@ifc-lite/sandbox 1.7.0

package/dist/sandbox.d.ts

@@ -0,0 +1,41 @@
+import type { BimContext } from '@ifc-lite/sdk';
+import type { SandboxConfig, ScriptResult, LogEntry } from './types.js';
+export declare class Sandbox {
+    private sdk;
+    private runtime;
+    private vm;
+    private logs;
+    private config;
+    /** Mutable start time — updated by eval(), read by interrupt handler */
+    private evalStartTime;
+    constructor(sdk: BimContext, config?: SandboxConfig);
+    /** Initialize the sandbox (loads WASM module if not cached) */
+    init(): Promise<void>;
+    /**
+     * Execute a script in the sandbox.
+     *
+     * Supports both JavaScript and TypeScript (TypeScript is type-stripped before execution).
+     */
+    eval(code: string, options?: {
+        filename?: string;
+        typescript?: boolean;
+    }): Promise<ScriptResult>;
+    /** Dispose the sandbox and free WASM memory */
+    dispose(): void;
+}
+/** Error thrown when a sandboxed script fails */
+export declare class ScriptError extends Error {
+    readonly logs: LogEntry[];
+    readonly durationMs: number;
+    constructor(message: string, logs: LogEntry[], durationMs: number);
+}
+/**
+ * Create and initialize a sandbox.
+ *
+ * Usage:
+ *   const sandbox = await createSandbox(bim, { permissions: { mutate: true } })
+ *   const result = await sandbox.eval('bim.query.byType("IfcWall")')
+ *   sandbox.dispose()
+ */
+export declare function createSandbox(sdk: BimContext, config?: SandboxConfig): Promise<Sandbox>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAexE,qBAAa,OAAO;IAShB,OAAO,CAAC,GAAG;IARb,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,EAAE,CAA+B;IACzC,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,MAAM,CAA0B;IACxC,wEAAwE;IACxE,OAAO,CAAC,aAAa,CAAK;gBAGhB,GAAG,EAAE,UAAU,EACvB,MAAM,GAAE,aAAkB;IAQ5B,+DAA+D;IACzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB3B;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IA4CtG,+CAA+C;IAC/C,OAAO,IAAI,IAAI;CAYhB;AAED,iDAAiD;AACjD,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,QAAQ,EAAE;aAChB,UAAU,EAAE,MAAM;gBAFlC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,QAAQ,EAAE,EAChB,UAAU,EAAE,MAAM;CAKrC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/sandbox.js

@@ -0,0 +1,135 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Sandbox — QuickJS-in-WASM script execution environment.
+ *
+ * Architecture:
+ * - One WASM module loaded per app lifetime (shared across sandboxes)
+ * - Each sandbox creates a fresh QuickJS context (cheap — a few KB)
+ * - The `bim` API is built inside the context via bridge.ts
+ * - Scripts run synchronously inside QuickJS
+ * - Memory and CPU limits enforced per-context
+ * - TypeScript is transpiled to JS before execution (type-stripping)
+ */
+import { getQuickJS } from 'quickjs-emscripten';
+import { DEFAULT_LIMITS, DEFAULT_PERMISSIONS } from './types.js';
+import { buildBridge } from './bridge.js';
+import { transpileTypeScript } from './transpile.js';
+/** Cached WASM module promise — deduplicates concurrent init calls */
+let modulePromise = null;
+function getModule() {
+    if (!modulePromise) {
+        modulePromise = getQuickJS();
+    }
+    return modulePromise;
+}
+export class Sandbox {
+    sdk;
+    runtime = null;
+    vm = null;
+    logs = [];
+    config;
+    /** Mutable start time — updated by eval(), read by interrupt handler */
+    evalStartTime = 0;
+    constructor(sdk, config = {}) {
+        this.sdk = sdk;
+        this.config = {
+            permissions: { ...DEFAULT_PERMISSIONS, ...config.permissions },
+            limits: { ...DEFAULT_LIMITS, ...config.limits },
+        };
+    }
+    /** Initialize the sandbox (loads WASM module if not cached) */
+    async init() {
+        const module = await getModule();
+        this.runtime = module.newRuntime();
+        // Apply resource limits
+        this.runtime.setMemoryLimit(this.config.limits.memoryBytes ?? DEFAULT_LIMITS.memoryBytes);
+        this.runtime.setMaxStackSize(this.config.limits.maxStackBytes ?? DEFAULT_LIMITS.maxStackBytes);
+        // CPU limit via interrupt handler — reads instance field set by eval()
+        const timeoutMs = this.config.limits.timeoutMs ?? DEFAULT_LIMITS.timeoutMs;
+        this.runtime.setInterruptHandler(() => {
+            if (this.evalStartTime > 0 && Date.now() - this.evalStartTime > timeoutMs) {
+                return true; // Interrupt execution
+            }
+            return false;
+        });
+        this.vm = this.runtime.newContext();
+        // Build the bim API inside the sandbox
+        const { logs } = buildBridge(this.vm, this.sdk, this.config.permissions);
+        this.logs = logs;
+    }
+    /**
+     * Execute a script in the sandbox.
+     *
+     * Supports both JavaScript and TypeScript (TypeScript is type-stripped before execution).
+     */
+    async eval(code, options) {
+        if (!this.vm) {
+            throw new Error('Sandbox not initialized. Call init() first.');
+        }
+        // Clear previous logs
+        this.logs.length = 0;
+        // Transpile TypeScript — always strip types for safety.
+        // The transpiler is a no-op for plain JavaScript, and the heuristic
+        // looksLikeTypeScript missed patterns like Record<string, number>.
+        let jsCode = code;
+        if (options?.typescript !== false) {
+            jsCode = await transpileTypeScript(code);
+        }
+        this.evalStartTime = Date.now();
+        const result = this.vm.evalCode(jsCode, options?.filename ?? 'script.js');
+        const durationMs = Date.now() - this.evalStartTime;
+        this.evalStartTime = 0;
+        if (result.error) {
+            const errorData = this.vm.dump(result.error);
+            result.error.dispose();
+            throw new ScriptError(typeof errorData === 'object' && errorData !== null && 'message' in errorData
+                ? String(errorData.message)
+                : String(errorData), this.logs, durationMs);
+        }
+        const value = this.vm.dump(result.value);
+        result.value.dispose();
+        return {
+            value,
+            logs: [...this.logs],
+            durationMs,
+        };
+    }
+    /** Dispose the sandbox and free WASM memory */
+    dispose() {
+        if (this.vm) {
+            this.vm.dispose();
+            this.vm = null;
+        }
+        if (this.runtime) {
+            this.runtime.dispose();
+            this.runtime = null;
+        }
+    }
+}
+/** Error thrown when a sandboxed script fails */
+export class ScriptError extends Error {
+    logs;
+    durationMs;
+    constructor(message, logs, durationMs) {
+        super(message);
+        this.logs = logs;
+        this.durationMs = durationMs;
+        this.name = 'ScriptError';
+    }
+}
+/**
+ * Create and initialize a sandbox.
+ *
+ * Usage:
+ *   const sandbox = await createSandbox(bim, { permissions: { mutate: true } })
+ *   const result = await sandbox.eval('bim.query.byType("IfcWall")')
+ *   sandbox.dispose()
+ */
+export async function createSandbox(sdk, config) {
+    const sandbox = new Sandbox(sdk, config);
+    await sandbox.init();
+    return sandbox;
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAoE,MAAM,oBAAoB,CAAC;AAGlH,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sEAAsE;AACtE,IAAI,aAAa,GAAsC,IAAI,CAAC;AAE5D,SAAS,SAAS;IAChB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,UAAU,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,OAAO;IASR;IARF,OAAO,GAA0B,IAAI,CAAC;IACtC,EAAE,GAA0B,IAAI,CAAC;IACjC,IAAI,GAAe,EAAE,CAAC;IACtB,MAAM,CAA0B;IACxC,wEAAwE;IAChE,aAAa,GAAG,CAAC,CAAC;IAE1B,YACU,GAAe,EACvB,SAAwB,EAAE;QADlB,QAAG,GAAH,GAAG,CAAY;QAGvB,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE;YAC9D,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEnC,wBAAwB;QACxB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC,CAAC;QAE/F,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE;YACpC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,SAAS,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAC,CAAC,sBAAsB;YACrC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAEpC,uCAAuC;QACvC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAqD;QAC5E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAErB,wDAAwD;QACxD,oEAAoE;QACpE,mEAAmE;QACnE,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,WAAW,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAEvB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,SAAS;gBAC3E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EACrB,IAAI,CAAC,IAAI,EACT,UAAU,CACX,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAEvB,OAAO;YACL,KAAK;YACL,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,OAAO;QACL,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;CAGF;AAED,iDAAiD;AACjD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,IAAgB,EAChB,UAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAY;QAChB,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAe,EACf,MAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/transpile.d.ts

@@ -0,0 +1,8 @@
+/** Transpile TypeScript to JavaScript by stripping types, then strip imports */
+export declare function transpileTypeScript(code: string): Promise<string>;
+/**
+ * Regex-based type stripping — removes TypeScript-only syntax.
+ * Not a full parser, but handles patterns commonly used in BIM scripts.
+ */
+export declare function naiveTypeStrip(code: string): string;
+//# sourceMappingURL=transpile.d.ts.map

package/dist/transpile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transpile.d.ts","sourceRoot":"","sources":["../src/transpile.ts"],"names":[],"mappings":"AAgEA,gFAAgF;AAChF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBvE;AAiCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BnD"}

package/dist/transpile.js

@@ -0,0 +1,149 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+let esbuildReady = null;
+/**
+ * Lazy-load and initialize esbuild-wasm.
+ * First script run pays the ~10MB WASM download; subsequent runs are instant.
+ * Returns null if unavailable (WASM blocked, CDN down, etc.).
+ */
+function getEsbuild() {
+    if (esbuildReady)
+        return esbuildReady;
+    esbuildReady = (async () => {
+        try {
+            // Dynamic import — Vite code-splits esbuild-wasm into a separate chunk
+            const mod = await import('esbuild-wasm');
+            const esbuild = (mod.default ?? mod);
+            // Resolve WASM binary URL
+            let wasmURL;
+            try {
+                // Vite: import the .wasm as a URL asset (works in dev + production)
+                // @ts-expect-error — Vite-specific ?url suffix for asset imports
+                const wasmMod = await import('esbuild-wasm/esbuild.wasm?url');
+                wasmURL = wasmMod.default;
+            }
+            catch {
+                // Fallback: CDN (version-pinned to match installed package)
+                wasmURL = `https://unpkg.com/esbuild-wasm@0.27.3/esbuild.wasm`;
+            }
+            await esbuild.initialize({ wasmURL, worker: false });
+            return esbuild;
+        }
+        catch {
+            return null;
+        }
+    })();
+    return esbuildReady;
+}
+// ============================================================================
+// Public API
+// ============================================================================
+/** Transpile TypeScript to JavaScript by stripping types, then strip imports */
+export async function transpileTypeScript(code) {
+    let js;
+    try {
+        const esbuild = await getEsbuild();
+        if (esbuild) {
+            const result = await esbuild.transform(code, {
+                loader: 'ts',
+                target: 'es2022',
+            });
+            js = result.code;
+        }
+        else {
+            js = naiveTypeStrip(code);
+        }
+    }
+    catch {
+        js = naiveTypeStrip(code);
+    }
+    // Strip import/export statements — QuickJS has no module system
+    return stripModuleSyntax(js);
+}
+// ============================================================================
+// Module syntax stripping
+// ============================================================================
+/**
+ * Strip import/export statements from JavaScript code.
+ * QuickJS doesn't support ES modules, so scripts access the SDK via
+ * the global `bim` object built by the bridge.
+ */
+function stripModuleSyntax(code) {
+    let result = code;
+    // Remove import statements: import ... from '...' or import '...'
+    result = result.replace(/^\s*import\s+(?:(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)(?:\s*,\s*(?:\{[^}]*\}|\*\s+as\s+\w+|\w+))*\s+from\s+)?['"][^'"]*['"];?\s*$/gm, '');
+    // Remove export keywords (keep the declaration): export const/function/class → const/function/class
+    result = result.replace(/^\s*export\s+(default\s+)?(const|let|var|function|class|async\s+function)\s/gm, '$2 ');
+    // Remove bare "export default" expression statements
+    result = result.replace(/^\s*export\s+default\s+/gm, '');
+    // Remove export { ... } and export { ... } from '...'
+    result = result.replace(/^\s*export\s+\{[^}]*\}(?:\s+from\s+['"][^'"]*['"])?\s*;?\s*$/gm, '');
+    return result;
+}
+// ============================================================================
+// Naive type stripping (fallback when esbuild-wasm unavailable)
+// ============================================================================
+/**
+ * Regex-based type stripping — removes TypeScript-only syntax.
+ * Not a full parser, but handles patterns commonly used in BIM scripts.
+ */
+export function naiveTypeStrip(code) {
+    let result = code;
+    // Remove interface declarations (including multiline)
+    result = result.replace(/^\s*(?:export\s+)?interface\s+\w+[^{]*\{[^}]*\}/gm, '');
+    // Remove type alias declarations
+    result = result.replace(/^\s*(?:export\s+)?type\s+\w+\s*=\s*[^;]+;/gm, '');
+    // Strip variable type annotations using balanced-bracket scanner.
+    // Handles: const x: [string, number][] = ..., const y: Array<{ a: T; b: U }> = ...
+    result = stripVariableAnnotations(result);
+    // Remove function parameter type annotations: (x: TYPE, y: TYPE)
+    result = result.replace(/(\w+)\s*:\s*(?:string|number|boolean|void|any|unknown|never|null|undefined|Record<[^>]+>|Array<[^>]+>|Map<[^>]+>|Set<[^>]+>|\[[^\]]*\](?:\[\])?|\w+(?:\[\])?(?:\s*\|\s*(?:string|number|boolean|null|undefined|\w+))*)\s*(?=[,)])/g, '$1');
+    // Remove function return type annotations: ): Type {
+    result = result.replace(/\):\s*[^{]+\{/g, ') {');
+    // Remove `as Type` casts — but not import aliases like `import { Foo as Bar }`
+    result = result.replace(/(?<![{,]\s*\w+\s)\s+as\s+\w+(?:\[\])?/g, '');
+    // Remove generic type parameters: <T>, <T extends U>
+    result = result.replace(/<\w+(?:\s+extends\s+\w+)?>/g, '');
+    return result;
+}
+/**
+ * Strip type annotations from variable declarations using bracket-depth tracking.
+ * Handles complex types like `Array<{ a: T; b: U }>` that contain semicolons
+ * inside nested brackets — a simple regex `[^=;]*` would fail on these.
+ */
+function stripVariableAnnotations(code) {
+    const lines = code.split('\n');
+    for (let li = 0; li < lines.length; li++) {
+        const line = lines[li];
+        // Match: const/let/var NAME:
+        const m = line.match(/^(\s*(?:const|let|var)\s+\w+)\s*:\s*/);
+        if (!m)
+            continue;
+        const prefix = m[1];
+        let i = m[0].length;
+        let depth = 0;
+        let found = false;
+        // Scan through the type annotation, tracking bracket nesting
+        while (i < line.length) {
+            const ch = line[i];
+            if (ch === '<' || ch === '{' || ch === '(' || ch === '[')
+                depth++;
+            else if (ch === '>' || ch === '}' || ch === ')' || ch === ']')
+                depth--;
+            else if (ch === '=' && depth === 0) {
+                // Found assignment at depth 0 — strip the type annotation
+                lines[li] = prefix + ' ' + line.substring(i);
+                found = true;
+                break;
+            }
+            i++;
+        }
+        // If no '=' found, this is an uninitialized variable: `let x: Type`
+        if (!found) {
+            lines[li] = prefix;
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=transpile.js.map

package/dist/transpile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transpile.js","sourceRoot":"","sources":["../src/transpile.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAsB/D,IAAI,YAAY,GAAuC,IAAI,CAAC;AAE5D;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;QACzB,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAgB,CAAC;YAEpD,0BAA0B;YAC1B,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBAC9D,OAAO,GAAI,OAA+B,CAAC,OAAO,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,OAAO,GAAG,oDAAoD,CAAC;YACjE,CAAC;YAED,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,IAAI,EAAU,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;gBAC3C,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YACH,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gEAAgE;IAChE,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,kEAAkE;IAClE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,8HAA8H,EAAE,EAAE,CAAC,CAAC;IAE5J,oGAAoG;IACpG,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,+EAA+E,EAAE,KAAK,CAAC,CAAC;IAEhH,qDAAqD;IACrD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;IAEzD,sDAAsD;IACtD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gEAAgE,EAAE,EAAE,CAAC,CAAC;IAE9F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,gEAAgE;AAChE,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,sDAAsD;IACtD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,mDAAmD,EAAE,EAAE,CAAC,CAAC;IAEjF,iCAAiC;IACjC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC;IAE3E,kEAAkE;IAClE,mFAAmF;IACnF,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAE1C,iEAAiE;IACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oOAAoO,EAAE,IAAI,CAAC,CAAC;IAEpQ,qDAAqD;IACrD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAEjD,+EAA+E;IAC/E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;IAEtE,qDAAqD;IACrD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAE3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,6BAA6B;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,6DAA6D;QAC7D,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC7D,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAClE,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACnC,0DAA0D;gBAC1D,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC7C,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;QACD,oEAAoE;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Types for @ifc-lite/sandbox
+ */
+/** Permission configuration — controls which SDK APIs are accessible */
+export interface SandboxPermissions {
+    /** Allow bim.model.* (model loading/management) */
+    model?: boolean;
+    /** Allow bim.query.* (entity queries) */
+    query?: boolean;
+    /** Allow bim.viewer.* (renderer control, colors, visibility) */
+    viewer?: boolean;
+    /** Allow bim.mutate.* (property editing) */
+    mutate?: boolean;
+    /** Allow bim.lens.* (lens definitions) */
+    lens?: boolean;
+    /** Allow bim.export.* (data export) */
+    export?: boolean;
+}
+/** Resource limits for sandbox execution */
+export interface SandboxLimits {
+    /** Maximum heap memory in bytes (default: 64MB) */
+    memoryBytes?: number;
+    /** Maximum execution time in milliseconds (default: 30000) */
+    timeoutMs?: number;
+    /** Maximum stack size in bytes (default: 512KB) */
+    maxStackBytes?: number;
+}
+/** Configuration for creating a sandbox */
+export interface SandboxConfig {
+    /** Permission configuration */
+    permissions?: SandboxPermissions;
+    /** Resource limits */
+    limits?: SandboxLimits;
+}
+/** Result of script execution */
+export interface ScriptResult {
+    /** Return value (JSON-serializable) */
+    value: unknown;
+    /** Console output captured during execution */
+    logs: LogEntry[];
+    /** Execution time in milliseconds */
+    durationMs: number;
+}
+/** A captured console log entry */
+export interface LogEntry {
+    level: 'log' | 'warn' | 'error' | 'info';
+    args: unknown[];
+    timestamp: number;
+}
+/** Default permissions — read-only access */
+export declare const DEFAULT_PERMISSIONS: Required<SandboxPermissions>;
+/** Default resource limits */
+export declare const DEFAULT_LIMITS: Required<SandboxLimits>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,sBAAsB;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,+CAA+C;IAC/C,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mCAAmC;AACnC,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACzC,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,kBAAkB,CAO5D,CAAC;AAEF,8BAA8B;AAC9B,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,aAAa,CAIlD,CAAC"}

package/dist/types.js

@@ -0,0 +1,19 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/** Default permissions — read-only access */
+export const DEFAULT_PERMISSIONS = {
+    model: true,
+    query: true,
+    viewer: true,
+    mutate: false, // Read-only by default
+    lens: true,
+    export: true,
+};
+/** Default resource limits */
+export const DEFAULT_LIMITS = {
+    memoryBytes: 64 * 1024 * 1024, // 64 MB
+    timeoutMs: 30_000, // 30 seconds
+    maxStackBytes: 512 * 1024, // 512 KB
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAyD/D,6CAA6C;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC/D,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,KAAK,EAAK,uBAAuB;IACzC,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,8BAA8B;AAC9B,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAM,QAAQ;IAC3C,SAAS,EAAE,MAAM,EAAoB,aAAa;IAClD,aAAa,EAAE,GAAG,GAAG,IAAI,EAAY,SAAS;CAC/C,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@ifc-lite/sandbox",
+  "version": "1.7.0",
+  "description": "QuickJS-in-WASM sandboxed script execution for ifc-lite",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./schema": {
+      "import": "./dist/bridge-schema.js",
+      "types": "./dist/bridge-schema.d.ts"
+    }
+  },
+  "dependencies": {
+    "esbuild-wasm": "^0.27.3",
+    "quickjs-emscripten": "^0.31.0",
+    "@ifc-lite/sdk": "^1.7.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.6.0"
+  },
+  "license": "MPL-2.0",
+  "author": "Louis True",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/louistrue/ifc-lite.git",
+    "directory": "packages/sandbox"
+  },
+  "homepage": "https://louistrue.github.io/ifc-lite/",
+  "bugs": "https://github.com/louistrue/ifc-lite/issues",
+  "keywords": [
+    "ifc",
+    "bim",
+    "sandbox",
+    "quickjs",
+    "wasm",
+    "scripting"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run"
+  }
+}