@markii/lua 0.3.0 → 0.3.1

package/dist/capabilities.d.ts

@@ -1,4 +1,5 @@
 import type { ScriptView } from '@markii/bundle';
+import { type MarshalLimits } from './marshal.js';
 /** A GET/POST/PATCH result handed back to Lua as `{status=..., body=...}`. */
 export interface NetResponse {
     status: number;
@@ -51,6 +52,18 @@ export interface CapabilityConfig {
     /** Bundle-scoped filesystem view (spec §11) — already capability-restricted by `@markii/bundle`'s `createScriptView`; this module delegates to it, never re-implements the path-jail or write policy. */
     bundle?: ScriptView;
     maxFetchBytes?: number;
+    /**
+     * Depth/node budget for a `net.fetch_json` response, checked (via
+     * `./marshal`'s `checkJsonWithinLimits`) against the parsed JSON BEFORE
+     * the raw body text is ever handed to Lua's `__smd_json_decode`
+     * (`./json-decode`) — see that module's doc comment for the full
+     * rationale (GitHub issue #6). Defaults to `./marshal`'s
+     * `DEFAULT_MARSHAL_LIMITS`, the same defaults `runScript` already uses
+     * for the return-value marshal walk, so a fetched response and a
+     * script's own return value are held to one shared limit by default,
+     * not two independently-tuned ones.
+     */
+    marshalLimits?: MarshalLimits;
 }
 export declare const DEFAULT_MAX_FETCH_BYTES = 2000000;
 /** One genuine capability denial, as recorded by `buildCapabilities`' `denials` handle — see its doc comment. */

package/dist/capabilities.js

@@ -1,4 +1,7 @@
-import { CAPABILITY_ERROR_TAG } from './errors.js';
+import { LuaMultiReturn } from 'wasmoon';
+import { CAPABILITY_ERROR_TAG, MARSHAL_ERROR_TAG } from './errors.js';
+import { buildJsonDecodePrelude } from './json-decode.js';
+import { buildMarshalPrelude, checkJsonWithinLimits, DEFAULT_MARSHAL_LIMITS, finalizeMarshaledValue, } from './marshal.js';
 export const DEFAULT_MAX_FETCH_BYTES = 2_000_000;
 function capabilityError(message) {
     return new Error(`${CAPABILITY_ERROR_TAG}: ${message}`);
@@ -94,8 +97,38 @@ export function luaStringToBytes(s) {
  */
 export function buildCapabilities(config) {
     const maxFetchBytes = config.maxFetchBytes ?? DEFAULT_MAX_FETCH_BYTES;
+    const marshalLimits = config.marshalLimits ?? DEFAULT_MARSHAL_LIMITS;
     const rawGlobals = {};
     const preludeParts = [];
+    // `__smd_json_decode` (`./json-decode`) is needed by BOTH `net.fetch_json`
+    // and `cache.get` (a cache hit re-enters Lua the same way a fetch result
+    // does — see the `cache` section below) — injected at most once
+    // regardless of how many callers need it. Re-defining the same Lua
+    // global twice would be harmless (Lua allows redefining a function), but
+    // there is no reason to emit the prelude source twice.
+    let jsonDecodePreludeInjected = false;
+    function ensureJsonDecodePrelude() {
+        if (jsonDecodePreludeInjected)
+            return;
+        jsonDecodePreludeInjected = true;
+        preludeParts.push(buildJsonDecodePrelude(marshalLimits));
+    }
+    // `__smd_marshal_root` (`./marshal`'s `buildMarshalPrelude`) is normally
+    // injected once, unconditionally, by `sandbox.ts` — AFTER this module's
+    // own prelude. `cache.get`'s internal refresh path (below) needs it
+    // available too, and needs it self-contained here rather than assuming
+    // that injection order: this module is exercised standalone (see
+    // `capabilities.test.ts`, which never touches `sandbox.ts`), so it must
+    // not depend on a caller injecting it. Re-running `sandbox.ts`'s own
+    // injection afterward just redefines the same idempotent Lua functions —
+    // harmless.
+    let marshalPreludeInjected = false;
+    function ensureMarshalPrelude() {
+        if (marshalPreludeInjected)
+            return;
+        marshalPreludeInjected = true;
+        preludeParts.push(buildMarshalPrelude(marshalLimits));
+    }
     // Out-of-band denial record — see `CapabilityDenials`'s doc comment. Every
     // site below that throws a `capabilityError` records here FIRST, so
     // `sandbox.ts` can classify the failure by this JS-only signal instead of
@@ -145,12 +178,42 @@ export function buildCapabilities(config) {
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            return parsed;
+            // Depth/node budget, checked HERE on the plain parsed JS value and
+            // BEFORE the raw text is ever handed to Lua — see `./json-decode`'s
+            // doc comment (GitHub issue #6) for why decoding happens entirely in
+            // Lua, and `MarshalLimits`' doc comment above for why this reuses the
+            // same budget the return-value marshal walk already enforces.
+            const budgetCheck = checkJsonWithinLimits(parsed, marshalLimits);
+            if (!budgetCheck.ok) {
+                const message = `fetch response for "${url}" ${budgetCheck.message}`;
+                recordDenial('denied', message);
+                throw capabilityError(message);
+            }
+            // Hand back the RAW JSON TEXT, not the parsed JS value: any object or
+            // array crossing this JS->Lua boundary as-is would arrive in Lua as a
+            // wasmoon `js_proxy` userdata, not a genuine table (see
+            // `./json-decode`'s doc comment for the full mechanism and why that
+            // breaks `type()`/`#`/marshaling a nested return value, and silently
+            // raises on a `null` field read). Strings, unlike objects/arrays, are
+            // scalars and cross the boundary cleanly with no proxy involved; the
+            // prelude below decodes this text into a genuine Lua table entirely
+            // in Lua (`__smd_json_decode`, `./json-decode`).
+            return res.body;
         });
+        ensureJsonDecodePrelude();
         preludeParts.push(`
 local __smd_net_get = __smd_net_get_raw
+-- Captured into a local HERE, at prelude-definition time (this whole
+-- prelude runs once, before any untrusted script code) -- NOT resolved as
+-- a dynamic global lookup inside \`net.fetch_json\`'s own body. Otherwise a
+-- script could do \`__smd_json_decode = function(t) return t end\` before a
+-- LATER \`net.fetch_json\` call and neuter the decoder's own depth guard and
+-- array-marker stripping entirely (adversarial finding A2) -- the same
+-- rebinding risk \`./json-decode\`'s own doc comment (finding A1) already
+-- closes for the primitives the decoder uses internally.
+local __smd_net_get_json_decode = __smd_json_decode
 __smd_net_get_raw = nil
-net.fetch_json = function(url) return __smd_net_get(url):await() end
+net.fetch_json = function(url) return __smd_net_get_json_decode(__smd_net_get(url):await()) end
 `);
     }
     // POST/PATCH are effectful. Under the 'manual' tier, wired to the real
@@ -172,12 +235,25 @@ net.fetch_json = function(url) return __smd_net_get(url):await() end
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            return config.net.post(url, body);
+            const res = await config.net.post(url, body);
+            // As with `net.fetch_json` above (GitHub issue #6): a plain JS object
+            // (even one this shallow) crosses into Lua as a `js_proxy` userdata,
+            // not a genuine table. `status`/`body` are both scalars, so instead
+            // of proxying the whole response object, resolve with a
+            // `LuaMultiReturn` — `:await()` recognizes that and expands it into
+            // TWO separate Lua return values (see `wasmoon`'s promise
+            // `await`/`MultiReturn` handling) — and let the trusted prelude below
+            // rebuild a real `{status=..., body=...}` table out of ordinary Lua
+            // table-constructor syntax.
+            return LuaMultiReturn.of(res.status, res.body);
         });
         preludeParts.push(`
 local __smd_net_post = __smd_net_post_raw
 __smd_net_post_raw = nil
-net.post = function(url, body) return __smd_net_post(url, body):await() end
+net.post = function(url, body)
+  local status, respBody = __smd_net_post(url, body):await()
+  return { status = status, body = respBody }
+end
 `);
     }
     else if (
@@ -213,12 +289,18 @@ net.post = function(url, body) return __smd_net_post_blocked(url, body):await()
                 recordDenial('denied', message);
                 throw capabilityError(message);
             }
-            return config.net.patch(url, body);
+            const res = await config.net.patch(url, body);
+            // Same fix as `net.post` above (GitHub issue #6) — see that block's
+            // comment for the full mechanism.
+            return LuaMultiReturn.of(res.status, res.body);
         });
         preludeParts.push(`
 local __smd_net_patch = __smd_net_patch_raw
 __smd_net_patch_raw = nil
-net.patch = function(url, body) return __smd_net_patch(url, body):await() end
+net.patch = function(url, body)
+  local status, respBody = __smd_net_patch(url, body):await()
+  return { status = status, body = respBody }
+end
 `);
     }
     else if (
@@ -247,10 +329,103 @@ net.patch = function(url, body) return __smd_net_patch_blocked(url, body):await(
     // ever exposes plain read/write primitives (`__smd_cache_get_raw`,
     // `__smd_cache_set_raw`); the read-if-fresh-else-run-fn CONTROL FLOW is
     // Lua calling Lua, never JS calling Lua.
+    //
+    // ## The same issue #6 proxy problem, on a cache HIT
+    //
+    // A stored value that came from `net.fetch_json` (the canonical idiom
+    // documented in `docs/scripting.md`: `cache.get(key, ttl, function()
+    // return net.fetch_json(url) end)`) is exactly the JSON-shaped data
+    // `./json-decode`'s doc comment already covers. Handing a cache HIT's
+    // stored value back to Lua as-is has the identical fix requirement as
+    // `net.fetch_json`'s own result: it must not cross the boundary as a raw
+    // JS object (a `js_proxy` userdata), or `type()`/`#`/marshaling a nested
+    // hit result breaks exactly like an un-fixed `fetch_json` would.
+    //
+    // The fix mirrors `net.fetch_json` exactly and reuses BOTH of its pieces:
+    //   - On `cache.get`'s READ side, the raw JS function JSON-encodes the
+    //     stored value (`JSON.stringify`, on a value that's already
+    //     plain/JSON-safe — see the WRITE side below) and hands back that
+    //     TEXT, a scalar with no proxy involved, alongside the plain-number
+    //     `storedAtMs`, via one `LuaMultiReturn` (same technique
+    //     `net.post`/`net.patch` use for their two-field response). Lua then
+    //     decodes it with the SAME `__smd_json_decode` fetch_json already
+    //     uses (`ensureJsonDecodePrelude`).
+    //   - On the WRITE side (an internal refresh, never a public
+    //     `cache.set` — see `docs/scripting.md`: `cache.get` is the only
+    //     public cache API), the value `fn()` computed is run through the
+    //     SAME capped, cycle-safe Lua walk (`__smd_marshal_root`,
+    //     `./marshal`'s `buildMarshalPrelude`) already used to bound a
+    //     script's own top-level return value, BEFORE it ever crosses to JS
+    //     as a function argument. This closes a real, separate gap: passing
+    //     an uncapped Lua table as a host-function argument uses wasmoon's
+    //     own eager, unbounded table->JS conversion (see `./marshal`'s doc
+    //     comment on why the return-value path never trusts that
+    //     conversion) — without this walk, `cache.get(key, ttl, function()
+    //     return hugeOrCyclicTable end)` would hit that same unbounded cost,
+    //     and a cyclic value would later crash the JS-side `JSON.stringify`
+    //     outright. `finalizeMarshaledValue` (the same JS-side pass the
+    //     top-level return path already runs) then strips the walk's array
+    //     marker and rejects a non-finite number, before the plain,
+    //     JSON-safe result is handed to `config.cache!.set` — so
+    //     `CacheEntry.value`'s STORAGE shape is unchanged (still whatever
+    //     plain value the host's `CacheProvider` already expects; e.g. a
+    //     bundle's `cache/*.json` file), and a script's own scalar values
+    //     (numbers, strings, booleans) round-trip exactly as before.
+    //   - Either enforcement failing raises the existing, already-classified
+    //     `MARSHAL_ERROR_TAG` error (`sandbox.ts` already recognizes it as
+    //     `kind: 'marshal'`) — no new error taxonomy for this path.
     if (config.cache) {
-        rawGlobals.__smd_cache_get_raw = (async (key) => config.cache.get(key));
-        rawGlobals.__smd_cache_set_raw = (async (key, value, storedAtMs) => {
-            await config.cache.set(key, { value, storedAtMs });
+        ensureJsonDecodePrelude();
+        ensureMarshalPrelude();
+        rawGlobals.__smd_cache_get_raw = (async (key) => {
+            const entry = await config.cache.get(key);
+            if (entry === undefined)
+                return undefined;
+            // Depth/node budget, checked BEFORE the stored value is ever encoded
+            // to text and handed to Lua — mirrors `net.fetch_json`'s own
+            // pre-check exactly (adversarial finding B2). A host-stored value is
+            // exactly as untrusted as a remote fetch body — a bundle's
+            // `cache/*.json` file, for instance, can be edited by anything with
+            // write access to the bundle, not just this sandbox's own WRITE side
+            // below — so without this check, a 300k-element cached array reached
+            // the script completely uncapped even though the FETCH path was
+            // already capped.
+            const budgetCheck = checkJsonWithinLimits(entry.value, marshalLimits);
+            if (!budgetCheck.ok) {
+                const message = `cached value for "${key}" ${budgetCheck.message}`;
+                recordDenial('denied', message);
+                throw capabilityError(message);
+            }
+            let text;
+            try {
+                // A cyclic or BigInt-bearing stored value throws here. This
+                // module's own WRITE side (`__smd_cache_set_raw` below) already
+                // rejects both before ever storing anything, but a `CacheProvider`
+                // is host-controlled storage that something other than this
+                // sandbox could have written — turn that into the same clean,
+                // catchable denial instead of an unclassified throw out of the
+                // capability layer.
+                const encoded = JSON.stringify(entry.value);
+                text = encoded === undefined ? 'null' : encoded;
+            }
+            catch (err) {
+                const message = `cached value for "${key}" could not be encoded: ${describeThrown(err)}`;
+                recordDenial('denied', message);
+                throw capabilityError(message);
+            }
+            return LuaMultiReturn.of(text, entry.storedAtMs);
+        });
+        rawGlobals.__smd_cache_set_raw = (async (key, 
+        // Already the output of `__smd_marshal_root` (`./marshal`'s
+        // `buildMarshalPrelude`) by the time it reaches here — see the
+        // prelude below — so this is a bounded, cycle-free, marker-tagged
+        // plain value (or a scalar), never a raw uncapped Lua table.
+        marshaledValue, storedAtMs) => {
+            const finalized = finalizeMarshaledValue(marshaledValue);
+            if (!finalized.ok) {
+                throw new Error(`${MARSHAL_ERROR_TAG}:${finalized.reason}`);
+            }
+            await config.cache.set(key, { value: finalized.value, storedAtMs });
             return true;
         });
         // `now` (for TTL freshness) is computed in JS, once per cache.get
@@ -263,20 +438,36 @@ net.patch = function(url, body) return __smd_net_patch_blocked(url, body):await(
 local __smd_cache_get = __smd_cache_get_raw
 local __smd_cache_set = __smd_cache_set_raw
 local __smd_now_ms = __smd_now_ms_raw
+-- Captured into locals HERE, at prelude-definition time -- NOT resolved as
+-- dynamic globals inside cache.get's own body (adversarial findings A2 and
+-- D1). Without this, a script could do \`__smd_json_decode = function(t)
+-- return t end\` (A2) or, more seriously, \`__smd_marshal_root = function(v)
+-- return v end\` (D1) before a LATER cache.get call: the marshal-root
+-- rebind would send an UNBOUNDED, uncapped table straight through
+-- wasmoon's own eager table->JS conversion into the store the moment the
+-- rebound "identity" function handed it back, since the write side
+-- (\`__smd_cache_set_raw\` below) would then be receiving whatever the
+-- script substituted with no cap ever having run -- the return-value path
+-- was never vulnerable to this trick only because of an unrelated
+-- evaluation-order accident (its own \`__smd_marshal_root\` call happens
+-- inside \`wrapUserCode\`'s generated code, evaluated before the script's
+-- own top-level statements finish), not because the global was pinned.
+local __smd_cache_json_decode = __smd_json_decode
+local __smd_cache_marshal_root = __smd_marshal_root
 __smd_cache_get_raw = nil
 __smd_cache_set_raw = nil
 __smd_now_ms_raw = nil
 cache = cache or {}
 cache.get = function(key, ttl, fn)
-  local existing = __smd_cache_get(key):await()
-  if existing ~= nil then
+  local text, storedAtMs = __smd_cache_get(key):await()
+  if text ~= nil then
     local now = __smd_now_ms():await()
-    if (now - existing.storedAtMs) < (ttl * 1000) then
-      return existing.value
+    if (now - storedAtMs) < (ttl * 1000) then
+      return __smd_cache_json_decode(text)
     end
   end
   local value = fn()
-  __smd_cache_set(key, value, __smd_now_ms():await()):await()
+  __smd_cache_set(key, __smd_cache_marshal_root(value), __smd_now_ms():await()):await()
   return value
 end
 `);

package/dist/errors.d.ts

@@ -49,6 +49,22 @@
 export declare const CAPABILITY_ERROR_TAG = "MARK_CAPABILITY";
 /** Prefix tag for a marshal-time rejection raised from the in-Lua marshal walk (see `./marshal`). */
 export declare const MARSHAL_ERROR_TAG = "MARK_MARSHAL";
+/**
+ * Prefix tag for a rejection raised from the in-Lua JSON decoder
+ * (`./json-decode`'s `__smd_json_decode`, used by `net.fetch_json` — see
+ * `./capabilities`). Under normal operation this never fires: the
+ * depth/node budget is enforced BEFORE the fetched body ever reaches Lua
+ * (`./capabilities`' `checkJsonWithinLimits` call, using the same
+ * `MarshalLimits` as `./marshal`, recorded as an ordinary capability denial
+ * — see `CAPABILITY_ERROR_TAG` above). The Lua-side `maxDepth` check this
+ * tag backs is a pure recursion-depth (C-stack) safety net for the case
+ * where that pre-check and the decoder's own walk of the exact same text
+ * would ever disagree — not a second, independently-tuned limit. Like
+ * `MARSHAL_ERROR_TAG`, this is NOT a classification signal `sandbox.ts`
+ * inspects: a script forging this text produces an ordinary `'runtime'`
+ * failure, same as any other `error()` call.
+ */
+export declare const FETCH_DECODE_ERROR_TAG = "MARK_FETCH_DECODE";
 /** The limits a run can breach; see `./limits`. */
 export type ScriptLimitKind = 'instructions' | 'timeout' | 'memory';
 /** Why a return value was rejected by the marshaller; see `./marshal`. */

package/dist/errors.js

@@ -49,6 +49,22 @@
 export const CAPABILITY_ERROR_TAG = 'MARK_CAPABILITY';
 /** Prefix tag for a marshal-time rejection raised from the in-Lua marshal walk (see `./marshal`). */
 export const MARSHAL_ERROR_TAG = 'MARK_MARSHAL';
+/**
+ * Prefix tag for a rejection raised from the in-Lua JSON decoder
+ * (`./json-decode`'s `__smd_json_decode`, used by `net.fetch_json` — see
+ * `./capabilities`). Under normal operation this never fires: the
+ * depth/node budget is enforced BEFORE the fetched body ever reaches Lua
+ * (`./capabilities`' `checkJsonWithinLimits` call, using the same
+ * `MarshalLimits` as `./marshal`, recorded as an ordinary capability denial
+ * — see `CAPABILITY_ERROR_TAG` above). The Lua-side `maxDepth` check this
+ * tag backs is a pure recursion-depth (C-stack) safety net for the case
+ * where that pre-check and the decoder's own walk of the exact same text
+ * would ever disagree — not a second, independently-tuned limit. Like
+ * `MARSHAL_ERROR_TAG`, this is NOT a classification signal `sandbox.ts`
+ * inspects: a script forging this text produces an ordinary `'runtime'`
+ * failure, same as any other `error()` call.
+ */
+export const FETCH_DECODE_ERROR_TAG = 'MARK_FETCH_DECODE';
 /**
  * Thrown by the instruction-count/wall-clock hook installed in `./limits`
  * when this package needs to surface a limit breach as a JS-level

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { ScriptFailure, ScriptLimitKind, ScriptMarshalReason, } from './errors.js';
-export { CAPABILITY_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
+export { CAPABILITY_ERROR_TAG, FETCH_DECODE_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
 export type { CreateEmptyLuaEngineOptions } from './globals.js';
 export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './globals.js';
 export type { LimitHandle, ScriptLimits } from './limits.js';
@@ -7,7 +7,7 @@ export { DEFAULT_LIMITS, installLimits } from './limits.js';
 export type { CacheEntry, CacheProvider, CapabilityConfig, CapabilityDenial, CapabilityDenials, CapabilityTier, NetGrants, NetProvider, NetResponse, } from './capabilities.js';
 export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
 export type { MarshalLimits } from './marshal.js';
-export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
+export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';
 export type { RunScriptOptions, RunScriptResult } from './sandbox.js';
 export { runScript } from './sandbox.js';

package/dist/index.js

@@ -3,11 +3,11 @@
 // filesystem). No React, no @markii/core, no @markii/react — see AGENTS.md's
 // import rule and the ESLint guard in the root config. May depend on
 // @markii/bundle for the `ScriptView` capability type only.
-export { CAPABILITY_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
+export { CAPABILITY_ERROR_TAG, FETCH_DECODE_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';
 export { ALLOWED_GLOBALS, DENIED_GLOBALS, createEmptyLuaEngine, } from './globals.js';
 export { DEFAULT_LIMITS, installLimits } from './limits.js';
 export { DEFAULT_MAX_FETCH_BYTES, bytesToLuaString, buildCapabilities, luaStringToBytes, } from './capabilities.js';
-export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
+export { DEFAULT_MARSHAL_LIMITS, buildMarshalPrelude, checkJsonWithinLimits, finalizeMarshaledValue, wrapUserCode, } from './marshal.js';
 export { NOT_YET_SUPPORTED_MESSAGE, buildRequireStub } from './require.js';
 export { runScript } from './sandbox.js';
 export { createLuaExecutor } from './executor.js';

package/dist/json-decode.d.ts

@@ -0,0 +1,89 @@
+import { type MarshalLimits } from './marshal.js';
+/**
+ * Builds the trusted Lua prelude defining `__smd_json_decode(text)`, the
+ * fix for GitHub issue #6: `net.fetch_json` used to hand the script
+ * wasmoon's own JS→Lua conversion of the parsed JSON object, which for any
+ * non-scalar JS value is a live PROXY (userdata wrapping the JS object via
+ * wasmoon's `js_proxy` metatable), never a genuine Lua table. That is the
+ * single root cause of all three traps the issue describes:
+ *
+ *   1. Returning any nested piece of the result fails marshaling with
+ *      `MARK_MARSHAL:type:userdata` — `./marshal`'s in-Lua walk sees
+ *      `type(value) == "userdata"` for the proxy and rejects it outright
+ *      (functions/userdata/threads are never marshalable, by design).
+ *   2. `type()` on the proxy genuinely returns `"userdata"` (it IS a
+ *      wasmoon `js_proxy` userdata, metatable-dressed to answer to
+ *      indexing like a table) and `#`/`pairs()` only work through that
+ *      metatable's `__len`/`__pairs`, which use 0-based JS semantics
+ *      inconsistent with the proxy's own 1-based `__index` — forcing a
+ *      script to guard every operation on the result with `pcall`.
+ *   3. Reading a field whose JSON value is `null` raises instead of
+ *      returning `nil`: the proxy's `__index` returns the raw JS `null`,
+ *      and wasmoon has no type extension that can push a bare JS `null`
+ *      onto the Lua stack (verified against `wasmoon`'s `NullTypeExtension`,
+ *      which is only registered when the engine option `injectObjects` is
+ *      on — it never is in this sandbox, see `./globals`), so the push
+ *      throws.
+ *
+ * Rather than fighting wasmoon's proxy machinery from the JS side (there is
+ * no supported way to make a plain JS object push as a genuine, non-proxied
+ * Lua table — only Lua's own table-constructor syntax produces one), this
+ * decodes the fetched body ENTIRELY IN LUA, the same philosophy `./marshal`
+ * already uses for the opposite direction (see that module's doc comment on
+ * why wasmoon's automatic conversions aren't trusted for anything
+ * resource-shaped): `./capabilities`' `net.fetch_json` hands this function
+ * the raw JSON text (a plain Lua string — strings are scalars, so they
+ * cross the JS↔Lua boundary cleanly with no proxy involved) and gets back a
+ * genuine Lua table built entirely out of ordinary `{}`/`t[k]=v` operations,
+ * indistinguishable from a table the script constructed itself: `type()`
+ * says `"table"`, `#`/`ipairs`/`pairs` behave normally, and a JSON `null`
+ * (as an OBJECT value) simply never gets assigned a key — reading it back
+ * is an ordinary, un-raising Lua `nil`. `cache.get`'s hit path (`./capabilities`)
+ * reuses this exact function for the identical reason: a cache hit re-enters
+ * Lua the same way a fetch result does.
+ *
+ * ## Depth/size caps: enforced BEFORE this ever runs, not by this function
+ *
+ * `./capabilities`' `net.fetch_json` and `cache.get` both call `./marshal`'s
+ * `checkJsonWithinLimits` on the already-`JSON.parse`d body/stored value and
+ * reject an oversized/too-deep one as an ordinary capability denial
+ * (recorded on the same `CapabilityDenials` handle the byte-size cap already
+ * uses) BEFORE the raw text is ever handed to this decoder. This function's
+ * own `maxDepth` check exists only as a recursion-depth (Lua C-stack) safety
+ * net for the case where that pre-check and this decoder's walk of the
+ * EXACT SAME text would ever disagree — see `FETCH_DECODE_ERROR_TAG`'s doc
+ * comment. There is no matching node-count check here: an instruction
+ * count over the sandbox's existing hook (`./limits`) already bounds the
+ * cost of a pathological decode the same way it bounds any other
+ * expensive Lua loop, so a second, independently-tuned node counter would
+ * only duplicate that enforcement.
+ *
+ * ## Why re-parse instead of reusing `JSON.parse`'s result
+ *
+ * `./capabilities` already calls `JSON.parse` once, to produce a clear
+ * "not valid JSON" error message and to run the depth/size pre-check
+ * above. Re-parsing the SAME (already-validated) text here in Lua is
+ * intentionally redundant: it is the only way to build genuine Lua tables
+ * at all (see above), and the cost is bounded by the same `maxFetchBytes`
+ * cap that already bounds the JS-side parse.
+ *
+ * ## Every Lua primitive this decoder uses is pinned at PRELUDE-DEFINITION
+ * ## time, not resolved as a dynamic global at call time (adversarial
+ * ## finding A1)
+ *
+ * `string.byte`/`sub`/`find`/`char`, `table.concat`, `tonumber`,
+ * `math.floor`, and `error` are all captured into locals ONCE, at the top
+ * of this chunk — which runs immediately when this prelude is injected,
+ * before any untrusted script code ever runs — and every nested function
+ * below closes over those locals as upvalues. Without this (the ORIGINAL
+ * shape of this file resolved them as plain global lookups INSIDE
+ * `__smd_json_decode`, i.e. at every CALL, not just once), a script could
+ * do `error = function() end` (or `string = {}`) before a LATER
+ * `net.fetch_json`/`cache.get` call and silently disable this decoder's own
+ * safety checks (verified empirically: rebinding `error` this way disables
+ * the depth guard entirely, since `fail()` would then no longer actually
+ * raise). This mirrors `./marshal`'s own `buildMarshalPrelude`, which
+ * already does exactly this for the same reason (see that module's doc
+ * comment referencing sandbox-audit finding F-1).
+ */
+export declare function buildJsonDecodePrelude(limits: MarshalLimits): string;

package/dist/json-decode.js

@@ -0,0 +1,354 @@
+import { FETCH_DECODE_ERROR_TAG } from './errors.js';
+import { ARRAY_MARKER } from './marshal.js';
+/**
+ * Builds the trusted Lua prelude defining `__smd_json_decode(text)`, the
+ * fix for GitHub issue #6: `net.fetch_json` used to hand the script
+ * wasmoon's own JS→Lua conversion of the parsed JSON object, which for any
+ * non-scalar JS value is a live PROXY (userdata wrapping the JS object via
+ * wasmoon's `js_proxy` metatable), never a genuine Lua table. That is the
+ * single root cause of all three traps the issue describes:
+ *
+ *   1. Returning any nested piece of the result fails marshaling with
+ *      `MARK_MARSHAL:type:userdata` — `./marshal`'s in-Lua walk sees
+ *      `type(value) == "userdata"` for the proxy and rejects it outright
+ *      (functions/userdata/threads are never marshalable, by design).
+ *   2. `type()` on the proxy genuinely returns `"userdata"` (it IS a
+ *      wasmoon `js_proxy` userdata, metatable-dressed to answer to
+ *      indexing like a table) and `#`/`pairs()` only work through that
+ *      metatable's `__len`/`__pairs`, which use 0-based JS semantics
+ *      inconsistent with the proxy's own 1-based `__index` — forcing a
+ *      script to guard every operation on the result with `pcall`.
+ *   3. Reading a field whose JSON value is `null` raises instead of
+ *      returning `nil`: the proxy's `__index` returns the raw JS `null`,
+ *      and wasmoon has no type extension that can push a bare JS `null`
+ *      onto the Lua stack (verified against `wasmoon`'s `NullTypeExtension`,
+ *      which is only registered when the engine option `injectObjects` is
+ *      on — it never is in this sandbox, see `./globals`), so the push
+ *      throws.
+ *
+ * Rather than fighting wasmoon's proxy machinery from the JS side (there is
+ * no supported way to make a plain JS object push as a genuine, non-proxied
+ * Lua table — only Lua's own table-constructor syntax produces one), this
+ * decodes the fetched body ENTIRELY IN LUA, the same philosophy `./marshal`
+ * already uses for the opposite direction (see that module's doc comment on
+ * why wasmoon's automatic conversions aren't trusted for anything
+ * resource-shaped): `./capabilities`' `net.fetch_json` hands this function
+ * the raw JSON text (a plain Lua string — strings are scalars, so they
+ * cross the JS↔Lua boundary cleanly with no proxy involved) and gets back a
+ * genuine Lua table built entirely out of ordinary `{}`/`t[k]=v` operations,
+ * indistinguishable from a table the script constructed itself: `type()`
+ * says `"table"`, `#`/`ipairs`/`pairs` behave normally, and a JSON `null`
+ * (as an OBJECT value) simply never gets assigned a key — reading it back
+ * is an ordinary, un-raising Lua `nil`. `cache.get`'s hit path (`./capabilities`)
+ * reuses this exact function for the identical reason: a cache hit re-enters
+ * Lua the same way a fetch result does.
+ *
+ * ## Depth/size caps: enforced BEFORE this ever runs, not by this function
+ *
+ * `./capabilities`' `net.fetch_json` and `cache.get` both call `./marshal`'s
+ * `checkJsonWithinLimits` on the already-`JSON.parse`d body/stored value and
+ * reject an oversized/too-deep one as an ordinary capability denial
+ * (recorded on the same `CapabilityDenials` handle the byte-size cap already
+ * uses) BEFORE the raw text is ever handed to this decoder. This function's
+ * own `maxDepth` check exists only as a recursion-depth (Lua C-stack) safety
+ * net for the case where that pre-check and this decoder's walk of the
+ * EXACT SAME text would ever disagree — see `FETCH_DECODE_ERROR_TAG`'s doc
+ * comment. There is no matching node-count check here: an instruction
+ * count over the sandbox's existing hook (`./limits`) already bounds the
+ * cost of a pathological decode the same way it bounds any other
+ * expensive Lua loop, so a second, independently-tuned node counter would
+ * only duplicate that enforcement.
+ *
+ * ## Why re-parse instead of reusing `JSON.parse`'s result
+ *
+ * `./capabilities` already calls `JSON.parse` once, to produce a clear
+ * "not valid JSON" error message and to run the depth/size pre-check
+ * above. Re-parsing the SAME (already-validated) text here in Lua is
+ * intentionally redundant: it is the only way to build genuine Lua tables
+ * at all (see above), and the cost is bounded by the same `maxFetchBytes`
+ * cap that already bounds the JS-side parse.
+ *
+ * ## Every Lua primitive this decoder uses is pinned at PRELUDE-DEFINITION
+ * ## time, not resolved as a dynamic global at call time (adversarial
+ * ## finding A1)
+ *
+ * `string.byte`/`sub`/`find`/`char`, `table.concat`, `tonumber`,
+ * `math.floor`, and `error` are all captured into locals ONCE, at the top
+ * of this chunk — which runs immediately when this prelude is injected,
+ * before any untrusted script code ever runs — and every nested function
+ * below closes over those locals as upvalues. Without this (the ORIGINAL
+ * shape of this file resolved them as plain global lookups INSIDE
+ * `__smd_json_decode`, i.e. at every CALL, not just once), a script could
+ * do `error = function() end` (or `string = {}`) before a LATER
+ * `net.fetch_json`/`cache.get` call and silently disable this decoder's own
+ * safety checks (verified empirically: rebinding `error` this way disables
+ * the depth guard entirely, since `fail()` would then no longer actually
+ * raise). This mirrors `./marshal`'s own `buildMarshalPrelude`, which
+ * already does exactly this for the same reason (see that module's doc
+ * comment referencing sandbox-audit finding F-1).
+ */
+export function buildJsonDecodePrelude(limits) {
+    return `
+local __smd_jd_error, __smd_jd_tonumber, __smd_jd_floor =
+  error, tonumber, math.floor
+local __smd_jd_sbyte, __smd_jd_ssub, __smd_jd_sfind, __smd_jd_schar =
+  string.byte, string.sub, string.find, string.char
+local __smd_jd_tconcat = table.concat
+
+function __smd_json_decode(__smd_json_text)
+  local error, tonumber, floor = __smd_jd_error, __smd_jd_tonumber, __smd_jd_floor
+  local sbyte, ssub, sfind, schar = __smd_jd_sbyte, __smd_jd_ssub, __smd_jd_sfind, __smd_jd_schar
+  local tconcat = __smd_jd_tconcat
+
+  local text = __smd_json_text
+  local len = #text
+  local pos = 1
+  local maxDepth = ${limits.maxDepth}
+
+  local function fail(reason)
+    error("${FETCH_DECODE_ERROR_TAG}:" .. reason)
+  end
+
+  local function skip_ws()
+    while pos <= len do
+      local c = sbyte(text, pos)
+      if c == 32 or c == 9 or c == 10 or c == 13 then
+        pos = pos + 1
+      else
+        return
+      end
+    end
+  end
+
+  -- Encodes one Unicode code point as UTF-8 bytes, for \\uXXXX escapes
+  -- inside JSON strings. No \`utf8\` library is loaded in this sandbox (see
+  -- \`./globals\`), so this is a small hand-rolled encoder covering the full
+  -- Unicode range JSON can express (a lone \\uXXXX escape, or a surrogate
+  -- pair for a codepoint above the Basic Multilingual Plane).
+  local function utf8_encode(cp)
+    if cp <= 0x7F then
+      return schar(cp)
+    elseif cp <= 0x7FF then
+      return schar(0xC0 + floor(cp / 0x40), 0x80 + (cp % 0x40))
+    elseif cp <= 0xFFFF then
+      return schar(
+        0xE0 + floor(cp / 0x1000),
+        0x80 + (floor(cp / 0x40) % 0x40),
+        0x80 + (cp % 0x40)
+      )
+    else
+      return schar(
+        0xF0 + floor(cp / 0x40000),
+        0x80 + (floor(cp / 0x1000) % 0x40),
+        0x80 + (floor(cp / 0x40) % 0x40),
+        0x80 + (cp % 0x40)
+      )
+    end
+  end
+
+  local decode_value
+
+  local function decode_string()
+    -- text:sub(pos, pos) == '"' on entry
+    pos = pos + 1
+    local parts = {}
+    local start = pos
+    while true do
+      if pos > len then fail("malformed") end
+      local c = sbyte(text, pos)
+      if c == 34 then -- '"'
+        parts[#parts + 1] = ssub(text, start, pos - 1)
+        pos = pos + 1
+        return tconcat(parts)
+      elseif c == 92 then -- '\\\\'
+        parts[#parts + 1] = ssub(text, start, pos - 1)
+        local e = ssub(text, pos + 1, pos + 1)
+        if e == '"' or e == '\\\\' or e == '/' then
+          parts[#parts + 1] = e
+          pos = pos + 2
+        elseif e == 'b' then
+          parts[#parts + 1] = schar(8)
+          pos = pos + 2
+        elseif e == 'f' then
+          parts[#parts + 1] = schar(12)
+          pos = pos + 2
+        elseif e == 'n' then
+          parts[#parts + 1] = schar(10)
+          pos = pos + 2
+        elseif e == 'r' then
+          parts[#parts + 1] = schar(13)
+          pos = pos + 2
+        elseif e == 't' then
+          parts[#parts + 1] = schar(9)
+          pos = pos + 2
+        elseif e == 'u' then
+          local hex = ssub(text, pos + 2, pos + 5)
+          local code = tonumber(hex, 16)
+          if not code then fail("malformed") end
+          pos = pos + 6
+          if code >= 0xD800 and code <= 0xDBFF
+              and ssub(text, pos, pos + 1) == "\\\\u" then
+            local hex2 = ssub(text, pos + 2, pos + 5)
+            local low = tonumber(hex2, 16)
+            if low and low >= 0xDC00 and low <= 0xDFFF then
+              code = 0x10000 + (code - 0xD800) * 0x400 + (low - 0xDC00)
+              pos = pos + 6
+            end
+          end
+          parts[#parts + 1] = utf8_encode(code)
+        else
+          fail("malformed")
+        end
+        start = pos
+      else
+        pos = pos + 1
+      end
+    end
+  end
+
+  local function decode_number()
+    local s, e = sfind(text, "^-?%d+%.?%d*[eE]?[%+%-]?%d*", pos)
+    if not s then fail("malformed") end
+    local numText = ssub(text, s, e)
+    pos = e + 1
+    local n = tonumber(numText)
+    if not n then fail("malformed") end
+    return n
+  end
+
+  local function decode_object(depth)
+    if depth >= maxDepth then fail("depth") end
+    pos = pos + 1 -- skip '{'
+    local out = {}
+    skip_ws()
+    if pos <= len and sbyte(text, pos) == 125 then -- '}'
+      pos = pos + 1
+      return out
+    end
+    while true do
+      skip_ws()
+      if sbyte(text, pos) ~= 34 then fail("malformed") end
+      local key = decode_string()
+      skip_ws()
+      if sbyte(text, pos) ~= 58 then fail("malformed") end -- ':'
+      pos = pos + 1
+      local value = decode_value(depth + 1)
+      -- JSON null becomes an ABSENT key, not an assigned nil -- reading it
+      -- back from Lua is then an ordinary, un-raising nil (issue #6, trap 3).
+      --
+      -- A key EXACTLY equal to the trusted marshal walk's array marker
+      -- (\`./marshal\`'s \`ARRAY_MARKER\`) is dropped, never stored -- this is
+      -- attacker-controlled JSON (a remote fetch body, or a host-stored
+      -- cache value), and \`finalizeMarshaledValue\` (\`./marshal\`) treats
+      -- that exact key as a trusted signal that ITS OWN marshal walk
+      -- produced this table and it should be reshaped into a JS array.
+      -- Without dropping it here, a response body such as
+      -- \`{"${ARRAY_MARKER}":true,"1":"a","2":"b","x":"kept"}\` would decode
+      -- to a Lua table carrying that same key, and later marshal to the
+      -- host as a JS ARRAY -- silently reshaping attacker-controlled data
+      -- and dropping its real keys (adversarial finding A4). Dropping
+      -- (rather than rejecting the whole response) keeps an otherwise
+      -- ordinary API response usable even if it happens to use this exact
+      -- field name for something unrelated.
+      if value ~= nil and key ~= "${ARRAY_MARKER}" then
+        out[key] = value
+      end
+      skip_ws()
+      local c = sbyte(text, pos)
+      if c == 44 then -- ','
+        pos = pos + 1
+      elseif c == 125 then -- '}'
+        pos = pos + 1
+        break
+      else
+        fail("malformed")
+      end
+    end
+    return out
+  end
+
+  local function decode_array(depth)
+    if depth >= maxDepth then fail("depth") end
+    pos = pos + 1 -- skip '['
+    local out = {}
+    local n = 0
+    skip_ws()
+    if pos <= len and sbyte(text, pos) == 93 then -- ']'
+      pos = pos + 1
+      return out
+    end
+    while true do
+      local value = decode_value(depth + 1)
+      n = n + 1
+      -- A JSON null ARRAY ELEMENT decodes to Lua \`false\`, not an absent
+      -- slot (orchestrator decision, adversarial finding C2): an absent
+      -- slot would leave a hole (\`#\`/\`ipairs\` stop early, and returning
+      -- the table to the host fails \`MARK_MARSHAL:key-type\` since the walk
+      -- no longer sees sequential \`1..n\` keys) -- reproducing issue #6's
+      -- headline crash for any API that puts \`null\` inside an array. \`nil\`
+      -- stays the right encoding for a JSON null OBJECT VALUE (an absent
+      -- key, see \`decode_object\` above) because a Lua table simply has no
+      -- way to represent "key present, value nil" at all; an array
+      -- POSITION has no such ambiguity to preserve, so \`false\` -- itself a
+      -- valid, falsy, round-trippable Lua/JSON value -- is used instead.
+      if value == nil then
+        out[n] = false
+      else
+        out[n] = value
+      end
+      skip_ws()
+      local c = sbyte(text, pos)
+      if c == 44 then
+        pos = pos + 1
+      elseif c == 93 then
+        pos = pos + 1
+        break
+      else
+        fail("malformed")
+      end
+    end
+    return out
+  end
+
+  decode_value = function(depth)
+    skip_ws()
+    if pos > len then fail("malformed") end
+    local c = sbyte(text, pos)
+    if c == 34 then
+      return decode_string()
+    elseif c == 123 then
+      return decode_object(depth)
+    elseif c == 91 then
+      return decode_array(depth)
+    elseif c == 116 then -- 't'rue
+      if ssub(text, pos, pos + 3) == "true" then
+        pos = pos + 4
+        return true
+      end
+      fail("malformed")
+    elseif c == 102 then -- 'f'alse
+      if ssub(text, pos, pos + 4) == "false" then
+        pos = pos + 5
+        return false
+      end
+      fail("malformed")
+    elseif c == 110 then -- 'n'ull
+      if ssub(text, pos, pos + 3) == "null" then
+        pos = pos + 4
+        return nil
+      end
+      fail("malformed")
+    elseif c == 45 or (c >= 48 and c <= 57) then
+      return decode_number()
+    else
+      fail("malformed")
+    end
+  end
+
+  local result = decode_value(0)
+  skip_ws()
+  if pos <= len then fail("malformed") end
+  return result
+end
+`;
+}

package/dist/marshal.d.ts

@@ -98,6 +98,40 @@ export declare function buildMarshalPrelude(limits: MarshalLimits): string;
  * mechanism (a custom `_ENV` per chunk) that this phase doesn't need.
  */
 export declare function wrapUserCode(code: string): string;
+/**
+ * Depth/node budget check for a plain, already-`JSON.parse`d JS value
+ * (arrays/objects/strings/numbers/booleans/`null`; never a cycle, since
+ * `JSON.parse` output is always a tree). Used by `./capabilities`' `net.fetch_json`
+ * to reject an oversized/too-deep fetch response BEFORE the raw JSON text
+ * is ever handed to Lua for decoding (`./json-decode`) — the JS-side
+ * mirror of what `buildMarshalPrelude`'s in-Lua walk does for the return
+ * value going the OTHER direction. Counting rule matches that walk exactly
+ * so the two budgets read as one shared limit, not two independently-tuned
+ * ones: every value (leaf or container) counts as one node, and `depth`
+ * increases by one for each level of array/object nesting.
+ */
+export declare function checkJsonWithinLimits(value: unknown, limits: MarshalLimits): {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'depth' | 'nodes';
+    message: string;
+};
+/**
+ * True array marker set by the Lua-side marshal walk (see
+ * `buildMarshalPrelude`). Exported (not just module-private) so
+ * `./json-decode`'s JSON decoder can recognize and DROP this exact key if
+ * it ever appears as an object key in attacker-controlled JSON (adversarial
+ * finding A4): without that, a remote response body like
+ * `{"__smd_is_array":true,"1":"a","2":"b","x":"kept"}` would decode to an
+ * ordinary Lua table carrying this same marker key, and `finalizeMarshaledValue`
+ * below — which has no way to tell "the trusted marshal walk set this" apart
+ * from "the JSON itself happened to contain a key with this exact name" —
+ * would then convert it to a JS ARRAY on the way out, silently reshaping
+ * attacker-controlled data and dropping the object's real keys. See
+ * `./json-decode`'s decoder for where the corresponding key is dropped.
+ */
+export declare const ARRAY_MARKER = "__smd_is_array";
 /**
  * Final JS-side pass over the value wasmoon already converted from the
  * Lua-side-capped table: strips the `__smd_is_array` marker (converting

package/dist/marshal.js

@@ -168,8 +168,71 @@ end
 export function wrapUserCode(code) {
     return `local function __smd_user_chunk()\n${code}\nend\nreturn __smd_marshal_root(__smd_user_chunk())`;
 }
-/** True array marker set by the Lua-side marshal walk (see `buildMarshalPrelude`). */
-const ARRAY_MARKER = '__smd_is_array';
+/**
+ * Depth/node budget check for a plain, already-`JSON.parse`d JS value
+ * (arrays/objects/strings/numbers/booleans/`null`; never a cycle, since
+ * `JSON.parse` output is always a tree). Used by `./capabilities`' `net.fetch_json`
+ * to reject an oversized/too-deep fetch response BEFORE the raw JSON text
+ * is ever handed to Lua for decoding (`./json-decode`) — the JS-side
+ * mirror of what `buildMarshalPrelude`'s in-Lua walk does for the return
+ * value going the OTHER direction. Counting rule matches that walk exactly
+ * so the two budgets read as one shared limit, not two independently-tuned
+ * ones: every value (leaf or container) counts as one node, and `depth`
+ * increases by one for each level of array/object nesting.
+ */
+export function checkJsonWithinLimits(value, limits) {
+    let nodes = 0;
+    function walk(v, depth) {
+        nodes++;
+        if (nodes > limits.maxNodes) {
+            return {
+                ok: false,
+                reason: 'nodes',
+                message: `exceeds the ${limits.maxNodes}-node limit`,
+            };
+        }
+        if (v !== null && typeof v === 'object') {
+            if (depth >= limits.maxDepth) {
+                return {
+                    ok: false,
+                    reason: 'depth',
+                    message: `exceeds the ${limits.maxDepth}-level depth limit`,
+                };
+            }
+            if (Array.isArray(v)) {
+                for (const item of v) {
+                    const r = walk(item, depth + 1);
+                    if (!r.ok)
+                        return r;
+                }
+            }
+            else {
+                for (const val of Object.values(v)) {
+                    const r = walk(val, depth + 1);
+                    if (!r.ok)
+                        return r;
+                }
+            }
+        }
+        return { ok: true };
+    }
+    return walk(value, 0);
+}
+/**
+ * True array marker set by the Lua-side marshal walk (see
+ * `buildMarshalPrelude`). Exported (not just module-private) so
+ * `./json-decode`'s JSON decoder can recognize and DROP this exact key if
+ * it ever appears as an object key in attacker-controlled JSON (adversarial
+ * finding A4): without that, a remote response body like
+ * `{"__smd_is_array":true,"1":"a","2":"b","x":"kept"}` would decode to an
+ * ordinary Lua table carrying this same marker key, and `finalizeMarshaledValue`
+ * below — which has no way to tell "the trusted marshal walk set this" apart
+ * from "the JSON itself happened to contain a key with this exact name" —
+ * would then convert it to a JS ARRAY on the way out, silently reshaping
+ * attacker-controlled data and dropping the object's real keys. See
+ * `./json-decode`'s decoder for where the corresponding key is dropped.
+ */
+export const ARRAY_MARKER = '__smd_is_array';
 /**
  * Final JS-side pass over the value wasmoon already converted from the
  * Lua-side-capped table: strips the `__smd_is_array` marker (converting

package/dist/sandbox.js

@@ -216,6 +216,7 @@ export async function runScript(options) {
             cache: options.cache,
             bundle: options.bundle,
             maxFetchBytes: options.maxFetchBytes,
+            marshalLimits,
         });
         for (const [name, fn] of Object.entries(rawGlobals)) {
             engine.global.set(name, fn);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/lua",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Sandboxed Lua 5.4 (wasmoon) execution runtime for Mark's document scripting: an empty-env global whitelist, two-tier capability-gated net/cache/bundle access, instruction-count/wall-clock/memory limits, and depth/size-capped Lua<->JS marshaling.",
   "keywords": [
     "markdown",
@@ -44,8 +44,8 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@markii/bundle": "0.3.0",
-    "@markii/runtime": "0.3.0",
+    "@markii/bundle": "0.3.1",
+    "@markii/runtime": "0.3.1",
     "wasmoon": "^1.16.0"
   }
 }