@kindgi/bounds 0.0.0-stage → 0.1.8

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Kindgi Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,111 @@
-# Temporary Holding Version
+# @kindgi/bounds
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The limits a Kindgi server puts on what a tenant sends it, so that one
+tenant's input can't stall the server for the others:
+
+- **patterns:** their length, the engine they run on (V8's, or RE2's,
+  which runs in linear time, so no pattern can take exponential time), and
+  how many citations a `must-cite` guardrail may ask for;
+- **schemas:** their size and nesting depth before they're compiled, how
+  many compiled ones are kept and how much JSON they add up to, and how
+  long a tenant's schemas may spend compiling in any 60 seconds;
+- **templates:** liquidjs's parse, render-time and memory limits;
+- **bodies** read from endpoints a tenant names: their size, decompressed,
+  and the idle time between chunks (per event for `text/event-stream`);
+- **request bodies** the API reads: their size and JSON nesting depth.
+
+The process sets its bounds once, at boot. The Kindgi runtime sets
+`HOSTED_BOUNDS` under its hosted profile; anywhere else it's
+`SELF_HOSTED_BOUNDS`, today's behaviour with generous caps. A second call
+throws.
+
+```ts
+import { HOSTED_BOUNDS, configureTenantInputBounds, tenantInputBounds } from '@kindgi/bounds';
+
+configureTenantInputBounds(HOSTED_BOUNDS); // once, at boot
+tenantInputBounds().schemaMaxBytes;          // what the helpers read
+```
+
+Tests run with other bounds through `@kindgi/bounds/testing`'s
+`overrideTenantInputBounds`, which returns the function that puts them back.
+
+## Whose work it is
+
+A budget kept per tenant (`schemaCompileBudgetMs`) charges the tenant
+whose work is running. The server runs each request and each run inside
+`runAsTenant(tenantId, fn)`; `currentTenant()` reads it. The scope follows
+`fn`'s own awaits and callbacks (an `AsyncLocalStorage` context), never
+another request's. Outside any scope, at boot or in Kindgi's own work,
+nothing is charged.
+
+Which compiles count is the scope's `compiles`:
+
+- `recompiles`, the default: a schema compiled again after the cache
+  dropped it. The first compile of a schema the tenant published doesn't
+  count, so a restarted server compiles each tenant's schemas freely.
+  Once a tenant has compiled 4,096 different schemas in the process, every
+  compile counts.
+- `all`: every compile, the first included. A request that publishes,
+  deploys or registers schemas runs this way, since that's where new
+  schemas come from.
+
+```ts
+import { runAsTenant } from '@kindgi/bounds';
+
+await runAsTenant(tenantId, () => handle(request));
+await runAsTenant(tenantId, () => publish(request), { compiles: 'all' });
+```
+
+## Patterns
+
+`compileTenantPattern(source, flags)` compiles a pattern a tenant wrote, a
+JavaScript regular expression's source and flags, under the process's
+bounds. It answers `{ kind: 'ok', pattern }`, whose `test(input)` and
+`count(input, atMost)` give the answers of the `RegExp` it was written as
+(on RE2, but for the differences below), or `{ kind: 'refused', reason }`,
+saying why.
+
+```ts
+import { compileTenantPattern } from '@kindgi/bounds';
+
+const compiled = compileTenantPattern(config.pattern, config.flags);
+if (compiled.kind === 'refused') throw new Error(`config.pattern: ${compiled.reason}`);
+compiled.pattern.test(output);
+compiled.pattern.count(output, 3); // stops at 3
+```
+
+With `SELF_HOSTED_BOUNDS` a pattern runs on V8's engine, as `new RegExp`
+does, up to 8,192 characters with its flags. With `HOSTED_BOUNDS` it runs on
+[RE2](https://github.com/google/re2/wiki/Syntax) (the
+[re2js](https://www.npmjs.com/package/re2js) port), in time linear in its
+input, up to 1,024 characters. On RE2:
+
+- **Only what `RegExp` accepts:** a pattern V8 refuses is refused in V8's
+  words, even where RE2 would compile it (`(?i)`, `(?P<n>…)`, or with `u`,
+  `\pL` and `\x{41}`).
+- **Refused, by name:**
+  - what RE2 doesn't have: backreferences (`\1`, `\k<name>`), lookahead and
+    lookbehind (`(?=`, `(?!`, `(?<=`, `(?<!`), and `\u` escapes (write the
+    character itself);
+  - what RE2 would silently read otherwise: `[]` and `[^]` (the start of a
+    class to RE2), `[:` in a class (a POSIX class to RE2) and, without the
+    `u` flag, `\p`, `\P`, `\A`, `\z`, `\Q`, `\a` and `\x{`, in a class or
+    out, which JavaScript reads as the letter itself.
+- **Refused in RE2's words:** anything else RE2 can't compile, such as a
+  repeat count over 1,000.
+- **Flags:** `i`, `m`, `s` and `u` map to RE2's own; `y` anchors at the
+  start; `g` and `d` change no answer; `v` is refused.
+- **Read differently, for every pattern:**
+  - RE2 always matches by code point and folds case as the `u` flag does: `.`
+    matches an emoji, and `/ſ/i` matches `s`;
+  - `.` stops only at `\n`, not at `\r`, `\u2028` or `\u2029`, and with `m`, `^`
+    and `$` match only around `\n`;
+  - `\s` is ASCII whitespace (`\t`, `\n`, `\f`, `\r` and space).
+- **Counting:** every match of a pattern like `x.*y|x` can read to the end of
+  the input, so counting them all is quadratic. `count(input, atMost)` scans
+  at most `atMost` matches, each linear in the input, so it costs up to
+  `atMost` × the input. A `must-cite` guardrail asks for its `minCitations`, at
+  most `mustCiteMaxCitations`: 100 with `HOSTED_BOUNDS`, no cap with
+  `SELF_HOSTED_BOUNDS`.
+
+Apache-2.0.

package/dist/bounds.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The limits a Kindgi server puts on what a tenant sends it: one setting
+ * for the whole process, set once at boot (`configureTenantInputBounds`)
+ * and read where tenant input is compiled or read (`tenantInputBounds`).
+ *
+ * The runtime sets {@link HOSTED_BOUNDS} under the hosted profile, where
+ * one tenant's input must never stall the server for the others. Anywhere
+ * else (a self-hosted server, a pack's own process, a test) it's
+ * {@link SELF_HOSTED_BOUNDS}: today's behaviour, with generous limits on
+ * bodies, schemas and a render's memory.
+ *
+ * Why one setting rather than an argument: the places that compile tenant
+ * input are deep inside the SDK's packages (guardrails, schema, agents,
+ * flow, tools). One explicit call at boot is testable, and a second call
+ * throwing keeps it from changing while the server runs. Why not the
+ * environment: a library that reads `process.env` behaves differently in a
+ * test than in the server.
+ */
+export interface TenantInputBounds {
+    /**
+     * The engine a tenant's pattern runs on: V8's, or RE2's, which runs in
+     * linear time. On RE2, a tenant's JSON Schema checks its data in linear
+     * time too (`@kindgi/schema`): its patterns run on RE2, its formats are
+     * ajv-formats' `fast` ones, and `uniqueItems` compares items by a key.
+     */
+    readonly regex: 'v8' | 're2';
+    /** The longest a tenant's pattern may be: its source plus its flags, in characters. */
+    readonly patternMaxLength: number;
+    /**
+     * The most citations a `must-cite` guardrail may require (`minCitations`).
+     * It counts matches up to that many, and on RE2 each match can read the
+     * rest of the output, so this caps what one evaluation costs.
+     */
+    readonly mustCiteMaxCitations: number;
+    /** The largest schema compiled: its JSON, in bytes, before it's compiled. */
+    readonly schemaMaxBytes: number;
+    /** The deepest a schema may nest, objects and arrays. */
+    readonly schemaMaxDepth: number;
+    /** Compiled schemas kept, by their JSON, the least recently used dropped first. */
+    readonly schemaCacheEntries: number;
+    /**
+     * The most schema JSON those compiled schemas may add up to, in bytes: a
+     * compiled schema takes 4 to 15 times its JSON in memory for real API
+     * schemas, and up to about 20 times for the worst shapes measured.
+     */
+    readonly schemaCacheMaxBytes: number;
+    /**
+     * The time a tenant's schemas may spend compiling in any 60 seconds, in
+     * milliseconds: the compiles that count (`runAsTenant` says whose work
+     * it is, and which count). Past it, the tenant's next compile that
+     * counts is refused until the window moves on; schemas already compiled
+     * keep working.
+     */
+    readonly schemaCompileBudgetMs: number;
+    /**
+     * The time a tenant's templates may spend rendering in any 60 seconds,
+     * in milliseconds, for renders done as its work (`runAsTenant`). Past it,
+     * the tenant's next render is refused until the window moves on. A
+     * render holds the event loop while it runs.
+     */
+    readonly templateRenderBudgetMs: number;
+    /** A template's limits (liquidjs's own). */
+    readonly liquid: {
+        /** The longest template parsed, in characters. */
+        readonly parseLimit: number;
+        /** The longest one render may take, in milliseconds. */
+        readonly renderLimitMs: number;
+        /**
+         * The most one render may allocate, in liquidjs's own units (roughly
+         * characters of strings and arrays it builds), not bytes: 8,388,608 is
+         * not 8 MiB, and isn't meant to be.
+         */
+        readonly memoryLimit: number;
+    };
+    /** The largest body read from a tenant-named endpoint, decompressed, in bytes. */
+    readonly responseMaxBytes: number;
+    /** The longest wait between two chunks of such a body, in milliseconds. */
+    readonly responseIdleMs: number;
+    /** The largest one event of a `text/event-stream` may be; the stream itself has no total. */
+    readonly sseEventMaxBytes: number;
+    /** The largest request body the API reads, in bytes (routes that take more set their own). */
+    readonly requestMaxBytes: number;
+    /**
+     * The deepest a request's JSON may nest, in levels of objects and arrays,
+     * the body's own being 1. It leaves room for a schema as deep as
+     * `schemaMaxDepth` inside the body that carries it.
+     */
+    readonly requestJsonMaxDepth: number;
+}
+/**
+ * Anywhere but the hosted profile: today's behaviour. A pattern on V8's
+ * engine, a template's length and render time, and idle time without
+ * limits; caps where today has none that a self-hoster could still hurt
+ * itself without (bodies, schemas, the compile cache, a render's memory).
+ */
+export declare const SELF_HOSTED_BOUNDS: TenantInputBounds;
+/** The hosted profile: patterns on RE2 (linear time), and tight limits. */
+export declare const HOSTED_BOUNDS: TenantInputBounds;
+/**
+ * Sets the process's bounds, once, at boot. A second call throws: they
+ * never change while the server runs.
+ */
+export declare function configureTenantInputBounds(bounds: TenantInputBounds): void;
+/** The process's bounds: what boot set, or {@link SELF_HOSTED_BOUNDS}. */
+export declare function tenantInputBounds(): TenantInputBounds;
+/**
+ * For tests (`@kindgi/bounds/testing`): runs with other bounds, and puts
+ * back what was set.
+ */
+export declare function overrideTenantInputBounds(bounds: TenantInputBounds): () => void;
+//# sourceMappingURL=bounds.d.ts.map

package/dist/bounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounds.d.ts","sourceRoot":"","sources":["../src/bounds.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE;QACf,kDAAkD;QAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,wDAAwD;QACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B;;;;WAIG;QACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAcD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAoB/B,CAAC;AAEH,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,iBAoB1B,CAAC;AAIH;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAK1E;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,iBAAiB,CAErD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAM/E"}

package/dist/bounds.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+const KiB = 1024;
+const MiB = 1024 * KiB;
+/*
+ * The numbers: fitted to limits the code already enforces (a pack
+ * service's body and an HTTP tool's response 10 MiB, a webhook body
+ * 256 KiB, MCP sign-in 64 KiB), until hosted usage tunes them. The
+ * compile cache's bytes and the compile budget are measured: a 256 KiB
+ * schema compiles to 4–5 MiB of heap in up to 0.75 s, and a 100 KiB one
+ * derived from a public OpenAPI document in 0.1–0.2 s.
+ */
+/**
+ * Anywhere but the hosted profile: today's behaviour. A pattern on V8's
+ * engine, a template's length and render time, and idle time without
+ * limits; caps where today has none that a self-hoster could still hurt
+ * itself without (bodies, schemas, the compile cache, a render's memory).
+ */
+export const SELF_HOSTED_BOUNDS = deepFreeze({
+    regex: 'v8',
+    patternMaxLength: 8_192,
+    mustCiteMaxCitations: Number.POSITIVE_INFINITY,
+    schemaMaxBytes: 1 * MiB,
+    schemaMaxDepth: 64,
+    schemaCacheEntries: 1_000,
+    schemaCacheMaxBytes: Number.POSITIVE_INFINITY,
+    schemaCompileBudgetMs: Number.POSITIVE_INFINITY,
+    templateRenderBudgetMs: Number.POSITIVE_INFINITY,
+    liquid: {
+        parseLimit: Number.POSITIVE_INFINITY,
+        renderLimitMs: Number.POSITIVE_INFINITY,
+        memoryLimit: 16_777_216,
+    },
+    responseMaxBytes: 10 * MiB,
+    responseIdleMs: Number.POSITIVE_INFINITY,
+    sseEventMaxBytes: 10 * MiB,
+    requestMaxBytes: 10 * MiB,
+    requestJsonMaxDepth: 128,
+});
+/** The hosted profile: patterns on RE2 (linear time), and tight limits. */
+export const HOSTED_BOUNDS = deepFreeze({
+    regex: 're2',
+    patternMaxLength: 1_024,
+    mustCiteMaxCitations: 100,
+    schemaMaxBytes: 256 * KiB,
+    schemaMaxDepth: 64,
+    schemaCacheEntries: 512,
+    schemaCacheMaxBytes: 8 * MiB,
+    schemaCompileBudgetMs: 2_000,
+    templateRenderBudgetMs: 5_000,
+    liquid: {
+        parseLimit: 262_144,
+        renderLimitMs: 1_000,
+        memoryLimit: 8_388_608,
+    },
+    responseMaxBytes: 10 * MiB,
+    responseIdleMs: 60_000,
+    sseEventMaxBytes: 10 * MiB,
+    requestMaxBytes: 2 * MiB,
+    requestJsonMaxDepth: 128,
+});
+let configured;
+/**
+ * Sets the process's bounds, once, at boot. A second call throws: they
+ * never change while the server runs.
+ */
+export function configureTenantInputBounds(bounds) {
+    if (configured !== undefined) {
+        throw new Error('Tenant input bounds are already set: they are set once, at boot.');
+    }
+    configured = deepFreeze(structuredClone(bounds));
+}
+/** The process's bounds: what boot set, or {@link SELF_HOSTED_BOUNDS}. */
+export function tenantInputBounds() {
+    return configured ?? SELF_HOSTED_BOUNDS;
+}
+/**
+ * For tests (`@kindgi/bounds/testing`): runs with other bounds, and puts
+ * back what was set.
+ */
+export function overrideTenantInputBounds(bounds) {
+    const before = configured;
+    configured = deepFreeze(structuredClone(bounds));
+    return () => {
+        configured = before;
+    };
+}
+function deepFreeze(value) {
+    for (const inner of Object.values(value)) {
+        if (inner !== null && typeof inner === 'object')
+            deepFreeze(inner);
+    }
+    return Object.freeze(value);
+}
+//# sourceMappingURL=bounds.js.map

package/dist/bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounds.js","sourceRoot":"","sources":["../src/bounds.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA4FjC,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;AAEvB;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,UAAU,CAAC;IAC9D,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,KAAK;IACvB,oBAAoB,EAAE,MAAM,CAAC,iBAAiB;IAC9C,cAAc,EAAE,CAAC,GAAG,GAAG;IACvB,cAAc,EAAE,EAAE;IAClB,kBAAkB,EAAE,KAAK;IACzB,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;IAC7C,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;IAC/C,sBAAsB,EAAE,MAAM,CAAC,iBAAiB;IAChD,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC,iBAAiB;QACpC,aAAa,EAAE,MAAM,CAAC,iBAAiB;QACvC,WAAW,EAAE,UAAU;KACxB;IACD,gBAAgB,EAAE,EAAE,GAAG,GAAG;IAC1B,cAAc,EAAE,MAAM,CAAC,iBAAiB;IACxC,gBAAgB,EAAE,EAAE,GAAG,GAAG;IAC1B,eAAe,EAAE,EAAE,GAAG,GAAG;IACzB,mBAAmB,EAAE,GAAG;CACzB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAsB,UAAU,CAAC;IACzD,KAAK,EAAE,KAAK;IACZ,gBAAgB,EAAE,KAAK;IACvB,oBAAoB,EAAE,GAAG;IACzB,cAAc,EAAE,GAAG,GAAG,GAAG;IACzB,cAAc,EAAE,EAAE;IAClB,kBAAkB,EAAE,GAAG;IACvB,mBAAmB,EAAE,CAAC,GAAG,GAAG;IAC5B,qBAAqB,EAAE,KAAK;IAC5B,sBAAsB,EAAE,KAAK;IAC7B,MAAM,EAAE;QACN,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,SAAS;KACvB;IACD,gBAAgB,EAAE,EAAE,GAAG,GAAG;IAC1B,cAAc,EAAE,MAAM;IACtB,gBAAgB,EAAE,EAAE,GAAG,GAAG;IAC1B,eAAe,EAAE,CAAC,GAAG,GAAG;IACxB,mBAAmB,EAAE,GAAG;CACzB,CAAC,CAAC;AAEH,IAAI,UAAyC,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB;IAClE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,UAAU,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,IAAI,kBAAkB,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC;IAC1B,UAAU,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,EAAE;QACV,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAmB,KAAQ;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/budget.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Budgets kept per tenant: the time a tenant's work of one kind (its
+ * schema compiles, its template renders) takes in any 60 seconds. That
+ * work holds the event loop while it runs, so a tenant past its budget
+ * waits instead of the others: its next piece of that work is refused
+ * until the window moves on, and may be retried then. The budget doesn't
+ * stop a piece it let start, so a tenant's minute can run past the budget
+ * by one piece.
+ */
+/** The window a budget kept per tenant counts over, in milliseconds. */
+export declare const BUDGET_WINDOW_MS = 60000;
+/** Which budget refused: what the API's refusal names in `details.limit`. */
+export type TenantBudgetLimit = 'schema-compile-time' | 'template-render-time';
+/**
+ * A tenant's work refused: it spent its budget of `budgetMs` (`limit`) in
+ * the last 60 seconds, and is under it again after `retryAfterMs`. Every
+ * budget's refusal is one of these, so what answers for one (the API, an
+ * agent's turn, a run's step) answers for them all.
+ */
+export declare class TenantBudgetError extends Error {
+    readonly limit: TenantBudgetLimit;
+    readonly budgetMs: number;
+    readonly retryAfterMs: number;
+    constructor(message: string, limit: TenantBudgetLimit, budgetMs: number, retryAfterMs: number);
+}
+/** Where a budget reads the time. */
+export interface BudgetClock {
+    /** The wall time, in milliseconds: where a piece of work sits in the window. */
+    now(): number;
+    /** A monotonic time, in milliseconds: how long a piece of work took. */
+    monotonic(): number;
+}
+/** The system's clock, read when asked: `Date.now` and `performance.now`. */
+export declare const SYSTEM_CLOCK: BudgetClock;
+/**
+ * The time each tenant spent on one kind of work in the last 60 seconds,
+ * against `budgetMs`; `refuse` makes the error for a tenant past it. An
+ * infinite budget keeps no count. Charging a piece costs the same however
+ * many pieces the window holds.
+ */
+export declare class TenantTimeBudget {
+    private readonly budgetMs;
+    private readonly refuse;
+    private readonly clock;
+    private readonly ledgers;
+    private readonly budgetUs;
+    private sweptAt;
+    constructor(budgetMs: number, refuse: (budgetMs: number, retryAfterMs: number) => TenantBudgetError, clock?: BudgetClock);
+    /**
+     * Runs `work` as `tenant`'s, and returns what it returns: refused with
+     * `refuse`'s error, before it starts, once the tenant has spent its
+     * budget. Its time is charged, a failed piece's too.
+     */
+    charge<T>(tenant: string, work: () => T): T;
+    /** Once a window: drops the work that left it, and the tenants with none left. */
+    private sweep;
+    /** Throws `refuse`'s error when `tenant` has spent its budget. */
+    private check;
+    /** Charges `tenant` for work started `at` that took `ms`. */
+    private spend;
+    /** Drops `ledger`'s work that left the window ending `now`; returns how many pieces are left. */
+    private inWindow;
+    private ledgerOf;
+}
+//# sourceMappingURL=budget.d.ts.map

package/dist/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../src/budget.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,sBAAsB,CAAC;AAE/E;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,KAAK,EAAE,iBAAiB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAH7B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM;CAKhC;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,GAAG,IAAI,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,IAAI,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,WAG1B,CAAC;AAyBF;;;;;GAKG;AACH,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAPxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,OAAO,CAAK;gBAGD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,iBAAiB,EACrE,KAAK,GAAE,WAA0B;IAKpD;;;;OAIG;IACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;IAa3C,kFAAkF;IAClF,OAAO,CAAC,KAAK;IAQb,kEAAkE;IAClE,OAAO,CAAC,KAAK;IAoBb,6DAA6D;IAC7D,OAAO,CAAC,KAAK;IAYb,iGAAiG;IACjG,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,QAAQ;CAQjB"}