@namzu/sdk 36.0.0 → 37.0.0

package/dist/execution/code-runtime/json-value.js

@@ -0,0 +1,89 @@
+/**
+ * Serialize application data before sending it to the interpreter.
+ *
+ * JSON.stringify alone can allocate an arbitrarily large intermediate string.
+ * This writer accounts for each piece, refuses cycles and non-JSON values, and
+ * limits nesting. It never installs application objects in the guest realm.
+ * Undefined is supported only as a top-level result, represented out of band.
+ */
+export function encodeCodeValue(value, maxBytes) {
+    if (value === undefined)
+        return undefined;
+    const pieces = [];
+    const ancestors = new Set();
+    let bytes = 0;
+    const append = (text) => {
+        bytes += Buffer.byteLength(text);
+        if (bytes > maxBytes)
+            throw new Error(`Code runtime value exceeds ${maxBytes} bytes.`);
+        pieces.push(text);
+    };
+    const quote = (text) => {
+        if (text.length > maxBytes - bytes) {
+            throw new Error(`Code runtime value exceeds ${maxBytes} bytes.`);
+        }
+        append(JSON.stringify(text));
+    };
+    const visit = (item, depth) => {
+        if (depth > 64)
+            throw new Error('Code runtime value exceeds 64 levels of nesting.');
+        if (item === null) {
+            append('null');
+            return;
+        }
+        if (typeof item === 'string') {
+            quote(item);
+            return;
+        }
+        if (typeof item === 'boolean') {
+            append(String(item));
+            return;
+        }
+        if (typeof item === 'number' && Number.isFinite(item)) {
+            append(String(item));
+            return;
+        }
+        if (typeof item !== 'object')
+            throw new Error('Code runtime values must be JSON-safe.');
+        if (ancestors.has(item))
+            throw new Error('Code runtime values must not contain cycles.');
+        const array = Array.isArray(item);
+        if (!array &&
+            Object.getPrototypeOf(item) !== Object.prototype &&
+            Object.getPrototypeOf(item) !== null) {
+            throw new Error('Code runtime values must contain only plain objects and arrays.');
+        }
+        ancestors.add(item);
+        if (array) {
+            if (item.length > maxBytes)
+                throw new Error(`Code runtime value exceeds ${maxBytes} bytes.`);
+            append('[');
+            for (let index = 0; index < item.length; index++) {
+                if (index > 0)
+                    append(',');
+                visit(item[index], depth + 1);
+            }
+            append(']');
+        }
+        else {
+            append('{');
+            const keys = Object.keys(item);
+            for (const [index, key] of keys.entries()) {
+                if (index > 0)
+                    append(',');
+                quote(key);
+                append(':');
+                const descriptor = Object.getOwnPropertyDescriptor(item, key);
+                if (!descriptor || !('value' in descriptor)) {
+                    throw new Error('Code runtime values must not contain accessors.');
+                }
+                visit(descriptor.value, depth + 1);
+            }
+            append('}');
+        }
+        ancestors.delete(item);
+    };
+    visit(value, 0);
+    return pieces.join('');
+}
+//# sourceMappingURL=json-value.js.map

package/dist/execution/code-runtime/json-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-value.js","sourceRoot":"","sources":["../../../src/execution/code-runtime/json-value.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,QAAgB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;QACrC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,SAAS,CAAC,CAAA;QACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACpC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,SAAS,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7B,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QACpD,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACnF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,OAAM;QACP,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,CAAA;YACX,OAAM;QACP,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YACpB,OAAM;QACP,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YACpB,OAAM;QACP,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QACvF,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IACC,CAAC,KAAK;YACN,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS;YAChD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,EACnC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACnF,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnB,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,SAAS,CAAC,CAAA;YAC5F,MAAM,CAAC,GAAG,CAAC,CAAA;YACX,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAA;QACZ,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,GAAG,CAAC,CAAA;YACX,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC1B,KAAK,CAAC,GAAG,CAAC,CAAA;gBACV,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC7D,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACnE,CAAC;gBACD,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACnC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAA;QACZ,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC,CAAA;IACD,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACf,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC"}

package/dist/execution/code-runtime/worker-program.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Trusted worker bootstrap. Only vm.evalCode executes the untrusted program.
+ * Kept as source so installed/bundled SDKs need no separate worker entry file.
+ * No Node object or callback is injected into QuickJS: its native functions
+ * exchange bounded strings and interpreter-owned promise handles.
+ */
+export declare const QUICKJS_WORKER_SOURCE = "\nconst { parentPort, workerData } = require('node:worker_threads')\nconst { newQuickJSWASMModuleFromVariant, newVariant } = require(workerData.corePath)\nconst variantModule = require(workerData.variantPath)\nconst variant = variantModule.default || variantModule\n\nasync function main() {\n\tconst limits = workerData.limits\n\tconst pages = Math.floor(limits.memoryLimitBytes / 65536)\n\tconst wasmMemory = new WebAssembly.Memory({ initial: Math.min(256, pages), maximum: pages })\n\tconst module = await newQuickJSWASMModuleFromVariant(newVariant(variant, { wasmMemory }))\n\tconst runtime = module.newRuntime()\n\truntime.setMemoryLimit(limits.memoryLimitBytes)\n\truntime.setMaxStackSize(512 * 1024)\n\truntime.setInterruptHandler(() => Date.now() >= workerData.deadline)\n\tconst vm = runtime.newContext()\n\tconst pending = new Map()\n\tlet nextId = 0\n\tlet printBytes = 0\n\tlet printCount = 0\n\tlet truncated = false\n\tlet ended = false\n\tlet pumping = false\n\tlet scheduled = false\n\tlet program\n\tconst owned = []\n\n\tfunction keep(result) {\n\t\tconst handle = vm.unwrapResult(result)\n\t\towned.push(handle)\n\t\treturn handle\n\t}\n\t// Capture intrinsics before the program may replace its own globals.\n\tconst encode = keep(vm.evalCode('(' + function () {\n\t\tconst stringify = JSON.stringify\n\t\tconst finite = Number.isFinite\n\t\tconst prototype = Object.getPrototypeOf\n\t\tconst plain = Object.prototype\n\t\tconst isArray = Array.isArray\n\t\tconst keys = Object.keys\n\t\tconst descriptor = Object.getOwnPropertyDescriptor\n\t\treturn function (value) {\n\t\t\tif (value === undefined) return undefined\n\t\t\tconst parents = new Set()\n\t\t\tfunction check(item, depth) {\n\t\t\t\tconst kind = typeof item\n\t\t\t\tif (item === null || kind === 'string' || kind === 'boolean' || (kind === 'number' && finite(item))) return\n\t\t\t\tif (kind !== 'object' || depth > 64 || parents.has(item)) throw new Error('Code runtime values must be JSON-safe.')\n\t\t\t\tif (!isArray(item) && prototype(item) !== plain && prototype(item) !== null) throw new Error('Code runtime values must use plain objects and arrays.')\n\t\t\t\tparents.add(item)\n\t\t\t\tfor (const key of keys(item)) {\n\t\t\t\t\tconst property = descriptor(item, key)\n\t\t\t\t\tif (!property || !('value' in property)) throw new Error('Code runtime values must not contain accessors.')\n\t\t\t\t\tcheck(property.value, depth + 1)\n\t\t\t\t}\n\t\t\t\tparents.delete(item)\n\t\t\t}\n\t\t\tcheck(value, 0)\n\t\t\treturn stringify(value)\n\t\t}\n\t}.toString() + ')()'))\n\tconst decode = keep(vm.evalCode('(function () { const parse = JSON.parse; return function(value) { return parse(value); }; })()'))\n\tconst errorText = keep(vm.evalCode('(function () { const string = String; return function(error) { try { return typeof error.message === \"string\" ? error.message : string(error); } catch { return \"The program failed.\"; } }; })()'))\n\n\tfunction textValue(handle, maximum) {\n\t\tconst length = vm.getProp(handle, 'length')\n\t\ttry {\n\t\t\tif (vm.getNumber(length) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')\n\t\t} finally { length.dispose() }\n\t\tconst text = vm.getString(handle)\n\t\tif (Buffer.byteLength(text) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')\n\t\treturn text\n\t}\n\tfunction serialize(handle, maximum) {\n\t\tif (vm.typeof(handle) === 'undefined') return undefined\n\t\tconst encoded = vm.callFunction(encode, vm.undefined, handle)\n\t\tif (encoded.error) {\n\t\t\tencoded.error.dispose()\n\t\t\tthrow new Error('Code runtime values must be JSON-safe and serializable.')\n\t\t}\n\t\ttry { return textValue(encoded.value, maximum) }\n\t\tfinally { encoded.value.dispose() }\n\t}\n\tfunction failureText(handle) {\n\t\tconst result = vm.callFunction(errorText, vm.undefined, handle)\n\t\tif (result.error) { result.error.dispose(); return 'The program failed.' }\n\t\t// Diagnostics have their own fixed bound. A deliberately tiny data\n\t\t// allowance must not erase the reason or the no-replay guidance for an\n\t\t// effect that completed but whose return value could not be delivered.\n\t\ttry { return textValue(result.value, 4096) }\n\t\tcatch { return 'The program failed with an oversized error.' }\n\t\tfinally { result.value.dispose() }\n\t}\n\tfunction dispose() {\n\t\tfor (const deferred of pending.values()) deferred.dispose()\n\t\tpending.clear()\n\t\tif (program && program.alive) program.dispose()\n\t\tfor (const handle of owned) if (handle.alive) handle.dispose()\n\t\tvm.dispose()\n\t\truntime.dispose()\n\t}\n\tfunction finish(message) {\n\t\tif (ended) return\n\t\tended = true\n\t\t// A guest OOM can make QuickJS teardown throw. The worker still owns\n\t\t// the whole WASM module and is terminated by its parent on settlement.\n\t\ttry { dispose() } catch {}\n\t\tparentPort.postMessage(message)\n\t}\n\tfunction fail(error) {\n\t\tfinish(Date.now() >= workerData.deadline\n\t\t\t? { kind: 'timed-out' }\n\t\t\t: { kind: 'error', error: String(error && error.message || error).slice(0, 4096) })\n\t}\n\tfunction schedule() {\n\t\tif (ended || scheduled) return\n\t\tscheduled = true\n\t\tsetImmediate(() => { scheduled = false; pump() })\n\t}\n\tfunction pump() {\n\t\tif (ended || pumping) return\n\t\tpumping = true\n\t\ttry {\n\t\t\tconst jobs = runtime.executePendingJobs(32)\n\t\t\tif (jobs.error) {\n\t\t\t\tconst error = failureText(jobs.error)\n\t\t\t\tjobs.error.dispose()\n\t\t\t\tthrow new Error(error)\n\t\t\t}\n\t\t\tconst state = vm.getPromiseState(program)\n\t\t\tif (state.type === 'fulfilled') {\n\t\t\t\tlet json\n\t\t\t\ttry { json = serialize(state.value, limits.maxValueBytes) }\n\t\t\t\tfinally { state.value.dispose() }\n\t\t\t\tfinish({ kind: 'done', json })\n\t\t\t} else if (state.type === 'rejected') {\n\t\t\t\tlet error\n\t\t\t\ttry { error = failureText(state.error) }\n\t\t\t\tfinally { state.error.dispose() }\n\t\t\t\tfail(new Error(error))\n\t\t\t} else if (runtime.hasPendingJob()) schedule()\n\t\t} catch (error) { fail(error) }\n\t\tfinally { pumping = false }\n\t}\n\tfunction rejected(message) {\n\t\tconst deferred = vm.newPromise()\n\t\tconst error = vm.newError(message)\n\t\tdeferred.reject(error)\n\t\terror.dispose()\n\t\treturn deferred.handle\n\t}\n\tconst call = vm.newFunction('call', (name, input = vm.undefined) => {\n\t\ttry {\n\t\t\tif (nextId >= limits.maxHostCalls) return rejected('Code runtime host-call limit reached.')\n\t\t\tif (pending.size >= limits.maxPendingHostCalls) return rejected('Code runtime pending host-call limit reached.')\n\t\t\tif (vm.typeof(name) !== 'string') return rejected('A host call requires a tool name string.')\n\t\t\tconst tool = textValue(name, Math.min(limits.maxValueBytes, 1024))\n\t\t\tconst json = serialize(input, limits.maxValueBytes)\n\t\t\tconst id = ++nextId\n\t\t\tconst deferred = vm.newPromise()\n\t\t\tpending.set(id, deferred)\n\t\t\tparentPort.postMessage({ kind: 'call', id, name: tool, json })\n\t\t\treturn deferred.handle\n\t\t} catch (error) { return rejected(String(error.message || error)) }\n\t})\n\tvm.setProp(vm.global, 'call', call)\n\tcall.dispose()\n\tconst print = vm.newFunction('print', (...values) => {\n\t\tif (truncated) return vm.undefined\n\t\ttry {\n\t\t\tconst parts = []\n\t\t\tlet remaining = workerData.maxOutputBytes - printBytes - (printCount > 0 ? 1 : 0)\n\t\t\tfor (const value of values) {\n\t\t\t\tif (parts.length) remaining--\n\t\t\t\tif (remaining < 0) throw new Error('output limit')\n\t\t\t\tconst text = vm.typeof(value) === 'string' ? textValue(value, remaining) : serialize(value, remaining)\n\t\t\t\tconst part = text === undefined ? '' : text\n\t\t\t\tremaining -= Buffer.byteLength(part)\n\t\t\t\tparts.push(part)\n\t\t\t}\n\t\t\tconst line = parts.join(' ')\n\t\t\tconst size = Buffer.byteLength(line) + (printCount > 0 ? 1 : 0)\n\t\t\tif (printBytes + size > workerData.maxOutputBytes) throw new Error('output limit')\n\t\t\t// Empty prints consume a newline after the first, so the byte\n\t\t\t// budget also bounds the number of worker messages.\n\t\t\tprintBytes += size\n\t\t\tprintCount++\n\t\t\tparentPort.postMessage({ kind: 'print', line })\n\t\t} catch {\n\t\t\ttruncated = true\n\t\t\tparentPort.postMessage({ kind: 'truncated' })\n\t\t}\n\t\treturn vm.undefined\n\t})\n\tvm.setProp(vm.global, 'print', print)\n\tprint.dispose()\n\n\tparentPort.on('message', (message) => {\n\t\tif (ended || message.kind !== 'call-result') return\n\t\tconst deferred = pending.get(message.id)\n\t\tif (!deferred) return\n\t\tpending.delete(message.id)\n\t\ttry {\n\t\t\tif (message.ok) {\n\t\t\t\tlet value = vm.undefined\n\t\t\t\tif (message.json !== undefined) {\n\t\t\t\t\tif (typeof message.json !== 'string' || Buffer.byteLength(message.json) > limits.maxValueBytes) throw new Error('Host result exceeds the value limit.')\n\t\t\t\t\tconst input = vm.newString(message.json)\n\t\t\t\t\ttry { value = vm.unwrapResult(vm.callFunction(decode, vm.undefined, input)) }\n\t\t\t\t\tfinally { input.dispose() }\n\t\t\t\t}\n\t\t\t\tdeferred.resolve(value)\n\t\t\t\tif (value !== vm.undefined) value.dispose()\n\t\t\t} else {\n\t\t\t\tconst error = vm.newError(String(message.error).slice(0, 4096))\n\t\t\t\tdeferred.reject(error)\n\t\t\t\terror.dispose()\n\t\t\t}\n\t\t\tdeferred.dispose()\n\t\t\tschedule()\n\t\t} catch (error) { deferred.dispose(); fail(error) }\n\t})\n\ttry {\n\t\tconst result = vm.evalCode('(async () => {\\n' + workerData.source + '\\n})()', 'model-program.js')\n\t\tif (result.error) {\n\t\t\tconst error = failureText(result.error)\n\t\t\tresult.error.dispose()\n\t\t\tfail(new Error(error))\n\t\t} else { program = result.value; pump() }\n\t} catch (error) { fail(error) }\n}\nmain().catch((error) => parentPort.postMessage({ kind: 'error', error: String(error && error.message || error).slice(0, 4096) }))\n";
+//# sourceMappingURL=worker-program.d.ts.map

package/dist/execution/code-runtime/worker-program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-program.d.ts","sourceRoot":"","sources":["../../../src/execution/code-runtime/worker-program.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,8qTAwOjC,CAAA"}

package/dist/execution/code-runtime/worker-program.js

@@ -0,0 +1,240 @@
+/**
+ * Trusted worker bootstrap. Only vm.evalCode executes the untrusted program.
+ * Kept as source so installed/bundled SDKs need no separate worker entry file.
+ * No Node object or callback is injected into QuickJS: its native functions
+ * exchange bounded strings and interpreter-owned promise handles.
+ */
+export const QUICKJS_WORKER_SOURCE = `
+const { parentPort, workerData } = require('node:worker_threads')
+const { newQuickJSWASMModuleFromVariant, newVariant } = require(workerData.corePath)
+const variantModule = require(workerData.variantPath)
+const variant = variantModule.default || variantModule
+
+async function main() {
+	const limits = workerData.limits
+	const pages = Math.floor(limits.memoryLimitBytes / 65536)
+	const wasmMemory = new WebAssembly.Memory({ initial: Math.min(256, pages), maximum: pages })
+	const module = await newQuickJSWASMModuleFromVariant(newVariant(variant, { wasmMemory }))
+	const runtime = module.newRuntime()
+	runtime.setMemoryLimit(limits.memoryLimitBytes)
+	runtime.setMaxStackSize(512 * 1024)
+	runtime.setInterruptHandler(() => Date.now() >= workerData.deadline)
+	const vm = runtime.newContext()
+	const pending = new Map()
+	let nextId = 0
+	let printBytes = 0
+	let printCount = 0
+	let truncated = false
+	let ended = false
+	let pumping = false
+	let scheduled = false
+	let program
+	const owned = []
+
+	function keep(result) {
+		const handle = vm.unwrapResult(result)
+		owned.push(handle)
+		return handle
+	}
+	// Capture intrinsics before the program may replace its own globals.
+	const encode = keep(vm.evalCode('(' + function () {
+		const stringify = JSON.stringify
+		const finite = Number.isFinite
+		const prototype = Object.getPrototypeOf
+		const plain = Object.prototype
+		const isArray = Array.isArray
+		const keys = Object.keys
+		const descriptor = Object.getOwnPropertyDescriptor
+		return function (value) {
+			if (value === undefined) return undefined
+			const parents = new Set()
+			function check(item, depth) {
+				const kind = typeof item
+				if (item === null || kind === 'string' || kind === 'boolean' || (kind === 'number' && finite(item))) return
+				if (kind !== 'object' || depth > 64 || parents.has(item)) throw new Error('Code runtime values must be JSON-safe.')
+				if (!isArray(item) && prototype(item) !== plain && prototype(item) !== null) throw new Error('Code runtime values must use plain objects and arrays.')
+				parents.add(item)
+				for (const key of keys(item)) {
+					const property = descriptor(item, key)
+					if (!property || !('value' in property)) throw new Error('Code runtime values must not contain accessors.')
+					check(property.value, depth + 1)
+				}
+				parents.delete(item)
+			}
+			check(value, 0)
+			return stringify(value)
+		}
+	}.toString() + ')()'))
+	const decode = keep(vm.evalCode('(function () { const parse = JSON.parse; return function(value) { return parse(value); }; })()'))
+	const errorText = keep(vm.evalCode('(function () { const string = String; return function(error) { try { return typeof error.message === "string" ? error.message : string(error); } catch { return "The program failed."; } }; })()'))
+
+	function textValue(handle, maximum) {
+		const length = vm.getProp(handle, 'length')
+		try {
+			if (vm.getNumber(length) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')
+		} finally { length.dispose() }
+		const text = vm.getString(handle)
+		if (Buffer.byteLength(text) > maximum) throw new Error('Code runtime value exceeds ' + maximum + ' bytes.')
+		return text
+	}
+	function serialize(handle, maximum) {
+		if (vm.typeof(handle) === 'undefined') return undefined
+		const encoded = vm.callFunction(encode, vm.undefined, handle)
+		if (encoded.error) {
+			encoded.error.dispose()
+			throw new Error('Code runtime values must be JSON-safe and serializable.')
+		}
+		try { return textValue(encoded.value, maximum) }
+		finally { encoded.value.dispose() }
+	}
+	function failureText(handle) {
+		const result = vm.callFunction(errorText, vm.undefined, handle)
+		if (result.error) { result.error.dispose(); return 'The program failed.' }
+		// Diagnostics have their own fixed bound. A deliberately tiny data
+		// allowance must not erase the reason or the no-replay guidance for an
+		// effect that completed but whose return value could not be delivered.
+		try { return textValue(result.value, 4096) }
+		catch { return 'The program failed with an oversized error.' }
+		finally { result.value.dispose() }
+	}
+	function dispose() {
+		for (const deferred of pending.values()) deferred.dispose()
+		pending.clear()
+		if (program && program.alive) program.dispose()
+		for (const handle of owned) if (handle.alive) handle.dispose()
+		vm.dispose()
+		runtime.dispose()
+	}
+	function finish(message) {
+		if (ended) return
+		ended = true
+		// A guest OOM can make QuickJS teardown throw. The worker still owns
+		// the whole WASM module and is terminated by its parent on settlement.
+		try { dispose() } catch {}
+		parentPort.postMessage(message)
+	}
+	function fail(error) {
+		finish(Date.now() >= workerData.deadline
+			? { kind: 'timed-out' }
+			: { kind: 'error', error: String(error && error.message || error).slice(0, 4096) })
+	}
+	function schedule() {
+		if (ended || scheduled) return
+		scheduled = true
+		setImmediate(() => { scheduled = false; pump() })
+	}
+	function pump() {
+		if (ended || pumping) return
+		pumping = true
+		try {
+			const jobs = runtime.executePendingJobs(32)
+			if (jobs.error) {
+				const error = failureText(jobs.error)
+				jobs.error.dispose()
+				throw new Error(error)
+			}
+			const state = vm.getPromiseState(program)
+			if (state.type === 'fulfilled') {
+				let json
+				try { json = serialize(state.value, limits.maxValueBytes) }
+				finally { state.value.dispose() }
+				finish({ kind: 'done', json })
+			} else if (state.type === 'rejected') {
+				let error
+				try { error = failureText(state.error) }
+				finally { state.error.dispose() }
+				fail(new Error(error))
+			} else if (runtime.hasPendingJob()) schedule()
+		} catch (error) { fail(error) }
+		finally { pumping = false }
+	}
+	function rejected(message) {
+		const deferred = vm.newPromise()
+		const error = vm.newError(message)
+		deferred.reject(error)
+		error.dispose()
+		return deferred.handle
+	}
+	const call = vm.newFunction('call', (name, input = vm.undefined) => {
+		try {
+			if (nextId >= limits.maxHostCalls) return rejected('Code runtime host-call limit reached.')
+			if (pending.size >= limits.maxPendingHostCalls) return rejected('Code runtime pending host-call limit reached.')
+			if (vm.typeof(name) !== 'string') return rejected('A host call requires a tool name string.')
+			const tool = textValue(name, Math.min(limits.maxValueBytes, 1024))
+			const json = serialize(input, limits.maxValueBytes)
+			const id = ++nextId
+			const deferred = vm.newPromise()
+			pending.set(id, deferred)
+			parentPort.postMessage({ kind: 'call', id, name: tool, json })
+			return deferred.handle
+		} catch (error) { return rejected(String(error.message || error)) }
+	})
+	vm.setProp(vm.global, 'call', call)
+	call.dispose()
+	const print = vm.newFunction('print', (...values) => {
+		if (truncated) return vm.undefined
+		try {
+			const parts = []
+			let remaining = workerData.maxOutputBytes - printBytes - (printCount > 0 ? 1 : 0)
+			for (const value of values) {
+				if (parts.length) remaining--
+				if (remaining < 0) throw new Error('output limit')
+				const text = vm.typeof(value) === 'string' ? textValue(value, remaining) : serialize(value, remaining)
+				const part = text === undefined ? '' : text
+				remaining -= Buffer.byteLength(part)
+				parts.push(part)
+			}
+			const line = parts.join(' ')
+			const size = Buffer.byteLength(line) + (printCount > 0 ? 1 : 0)
+			if (printBytes + size > workerData.maxOutputBytes) throw new Error('output limit')
+			// Empty prints consume a newline after the first, so the byte
+			// budget also bounds the number of worker messages.
+			printBytes += size
+			printCount++
+			parentPort.postMessage({ kind: 'print', line })
+		} catch {
+			truncated = true
+			parentPort.postMessage({ kind: 'truncated' })
+		}
+		return vm.undefined
+	})
+	vm.setProp(vm.global, 'print', print)
+	print.dispose()
+
+	parentPort.on('message', (message) => {
+		if (ended || message.kind !== 'call-result') return
+		const deferred = pending.get(message.id)
+		if (!deferred) return
+		pending.delete(message.id)
+		try {
+			if (message.ok) {
+				let value = vm.undefined
+				if (message.json !== undefined) {
+					if (typeof message.json !== 'string' || Buffer.byteLength(message.json) > limits.maxValueBytes) throw new Error('Host result exceeds the value limit.')
+					const input = vm.newString(message.json)
+					try { value = vm.unwrapResult(vm.callFunction(decode, vm.undefined, input)) }
+					finally { input.dispose() }
+				}
+				deferred.resolve(value)
+				if (value !== vm.undefined) value.dispose()
+			} else {
+				const error = vm.newError(String(message.error).slice(0, 4096))
+				deferred.reject(error)
+				error.dispose()
+			}
+			deferred.dispose()
+			schedule()
+		} catch (error) { deferred.dispose(); fail(error) }
+	})
+	try {
+		const result = vm.evalCode('(async () => {\\n' + workerData.source + '\\n})()', 'model-program.js')
+		if (result.error) {
+			const error = failureText(result.error)
+			result.error.dispose()
+			fail(new Error(error))
+		} else { program = result.value; pump() }
+	} catch (error) { fail(error) }
+}
+main().catch((error) => parentPort.postMessage({ kind: 'error', error: String(error && error.message || error).slice(0, 4096) }))
+`;
+//# sourceMappingURL=worker-program.js.map

package/dist/execution/code-runtime/worker-program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-program.js","sourceRoot":"","sources":["../../../src/execution/code-runtime/worker-program.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwOpC,CAAA"}

package/dist/execution/code-runtime/worker.d.ts

@@ -1,6 +1,28 @@
 import { type CodeRunResult, type CodeRuntime, type RunCodeOptions } from './types.js';
+/** Resource policy for one fresh QuickJS worker execution. */
+export interface WorkerCodeRuntimeOptions {
+    /** QuickJS allocator limit, also the WASM linear-memory ceiling. Does not bound total Node/process memory. Default: 64 MiB. */
+    readonly memoryLimitBytes?: number;
+    /** Maximum UTF-8 program source size. Default: 256 KiB. */
+    readonly maxSourceBytes?: number;
+    /** Maximum UTF-8 JSON size of each input, host result, and program return. Default: 1 MiB. */
+    readonly maxValueBytes?: number;
+    /** Maximum host calls admitted by one program, including refusals. Default: 100. */
+    readonly maxHostCalls?: number;
+    /** Maximum host calls awaiting replies simultaneously. Default: 100. */
+    readonly maxPendingHostCalls?: number;
+}
+/**
+ * Runs untrusted JavaScript in a QuickJS interpreter inside a worker thread.
+ * QuickJS owns the guest globals, functions, and promises. Node capabilities
+ * never enter that realm; constructors and dynamic imports cannot recover them.
+ * A fresh interpreter and bounded imported WASM memory are created per run.
+ * The worker makes wall-clock cancellation independent of interpreter progress.
+ */
 export declare class WorkerCodeRuntime implements CodeRuntime {
     readonly id = "worker_threads";
+    private readonly limits;
+    constructor(options?: WorkerCodeRuntimeOptions);
     run(options: RunCodeOptions): Promise<CodeRunResult>;
 }
 //# sourceMappingURL=worker.d.ts.map

package/dist/execution/code-runtime/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/execution/code-runtime/worker.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,cAAc,EACnB,MAAM,YAAY,CAAA;AA2FnB,qBAAa,iBAAkB,YAAW,WAAW;IACpD,QAAQ,CAAC,EAAE,oBAAmB;IAExB,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAmO1D"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/execution/code-runtime/worker.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,cAAc,EACnB,MAAM,YAAY,CAAA;AAKnB,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACxC,+HAA+H;IAC/H,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAgCD;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IACpD,QAAQ,CAAC,EAAE,oBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,OAAO,GAAE,wBAA6B;IAI5C,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAoT1D"}