@kindgi/bounds 0.0.0-stage → 0.1.8-rc.0

package/dist/budget.js

@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Budgets kept per tenant: the time a tenant's work of one kind (its
+ * schema compiles, its template renders) takes in any 60 seconds. That
+ * work holds the event loop while it runs, so a tenant past its budget
+ * waits instead of the others: its next piece of that work is refused
+ * until the window moves on, and may be retried then. The budget doesn't
+ * stop a piece it let start, so a tenant's minute can run past the budget
+ * by one piece.
+ */
+/** The window a budget kept per tenant counts over, in milliseconds. */
+export const BUDGET_WINDOW_MS = 60_000;
+/**
+ * A tenant's work refused: it spent its budget of `budgetMs` (`limit`) in
+ * the last 60 seconds, and is under it again after `retryAfterMs`. Every
+ * budget's refusal is one of these, so what answers for one (the API, an
+ * agent's turn, a run's step) answers for them all.
+ */
+export class TenantBudgetError extends Error {
+    limit;
+    budgetMs;
+    retryAfterMs;
+    constructor(message, limit, budgetMs, retryAfterMs) {
+        super(message);
+        this.limit = limit;
+        this.budgetMs = budgetMs;
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'TenantBudgetError';
+    }
+}
+/** The system's clock, read when asked: `Date.now` and `performance.now`. */
+export const SYSTEM_CLOCK = {
+    now: () => Date.now(),
+    monotonic: () => performance.now(),
+};
+/**
+ * The time each tenant spent on one kind of work in the last 60 seconds,
+ * against `budgetMs`; `refuse` makes the error for a tenant past it. An
+ * infinite budget keeps no count. Charging a piece costs the same however
+ * many pieces the window holds.
+ */
+export class TenantTimeBudget {
+    budgetMs;
+    refuse;
+    clock;
+    ledgers = new Map();
+    budgetUs;
+    sweptAt = 0;
+    constructor(budgetMs, refuse, clock = SYSTEM_CLOCK) {
+        this.budgetMs = budgetMs;
+        this.refuse = refuse;
+        this.clock = clock;
+        this.budgetUs = budgetMs * 1_000;
+    }
+    /**
+     * Runs `work` as `tenant`'s, and returns what it returns: refused with
+     * `refuse`'s error, before it starts, once the tenant has spent its
+     * budget. Its time is charged, a failed piece's too.
+     */
+    charge(tenant, work) {
+        if (this.budgetMs === Number.POSITIVE_INFINITY)
+            return work();
+        const now = this.clock.now();
+        this.sweep(now);
+        this.check(tenant, now);
+        const started = this.clock.monotonic();
+        try {
+            return work();
+        }
+        finally {
+            this.spend(tenant, now, this.clock.monotonic() - started);
+        }
+    }
+    /** Once a window: drops the work that left it, and the tenants with none left. */
+    sweep(now) {
+        if (now - this.sweptAt <= BUDGET_WINDOW_MS)
+            return;
+        this.sweptAt = now;
+        for (const [tenant, ledger] of this.ledgers) {
+            if (this.inWindow(ledger, now) === 0)
+                this.ledgers.delete(tenant);
+        }
+    }
+    /** Throws `refuse`'s error when `tenant` has spent its budget. */
+    check(tenant, now) {
+        const ledger = this.ledgerOf(tenant);
+        this.inWindow(ledger, now);
+        if (ledger.spentUs < this.budgetUs)
+            return;
+        // Read after the count, so a wall clock set back never refuses a tenant under its budget.
+        if (now < ledger.refusedUntil)
+            throw this.refuse(this.budgetMs, ledger.refusedUntil - now);
+        // Under the budget again once enough of the oldest work leaves the window.
+        let left = ledger.spentUs;
+        let under = now;
+        for (let i = ledger.head; i < ledger.pieces.length; i += 1) {
+            const spent = ledger.pieces[i];
+            left -= spent.us;
+            under = spent.at + BUDGET_WINDOW_MS;
+            if (left < this.budgetUs)
+                break;
+        }
+        // It holds until a piece is charged: what the tenant starts now is refused.
+        ledger.refusedUntil = under;
+        throw this.refuse(this.budgetMs, under - now);
+    }
+    /** Charges `tenant` for work started `at` that took `ms`. */
+    spend(tenant, at, ms) {
+        const ledger = this.ledgerOf(tenant);
+        const us = Math.round(ms * 1_000);
+        ledger.spentUs += us;
+        // A piece that started before a refusal can end after it, and move the wait.
+        ledger.refusedUntil = 0;
+        // Work ends in the order it started, but for a piece inside another one.
+        let i = ledger.pieces.length;
+        while (i > ledger.head && ledger.pieces[i - 1].at > at)
+            i -= 1;
+        ledger.pieces.splice(i, 0, { at, us });
+    }
+    /** Drops `ledger`'s work that left the window ending `now`; returns how many pieces are left. */
+    inWindow(ledger, now) {
+        const { pieces } = ledger;
+        while (ledger.head < pieces.length &&
+            pieces[ledger.head].at <= now - BUDGET_WINDOW_MS) {
+            ledger.spentUs -= pieces[ledger.head].us;
+            ledger.head += 1;
+        }
+        // Copied down once as many were dropped as are kept: each piece is copied about once.
+        if (ledger.head > 0 && ledger.head * 2 >= pieces.length) {
+            ledger.pieces = pieces.slice(ledger.head);
+            ledger.head = 0;
+        }
+        return ledger.pieces.length - ledger.head;
+    }
+    ledgerOf(tenant) {
+        let ledger = this.ledgers.get(tenant);
+        if (ledger === undefined) {
+            ledger = { pieces: [], head: 0, spentUs: 0, refusedUntil: 0 };
+            this.ledgers.set(tenant, ledger);
+        }
+        return ledger;
+    }
+}
+//# sourceMappingURL=budget.js.map

package/dist/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../src/budget.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;GAQG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAKvC;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IACA;IACA;IAJX,YACE,OAAe,EACN,KAAwB,EACxB,QAAgB,EAChB,YAAoB;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAmB;QACxB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,iBAAY,GAAZ,YAAY,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAUD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;CACnC,CAAC;AAyBF;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAMR;IACA;IACA;IAPF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,QAAQ,CAAS;IAC1B,OAAO,GAAG,CAAC,CAAC;IAEpB,YACmB,QAAgB,EAChB,MAAqE,EACrE,QAAqB,YAAY;QAFjC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAA+D;QACrE,UAAK,GAAL,KAAK,CAA4B;QAElD,IAAI,CAAC,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAI,MAAc,EAAE,IAAa;QACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,iBAAiB;YAAE,OAAO,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,GAAW;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,MAAc,EAAE,GAAW;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3C,0FAA0F;QAC1F,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;QAC3F,2EAA2E;QAC3E,IAAI,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAU,CAAC;YACxC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,gBAAgB,CAAC;YACpC,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ;gBAAE,MAAM;QAClC,CAAC;QACD,4EAA4E;QAC5E,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,6DAA6D;IACrD,KAAK,CAAC,MAAc,EAAE,EAAU,EAAE,EAAU;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrB,6EAA6E;QAC7E,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QACxB,yEAAyE;QACzE,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,IAAK,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,EAAE,GAAG,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,iGAAiG;IACzF,QAAQ,CAAC,MAAc,EAAE,GAAW;QAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,OACE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,EAAE,IAAI,GAAG,GAAG,gBAAgB,EAC3D,CAAC;YACD,MAAM,CAAC,OAAO,IAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,sFAAsF;QACtF,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,MAAc;QAC7B,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { HOSTED_BOUNDS, SELF_HOSTED_BOUNDS, type TenantInputBounds, configureTenantInputBounds, tenantInputBounds, } from './bounds.js';
+export { BUDGET_WINDOW_MS, type BudgetClock, SYSTEM_CLOCK, TenantBudgetError, type TenantBudgetLimit, TenantTimeBudget, } from './budget.js';
+export { type CompiledTenantPattern, type TenantPattern, compileTenantPattern, tenantPatternSyntaxProblem, } from './pattern.js';
+export { type RunAsTenantOptions, type TenantCompiles, type TenantScope, currentTenant, runAsTenant, runOutsideTenant, } from './tenant.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,YAAY,EACZ,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export { HOSTED_BOUNDS, SELF_HOSTED_BOUNDS, configureTenantInputBounds, tenantInputBounds, } from './bounds.js';
+export { BUDGET_WINDOW_MS, SYSTEM_CLOCK, TenantBudgetError, TenantTimeBudget, } from './budget.js';
+export { compileTenantPattern, tenantPatternSyntaxProblem, } from './pattern.js';
+export { currentTenant, runAsTenant, runOutsideTenant, } from './tenant.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAEhB,YAAY,EACZ,iBAAiB,EAEjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/pattern.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A tenant's pattern, compiled for the engine the process's bounds name.
+ * Both answers are those of the JavaScript `RegExp` it was written as,
+ * starting from the beginning of `input` each time (`lastIndex` 0).
+ */
+export interface TenantPattern {
+    /** Whether it matches in `input`: anywhere, or at the start under the `y` flag. */
+    test(input: string): boolean;
+    /**
+     * How many times it matches in `input`, one after another without
+     * overlapping, as `input.match()` with the `g` flag counts them. It stops
+     * counting at `atMost`: a caller that needs "at least n" asks for n, so a
+     * long input costs no more than that.
+     */
+    count(input: string, atMost?: number): number;
+}
+export type CompiledTenantPattern = {
+    readonly kind: 'ok';
+    readonly pattern: TenantPattern;
+}
+/** Why it can't run here: a fragment that reads after a colon, with no full stop. */
+ | {
+    readonly kind: 'refused';
+    readonly reason: string;
+};
+/**
+ * Compiles a pattern a tenant wrote (a JavaScript regular expression's
+ * source and flags) under the process's bounds: no longer than
+ * `patternMaxLength` with its flags, on V8's engine or on RE2's.
+ *
+ * Under RE2 (the hosted profile), a pattern runs in linear time in its
+ * input. The price is what RE2 doesn't have, refused by name:
+ * backreferences, lookahead and lookbehind. A few things also read
+ * differently, the same way for every pattern (the package README lists
+ * them): RE2 always matches by code point and folds case as the `u` flag
+ * does; `.` stops only at `\n`, and with `m`, `^` and `$` only around
+ * `\n`; `\s` is ASCII whitespace. What RE2 would silently read otherwise
+ * is refused: `[]` and `[^]` (the start of a class to RE2), `[:` in a
+ * class (a POSIX class to RE2) and, without the `u` flag, the escapes
+ * JavaScript reads as the letter itself (`\p`, `\P`, `\A`, `\z`, `\Q`,
+ * `\a`, `\x{`). So is `\u`, which RE2 doesn't have. And it accepts only
+ * what `RegExp` accepts: a pattern V8 refuses is refused in V8's words, even
+ * where RE2 would compile it (`(?i)`, `(?P<n>…)`).
+ *
+ * Flags under RE2: `i`, `m`, `s` and `u` map to RE2's own; `y` anchors at
+ * the start as it does from `lastIndex` 0; `g` and `d` change no answer
+ * here. `v` is refused: RE2 has no set notation.
+ */
+export declare function compileTenantPattern(source: string, flags?: string): CompiledTenantPattern;
+/**
+ * Why `compileTenantPattern` would refuse `source` with `flags` for its
+ * syntax, or `undefined` when it wouldn't: over `patternMaxLength`, what
+ * `RegExp` refuses and, under RE2, a flag or a construct RE2 doesn't have
+ * or reads otherwise. It builds no RE2 program, so it costs about what
+ * V8's parse does. A pattern RE2 refuses only as it builds the program
+ * passes here, and is refused when it's compiled: one too large (a
+ * repeat over 1,000, say), or with an escape RE2 doesn't have that this
+ * check doesn't name (`\N`, `[\b]`, `\cA`, a long property name such as
+ * `\p{Letter}`).
+ */
+export declare function tenantPatternSyntaxProblem(source: string, flags?: string): string | undefined;
+//# sourceMappingURL=pattern.d.ts.map

package/dist/pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern.d.ts","sourceRoot":"","sources":["../src/pattern.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/C;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE;AAC1D,qFAAqF;GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,qBAAqB,CAKtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,MAAM,GAAG,SAAS,CASzF"}

package/dist/pattern.js

@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { RE2JS, RE2JSException, RE2JSSyntaxException } from 're2js';
+import { tenantInputBounds } from './bounds.js';
+/**
+ * Compiles a pattern a tenant wrote (a JavaScript regular expression's
+ * source and flags) under the process's bounds: no longer than
+ * `patternMaxLength` with its flags, on V8's engine or on RE2's.
+ *
+ * Under RE2 (the hosted profile), a pattern runs in linear time in its
+ * input. The price is what RE2 doesn't have, refused by name:
+ * backreferences, lookahead and lookbehind. A few things also read
+ * differently, the same way for every pattern (the package README lists
+ * them): RE2 always matches by code point and folds case as the `u` flag
+ * does; `.` stops only at `\n`, and with `m`, `^` and `$` only around
+ * `\n`; `\s` is ASCII whitespace. What RE2 would silently read otherwise
+ * is refused: `[]` and `[^]` (the start of a class to RE2), `[:` in a
+ * class (a POSIX class to RE2) and, without the `u` flag, the escapes
+ * JavaScript reads as the letter itself (`\p`, `\P`, `\A`, `\z`, `\Q`,
+ * `\a`, `\x{`). So is `\u`, which RE2 doesn't have. And it accepts only
+ * what `RegExp` accepts: a pattern V8 refuses is refused in V8's words, even
+ * where RE2 would compile it (`(?i)`, `(?P<n>…)`).
+ *
+ * Flags under RE2: `i`, `m`, `s` and `u` map to RE2's own; `y` anchors at
+ * the start as it does from `lastIndex` 0; `g` and `d` change no answer
+ * here. `v` is refused: RE2 has no set notation.
+ */
+export function compileTenantPattern(source, flags = '') {
+    const bounds = tenantInputBounds();
+    const tooLong = lengthProblem(source, flags);
+    if (tooLong !== undefined)
+        return { kind: 'refused', reason: tooLong };
+    return bounds.regex === 're2' ? compileRe2(source, flags) : compileV8(source, flags);
+}
+/**
+ * Why `compileTenantPattern` would refuse `source` with `flags` for its
+ * syntax, or `undefined` when it wouldn't: over `patternMaxLength`, what
+ * `RegExp` refuses and, under RE2, a flag or a construct RE2 doesn't have
+ * or reads otherwise. It builds no RE2 program, so it costs about what
+ * V8's parse does. A pattern RE2 refuses only as it builds the program
+ * passes here, and is refused when it's compiled: one too large (a
+ * repeat over 1,000, say), or with an escape RE2 doesn't have that this
+ * check doesn't name (`\N`, `[\b]`, `\cA`, a long property name such as
+ * `\p{Letter}`).
+ */
+export function tenantPatternSyntaxProblem(source, flags = '') {
+    const tooLong = lengthProblem(source, flags);
+    if (tooLong !== undefined)
+        return tooLong;
+    if (tenantInputBounds().regex !== 're2') {
+        const parsed = parse(source, flags);
+        return typeof parsed === 'string' ? parsed : undefined;
+    }
+    const re2Flags = re2FlagsFor(flags);
+    return typeof re2Flags === 'string' ? re2Flags : re2SyntaxProblem(source, flags);
+}
+/** Why `source` with `flags` is over `patternMaxLength`, or `undefined`. */
+function lengthProblem(source, flags) {
+    const max = tenantInputBounds().patternMaxLength;
+    const length = source.length + flags.length;
+    return length > max ? `${length} characters with its flags, over the limit of ${max}` : undefined;
+}
+/** `source` with `flags` as V8 parses it, or V8's reason for refusing it. */
+function parse(source, flags) {
+    try {
+        return new RegExp(source, flags);
+    }
+    catch (error) {
+        return error.message;
+    }
+}
+function compileV8(source, flags) {
+    const once = parse(source, flags);
+    if (typeof once === 'string')
+        return { kind: 'refused', reason: once };
+    const every = flags.includes('g') ? once : new RegExp(source, `${flags}g`);
+    const byCodePoint = flags.includes('u') || flags.includes('v');
+    return {
+        kind: 'ok',
+        pattern: {
+            test(input) {
+                once.lastIndex = 0;
+                return once.test(input);
+            },
+            count(input, atMost = Number.POSITIVE_INFINITY) {
+                every.lastIndex = 0;
+                let found = 0;
+                while (found < atMost) {
+                    const match = every.exec(input);
+                    if (match === null)
+                        break;
+                    found += 1;
+                    // As `match()` steps past an empty match, so the next one can't be the same.
+                    if (match[0] === '')
+                        every.lastIndex = after(input, every.lastIndex, byCodePoint);
+                }
+                return found;
+            },
+        },
+    };
+}
+const RE2_ENGINE = 'RE2, the engine patterns run on here,';
+const RE2_FLAGS = {
+    i: RE2JS.CASE_INSENSITIVE,
+    m: RE2JS.MULTILINE,
+    s: RE2JS.DOTALL,
+    u: 0,
+    g: 0,
+    d: 0,
+    y: 0,
+};
+/** RE2's flags for `flags`, or why there are none. */
+function re2FlagsFor(flags) {
+    let re2Flags = 0;
+    for (const [index, flag] of [...flags].entries()) {
+        if (flags.indexOf(flag) !== index)
+            return `the \`${flag}\` flag is given twice`;
+        if (flag === 'v')
+            return `${RE2_ENGINE} has no \`v\` flag (set notation)`;
+        const mapped = RE2_FLAGS[flag];
+        if (mapped === undefined)
+            return `\`${flag}\` isn't a flag`;
+        re2Flags |= mapped;
+    }
+    return re2Flags;
+}
+/**
+ * Why RE2 can't run `source` with `flags` as JavaScript reads it, for its
+ * syntax; `undefined` when it can. What `RegExp` accepts, never more: RE2
+ * compiles `(?i)`, `(?P<n>…)` and, with `u`, `\pL` or `\x{41}`, which V8
+ * refuses. Constructing it only parses (it never matches), and the pattern
+ * is already within its length.
+ */
+function re2SyntaxProblem(source, flags) {
+    const parsed = parse(source, flags);
+    if (typeof parsed === 'string')
+        return parsed;
+    return unsupportedOnRe2(source, flags.includes('u'));
+}
+function compileRe2(source, flags) {
+    const re2Flags = re2FlagsFor(flags);
+    if (typeof re2Flags === 'string')
+        return { kind: 'refused', reason: re2Flags };
+    const problem = re2SyntaxProblem(source, flags);
+    if (problem !== undefined)
+        return { kind: 'refused', reason: problem };
+    let re;
+    try {
+        re = RE2JS.compile(source, re2Flags);
+    }
+    catch (error) {
+        if (!(error instanceof RE2JSException))
+            throw error;
+        const detail = error instanceof RE2JSSyntaxException
+            ? error.message.replace(/^error parsing regexp: /, '')
+            : error.message;
+        return { kind: 'refused', reason: `${RE2_ENGINE} refuses it: ${detail}` };
+    }
+    const sticky = flags.includes('y');
+    return {
+        kind: 'ok',
+        pattern: {
+            test(input) {
+                return sticky ? re.matcher(input).lookingAt() : re.test(input);
+            },
+            count(input, atMost = Number.POSITIVE_INFINITY) {
+                const matcher = re.matcher(input);
+                let found = 0;
+                let from = 0;
+                while (found < atMost && from <= input.length && matcher.find(from)) {
+                    const start = matcher.start();
+                    const end = matcher.end();
+                    if (sticky && start !== from)
+                        break;
+                    found += 1;
+                    from = end === start ? after(input, end, true) : end;
+                }
+                return found;
+            },
+        },
+    };
+}
+/**
+ * What RE2 doesn't have, or reads differently from JavaScript, by name
+ * and where it is; `undefined` when there's none. RE2's own messages
+ * would call a lookbehind an "invalid named capture". It runs on a
+ * pattern `RegExp` has already parsed with the same flags (`unicode`: `u`).
+ */
+function unsupportedOnRe2(source, unicode) {
+    let inClass = false;
+    for (let i = 0; i < source.length; i += 1) {
+        const c = source[i];
+        if (c === '\\') {
+            const next = source[i + 1] ?? '';
+            if (next === 'u') {
+                return `${RE2_ENGINE} has no \`\\u\` escapes: write the character itself (at index ${i})`;
+            }
+            const misread = unicode ? undefined : RE2_READS_OTHERWISE[next];
+            if (misread !== undefined && (next !== 'x' || source[i + 2] === '{')) {
+                const written = next === 'x' ? '\\x{' : `\\${next}`;
+                return `${RE2_ENGINE} reads \`${written}\` as ${misread}, where JavaScript without the \`u\` flag reads the letter \`${next}\` (at index ${i})`;
+            }
+            if (!inClass && next >= '1' && next <= '9') {
+                return `${RE2_ENGINE} has no backreferences (\`\\${next}\` at index ${i})`;
+            }
+            if (!inClass && next === 'k' && source[i + 2] === '<') {
+                return `${RE2_ENGINE} has no backreferences (\`\\k<\` at index ${i})`;
+            }
+            i += 1;
+        }
+        else if (inClass) {
+            if (c === ']')
+                inClass = false;
+            else if (c === '[' && source[i + 1] === ':') {
+                return `${RE2_ENGINE} reads \`[:\` in a class as a POSIX class such as \`[:alpha:]\`, not as JavaScript does (at index ${i})`;
+            }
+        }
+        else if (c === '[') {
+            const first = source[i + 1] === '^' ? i + 2 : i + 1;
+            if (source[first] === ']') {
+                return `${RE2_ENGINE} reads \`${source.slice(i, first + 1)}\` as the start of a class, not as JavaScript does (at index ${i})`;
+            }
+            inClass = true;
+            i = first - 1;
+        }
+        else if (c === '(' && source[i + 1] === '?') {
+            const look = LOOKAROUND.find((l) => source.startsWith(l, i));
+            if (look !== undefined) {
+                return `${RE2_ENGINE} has no lookahead or lookbehind (\`${look}\` at index ${i})`;
+            }
+        }
+    }
+    return undefined;
+}
+const LOOKAROUND = ['(?=', '(?!', '(?<=', '(?<!'];
+/** Escapes JavaScript without `u` reads as the letter itself, and RE2 as something else. */
+const RE2_READS_OTHERWISE = {
+    p: 'a Unicode class',
+    P: 'a negated Unicode class',
+    A: 'the start of the text',
+    z: 'the end of the text',
+    Q: 'the start of a quoted literal (`\\Q…\\E`)',
+    a: 'the bell character',
+    x: 'the start of a code point (`\\x{41}`)',
+};
+/** The index after an empty match at `index`: past a whole surrogate pair when matching by code point. */
+function after(input, index, byCodePoint) {
+    if (!byCodePoint)
+        return index + 1;
+    const code = input.codePointAt(index);
+    return index + (code !== undefined && code > 0xffff ? 2 : 1);
+}
+//# sourceMappingURL=pattern.js.map

package/dist/pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern.js","sourceRoot":"","sources":["../src/pattern.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwBhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE;IAC7D,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvE,OAAO,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE;IACnE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,iBAAiB,EAAE,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,iDAAiD,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,MAAc,EAAE,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAAe,CAAC,OAAO,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,IAAI,CAAC,KAAK;gBACR,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;gBACnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,iBAAiB;gBAC5C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBACpB,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,OAAO,KAAK,GAAG,MAAM,EAAE,CAAC;oBACtB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAChC,IAAI,KAAK,KAAK,IAAI;wBAAE,MAAM;oBAC1B,KAAK,IAAI,CAAC,CAAC;oBACX,6EAA6E;oBAC7E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;wBAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACpF,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAE3D,MAAM,SAAS,GAAqC;IAClD,CAAC,EAAE,KAAK,CAAC,gBAAgB;IACzB,CAAC,EAAE,KAAK,CAAC,SAAS;IAClB,CAAC,EAAE,KAAK,CAAC,MAAM;IACf,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;CACL,CAAC;AAEF,sDAAsD;AACtD,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,SAAS,IAAI,wBAAwB,CAAC;QAChF,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,GAAG,UAAU,mCAAmC,CAAC;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,IAAI,iBAAiB,CAAC;QAC5D,QAAQ,IAAI,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvE,IAAI,EAAS,CAAC;IACd,IAAI,CAAC;QACH,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,MAAM,GACV,KAAK,YAAY,oBAAoB;YACnC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;YACtD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,gBAAgB,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,IAAI,CAAC,KAAK;gBACR,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,iBAAiB;gBAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC1B,IAAI,MAAM,IAAI,KAAK,KAAK,IAAI;wBAAE,MAAM;oBACpC,KAAK,IAAI,CAAC,CAAC;oBACX,IAAI,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACvD,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAgB;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,GAAG,UAAU,iEAAiE,CAAC,GAAG,CAAC;YAC5F,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACrE,MAAM,OAAO,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpD,OAAO,GAAG,UAAU,YAAY,OAAO,SAAS,OAAO,gEAAgE,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAClJ,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;gBAC3C,OAAO,GAAG,UAAU,+BAA+B,IAAI,eAAe,CAAC,GAAG,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtD,OAAO,GAAG,UAAU,6CAA6C,CAAC,GAAG,CAAC;YACxE,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;iBAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,OAAO,GAAG,UAAU,qGAAqG,CAAC,GAAG,CAAC;YAChI,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1B,OAAO,GAAG,UAAU,YAAY,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,gEAAgE,CAAC,GAAG,CAAC;YACjI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,GAAG,UAAU,sCAAsC,IAAI,eAAe,CAAC,GAAG,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3D,4FAA4F;AAC5F,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,EAAE,iBAAiB;IACpB,CAAC,EAAE,yBAAyB;IAC5B,CAAC,EAAE,uBAAuB;IAC1B,CAAC,EAAE,qBAAqB;IACxB,CAAC,EAAE,2CAA2C;IAC9C,CAAC,EAAE,oBAAoB;IACvB,CAAC,EAAE,uCAAuC;CAC3C,CAAC;AAEF,0GAA0G;AAC1G,SAAS,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,WAAoB;IAC/D,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/tenant.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Which of a tenant's schema compiles count against its budget.
+ * `recompiles`: compiling a schema again, after the cache dropped it; the
+ * first compile of a schema the tenant published doesn't count, so a
+ * restarted server compiles each tenant's schemas freely. `all`: every
+ * compile, for a request that publishes, deploys or registers schemas,
+ * which is where new ones come from.
+ */
+export type TenantCompiles = 'recompiles' | 'all';
+/** The tenant whose work is running, and which of its compiles count. */
+export interface TenantScope {
+    readonly tenantId: string;
+    readonly compiles: TenantCompiles;
+}
+/** `runAsTenant`'s options. */
+export interface RunAsTenantOptions {
+    /** Which of the tenant's compiles count: `recompiles` unless set. */
+    readonly compiles?: TenantCompiles;
+}
+/** Runs `fn` as `tenantId`'s work, and returns what it returns. */
+export declare function runAsTenant<T>(tenantId: string, fn: () => T, options?: RunAsTenantOptions): T;
+/**
+ * Runs `fn` outside any tenant's scope, and returns what it returns: for
+ * Kindgi's own work that a tenant's request happens to start (compiling
+ * one of Kindgi's schemas the first time, say), which no tenant is
+ * charged for.
+ */
+export declare function runOutsideTenant<T>(fn: () => T): T;
+/** Whose work this is, or undefined outside `runAsTenant`. */
+export declare function currentTenant(): TenantScope | undefined;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../src/tenant.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,KAAK,CAAC;AAElD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,+BAA+B;AAC/B,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAID,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,CAAC,CAEjG;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAElD;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,IAAI,WAAW,GAAG,SAAS,CAEvD"}

package/dist/tenant.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Whose work this is: the tenant a budget kept per tenant charges
+ * (`schemaCompileBudgetMs`, `templateRenderBudgetMs`), and which of its
+ * compiles count. The API runs each authenticated request with
+ * `runAsTenant`, and a request that publishes schemas in a scope of its
+ * own that counts every compile; a server that does a tenant's work
+ * outside a request (a run, a job) wraps it the same way. The scope is an
+ * `AsyncLocalStorage` context: it follows `fn`'s own awaits and callbacks,
+ * never another request's, however they interleave. Outside any scope
+ * (boot, Kindgi's own work), nothing is charged.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+const scopes = new AsyncLocalStorage();
+/** Runs `fn` as `tenantId`'s work, and returns what it returns. */
+export function runAsTenant(tenantId, fn, options = {}) {
+    return scopes.run({ tenantId, compiles: options.compiles ?? 'recompiles' }, fn);
+}
+/**
+ * Runs `fn` outside any tenant's scope, and returns what it returns: for
+ * Kindgi's own work that a tenant's request happens to start (compiling
+ * one of Kindgi's schemas the first time, say), which no tenant is
+ * charged for.
+ */
+export function runOutsideTenant(fn) {
+    return scopes.exit(fn);
+}
+/** Whose work this is, or undefined outside `runAsTenant`. */
+export function currentTenant() {
+    return scopes.getStore();
+}
+//# sourceMappingURL=tenant.js.map

package/dist/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../src/tenant.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAwBrD,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEpD,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAI,QAAgB,EAAE,EAAW,EAAE,UAA8B,EAAE;IAC5F,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAI,EAAW;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,6 @@
+/**
+ * For tests: run with other bounds than the process's, then put them back.
+ * Never in a server: its bounds are set once, at boot.
+ */
+export { overrideTenantInputBounds } from './bounds.js';
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC"}

package/dist/testing.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * For tests: run with other bounds than the process's, then put them back.
+ * Never in a server: its bounds are set once, at boot.
+ */
+export { overrideTenantInputBounds } from './bounds.js';
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;GAGG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC"}