gigatoken 0.2.2-aarch64-linux → 0.4.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4cc04817cf7e36afff107fbe7e5fd71d856c733d4afd57c5000ebd977006c6d4
-  data.tar.gz: 17ece4ff18d0d63d1d3d6d1443ee037c6bb96310e2b6abe1fa1e4bb6fbf0b421
+  metadata.gz: b71bf2d5bc4c68c369507b7582cd539284e4106a79bc366c8f88016fd3e01475
+  data.tar.gz: 1a1137fd492cce3db3aebfbed54c95049b091cbf3ceeefa17d28a624b64b4765
 SHA512:
-  metadata.gz: cbeeda4b3288656179f675beb7a7dfcb998ac068be31e794c11fb3e3c80879a6f1492bcb656ca8d03b1e6084bb2b312cb68efabdd889611c7fe47c3f5558e925
-  data.tar.gz: 99aa1445f17e51eb6aa746d12d18357c3e86522925487f2c60074a833f873232ff6d38e47d8c73f320afa5337a9d19b232e1b81029d70851d36dc5d6425e563e
+  metadata.gz: bd326b7fa3b0b7c5b13570362700caf963e95630b08882bb227d7da7a4ac342db73e132f5ea286de861e39a0a30b3d06e7b92885d22d80cb489be4a343693931
+  data.tar.gz: 37ee8f34abf50eccb99b15db9f0fce8fcece3a3086b12a342cf06dbcde552a5506a3586ee448248bc947134926c1b7964607411c55a9c84ab1c0f91885eca797

data/README.md

@@ -15,7 +15,7 @@ Zero-copy Ruby bindings for [marcelroed/gigatoken](https://github.com/marcelroed
 
 Mac Studio M4 Max, OpenWebText, GPT-2 tokenizer; every library produces the same tokenization, gigatoken just does it faster. The Python row includes a fix for [marcelroed/gigatoken#38](https://github.com/marcelroed/gigatoken/issues/38) — a hidden memcpy in `shrink_to_fit()` we found while chasing the last of the Ruby–Python gap and sent upstream (one-line fix; without it the wheel lands around 7.4 GB/s).
 
-**340x faster** than the fastest existing Ruby gem (tiktoken_ruby) and **1,050x faster** than the tokenizers gem. Full methodology & exact counts: [docs/rb/benchmarks.md](docs/rb/benchmarks.md).
+**340x faster** than the fastest existing Ruby gem (tiktoken_ruby) and **1,050x faster** than the tokenizers gem. Full methodology & exact counts: [docs/explanation/benchmarks.md](docs/explanation/benchmarks.md).
 
 ## Install
 
@@ -57,9 +57,9 @@ Gigatoken::Tokenizer.from_tiktoken("cl100k_base.tiktoken", pretokenizer: "gpt4",
 Gigatoken::Tokenizer.from_json(File.binread("tokenizer.json"))
 ```
 
-A `.tiktoken` file holds mergeable ranks only — its pretokenization scheme and special tokens live in the code that defines the encoding, not the file — so `pretokenizer:` is a required keyword (one of `Gigatoken::Native.pretokenizer_names`: `gpt2`/`r50k`, `gpt4`/`cl100k`, `qwen2`, `qwen35`, `olmo3`, `deepseek_v3`, `o200k`, `nemotron`, `kimi`) and `special_tokens:` defaults to none. Nothing is guessed: an unknown scheme raises `Gigatoken::Error` naming the valid ones, and `Tokenizer.load` on a `.tiktoken` path with no `pretokenizer:` raises rather than silently picking one.
+A `.tiktoken` file holds mergeable ranks only — its pretokenization scheme and special tokens live in the code that defines the encoding, not the file — so `pretokenizer:` is a required keyword (one of `Gigatoken::Native.pretokenizer_names`: `gpt2`/`r50k`, `gpt4`/`cl100k`, `qwen2`, `qwen35`, `olmo3`, `deepseek_v3`, `o200k`, `nemotron`, `kimi`) and `special_tokens:` defaults to none. Nothing is guessed: an unknown scheme raises `Gigatoken::ModelError` naming the valid ones, and `Tokenizer.load` on a `.tiktoken` path with no `pretokenizer:` raises rather than silently picking one.
 
-SentencePiece-BPE models (Llama, Gemma, Mistral — any `tokenizer.json` with `byte_fallback: true`) load through the same entry points and pick the right backend automatically. One difference: the SentencePiece core decodes text, so it validates input and raises `Gigatoken::Error` on invalid UTF-8 instead of guessing.
+SentencePiece-BPE models (Llama, Gemma, Mistral — any `tokenizer.json` with `byte_fallback: true`) load through the same entry points and pick the right backend automatically. One difference: the SentencePiece core decodes text, so it validates input and raises `Gigatoken::InputError` on invalid UTF-8 instead of guessing.
 
 ### Packaged tiktoken encodings
 
@@ -71,7 +71,7 @@ Gigatoken::Tokenizer.load("cl100k_base")          # same result — packaged nam
                                                   # checked before the Hub-repo-id shape
 ```
 
-`p50k_base` and `p50k_edit` are deliberately not packaged: both load the same non-dense ranks (id 50256 is left free for `<|endoftext|>`), and the rank loader rejects non-dense ranks. Both entry points raise `Gigatoken::Error` explaining that, rather than `load` falling through to the Hub for a name that happens to look like a legacy repo id.
+`p50k_base` and `p50k_edit` are deliberately not packaged: both load the same non-dense ranks (id 50256 is left free for `<|endoftext|>`), and the rank loader rejects non-dense ranks. Both entry points raise `Gigatoken::ModelError` explaining that, rather than `load` falling through to the Hub for a name that happens to look like a legacy repo id.
 
 `encode` on a packaged tokenizer honours its special-token table: text containing `<|endoftext|>` (or any other literal special-token string) is tokenized as that special token, not as ordinary text. That matches [`tiktoken`](https://github.com/openai/tiktoken)'s `encode_with_special_tokens`, not its plain `encode`, which treats the same literal as ordinary text — a difference worth knowing if you're tokenizing untrusted input. To get tiktoken's non-honouring default instead, build a tokenizer from the same rank file with an empty special-token table:
 
@@ -117,9 +117,15 @@ packed.token_count  # => total tokens
 packed[3]           # => document 3's ids as an Array, on demand
 ```
 
+### Errors
+
+Everything the library raises is a `Gigatoken::Error`, never a raw Rust panic — and, under it, one of three: `Gigatoken::ModelError` when a tokenizer can't be loaded (bad or hostile JSON, a missing file or directory, an unknown or unpackable encoding name, a malformed `.tiktoken`), `Gigatoken::InputError` when a document or an id can't be taken (a String that won't transcode, invalid UTF-8 on the SentencePiece path, an id outside the vocabulary in `decode`), and `Gigatoken::HubError` for everything `Gigatoken::Hub` raises (HTTP status, transport, timeout, the repo-id and header checks). `rescue Gigatoken::Error` catches all three.
+
+`encode` and `encode_batch` honour the String's encoding tag: UTF-8, US-ASCII and binary go through byte-wise, and a real non-UTF-8 encoding (ISO-8859-1, UTF-16LE, …) is transcoded first, so it gives the same ids as the same text read as UTF-8. See [the reference](docs/reference/tokenizer.md#input-encodings).
+
 ### Async
 
-`encode_batch` and `encode_files` release the GVL for the whole encode; the parallelism runs on the engine's rayon pool, not Ruby threads. Under `Async`, give the fiber scheduler a worker pool (`ASYNC_SCHEDULER_WORKER_POOL=true`) and the calling fiber yields to the reactor too. Design notes: [docs/rb/async.md](docs/rb/async.md).
+`encode_batch` and `encode_files` release the GVL for the whole encode; the parallelism runs on the engine's rayon pool, not Ruby threads. Under `Async`, give the fiber scheduler a worker pool (`ASYNC_SCHEDULER_WORKER_POOL=true`) and the calling fiber yields to the reactor too. Design notes: [docs/how-to/run-under-async.md](docs/how-to/run-under-async.md).
 
 ## CLI
 
@@ -138,6 +144,16 @@ gigatoken bench lib/gigatoken/encodings/cl100k_base.tiktoken README.md --pretoke
 
 Leave it off against a `.tiktoken` TOKENIZER and both commands raise `Gigatoken::Error` naming the valid schemes instead of crashing; for every other TOKENIZER shape (`tokenizer.json`, a packaged name, a Hub repo id) `--pretokenizer` is accepted but ignored.
 
+## Documentation
+
+In-depth docs live under [`docs/`](docs/README.md), organized by
+[Diátaxis](https://diataxis.fr/):
+
+- **Tutorial:** [Getting started](docs/tutorials/getting-started.md)
+- **How-to:** [Load a tokenizer](docs/how-to/load-a-tokenizer.md), [Tokenize files](docs/how-to/tokenize-files.md), [Packed results](docs/how-to/use-packed-results.md), [Cache budget](docs/how-to/tune-the-cache-budget.md), [Async](docs/how-to/run-under-async.md), [Measure](docs/how-to/measure-time-and-allocations.md)
+- **Reference:** [`Tokenizer`](docs/reference/tokenizer.md), [`PackedResult`](docs/reference/packed-result.md), [File sources](docs/reference/file-sources.md), [Encodings and settings](docs/reference/encodings-and-settings.md), [CLI](docs/reference/cli.md)
+- **Explanation:** [Benchmarks](docs/explanation/benchmarks.md), [Allocations](docs/explanation/allocations.md), [Async design](docs/explanation/async-design.md)
+
 ## Development
 
 ```bash
@@ -145,6 +161,7 @@ bundle install
 bundle exec rake compile    # native extension (Rust nightly, via rust-toolchain.toml)
 bundle exec rspec
 bundle exec standardrb
+ruby -Ilib bench/operations.rb   # every operation: i/s, objects and malloc per call
 ```
 
 The Ruby layer is fiber-first throughout — no `Thread`, no `Mutex`; all parallelism lives in the core's rayon pool. CI runs ubuntu + macos × Ruby 3.3/3.4/4.0, and `release.yml` cross-builds the precompiled native gems (arm64-darwin, x86_64-linux, aarch64-linux).

data/lib/gigatoken/cli/bench.rb

@@ -20,30 +20,36 @@ module Gigatoken
       option :pretokenizer, desc: "pretokenizer scheme, required when TOKENIZER is a .tiktoken file (one of #{Native.pretokenizer_names.join(", ")}); ignored otherwise"
 
       def call(tokenizer:, files:, doc_separator: nil, limit_bytes: "none", parallel: true, packed: false, pretokenizer: nil, **)
+        Support.check_usage!(files, doc_separator)
         limit = Support.parse_size(limit_bytes)
         out.puts "#{label("cpu")}: #{Support.cpu_info}"
 
         gt_tokenizer = Support.load_tokenizer(tokenizer, pretokenizer: pretokenizer)
 
+        # Only the batch path materializes the documents; the native paths
+        # leave this nil and count their bytes off the clock below.
+        docs = nil
         start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         if packed
           encoded = gt_tokenizer.encode_files(Support.text_file_source(files, doc_separator), parallel: parallel, packed: true)
-          n_bytes = files.sum { |file| File.size(file) }
           n_tokens = encoded.token_count
         elsif parallel
           docs = Support.subset_docs(Support.split_docs(files, doc_separator), limit)
           encoded = gt_tokenizer.encode_batch(docs)
-          n_bytes = docs.sum(&:bytesize)
           n_tokens = encoded.sum(&:length)
         else
           encoded = gt_tokenizer.encode_files(Support.text_file_source(files, doc_separator), parallel: false)
-          n_bytes = files.sum { |file| File.size(file) }
           n_tokens = encoded.sum(&:length)
         end
         seconds = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
 
+        # The throughput is over the bytes encoded, which for a compressed
+        # file are its decompressed bytes. Counting those means reading the
+        # file, so the native paths count off the clock; the batch path
+        # already holds the documents it encoded.
+        n_bytes = docs ? docs.sum(&:bytesize) : Support.input_bytesize(files)
         out.puts report("gigatoken", seconds, n_bytes, n_tokens)
-      rescue Gigatoken::Error => e
+      rescue Gigatoken::Error, SystemCallError => e
         err.puts "error: #{e.message}"
         exit(1)
       end

data/lib/gigatoken/cli/support.rb

@@ -4,16 +4,29 @@ require "etc"
 
 module Gigatoken
   module CLI
-    # Helpers shared by the bench and validate commands: tokenizer loading,
-    # byte-size parsing, document splitting, and CPU identification.
+    # Helpers shared by the bench and validate commands: argument checking,
+    # tokenizer loading, byte-size parsing, document splitting, and CPU
+    # identification.
     module Support
       SIZE_UNITS = {"" => 1, "k" => 10**3, "m" => 10**6, "g" => 10**9, "t" => 10**12}.freeze
       private_constant :SIZE_UNITS
 
-      SIZE_PATTERN = /\A\s*(\d+(?:\.\d+)?)\s*([kmgt]?)i?b?\s*\z/i
+      # "KiB" and friends are binary, as everywhere else that spells the i.
+      BINARY_SIZE_UNITS = {"" => 1, "k" => 2**10, "m" => 2**20, "g" => 2**30, "t" => 2**40}.freeze
+      private_constant :BINARY_SIZE_UNITS
+
+      SIZE_PATTERN = /\A\s*(\d+(?:\.\d+)?)\s*([kmgt]?)(i?)b?\s*\z/i
       private_constant :SIZE_PATTERN
 
       class << self
+        # The argument shapes dry-cli itself lets through: FILES declared
+        # `required: true` still arrives empty, and an empty separator would
+        # split every byte into its own document.
+        def check_usage!(files, separator)
+          raise Gigatoken::Error, "FILES is required: name at least one file to encode" if files.empty?
+          raise Gigatoken::Error, "--doc-separator cannot be empty" if separator == ""
+        end
+
         # Load TOKENIZER: a tokenizer.json path/directory, a packaged
         # tiktoken encoding name, a HuggingFace repo id, or a .tiktoken file
         # — see Gigatoken::Tokenizer.load. `pretokenizer:` is forwarded
@@ -23,15 +36,17 @@ module Gigatoken
           Gigatoken::Tokenizer.load(spec, pretokenizer: pretokenizer)
         end
 
-        # Parse a decimal byte size like "100MB", "2.5GB", or "1000000";
-        # "none"/"unlimited" means no limit.
+        # Parse a byte size like "100MB", "2.5GB", "64KiB" or "1000000" —
+        # decimal units unless the prefix spells the i, which makes it
+        # binary; "none"/"unlimited" means no limit.
         def parse_size(text)
           return nil if ["none", "unlimited"].include?(text.strip.downcase)
 
           match = SIZE_PATTERN.match(text)
           raise Gigatoken::Error, "cannot parse size #{text.inspect}; expected something like 100MB (or 'none')" unless match
 
-          (match[1].to_f * SIZE_UNITS.fetch(match[2].downcase)).to_i
+          units = match[3].empty? ? SIZE_UNITS : BINARY_SIZE_UNITS
+          (match[1].to_f * units.fetch(match[2].downcase)).to_i
         end
 
         # A Native::TextFileSource for FILES, split on `separator` when
@@ -42,15 +57,23 @@ module Gigatoken
 
         # Whole files as raw bytes, one document per file, or (with a
         # separator) the separator-split pieces of each file in order, empty
-        # documents skipped.
+        # documents skipped. Compressed files are decompressed first, as the
+        # native file sources do, so both paths split the same bytes.
         def split_docs(files, separator)
-          raws = files.map { |file| File.binread(file.to_s) }
+          raws = files.map { |file| read_decompressed(file.to_s) }
           return raws if separator.nil?
 
           sep = separator.b
           raws.flat_map { |raw| raw.split(sep).reject(&:empty?) }
         end
 
+        # The bytes the tokenizer actually sees for FILES — a compressed
+        # file's decompressed size, not its size on disk — so throughput is
+        # reported over the input that was tokenized.
+        def input_bytesize(files)
+          files.sum { |file| read_decompressed(file.to_s).bytesize }
+        end
+
         # The prefix of `docs` totalling at most `limit_bytes`, byte-
         # truncating the final document to fill the budget. Unlike a
         # text-comparison tool, gigatoken encodes raw bytes and does not
@@ -90,6 +113,15 @@ module Gigatoken
 
         private
 
+        # One file's bytes, decompressed. `Native.read_input` is the core's
+        # own decoder — the one the native file sources load through — so
+        # `.gz`, `.zst`/`.zstd` and plain files are detected and read here
+        # exactly as they are on the other side of `validate`, and an
+        # unreadable file raises Gigatoken::Error naming it.
+        def read_decompressed(path)
+          Gigatoken::Native.read_input(path)
+        end
+
         def darwin_cpu_info
           name = sysctl("machdep.cpu.brand_string")
           [name, sysctl_int("hw.physicalcpu"), sysctl_int("hw.packages")]

data/lib/gigatoken/cli/validate.rb

@@ -20,6 +20,7 @@ module Gigatoken
       option :pretokenizer, desc: "pretokenizer scheme, required when TOKENIZER is a .tiktoken file (one of #{Native.pretokenizer_names.join(", ")}); ignored otherwise"
 
       def call(tokenizer:, files:, doc_separator: nil, pretokenizer: nil, **)
+        Support.check_usage!(files, doc_separator)
         gt_tokenizer = Support.load_tokenizer(tokenizer, pretokenizer: pretokenizer)
 
         via_files = gt_tokenizer.encode_files(Support.text_file_source(files, doc_separator))
@@ -38,7 +39,7 @@ module Gigatoken
         end
 
         out.puts "validation OK: #{via_files.length} documents match"
-      rescue Gigatoken::Error => e
+      rescue Gigatoken::Error, SystemCallError => e
         err.puts "error: #{e.message}"
         exit(1)
       end

data/lib/gigatoken/encodings.rb

@@ -40,6 +40,10 @@ module Gigatoken
     HARMONY_RESERVED_TAIL = (200013..201087).to_h { |id| ["<|reserved_#{id}|>", id] }.freeze
     private_constant :HARMONY_RESERVED_TAIL
 
+    # Deep-frozen: entries, their `special_tokens` tables and the `rank_file`
+    # paths. `Tokenizer#special_tokens` hands the registry's own Hash back to
+    # callers, so anything less lets one caller's poke rewrite what every
+    # later `from_encoding` in the process loads.
     REGISTRY = {
       "r50k_base" => {
         rank_file: File.join(DATA_DIR, "r50k_base.tiktoken"),
@@ -67,7 +71,7 @@ module Gigatoken
         pretokenizer: "o200k",
         special_tokens: HARMONY_HEAD_TOKENS.merge(HARMONY_RESERVED_TAIL).freeze
       }
-    }.freeze
+    }.each_value { |encoding| encoding.each_value(&:freeze).freeze }.freeze
     private_constant :REGISTRY
 
     # The packaged encoding names — the single source error messages naming
@@ -88,15 +92,16 @@ module Gigatoken
 
     class << self
       # The {rank_file:, pretokenizer:, special_tokens:} registered for a
-      # packaged encoding name, or nil.
+      # packaged encoding name, or nil. Names are Strings or Symbols, as
+      # Tokenizer.load accepts both.
       def [](name)
-        REGISTRY[name]
+        REGISTRY[name.to_s]
       end
 
       # Why `name` can't be packaged, or nil when there's no reason on
       # record (it's either packaged, or simply not one gigatoken knows of).
       def unpackable_reason(name)
-        UNPACKABLE_REASONS[name]
+        UNPACKABLE_REASONS[name.to_s]
       end
     end
   end

data/lib/gigatoken/hub.rb

@@ -2,6 +2,7 @@
 
 require "async"
 require "async/http"
+require "async/http/proxy"
 require "fileutils"
 require "pathname"
 
@@ -32,6 +33,39 @@ module Gigatoken
     MAX_REDIRECTS = 10
     private_constant :MAX_REDIRECTS
 
+    # Connect/read timeout in seconds, and the bound on the request phase —
+    # huggingface_hub's HF_HUB_ETAG_TIMEOUT / HF_HUB_DOWNLOAD_TIMEOUT
+    # default.
+    DEFAULT_TIMEOUT = 10
+    private_constant :DEFAULT_TIMEOUT
+
+    # A "." or ".." path segment: the traversal that must never reach a URL
+    # or the cache, wherever it comes from.
+    DOT_SEGMENT = /\A\.\.?\z/
+    private_constant :DOT_SEGMENT
+
+    # Everything outside RFC 3986's unreserved set, which is what
+    # huggingface_hub's `quote` percent-encodes.
+    RESERVED = /[^A-Za-z0-9\-._~]/
+    private_constant :RESERVED
+
+    # How a request, or the body read that follows it, fails underneath
+    # async-http: a connect/read timeout, a refused or reset connection, a
+    # proxy refusing the CONNECT tunnel, DNS resolution, a body cut short, a
+    # malformed endpoint, TLS. All of them reach the caller as
+    # Gigatoken::HubError.
+    TRANSPORT_ERRORS = [
+      Async::TimeoutError,
+      Async::HTTP::Proxy::ConnectFailure,
+      IOError,
+      SocketError,
+      SystemCallError,
+      URI::InvalidURIError,
+      Protocol::HTTP::Error,
+      OpenSSL::SSL::SSLError
+    ].freeze
+    private_constant :TRANSPORT_ERRORS
+
     class << self
       # Whether `name` is shaped like a HuggingFace Hub repo id: `org/name`,
       # or a bare legacy repo name like `gpt2`. At most one slash, and not
@@ -99,15 +133,50 @@ module Gigatoken
         revision.match?(/\A[0-9a-f]{40}\z/)
       end
 
+      # The Hub endpoint, resolved like huggingface_hub does it: HF_ENDPOINT,
+      # then https://huggingface.co.
+      def default_endpoint
+        env("HF_ENDPOINT") || DEFAULT_ENDPOINT
+      end
+
+      # Whether `value` is usable as a URL path and a cache path component:
+      # not empty, not absolute, no NUL byte, no "." or ".." segment.
+      # huggingface_hub rejects the same traversals in validate_repo_id.
+      def safe_component?(value)
+        !value.empty? && !value.include?("\0") && !value.start_with?("/") &&
+          value.split("/", -1).none? { |segment| segment.match?(DOT_SEGMENT) }
+      end
+
+      # The proxy URL the environment names for a `scheme` request to
+      # `hostname`, or nil: http_proxy/https_proxy, lowercase spelling
+      # first, suppressed by a matching no_proxy entry — what requests does,
+      # and so what huggingface_hub inherits.
+      def proxy_url(scheme, hostname)
+        url = env("#{scheme}_proxy") || env("#{scheme.upcase}_PROXY")
+        url unless url.nil? || no_proxy?(hostname)
+      end
+
       private
 
+      # no_proxy is a comma-separated list of host suffixes, or "*" for
+      # everything.
+      def no_proxy?(hostname)
+        host = hostname.downcase
+        (env("no_proxy") || env("NO_PROXY")).to_s.split(",").any? do |entry|
+          entry = entry.strip.downcase.delete_prefix(".")
+          next true if entry == "*"
+
+          !entry.empty? && (host == entry || host.end_with?(".#{entry}"))
+        end
+      end
+
       def env(key)
         value = ENV[key]
         value unless value.nil? || value.empty?
       end
 
       def word_part?(part, first_alnum:)
-        return false if part.nil? || part.empty?
+        return false if part.nil? || part.empty? || part.match?(DOT_SEGMENT)
 
         first_ok = first_alnum ? part[0].match?(/[A-Za-z0-9]/) : word_char?(part[0])
         first_ok && part[1..].chars.all? { |c| word_char?(c) }
@@ -125,15 +194,28 @@ module Gigatoken
 
     # @parameter endpoint [String] the Hub endpoint to fetch from — override
     #   for pointing at a local server in tests (dependency injection, not a
-    #   mock).
-    def initialize(endpoint: DEFAULT_ENDPOINT)
+    #   mock); defaults to Hub.default_endpoint (HF_ENDPOINT, then
+    #   huggingface.co).
+    # @parameter timeout [Numeric] connect/read timeout in seconds, applied
+    #   to every request and to the request phase as a whole.
+    def initialize(endpoint: self.class.default_endpoint, timeout: DEFAULT_TIMEOUT)
       @endpoint = endpoint.chomp("/")
-      @internet = Async::HTTP::Internet.new
+      @timeout = timeout
     end
 
     # Path of `filename` from Hub repo `repo_id` at `revision`, served from
-    # the standard HF cache, downloading into it first when absent.
+    # the standard HF cache, downloading into it first when absent. The
+    # three caller-supplied components are checked before any request or
+    # filesystem access: one of them carrying `..` would otherwise read and
+    # overwrite files outside the cache.
     def hub_file(repo_id, filename = "tokenizer.json", revision: "main")
+      {"repo id" => repo_id, "filename" => filename, "revision" => revision}.each do |what, value|
+        next if self.class.safe_component?(value)
+
+        raise HubError, "#{what} #{value.inspect}: must not be empty or absolute, " \
+          "or contain a NUL byte or a \".\" or \"..\" path segment"
+      end
+
       self.class.cached_file(repo_id, filename, revision) ||
         Sync { fetch(repo_id, filename, revision) }
     end
@@ -145,31 +227,127 @@ module Gigatoken
     # recording the branch ref so later lookups (ours and
     # huggingface_hub's) resolve it.
     def fetch(repo_id, filename, revision)
-      url = "#{@endpoint}/#{repo_id}/resolve/#{revision}/#{filename}"
+      clients = []
+      url = resolve_url(repo_id, filename, revision)
       token = self.class.hf_token
-      response = @internet.get(url, auth_headers(token))
+      headers = auth_headers(token)
+      response = get(url, headers, clients)
       # Unlisted headers parse as a Header::Generic (an Array of values);
       # x-repo-commit is always a single value, so flatten it to a String.
       commit = response.headers["x-repo-commit"]&.to_s
 
-      # Redirects are followed by hand: resolve/ URLs answer with the
-      # x-repo-commit header and a redirect to a CDN for LFS files, and the
-      # Authorization header must not travel to the other host.
+      # Redirects are followed by hand: a resolve/ URL answers an LFS file
+      # with a redirect to a CDN, a renamed repo with one to its new name,
+      # and both headers below need a rule of their own across the hop.
       hops = 0
       while (300...400).cover?(response.status)
-        ensure_ok!(url, response.status, !!token)
-        hops += 1
-        raise Error, "#{url}: too many redirects" if hops > MAX_REDIRECTS
-
-        location = response.headers["location"] ||
-          raise(Error, "#{url}: redirect with no Location header")
+        location = response.headers["location"]
         response.close
-        url = absolutize(location, url)
-        response = @internet.get(url, {"user-agent" => "gigatoken"})
+        raise HubError, "#{url}: redirect with no Location header" unless location
+        raise HubError, "#{url}: too many redirects" if (hops += 1) > MAX_REDIRECTS
+
+        target = absolutize(location, url)
+        # A renamed repo answers with a same-origin redirect that still needs
+        # the token; the LFS CDN elsewhere authenticates by signed URL and
+        # must never see it — huggingface_hub drops the header on the same
+        # rule.
+        headers = auth_headers(nil) unless same_origin?(target, url)
+        url = target
+        response = get(url, headers, clients)
+        # An LFS file carries x-repo-commit on the resolve/ hop; a renamed
+        # repo carries it only on the hop that finally answers 200.
+        commit ||= response.headers["x-repo-commit"]&.to_s
+      end
+      ensure_ok!(url, response, !!token)
+      ensure_commit!(url, commit)
+
+      write_to_cache(repo_id, filename, revision, commit, response)
+    rescue *TRANSPORT_ERRORS => e
+      raise HubError, "#{url}: #{e.message} (#{e.class})"
+    ensure
+      close_all(response, clients)
+    end
+
+    # Release everything the fetch holds, in the one place every exit passes
+    # through. Order matters: an unread body keeps its connection checked
+    # out, and Async::HTTP::Client#close waits for its pool to drain, so the
+    # response goes first and the clients innermost-first — a tunnel client's
+    # connection is held by the proxy client opened under it. Bounded, and
+    # deaf to the ways a broken connection fails to close: a connection some
+    # failure left mid-stream would otherwise stall the drain, and with it
+    # the Sync this all runs inside, for good. A leaked socket is worth less
+    # than the caller's result or exception.
+    def close_all(response, clients)
+      Async::Task.current.with_timeout(@timeout) do
+        response&.close
+        clients.reverse_each(&:close)
       end
-      ensure_ok!(url, response.status, !!token)
+    rescue *TRANSPORT_ERRORS
+      nil
+    end
+
+    # `endpoint/repo/resolve/revision/filename`, percent-encoded the way
+    # huggingface_hub's `quote` does it: `revision` whole (`safe=""`), so
+    # `refs/pr/1` travels as `refs%2Fpr%2F1`, while the repo id and the
+    # filename keep their slashes.
+    def resolve_url(repo_id, filename, revision)
+      "#{@endpoint}/#{escape_path(repo_id)}/resolve/#{escape(revision)}/#{escape_path(filename)}"
+    end
 
-      write_to_cache(repo_id, filename, revision, commit || revision, response)
+    def escape_path(value)
+      value.split("/", -1).map { |segment| escape(segment) }.join("/")
+    end
+
+    def escape(value)
+      value.gsub(RESERVED) { |char| char.bytes.map { |byte| format("%%%02X", byte) }.join }
+    end
+
+    # GET `url`, through the proxy the environment names for it when there
+    # is one: an http request travels to the proxy with the absolute URI in
+    # its request line, an https one through a CONNECT tunnel — how requests,
+    # and so huggingface_hub, routes them. The clients stay open (the body
+    # is still to be streamed); #fetch closes them.
+    def get(url, headers, clients)
+      endpoint = endpoint_for(url)
+      proxy = self.class.proxy_url(endpoint.scheme, endpoint.hostname)
+      proxy &&= endpoint_for(proxy)
+
+      client =
+        if proxy.nil?
+          open_client(endpoint, clients)
+        elsif endpoint.secure?
+          # https tunnels through the proxy with CONNECT, then speaks TLS to
+          # the origin as if it had connected to it directly.
+          open_client(open_client(proxy, clients).proxied_endpoint(endpoint), clients)
+        else
+          open_client(proxy, clients)
+        end
+      # An http proxy is addressed with the absolute URI in the request line;
+      # a direct or tunnelled request carries just the path.
+      target = (proxy && !endpoint.secure?) ? url : endpoint.path
+
+      request = Protocol::HTTP::Request["GET", target, headers, scheme: endpoint.scheme, authority: endpoint.authority]
+      # A CONNECT tunnel's socket carries no timeout of its own, so the
+      # request phase is bounded here whichever way it was routed; the body
+      # then streams under the endpoint's own connect/read timeout.
+      Async::Task.current.with_timeout(@timeout) { client.call(request) }
+    end
+
+    # A malformed URL comes back as URI::InvalidURIError, one that cannot be
+    # routed (no scheme or host) as ArgumentError; both mean the same thing
+    # to the caller, and neither is worth a backtrace.
+    def endpoint_for(url)
+      Async::HTTP::Endpoint.parse(url, timeout: @timeout)
+    rescue ArgumentError => e
+      raise HubError, "#{url}: #{e.message} (#{e.class})"
+    end
+
+    # A client for one hop, remembered in `clients` so #fetch can close it
+    # once the body is written. retries: 1 — a client built for this hop has
+    # no stale pooled connection for a retry to rescue, and async-http's
+    # default of 3 would pay @timeout three times over.
+    def open_client(endpoint, clients)
+      Async::HTTP::Client.new(endpoint, retries: 1).tap { |client| clients << client }
     end
 
     def auth_headers(token)
@@ -192,51 +370,75 @@ module Gigatoken
       rescue
         FileUtils.rm_f(tmp)
         raise
-      ensure
-        response.close
       end
       File.rename(tmp, target)
 
-      if !self.class.commit_hash?(revision) && revision != commit
-        refs_dir = repo_dir.join("refs")
-        FileUtils.mkdir_p(refs_dir)
-        File.write(refs_dir.join(revision), commit)
+      # A nested revision like refs/pr/1 is a nested ref file, so its parent
+      # has to exist — huggingface_hub mkdir -p's the same path.
+      if revision != commit
+        ref_path = repo_dir.join("refs", revision)
+        FileUtils.mkdir_p(ref_path.dirname)
+        File.write(ref_path, commit)
       end
 
       target
     end
 
-    def ensure_ok!(url, status, had_token)
+    # Raise on a non-success status. The unread body is left to #close_all,
+    # which every exit from #fetch passes through: it keeps the HTTP/1.x
+    # connection — and the Sync around it — alive until it is closed, so the
+    # exception would otherwise never reach the caller.
+    def ensure_ok!(url, response, had_token)
+      status = response.status
       return if (200...400).cover?(status)
 
       case status
       when 404
-        raise Error, "#{url}: HTTP 404 — no such repo with that file, and no such local file either"
+        raise HubError, "#{url}: HTTP 404 — no such repo with that file, and no such local file either"
       when 401, 403
         token_note = had_token ? "the request used the discovered token" : "no token was found"
-        raise Error,
+        raise HubError,
           "#{url}: HTTP #{status} — the repo may be private or gated (#{token_note}; set HF_TOKEN or run " \
           "`hf auth login`, and accept the repo's terms on huggingface.co if it is gated)"
       else
-        raise Error, "#{url}: HTTP #{status}"
+        raise HubError, "#{url}: HTTP #{status}"
       end
     end
 
+    # The snapshot directory is named by a server-controlled header, so only
+    # a real commit hash may become one: anything else would write the body
+    # wherever the header points. A missing header also means the endpoint
+    # isn't a Hub, whose snapshot would never be found again.
+    def ensure_commit!(url, commit)
+      return if self.class.commit_hash?(commit.to_s)
+
+      raise HubError, "#{url}: response is missing a usable x-repo-commit header (#{commit.inspect}) — it does not " \
+        "seem to be served by a HuggingFace Hub endpoint; if HF_ENDPOINT is set, check that it points to a " \
+        "Hub-compatible endpoint, and otherwise check your firewall and proxy settings"
+    end
+
     # A redirect Location resolved against the request URL: absolute URLs
     # pass through, host-relative (`/x/y`) and path-relative ones join the
     # base.
     def absolutize(location, base)
       return location if location.include?("://")
 
-      origin_end = base.index("://") ? base.index("://") + 3 : 0
-      origin_end = base.index("/", origin_end) || base.length
+      base_origin = origin(base)
+      return "#{base_origin}#{location}" if location.start_with?("/")
 
-      if location.start_with?("/")
-        "#{base[0...origin_end]}#{location}"
-      else
-        dir_end = base.rindex("/") || base.length
-        "#{base[0...[dir_end, origin_end].max]}/#{location}"
-      end
+      dir_end = base.rindex("/") || base.length
+      "#{base[0...[dir_end, base_origin.length].max]}/#{location}"
+    end
+
+    # Scheme and authority of a URL — everything before its path. Two URLs
+    # sharing one may pass the Authorization header between them.
+    def origin(url)
+      scheme_end = url.index("://")
+      url[0...(url.index("/", scheme_end ? scheme_end + 3 : 0) || url.length)]
+    end
+
+    def same_origin?(url, other)
+      origin(url).casecmp?(origin(other))
     end
   end
 end

data/lib/gigatoken/packed_result.rb

@@ -28,9 +28,17 @@ module Gigatoken
       lens.sum
     end
 
-    # Array of token ids for document `i`, materialized on demand.
-    def [](i)
-      buffer.get_values(Array.new(lens[i], :u32), @offsets[i] * 4)
+    # Array of token ids for document `i`, materialized on demand; negative
+    # indices count from the end, out-of-range ones give nil, and a
+    # non-Integer index is a TypeError, all like Array.
+    def [](index)
+      i = Integer.try_convert(index)
+      raise TypeError, "no implicit conversion of #{index.class} into Integer" if i.nil?
+
+      i += size if i.negative?
+      return unless i >= 0 && i < size
+
+      buffer.values(:u32, @offsets[i] * 4, lens[i])
     end
 
     def each
@@ -42,7 +50,7 @@ module Gigatoken
     # A ragged Array of Arrays, one per document — the same shape
     # `encode_batch`/`encode_files` return with `packed: false`.
     def to_a
-      each.to_a
+      Array.new(size) { |i| self[i] }
     end
   end
 end

data/lib/gigatoken/tokenizer.rb

@@ -10,18 +10,35 @@ module Gigatoken
     FILE_SOURCE_CLASSES = [Native::TextFileSource, Native::JsonlFileSource, Native::ParquetFileSource].freeze
     private_constant :FILE_SOURCE_CLASSES
 
+    # Encodings whose bytes reach the native call untouched. UTF-8 is checked
+    # by identity first — it is the hot path, see #encode — and these are the
+    # rest: US-ASCII already is UTF-8 bytes, and ASCII-8BIT is deliberately
+    # raw bytes. Anything else — ISO-8859-1, Windows-1252, UTF-16LE — is a
+    # real encoding whose bytes are not the text's UTF-8 bytes, so encoding it
+    # raw would give different ids than the same text read as UTF-8. (Invalid
+    # bytes in a UTF-8-tagged String stay raw: a documented difference from
+    # tiktoken, which rejects them.)
+    BYTEWISE_ENCODINGS = [Encoding::US_ASCII, Encoding::BINARY].freeze
+    private_constant :BYTEWISE_ENCODINGS
+
     # Load from in-memory tokenizer.json contents (String or bytes). Backed
     # by a BPETokenizer or a SentencePieceTokenizer, per the model's
-    # byte_fallback flag.
+    # byte_fallback flag. The document is parsed twice, deliberately: the Ruby
+    # parse runs first because JSON.parse's depth limit is what keeps hostile
+    # nesting away from the native parser (see parse_json), and it is also
+    # where the special-token table is read from.
     def self.from_json(data)
-      native = Native.load_hf_json(data)
-      new(native, special_tokens: special_tokens_from_json(data))
+      json = String.try_convert(data) or raise TypeError, "no implicit conversion of #{data.class} into String"
+      parsed = parse_json(json)
+      new(Native.load_hf_json(json), special_tokens: special_tokens_from(parsed))
     end
 
     # Load from a tokenizer.json path, or a directory containing one.
     def self.from_file(path)
-      path = File.join(path, "tokenizer.json") if File.directory?(path)
-      from_json(File.binread(path))
+      file = File.directory?(path) ? File.join(path, "tokenizer.json") : path.to_s
+      raise ModelError, "#{file.inspect}: no such file" unless File.file?(file)
+
+      from_json(File.binread(file))
     end
 
     # Load from a .tiktoken mergeable-ranks file. The file carries neither a
@@ -44,13 +61,13 @@ module Gigatoken
 
       reason = Encodings.unpackable_reason(name)
       detail = reason ? " — #{reason}" : ""
-      raise Error, "#{name.inspect}: not a packaged encoding#{detail} (packaged encodings: #{Encodings::NAMES.join(", ")})"
+      raise ModelError, "#{name.inspect}: not a packaged encoding#{detail} (packaged encodings: #{Encodings::NAMES.join(", ")})"
     end
 
     # Load tokenizer.json from HuggingFace Hub repo `repo_id` at `revision`
     # (downloaded directly; huggingface_hub is not required).
-    def self.from_hub(repo_id, revision: "main", hub: Hub.new)
-      from_file(hub.hub_file(repo_id, "tokenizer.json", revision: revision))
+    def self.from_hub(repo_id, revision: "main", hub: nil)
+      from_file((hub || Hub.new).hub_file(repo_id, "tokenizer.json", revision: revision))
     end
 
     # Load from any of the supported source shapes: an existing file or
@@ -67,11 +84,11 @@ module Gigatoken
     # here too, raising the same explanation from_encoding gives rather than
     # reaching the Hub — but only those; an unrecognized bare name like
     # "gpt2" still dispatches to the Hub.
-    def self.load(source, pretokenizer: nil, special_tokens: {}, revision: "main", hub: Hub.new)
+    def self.load(source, pretokenizer: nil, special_tokens: {}, revision: "main", hub: nil)
       source = source.to_s
       if source.end_with?(".tiktoken")
         unless pretokenizer
-          raise Error, "#{source.inspect}: a .tiktoken file carries no pretokenizer scheme of its own — " \
+          raise ModelError, "#{source.inspect}: a .tiktoken file carries no pretokenizer scheme of its own — " \
             "pass pretokenizer: (one of #{Native.pretokenizer_names.join(", ")})"
         end
         return from_tiktoken(source, pretokenizer: pretokenizer, special_tokens: special_tokens)
@@ -80,21 +97,44 @@ module Gigatoken
       return from_encoding(source) if Encodings::NAMES.include?(source) || Encodings.unpackable_reason(source)
       return from_hub(source, revision: revision, hub: hub) if Hub.looks_like_repo_id?(source)
 
-      raise Error, "#{source.inspect}: no such file or directory, not a .tiktoken path, and doesn't look like a HuggingFace Hub repo id"
+      raise ModelError, "#{source.inspect}: no such file or directory, not a .tiktoken path, and doesn't look like a HuggingFace Hub repo id"
+    end
+
+    # `data` is UTF-8 JSON whatever its encoding tag says (File.binread tags
+    # binary; a US-ASCII default_external tags that), so retag rather than let
+    # JSON.parse transcode from the tag; a UTF-8-tagged String needs no copy.
+    # JSON.parse's default max_nesting of 100 is the guard: the native parser
+    # is recursive with no depth limit, and deep enough nesting overflows its
+    # stack rather than raising.
+    def self.parse_json(data)
+      data = data.dup.force_encoding(Encoding::UTF_8) unless data.encoding == Encoding::UTF_8
+      JSON.parse(data)
+    rescue JSON::ParserError => e
+      raise ModelError, "failed to parse tokenizer JSON: #{e.message}"
     end
+    private_class_method :parse_json
 
-    def self.special_tokens_from_json(data)
-      added = JSON.parse(data.dup.force_encoding(Encoding::UTF_8))["added_tokens"] || []
+    def self.special_tokens_from(parsed)
+      added = parsed["added_tokens"] || []
       added.each_with_object({}) { |t, h| h[t["content"]] = t["id"] if t["special"] }
     end
-    private_class_method :special_tokens_from_json
+    private_class_method :special_tokens_from
 
+    # The table is frozen so `#special_tokens` can neither alias the
+    # deep-frozen registry's Hash nor a `from_tiktoken` caller's; an
+    # already-frozen one is safe to share as-is.
     def initialize(native, special_tokens: {})
       @native = native
-      @special_tokens = special_tokens
+      @special_tokens = special_tokens.frozen? ? special_tokens : special_tokens.dup.freeze
     end
 
+    # A String already tagged UTF-8 — every ordinary document — reaches the
+    # native call over one inline identity check. A helper frame here is
+    # measurable against the encode itself at document sizes this small, so
+    # the check is spelled out rather than delegated to #transcode?; anything
+    # else takes the slow path in #utf8.
     def encode(text)
+      text = utf8(text) unless text.is_a?(String) && text.encoding == Encoding::UTF_8
       @native.encode(text)
     end
 
@@ -103,6 +143,7 @@ module Gigatoken
     # token ids plus per-document lengths), avoiding the per-token Ruby
     # array materialization the ragged shape costs.
     def encode_batch(texts, packed: false)
+      texts = utf8_batch(texts)
       if packed
         PackedResult.new(*@native.encode_batch_packed(texts))
       else
@@ -150,5 +191,34 @@ module Gigatoken
     end
 
     attr_reader :special_tokens
+
+    private
+
+    # UTF-8 first and by identity, so the batch walk below costs the same one
+    # comparison per document that #encode costs; the list is only consulted
+    # for the encodings that aren't it.
+    def transcode?(text)
+      text.is_a?(String) && text.encoding != Encoding::UTF_8 && !BYTEWISE_ENCODINGS.include?(text.encoding)
+    end
+
+    # A transcode that can't be done — a dummy encoding like UTF-7, bytes the
+    # tag doesn't allow, a character the target can't hold — is a fact about
+    # the document, not about the tokenizer, and reaches the caller as one.
+    def utf8(text)
+      transcode?(text) ? text.encode(Encoding::UTF_8) : text
+    rescue EncodingError => e
+      raise InputError, e.message
+    end
+
+    # The same rule per document, without copying the Array when — as in
+    # every UTF-8 batch — there is nothing to transcode. Elements are only
+    # type-checked, never coerced: a `to_str` object is left for the native
+    # side to convert under its own snapshot of the input.
+    def utf8_batch(texts)
+      array = Array.try_convert(texts)
+      return texts if array.nil? || array.none? { |text| transcode?(text) }
+
+      array.map { |text| utf8(text) }
+    end
   end
 end

data/lib/gigatoken/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Gigatoken
-  VERSION = "0.2.2"
+  VERSION = "0.4.0"
 end

data/lib/gigatoken.rb

@@ -4,9 +4,25 @@ require_relative "gigatoken/version"
 
 module Gigatoken
   # Raised for tokenizer load and encode failures surfaced from the native
-  # extension — never a raw Rust panic across the Ruby boundary.
+  # extension — never a raw Rust panic across the Ruby boundary. The base of
+  # the three below: rescue this to catch everything gigatoken raises.
+  # Anything narrower than the three has no class of its own — CLI usage
+  # errors and the odd leftover are this one directly.
   class Error < StandardError; end
 
+  # Everything Gigatoken::Hub raises: HTTP status, transport, timeout, repo-id
+  # / revision / filename / x-repo-commit validation.
+  class HubError < Error; end
+
+  # A document the tokenizer cannot take: an untranscodable or invalid-byte
+  # String, invalid UTF-8 on the SentencePiece path, an id outside the
+  # vocabulary in #decode.
+  class InputError < Error; end
+
+  # A tokenizer that cannot be loaded: bad or hostile JSON, a missing file or
+  # directory, an unknown or unpackable encoding name, a malformed .tiktoken.
+  class ModelError < Error; end
+
   class << self
     # The process-global encode-cache budget in bytes per worker (a parallel
     # batch encode may use up to workers x budget), applied to tokenizers of

data/rust-toolchain.toml

@@ -1,5 +1,5 @@
 [toolchain]
-channel = "nightly"
+channel = "nightly-2026-09-18"
 # Cross triples for the precompiled-gem builds (ruby-gem.yml). rustup's
 # toolchain-file auto-install is the only thing that provisions nightly
 # inside the rb-sys-dock containers, so the targets must be declared here —

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gigatoken
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.4.0
 platform: aarch64-linux
 authors:
 - Eric Jacobs
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async