@animalabs/agent-framework 0.23.3 → 0.24.1

package/dist/src/code-execution/isolate/child.js

@@ -0,0 +1,315 @@
+/**
+ * A script's child: one process per script, which runs it in the engine and
+ * answers the engine's four imports. It takes its start from the parent's
+ * first frame, sends each tool call to the parent and settles it with the
+ * parent's answer, flushes the output in bounded batches, and reports how the
+ * script ended. A crash it can't report: the parent sees that the child ended
+ * without saying how.
+ *
+ * Stopping: the parent creates the stop file and sends a stop frame. A
+ * computing guest's interrupt import sees the file, checked at most every few
+ * milliseconds, so a stop reaches a spinning guest without its event loop; an
+ * idle guest's child reads the frame. Why the stop was asked is the parent's
+ * to say, so the child reports only that the script stopped.
+ */
+import { existsSync } from 'node:fs';
+import { MAX_RESULT_DEPTH } from '../engine.js';
+import { argumentsRefusal, MAX_CALLS_IN_FLIGHT, RESULT_TOO_LARGE, wakeLimitRefusal, wakeRefusal } from './protocol.js';
+import { OutputBatch } from './output.js';
+import { bounded, glimpse, NAME_CHARS, VALUE_CHARS } from './render.js';
+import { preludeSource, scriptCall, scriptFrames, WAKE_CALL_NAME } from './prelude.js';
+/** How often, at most, the interrupt import looks for the stop file. */
+export const STOP_CHECK_MS = 3;
+/**
+ * The filename of the one line that starts the script, `await __run(...)`.
+ * The script's own frames carry `<input>`, the source name QuickJS gives the
+ * async function it's compiled into (SCRIPT_LINE_OFFSET).
+ */
+const SCRIPT_FILENAME = 'script.js';
+/** The value's JSON from the engine's JSON of the prelude's text: a string, so one parse gives it, and anything else is given as it came. */
+function valueJson(json) {
+    try {
+        const text = JSON.parse(json);
+        return typeof text === 'string' ? text : json;
+    }
+    catch {
+        return json;
+    }
+}
+/** Run the script `start` names to its end. Resolves once its ending is sent, or when the parent closes the channel. */
+export async function runChild(io, start, loadEngine) {
+    const batch = new OutputBatch();
+    /** The calls the guest waits on, by id: their tools' names. */
+    const outstanding = new Map();
+    /** Calls answered here, without going out: their arguments were too large to send. */
+    const local = [];
+    /**
+     * While a result settles, the calls the guest's jobs make are held, and go
+     * out after that result's `seen`, which says whether the result fit: the
+     * parent then frees the answered call's place before it counts the next.
+     * A result the engine drops reaches no script code, and what code QuickJS
+     * still runs as the stop lands, a stack hook building the stop's error,
+     * can't make a call, since the engine refuses `__host` once stopped: its
+     * settle holds none.
+     */
+    let held = null;
+    /** Wakes sent, which the script's cap counts. */
+    let wakesSent = 0;
+    let stopped = false;
+    let lastFlush = io.now();
+    let lastStopCheck = -Infinity;
+    let lastParentCheck = -Infinity;
+    /** Its parent has been seen gone, so the child has ended its process, or stopped its guest. */
+    let orphan = false;
+    const flush = () => {
+        lastFlush = io.now();
+        for (const text of batch.flush())
+            io.send({ t: 'out', text });
+    };
+    const slots = {
+        hostCall(callId, name, argsJson) {
+            outstanding.set(callId, name);
+            // What the host won't take is refused here, before a frame is built,
+            // and by the parent again, since the child is untrusted. A call that
+            // passes always fits a frame, which carries its arguments escaped, at
+            // most six bytes for each of theirs.
+            const wake = name === WAKE_CALL_NAME;
+            // A wake past the script's cap is refused too, after its size, so one
+            // refused for its size uses none of the script's wakes.
+            const refusal = wake
+                ? (wakeRefusal(argsJson) ?? (wakesSent >= start.maxWakes ? wakeLimitRefusal(start.maxWakes) : null))
+                : argumentsRefusal(name, argsJson);
+            if (refusal) {
+                // The slot can't settle the call from inside the engine: it's answered
+                // as soon as the engine returns.
+                local.push({ id: callId, json: JSON.stringify(refusal) });
+                return;
+            }
+            if (wake)
+                wakesSent += 1;
+            // What the script wrote before the call reaches the host before it does.
+            if (batch.unflushed > 0)
+                flush();
+            const call = { t: 'call', id: callId, name, args: argsJson };
+            // A wake takes no place among the calls in flight, so it needn't wait for a seen.
+            if (held === null || wake)
+                io.send(call);
+            else if (held.length < MAX_CALLS_IN_FLIGHT)
+                held.push(call);
+            else {
+                // A guest held to the prelude has at most that many calls out. One
+                // that makes more, its promises replaced, would have them held
+                // without bound: the rest go out at once, which the parent takes as
+                // the protocol break it is, and the guest is stopped.
+                stopped = true;
+                io.send(call);
+            }
+        },
+        interrupt() {
+            const t = io.now();
+            if (!stopped && t - lastStopCheck >= STOP_CHECK_MS) {
+                lastStopCheck = t;
+                stopped = existsSync(start.stopFile);
+            }
+            if (batch.unflushed > 0 && t - lastFlush >= start.flushMs)
+                flush();
+            return stopped;
+        },
+        supervise() {
+            // A guest that computes doesn't let the child see its parent go, so
+            // that's checked at the engine's interrupt checks, at most once a stop
+            // check, a stop's included: a guest can keep a stop from ending it,
+            // since QuickJS drops a stop it takes inside a stack hook or an
+            // iterator's return, and only the parent kills a child that runs on.
+            // The engine calls this first, so an orphan ends its process at once
+            // rather than stop its guest. Output waiting to be sent goes with the
+            // process: the parent that would read it is gone, and a write to it
+            // could fail or block.
+            const t = io.now();
+            if (orphan || t - lastParentCheck < STOP_CHECK_MS)
+                return;
+            lastParentCheck = t;
+            if (!io.parentGone?.())
+                return;
+            orphan = true;
+            io.orphaned?.();
+            stopped = true;
+        },
+        output(_stream, text) {
+            if (batch.write(text) || io.now() - lastFlush >= start.flushMs)
+                flush();
+        },
+    };
+    const engine = await loadEngine({ memoryMaxBytes: start.memoryMaxBytes, ...(start.maxStackBytes === undefined ? {} : { maxStackBytes: start.maxStackBytes }) }, slots);
+    // The loop's own failure, if one is leaving it: dispose()'s, after it, is the lesser news.
+    let failing = false;
+    try {
+        // The script's own ending: the first terminal state. Calls still in flight
+        // when it ends are waited for, so each outcome reaches the record, and their
+        // later states don't change how the script ended: a stop then ends the
+        // wait, and the script's own ending is what's reported. A failure once the
+        // script ran (`failed`: an exception escaped its promises) ends the run at
+        // once, past an ending it kept: the engine takes nothing more.
+        const terminal = (s) => s.kind === 'fulfilled' || s.kind === 'rejected';
+        let ending = { kind: 'pending' };
+        let interrupted = false;
+        const after = (next) => {
+            if (next.kind === 'interrupted')
+                interrupted = true;
+            if (next.kind === 'failed' || !terminal(ending))
+                ending = next;
+        };
+        const over = () => interrupted || ending.kind === 'failed';
+        const settleLocal = () => {
+            while (local.length > 0 && !over()) {
+                const { id, json } = local.shift();
+                outstanding.delete(id);
+                after(engine.settle(id, false, json, json));
+            }
+        };
+        after(engine.start(preludeSource(start.tools), scriptCall(start.script), SCRIPT_FILENAME));
+        settleLocal();
+        for (;;) {
+            if (over() || stopped || outstanding.size === 0) {
+                flush();
+                // The value, or a failure's message and stack, cut as a return shows
+                // them, so the ending's frame always fits whatever the script made.
+                if (ending.kind === 'fulfilled') {
+                    // The prelude's run resolves to its value's JSON text, which the engine
+                    // gives as a JSON string: one layer off is the value's JSON.
+                    io.send(ending.json === undefined ? { t: 'end', how: 'finished' } : { t: 'end', how: 'finished', value: bounded(valueJson(ending.json), VALUE_CHARS) });
+                }
+                else if (ending.kind === 'rejected' || ending.kind === 'failed') {
+                    // The script's frames go apart from the name and message, each cut
+                    // on its own, so a cut never breaks which is which. Every failure's
+                    // stack is QuickJS's own, or one the script set, and is put as the
+                    // agent reads it here (scriptFrames), whether the script threw it or
+                    // it escaped the script's promises, and cut as it's read: the frames
+                    // go as scriptFrames gives them, cut once.
+                    const frames = ending.stack ? scriptFrames(ending.stack, VALUE_CHARS) : '';
+                    io.send({
+                        t: 'end',
+                        how: 'failed',
+                        error: {
+                            name: bounded(ending.name, NAME_CHARS),
+                            message: bounded(ending.message, VALUE_CHARS),
+                            ...(frames ? { stack: frames } : {}),
+                        },
+                    });
+                }
+                else if (interrupted || stopped) {
+                    io.send({ t: 'end', how: 'stopped' });
+                }
+                else {
+                    io.send({
+                        t: 'end',
+                        how: 'failed',
+                        stalled: true,
+                        error: {
+                            name: 'Error',
+                            message: 'The script is waiting on a promise that nothing can settle: no tool call is pending, and there are no timers here.',
+                        },
+                    });
+                }
+                return;
+            }
+            // The guest is idle until a call is answered: send its output so far.
+            flush();
+            const message = await io.next();
+            if (message === null)
+                return; // the parent is gone, and with it anyone to tell
+            if (message.t === 'stop') {
+                stopped = true;
+                continue;
+            }
+            if (message.t !== 'result' || !outstanding.has(message.id))
+                continue;
+            const name = outstanding.get(message.id);
+            outstanding.delete(message.id);
+            // A result the guest can't take, too large for its memory, nested too
+            // deep or not parsed, reaches the script as ResultTooLarge, made here,
+            // and the parent hears it wasn't seen. An answer that isn't ok is an
+            // error the host gave in the result's place, such as a refusal.
+            // The call as the script wrote it: a wake is wake_agent.
+            const called = name === WAKE_CALL_NAME ? 'wake_agent' : name;
+            // An error the host gave in the result's place keeps its name, such as
+            // a refusal's, and its message's start: whether the call ran is in
+            // them, read here, outside the guest.
+            const unfit = message.ok
+                ? JSON.stringify({
+                    name: RESULT_TOO_LARGE,
+                    message: `${called}'s result, ${message.json.length} bytes, couldn't be received by this script: it was ${unfitWhy(true)}; ` +
+                        'the call took effect, and none of its result reached the script. Calling it again would do the call again, its effect included, and likely bring the same result, so if the call only reads, ask the tool for less if it can',
+                    bytes: message.json.length,
+                })
+                : unfitAnswer(called, message.json);
+            held = [];
+            let state;
+            let calls;
+            try {
+                state = engine.settle(message.id, message.ok, message.json, unfit);
+            }
+            finally {
+                calls = held;
+                held = null;
+            }
+            // A result that reached the script freed its call's place, as the
+            // prelude has it, and its seen says so. One that never reached it
+            // (`dropped`) has no seen: the script never had it, so the prelude
+            // never freed its place, and what code QuickJS still runs as the stop
+            // lands can't reach the host, since the engine refuses `__host` once
+            // stopped. The run's end counts the answer as one the script didn't
+            // read (Gladys-2592, room-203 #159239, #162129).
+            if (!state.dropped)
+                io.send(state.unfit ? { t: 'seen', id: message.id, unfit: true } : { t: 'seen', id: message.id });
+            for (const call of calls)
+                io.send(call);
+            after(state);
+            settleLocal();
+        }
+    }
+    catch (err) {
+        failing = true;
+        throw err;
+    }
+    finally {
+        try {
+            engine.dispose();
+        }
+        catch (err) {
+            if (!failing)
+                throw err;
+        }
+    }
+}
+/** An error the host gave in a result's place, which the guest couldn't take: its name and its message's start, read in the child. */
+function unfitAnswer(tool, json) {
+    let name = RESULT_TOO_LARGE;
+    let message = '';
+    let parsed = false;
+    try {
+        const answer = JSON.parse(new TextDecoder().decode(json));
+        parsed = true;
+        if (typeof answer.name === 'string' && answer.name)
+            name = bounded(answer.name, NAME_CHARS);
+        if (typeof answer.message === 'string')
+            message = glimpse(answer.message, UNFIT_GLIMPSE_CHARS);
+    }
+    catch {
+        // Not readable here either: only its size and the tool are known.
+    }
+    return JSON.stringify({
+        name,
+        message: `${message ? `${message} ` : `${tool}'s answer `}(the host's answer, ${json.length} bytes, couldn't be received by this script whole: it was ${unfitWhy(!parsed)})`,
+        bytes: json.length,
+    });
+}
+/** Why the guest couldn't take an answer: what the engine refuses, less what the child has ruled out. */
+function unfitWhy(couldBeJson) {
+    return couldBeJson
+        ? `too large for its memory, nested deeper than ${MAX_RESULT_DEPTH} levels, or not valid JSON`
+        : `too large for its memory, or nested deeper than ${MAX_RESULT_DEPTH} levels`;
+}
+/** How much of an unfit answer's message reaches the script. */
+const UNFIT_GLIMPSE_CHARS = 2000;
+//# sourceMappingURL=child.js.map

package/dist/src/code-execution/isolate/child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child.js","sourceRoot":"","sources":["../../../../src/code-execution/isolate/child.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAqF,MAAM,cAAc,CAAC;AACnI,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B;;;;GAIG;AACH,MAAM,eAAe,GAAG,WAAW,CAAC;AA2BpC,6IAA6I;AAC7I,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAW,EAAE,KAAmB,EAAE,UAAsB;IACrF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,sFAAsF;IACtF,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,iDAAiD;IACjD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,eAAe,GAAG,CAAC,QAAQ,CAAC;IAChC,+FAA+F;IAC/F,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;YAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,KAAK,GAAgB;QACzB,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YAC7B,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,IAAI,GAAG,IAAI,KAAK,cAAc,CAAC;YACrC,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,OAAO,GAAG,IAAI;gBAClB,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpG,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,iCAAiC;gBACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,IAAI,IAAI;gBAAE,SAAS,IAAI,CAAC,CAAC;YACzB,yEAAyE;YACzE,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC7D,kFAAkF;YAClF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;gBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,CAAC;gBACJ,mEAAmE;gBACnE,+DAA+D;gBAC/D,oEAAoE;gBACpE,sDAAsD;gBACtD,OAAO,GAAG,IAAI,CAAC;gBACf,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,SAAS;YACP,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,aAAa,IAAI,aAAa,EAAE,CAAC;gBACnD,aAAa,GAAG,CAAC,CAAC;gBAClB,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS;YACP,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;YACnB,IAAI,MAAM,IAAI,CAAC,GAAG,eAAe,GAAG,aAAa;gBAAE,OAAO;YAC1D,eAAe,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE;gBAAE,OAAO;YAC/B,MAAM,GAAG,IAAI,CAAC;YACd,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,IAAI;YAClB,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;QAC1E,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAW,MAAM,UAAU,CACrC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,EAAE,EAC9H,KAAK,CACN,CAAC;IACF,2FAA2F;IAC3F,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;QAClF,IAAI,MAAM,GAAG,EAAE,IAAI,EAAE,SAAS,EAAc,CAAC;QAC7C,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,IAAc,EAAQ,EAAE;YACrC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;gBAAE,WAAW,GAAG,IAAI,CAAC;YACpD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC;QACjE,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,GAAY,EAAE,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;QACpE,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;gBACpC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QAC3F,WAAW,EAAE,CAAC;QACd,SAAS,CAAC;YACR,IAAI,IAAI,EAAE,IAAI,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChD,KAAK,EAAE,CAAC;gBACR,qEAAqE;gBACrE,oEAAoE;gBACpE,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAChC,wEAAwE;oBACxE,6DAA6D;oBAC7D,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC1J,CAAC;qBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClE,mEAAmE;oBACnE,oEAAoE;oBACpE,mEAAmE;oBACnE,qEAAqE;oBACrE,qEAAqE;oBACrE,2CAA2C;oBAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,EAAE,CAAC,IAAI,CAAC;wBACN,CAAC,EAAE,KAAK;wBACR,GAAG,EAAE,QAAQ;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;4BACtC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;4BAC7C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACrC;qBACF,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;oBAClC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,IAAI,CAAC;wBACN,CAAC,EAAE,KAAK;wBACR,GAAG,EAAE,QAAQ;wBACb,OAAO,EAAE,IAAI;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,oHAAoH;yBAC9H;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,KAAK,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,CAAC,iDAAiD;YAC/E,IAAI,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAE,CAAC;YAC1C,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/B,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,gEAAgE;YAChE,yDAAyD;YACzD,MAAM,MAAM,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,uEAAuE;YACvE,mEAAmE;YACnE,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE;gBACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;oBACf,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,GAAG,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,uDAAuD,QAAQ,CAAC,IAAI,CAAC,IAAI;wBAC1H,8NAA8N;oBAChO,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;iBAC3B,CAAC;gBACF,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,EAAE,CAAC;YACV,IAAI,KAAkB,CAAC;YACvB,IAAI,KAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,CAAC;oBAAS,CAAC;gBACT,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,iDAAiD;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACtH,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO;gBAAE,MAAM,GAAG,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,sIAAsI;AACtI,SAAS,WAAW,CAAC,IAAY,EAAE,IAAgB;IACjD,IAAI,IAAI,GAAG,gBAAgB,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAA0C,CAAC;QACnG,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC5F,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI;QACJ,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,uBAAuB,IAAI,CAAC,MAAM,6DAA6D,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG;QAC5K,KAAK,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,SAAS,QAAQ,CAAC,WAAoB;IACpC,OAAO,WAAW;QAChB,CAAC,CAAC,gDAAgD,gBAAgB,4BAA4B;QAC9F,CAAC,CAAC,mDAAmD,gBAAgB,SAAS,CAAC;AACnF,CAAC;AAED,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,IAAI,CAAC"}

package/dist/src/code-execution/isolate/frames.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Length-prefixed frames between a script's parent and its child: four bytes
+ * of big-endian length, then that many bytes of body. The parent writes to the
+ * child's stdin and reads the child's fd 3.
+ *
+ * A body's first byte says what it holds:
+ * - `JSON_KIND`: a message as UTF-8 JSON. Every frame from a child is one.
+ * - `RESULT_KIND`: a call's result for the guest, from the parent: whether it
+ *   resolves or rejects, the call's id, and the result's JSON as UTF-8 bytes,
+ *   which the child hands the engine as they are, with no second parse and no
+ *   string copy (the path the memory budget was measured on).
+ *
+ * The decoder is the only way bytes from a child become values in the parent,
+ * so it bounds what a child can make the parent hold: a frame longer than its
+ * limit, of a kind it doesn't take, not JSON, or holding more values than its
+ * limit (counted before it's parsed), is a protocol error, and the parent ends
+ * the script as crashed rather than reading on.
+ */
+/** The largest frame from a child: a call's arguments or a batch of output. */
+export declare const MAX_FRAME_BYTES: number;
+export declare const JSON_KIND = 0;
+export declare const RESULT_KIND = 1;
+/** A frame that breaks the protocol: too long, of a kind not taken, not UTF-8, not JSON, holding too many values, or cut off when its stream ended. */
+export declare class FrameError extends Error {
+    /** For a frame too long to encode: how long its body came to. */
+    readonly bytes: number | undefined;
+    constructor(message: string, bytes?: number);
+}
+/**
+ * The values in a JSON text, counted outside its strings: the top value, and
+ * each value inside an object or array. Counting stops once past `stopAfter`.
+ */
+export declare function countJsonValues(text: string, stopAfter?: number): number;
+/** A call's result as the child decodes it: the JSON's bytes, untouched. */
+export interface ResultFrame {
+    t: 'result';
+    id: number;
+    ok: boolean;
+    json: Uint8Array;
+}
+/** One message as a JSON frame. One longer than `maxFrameBytes` throws a FrameError, and nothing is written. */
+export declare function encodeFrame(message: unknown, maxFrameBytes?: number): Buffer;
+/**
+ * A call's result as a result frame: the JSON's bytes follow a header of `ok`
+ * and the id. Written straight into the frame, so a result's bytes are held
+ * once, which the host's memory figure counts.
+ */
+export declare function encodeResultFrame(id: number, ok: boolean, json: string, maxFrameBytes: number): Buffer;
+/** How much a result frame's body holds beyond its JSON. */
+export declare const RESULT_FRAME_OVERHEAD: number;
+/**
+ * Bytes in, whole frames' values out. Holds at most one frame's bytes plus its
+ * header: a header naming more than `maxFrameBytes` throws before any of that
+ * frame's body is kept, and once a header names its body's length, the body
+ * is one buffer of that length, which each chunk is copied into. So however
+ * the bytes arrive, one at a time included, the decoder keeps no chunk of
+ * them. Takes result frames only if asked to: a parent's decoder takes JSON
+ * alone.
+ */
+export declare class FrameDecoder {
+    private readonly maxFrameBytes;
+    private readonly takesResults;
+    /** The most values a JSON frame may hold, counted before it's parsed. */
+    private readonly maxValues;
+    private readonly header;
+    private headerFilled;
+    private body;
+    private bodyFilled;
+    private broken;
+    constructor(maxFrameBytes?: number, takesResults?: boolean, 
+    /** The most values a JSON frame may hold, counted before it's parsed. */
+    maxValues?: number);
+    /** The values of every frame `chunk` completes, in order. Throws the same FrameError from then on, once one frame was bad. */
+    push(chunk: Buffer): unknown[];
+    /** At the stream's end: throws if a frame was begun and not finished. */
+    end(): void;
+    private decode;
+    private fail;
+}
+//# sourceMappingURL=frames.d.ts.map

package/dist/src/code-execution/isolate/frames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.d.ts","sourceRoot":"","sources":["../../../../src/code-execution/isolate/frames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,eAAe,QAAmB,CAAC;AAGhD,eAAO,MAAM,SAAS,IAAI,CAAC;AAC3B,eAAO,MAAM,WAAW,IAAI,CAAC;AAI7B,uJAAuJ;AACvJ,qBAAa,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAI1C;CACF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAW,GAAG,MAAM,CAqB1E;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,QAAQ,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;CAClB;AAYD,gHAAgH;AAChH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,GAAE,MAAwB,GAAG,MAAM,CAO7F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,QAAsB,CAAC;AAEzD;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAV5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAA2B;IAEzC,YACmB,aAAa,GAAE,MAAwB,EACvC,YAAY,UAAQ;IACrC,yEAAyE;IACxD,SAAS,SAAW,EACnC;IAEJ,8HAA8H;IAC9H,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,CA8B7B;IAED,yEAAyE;IACzE,GAAG,IAAI,IAAI,CAKV;IAED,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,IAAI;CAKb"}

package/dist/src/code-execution/isolate/frames.js

@@ -0,0 +1,210 @@
+/**
+ * Length-prefixed frames between a script's parent and its child: four bytes
+ * of big-endian length, then that many bytes of body. The parent writes to the
+ * child's stdin and reads the child's fd 3.
+ *
+ * A body's first byte says what it holds:
+ * - `JSON_KIND`: a message as UTF-8 JSON. Every frame from a child is one.
+ * - `RESULT_KIND`: a call's result for the guest, from the parent: whether it
+ *   resolves or rejects, the call's id, and the result's JSON as UTF-8 bytes,
+ *   which the child hands the engine as they are, with no second parse and no
+ *   string copy (the path the memory budget was measured on).
+ *
+ * The decoder is the only way bytes from a child become values in the parent,
+ * so it bounds what a child can make the parent hold: a frame longer than its
+ * limit, of a kind it doesn't take, not JSON, or holding more values than its
+ * limit (counted before it's parsed), is a protocol error, and the parent ends
+ * the script as crashed rather than reading on.
+ */
+/** The largest frame from a child: a call's arguments or a batch of output. */
+export const MAX_FRAME_BYTES = 64 * 1024 * 1024;
+const HEADER_BYTES = 4;
+export const JSON_KIND = 0;
+export const RESULT_KIND = 1;
+/** A result body's own header: its kind, `ok`, and the call's id. */
+const RESULT_HEADER_BYTES = 1 + 1 + 4;
+/** A frame that breaks the protocol: too long, of a kind not taken, not UTF-8, not JSON, holding too many values, or cut off when its stream ended. */
+export class FrameError extends Error {
+    /** For a frame too long to encode: how long its body came to. */
+    bytes;
+    constructor(message, bytes) {
+        super(message);
+        this.name = 'FrameError';
+        this.bytes = bytes;
+    }
+}
+/**
+ * The values in a JSON text, counted outside its strings: the top value, and
+ * each value inside an object or array. Counting stops once past `stopAfter`.
+ */
+export function countJsonValues(text, stopAfter = Infinity) {
+    let values = 1;
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (inString) {
+            if (c === 0x5c)
+                i++;
+            else if (c === 0x22)
+                inString = false;
+        }
+        else if (c === 0x22) {
+            inString = true;
+        }
+        else if (c === 0x7b || c === 0x5b) {
+            // An object or array holds a first value unless it closes at once.
+            let j = i + 1;
+            while (j < text.length && (text.charCodeAt(j) === 0x20 || text.charCodeAt(j) === 0x0a || text.charCodeAt(j) === 0x0d || text.charCodeAt(j) === 0x09))
+                j++;
+            const next = text.charCodeAt(j);
+            if (next !== 0x7d && next !== 0x5d && ++values > stopAfter)
+                return values;
+        }
+        else if (c === 0x2c) {
+            if (++values > stopAfter)
+                return values;
+        }
+    }
+    return values;
+}
+function frame(body, maxFrameBytes) {
+    if (body.length > maxFrameBytes) {
+        throw new FrameError(`a frame of ${body.length} bytes is longer than the ${maxFrameBytes} the protocol allows`, body.length);
+    }
+    const out = Buffer.allocUnsafe(HEADER_BYTES + body.length);
+    out.writeUInt32BE(body.length, 0);
+    body.copy(out, HEADER_BYTES);
+    return out;
+}
+/** One message as a JSON frame. One longer than `maxFrameBytes` throws a FrameError, and nothing is written. */
+export function encodeFrame(message, maxFrameBytes = MAX_FRAME_BYTES) {
+    const json = JSON.stringify(message);
+    if (json === undefined)
+        throw new FrameError('a frame must hold a JSON value');
+    const body = Buffer.allocUnsafe(1 + Buffer.byteLength(json, 'utf8'));
+    body[0] = JSON_KIND;
+    body.write(json, 1, 'utf8');
+    return frame(body, maxFrameBytes);
+}
+/**
+ * A call's result as a result frame: the JSON's bytes follow a header of `ok`
+ * and the id. Written straight into the frame, so a result's bytes are held
+ * once, which the host's memory figure counts.
+ */
+export function encodeResultFrame(id, ok, json, maxFrameBytes) {
+    const bodyLength = RESULT_HEADER_BYTES + Buffer.byteLength(json, 'utf8');
+    if (bodyLength > maxFrameBytes) {
+        throw new FrameError(`a frame of ${bodyLength} bytes is longer than the ${maxFrameBytes} the protocol allows`, bodyLength);
+    }
+    const out = Buffer.allocUnsafe(HEADER_BYTES + bodyLength);
+    out.writeUInt32BE(bodyLength, 0);
+    out[HEADER_BYTES] = RESULT_KIND;
+    out[HEADER_BYTES + 1] = ok ? 1 : 0;
+    out.writeUInt32BE(id >>> 0, HEADER_BYTES + 2);
+    out.write(json, HEADER_BYTES + RESULT_HEADER_BYTES, 'utf8');
+    return out;
+}
+/** How much a result frame's body holds beyond its JSON. */
+export const RESULT_FRAME_OVERHEAD = RESULT_HEADER_BYTES;
+/**
+ * Bytes in, whole frames' values out. Holds at most one frame's bytes plus its
+ * header: a header naming more than `maxFrameBytes` throws before any of that
+ * frame's body is kept, and once a header names its body's length, the body
+ * is one buffer of that length, which each chunk is copied into. So however
+ * the bytes arrive, one at a time included, the decoder keeps no chunk of
+ * them. Takes result frames only if asked to: a parent's decoder takes JSON
+ * alone.
+ */
+export class FrameDecoder {
+    maxFrameBytes;
+    takesResults;
+    maxValues;
+    header = Buffer.alloc(HEADER_BYTES);
+    headerFilled = 0;
+    body = null;
+    bodyFilled = 0;
+    broken = null;
+    constructor(maxFrameBytes = MAX_FRAME_BYTES, takesResults = false, 
+    /** The most values a JSON frame may hold, counted before it's parsed. */
+    maxValues = Infinity) {
+        this.maxFrameBytes = maxFrameBytes;
+        this.takesResults = takesResults;
+        this.maxValues = maxValues;
+    }
+    /** The values of every frame `chunk` completes, in order. Throws the same FrameError from then on, once one frame was bad. */
+    push(chunk) {
+        if (this.broken)
+            throw this.broken;
+        const values = [];
+        let at = 0;
+        while (at < chunk.length) {
+            if (this.body === null) {
+                const n = Math.min(HEADER_BYTES - this.headerFilled, chunk.length - at);
+                chunk.copy(this.header, this.headerFilled, at, at + n);
+                this.headerFilled += n;
+                at += n;
+                if (this.headerFilled < HEADER_BYTES)
+                    break;
+                const length = this.header.readUInt32BE(0);
+                if (length > this.maxFrameBytes) {
+                    return this.fail(`a frame announced ${length} bytes, more than the ${this.maxFrameBytes} the protocol allows`);
+                }
+                if (length === 0)
+                    return this.fail('a frame was empty');
+                this.body = Buffer.allocUnsafe(length);
+                this.bodyFilled = 0;
+            }
+            const n = Math.min(this.body.length - this.bodyFilled, chunk.length - at);
+            chunk.copy(this.body, this.bodyFilled, at, at + n);
+            this.bodyFilled += n;
+            at += n;
+            if (this.bodyFilled < this.body.length)
+                break;
+            const body = this.body;
+            this.body = null;
+            this.headerFilled = 0;
+            values.push(this.decode(body));
+        }
+        return values;
+    }
+    /** At the stream's end: throws if a frame was begun and not finished. */
+    end() {
+        if (this.broken)
+            throw this.broken;
+        if (this.headerFilled > 0 || this.body !== null) {
+            this.fail(`the stream ended inside a frame, with ${this.body === null ? this.headerFilled : this.bodyFilled} of its bytes read`);
+        }
+    }
+    decode(body) {
+        if (body[0] === RESULT_KIND && this.takesResults) {
+            if (body.length < RESULT_HEADER_BYTES)
+                return this.fail('a result frame was shorter than its header');
+            const result = { t: 'result', id: body.readUInt32BE(2), ok: body[1] === 1, json: body.subarray(RESULT_HEADER_BYTES) };
+            return result;
+        }
+        if (body[0] !== JSON_KIND)
+            return this.fail(`a frame was of kind ${body[0]}, which this side doesn't take`);
+        let text;
+        try {
+            // A byte-order mark is kept, so it fails JSON.parse as the text it is.
+            text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(body.subarray(1));
+        }
+        catch {
+            return this.fail('a frame was not UTF-8');
+        }
+        if (countJsonValues(text, this.maxValues) > this.maxValues)
+            return this.fail(`a frame held more than ${this.maxValues} values`);
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return this.fail('a frame was not JSON');
+        }
+    }
+    fail(message) {
+        this.broken = new FrameError(message);
+        this.body = null;
+        throw this.broken;
+    }
+}
+//# sourceMappingURL=frames.js.map

package/dist/src/code-execution/isolate/frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../../../src/code-execution/isolate/frames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;AAC3B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,uJAAuJ;AACvJ,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,iEAAiE;IACxD,KAAK,CAAqB;IAEnC,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAS,GAAG,QAAQ;IAChE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;iBACf,IAAI,CAAC,KAAK,IAAI;gBAAE,QAAQ,GAAG,KAAK,CAAC;QACxC,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,mEAAmE;YACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1J,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,MAAM,GAAG,SAAS;gBAAE,OAAO,MAAM,CAAC;QAC5E,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,GAAG,SAAS;gBAAE,OAAO,MAAM,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,SAAS,KAAK,CAAC,IAAY,EAAE,aAAqB;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,UAAU,CAAC,cAAc,IAAI,CAAC,MAAM,6BAA6B,aAAa,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,aAAa,GAAW,eAAe;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,EAAW,EAAE,IAAY,EAAE,aAAqB;IAC5F,MAAM,UAAU,GAAG,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,cAAc,UAAU,6BAA6B,aAAa,sBAAsB,EAAE,UAAU,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC;IAC1D,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;IAChC,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IAQJ,aAAa;IACb,YAAY;IAEZ,SAAS;IAVX,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,YAAY,GAAG,CAAC,CAAC;IACjB,IAAI,GAAkB,IAAI,CAAC;IAC3B,UAAU,GAAG,CAAC,CAAC;IACf,MAAM,GAAsB,IAAI,CAAC;IAEzC,YACmB,aAAa,GAAW,eAAe,EACvC,YAAY,GAAG,KAAK;IACrC,yEAAyE;IACxD,SAAS,GAAG,QAAQ;6BAHpB,aAAa;4BACb,YAAY;yBAEZ,SAAS;IACzB,CAAC;IAEJ,8HAA8H;IAC9H,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;gBACxE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;gBACvB,EAAE,IAAI,CAAC,CAAC;gBACR,IAAI,IAAI,CAAC,YAAY,GAAG,YAAY;oBAAE,MAAM;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;oBAChC,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,MAAM,yBAAyB,IAAI,CAAC,aAAa,sBAAsB,CAAC,CAAC;gBACjH,CAAC;gBACD,IAAI,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YACrB,EAAE,IAAI,CAAC,CAAC;YACR,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACzE,GAAG;QACD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,oBAAoB,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACtG,MAAM,MAAM,GAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACnI,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC5G,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,uEAAuE;YACvE,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;QAChI,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,OAAe;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;CACF"}