@hue-run/sdk 0.9.0 → 0.11.0

package/dist/evals/files.d.ts

@@ -32,19 +32,85 @@ export interface StagedOutputFile {
 export declare class OutputFileError extends Error {
     constructor(message: string);
 }
-/** Reduce a declared file name to a single printable path segment, at most 200 characters. */
+/** Stable codes of a pinned file the runner refuses to hand over. */
+export type CaseFileErrorCode = "case_file_mismatch" | "case_file_name_refused";
+/**
+ * Thrown when a pinned file cannot be used: its downloaded bytes differ from the manifest's size
+ * or SHA-256 (`case_file_mismatch`), or a file meant for an agent working in a world is not
+ * named by one safe file name (`case_file_name_refused`). Raised before the case's execution
+ * starts, so no execution, world or target call is spent on it.
+ */
+export declare class CaseFileError extends Error {
+    /** Stable diagnostic code. */
+    readonly code: CaseFileErrorCode;
+    /** Hue artifact identity of the refused file. */
+    readonly artifactId: string;
+    constructor(
+    /** Stable diagnostic code. */
+    code: CaseFileErrorCode, 
+    /** Hue artifact identity of the refused file. */
+    artifactId: string, message: string);
+}
+/**
+ * Whether `name` can be used unchanged as one file name: not empty, `.` or `..`; no `/`, `\`,
+ * C0 or C1 control character, or character Windows reserves (`: < > " | ? *`); no Windows device
+ * name (`CON`, `NUL`, `COM1`, … with any extension); no trailing dot or space, which Windows
+ * drops; at most 200 UTF-8 bytes. An absolute path or a path with a parent step always contains
+ * a separator, so it is refused too.
+ */
+export declare function isSafeFileName(name: string): boolean;
+/** Refuse a pinned file whose name is not one safe file name; see {@link isSafeFileName}. */
+export declare function assertSafeFileNames(files: readonly Pick<CaseFile, "artifactId" | "filename">[]): void;
+/**
+ * Reduce a declared file name to a single printable path segment, at most 200 UTF-8 bytes. A
+ * longer name keeps its extension, so `.pdf` stays `.pdf`, and its stem is shortened and marked
+ * with a short hash of the whole name, so two long names never shorten to the same one.
+ */
 export declare function safeFilename(name: string): string;
+/** The device and inode a listing saw for a file, compared with the file actually opened. */
+export interface FileIdentity {
+    dev: number;
+    ino: number;
+}
+/**
+ * Read a file an agent wrote without trusting its path: the last component must not be a
+ * symlink and the open file must be a regular file of at most `maxBytes`, checked before any byte
+ * is read, and, when `expected` is given, the very file a listing saw. The bytes come from that
+ * open file. Returns undefined for a missing file only when nothing was expected there; every
+ * other refusal is an `OutputFileError` naming `label`.
+ */
+export declare function readAgentFile(path: string, label: string, maxBytes: number, expected?: FileIdentity): Promise<Uint8Array | undefined>;
+/** Check pinned files against the manifest without keeping them: nothing is written to disk. */
+export declare function verifyCaseFiles(client: EvaluationClient, files: readonly SubjectFile[]): Promise<void>;
 /**
  * Save verified copies of a case's pinned input files under `directory`. A file already
  * present with the pinned identity is reused, so a resumed run does not download again.
  */
 export declare function downloadCaseFiles(client: EvaluationClient, files: SubjectFile[], directory: string, primaryArtifactId?: string | null): Promise<LocalFile[]>;
+/**
+ * Download a case's needed inputs under `caseDirectory`: the agent-visible roles into `inputs/`
+ * and evaluator-only files into `evaluator-inputs/`, so the directory the target's files live in
+ * never holds an evaluator's file. `all` keeps the manifest order for scorers; `target` is the
+ * agent-visible subset.
+ */
+export declare function downloadCaseInputs(client: EvaluationClient, files: CaseFile[], caseDirectory: string): Promise<{
+    all: LocalFile[];
+    target: LocalFile[];
+}>;
 /** Copy the target's generated files next to the checkpoint and record their identities. */
 export declare function stageOutputFiles(files: OutputFile[], directory: string): Promise<StagedOutputFile[]>;
+/** How long an upload waits for Hue to verify one artifact, and how often it looks. Hue verifies
+ * within a two-minute lease, which can outlast one request's timeout. */
+export declare const artifactSettling: {
+    settleMillis: number;
+    pollMillis: number;
+    maxPollMillis: number;
+};
 /**
  * Publish staged files as verified artifacts. Reservations use stable keys derived from the
- * execution and the bytes, so a resumed upload settles on the same artifact.
+ * execution and the bytes, so a resumed upload settles on the same artifact, including one Hue
+ * finished verifying after an earlier attempt stopped waiting.
  */
-export declare function uploadOutputFiles(client: EvaluationClient, executionId: string, files: StagedOutputFile[], save: () => Promise<void>): Promise<void>;
+export declare function uploadOutputFiles(client: EvaluationClient, executionId: string, files: StagedOutputFile[], save: () => Promise<void>, timing?: typeof artifactSettling): Promise<void>;
 /** Project uploaded staged files as the verified local files handed to scorers. */
 export declare function localOutputFiles(files: StagedOutputFile[]): LocalFile[];

package/dist/evals/files.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
-import { copyFile, lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { extname, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
-import { HueApiError } from "./client.js";
+import { ArtifactSizeError, HueApiError } from "./client.js";
 /** Roles the target receives. Organization templates stay with grading, as in the managed protocol. */
 export const targetFileRoles = [
     "source",
@@ -37,25 +38,153 @@ export class OutputFileError extends Error {
         this.name = "OutputFileError";
     }
 }
+/**
+ * Thrown when a pinned file cannot be used: its downloaded bytes differ from the manifest's size
+ * or SHA-256 (`case_file_mismatch`), or a file meant for an agent working in a world is not
+ * named by one safe file name (`case_file_name_refused`). Raised before the case's execution
+ * starts, so no execution, world or target call is spent on it.
+ */
+export class CaseFileError extends Error {
+    code;
+    artifactId;
+    constructor(
+    /** Stable diagnostic code. */
+    code, 
+    /** Hue artifact identity of the refused file. */
+    artifactId, message) {
+        super(`${message} (${code})`);
+        this.code = code;
+        this.artifactId = artifactId;
+        this.name = "CaseFileError";
+    }
+}
 const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
-/** Reduce a declared file name to a single printable path segment, at most 200 characters. */
+/** A file name quoted for a message: at most 120 characters, controls escaped. */
+const quoted = (name) => JSON.stringify([...name].slice(0, 120).join(""));
+/** Names Windows reserves for devices, with or without an extension. */
+const DEVICE_NAME = /^(?:con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)$/iu;
+/** The longest file name the runner writes, in UTF-8 bytes: room is left for the temporary
+ * suffix of an atomic write and a copy counter within the usual 255-byte limit. */
+const MAX_NAME_BYTES = 200;
+/** The longest prefix of `name` that fits in `bytes` UTF-8 bytes, cut between code points. */
+function truncateBytes(name, bytes) {
+    let kept = "";
+    let size = 0;
+    for (const character of name) {
+        size += Buffer.byteLength(character);
+        if (size > bytes)
+            break;
+        kept += character;
+    }
+    return kept;
+}
+/**
+ * Whether `name` can be used unchanged as one file name: not empty, `.` or `..`; no `/`, `\`,
+ * C0 or C1 control character, or character Windows reserves (`: < > " | ? *`); no Windows device
+ * name (`CON`, `NUL`, `COM1`, … with any extension); no trailing dot or space, which Windows
+ * drops; at most 200 UTF-8 bytes. An absolute path or a path with a parent step always contains
+ * a separator, so it is refused too.
+ */
+export function isSafeFileName(name) {
+    if (typeof name !== "string" || !name || name === "." || name === "..")
+        return false;
+    // eslint-disable-next-line no-control-regex -- control characters are refused
+    if (/[/\\:<>"|?*\x00-\x1f\x7f-\x9f]/u.test(name))
+        return false;
+    if (name.endsWith(".") || name.endsWith(" "))
+        return false;
+    if (DEVICE_NAME.test(name.split(".")[0].trimEnd()))
+        return false;
+    return Buffer.byteLength(name) <= MAX_NAME_BYTES;
+}
+/** Refuse a pinned file whose name is not one safe file name; see {@link isSafeFileName}. */
+export function assertSafeFileNames(files) {
+    for (const file of files)
+        if (!isSafeFileName(file.filename))
+            throw new CaseFileError("case_file_name_refused", file.artifactId, `Pinned file ${quoted(String(file.filename))} is not a safe file name`);
+}
+/**
+ * Reduce a declared file name to a single printable path segment, at most 200 UTF-8 bytes. A
+ * longer name keeps its extension, so `.pdf` stays `.pdf`, and its stem is shortened and marked
+ * with a short hash of the whole name, so two long names never shorten to the same one.
+ */
 export function safeFilename(name) {
     const cleaned = [...name]
         .filter((c) => c.charCodeAt(0) >= 32 && c.charCodeAt(0) !== 127 && c !== "/" && c !== "\\")
         .join("")
         .trim();
-    return cleaned && cleaned !== "." && cleaned !== ".."
-        ? [...cleaned].slice(0, 200).join("")
-        : "file";
+    let kept = cleaned;
+    if (Buffer.byteLength(cleaned) > MAX_NAME_BYTES) {
+        const found = extname(cleaned);
+        const extension = Buffer.byteLength(found) <= 32 ? found : "";
+        const mark = `~${sha256(Buffer.from(cleaned)).slice(0, 8)}`;
+        const room = MAX_NAME_BYTES - Buffer.byteLength(extension) - mark.length;
+        kept = `${truncateBytes(cleaned.slice(0, cleaned.length - extension.length), room)}${mark}${extension}`;
+    }
+    return kept && kept !== "." && kept !== ".." ? kept : "file";
 }
+/** Create `path` if needed and require a directory this user owns that no one else can open. */
 async function privateDirectory(path) {
     const root = resolve(path);
     await mkdir(root, { recursive: true, mode: 0o700 });
     const info = await lstat(root);
-    if (!info.isDirectory() || info.isSymbolicLink())
-        throw new Error("Use a private files directory (no symlink)");
+    const uid = process.getuid?.();
+    if (!info.isDirectory() ||
+        info.isSymbolicLink() ||
+        (uid !== undefined && info.uid !== uid) ||
+        (process.platform !== "win32" && (info.mode & 0o077) !== 0))
+        throw new Error("Use a private files directory (owned by this user, mode 0700, no symlink)");
     return root;
 }
+// A symlink as the last path component fails to open, and a FIFO or device never blocks.
+const AGENT_FILE_FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/**
+ * Read a file an agent wrote without trusting its path: the last component must not be a
+ * symlink and the open file must be a regular file of at most `maxBytes`, checked before any byte
+ * is read, and, when `expected` is given, the very file a listing saw. The bytes come from that
+ * open file. Returns undefined for a missing file only when nothing was expected there; every
+ * other refusal is an `OutputFileError` naming `label`.
+ */
+export async function readAgentFile(path, label, maxBytes, expected) {
+    let file;
+    try {
+        file = await open(path, AGENT_FILE_FLAGS);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" && !expected)
+            return undefined;
+        if (code === "ELOOP" || code === "EMLINK")
+            throw new OutputFileError(`${label} is a symbolic link`);
+        if (code === "ENOENT")
+            throw new OutputFileError(`${label} changed while it was collected`);
+        throw new OutputFileError(`${label} could not be read`);
+    }
+    try {
+        const info = await file.stat();
+        if (!info.isFile())
+            throw new OutputFileError(`${label} is not a regular file`);
+        if (expected && (info.dev !== expected.dev || info.ino !== expected.ino))
+            throw new OutputFileError(`${label} changed while it was collected`);
+        if (info.size > maxBytes)
+            throw new OutputFileError(`${label} exceeds ${Math.floor(maxBytes / 1024 / 1024)} MiB`);
+        // One byte past the size seen: a file that is still growing is refused, not read whole.
+        const bytes = Buffer.allocUnsafe(info.size + 1);
+        let total = 0;
+        while (total < bytes.length) {
+            const { bytesRead } = await file.read(bytes, total, bytes.length - total, total);
+            if (!bytesRead)
+                break;
+            total += bytesRead;
+        }
+        if (total !== info.size)
+            throw new OutputFileError(`${label} changed while it was collected`);
+        return bytes.subarray(0, total);
+    }
+    finally {
+        await file.close();
+    }
+}
 async function writePrivate(path, bytes) {
     const temporary = `${path}.${randomUUID()}.tmp`;
     const file = await open(temporary, "wx", 0o600);
@@ -74,6 +203,28 @@ async function verifiedBytes(path, expected) {
         throw new Error(`Saved file ${path} no longer matches its verified identity`);
     return bytes;
 }
+/** Download one pinned file and check its size and SHA-256 against the manifest. The download
+ * stops one byte past the pinned size. */
+async function downloadVerified(client, file) {
+    const mismatch = () => new CaseFileError("case_file_mismatch", file.artifactId, `Downloaded file ${quoted(file.filename)} does not match its pinned size and SHA-256`);
+    let bytes;
+    try {
+        bytes = await client.downloadArtifact(file.artifactId, { maxBytes: file.byteSize });
+    }
+    catch (error) {
+        if (error instanceof ArtifactSizeError)
+            throw mismatch();
+        throw error;
+    }
+    if (bytes.byteLength !== file.byteSize || sha256(bytes) !== file.sha256)
+        throw mismatch();
+    return bytes;
+}
+/** Check pinned files against the manifest without keeping them: nothing is written to disk. */
+export async function verifyCaseFiles(client, files) {
+    for (const file of files)
+        await downloadVerified(client, file);
+}
 /**
  * Save verified copies of a case's pinned input files under `directory`. A file already
  * present with the pinned identity is reused, so a resumed run does not download again.
@@ -91,12 +242,8 @@ export async function downloadCaseFiles(client, files, directory, primaryArtifac
         catch {
             present = false;
         }
-        if (!present) {
-            const bytes = await client.downloadArtifact(file.artifactId);
-            if (bytes.byteLength !== file.byteSize || sha256(bytes) !== file.sha256)
-                throw new Error(`Downloaded input ${file.filename} does not match its pinned identity`);
-            await writePrivate(path, bytes);
-        }
+        if (!present)
+            await writePrivate(path, await downloadVerified(client, file));
         saved.push({
             artifactId: file.artifactId,
             role: file.role,
@@ -110,6 +257,26 @@ export async function downloadCaseFiles(client, files, directory, primaryArtifac
     }
     return saved;
 }
+/**
+ * Download a case's needed inputs under `caseDirectory`: the agent-visible roles into `inputs/`
+ * and evaluator-only files into `evaluator-inputs/`, so the directory the target's files live in
+ * never holds an evaluator's file. `all` keeps the manifest order for scorers; `target` is the
+ * agent-visible subset.
+ */
+export async function downloadCaseInputs(client, files, caseDirectory) {
+    const visible = (file) => targetFileRoles.includes(file.role);
+    const agentFiles = files.filter(visible);
+    const evaluatorFiles = files.filter((file) => !visible(file));
+    const target = agentFiles.length
+        ? await downloadCaseFiles(client, agentFiles, join(caseDirectory, "inputs"))
+        : [];
+    const evaluator = evaluatorFiles.length
+        ? await downloadCaseFiles(client, evaluatorFiles, join(caseDirectory, "evaluator-inputs"))
+        : [];
+    const saved = [...target, ...evaluator];
+    const all = files.map((file) => saved.find((entry) => entry.artifactId === file.artifactId && entry.role === file.role));
+    return { all, target };
+}
 /** Copy the target's generated files next to the checkpoint and record their identities. */
 export async function stageOutputFiles(files, directory) {
     if (!Array.isArray(files) || !files.length)
@@ -132,24 +299,17 @@ export async function stageOutputFiles(files, directory) {
         names.add(filename);
         if (!outputContentTypes.includes(file.contentType))
             throw new OutputFileError(`Unsupported generated file type ${String(file.contentType)}`);
-        let bytes;
-        try {
-            bytes = file.bytes ?? (await readFile(file.path));
-        }
-        catch {
+        // A path is read once, as a regular file within the limit, and staged from those bytes.
+        const bytes = file.bytes ??
+            (await readAgentFile(file.path, `Generated file ${filename}`, outputFileLimits.bytes));
+        if (!bytes)
             throw new OutputFileError(`Generated file ${filename} could not be read`);
-        }
         if (!bytes.byteLength)
             throw new OutputFileError(`Generated file ${filename} is empty`);
         if (bytes.byteLength > outputFileLimits.bytes)
             throw new OutputFileError(`Generated file ${filename} exceeds 25 MiB`);
         const path = join(root, filename);
-        if (file.bytes)
-            await writePrivate(path, bytes);
-        else {
-            await copyFile(file.path, path);
-            await verifiedBytes(path, { byteSize: bytes.byteLength, sha256: sha256(bytes) });
-        }
+        await writePrivate(path, bytes);
         staged.push({
             filename,
             contentType: file.contentType,
@@ -161,11 +321,74 @@ export async function stageOutputFiles(files, directory) {
     }
     return staged;
 }
+/** How long an upload waits for Hue to verify one artifact, and how often it looks. Hue verifies
+ * within a two-minute lease, which can outlast one request's timeout. */
+export const artifactSettling = { settleMillis: 180_000, pollMillis: 1000, maxPollMillis: 10_000 };
+/** A completion failure that can mean Hue is still verifying: a lost or timed-out response, a
+ * verification already running (409), or a refusal to retry (429, 503). */
+function mayStillVerify(error) {
+    return (error instanceof HueApiError &&
+        (error.status === undefined ||
+            error.status === 409 ||
+            error.status === 429 ||
+            error.status === 503));
+}
+/**
+ * Completes an artifact's verification and returns the state it settles in. When a completion
+ * times out, finds verification already running or is refused for now, the artifact is read after
+ * a pause: ready is returned; verifying is completed again, which Hue refuses while its lease
+ * holds and restarts once it lapsed; an artifact a retryable refusal (a lost response, 429 or 503)
+ * left unverified is completed again up to three times; any other state is returned for the
+ * caller to refuse (a resume uploads a rejected artifact again). All within `timing.settleMillis`.
+ */
+async function settleArtifact(client, id, timing) {
+    const deadline = Date.now() + timing.settleMillis;
+    let pause = timing.pollMillis;
+    let retries = 0;
+    for (;;) {
+        let refusedForNow;
+        let asked = 0;
+        try {
+            return (await client.completeArtifact(id)).state;
+        }
+        catch (error) {
+            if (!mayStillVerify(error) || Date.now() >= deadline)
+                throw error;
+            refusedForNow = error.status !== 409;
+            // A refusal that says how long to wait is waited out, within the settling window.
+            asked = (error.retryAfterSeconds ?? 0) * 1000;
+        }
+        await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(Math.max(pause, asked), deadline - Date.now()))));
+        pause = Math.min(pause * 2, timing.maxPollMillis);
+        let current;
+        try {
+            current = await client.getArtifact(id);
+        }
+        catch (error) {
+            if (!mayStillVerify(error))
+                throw error;
+        }
+        if (current?.state === "ready")
+            return current.state;
+        const unverified = current &&
+            ["reserved", "rejected"].includes(current.state) &&
+            current.failureCode !== "mismatch";
+        if (current && current.state !== "verifying" && !(unverified && refusedForNow && retries++ < 3))
+            return current.state;
+        if (Date.now() >= deadline) {
+            const seconds = Math.round(timing.settleMillis / 1000);
+            throw new Error(current?.state === "verifying"
+                ? `Hue was still verifying generated file ${id} after ${seconds} seconds`
+                : `Hue had not verified generated file ${id} after ${seconds} seconds (${current ? `it was ${current.state}` : "its state could not be read"})`);
+        }
+    }
+}
 /**
  * Publish staged files as verified artifacts. Reservations use stable keys derived from the
- * execution and the bytes, so a resumed upload settles on the same artifact.
+ * execution and the bytes, so a resumed upload settles on the same artifact, including one Hue
+ * finished verifying after an earlier attempt stopped waiting.
  */
-export async function uploadOutputFiles(client, executionId, files, save) {
+export async function uploadOutputFiles(client, executionId, files, save, timing = artifactSettling) {
     for (const file of files) {
         if (file.artifactId)
             continue;
@@ -179,7 +402,8 @@ export async function uploadOutputFiles(client, executionId, files, save) {
         });
         let state = reserved.state;
         if (state !== "ready") {
-            if (reserved.copyState !== "acknowledged") {
+            // A verification already running holds the uploaded bytes; Hue refuses another upload then.
+            if (reserved.copyState !== "acknowledged" && state !== "verifying") {
                 const upload = await client.requestArtifactUpload(reserved.id);
                 try {
                     await client.uploadArtifactBytes(upload, bytes, file.contentType);
@@ -189,18 +413,7 @@ export async function uploadOutputFiles(client, executionId, files, save) {
                     // settled by verified completion; never rewrite a final object here.
                 }
             }
-            let attempt = 0;
-            for (;;) {
-                try {
-                    state = (await client.completeArtifact(reserved.id)).state;
-                    break;
-                }
-                catch (error) {
-                    if (!(error instanceof HueApiError) || error.status !== 503 || attempt++ >= 2)
-                        throw error;
-                    await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));
-                }
-            }
+            state = await settleArtifact(client, reserved.id, timing);
         }
         if (state !== "ready")
             throw new Error(`Generated file ${file.filename} was not verified by Hue (${state})`);

package/dist/evals/json.js

@@ -4,27 +4,96 @@ export function aggregateBounds(bytes) {
     return { bytes, nodes: Math.ceil(bytes / 2), depth: valueBounds.depth + 8 };
 }
 const isText = (item) => item.isWellFormed() && !item.includes("\u0000");
+/** A string's code points: its UTF-16 length less one for each surrogate pair. */
+function codePoints(text) {
+    let count = text.length;
+    for (let index = 0; index < text.length - 1; index++) {
+        const unit = text.charCodeAt(index);
+        if (unit < 0xd800 || unit > 0xdbff)
+            continue;
+        const next = text.charCodeAt(index + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) {
+            count--;
+            index++;
+        }
+    }
+    return count;
+}
+/** Thrown within `json` when the byte bound is passed, which is checked last. */
+class PastByteBound extends Error {
+}
 /** Reject lossy JSON serialization before creating requests/checkpoints. */
 export function json(value, requested = valueBounds) {
     const bounds = typeof requested === "number" ? { ...valueBounds, bytes: requested } : requested;
     const ancestors = new Set();
     let nodes = 0;
+    // The UTF-8 length of the JSON text, counted as the value is read, so a value too long to
+    // serialize (past the runtime's longest string) is refused before `JSON.stringify` is asked to.
+    let bytes = 0;
+    // Once the byte bound is passed, the value is read again only to check it (below).
+    let checking = false;
+    // Text the second read has found valid is not checked again, so a string referenced many times
+    // is scanned once: by content up to 16,383 UTF-16 units, and a longer string when it is the last
+    // checked of its length. V8 hashes those by length alone, so a set of them would compare each
+    // with every other of that length.
+    const checkedText = new Set();
+    const checkedLong = new Map();
+    const text = (item) => {
+        if (!checking)
+            return isText(item);
+        if (item.length <= 16_383 ? checkedText.has(item) : checkedLong.get(item.length) === item)
+            return true;
+        if (!isText(item))
+            return false;
+        if (item.length <= 16_383)
+            checkedText.add(item);
+        else
+            checkedLong.set(item.length, item);
+        return true;
+    };
+    const charge = (amount) => {
+        if (checking)
+            return;
+        bytes += amount;
+        if (bytes > bounds.bytes)
+            throw new PastByteBound();
+    };
+    // A string's JSON text is at least as long as the string, so one longer than what is left is
+    // refused before it is escaped.
+    const chargeText = (text) => {
+        if (checking)
+            return;
+        if (text.length + 2 > bounds.bytes - bytes)
+            throw new PastByteBound();
+        charge(Buffer.byteLength(JSON.stringify(text)));
+    };
     const visit = (item, depth) => {
         if (++nodes > bounds.nodes || depth > bounds.depth)
             throw new RangeError("JSON exceeds depth/node limits");
-        if (item === null || typeof item === "boolean")
+        if (item === null || typeof item === "boolean") {
+            charge(item === false ? 5 : 4);
             return item;
-        if (typeof item === "number" && Number.isFinite(item))
+        }
+        if (typeof item === "number" && Number.isFinite(item)) {
+            charge(JSON.stringify(item).length);
             return item;
-        if (typeof item === "string" && isText(item))
+        }
+        if (typeof item === "string" && text(item)) {
+            chargeText(item);
             return item;
+        }
         if (!item || typeof item !== "object" || ancestors.has(item))
             throw new TypeError("Expected finite JSON without cycles or invalid Unicode");
         ancestors.add(item);
         try {
             if (Array.isArray(item)) {
+                // Each element is a value: an array longer than the values left is refused before its
+                // keys are listed.
+                if (item.length > bounds.nodes - nodes)
+                    throw new RangeError("JSON exceeds depth/node limits");
                 if (Object.keys(item).length !== item.length)
                     throw new TypeError("Sparse/extended arrays are not JSON");
+                charge(item.length ? item.length + 1 : 2);
                 return item.map((entry) => visit(entry, depth + 1));
             }
             if (Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null)
@@ -32,9 +101,33 @@ export function json(value, requested = valueBounds) {
             if (Object.getOwnPropertySymbols(item).length)
                 throw new TypeError("JSON cannot contain symbol properties");
             const result = Object.create(null);
-            for (const key of Object.keys(item).sort()) {
-                if (!isText(key))
+            // Each member is a value: an object with more than the values left is refused before its
+            // keys are sorted.
+            const keys = Object.keys(item);
+            if (keys.length > bounds.nodes - nodes)
+                throw new RangeError("JSON exceeds depth/node limits");
+            if (!checking) {
+                // Keys whose JSON text alone (at least their code points, two quotes and a colon each)
+                // needs more bytes than are left pass the byte bound before they are sorted, as in the
+                // Python SDK, so both read such an object the same way. A key has at least half its
+                // UTF-16 length in code points, so a long one passes it without counting them.
+                let left = bounds.bytes - bytes;
+                for (const key of keys) {
+                    left -= 3;
+                    if (key.length / 2 > left)
+                        throw new PastByteBound();
+                    left -= codePoints(key);
+                    if (left < 0)
+                        throw new PastByteBound();
+                }
+                keys.sort();
+            }
+            charge(keys.length ? keys.length + 1 : 2);
+            for (const key of keys) {
+                if (!text(key))
                     throw new TypeError("Expected finite JSON without cycles or invalid Unicode");
+                chargeText(key);
+                charge(1);
                 const descriptor = Object.getOwnPropertyDescriptor(item, key);
                 if (!("value" in descriptor))
                     throw new TypeError("JSON cannot contain accessors");
@@ -47,10 +140,24 @@ export function json(value, requested = valueBounds) {
             ancestors.delete(item);
         }
     };
-    const result = visit(value, 0);
-    if (Buffer.byteLength(JSON.stringify(result)) > bounds.bytes)
-        throw new RangeError("JSON exceeds byte limit");
-    return result;
+    try {
+        const result = visit(value, 0);
+        if (Buffer.byteLength(JSON.stringify(result)) > bounds.bytes)
+            throw new RangeError("JSON exceeds byte limit");
+        return result;
+    }
+    catch (error) {
+        if (!(error instanceof PastByteBound))
+            throw error;
+    }
+    // The byte bound is checked last, as it was before the length was counted as the value is
+    // read: a value past it that holds a value that is not JSON, or passes the value or depth bound,
+    // is refused for that. So the value is read again with each object's keys in their own order,
+    // and nothing is counted, escaped or sorted, nor text checked twice (`text`).
+    checking = true;
+    nodes = 0;
+    visit(value, 0);
+    throw new RangeError("JSON exceeds byte limit");
 }
 export function digest(value) {
     return createHash("sha256")