@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/examples/canister-studio/src/interface/cli-cache.ts

@@ -0,0 +1,125 @@
+// Compiler answers remembered by the .did text they are about. The live
+// loader caches compiled interfaces itself; this serves the server
+// functions that compile on request (the TypeScript module, a projection,
+// the committed .did check), which would otherwise compile again on every
+// request, and the method docs the loader's compile reads from the module.
+import type { Sources } from "@meantjs/cli"
+import { sha256Hex } from "../lib/hex.ts"
+import { Lru } from "./cache.ts"
+import { CompileDeadlineError, type CandidCli } from "./compile.ts"
+import { TRANSIENT_FAILURE_TTL_MS } from "./live-loader.ts"
+
+const MAX_ENTRIES = 500
+/** At most this much JSON (UTF-16, 2 bytes a unit) across the answers. */
+const MAX_WEIGHT = 32 * 1024 * 1024
+const MAX_SLOW_DIDS = 1_000
+
+export interface CliCacheOptions {
+  /** The clock, for tests. */
+  now?: () => number
+  /**
+   * How long a .did is refused after a compile of it ran past the deadline:
+   * the parse that made it slow is the same for every call about it, so a
+   * new method list would only hold the worker again.
+   */
+  slowTtlMs?: number
+}
+
+/**
+ * `cli` with its answers kept: `didToModule` by .did, `projectDid` by .did
+ * and set of method names, `checkCompatible` by both .did texts, in an LRU
+ * bounded by count and size. A call that throws is not kept, but one
+ * stopped at its deadline refuses every call about the same .did for
+ * `slowTtlMs`. Calls in flight are shared.
+ */
+export function cachingCli(
+  cli: CandidCli,
+  options: CliCacheOptions = {}
+): CandidCli {
+  const now = options.now ?? Date.now
+  const slowTtlMs = options.slowTtlMs ?? TRANSIENT_FAILURE_TTL_MS
+  const answers = new Lru<string, { answer: Promise<unknown>; weight: number }>(
+    {
+      maxEntries: MAX_ENTRIES,
+      maxWeight: MAX_WEIGHT,
+      weigh: (entry) => entry.weight,
+    }
+  )
+  // .did hash to the time its refusal ends.
+  const slow = new Lru<string, number>({ maxEntries: MAX_SLOW_DIDS })
+
+  async function guarded<T>(
+    dids: readonly string[],
+    work: () => Promise<T>
+  ): Promise<T> {
+    for (const did of dids) {
+      if ((slow.get(did) ?? 0) > now()) {
+        throw new CompileDeadlineError(
+          `Compiling this interface ran past the server's deadline a moment ago; it is not compiled again for ${slowTtlMs / 1000} s.`
+        )
+      }
+    }
+    try {
+      return await work()
+    } catch (error) {
+      if (error instanceof CompileDeadlineError && !error.busy) {
+        for (const did of dids) slow.set(did, now() + slowTtlMs)
+      }
+      throw error
+    }
+  }
+
+  async function remembered<T>(
+    key: string,
+    dids: readonly string[],
+    work: () => Promise<T>
+  ): Promise<T> {
+    const known = answers.get(key)
+    if (known !== undefined) return known.answer as Promise<T>
+    const answer = guarded(dids, work)
+    answers.set(key, { answer, weight: 0 })
+    try {
+      const value = await answer
+      // Weighed once it is known; an entry evicted meanwhile stays out.
+      if (answers.peek(key)?.answer === answer) {
+        answers.set(key, { answer, weight: 2 * JSON.stringify(value).length })
+      }
+      return value
+    } catch (error) {
+      if (answers.peek(key)?.answer === answer) answers.delete(key)
+      throw error
+    }
+  }
+
+  return {
+    // The loader keeps what it compiles by .did hash; only the deadline
+    // refusal applies here.
+    didToContract: async (sources) =>
+      guarded([await hashOf(sources)], () => cli.didToContract(sources)),
+    didToModule: async (sources) => {
+      const did = await hashOf(sources)
+      return remembered(`module\u0000${did}`, [did], () =>
+        cli.didToModule(sources)
+      )
+    },
+    projectDid: async (sources, methods) => {
+      const did = await hashOf(sources)
+      // The projection depends on the set of names, not their order.
+      const names = JSON.stringify([...new Set(methods)].sort())
+      return remembered(`project\u0000${did}\u0000${names}`, [did], () =>
+        cli.projectDid(sources, methods)
+      )
+    },
+    checkCompatible: async (written, live) => {
+      const dids = [await hashOf(written), await hashOf(live)]
+      return remembered(`compat\u0000${dids.join("\u0000")}`, dids, () =>
+        cli.checkCompatible(written, live)
+      )
+    },
+  }
+}
+
+function hashOf(sources: Sources): Promise<string> {
+  const text = typeof sources === "string" ? sources : JSON.stringify(sources)
+  return sha256Hex(new TextEncoder().encode(text))
+}

package/examples/canister-studio/src/interface/compile.server.test.ts

@@ -0,0 +1,198 @@
+// @vitest-environment node
+// The server's compiler in its worker thread, over the real WASM (offline):
+// the deadline that stops a hostile .did, the event loop it keeps free, and
+// a worker that cannot start.
+import { execFile } from "node:child_process"
+import { promisify } from "node:util"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import icrc1Did from "../../did/icrc1.did?raw"
+import {
+  CompileDeadlineError,
+  compileInterface,
+  MAX_DID_BYTES,
+  utf8Length,
+} from "./compile.ts"
+import { createWorkerCli, type WorkerCli } from "./compile.server.ts"
+import {
+  createLiveInterfaceLoader,
+  TRANSIENT_FAILURE_TTL_MS,
+} from "./live-loader.ts"
+import type { CandidSource } from "./read-candid.ts"
+
+const CKBTC_LEDGER = "mxzaz-hqaaa-aaaar-qaada-cai"
+const HASH = new Uint8Array(32).fill(0xa1)
+
+// The slowest shape found within the cap: 19,516 methods `m<i> : () -> ()`,
+// 262,134 bytes, which the compiler takes 2.5 s over (5 s with the docs).
+const HOSTILE_DID = `service : {\n/// d\n${Array.from(
+  { length: 19_516 },
+  (_, i) => `m${i}:()->();`
+).join("")}\n}`
+
+const opened: WorkerCli[] = []
+
+function workerCli(options?: Parameters<typeof createWorkerCli>[0]) {
+  const cli = createWorkerCli(options)
+  opened.push(cli)
+  return cli
+}
+
+afterEach(async () => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+  await Promise.all(opened.splice(0).map((cli) => cli.close()))
+})
+
+/** Counts timer ticks while `work` runs: zero means the event loop was held. */
+async function ticksDuring<T>(work: () => Promise<T>): Promise<[T, number]> {
+  let ticks = 0
+  const timer = setInterval(() => ticks++, 10)
+  try {
+    return [await work(), ticks]
+  } finally {
+    clearInterval(timer)
+  }
+}
+
+function sourceOf(did: string): CandidSource & { reads: number } {
+  const source = {
+    reads: 0,
+    async readCandidAndHash() {
+      source.reads++
+      return { did, moduleHash: HASH }
+    },
+    async readModuleHash() {
+      return HASH
+    },
+    async readTmpHack(): Promise<string> {
+      throw new Error("no tmp hack read expected")
+    },
+  }
+  return source
+}
+
+describe("the worker compiler", () => {
+  it("compiles in the worker, one call after another", async () => {
+    const cli = workerCli()
+    const [a, b, c] = await Promise.all([
+      cli.didToContract(icrc1Did),
+      cli.didToModule(icrc1Did),
+      cli.projectDid(icrc1Did, ["icrc1_fee"]),
+    ])
+    expect("contract" in a).toBe(true)
+    expect(b).toMatchObject({ ok: true })
+    expect(c).toMatchObject({ ok: true, methods: ["icrc1_fee"] })
+  })
+
+  it("stops a hostile .did at its deadline without holding the event loop, then starts afresh", async () => {
+    expect(utf8Length(HOSTILE_DID)).toBeLessThanOrEqual(MAX_DID_BYTES)
+    const cli = workerCli({ deadlineMs: 300 })
+    // Started and warm, so the deadline times the compile alone.
+    await cli.didToContract("service : {}")
+
+    const started = performance.now()
+    const [outcome, ticks] = await ticksDuring(() =>
+      cli.didToContract(HOSTILE_DID).then(
+        () => "compiled",
+        (error: unknown) => error
+      )
+    )
+    const took = performance.now() - started
+    expect(outcome).toBeInstanceOf(CompileDeadlineError)
+    expect(took).toBeLessThan(1_500)
+    expect(ticks).toBeGreaterThan(10)
+
+    expect(
+      await cli.didToContract("service : { ping : () -> (text) query }")
+    ).toHaveProperty("contract")
+  })
+
+  it("makes the deadline a timeout failure of compileInterface", async () => {
+    const cli = workerCli({ deadlineMs: 300 })
+    expect(await compileInterface(cli, HOSTILE_DID)).toMatchObject({
+      ok: false,
+      code: "timeout",
+      message: expect.stringMatching(/stopped it/),
+    })
+  })
+
+  it("refuses a call while the queue is full", async () => {
+    const cli = workerCli({ maxQueued: 0 })
+    const error: unknown = await cli.didToContract(icrc1Did).catch((e) => e)
+    expect(error).toBeInstanceOf(CompileDeadlineError)
+    expect(error).toMatchObject({ busy: true })
+  })
+
+  it("never keeps a process alive once its calls are done (pnpm smoke)", async () => {
+    const module = new URL("./compile.server.ts", import.meta.url).href
+    const script = `
+      const { createWorkerCli } = await import(${JSON.stringify(module)})
+      const reply = await createWorkerCli().didToContract("service : {}")
+      console.log("contract" in reply)
+    `
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      ["--no-warnings", "--input-type=module", "--eval", script],
+      { timeout: 10_000 }
+    )
+    expect(stdout.trim()).toBe("true")
+  })
+
+  it("fails the call, with no hang, when the worker cannot start", async () => {
+    vi.stubEnv("CANDID_CORE_WASM", "/srv/deploy/releases/missing/candid.wasm")
+    const cli = workerCli()
+    await expect(cli.didToContract(icrc1Did)).rejects.toThrow(/did not start/)
+  })
+})
+
+describe("the live loader over the worker", () => {
+  it("reports a compile stopped at its deadline as a timeout, remembered briefly", async () => {
+    let time = 1_000_000
+    const source = sourceOf(HOSTILE_DID)
+    const cli = workerCli({ deadlineMs: 300 })
+    const loader = createLiveInterfaceLoader({
+      source,
+      compile: (did) => compileInterface(cli, did),
+      compiledIn: "server",
+      now: () => time,
+    })
+    expect(await loader.load(CKBTC_LEDGER)).toMatchObject({
+      ok: false,
+      code: "timeout",
+    })
+    time += TRANSIENT_FAILURE_TTL_MS - 1
+    await loader.load(CKBTC_LEDGER)
+    expect(source.reads).toBe(1)
+  })
+
+  it("lets its own timeout fire while the worker compiles", async () => {
+    const cli = workerCli({ deadlineMs: 10_000 })
+    await cli.didToContract("service : {}")
+    const loader = createLiveInterfaceLoader({
+      source: sourceOf(HOSTILE_DID),
+      compile: (did) => compileInterface(cli, did),
+      compiledIn: "server",
+      timeoutMs: 200,
+    })
+    const started = performance.now()
+    const [payload, ticks] = await ticksDuring(() => loader.load(CKBTC_LEDGER))
+    expect(payload).toMatchObject({ ok: false, code: "timeout" })
+    expect(performance.now() - started).toBeLessThan(1_500)
+    expect(ticks).toBeGreaterThan(5)
+  })
+
+  it("keeps a compiler that cannot start out of the page: server_error, no path", async () => {
+    vi.stubEnv("CANDID_CORE_WASM", "/srv/deploy/releases/missing/candid.wasm")
+    const logged = vi.spyOn(console, "error").mockImplementation(() => {})
+    const cli = workerCli()
+    const loader = createLiveInterfaceLoader({
+      source: sourceOf(icrc1Did),
+      compile: (did) => compileInterface(cli, did),
+      compiledIn: "server",
+    })
+    const payload = await loader.load(CKBTC_LEDGER)
+    expect(payload).toMatchObject({ ok: false, code: "server_error" })
+    expect(JSON.stringify(payload)).not.toContain("/srv/")
+    expect(String(logged.mock.calls[0]?.[1])).toContain("/srv/")
+  })
+})

package/examples/canister-studio/src/interface/compile.server.ts

@@ -0,0 +1,262 @@
+// The server's copy of the Meant compiler, in a worker thread. Server
+// only. Each compiler call is one synchronous WASM call: on the server's own
+// thread a hostile .did within the size cap held the event loop for 2.5 to
+// 5 s, and no timer can interrupt that. In a worker the event loop stays
+// free, and a call that outlives its deadline is stopped by terminating the
+// worker; the next call starts a fresh one.
+import { createRequire } from "node:module"
+import { dirname, join } from "node:path"
+import { pathToFileURL } from "node:url"
+import { Worker } from "node:worker_threads"
+import { CompileDeadlineError, type CandidCli } from "./compile.ts"
+
+/**
+ * How long one compiler call may run in the worker. Real interfaces take 1
+ * to 30 ms; the hostile .did of `MAX_DID_BYTES` takes 2.5 s.
+ */
+const COMPILE_DEADLINE_MS = 2_000
+/** How long a fresh worker may take to load the compiler (about 40 ms). */
+const START_TIMEOUT_MS = 15_000
+/** Calls waiting for the worker past this many are refused. */
+const MAX_QUEUED = 64
+
+// The worker's script, evaluated: an eval worker needs no file of its own,
+// so `vite dev` and the server build run the same code. It uses dynamic
+// `import()` alone, which works whether Node evaluates it as CommonJS (the
+// default) or as a module (a parent run with `--input-type=module` passes
+// that on). The library is imported from the file URL the main thread
+// resolved, and its WASM is read from disk here: `init()` without bytes
+// reads `../wasm/` next to the library's file, which a bundled copy no
+// longer has.
+const WORKER_SOURCE = `
+Promise.all([import("node:worker_threads"), import("node:fs")]).then(
+  async ([{ parentPort, workerData }, { readFileSync }]) => {
+    const CALLS = new Set(["didToContract", "didToModule", "projectDid", "checkCompatible"])
+    const text = (error) => String((error && error.stack) || error)
+    try {
+      const cli = await import(workerData.cliUrl)
+      await cli.init(readFileSync(workerData.wasmPath))
+      parentPort.on("message", async ({ id, call, args }) => {
+        try {
+          if (!CALLS.has(call)) throw new Error("no compiler call " + call)
+          parentPort.postMessage({ id, ok: true, value: await cli[call](...args) })
+        } catch (error) {
+          parentPort.postMessage({ id, ok: false, message: text(error) })
+        }
+      })
+      parentPort.postMessage({ ready: true })
+    } catch (error) {
+      parentPort.postMessage({ startFailed: text(error) })
+    }
+  }
+)
+`
+
+type Call = keyof CandidCli
+
+type Job = {
+  id: number
+  call: Call
+  args: unknown[]
+  resolve(value: unknown): void
+  reject(error: unknown): void
+  timer?: ReturnType<typeof setTimeout>
+}
+
+type Reply =
+  | { ready: true }
+  | { startFailed: string }
+  | { id: number; ok: true; value: unknown }
+  | { id: number; ok: false; message: string }
+
+export interface WorkerCli extends CandidCli {
+  /** Stops the worker; a later call starts another. */
+  close(): Promise<void>
+}
+
+/**
+ * The compiler functions, run one at a time in a worker thread, each
+ * stopped at `deadlineMs` with a `CompileDeadlineError`. The worker starts
+ * on the first call and is unreferenced, so it never keeps the process
+ * alive; a call in flight does, through its deadline timer.
+ */
+export function createWorkerCli(
+  options: { deadlineMs?: number; maxQueued?: number } = {}
+): WorkerCli {
+  const deadlineMs = options.deadlineMs ?? COMPILE_DEADLINE_MS
+  const maxQueued = options.maxQueued ?? MAX_QUEUED
+  let worker: Worker | undefined
+  let ready = false
+  let running: Job | undefined
+  const queue: Job[] = []
+  let ids = 0
+
+  // One job at a time: the worker has one thread, and a queued job's
+  // deadline starts only when the worker takes it.
+  function pump(): void {
+    if (running !== undefined) return
+    const job = queue.shift()
+    if (job === undefined) return
+    running = job
+    if (worker === undefined) {
+      try {
+        spawn()
+      } catch (error) {
+        running = undefined
+        job.reject(error)
+        pump()
+      }
+    } else if (ready) {
+      send(worker, job)
+    }
+  }
+
+  function spawn(): void {
+    const w = new Worker(WORKER_SOURCE, {
+      eval: true,
+      workerData: locateCompiler(),
+    })
+    worker = w
+    ready = false
+    const startTimer = setTimeout(
+      () =>
+        retire(
+          w,
+          new Error(
+            `The compiler worker did not start within ${START_TIMEOUT_MS / 1000} s.`
+          )
+        ),
+      START_TIMEOUT_MS
+    )
+    w.on("message", (reply: Reply) => {
+      if (worker !== w) return
+      if ("ready" in reply) {
+        clearTimeout(startTimer)
+        ready = true
+        if (running !== undefined) send(w, running)
+        return
+      }
+      if ("startFailed" in reply) {
+        clearTimeout(startTimer)
+        retire(
+          w,
+          new Error(`The compiler worker did not start: ${reply.startFailed}`)
+        )
+        return
+      }
+      const job = running
+      if (job === undefined || job.id !== reply.id) return
+      clearTimeout(job.timer)
+      running = undefined
+      if (reply.ok) {
+        job.resolve(reply.value)
+        pump()
+      } else {
+        job.reject(new Error(reply.message))
+        // The library throws for no data error, so this is a trap of the
+        // WASM, which may leave its instance broken: start afresh.
+        retire(w)
+      }
+    })
+    w.on("error", (error) => {
+      clearTimeout(startTimer)
+      retire(w, error)
+    })
+    w.on("exit", (code) => {
+      clearTimeout(startTimer)
+      retire(w, new Error(`The compiler worker exited with code ${code}.`))
+    })
+    // After the listeners: adding a "message" listener refs the port again.
+    w.unref()
+  }
+
+  function send(w: Worker, job: Job): void {
+    job.timer = setTimeout(() => {
+      if (running !== job) return
+      retire(
+        w,
+        new CompileDeadlineError(
+          `The compile took longer than ${deadlineMs / 1000} s, so the server stopped it.`
+        )
+      )
+    }, deadlineMs)
+    w.postMessage({ id: job.id, call: job.call, args: job.args })
+  }
+
+  // Stops `w` and fails the job it held; the next job starts a fresh
+  // worker. Only the current worker counts: the late "exit" of a worker
+  // this terminated must not touch its successor.
+  function retire(w: Worker, error?: unknown): void {
+    if (worker !== w) return
+    worker = undefined
+    ready = false
+    void w.terminate()
+    const job = running
+    running = undefined
+    if (job !== undefined) {
+      clearTimeout(job.timer)
+      job.reject(error)
+    }
+    pump()
+  }
+
+  function call<T>(name: Call, args: unknown[]): Promise<T> {
+    return new Promise<T>((resolve, reject) => {
+      if (queue.length >= maxQueued) {
+        reject(
+          new CompileDeadlineError(
+            "The server's compiler is busy; try again in a moment.",
+            { busy: true }
+          )
+        )
+        return
+      }
+      queue.push({
+        id: ++ids,
+        call: name,
+        args,
+        resolve: (value) => resolve(value as T),
+        reject,
+      })
+      pump()
+    })
+  }
+
+  return {
+    didToContract: (sources) => call("didToContract", [sources]),
+    didToModule: (sources) => call("didToModule", [sources]),
+    projectDid: (sources, methods) => call("projectDid", [sources, methods]),
+    checkCompatible: (written, live) =>
+      call("checkCompatible", [written, live]),
+    async close() {
+      const w = worker
+      if (w !== undefined) {
+        retire(w, new Error("The compiler worker was closed."))
+        await w.terminate()
+      }
+    },
+  }
+}
+
+/**
+ * Where the worker loads the compiler from: the library as the main thread
+ * resolves it, and its WASM (`CANDID_CORE_WASM` names another copy).
+ */
+function locateCompiler(): { cliUrl: string; wasmPath: string } {
+  const require = createRequire(import.meta.url)
+  return {
+    cliUrl: pathToFileURL(require.resolve("@meantjs/cli")).href,
+    wasmPath:
+      process.env.CANDID_CORE_WASM ??
+      join(
+        dirname(require.resolve("@meantjs/cli/package.json")),
+        "wasm/candid_core_wasm_bg.wasm"
+      ),
+  }
+}
+
+/** The server's compiler: one worker for every request of the process. */
+export const serverCli: WorkerCli = createWorkerCli()
+
+// `vite dev` re-runs this module on an edit: stop the worker it replaces.
+import.meta.hot?.dispose(() => serverCli.close())

package/examples/canister-studio/src/interface/compile.test.ts

@@ -0,0 +1,108 @@
+// @vitest-environment node
+// The compile steps the server functions and the browser share, over the
+// real compiler (offline).
+import { readFile } from "node:fs/promises"
+import { describe, expect, it } from "vitest"
+import icpLedgerDid from "../../did/icp_ledger.did?raw"
+import icrc1Did from "../../did/icrc1.did?raw"
+import {
+  compatibilityOf,
+  compileInterface,
+  MAX_DID_BYTES,
+  MAX_METHODS,
+  moduleOf,
+  projectionOf,
+  tooLarge,
+} from "./compile.ts"
+import { serverCli } from "./compile.server.ts"
+
+describe("moduleOf", () => {
+  it("writes exactly the committed module for a registry .did", async () => {
+    const committed = await readFile(
+      new URL("../canisters/icp_ledger.ts", import.meta.url),
+      "utf8"
+    )
+    const result = await moduleOf(serverCli, icpLedgerDid)
+    expect(result).toEqual({ ok: true, module: committed, omitted: [] })
+  })
+
+  it("says why a .did does not generate", async () => {
+    const result = await moduleOf(serverCli, "service : {")
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(result.message).toMatch(/did_parse_error/)
+  })
+})
+
+describe("projectionOf", () => {
+  it("projects onto the methods named, in name order", async () => {
+    const result = await projectionOf(serverCli, icrc1Did, [
+      "icrc1_transfer",
+      "icrc1_balance_of",
+    ])
+    expect(result.ok).toBe(true)
+    if (!result.ok) return
+    expect(result.methods).toEqual(["icrc1_balance_of", "icrc1_transfer"])
+    expect(result.did).toContain("icrc1_transfer")
+    expect(result.did).not.toContain("icrc1_symbol")
+  })
+
+  it("names an unknown method", async () => {
+    const result = await projectionOf(serverCli, icrc1Did, ["no_such_method"])
+    expect(result).toMatchObject({ ok: false })
+    if (!result.ok) expect(result.message).toMatch(/unknown_method/)
+  })
+})
+
+describe("compatibilityOf", () => {
+  it("finds the ICRC-1 .did compatible with the ICP ledger's", async () => {
+    const report = await compatibilityOf(serverCli, icrc1Did, icpLedgerDid)
+    expect(report).toMatchObject({ ok: true, compatible: true })
+  })
+
+  it("reports a missing method as incompatible", async () => {
+    const report = await compatibilityOf(
+      serverCli,
+      "service : { gone : () -> (nat) query }",
+      icrc1Did
+    )
+    expect(report).toMatchObject({ ok: true, compatible: false })
+    if (report.ok) expect(report.diagnostics[0]?.code).toBe("method_missing")
+  })
+
+  it("says which side did not compile", async () => {
+    const report = await compatibilityOf(serverCli, "service : {", icrc1Did)
+    expect(report.ok).toBe(false)
+    if (!report.ok) expect(report.message).toMatch(/written/)
+  })
+})
+
+describe("compileInterface", () => {
+  it("counts the cap in UTF-8 bytes", () => {
+    const fits = "é".repeat(MAX_DID_BYTES / 2)
+    expect(tooLarge(fits)).toBeUndefined()
+    expect(tooLarge(`${fits}x`)).toMatchObject({ code: "too_large" })
+  })
+
+  it("refuses an interface of more than MAX_METHODS methods as too large", async () => {
+    const service = (n: number) =>
+      `service : {${Array.from({ length: n }, (_, i) => `m${i} : () -> ();`).join("")}}`
+    expect(
+      await compileInterface(serverCli, service(MAX_METHODS))
+    ).toMatchObject({ ok: true })
+    expect(
+      await compileInterface(serverCli, service(MAX_METHODS + 1))
+    ).toMatchObject({
+      ok: false,
+      code: "too_large",
+      message: `The interface has ${MAX_METHODS + 1} methods; the studio loads at most ${MAX_METHODS}.`,
+    })
+  })
+
+  it("keeps a hostile method name as data", async () => {
+    const result = await compileInterface(
+      serverCli,
+      'service : { "__proto__" : () -> (); "<img src=x onerror=alert(1)>" : () -> () query }'
+    )
+    expect(result.ok).toBe(true)
+  })
+})