@procedures/client 0.14.1 → 0.15.1

package/src/procedures/collection/procedures.ts

@@ -57,7 +57,7 @@ import {
   type DeleteBatchInput,
 } from "./schemas.js";
 import { DEFAULT_FIND_LIMIT, queryEntries, type StorageQueryOptions, type StorageQueryPolicy } from "./query.js";
-import type { CollectionStorage, StorageWriteOptions } from "./storage.js";
+import type { CollectionStorage, StorageBatchWriteOptions, StorageItemWriteOptions, StorageWriteOptions } from "./storage.js";
 import { collectionChangeTopic, startChangeChain, writeWithChangeEvent } from "./changes.js";
 import { partitionOfCall, storageOfCall, withPartition, type PartitionInput } from "./partition.js";
 import { admitsRow, admittedStorage, type CollectionAdmission } from "./admission.js";
@@ -138,6 +138,19 @@ function writeOptionsOf(input: { origin?: string }): StorageWriteOptions | undef
   return input.origin === undefined ? undefined : { origin: input.origin };
 }
 
+/** The write options of `set` and `delete`: the origin, and the expected version (roadmap CLI-16). */
+function itemWriteOptionsOf(input: { origin?: string; expectedVersion?: string | null }): StorageItemWriteOptions | undefined {
+  if (input.expectedVersion === undefined) return writeOptionsOf(input);
+  return { ...writeOptionsOf(input), expectedVersion: input.expectedVersion };
+}
+
+/** The write options of `setBatch`: the origin, and the expected version of each item that has one (roadmap CLI-16). */
+function batchWriteOptionsOf(input: SetBatchInput): StorageBatchWriteOptions | undefined {
+  const expectedVersions = input.items.flatMap((item): Array<[string, string | null]> => (item.expectedVersion === undefined ? [] : [[item.id, item.expectedVersion]]));
+  if (expectedVersions.length === 0) return writeOptionsOf(input);
+  return { ...writeOptionsOf(input), expectedVersions };
+}
+
 // =============================================================================
 // Collection Procedure Definitions
 // =============================================================================
@@ -216,7 +229,7 @@ export function createCollectionProcedures(collectionName: string, options: Coll
       },
       handler: async (input: SetInput & PartitionInput, ctx: ProcedureContext) => {
         const { storage, view, partition } = await storageOf(input, ctx);
-        await changing(ctx, partition, storage, [input.id], input.origin, () => view.set(input.id, input.value, writeOptionsOf(input)));
+        await changing(ctx, partition, storage, [input.id], input.origin, () => view.set(input.id, input.value, itemWriteOptionsOf(input)));
       },
     }),
 
@@ -232,7 +245,7 @@ export function createCollectionProcedures(collectionName: string, options: Coll
       },
       handler: async (input: DeleteInput & PartitionInput, ctx: ProcedureContext) => {
         const { storage, view, partition } = await storageOf(input, ctx);
-        return changing(ctx, partition, storage, [input.id], input.origin, () => view.delete(input.id, writeOptionsOf(input)));
+        return changing(ctx, partition, storage, [input.id], input.origin, () => view.delete(input.id, itemWriteOptionsOf(input)));
       },
     }),
 
@@ -451,7 +464,7 @@ export function createCollectionProcedures(collectionName: string, options: Coll
           item.id,
           item.value,
         ]);
-        await changing(ctx, partition, storage, items.map(([id]) => id), input.origin, () => view.setBatch(items, writeOptionsOf(input)));
+        await changing(ctx, partition, storage, items.map(([id]) => id), input.origin, () => view.setBatch(items, batchWriteOptionsOf(input)));
       },
     }),
 

package/src/procedures/collection/query.ts

@@ -31,6 +31,22 @@
  *   regular expressions and the limit. The default policy does not permit `$regex`.
  */
 
+// The precondition of the collection writes is a part of the wire contract too (roadmap CLI-16).
+// This entry gives it to the storage packages: the module has no imports.
+export {
+  MAX_EXPECTED_VERSION_LENGTH,
+  PRECONDITION_NOT_SUPPORTED,
+  VERSION_CONFLICTS_METADATA_KEY,
+  VersionConflictError,
+  asVersionConflictError,
+  isExpectedVersion,
+  preconditionNotSupported,
+  versionConflict,
+  versionConflicts,
+  versionConflictsOf,
+} from "./precondition.js";
+export type { CurrentItem, VersionConflict, VersionOf } from "./precondition.js";
+
 //
 // ═══ The types ═══
 //

package/src/procedures/collection/schemas.ts

@@ -16,6 +16,7 @@ import {
   type StorageSelector,
   type StorageSort,
 } from "./query.js";
+import { MAX_EXPECTED_VERSION_LENGTH, isExpectedVersion } from "./precondition.js";
 
 // =============================================================================
 // Generic Schema Builder
@@ -83,6 +84,25 @@ function withOriginOf<I extends object>(data: Record<string, unknown>, input: I)
   return (isString(origin) ? { ...input, origin } : input) as I & { origin?: string };
 }
 
+/** The message of an expected version that is not valid (roadmap CLI-16). */
+const EXPECTED_VERSION_MESSAGE = `expectedVersion must be a string of at most ${MAX_EXPECTED_VERSION_LENGTH} characters, or null`;
+
+/**
+ * The error of the field `expectedVersion` of a write input (roadmap CLI-16), or undefined. The
+ * field is absent, a string of at most 1024 characters, or `null`.
+ */
+function expectedVersionError(data: Record<string, unknown>, path: (string | number)[] = []): ZodErrorLike | undefined {
+  if (!("expectedVersion" in data) || data["expectedVersion"] === undefined || isExpectedVersion(data["expectedVersion"])) return undefined;
+  const message = path.length === 0 ? EXPECTED_VERSION_MESSAGE : `${path.join(".")}.${EXPECTED_VERSION_MESSAGE}`;
+  return { message, errors: [{ path: [...path, "expectedVersion"], message }] };
+}
+
+/** The input with the expected version of the data, when the data has one. */
+function withExpectedVersionOf<I extends object>(data: Record<string, unknown>, input: I): I & { expectedVersion?: string | null } {
+  const expected = data["expectedVersion"];
+  return (isExpectedVersion(expected) ? { ...input, expectedVersion: expected } : input) as I & { expectedVersion?: string | null };
+}
+
 // =============================================================================
 // Common Schemas
 // =============================================================================
@@ -217,6 +237,11 @@ export interface SetInput {
   value: unknown;
   /** The origin of the write, for the observers of the storage and the change event (roadmap CLI-15). */
   origin?: string;
+  /**
+   * The version that the write expects for the current item (roadmap CLI-16). `null` expects no
+   * item. A conflict changes nothing and answers `VERSION_CONFLICT` with the current item.
+   */
+  expectedVersion?: string | null;
 }
 
 export const setInputSchema : ZodLike<SetInput> = createSchema<SetInput>((data) => {
@@ -247,9 +272,9 @@ export const setInputSchema : ZodLike<SetInput> = createSchema<SetInput>((data)
       },
     };
   }
-  const error = originError(data);
+  const error = originError(data) ?? expectedVersionError(data);
   if (error) return { success: false, error };
-  return { success: true, data: withOriginOf(data, { id: data["id"], value: data["value"] }) };
+  return { success: true, data: withExpectedVersionOf(data, withOriginOf(data, { id: data["id"], value: data["value"] })) };
 });
 
 /**
@@ -270,6 +295,11 @@ export interface DeleteInput {
   id: string;
   /** The origin of the write, for the observers of the storage and the change event (roadmap CLI-15). */
   origin?: string;
+  /**
+   * The version that the delete expects for the current item (roadmap CLI-16). `null` expects no
+   * item. A conflict changes nothing and answers `VERSION_CONFLICT` with the current item.
+   */
+  expectedVersion?: string | null;
 }
 
 export const deleteInputSchema : ZodLike<DeleteInput> = createSchema<DeleteInput>((data) => {
@@ -291,9 +321,9 @@ export const deleteInputSchema : ZodLike<DeleteInput> = createSchema<DeleteInput
       },
     };
   }
-  const error = originError(data);
+  const error = originError(data) ?? expectedVersionError(data);
   if (error) return { success: false, error };
-  return { success: true, data: withOriginOf(data, { id: data["id"] }) };
+  return { success: true, data: withExpectedVersionOf(data, withOriginOf(data, { id: data["id"] })) };
 });
 
 /**
@@ -810,7 +840,12 @@ export const getBatchOutputSchema : ZodLike<Record<string, unknown>> = createSch
  * Input for setBatch operation.
  */
 export interface SetBatchInput {
-  items: Array<{ id: string; value: unknown }>;
+  /**
+   * The items. An item can have `expectedVersion`: the version that the write expects for the
+   * current item of its id (roadmap CLI-16). When one item has a conflict, the batch changes no
+   * item and answers `VERSION_CONFLICT`.
+   */
+  items: Array<{ id: string; value: unknown; expectedVersion?: string | null }>;
   /** The origin of the write, for the observers of the storage and the change event (roadmap CLI-15). */
   origin?: string;
 }
@@ -845,13 +880,15 @@ export const setBatchInputSchema : ZodLike<SetBatchInput> = createSchema<SetBatc
         },
       };
     }
+    const versionError = expectedVersionError(item, ["items", i]);
+    if (versionError) return { success: false, error: versionError };
   }
   const error = originError(data);
   if (error) return { success: false, error };
   return {
     success: true,
     data: withOriginOf(data, {
-      items: data["items"].map((item: any) => ({ id: item["id"], value: item["value"] })),
+      items: data["items"].map((item: any) => withExpectedVersionOf(item, { id: item["id"], value: item["value"] })),
     }),
   };
 });

package/src/procedures/collection/storage.ts

@@ -20,6 +20,9 @@
  * - `query()` gives the result of `queryEntries()` of `@procedures/collections` for the entries.
  * - `observe()` gives one batch for each write that changes the storage, before the write resolves.
  * - `patch()` merges the fields into the item in one step.
+ * - A write with `expectedVersion` (`set`, `delete`) or `expectedVersions` (`setBatch`) tests the
+ *   version of the current item and writes in one step. A conflict changes nothing and rejects
+ *   with `VersionConflictError` (roadmap CLI-16).
  */
 
 import type { StoragePatch, StorageQueryOptions, StorageQueryPolicy, StorageSelector } from "./query.js";
@@ -76,10 +79,13 @@ export interface CollectionStorage<T> {
   has(id: string): Promise<boolean>;
   /** The number of items. */
   size(): Promise<number>;
-  /** Set the item of an id. The options give the origin of the write to the observers. */
-  set(id: string, value: T, options?: StorageWriteOptions): Promise<void>;
-  /** Delete the item of an id. True when it existed. */
-  delete(id: string, options?: StorageWriteOptions): Promise<boolean>;
+  /**
+   * Set the item of an id. The options give the origin of the write to the observers, and the
+   * expected version of the current item (roadmap CLI-16).
+   */
+  set(id: string, value: T, options?: StorageItemWriteOptions): Promise<void>;
+  /** Delete the item of an id. True when it existed. The options can expect a version, as for `set`. */
+  delete(id: string, options?: StorageItemWriteOptions): Promise<boolean>;
   /** Delete every item. */
   clear(options?: StorageWriteOptions): Promise<void>;
   /**
@@ -88,8 +94,8 @@ export interface CollectionStorage<T> {
    * procedure `patch` uses it. A storage without it gets a read and a write of the item.
    */
   patch?(id: string, fields: StoragePatch, options?: StorageWriteOptions): Promise<T | undefined>;
-  /** Set several items. */
-  setBatch(items: Array<[string, T]>, options?: StorageWriteOptions): Promise<void>;
+  /** Set several items. The options can expect a version for each id (roadmap CLI-16). */
+  setBatch(items: Array<[string, T]>, options?: StorageBatchWriteOptions): Promise<void>;
   /** Delete several items. The number of items that existed. */
   deleteBatch(ids: string[], options?: StorageWriteOptions): Promise<number>;
   /** The items of several ids. An id with no item is not in the map. */
@@ -114,6 +120,30 @@ export interface StorageWriteOptions {
   readonly origin?: string | undefined;
 }
 
+/**
+ * The options of `set` and `delete`: the origin, and the precondition of the write (roadmap
+ * CLI-16). `precondition.ts` gives the rules.
+ */
+export interface StorageItemWriteOptions extends StorageWriteOptions {
+  /**
+   * The version that the write expects for the current item, from `versionOf` of the storage.
+   * `null` expects no item. When the current item has another version, the write changes nothing
+   * and rejects with `VersionConflictError`. A storage without `versionOf` rejects it with a
+   * `TypeError`. Absent: no precondition.
+   */
+  readonly expectedVersion?: string | null | undefined;
+}
+
+/** The options of `setBatch`: the origin, and the precondition of each id (roadmap CLI-16). */
+export interface StorageBatchWriteOptions extends StorageWriteOptions {
+  /**
+   * The version that the write expects for the current item of each id, as for `expectedVersion`.
+   * When one id has a conflict, the batch changes no item. An id without an entry has no
+   * precondition.
+   */
+  readonly expectedVersions?: ReadonlyArray<readonly [string, string | null]> | undefined;
+}
+
 /** A change of `observe()`: an id got a value. */
 export interface StorageSetChange<T> {
   readonly type: "set";

package/src/procedures/index.ts

@@ -150,8 +150,23 @@ export {
   queryEntries,
   queryOptionsProblems,
   selectorProblems,
+  MAX_EXPECTED_VERSION_LENGTH,
+  PRECONDITION_NOT_SUPPORTED,
+  VERSION_CONFLICTS_METADATA_KEY,
+  VersionConflictError,
+  asVersionConflictError,
+  isExpectedVersion,
+  preconditionNotSupported,
+  versionConflict,
+  versionConflicts,
+  versionConflictsOf,
 } from "./collection/index.js";
 export type {
+  CurrentItem,
+  VersionConflict,
+  VersionOf,
+  StorageItemWriteOptions,
+  StorageBatchWriteOptions,
   CollectionProceduresOptions,
   CollectionChangeEventsOptions,
   CollectionChangeEvent,

package/src/protocol.ts

@@ -48,7 +48,9 @@ export type ProtocolErrorCode =
   | "CONNECTION_CLOSED"
   | "CONNECTION_NOT_FOUND"
   | "TOPIC_NOT_FOUND"
-  | "TOPIC_CLEARED";
+  | "TOPIC_CLEARED"
+  | "VERSION_CONFLICT"
+  | "RATE_LIMITED";
 
 /**
  * The error codes of the protocol, on each face (HTTP, WebSocket, MCP, local). An error that a
@@ -80,6 +82,8 @@ export const ERROR_CODES: Readonly<Record<ProtocolErrorCode, ErrorCodeInfo>> = {
   CONNECTION_NOT_FOUND: { http: 404, retryable: false, meaning: "The server has no connection with this id" },
   TOPIC_NOT_FOUND: { http: 404, retryable: false, meaning: "The topic rule of the host has no topic with this name" },
   TOPIC_CLEARED: { http: 410, retryable: false, meaning: "The host cleared a topic of the subscription: clear() of its bus removed the listener" },
+  VERSION_CONFLICT: { http: 409, retryable: false, meaning: "The current item does not have the version that the write expects. The metadata key conflicts has the current items" },
+  RATE_LIMITED: { http: 429, retryable: true, meaning: "A limit of the host refuses the call. The metadata key retry-after gives the wait, and reason gives the cause" },
 };
 
 /** True when a code is an error code of the protocol. */

package/src/server/host-policy.ts

@@ -18,6 +18,8 @@
  *   call and what the host gives for it (CAPABILITIES-2026-10).
  * - `events`: the remote events of the host (`documentation/EVENTS.md`). The server pins
  *   `events.subscribe` with this topic rule, and its procedures get the bus as `ctx.bus`.
+ * - `limits`, `limitStores`: the limits of the calls (CLI-40). Each server of the policy makes one
+ *   keyed limiter for each limit, and refuses a call above a limit with `RATE_LIMITED`.
  */
 
 import type { Capability, ClearanceOrder, ProcedurePath, ResourcesOf } from "../procedures/types.js";
@@ -30,6 +32,8 @@ import type { ProcedureRegistry } from "../procedures/registry.js";
 import type { ProcedureServerOptions } from "./procedure-server.js";
 import type { EventPublisherOptions } from "../events/publisher.js";
 import { toMs, type Duration } from "../duration.js";
+import type { LimiterStore } from "@mark1russell7/service/limiter";
+import type { CallLimit } from "./limits.js";
 
 /** The procedures of a host that are tools: namespaces (first path segments), less some keys. */
 export interface ToolSurface {
@@ -102,6 +106,15 @@ export interface HostPolicyOptions {
    * `ctx.bus`. Without this option, the host does not serve `events.subscribe`.
    */
   events?: EventPublisherOptions | undefined;
+  /**
+   * The limits of the calls (CLI-40): each limit counts the calls of one key, for example the
+   * writes of each tenant. A refusal is `RATE_LIMITED` on each face. Without it: no limits.
+   * Each limit that covers a call takes one unit, in the sequence of the limits. A limit before a
+   * refusal keeps its unit: the server does not give it back.
+   */
+  limits?: readonly CallLimit[] | undefined;
+  /** The stores that the replicas share, by the name of their dependency, for the limits with a shared store. */
+  limitStores?: Readonly<Record<string, LimiterStore>> | undefined;
 }
 
 /** What a host lets its callers do. */
@@ -120,6 +133,10 @@ export interface HostPolicy {
   readonly admitItem: AdmitItem | undefined;
   /** The remote events: each server of the policy makes its own publisher from these options. */
   readonly events: EventPublisherOptions | undefined;
+  /** The limits of the calls (CLI-40). Each server of the policy makes its own keyed limiters from them. */
+  readonly limits?: readonly CallLimit[] | undefined;
+  /** The shared stores of the limits, by the name of their dependency. */
+  readonly limitStores?: Readonly<Record<string, LimiterStore>> | undefined;
 }
 
 /** The capability function of a policy: the capability of the options, narrowed by `readOnly`. */
@@ -167,6 +184,8 @@ export function hostPolicy(options: HostPolicyOptions = {}): HostPolicy {
     resources: options.resources,
     admitItem: options.admitItem,
     events: options.events,
+    ...(options.limits && options.limits.length > 0 ? { limits: options.limits } : {}),
+    ...(options.limitStores ? { limitStores: options.limitStores } : {}),
   };
 }
 
@@ -188,5 +207,8 @@ export function procedureServerOptions(policy: HostPolicy, registry?: ProcedureR
     ...(policy.admitItem ? { admitItem: policy.admitItem } : {}),
     // The remote events: the server makes its publisher and pins events.subscribe (EVENTS.md)
     ...(policy.events ? { events: policy.events } : {}),
+    // The limits of the calls: the server makes one keyed limiter for each one (CLI-40)
+    ...(policy.limits ? { limits: policy.limits } : {}),
+    ...(policy.limitStores ? { limitStores: policy.limitStores } : {}),
   };
 }

package/src/server/limits.ts

@@ -0,0 +1,254 @@
+/**
+ * The limits of the calls of a server (CLI-40): one admission step for each face.
+ *
+ * A limit is data: a key over the call, the calls that it covers, a limit policy, a store and a
+ * bound on its keys. Each limit is a keyed limiter of `@mark1russell7/service/limiter` (SYS-28) on
+ * the clock of the server. The server takes one unit of each limit that covers a call, after the
+ * authentication and before the run. Thus the key can read the principal of the call. It takes the
+ * units in the sequence of the limits, and the first refusal stops the call. A limit before the
+ * refusal keeps its unit: the server does not give it back.
+ *
+ * A refusal is `RATE_LIMITED` (retryable), with the wait in the metadata key `retry-after` (in
+ * milliseconds) and the cause in `reason` (`limit`, `cap` or `store`). The HTTP face answers 429
+ * with `Retry-After` in whole seconds. The WebSocket face and the MCP face give the same code and
+ * the same wait. The work did not start, so a retry after the wait is safe.
+ */
+
+import { valueIn } from "@mark1russell7/quantity";
+import {
+  keyedLimiter,
+  memoryStore,
+  retryAfterSeconds,
+  type KeyedLimiter,
+  type LimitPolicy,
+  type LimiterEviction,
+  type LimiterStore,
+  type LimiterStoreSpec,
+  type Refused,
+} from "@mark1russell7/service/limiter";
+import type { Clock } from "../clock.js";
+import { effectsOf, isReadOnly } from "../procedures/capability.js";
+import { pathToKey, type Effects, type ProcedurePath } from "../procedures/types.js";
+import { exposePatterns } from "./host-policy.js";
+import type { Principal, ServerRequest, ServerResponse } from "./types.js";
+
+/** The facts of a call that a limit reads. The server gives them after the authentication of the call. */
+export interface LimitedCall {
+  /** The path of the procedure of the call. */
+  readonly path: ProcedurePath;
+  /** The route of the call: the key of its procedure, for example `collections.notes.set`. */
+  readonly route: string;
+  /** The effects that the procedure declares, or undefined when it declares none. */
+  readonly effects: Effects | undefined;
+  /** True when the procedure can change data: its effects do not say `writes: []`. A procedure without effects can change data. */
+  readonly writes: boolean;
+  /** The principal of the call: from the request hook, the token check or the authenticate function. Undefined for a call without one. */
+  readonly principal: Principal | undefined;
+  /** The request. Its payload and its metadata come from the caller, thus a key from them is a claim of the caller. */
+  readonly request: ServerRequest<unknown>;
+}
+
+/**
+ * A part of the key of a limit, as data:
+ * - `principal`: the id of the principal of the call.
+ * - `route`: the key of the procedure of the call.
+ * - `{ claim }`: a claim of the principal, for example `{ claim: "tenant" }`. A string or a number.
+ */
+export type CallLimitKeyPart = "principal" | "route" | { readonly claim: string };
+
+/**
+ * The key of a limit: one part, a list of parts, or a function of the call. A call whose key has
+ * no value (a part without a value, or a function that gives undefined) is outside the limit.
+ */
+export type CallLimitKey = CallLimitKeyPart | readonly CallLimitKeyPart[] | ((call: LimitedCall) => string | undefined);
+
+/** The calls that a limit covers, as data. Each given field must agree. Without a field, the limit covers each call. */
+export interface CallLimitCovers {
+  /** True: only the calls of a procedure that can change data. False: only the calls of a procedure that changes nothing. */
+  readonly writes?: boolean | undefined;
+  /** Only the calls of these procedures: an exact key (`notes.set`), a prefix (`collections.*`) or `*`. */
+  readonly routes?: readonly string[] | undefined;
+}
+
+/**
+ * A limit of the calls of a server (CLI-40): a keyed limiter of `@mark1russell7/service/limiter`
+ * with a key over the call. The policy, the store and the bound on the keys have no defaults, as
+ * in the spec of a keyed limiter (`LimiterSpec`).
+ */
+export interface CallLimit {
+  /** The name of the limiter. It is unique in the service: `svc.limiter()` declares the limiter with this name. */
+  readonly name: string;
+  /** The key of each call: who or what the limit counts. */
+  readonly key: CallLimitKey;
+  /**
+   * The text of the key in the declaration of the service (`LimiterSpec.key`), for example
+   * `tenant`. The default names the parts of the key, or `call` for a function.
+   */
+  readonly keyName?: string | undefined;
+  /** The calls that the limit covers: the fields of `CallLimitCovers`, or a function of the call. Without it, each call. */
+  readonly covers?: CallLimitCovers | ((call: LimitedCall) => boolean) | undefined;
+  /** The policy: a token bucket or a sliding window. */
+  readonly policy: LimitPolicy;
+  /**
+   * The store of the counts. `{ kind: "local" }`: the memory of this replica. `{ kind: "shared",
+   * dependency, onStoreFailure }`: the store of `limitStores` with the name of the dependency.
+   */
+  readonly store: LimiterStoreSpec;
+  /** The bound on the keys that the store holds. */
+  readonly evict: LimiterEviction;
+}
+
+/** The refusal of a call by one limit. */
+export interface CallLimitRefusal {
+  /** The name of the limit that refused the call. */
+  readonly limit: string;
+  readonly refused: Refused;
+}
+
+/** The limits of one server, as runtime: one keyed limiter for each limit. */
+export interface CallLimiter {
+  /** The keyed limiters, in the sequence of the limits. A host declares each one with `svc.limiter(name, spec)`. */
+  readonly limiters: readonly KeyedLimiter[];
+  /**
+   * This method takes one unit of each limit that covers the call, in the sequence of the limits.
+   * It gives the first refusal, or undefined. A limit before the refusal keeps its unit.
+   */
+  admit(call: LimitedCall): Promise<CallLimitRefusal | undefined>;
+}
+
+/** The options of `callLimiter()`. */
+export interface CallLimiterOptions {
+  /** The clock of the local store: give the clock of the server. */
+  readonly clock: Clock;
+  /** The stores that the replicas share, by the name of their dependency. */
+  readonly stores?: Readonly<Record<string, LimiterStore>> | undefined;
+}
+
+/** The metadata key of the wait of a refusal, in milliseconds (the same key as `retry-after` of wire v1). */
+const RETRY_AFTER = "retry-after";
+
+/** This function tells if a key is a list of parts. */
+function isPartList(key: CallLimitKey): key is readonly CallLimitKeyPart[] {
+  return Array.isArray(key);
+}
+
+/** The value of one part of a key, or undefined. */
+function partValue(part: CallLimitKeyPart, call: LimitedCall): string | undefined {
+  if (part === "principal") return call.principal?.id;
+  if (part === "route") return call.route;
+  const value = call.principal?.claims?.[part.claim];
+  return typeof value === "string" ? value : typeof value === "number" && Number.isFinite(value) ? String(value) : undefined;
+}
+
+/** The text of one part of a key, for the declaration of the service. */
+function partName(part: CallLimitKeyPart): string {
+  return typeof part === "string" ? part : part.claim;
+}
+
+/** This function gives the function of the key of a limit. A list of parts gives the JSON of the values. */
+function keyFunction(key: CallLimitKey): (call: LimitedCall) => string | undefined {
+  if (typeof key === "function") return key;
+  const parts = isPartList(key) ? key : [key];
+  if (parts.length === 0) throw new Error("A key of a limit needs one part or more");
+  return (call) => {
+    const values: string[] = [];
+    for (const part of parts) {
+      const value = partValue(part, call);
+      if (value === undefined) return undefined;
+      values.push(value);
+    }
+    return values.length === 1 ? values[0] : JSON.stringify(values);
+  };
+}
+
+/** The text of the key of a limit, for the declaration of the service. */
+function keyNameOf(limit: CallLimit): string {
+  if (limit.keyName !== undefined) return limit.keyName;
+  if (typeof limit.key === "function") return "call";
+  return (isPartList(limit.key) ? limit.key : [limit.key]).map(partName).join("+");
+}
+
+/** This function gives the function that tells if a limit covers a call. */
+function coversFunction(covers: CallLimit["covers"]): (call: LimitedCall) => boolean {
+  if (covers === undefined) return () => true;
+  if (typeof covers === "function") return covers;
+  const { writes, routes } = covers;
+  const routeRule = routes === undefined ? undefined : exposePatterns(routes);
+  return (call) => (writes === undefined || call.writes === writes) && (routeRule === undefined || routeRule(call.path));
+}
+
+/** This function gives the store of a limit: the local store, or the shared store of its dependency. */
+function storeOf(limit: CallLimit, local: LimiterStore, stores: Readonly<Record<string, LimiterStore>>): LimiterStore {
+  const spec = limit.store as LimiterStoreSpec | undefined;
+  if (spec === undefined || spec.kind !== "shared") return local;
+  const store = Object.prototype.hasOwnProperty.call(stores, spec.dependency) ? stores[spec.dependency] : undefined;
+  if (store === undefined) {
+    throw new Error(`The limit ${limit.name} keeps its counts in the shared store ${spec.dependency}, and limitStores has no store with that name`);
+  }
+  return store;
+}
+
+/**
+ * This function makes the runtime of the limits of a server: one keyed limiter for each limit. The
+ * local limits share one memory store on the clock of the options. It refuses two limits with one
+ * name, a limit with a problem in its spec, and a shared store that `stores` does not have.
+ */
+export function callLimiter(limits: readonly CallLimit[], options: CallLimiterOptions): CallLimiter {
+  const local = memoryStore(options.clock);
+  const stores = options.stores ?? {};
+  const names = new Set<string>();
+  const entries = limits.map((limit) => {
+    if (names.has(limit.name)) throw new Error(`Two limits have the name ${limit.name}: the name of a limit is unique`);
+    names.add(limit.name);
+    const keyOf = keyFunction(limit.key);
+    const covers = coversFunction(limit.covers);
+    const limiter = keyedLimiter(limit.name, { key: keyNameOf(limit), policy: limit.policy, store: limit.store, evict: limit.evict }, storeOf(limit, local, stores));
+    return { limiter, keyOf, covers };
+  });
+  return {
+    limiters: entries.map((entry) => entry.limiter),
+    async admit(call) {
+      for (const { limiter, keyOf, covers } of entries) {
+        if (!covers(call)) continue;
+        const key = keyOf(call);
+        if (key === undefined) continue;
+        const decision = await limiter.take(key);
+        if (!decision.allowed) return { limit: limiter.name, refused: decision };
+      }
+      return undefined;
+    },
+  };
+}
+
+/** This function gives the facts of a call for the limits: its procedure, its effects, its principal and its request. */
+export function limitedCall(procedure: { readonly path: ProcedurePath; readonly metadata?: unknown }, request: ServerRequest<unknown>): LimitedCall {
+  const effects = effectsOf(procedure);
+  return {
+    path: procedure.path,
+    route: pathToKey(procedure.path),
+    effects,
+    writes: !isReadOnly(effects),
+    principal: request.principal,
+    request,
+  };
+}
+
+/**
+ * This function gives the response of a refused call: `RATE_LIMITED`, retryable, with the wait in
+ * `retry-after` (milliseconds) and the cause in `reason`. The failure of a store stays on the server.
+ */
+export function rateLimitedResponse(id: string, refusal: CallLimitRefusal): ServerResponse<unknown> {
+  const { limit, refused } = refusal;
+  const waitMs = valueIn(refused.retryAfter, "ms");
+  const seconds = retryAfterSeconds(refused.retryAfter);
+  return {
+    id,
+    status: {
+      type: "error",
+      code: "RATE_LIMITED",
+      message: `The limit ${limit} of the host refuses the call (${refused.cause}): retry after ${seconds} s`,
+      retryable: true,
+    },
+    metadata: { [RETRY_AFTER]: waitMs, reason: refused.cause },
+  };
+}