@kindgi/schema 0.1.7 → 0.1.8

package/README.md

@@ -14,14 +14,42 @@ Turn the JSON Schemas that live in `@kindgi/specs/*.schema.json` into runtime-us
   - `validate<T>(id, data)` — validate data against a schema by `$id`, returning `Result<T, SchemaError>`.
   - `getSchema(id)` — retrieve the raw parsed schema JSON.
   - `ids()` — list every registered `$id`.
-- **`compileInlineSchema(schema)`** — compile one anonymous JSON Schema (no `$id`, no cross-schema `$ref`) into a `CompiledInlineSchema` whose `validate<T>(data)` returns `Result<T, ValidationErrorLike>`.
-- **`compileJsonSchema(schema, options?)`** — compile one JSON Schema into an Ajv `ValidateFunction`, in the dialect it declares in `$schema` (draft-06, draft-07, 2019-09 or 2020-12; 2020-12 when it declares none), with formats checked. `dialects` limits the ones it may declare. `strict` (default `true`) is Ajv's strict mode, a lint for the schemas you write; turn it off for a schema from elsewhere, such as an MCP server's. `useDefaults` fills in each property's `default`. Throws for another dialect, or a schema that doesn't compile.
+- **`compileInlineSchema(schema)`** — compile one anonymous JSON Schema (no `$id`, no cross-schema `$ref`) into a `CompiledInlineSchema` whose `validate<T>(data)` returns `Result<T, ValidationErrorLike>`. Compiled under the process's bounds (see [Bounds](#bounds)); a schema over them is a `compile` error.
+- **`compileJsonSchema(schema, options?)`** — compile one JSON Schema into an Ajv `ValidateFunction`, in the dialect it declares in `$schema` (draft-06, draft-07, 2019-09 or 2020-12; 2020-12 when it declares none), with formats checked. `dialects` limits the ones it may declare. `strict` (default `true`) is Ajv's strict mode, a lint for the schemas you write; turn it off for a schema from elsewhere, such as an MCP server's. `useDefaults` fills in each property's `default`. Compiled under the process's bounds (see [Bounds](#bounds)). Throws for another dialect, a schema over the bounds, or one that doesn't compile.
+- **`holdJsonSchema(schema, options?)`** — `compileJsonSchema` for a caller that keeps the schema. It compiles the schema now and returns a function that gives its validator on each call. It keeps a JSON schema's cache key, not its validator, so the cache stays all that holds it: once the cache drops it, the next call compiles it again, a recompile the budget counts. A schema JSON can't carry is held as compiled.
 - **`jsonSchemaDialect(schema, allowed?)`** — the dialect a schema declares, as `'draft-06' | 'draft-07' | '2019-09' | '2020-12'`; throws, naming it, for one Kindgi doesn't validate (or one not in `allowed`).
 - **`versionOf(schema)`** — extract `{ major, semver }` from a schema's `$id` and `$comment`.
 - **Zod authoring helpers** — `AnySchema` (a JSON Schema object or a Zod v4 schema), `isZodSchema`, `isJsonSchemaObject`, `schemaKindOf`, and `toJSONSchema` / `toJSONSchemaSync` (with `loadZodConverter` / `loadZodConverterSync`), which convert Zod to JSON Schema through Zod's native `z.toJSONSchema()`. `zod` is an optional peer dependency: it is imported only when a Zod schema is passed, and a missing or failed conversion is an `invalid-zod-conversion` error, not a throw.
 - **`canonicalize(value)`** — deterministic JSON serialization (sorted keys, `undefined` omitted, no whitespace), a subset of RFC 8785 used for signing.
 - **`SchemaError`** — typed discriminated union covering load / parse / compile / not-found / validation / Zod-conversion errors.
 
+## Bounds
+
+`compileJsonSchema` and `compileInlineSchema` compile a schema under the process's bounds, from [`@kindgi/bounds`](../bounds/):
+
+- A schema nested deeper than `schemaMaxDepth`, or larger than `schemaMaxBytes` as JSON, is refused before it's compiled, with an error naming the limit.
+- A `$ref` is compiled once, where its target is, not copied into each place that uses it (Ajv's `inlineRefs: false`), so the code a schema compiles to grows with its JSON, not with its targets' sizes times their uses.
+- Each schema is compiled once and its validator kept, by the schema's JSON as written and the options it was compiled with. The cache holds at most `schemaCacheEntries` validators and `schemaCacheMaxBytes` of their schemas' JSON, and drops the least recently used first. A schema that didn't compile is kept too, weighing nothing, and throws the same error again.
+
+Under `HOSTED_BOUNDS`, whose patterns run on RE2, every check a schema makes of the data runs in time linear in the data (`uniqueItems`: in its size times its depth):
+
+- `pattern`, `patternProperties` and `propertyNames` run on RE2, through `compileTenantPattern`. A schema with a pattern RE2 can't run (a lookahead, a backreference) doesn't compile, and the error names the pattern and why.
+- Formats are ajv-formats' `fast` ones. `regex` accepts a pattern whose syntax `compileTenantPattern` accepts, checked without building RE2's program (`tenantPatternSyntaxProblem`). A pattern RE2 refuses only when it builds the program still passes here: one too large (a repeat over 1,000) or with an escape the check doesn't name (`\cA`, `\p{Letter}`). `url` is ajv-formats' own, written without its backtracking. `fast` is looser in places: `date` accepts `2026-02-30`.
+- `uniqueItems` looks for a repeat by a key for each item, not pair by pair. The verdict and the error are Ajv's, down to the pair of items it names. One difference: an object with its own `valueOf` or `toString` key is compared by its keys, where Ajv's compare throws.
+
+Under `SELF_HOSTED_BOUNDS`, patterns run on V8, formats are ajv-formats' `full` ones, and `uniqueItems` is Ajv's own.
+
+### Compile time
+
+Compiling a large schema holds the event loop, so each tenant's compiles share a budget: `schemaCompileBudgetMs` of compiling in any 60 seconds (2 seconds under `HOSTED_BOUNDS`, none under `SELF_HOSTED_BOUNDS`). A compile is a tenant's when it runs inside `runAsTenant` from `@kindgi/bounds`, and which compiles count is the scope's:
+
+- By default, only a schema compiled again: one the tenant compiled before in this process, dropped from the cache since. A tenant's first compile of a schema is free, for its first 4,096 schemas; past them, every compile counts.
+- With `{ compiles: 'all' }`, which a request that publishes schemas uses, every compile counts, the first ones too.
+
+Once a tenant has spent its budget, a compile that counts throws `SchemaCompileBudgetError` (its `budgetMs`, and `retryAfterMs` until enough of its compiles leave the window), from `compileInlineSchema` as from `compileJsonSchema`: it isn't the schema's fault, so it isn't returned as a compile error, and it isn't kept. Validators already kept still serve. A compile isn't stopped part way, so a tenant's minute can run over by one compile. Outside a scope, nothing is refused.
+
+`createSpecRegistry` and `loadSpecRegistry` compile Kindgi's own schemas, in `@kindgi/specs`, and run their patterns on V8; the formats and `uniqueItems` follow the bounds as above.
+
 ## Example
 
 ```ts
@@ -52,4 +80,4 @@ if (validated.kind === 'ok') {
 - **No Zod on the wire, and no JSON Schema → Zod conversion.** Zod is an authoring convenience: schemas are converted one way, Zod → JSON Schema, and every schema that is registered or exchanged is JSON Schema.
 - **No schema migration helpers.** Every schema is at its first major version, so there is nothing to migrate between.
 - **No TypeScript type generation.** Callers define TypeScript types that match schema shapes by hand, or author with Zod and derive them with `z.infer`.
-- **No custom Ajv extensions.** Uses stock Ajv + `ajv-formats`, with no custom keywords. Kindgi's own schemas are Draft 2020-12; `compileJsonSchema` compiles a schema from elsewhere with Ajv's class for its declared dialect.
+- **No custom Ajv keywords.** Uses Ajv + `ajv-formats` and the keywords they define; under `HOSTED_BOUNDS`, `uniqueItems` and the `url` and `regex` formats are replaced with linear versions of the same checks (see [Bounds](#bounds)). Kindgi's own schemas are Draft 2020-12; `compileJsonSchema` compiles a schema from elsewhere with Ajv's class for its declared dialect.

package/dist/bounded.d.ts

@@ -0,0 +1,57 @@
+import { Ajv } from 'ajv';
+import type { Options, ValidateFunction } from 'ajv';
+import { Ajv2019 } from 'ajv/dist/2019.js';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import type { JsonSchemaDialect } from './dialect.js';
+type AnyAjv = Ajv | Ajv2019 | Ajv2020;
+/** Whose schemas an Ajv compiles, and the keywords they may carry. */
+export interface BoundedAjvOptions {
+    /**
+     * `tenant` (the default): anyone's, its patterns run as a tenant's do.
+     * `kindgi`: Kindgi's own (`@kindgi/specs`), whose patterns are Kindgi's
+     * code and run on V8 as the rest of it does; the checks they make of the
+     * data (formats, `uniqueItems`) are bounded all the same.
+     */
+    readonly schemasFrom?: 'tenant' | 'kindgi';
+    /** Keywords Kindgi reads off a schema, which validate nothing. */
+    readonly annotations?: readonly string[];
+}
+/**
+ * An Ajv for `dialect` under the process's bounds, with ajv-formats'
+ * formats and the keywords in `annotations`.
+ */
+export declare function boundedAjv(dialect: JsonSchemaDialect, options: Options, how?: BoundedAjvOptions): AnyAjv;
+/** What `compileTenantSchema` compiles: the dialect, Ajv's options, and the annotations. */
+export interface TenantSchemaCompile {
+    readonly dialect: JsonSchemaDialect;
+    readonly options: Options;
+    readonly annotations?: readonly string[];
+}
+/**
+ * A validator for a tenant's `schema`, compiled once: measured against the
+ * bounds first (its depth, then its size as JSON), then taken from the
+ * cache or compiled and kept. Throws, as `ajv.compile` does, when it's over
+ * a bound or doesn't compile; a schema that didn't compile is kept too, and
+ * throws the same error again. Throws `SchemaCompileBudgetError`, and
+ * keeps nothing, when the compile counts against a tenant that has spent
+ * its budget.
+ *
+ * The cache key is the schema's JSON as written, keys in their order: the
+ * order of `properties` is the order Ajv fills in defaults and reports
+ * errors in. A schema holding a value JSON can't carry (a function,
+ * `undefined`) is compiled each time.
+ */
+export declare function compileTenantSchema(schema: unknown, how: TenantSchemaCompile): ValidateFunction;
+/**
+ * A tenant's `schema` compiled now, as `compileTenantSchema` does, for a
+ * caller that keeps it: what this keeps is the cache key, not the
+ * validator. Each call returns the validator the cache has under the key
+ * or, once the cache has dropped it (or the bounds changed), compiles it
+ * again as `compileTenantSchema` does, a recompile the tenant's budget
+ * counts, and which can throw as it does. So however long a caller keeps
+ * it, the cache is all that holds the compiled schema. A schema holding a
+ * value JSON can't carry, never cached, is held as compiled.
+ */
+export declare function holdTenantSchema(schema: unknown, how: TenantSchemaCompile): () => ValidateFunction;
+export {};
+//# sourceMappingURL=bounded.d.ts.map

package/dist/bounded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.d.ts","sourceRoot":"","sources":["../src/bounded.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,KAAK,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,OAAO,CAAC;AAatC,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,OAAO,EAChB,GAAG,GAAE,iBAAsB,GAC1B,MAAM,CAoCR;AA4CD,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,mBAAmB,GAAG,gBAAgB,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,mBAAmB,GACvB,MAAM,gBAAgB,CAWxB"}

package/dist/bounded.js

@@ -0,0 +1,308 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The one place `@kindgi/schema` makes an Ajv, under the process's bounds
+ * (`@kindgi/bounds`): `compileJsonSchema`, `compileInlineSchema` and
+ * `createSpecRegistry` all compile here.
+ *
+ * With `SELF_HOSTED_BOUNDS`, Ajv is as it always was: patterns on V8,
+ * ajv-formats' full formats, Ajv's own `uniqueItems`. On RE2
+ * (`HOSTED_BOUNDS`), every check a tenant's schema makes runs in time
+ * linear in the data (`uniqueItems`: in its size times its depth):
+ * - `pattern`, `patternProperties` and `propertyNames`' patterns run on
+ *   RE2, through `compileTenantPattern` (Ajv's `code.regExp`); Kindgi's own
+ *   schemas' patterns stay on V8 (`schemasFrom`);
+ * - formats are ajv-formats' `fast` ones; `regex` is a pattern whose
+ *   syntax `compileTenantPattern` accepts (`tenantPatternSyntaxProblem`,
+ *   which builds no RE2 program), and `url` is matched without the
+ *   backtracking its regular expression has (see `linearUrl`);
+ * - `uniqueItems` finds a repeat by each item's key, not pair by pair
+ *   (`./unique-items.ts`).
+ *
+ * A tenant's schema (`compileTenantSchema`) is also measured before it's
+ * compiled, its depth and its size as JSON, and compiled once: the
+ * validators are kept by the schema's JSON, the least recently used
+ * dropped first (`schemaCacheEntries`, `schemaCacheMaxBytes`). The time
+ * its compiles take is charged to the tenant whose work it is
+ * (`./compile-budget.ts`).
+ */
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { compileTenantPattern, currentTenant, tenantInputBounds, tenantPatternSyntaxProblem, } from '@kindgi/bounds';
+import { Ajv } from 'ajv';
+import * as addFormatsModule from 'ajv-formats';
+import { Ajv2019 } from 'ajv/dist/2019.js';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { CompileBudget, SchemaCompileBudgetError } from './compile-budget.js';
+import { linearUniqueItems } from './unique-items.js';
+const addFormatsRaw = addFormatsModule;
+const addFormats = typeof addFormatsRaw === 'function'
+    ? addFormatsRaw
+    : addFormatsRaw.default;
+const require = createRequire(import.meta.url);
+/**
+ * An Ajv for `dialect` under the process's bounds, with ajv-formats'
+ * formats and the keywords in `annotations`.
+ */
+export function boundedAjv(dialect, options, how = {}) {
+    const onRe2 = tenantInputBounds().regex === 're2';
+    const tenants = how.schemasFrom !== 'kindgi';
+    const ajvOptions = tenants
+        ? {
+            ...options,
+            // Ajv's default inlines a `$ref` target at every site that uses
+            // it, so the code it writes grows as the target's size times its
+            // uses while the JSON stays small: 27 KiB of one `$defs` used 400
+            // times took 18 s and 2.8 GiB to compile.
+            inlineRefs: false,
+            ...(onRe2 && { code: { ...options.code, regExp: tenantRegExp } }),
+        }
+        : options;
+    let ajv;
+    if (dialect === '2020-12')
+        ajv = new Ajv2020(ajvOptions);
+    else if (dialect === '2019-09')
+        ajv = new Ajv2019(ajvOptions);
+    else {
+        ajv = new Ajv(ajvOptions);
+        if (dialect === 'draft-06') {
+            ajv.addMetaSchema(require('ajv/dist/refs/json-schema-draft-06.json'));
+        }
+    }
+    if (onRe2) {
+        addFormats(ajv, { mode: 'fast' });
+        // A pattern `compileTenantPattern` would accept for its syntax, checked
+        // without building RE2's program: data can carry thousands of values.
+        ajv.addFormat('regex', (input) => tenantPatternSyntaxProblem(input) === undefined);
+        ajv.addFormat('url', linearUrl());
+        ajv.removeKeyword('uniqueItems');
+        ajv.addKeyword(linearUniqueItems());
+    }
+    else {
+        addFormats(ajv);
+    }
+    for (const keyword of how.annotations ?? [])
+        ajv.addKeyword(keyword);
+    return ajv;
+}
+/**
+ * Ajv's `code.regExp` on RE2: a schema's pattern compiled by
+ * `compileTenantPattern`, and refused, so the schema doesn't compile, when
+ * it can't run there. Ajv keeps one compiled pattern per `toString()`.
+ */
+const tenantRegExp = Object.assign((source, flags) => {
+    const compiled = compileTenantPattern(source, flags);
+    if (compiled.kind === 'refused') {
+        throw new Error(`The schema's pattern ${JSON.stringify(source)} isn't a regular expression that compiles: ${compiled.reason}.`);
+    }
+    const { pattern } = compiled;
+    const key = JSON.stringify([source, flags]);
+    const like = { test: (input) => pattern.test(input), toString: () => key };
+    return like;
+}, 
+// Only Ajv's standalone code reads `code`, and Kindgi never generates it.
+{ code: 'tenantRegExp' });
+/**
+ * ajv-formats' `url`, with its user-info part `\S+(?::\S*)?@` written
+ * `\S+@`: the same strings (`\S` takes the `:` already), without the
+ * backtracking that makes it quadratic in a long string with no `@`.
+ * Built on first use, so only a process on RE2 depends on its source.
+ */
+function linearUrl() {
+    if (rewrittenUrl !== undefined)
+        return rewrittenUrl;
+    const full = require('ajv-formats/dist/formats.js')
+        .fullFormats.url;
+    const userInfo = '(?:\\S+(?::\\S*)?@)?';
+    if (full.source.split(userInfo).length !== 2) {
+        throw new Error("ajv-formats' url format isn't the one @kindgi/schema rewrites.");
+    }
+    rewrittenUrl = new RegExp(full.source.replace(userInfo, '(?:\\S+@)?'), full.flags);
+    return rewrittenUrl;
+}
+let rewrittenUrl;
+/**
+ * A validator for a tenant's `schema`, compiled once: measured against the
+ * bounds first (its depth, then its size as JSON), then taken from the
+ * cache or compiled and kept. Throws, as `ajv.compile` does, when it's over
+ * a bound or doesn't compile; a schema that didn't compile is kept too, and
+ * throws the same error again. Throws `SchemaCompileBudgetError`, and
+ * keeps nothing, when the compile counts against a tenant that has spent
+ * its budget.
+ *
+ * The cache key is the schema's JSON as written, keys in their order: the
+ * order of `properties` is the order Ajv fills in defaults and reports
+ * errors in. A schema holding a value JSON can't carry (a function,
+ * `undefined`) is compiled each time.
+ */
+export function compileTenantSchema(schema, how) {
+    return compileKeyed(schema, how).validate;
+}
+/**
+ * A tenant's `schema` compiled now, as `compileTenantSchema` does, for a
+ * caller that keeps it: what this keeps is the cache key, not the
+ * validator. Each call returns the validator the cache has under the key
+ * or, once the cache has dropped it (or the bounds changed), compiles it
+ * again as `compileTenantSchema` does, a recompile the tenant's budget
+ * counts, and which can throw as it does. So however long a caller keeps
+ * it, the cache is all that holds the compiled schema. A schema holding a
+ * value JSON can't carry, never cached, is held as compiled.
+ */
+export function holdTenantSchema(schema, how) {
+    const first = compileKeyed(schema, how);
+    if (first.key === undefined)
+        return () => first.validate;
+    let key = first.key;
+    return () => {
+        const kept = stateFor(tenantInputBounds()).cache.get(key);
+        if (kept?.kind === 'compiled')
+            return kept.validate;
+        const again = compileKeyed(schema, how);
+        if (again.key !== undefined)
+            key = again.key;
+        return again.validate;
+    };
+}
+/** `compileTenantSchema`'s validator, and the key the cache keeps it under (none when it isn't JSON). */
+function compileKeyed(schema, how) {
+    const bounds = tenantInputBounds();
+    const measured = measure(schema, bounds);
+    if (measured.kind === 'over')
+        throw new Error(measured.reason);
+    const text = jsonText(schema);
+    const bytes = Buffer.byteLength(text);
+    if (bytes > bounds.schemaMaxBytes) {
+        throw new Error(`The schema is ${bytes} bytes as JSON, over the limit of ${bounds.schemaMaxBytes}.`);
+    }
+    const compile = () => boundedAjv(how.dialect, how.options, { annotations: how.annotations ?? [] }).compile(schema);
+    const { cache, budget } = stateFor(bounds);
+    const scope = currentTenant();
+    if (!measured.json)
+        return { validate: budget.run(scope, undefined, compile) };
+    const key = createHash('sha256')
+        .update(JSON.stringify([how.dialect, how.options, how.annotations ?? []]))
+        .update(text)
+        .digest('base64');
+    const kept = cache.get(key);
+    if (kept !== undefined) {
+        if (kept.kind === 'refused')
+            throw kept.error;
+        return { validate: kept.validate, key };
+    }
+    let validate;
+    try {
+        validate = budget.run(scope, key, compile);
+    }
+    catch (error) {
+        // A schema that doesn't compile keeps its error, which is small.
+        if (!(error instanceof SchemaCompileBudgetError))
+            cache.set(key, { kind: 'refused', error }, 0);
+        throw error;
+    }
+    cache.set(key, { kind: 'compiled', validate }, bytes);
+    return { validate, key };
+}
+/** `JSON.stringify(schema)`, or '' when it can't write it (a `BigInt`). */
+function jsonText(schema) {
+    try {
+        return JSON.stringify(schema) ?? '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Whether `schema` nests deeper than the bounds allow, and whether it's
+ * JSON: only plain objects, arrays, strings, finite numbers, booleans and
+ * `null`. Walked without recursion, and stopped once it has seen more
+ * values than fit in `schemaMaxBytes` of JSON, so an object graph that
+ * shares its parts (or loops) can't make the walk long.
+ */
+function measure(schema, bounds) {
+    const max = bounds.schemaMaxDepth;
+    const stack = [[schema, 0]];
+    let json = true;
+    let seen = 0;
+    while (stack.length > 0) {
+        const [value, depth] = stack.pop();
+        if (typeof value === 'number')
+            json &&= Number.isFinite(value);
+        else if (typeof value !== 'object')
+            json &&= typeof value === 'string' || typeof value === 'boolean';
+        if (typeof value !== 'object' || value === null)
+            continue;
+        if (depth === max) {
+            return {
+                kind: 'over',
+                reason: `The schema nests objects and arrays more than ${max} deep, the limit.`,
+            };
+        }
+        const proto = Object.getPrototypeOf(value);
+        json &&= proto === Object.prototype || proto === Array.prototype;
+        for (const inner of Object.values(value)) {
+            seen += 1;
+            // Each value takes at least two bytes of JSON, with its comma.
+            if (seen * 2 > bounds.schemaMaxBytes) {
+                return {
+                    kind: 'over',
+                    reason: `The schema is more than ${bounds.schemaMaxBytes} bytes as JSON, the limit.`,
+                };
+            }
+            stack.push([inner, depth + 1]);
+        }
+    }
+    return { kind: 'within', json };
+}
+/**
+ * A cache that drops the least recently used entries while it holds more
+ * than `maxEntries`, or more than `maxBytes` by the weights it was given.
+ */
+class LeastRecentlyUsed {
+    maxEntries;
+    maxBytes;
+    entries = new Map();
+    bytes = 0;
+    constructor(maxEntries, maxBytes) {
+        this.maxEntries = maxEntries;
+        this.maxBytes = maxBytes;
+    }
+    get(key) {
+        const entry = this.entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        return entry.value;
+    }
+    set(key, value, bytes) {
+        this.delete(key);
+        this.entries.set(key, { value, bytes });
+        this.bytes += bytes;
+        while (this.entries.size > this.maxEntries || this.bytes > this.maxBytes) {
+            const oldest = this.entries.keys().next();
+            if (oldest.done === true)
+                break;
+            this.delete(oldest.value);
+        }
+    }
+    delete(key) {
+        const entry = this.entries.get(key);
+        if (entry === undefined)
+            return;
+        this.entries.delete(key);
+        this.bytes -= entry.bytes;
+    }
+}
+let state;
+/** The cache and the budget for `bounds`: new ones when the bounds change (a test's override). */
+function stateFor(bounds) {
+    if (state?.bounds !== bounds) {
+        state = {
+            bounds,
+            cache: new LeastRecentlyUsed(bounds.schemaCacheEntries, bounds.schemaCacheMaxBytes),
+            budget: new CompileBudget(bounds.schemaCompileBudgetMs),
+        };
+    }
+    return state;
+}
+//# sourceMappingURL=bounded.js.map

package/dist/bounded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.js","sourceRoot":"","sources":["../src/bounded.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1B,OAAO,KAAK,gBAAgB,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAOtD,MAAM,aAAa,GAAG,gBAA2B,CAAC;AAClD,MAAM,UAAU,GACd,OAAO,aAAa,KAAK,UAAU;IACjC,CAAC,CAAE,aAA8B;IACjC,CAAC,CAAE,aAA2C,CAAC,OAAO,CAAC;AAE3D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAe/C;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,OAA0B,EAC1B,OAAgB,EAChB,MAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC;IAC7C,MAAM,UAAU,GAAY,OAAO;QACjC,CAAC,CAAC;YACE,GAAG,OAAO;YACV,gEAAgE;YAChE,iEAAiE;YACjE,kEAAkE;YAClE,0CAA0C;YAC1C,UAAU,EAAE,KAAK;YACjB,GAAG,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;SAClE;QACH,CAAC,CAAC,OAAO,CAAC;IACZ,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,KAAK,SAAS;QAAE,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;SACpD,IAAI,OAAO,KAAK,SAAS;QAAE,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;SACzD,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,wEAAwE;QACxE,sEAAsE;QACtE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;QAC3F,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAiB,MAAM,CAAC,MAAM,CAC9C,CAAC,MAAc,EAAE,KAAa,EAAc,EAAE;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,0EAA0E;AAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,CACzB,CAAC;AAEF;;;;;GAKG;AACH,SAAS,SAAS;IAChB,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,IAAI,GAAI,OAAO,CAAC,6BAA6B,CAAsC;SACtF,WAAW,CAAC,GAAG,CAAC;IACnB,MAAM,QAAQ,GAAG,sBAAsB,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,IAAI,YAAgC,CAAC;AASrC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,GAAwB;IAC3E,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAe,EACf,GAAwB;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzD,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,OAAO,GAAG,EAAE;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CACnB,MAAe,EACf,GAAwB;IAExB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,qCAAqC,MAAM,CAAC,cAAc,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAClF,MAAgB,CACjB,CAAC;IACJ,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;SACzE,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,CAAC,CAAC,KAAK,YAAY,wBAAwB,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,MAAe;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAMD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,MAAe,EAAE,MAAyB;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAClC,MAAM,KAAK,GAAwB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAuB,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAChC,IAAI,KAAK,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;QACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,iDAAiD,GAAG,mBAAmB;aAChF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC;QACjE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,CAAC;YACV,+DAA+D;YAC/D,IAAI,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;gBACrC,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,2BAA2B,MAAM,CAAC,cAAc,4BAA4B;iBACrF,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAMD;;;GAGG;AACH,MAAM,iBAAiB;IAKF;IACA;IALF,OAAO,GAAG,IAAI,GAAG,EAAyD,CAAC;IACpF,KAAK,GAAG,CAAC,CAAC;IAElB,YACmB,UAAkB,EAClB,QAAgB;QADhB,eAAU,GAAV,UAAU,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ,EAAE,KAAa;QACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;CACF;AAQD,IAAI,KAAwB,CAAC;AAE7B,kGAAkG;AAClG,SAAS,QAAQ,CAAC,MAAyB;IACzC,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,KAAK,GAAG;YACN,MAAM;YACN,KAAK,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,mBAAmB,CAAC;YACnF,MAAM,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/compile-budget.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The time each tenant's schemas spend compiling, in any 60 seconds,
+ * against the bounds' `schemaCompileBudgetMs`. Compiling a large schema
+ * holds the event loop (a 256 KiB one up to 0.75 s), so a tenant past its
+ * budget waits instead of the others.
+ *
+ * Which compiles count is the tenant's scope's (`runAsTenant`): every one
+ * in a request that publishes schemas (`all`), and otherwise only a
+ * schema compiled again (`recompiles`), which is what a tenant whose
+ * schemas don't fit in the cache makes each call do. A tenant's first
+ * compile of a schema in the process is free, up to `FIRST_COMPILES`
+ * schemas; past them, every compile counts. A tenant that compiled
+ * nothing for an hour is forgotten, as a restart would forget it: its next
+ * compiles are first ones again. The window and the refusal are the
+ * bounds' budget kept per tenant (`TenantTimeBudget`).
+ */
+import { type BudgetClock, TenantBudgetError, type TenantScope } from '@kindgi/bounds';
+/** The schemas a tenant may compile once for free, in a process. */
+export declare const FIRST_COMPILES = 4096;
+/** How long a tenant compiles nothing before it's forgotten. */
+export declare const FORGET_AFTER_MS: number;
+/** A tenant's compile refused: it spent `budgetMs` in the last 60 seconds. Retry after `retryAfterMs`. */
+export declare class SchemaCompileBudgetError extends TenantBudgetError {
+    readonly code = "schema-compile-budget-exceeded";
+    constructor(budgetMs: number, retryAfterMs: number);
+}
+export declare class CompileBudget {
+    private readonly budgetMs;
+    private readonly clock;
+    private readonly time;
+    /** Each tenant's schemas compiled once, by key, up to `FIRST_COMPILES`, and when it last compiled. */
+    private readonly compiled;
+    private sweptAt;
+    constructor(budgetMs: number, clock?: BudgetClock);
+    /**
+     * Runs `compile`, the compile of the schema `key` (undefined: one that
+     * isn't JSON, which always counts), as `scope`'s work. When it counts,
+     * it's refused with `SchemaCompileBudgetError` once the tenant has spent
+     * its budget, and its time is charged.
+     */
+    run<T>(scope: TenantScope | undefined, key: string | undefined, compile: () => T): T;
+    /** The schemas `tenant` has compiled once, by key; it compiles `now`. */
+    private compiledBy;
+    /** Once a window: forgets the tenants idle past `FORGET_AFTER_MS`. */
+    private forget;
+}
+//# sourceMappingURL=compile-budget.d.ts.map

package/dist/compile-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-budget.d.ts","sourceRoot":"","sources":["../src/compile-budget.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAEL,KAAK,WAAW,EAEhB,iBAAiB,EACjB,KAAK,WAAW,EAEjB,MAAM,gBAAgB,CAAC;AAExB,oEAAoE;AACpE,eAAO,MAAM,cAAc,OAAQ,CAAC;AAEpC,gEAAgE;AAChE,eAAO,MAAM,eAAe,QAAc,CAAC;AAE3C,0GAA0G;AAC1G,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,oCAAoC;gBAErC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CASnD;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAPxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiE;IAC1F,OAAO,CAAC,OAAO,CAAK;gBAGD,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,WAA0B;IASpD;;;;;OAKG;IACH,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;IAkBpF,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAWlB,sEAAsE;IACtE,OAAO,CAAC,MAAM;CAOf"}

package/dist/compile-budget.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The time each tenant's schemas spend compiling, in any 60 seconds,
+ * against the bounds' `schemaCompileBudgetMs`. Compiling a large schema
+ * holds the event loop (a 256 KiB one up to 0.75 s), so a tenant past its
+ * budget waits instead of the others.
+ *
+ * Which compiles count is the tenant's scope's (`runAsTenant`): every one
+ * in a request that publishes schemas (`all`), and otherwise only a
+ * schema compiled again (`recompiles`), which is what a tenant whose
+ * schemas don't fit in the cache makes each call do. A tenant's first
+ * compile of a schema in the process is free, up to `FIRST_COMPILES`
+ * schemas; past them, every compile counts. A tenant that compiled
+ * nothing for an hour is forgotten, as a restart would forget it: its next
+ * compiles are first ones again. The window and the refusal are the
+ * bounds' budget kept per tenant (`TenantTimeBudget`).
+ */
+import { BUDGET_WINDOW_MS, SYSTEM_CLOCK, TenantBudgetError, TenantTimeBudget, } from '@kindgi/bounds';
+/** The schemas a tenant may compile once for free, in a process. */
+export const FIRST_COMPILES = 4_096;
+/** How long a tenant compiles nothing before it's forgotten. */
+export const FORGET_AFTER_MS = 60 * 60_000;
+/** A tenant's compile refused: it spent `budgetMs` in the last 60 seconds. Retry after `retryAfterMs`. */
+export class SchemaCompileBudgetError extends TenantBudgetError {
+    code = 'schema-compile-budget-exceeded';
+    constructor(budgetMs, retryAfterMs) {
+        super(`Schemas compiled for this tenant took its budget of ${budgetMs} ms in the last 60 seconds: try again in ${Math.max(1, Math.ceil(retryAfterMs / 1000))} s.`, 'schema-compile-time', budgetMs, retryAfterMs);
+        this.name = 'SchemaCompileBudgetError';
+    }
+}
+export class CompileBudget {
+    budgetMs;
+    clock;
+    time;
+    /** Each tenant's schemas compiled once, by key, up to `FIRST_COMPILES`, and when it last compiled. */
+    compiled = new Map();
+    sweptAt = 0;
+    constructor(budgetMs, clock = SYSTEM_CLOCK) {
+        this.budgetMs = budgetMs;
+        this.clock = clock;
+        this.time = new TenantTimeBudget(budgetMs, (budget, retryAfterMs) => new SchemaCompileBudgetError(budget, retryAfterMs), clock);
+    }
+    /**
+     * Runs `compile`, the compile of the schema `key` (undefined: one that
+     * isn't JSON, which always counts), as `scope`'s work. When it counts,
+     * it's refused with `SchemaCompileBudgetError` once the tenant has spent
+     * its budget, and its time is charged.
+     */
+    run(scope, key, compile) {
+        if (scope === undefined || this.budgetMs === Number.POSITIVE_INFINITY)
+            return compile();
+        const now = this.clock.now();
+        this.forget(now);
+        const seen = this.compiledBy(scope.tenantId, now);
+        const first = key !== undefined && !seen.has(key) && seen.size < FIRST_COMPILES;
+        if (first && scope.compiles === 'recompiles') {
+            seen.add(key);
+            return compile();
+        }
+        // Noted once it runs: a refused compile leaves the schema a first one.
+        const noted = first ? key : undefined;
+        return this.time.charge(scope.tenantId, () => {
+            if (noted !== undefined)
+                seen.add(noted);
+            return compile();
+        });
+    }
+    /** The schemas `tenant` has compiled once, by key; it compiles `now`. */
+    compiledBy(tenant, now) {
+        const kept = this.compiled.get(tenant);
+        if (kept !== undefined) {
+            kept.at = now;
+            return kept.seen;
+        }
+        const seen = new Set();
+        this.compiled.set(tenant, { seen, at: now });
+        return seen;
+    }
+    /** Once a window: forgets the tenants idle past `FORGET_AFTER_MS`. */
+    forget(now) {
+        if (now - this.sweptAt <= BUDGET_WINDOW_MS)
+            return;
+        this.sweptAt = now;
+        for (const [tenant, kept] of [...this.compiled]) {
+            if (now - kept.at >= FORGET_AFTER_MS)
+                this.compiled.delete(tenant);
+        }
+    }
+}
+//# sourceMappingURL=compile-budget.js.map

package/dist/compile-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-budget.js","sourceRoot":"","sources":["../src/compile-budget.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,gBAAgB,EAEhB,YAAY,EACZ,iBAAiB,EAEjB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AAE3C,0GAA0G;AAC1G,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IACpD,IAAI,GAAG,gCAAgC,CAAC;IAEjD,YAAY,QAAgB,EAAE,YAAoB;QAChD,KAAK,CACH,uDAAuD,QAAQ,4CAA4C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,KAAK,EAC3J,qBAAqB,EACrB,QAAQ,EACR,YAAY,CACb,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAOL;IACA;IAPF,IAAI,CAAmB;IACxC,sGAAsG;IACrF,QAAQ,GAAG,IAAI,GAAG,EAAsD,CAAC;IAClF,OAAO,GAAG,CAAC,CAAC;IAEpB,YACmB,QAAgB,EAChB,QAAqB,YAAY;QADjC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAA4B;QAElD,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAC9B,QAAQ,EACR,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,EAC5E,KAAK,CACN,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAI,KAA8B,EAAE,GAAuB,EAAE,OAAgB;QAC9E,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,iBAAiB;YAAE,OAAO,OAAO,EAAE,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAChF,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,uEAAuE;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3C,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACjE,UAAU,CAAC,MAAc,EAAE,GAAW;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IAC9D,MAAM,CAAC,GAAW;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,eAAe;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF"}

package/dist/dialect.d.ts

@@ -1,3 +1,19 @@
+/**
+ * Compile a JSON Schema in the dialect it declares (`$schema`). Kindgi's
+ * own schemas are Draft 2020-12, the default when a schema declares none.
+ * A schema from elsewhere (an MCP server: the TypeScript MCP SDK emits
+ * draft-07) means its keywords as its dialect defines them: draft-07's
+ * array-form `items` is a tuple, 2020-12's is not. So each dialect gets
+ * Ajv's class for it, not 2020-12's with another meta-schema added.
+ *
+ * `strict` is Ajv's strict mode, an authoring lint (unknown keywords and
+ * formats, loose tuples): right for the schemas a pack's author writes,
+ * wrong for a schema someone else's server sends, which is valid JSON Schema
+ * without being written to that standard. A union of types
+ * (`type: ['string', 'number']`) is standard JSON Schema, and what Zod 4
+ * writes for a union of scalars, so it's allowed in either mode
+ * (`ALLOW_UNION_TYPES`).
+ */
 import type { ValidateFunction } from 'ajv';
 /**
  * Every Kindgi schema compiler takes a union of types (`type: ['string', 'number']`): standard
@@ -23,9 +39,18 @@ export interface CompileJsonSchemaOptions {
     readonly useDefaults?: boolean;
 }
 /**
- * A validator for `schema`, compiled in its declared dialect. Throws when
- * the dialect isn't supported (or allowed) or the schema doesn't compile,
- * as `ajv.compile` does.
+ * A validator for `schema`, compiled in its declared dialect under the
+ * process's bounds (`compileTenantSchema`). Throws when the dialect isn't
+ * supported (or allowed), the schema is over a bound, or it doesn't
+ * compile, as `ajv.compile` does.
  */
 export declare function compileJsonSchema(schema: Readonly<Record<string, unknown>>, options?: CompileJsonSchemaOptions): ValidateFunction;
+/**
+ * `compileJsonSchema` for a caller that keeps the schema: compiled now,
+ * and what to call for its validator each time (`holdTenantSchema`). The
+ * cache stays all that holds a JSON schema's validator. A schema JSON
+ * can't carry (a key whose value is `undefined`, say) is never cached, so
+ * it's held as compiled rather than compiled on every call.
+ */
+export declare function holdJsonSchema(schema: Readonly<Record<string, unknown>>, options?: CompileJsonSchemaOptions): () => ValidateFunction;
 //# sourceMappingURL=dialect.d.ts.map

package/dist/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAe5C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAWhF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,GAAE,SAAS,iBAAiB,EAAiB,GACnD,iBAAiB,CAenB;AAOD,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,GAAE,wBAA6B,GACrC,gBAAgB,CAmBlB"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAI5C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAWhF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,GAAE,SAAS,iBAAiB,EAAiB,GACnD,iBAAiB,CAenB;AAOD,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,GAAE,wBAA6B,GACrC,gBAAgB,CAElB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,GAAE,wBAA6B,GACrC,MAAM,gBAAgB,CAExB"}