@procedures/client 0.15.0 → 0.16.0

package/src/procedures/collection/changes.ts

@@ -28,6 +28,8 @@ import type { EventBus } from "../../events/types.js";
 import { withRows } from "../../events/rows.js";
 import type { AdmitItem } from "../invoke.js";
 import type { StorageChanges } from "./storage.js";
+import type { RepositoryProvider } from "../types.js";
+import { collectionTopicTarget } from "./topic.js";
 
 /**
  * The change event of the writes of a collection, on the topic `collections.<name>` (roadmap
@@ -56,22 +58,21 @@ export interface CollectionChangeEvent {
   readonly origin?: string | undefined;
 }
 
-/**
- * This function gives the topic of the change events of a collection: `collections.<name>`, or
- * `collections.<name>.<partition>` for a partition (roadmap CLI-17).
- */
-export function collectionChangeTopic(collection: string, partition?: string): string {
-  return partition === undefined ? `collections.${collection}` : `collections.${collection}.${partition}`;
-}
+export { collectionChangeTopic } from "./topic.js";
 
 /**
  * This function gives the resources that a subscriber of a topic reads: `collection:<name>` for
  * the topic `collections.<name>` and for a topic of a partition, `collections.<name>.<partition>`.
- * Another topic gives no resource. `EventPublisher` uses it as its default `reads`.
+ * Another topic gives no resource. `EventPublisher` uses it as its default `reads`, with the
+ * repository of the call.
+ *
+ * It reads the topic with `collectionTopicTarget()`, the parse of the listener of the publisher
+ * (roadmap CLI-42). With the repository, the plain topic of a dotted name, `collections.graph.nodes`,
+ * reads `collection:graph.nodes`. Without it, the first dot ends the name.
  */
-export function collectionTopicReads(topic: string): readonly string[] {
-  const match = /^collections\.([^.]+)(?:\.|$)/.exec(topic);
-  return match ? [`collection:${match[1]}`] : [];
+export function collectionTopicReads(topic: string, repository?: RepositoryProvider): readonly string[] {
+  const target = collectionTopicTarget(topic, repository);
+  return target ? [`collection:${target.collection}`] : [];
 }
 
 /** The part of a storage that the change events read. */

package/src/procedures/collection/index.ts

@@ -72,6 +72,8 @@ export type { CollectionChangeEvent } from "./changes.js";
 
 // The partitions of a collection (roadmap CLI-17)
 export { PARTITION_PATTERN, collectionTopicPartition, collectionTopicTarget, partitionOfCall, storageOfCall, withPartition } from "./partition.js";
+// The topic rule of a collection for EventPublisher (roadmap CLI-42)
+export { collectionTopicRule } from "./topic.js";
 export type { CollectionPartitions, PartitionInput, PartitionResolver } from "./partition.js";
 
 // The rules of the rows of a collection: a filter of the reads and a guard of the writes (roadmap CLI-41)

package/src/procedures/collection/partition.ts

@@ -11,11 +11,13 @@
  * - A subscriber names the partition that it asks for in the topic, as an input does:
  *   `collections.<name>.<requested>`. The publisher resolves it in the same way and listens to the
  *   topic of the resolved partition, so a subscriber cannot name the topic of another tenant.
+ * - In the topic of a partition, the name encodes `%` and `.` (`topic.ts`, roadmap CLI-42). Thus
+ *   the name of a collection with partitions can have a dot.
  * - A collection without partitions refuses a call or a topic with a partition.
  */
 import type { ZodLike } from "../../client/validation/types.js";
 import { InvocationError } from "../invoke.js";
-import type { ProcedureContext, RepositoryProvider } from "../types.js";
+import type { ProcedureContext } from "../types.js";
 import type { CollectionStorage } from "./storage.js";
 
 /** The characters of a partition: letters, digits and `_ . : @ ~ + | / -`, 256 at most. */
@@ -129,29 +131,5 @@ export function storageOfCall<T>(ctx: ProcedureContext, collection: string, part
   return repository.getPartitionStorage<T>(collection, partition);
 }
 
-/**
- * This function gives the collection and the partition part of a topic of a call, with the
- * repository of the call: one rule for the read check and for the listener of the publisher.
- *
- * - A collection of the repository without partitions whose name is the whole rest of the topic
- *   wins: its name can have a dot.
- * - Else the first part after `collections.` names the collection, and the rest is the partition
- *   that the call asks for. A collection with partitions has no dot in its name.
- */
-export function collectionTopicTarget(topic: string, repository: RepositoryProvider | undefined): { collection: string; partition: string | undefined } | undefined {
-  if (!topic.startsWith("collections.")) return undefined;
-  const whole = topic.slice("collections.".length);
-  if (whole !== "" && repository?.hasCollection(whole) && !repository.hasPartitions?.(whole)) return { collection: whole, partition: undefined };
-  return collectionTopicPartition(topic);
-}
-
-/**
- * This function gives the collection and the partition part of a topic `collections.<name>` or
- * `collections.<name>.<partition>`, or undefined for another topic. It reads the topic alone:
- * `collectionTopicTarget` also knows the collections of a repository.
- */
-export function collectionTopicPartition(topic: string): { collection: string; partition: string | undefined } | undefined {
-  const match = /^collections\.([^.]+)(?:\.(.+))?$/.exec(topic);
-  if (!match) return undefined;
-  return { collection: match[1]!, partition: match[2] };
-}
+// The parse of a topic lives in topic.ts, with the encode (roadmap CLI-42)
+export { collectionTopicPartition, collectionTopicTarget } from "./topic.js";

package/src/procedures/collection/topic.ts

@@ -0,0 +1,115 @@
+/**
+ * The topics of the change events of a collection (roadmap CLI-15, CLI-17 and CLI-42). This module
+ * has the one function that makes a topic, the functions that read it, and the topic rule of a
+ * collection. Each part of the client that makes or reads the topic of a collection or of a
+ * partition uses them.
+ *
+ * - `collections.<name>` is the topic of a collection. The name stays as it is, also with a dot.
+ * - `collections.<name>.<partition>` is the topic of a partition. In this form, the name encodes
+ *   `%` as `%25` and `.` as `%2E`. Thus the first dot after `collections.` ends the name, and the
+ *   partition after that dot can have each character, also `.`, `/` and `%`.
+ * - The partition stays as it is, and so does a name without `.` and `%`. Thus each topic of a
+ *   partition of a name without `.` and `%` stays the same as before CLI-42.
+ * - Only the canonical form of a topic counts: a parse gives a collection and a partition only when
+ *   `collectionChangeTopic(collection, partition)` gives the same topic. Thus `%2e` is no alias of
+ *   `%2E`, and a rule or an `allow` function that compares the strings sees each topic one way.
+ * - The topic of a collection whose name has a dot, `collections.a.b`, has the same form as the
+ *   topic of the partition `b` of the collection `a`. Only the repository knows the collection, so
+ *   `collectionTopicTarget()` decides with it.
+ */
+import type { RepositoryProvider } from "../types.js";
+
+/** The prefix of the topic of each collection. */
+const PREFIX = "collections.";
+
+/** This function encodes the name of a collection for a topic with a partition: `%` and `.` become `%25` and `%2E`. */
+function encodeTopicName(name: string): string {
+  return name.replace(/[%.]/g, (char) => (char === "%" ? "%25" : "%2E"));
+}
+
+/** This function decodes the name of a topic with a partition. The parse then checks the canonical form. */
+function decodeTopicName(segment: string): string {
+  return segment.replace(/%(25|2E)/g, (_sequence, code: string) => (code === "25" ? "%" : "."));
+}
+
+/**
+ * This function gives the topic of the change events of a collection: `collections.<name>`, or
+ * `collections.<name>.<partition>` for a partition (roadmap CLI-17). In the topic of a partition,
+ * the name encodes `%` and `.` (roadmap CLI-42), so `collectionTopicPartition()` gives back the
+ * same collection and the same partition.
+ *
+ * @example
+ * ```typescript
+ * collectionChangeTopic("notes", "t1/board:b1"); // "collections.notes.t1/board:b1"
+ * collectionChangeTopic("graph.nodes", "acme/space"); // "collections.graph%2Enodes.acme/space"
+ * collectionChangeTopic("graph.nodes"); // "collections.graph.nodes"
+ * ```
+ */
+export function collectionChangeTopic(collection: string, partition?: string): string {
+  return partition === undefined ? `${PREFIX}${collection}` : `${PREFIX}${encodeTopicName(collection)}.${partition}`;
+}
+
+/**
+ * This function gives the collection and the partition of a topic `collections.<name>` or
+ * `collections.<name>.<partition>`, or undefined for another topic. It reads the topic alone:
+ * `collectionTopicTarget()` also knows the collections of a repository.
+ *
+ * - The first dot after the name ends the name. In a topic with a partition, the name is decoded:
+ *   `%2E` is a dot and `%25` is a `%` (roadmap CLI-42).
+ * - Each character after that dot is the partition. A partition has one character at least.
+ * - A topic that is not in the canonical form gives undefined: `collectionChangeTopic()` of the
+ *   result always gives the topic again. Thus `collections.a%2eb.t1` names no collection.
+ * - For each name and each partition, `collectionTopicPartition(collectionChangeTopic(name,
+ *   partition))` gives the same name and the same partition.
+ */
+export function collectionTopicPartition(topic: string): { collection: string; partition: string | undefined } | undefined {
+  if (!topic.startsWith(PREFIX)) return undefined;
+  const rest = topic.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot === -1) return rest === "" ? undefined : { collection: rest, partition: undefined };
+  if (dot === 0 || dot === rest.length - 1) return undefined;
+  const collection = decodeTopicName(rest.slice(0, dot));
+  const partition = rest.slice(dot + 1);
+  // Only the canonical form counts: an alias of an escape names no collection
+  return collectionChangeTopic(collection, partition) === topic ? { collection, partition } : undefined;
+}
+
+/**
+ * This function gives the collection and the partition part of a topic of a call, with the
+ * repository of the call: one rule for the read check and for the listener of the publisher.
+ *
+ * - A collection of the repository whose name is the whole rest of the topic wins, with or without
+ *   partitions: its name can have a dot. The call then asks for no partition.
+ * - Else `collectionTopicPartition()` reads the topic: the first dot after the name ends the name,
+ *   and the rest is the partition that the call asks for. In this form, the name encodes `%` and
+ *   `.`, so the name of a collection with partitions can have a dot (roadmap CLI-42).
+ */
+export function collectionTopicTarget(topic: string, repository: RepositoryProvider | undefined): { collection: string; partition: string | undefined } | undefined {
+  if (!topic.startsWith(PREFIX)) return undefined;
+  const whole = topic.slice(PREFIX.length);
+  if (whole !== "" && repository?.hasCollection(whole)) return { collection: whole, partition: undefined };
+  return collectionTopicPartition(topic);
+}
+
+/**
+ * This function gives the topic rule of a collection for `EventPublisher` (the option `topics`):
+ * the topic of the collection, and the pattern of the topics of its partitions (roadmap CLI-42).
+ * Build the rule of a collection with it. Do not join the parts yourself: a dotted name needs its
+ * encoded form in the pattern.
+ *
+ * - The rule always has the two forms. For a collection with partitions, the plain topic asks for
+ *   no partition, and the resolver of the partition decides.
+ * - For a collection without partitions, a topic of a partition passes the rule. The publisher then
+ *   refuses it with `FORBIDDEN` (reason `partition-not-allowed`).
+ * - The pattern matches only the canonical form of a topic, so an alias of an escape gets
+ *   `TOPIC_NOT_FOUND`.
+ *
+ * @example
+ * ```typescript
+ * collectionTopicRule("graph.nodes"); // ["collections.graph.nodes", "collections.graph%2Enodes.*"]
+ * new EventPublisher({ bus, topics: ["orders.*", ...collectionTopicRule("graph.nodes")] });
+ * ```
+ */
+export function collectionTopicRule(collection: string): string[] {
+  return [collectionChangeTopic(collection), `${PREFIX}${encodeTopicName(collection)}.*`];
+}

package/src/procedures/index.ts

@@ -133,6 +133,7 @@ export {
   PARTITION_PATTERN,
   collectionTopicPartition,
   collectionTopicTarget,
+  collectionTopicRule,
   // The rules of the rows of a collection (roadmap CLI-41)
   admittedStorage,
   admitsRow,

package/src/protocol.ts

@@ -49,7 +49,8 @@ export type ProtocolErrorCode =
   | "CONNECTION_NOT_FOUND"
   | "TOPIC_NOT_FOUND"
   | "TOPIC_CLEARED"
-  | "VERSION_CONFLICT";
+  | "VERSION_CONFLICT"
+  | "RATE_LIMITED";
 
 /**
  * The error codes of the protocol, on each face (HTTP, WebSocket, MCP, local). An error that a
@@ -82,6 +83,7 @@ export const ERROR_CODES: Readonly<Record<ProtocolErrorCode, ErrorCodeInfo>> = {
   TOPIC_NOT_FOUND: { http: 404, retryable: false, meaning: "The topic rule of the host has no topic with this name" },
   TOPIC_CLEARED: { http: 410, retryable: false, meaning: "The host cleared a topic of the subscription: clear() of its bus removed the listener" },
   VERSION_CONFLICT: { http: 409, retryable: false, meaning: "The current item does not have the version that the write expects. The metadata key conflicts has the current items" },
+  RATE_LIMITED: { http: 429, retryable: true, meaning: "A limit of the host refuses the call. The metadata key retry-after gives the wait, and reason gives the cause" },
 };
 
 /** True when a code is an error code of the protocol. */

package/src/server/host-policy.ts

@@ -18,6 +18,8 @@
  *   call and what the host gives for it (CAPABILITIES-2026-10).
  * - `events`: the remote events of the host (`documentation/EVENTS.md`). The server pins
  *   `events.subscribe` with this topic rule, and its procedures get the bus as `ctx.bus`.
+ * - `limits`, `limitStores`: the limits of the calls (CLI-40). Each server of the policy makes one
+ *   keyed limiter for each limit, and refuses a call above a limit with `RATE_LIMITED`.
  */
 
 import type { Capability, ClearanceOrder, ProcedurePath, ResourcesOf } from "../procedures/types.js";
@@ -30,6 +32,8 @@ import type { ProcedureRegistry } from "../procedures/registry.js";
 import type { ProcedureServerOptions } from "./procedure-server.js";
 import type { EventPublisherOptions } from "../events/publisher.js";
 import { toMs, type Duration } from "../duration.js";
+import type { LimiterStore } from "@mark1russell7/service/limiter";
+import type { CallLimit } from "./limits.js";
 
 /** The procedures of a host that are tools: namespaces (first path segments), less some keys. */
 export interface ToolSurface {
@@ -102,6 +106,15 @@ export interface HostPolicyOptions {
    * `ctx.bus`. Without this option, the host does not serve `events.subscribe`.
    */
   events?: EventPublisherOptions | undefined;
+  /**
+   * The limits of the calls (CLI-40): each limit counts the calls of one key, for example the
+   * writes of each tenant. A refusal is `RATE_LIMITED` on each face. Without it: no limits.
+   * Each limit that covers a call takes one unit, in the sequence of the limits. A limit before a
+   * refusal keeps its unit: the server does not give it back.
+   */
+  limits?: readonly CallLimit[] | undefined;
+  /** The stores that the replicas share, by the name of their dependency, for the limits with a shared store. */
+  limitStores?: Readonly<Record<string, LimiterStore>> | undefined;
 }
 
 /** What a host lets its callers do. */
@@ -120,6 +133,10 @@ export interface HostPolicy {
   readonly admitItem: AdmitItem | undefined;
   /** The remote events: each server of the policy makes its own publisher from these options. */
   readonly events: EventPublisherOptions | undefined;
+  /** The limits of the calls (CLI-40). Each server of the policy makes its own keyed limiters from them. */
+  readonly limits?: readonly CallLimit[] | undefined;
+  /** The shared stores of the limits, by the name of their dependency. */
+  readonly limitStores?: Readonly<Record<string, LimiterStore>> | undefined;
 }
 
 /** The capability function of a policy: the capability of the options, narrowed by `readOnly`. */
@@ -167,6 +184,8 @@ export function hostPolicy(options: HostPolicyOptions = {}): HostPolicy {
     resources: options.resources,
     admitItem: options.admitItem,
     events: options.events,
+    ...(options.limits && options.limits.length > 0 ? { limits: options.limits } : {}),
+    ...(options.limitStores ? { limitStores: options.limitStores } : {}),
   };
 }
 
@@ -188,5 +207,8 @@ export function procedureServerOptions(policy: HostPolicy, registry?: ProcedureR
     ...(policy.admitItem ? { admitItem: policy.admitItem } : {}),
     // The remote events: the server makes its publisher and pins events.subscribe (EVENTS.md)
     ...(policy.events ? { events: policy.events } : {}),
+    // The limits of the calls: the server makes one keyed limiter for each one (CLI-40)
+    ...(policy.limits ? { limits: policy.limits } : {}),
+    ...(policy.limitStores ? { limitStores: policy.limitStores } : {}),
   };
 }

package/src/server/limits.ts

@@ -0,0 +1,254 @@
+/**
+ * The limits of the calls of a server (CLI-40): one admission step for each face.
+ *
+ * A limit is data: a key over the call, the calls that it covers, a limit policy, a store and a
+ * bound on its keys. Each limit is a keyed limiter of `@mark1russell7/service/limiter` (SYS-28) on
+ * the clock of the server. The server takes one unit of each limit that covers a call, after the
+ * authentication and before the run. Thus the key can read the principal of the call. It takes the
+ * units in the sequence of the limits, and the first refusal stops the call. A limit before the
+ * refusal keeps its unit: the server does not give it back.
+ *
+ * A refusal is `RATE_LIMITED` (retryable), with the wait in the metadata key `retry-after` (in
+ * milliseconds) and the cause in `reason` (`limit`, `cap` or `store`). The HTTP face answers 429
+ * with `Retry-After` in whole seconds. The WebSocket face and the MCP face give the same code and
+ * the same wait. The work did not start, so a retry after the wait is safe.
+ */
+
+import { valueIn } from "@mark1russell7/quantity";
+import {
+  keyedLimiter,
+  memoryStore,
+  retryAfterSeconds,
+  type KeyedLimiter,
+  type LimitPolicy,
+  type LimiterEviction,
+  type LimiterStore,
+  type LimiterStoreSpec,
+  type Refused,
+} from "@mark1russell7/service/limiter";
+import type { Clock } from "../clock.js";
+import { effectsOf, isReadOnly } from "../procedures/capability.js";
+import { pathToKey, type Effects, type ProcedurePath } from "../procedures/types.js";
+import { exposePatterns } from "./host-policy.js";
+import type { Principal, ServerRequest, ServerResponse } from "./types.js";
+
+/** The facts of a call that a limit reads. The server gives them after the authentication of the call. */
+export interface LimitedCall {
+  /** The path of the procedure of the call. */
+  readonly path: ProcedurePath;
+  /** The route of the call: the key of its procedure, for example `collections.notes.set`. */
+  readonly route: string;
+  /** The effects that the procedure declares, or undefined when it declares none. */
+  readonly effects: Effects | undefined;
+  /** True when the procedure can change data: its effects do not say `writes: []`. A procedure without effects can change data. */
+  readonly writes: boolean;
+  /** The principal of the call: from the request hook, the token check or the authenticate function. Undefined for a call without one. */
+  readonly principal: Principal | undefined;
+  /** The request. Its payload and its metadata come from the caller, thus a key from them is a claim of the caller. */
+  readonly request: ServerRequest<unknown>;
+}
+
+/**
+ * A part of the key of a limit, as data:
+ * - `principal`: the id of the principal of the call.
+ * - `route`: the key of the procedure of the call.
+ * - `{ claim }`: a claim of the principal, for example `{ claim: "tenant" }`. A string or a number.
+ */
+export type CallLimitKeyPart = "principal" | "route" | { readonly claim: string };
+
+/**
+ * The key of a limit: one part, a list of parts, or a function of the call. A call whose key has
+ * no value (a part without a value, or a function that gives undefined) is outside the limit.
+ */
+export type CallLimitKey = CallLimitKeyPart | readonly CallLimitKeyPart[] | ((call: LimitedCall) => string | undefined);
+
+/** The calls that a limit covers, as data. Each given field must agree. Without a field, the limit covers each call. */
+export interface CallLimitCovers {
+  /** True: only the calls of a procedure that can change data. False: only the calls of a procedure that changes nothing. */
+  readonly writes?: boolean | undefined;
+  /** Only the calls of these procedures: an exact key (`notes.set`), a prefix (`collections.*`) or `*`. */
+  readonly routes?: readonly string[] | undefined;
+}
+
+/**
+ * A limit of the calls of a server (CLI-40): a keyed limiter of `@mark1russell7/service/limiter`
+ * with a key over the call. The policy, the store and the bound on the keys have no defaults, as
+ * in the spec of a keyed limiter (`LimiterSpec`).
+ */
+export interface CallLimit {
+  /** The name of the limiter. It is unique in the service: `svc.limiter()` declares the limiter with this name. */
+  readonly name: string;
+  /** The key of each call: who or what the limit counts. */
+  readonly key: CallLimitKey;
+  /**
+   * The text of the key in the declaration of the service (`LimiterSpec.key`), for example
+   * `tenant`. The default names the parts of the key, or `call` for a function.
+   */
+  readonly keyName?: string | undefined;
+  /** The calls that the limit covers: the fields of `CallLimitCovers`, or a function of the call. Without it, each call. */
+  readonly covers?: CallLimitCovers | ((call: LimitedCall) => boolean) | undefined;
+  /** The policy: a token bucket or a sliding window. */
+  readonly policy: LimitPolicy;
+  /**
+   * The store of the counts. `{ kind: "local" }`: the memory of this replica. `{ kind: "shared",
+   * dependency, onStoreFailure }`: the store of `limitStores` with the name of the dependency.
+   */
+  readonly store: LimiterStoreSpec;
+  /** The bound on the keys that the store holds. */
+  readonly evict: LimiterEviction;
+}
+
+/** The refusal of a call by one limit. */
+export interface CallLimitRefusal {
+  /** The name of the limit that refused the call. */
+  readonly limit: string;
+  readonly refused: Refused;
+}
+
+/** The limits of one server, as runtime: one keyed limiter for each limit. */
+export interface CallLimiter {
+  /** The keyed limiters, in the sequence of the limits. A host declares each one with `svc.limiter(name, spec)`. */
+  readonly limiters: readonly KeyedLimiter[];
+  /**
+   * This method takes one unit of each limit that covers the call, in the sequence of the limits.
+   * It gives the first refusal, or undefined. A limit before the refusal keeps its unit.
+   */
+  admit(call: LimitedCall): Promise<CallLimitRefusal | undefined>;
+}
+
+/** The options of `callLimiter()`. */
+export interface CallLimiterOptions {
+  /** The clock of the local store: give the clock of the server. */
+  readonly clock: Clock;
+  /** The stores that the replicas share, by the name of their dependency. */
+  readonly stores?: Readonly<Record<string, LimiterStore>> | undefined;
+}
+
+/** The metadata key of the wait of a refusal, in milliseconds (the same key as `retry-after` of wire v1). */
+const RETRY_AFTER = "retry-after";
+
+/** This function tells if a key is a list of parts. */
+function isPartList(key: CallLimitKey): key is readonly CallLimitKeyPart[] {
+  return Array.isArray(key);
+}
+
+/** The value of one part of a key, or undefined. */
+function partValue(part: CallLimitKeyPart, call: LimitedCall): string | undefined {
+  if (part === "principal") return call.principal?.id;
+  if (part === "route") return call.route;
+  const value = call.principal?.claims?.[part.claim];
+  return typeof value === "string" ? value : typeof value === "number" && Number.isFinite(value) ? String(value) : undefined;
+}
+
+/** The text of one part of a key, for the declaration of the service. */
+function partName(part: CallLimitKeyPart): string {
+  return typeof part === "string" ? part : part.claim;
+}
+
+/** This function gives the function of the key of a limit. A list of parts gives the JSON of the values. */
+function keyFunction(key: CallLimitKey): (call: LimitedCall) => string | undefined {
+  if (typeof key === "function") return key;
+  const parts = isPartList(key) ? key : [key];
+  if (parts.length === 0) throw new Error("A key of a limit needs one part or more");
+  return (call) => {
+    const values: string[] = [];
+    for (const part of parts) {
+      const value = partValue(part, call);
+      if (value === undefined) return undefined;
+      values.push(value);
+    }
+    return values.length === 1 ? values[0] : JSON.stringify(values);
+  };
+}
+
+/** The text of the key of a limit, for the declaration of the service. */
+function keyNameOf(limit: CallLimit): string {
+  if (limit.keyName !== undefined) return limit.keyName;
+  if (typeof limit.key === "function") return "call";
+  return (isPartList(limit.key) ? limit.key : [limit.key]).map(partName).join("+");
+}
+
+/** This function gives the function that tells if a limit covers a call. */
+function coversFunction(covers: CallLimit["covers"]): (call: LimitedCall) => boolean {
+  if (covers === undefined) return () => true;
+  if (typeof covers === "function") return covers;
+  const { writes, routes } = covers;
+  const routeRule = routes === undefined ? undefined : exposePatterns(routes);
+  return (call) => (writes === undefined || call.writes === writes) && (routeRule === undefined || routeRule(call.path));
+}
+
+/** This function gives the store of a limit: the local store, or the shared store of its dependency. */
+function storeOf(limit: CallLimit, local: LimiterStore, stores: Readonly<Record<string, LimiterStore>>): LimiterStore {
+  const spec = limit.store as LimiterStoreSpec | undefined;
+  if (spec === undefined || spec.kind !== "shared") return local;
+  const store = Object.prototype.hasOwnProperty.call(stores, spec.dependency) ? stores[spec.dependency] : undefined;
+  if (store === undefined) {
+    throw new Error(`The limit ${limit.name} keeps its counts in the shared store ${spec.dependency}, and limitStores has no store with that name`);
+  }
+  return store;
+}
+
+/**
+ * This function makes the runtime of the limits of a server: one keyed limiter for each limit. The
+ * local limits share one memory store on the clock of the options. It refuses two limits with one
+ * name, a limit with a problem in its spec, and a shared store that `stores` does not have.
+ */
+export function callLimiter(limits: readonly CallLimit[], options: CallLimiterOptions): CallLimiter {
+  const local = memoryStore(options.clock);
+  const stores = options.stores ?? {};
+  const names = new Set<string>();
+  const entries = limits.map((limit) => {
+    if (names.has(limit.name)) throw new Error(`Two limits have the name ${limit.name}: the name of a limit is unique`);
+    names.add(limit.name);
+    const keyOf = keyFunction(limit.key);
+    const covers = coversFunction(limit.covers);
+    const limiter = keyedLimiter(limit.name, { key: keyNameOf(limit), policy: limit.policy, store: limit.store, evict: limit.evict }, storeOf(limit, local, stores));
+    return { limiter, keyOf, covers };
+  });
+  return {
+    limiters: entries.map((entry) => entry.limiter),
+    async admit(call) {
+      for (const { limiter, keyOf, covers } of entries) {
+        if (!covers(call)) continue;
+        const key = keyOf(call);
+        if (key === undefined) continue;
+        const decision = await limiter.take(key);
+        if (!decision.allowed) return { limit: limiter.name, refused: decision };
+      }
+      return undefined;
+    },
+  };
+}
+
+/** This function gives the facts of a call for the limits: its procedure, its effects, its principal and its request. */
+export function limitedCall(procedure: { readonly path: ProcedurePath; readonly metadata?: unknown }, request: ServerRequest<unknown>): LimitedCall {
+  const effects = effectsOf(procedure);
+  return {
+    path: procedure.path,
+    route: pathToKey(procedure.path),
+    effects,
+    writes: !isReadOnly(effects),
+    principal: request.principal,
+    request,
+  };
+}
+
+/**
+ * This function gives the response of a refused call: `RATE_LIMITED`, retryable, with the wait in
+ * `retry-after` (milliseconds) and the cause in `reason`. The failure of a store stays on the server.
+ */
+export function rateLimitedResponse(id: string, refusal: CallLimitRefusal): ServerResponse<unknown> {
+  const { limit, refused } = refusal;
+  const waitMs = valueIn(refused.retryAfter, "ms");
+  const seconds = retryAfterSeconds(refused.retryAfter);
+  return {
+    id,
+    status: {
+      type: "error",
+      code: "RATE_LIMITED",
+      message: `The limit ${limit} of the host refuses the call (${refused.cause}): retry after ${seconds} s`,
+      retryable: true,
+    },
+    metadata: { [RETRY_AFTER]: waitMs, reason: refused.cause },
+  };
+}