Module limits 

Execution budgets.

Turing-complete rules can fail to terminate. Three limits bound that, none of which can be disabled: a per-invocation timeout, a global wall-clock budget for the whole run, and a memory ceiling per runtime.

Breaching any of them cancels the run — see docs/architecture.md §6.8 for why continuing would be worse. Turning a breach into an error is each engine’s own concern; lanekeep-js’s SandboxError is one such type.

Why this lives in lanekeep-core rather than in one engine

There is one global run budget, not one per engine: docs/architecture.md’s resource-limits invariant is that breaching it cancels the run, and a run can call into more than one engine (lanekeep-js’s QuickJS sandbox today, lanekeep-wasm’s component runtime once it dispatches rules). RunClock is the shared origin that makes “the run” a single wall-clock deadline rather than a per-engine one. Two independent clocks would each enforce their own share of the budget correctly in isolation while the run as a whole overran both — a quantitative failure, not a maintenance one, since it needs no drift to manifest: two honest clocks that were never told about each other already sum past the one promise the run makes. Defining RunClock once, here, is what keeps a second instance from being constructible at all for a single run.

Structs

Budget

Shared between an engine’s runtime and its interrupt handler.

Limits

The three budgets.

RunClock

When the run started, shared by every worker.

Enums

Trip

Which budget was breached.

Constants

DEFAULT_GLOBAL_TIMEOUT

Default wall-clock budget for an entire run.

DEFAULT_MEMORY_BYTES

Default memory ceiling per JavaScript runtime, which means per worker.

DEFAULT_RULE_TIMEOUT

Default budget for a single handler invocation.