@nodetool-ai/agents 0.7.0-rc.23 → 0.8.2

package/dist/wasm-sandbox/host.js

@@ -0,0 +1,409 @@
+/**
+ * The host side of sandbox WASM modules: compile once, run on a pooled worker,
+ * one fresh instance per call, under layered budgets.
+ *
+ * Three things live here, in widening scope:
+ *
+ * - a **module cache** keyed by content digest, process-wide. Compilation is
+ *   the expensive part and `WebAssembly.Module` is structured-cloneable, so one
+ *   compile serves every call in every invocation, on any worker.
+ * - a **worker pool**, process-wide, four workers by default. A call that
+ *   overruns its per-call timeout terminates its worker and the pool creates a
+ *   replacement. That is safe precisely because instances are per-call: the
+ *   killed thread owned nothing.
+ * - a **dispatcher**, one per run. It is the security boundary: it serves only
+ *   the WASM modules declared for that run, and validates module identity,
+ *   export allowlist, argument count, and argument type before any worker sees
+ *   the call. Guest code that gets hold of a dispatcher gains nothing beyond
+ *   the run's own declared surface.
+ *
+ * **Stateless by contract.** Each call instantiates fresh from the cached
+ * module, runs, and discards the instance. Mutable globals and linear memory
+ * do not carry from one call to the next — a pack that needs state across
+ * calls keeps it in guest JavaScript and passes scalars in.
+ */
+import { parseWasmBinary, SANDBOX_WASM_BUDGETS, WASM_VALUE_TYPE, wasmValueTypeName } from "@nodetool-ai/protocol";
+import { defaultWasmWorkerFactory } from "./workers.js";
+import { isNumber, isString } from "../utils/type-guards.js";
+const INT32_MIN = -2147483648;
+const INT32_MAX = 2147483647;
+/** Raised when a call breaks the scalar contract or exhausts a budget. */
+export class SandboxWasmError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SandboxWasmError";
+    }
+}
+// ---------------------------------------------------------------------------
+// Compile-once module cache
+// ---------------------------------------------------------------------------
+const moduleCache = new Map();
+/** Compile a module's bytes at most once per process, keyed by content digest. */
+export function compileSandboxWasm(contentDigest, bytes) {
+    const cached = moduleCache.get(contentDigest);
+    if (cached !== undefined)
+        return cached;
+    const buffer = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(buffer).set(bytes);
+    const compiled = WebAssembly.compile(buffer);
+    moduleCache.set(contentDigest, compiled);
+    // A compile that fails must not poison the cache for the next run.
+    void compiled.catch(() => moduleCache.delete(contentDigest));
+    return compiled;
+}
+/** Drop the compile cache. Tests only. */
+export function resetSandboxWasmModuleCache() {
+    moduleCache.clear();
+}
+/** The one error a cancelled run raises, wherever it is noticed. */
+function cancelled() {
+    return new SandboxWasmError("the run was cancelled");
+}
+/**
+ * Read the abort flag through a call.
+ *
+ * The point of these checks is that the answer changes across an await, which
+ * is exactly what narrowing an inline `signal.aborted` would deny.
+ */
+function isAborted(signal) {
+    return signal?.aborted === true;
+}
+/** A fixed set of workers shared by every invocation in the process. */
+export class WasmWorkerPool {
+    size;
+    factory;
+    idle = [];
+    waiting = [];
+    live = 0;
+    /** Workers terminated for overrunning a per-call timeout. Observable in tests. */
+    replacements = 0;
+    constructor(size = SANDBOX_WASM_BUDGETS.workerPoolSize, factory = defaultWasmWorkerFactory) {
+        this.size = size;
+        this.factory = factory;
+    }
+    async acquire() {
+        const idle = this.idle.pop();
+        if (idle !== undefined)
+            return idle;
+        if (this.live < this.size) {
+            this.live += 1;
+            try {
+                return { worker: await this.factory.create(), dead: false };
+            }
+            catch (error) {
+                this.live -= 1;
+                throw error;
+            }
+        }
+        const slot = await new Promise((resolve) => {
+            this.waiting.push(resolve);
+        });
+        if (slot !== undefined)
+            return slot;
+        this.live += 1;
+        try {
+            return { worker: await this.factory.create(), dead: false };
+        }
+        catch (error) {
+            this.live -= 1;
+            throw error;
+        }
+    }
+    release(slot) {
+        if (slot.dead) {
+            this.live -= 1;
+            const next = this.waiting.shift();
+            // Hand the vacancy on, not the corpse: the next waiter creates a
+            // replacement worker for the slot the killed one gave up.
+            if (next !== undefined)
+                next(undefined);
+            return;
+        }
+        const next = this.waiting.shift();
+        if (next !== undefined) {
+            next(slot);
+            return;
+        }
+        this.idle.push(slot);
+    }
+    /**
+     * Run one call, killing and replacing the worker if it overruns or is
+     * cancelled.
+     *
+     * Cancellation has to reach the worker, not just the caller. A guest export
+     * is a scalar function with no yield point, so abandoning the promise would
+     * leave the thread spinning for the whole timeout on work nobody wants —
+     * the same reason a timeout terminates rather than waits.
+     */
+    async run(module, exportName, args, timeoutMs, signal) {
+        if (isAborted(signal))
+            throw cancelled();
+        const slot = await this.acquire();
+        let timer;
+        let onAbort;
+        try {
+            if (isAborted(signal))
+                throw cancelled();
+            const cancellation = new Promise((_resolve, reject) => {
+                if (signal === undefined)
+                    return;
+                onAbort = () => {
+                    slot.dead = true;
+                    // Reject before terminating, for the reason the timeout does: the
+                    // worker's own rejection would otherwise win the race and report a
+                    // generic message instead of the cancellation.
+                    reject(cancelled());
+                    slot.worker.terminate();
+                };
+                signal.addEventListener("abort", onAbort, { once: true });
+            });
+            const timeout = new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    slot.dead = true;
+                    this.replacements += 1;
+                    // Reject before terminating: a terminated worker rejects its own
+                    // pending call, and the race would then report the worker's generic
+                    // message instead of the budget this call actually broke.
+                    reject(new SandboxWasmError(`WASM call ${exportName} exceeded its ${timeoutMs} ms per-call timeout; the worker was terminated and replaced`));
+                    slot.worker.terminate();
+                }, timeoutMs);
+            });
+            const result = await Promise.race([
+                slot.worker.call({ module, exportName, args }),
+                timeout,
+                cancellation
+            ]);
+            return result.value;
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            if (onAbort !== undefined)
+                signal?.removeEventListener("abort", onAbort);
+            this.release(slot);
+        }
+    }
+    /** Destroy every worker. Tests and host shutdown. */
+    dispose() {
+        for (const slot of this.idle)
+            slot.worker.terminate();
+        this.idle.length = 0;
+        this.live = 0;
+        for (const waiter of this.waiting.splice(0))
+            waiter(undefined);
+    }
+}
+let sharedPool;
+/** The process-wide pool every run shares. */
+export function sandboxWasmWorkerPool() {
+    sharedPool ??= new WasmWorkerPool();
+    return sharedPool;
+}
+/** Destroy the process-wide pool. Tests only. */
+export function resetSandboxWasmWorkerPool() {
+    sharedPool?.dispose();
+    sharedPool = undefined;
+}
+function lowered(key, modules) {
+    const ceiling = SANDBOX_WASM_BUDGETS[key];
+    let value = ceiling;
+    for (const module of modules) {
+        if (module.kind !== "wasm")
+            continue;
+        const asked = module.wasm.limits?.[key];
+        if (asked !== undefined && asked < value)
+            value = asked;
+    }
+    return value;
+}
+/**
+ * Build the dispatcher for one invocation, or `undefined` when the run
+ * declares no WASM modules.
+ *
+ * Per-invocation budgets are the lowest any declared module asks for: a
+ * manifest lowers a bound for everything in the run it takes part in, because
+ * the bound is on the invocation, not on the module.
+ */
+export function createSandboxWasmDispatcher(modules, options = {}) {
+    const wasmModules = modules.filter((module) => module.kind === "wasm");
+    if (wasmModules.length === 0)
+        return undefined;
+    const pool = options.pool ?? sandboxWasmWorkerPool();
+    const byKey = new Map();
+    for (const module of wasmModules) {
+        const binary = parseWasmBinary(module.bytes);
+        const exports = new Map();
+        for (const exported of module.wasm.exports) {
+            const entry = binary.exports.get(exported.wasm);
+            const signature = entry === undefined ? undefined : binary.functions[entry.index];
+            if (signature === undefined) {
+                throw new SandboxWasmError(`${module.specifier}: export ${exported.wasm} has no signature in the binary`);
+            }
+            exports.set(exported.as, { wasmName: exported.wasm, signature });
+        }
+        byKey.set(module.specifier, {
+            specifier: module.specifier,
+            contentDigest: module.contentDigest,
+            bytes: module.bytes,
+            contract: module.wasm,
+            exports,
+            callTimeoutMs: module.wasm.limits?.callTimeoutMs ?? SANDBOX_WASM_BUDGETS.callTimeoutMs
+        });
+    }
+    const budgets = {
+        callConcurrency: lowered("callConcurrency", wasmModules),
+        callsPerInvocation: lowered("callsPerInvocation", wasmModules),
+        wallClockMs: lowered("wallClockMs", wasmModules)
+    };
+    let callsUsed = 0;
+    let wallClockUsed = 0;
+    let inFlight = 0;
+    let peakConcurrency = 0;
+    const queue = [];
+    const enter = async () => {
+        if (inFlight >= budgets.callConcurrency) {
+            await new Promise((resolve) => queue.push(resolve));
+        }
+        inFlight += 1;
+        if (inFlight > peakConcurrency)
+            peakConcurrency = inFlight;
+    };
+    const leave = () => {
+        inFlight -= 1;
+        queue.shift()?.();
+    };
+    return {
+        specifiers: wasmModules.map((module) => module.specifier),
+        budgets,
+        get peakConcurrency() {
+            return peakConcurrency;
+        },
+        async call(moduleKey, exportName, args) {
+            const signal = options.signal;
+            if (isAborted(signal))
+                throw cancelled();
+            const runModule = isString(moduleKey) ? byKey.get(moduleKey) : undefined;
+            if (runModule === undefined) {
+                throw new SandboxWasmError(`${describe(moduleKey)} is not a WASM sandbox module this run serves`);
+            }
+            const exported = isString(exportName) ? runModule.exports.get(exportName) : undefined;
+            if (exported === undefined) {
+                throw new SandboxWasmError(`${runModule.specifier} has no export named ${describe(exportName)}`);
+            }
+            const converted = convertArguments(runModule.specifier, exportName, exported.signature, args);
+            if (callsUsed >= budgets.callsPerInvocation) {
+                throw new SandboxWasmError(`${runModule.specifier}: this node exhausted its budget of ${budgets.callsPerInvocation} WASM calls per invocation`);
+            }
+            callsUsed += 1;
+            const compiled = await compileSandboxWasm(runModule.contentDigest, runModule.bytes);
+            // Every await between the entry check and the dispatch is rechecked:
+            // compiling a large module and queueing behind a busy slot both take
+            // long enough for the run to be cancelled underneath them. The queue
+            // needs no cancellation of its own — the calls holding the slots share
+            // this signal, so their own aborts release them and this one is turned
+            // away as soon as it is admitted.
+            if (isAborted(signal))
+                throw cancelled();
+            await enter();
+            if (isAborted(signal)) {
+                leave();
+                throw cancelled();
+            }
+            // The wall clock is *reserved* here, not merely read: charging only on
+            // completion let every concurrently admitted call see the whole
+            // remainder, so two calls under the default concurrency of 2 could each
+            // be handed a 30 s budget and spend 60 s of worker time between them.
+            // Read and reserve sit in one synchronous run of this function — no
+            // await between them — so a second call admitted meanwhile can only ever
+            // see what is left after this one took its share.
+            const remainingWallClock = budgets.wallClockMs - wallClockUsed;
+            if (remainingWallClock <= 0) {
+                leave();
+                throw new SandboxWasmError(`${runModule.specifier}: this node exhausted its budget of ${budgets.wallClockMs} ms of WASM wall clock per invocation`);
+            }
+            const reserved = Math.min(runModule.callTimeoutMs, remainingWallClock);
+            wallClockUsed += reserved;
+            const startedAt = Date.now();
+            let cutAtTimeout = false;
+            try {
+                // The effective timeout is the reservation, so the call cannot outrun
+                // what it was actually admitted for.
+                return await pool.run(compiled, exported.wasmName, converted, reserved, signal);
+            }
+            catch (error) {
+                cutAtTimeout =
+                    error instanceof SandboxWasmError &&
+                        error.message.includes("per-call timeout");
+                throw error;
+            }
+            finally {
+                // Replace the reservation with what the call really cost: a fast call
+                // refunds the difference. A call cut at its timeout keeps at least its
+                // full reservation — the kill can be measured a millisecond early, and
+                // refunding that sliver admits a next call the budget says is refused.
+                const elapsed = Date.now() - startedAt;
+                wallClockUsed +=
+                    (cutAtTimeout ? Math.max(elapsed, reserved) : elapsed) - reserved;
+                leave();
+            }
+        }
+    };
+}
+function describe(value) {
+    if (isString(value))
+        return JSON.stringify(value);
+    return `a ${value === null ? "null" : typeof value} value`;
+}
+/**
+ * Validate and convert one call's arguments host-side.
+ *
+ * Never left to WebAssembly's implicit coercion, so Node and the browser
+ * answer the same: an `i32` must be a finite integer inside int32 range and
+ * out-of-range rejects rather than wrapping, while `f32`/`f64` take any JS
+ * number — `NaN` and infinities included — and `f32` rounds by WebAssembly's
+ * own rules inside the call.
+ */
+export function convertArguments(specifier, exportName, signature, args) {
+    if (!Array.isArray(args)) {
+        throw new SandboxWasmError(`${specifier}: ${exportName} was called with a non-list argument`);
+    }
+    if (args.length !== signature.parameters.length) {
+        throw new SandboxWasmError(`${specifier}: ${exportName} takes ${signature.parameters.length} argument${signature.parameters.length === 1 ? "" : "s"}, received ${args.length}`);
+    }
+    return signature.parameters.map((type, position) => convertArgument(specifier, exportName, type, position, args[position]));
+}
+function convertArgument(specifier, exportName, type, position, value) {
+    const where = `${specifier}: ${exportName} argument ${position} expects ${wasmValueTypeName(type)}`;
+    if (!isNumber(value)) {
+        throw new SandboxWasmError(`${where}, received ${describeValue(value)}`);
+    }
+    if (type === WASM_VALUE_TYPE.F32 || type === WASM_VALUE_TYPE.F64)
+        return value;
+    if (type !== WASM_VALUE_TYPE.I32) {
+        throw new SandboxWasmError(`${specifier}: ${exportName} argument ${position} uses ${wasmValueTypeName(type)}, which the scalar contract does not carry`);
+    }
+    if (!Number.isFinite(value) || !Number.isInteger(value)) {
+        throw new SandboxWasmError(`${where}, received ${describeValue(value)}`);
+    }
+    if (value < INT32_MIN || value > INT32_MAX) {
+        throw new SandboxWasmError(`${where} in the range ${INT32_MIN}…${INT32_MAX}, received ${value}`);
+    }
+    return value;
+}
+function describeValue(value) {
+    if (typeof value === "bigint")
+        return `the bigint ${value}`;
+    if (isNumber(value)) {
+        if (Number.isNaN(value))
+            return "NaN";
+        if (!Number.isFinite(value))
+            return String(value);
+        return `the non-integer ${value}`;
+    }
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "an array";
+    return `a ${typeof value} value`;
+}
+//# sourceMappingURL=host.js.map

package/dist/wasm-sandbox/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/wasm-sandbox/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EAKlB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wBAAwB,EAGzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC;AAC9B,MAAM,SAAS,GAAG,UAAU,CAAC;AAE7B,0EAA0E;AAC1E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEnE,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,KAAiB;IAEjB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzC,mEAAmE;IACnE,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,2BAA2B;IACzC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAYD,oEAAoE;AACpE,SAAS,SAAS;IAChB,OAAO,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,MAA+B;IAChD,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,OAAO,cAAc;IAQN,IAAI;IACJ,OAAO;IART,IAAI,GAAmB,EAAE,CAAC;IAC1B,OAAO,GAAiD,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,CAAC;IACjB,kFAAkF;IAClF,YAAY,GAAG,CAAC,CAAC;IAEjB,YACmB,IAAI,GAAW,oBAAoB,CAAC,cAAc,EAClD,OAAO,GAAsB,wBAAwB;oBADrD,IAAI;uBACJ,OAAO;IACvB,CAAC;IAEI,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAA2B,CAAC,OAAO,EAAE,EAAE;YACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAkB;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,iEAAiE;YACjE,0DAA0D;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,MAA0B,EAC1B,UAAkB,EAClB,IAAuB,EACvB,SAAiB,EACjB,MAAoB;QAEpB,IAAI,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,KAAgD,CAAC;QACrD,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAC3D,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO;gBACjC,OAAO,GAAG,GAAG,EAAE;oBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,kEAAkE;oBAClE,mEAAmE;oBACnE,+CAA+C;oBAC/C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1B,CAAC,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;oBACvB,iEAAiE;oBACjE,oEAAoE;oBACpE,0DAA0D;oBAC1D,MAAM,CACJ,IAAI,gBAAgB,CAClB,aAAa,UAAU,iBAAiB,SAAS,8DAA8D,CAChH,CACF,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBAC9C,OAAO;gBACP,YAAY;aACb,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,OAAO;QACL,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAED,IAAI,UAAsC,CAAC;AAE3C,8CAA8C;AAC9C,MAAM,UAAU,qBAAqB;IACnC,UAAU,KAAK,IAAI,cAAc,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,0BAA0B;IACxC,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC;AAqCD,SAAS,OAAO,CACd,GAA4B,EAC5B,OAAyC;IAEzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAW,OAAO,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK;YAAE,KAAK,GAAG,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAyC,EACzC,OAAO,GAAoD,EAAE;IAE7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAChC,CAAC,MAAM,EAA8D,EAAE,CACrE,MAAM,CAAC,IAAI,KAAK,MAAM,CACzB,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,qBAAqB,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0D,CAAC;QAClF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CACxB,GAAG,MAAM,CAAC,SAAS,YAAY,QAAQ,CAAC,IAAI,iCAAiC,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,OAAO;YACP,aAAa,EACX,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,oBAAoB,CAAC,aAAa;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAuB;QAClC,eAAe,EAAE,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC;QACxD,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC9D,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;KACjD,CAAC;IAEF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,eAAe;YAAE,eAAe,GAAG,QAAQ,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,QAAQ,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,OAAO;QACP,IAAI,eAAe;YACjB,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CACxB,GAAG,QAAQ,CAAC,SAAS,CAAC,+CAA+C,CACtE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,CAAC,SAAS,wBAAwB,QAAQ,CAAC,UAAU,CAAC,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,SAAS,EACnB,UAAoB,EACpB,QAAQ,CAAC,SAAS,EAClB,IAAI,CACL,CAAC;YAEF,IAAI,SAAS,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,CAAC,SAAS,uCAAuC,OAAO,CAAC,kBAAkB,4BAA4B,CACpH,CAAC;YACJ,CAAC;YACD,SAAS,IAAI,CAAC,CAAC;YAEf,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACpF,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,kCAAkC;YAClC,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACzC,MAAM,KAAK,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,KAAK,EAAE,CAAC;gBACR,MAAM,SAAS,EAAE,CAAC;YACpB,CAAC;YAED,uEAAuE;YACvE,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,oEAAoE;YACpE,yEAAyE;YACzE,kDAAkD;YAClD,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC;YAC/D,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;gBAC5B,KAAK,EAAE,CAAC;gBACR,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,CAAC,SAAS,uCAAuC,OAAO,CAAC,WAAW,uCAAuC,CACxH,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACvE,aAAa,IAAI,QAAQ,CAAC;YAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC;gBACH,sEAAsE;gBACtE,qCAAqC;gBACrC,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY;oBACV,KAAK,YAAY,gBAAgB;wBACjC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACvC,aAAa;oBACX,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;gBACpE,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAAkB,EAClB,SAAwB,EACxB,IAAa;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,KAAK,UAAU,sCAAsC,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,KAAK,UAAU,UAAU,SAAS,CAAC,UAAU,CAAC,MAAM,YAAY,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,CAAC,MAAM,EAAE,CACpJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CACjD,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,UAAkB,EAClB,IAAY,EACZ,QAAgB,EAChB,KAAc;IAEd,MAAM,KAAK,GAAG,GAAG,SAAS,KAAK,UAAU,aAAa,QAAQ,YAAY,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;IACpG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,GAAG,IAAI,IAAI,KAAK,eAAe,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,KAAK,UAAU,aAAa,QAAQ,SAAS,iBAAiB,CAAC,IAAI,CAAC,4CAA4C,CAC7H,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,GAAG,SAAS,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,iBAAiB,SAAS,IAAI,SAAS,cAAc,KAAK,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,KAAK,EAAE,CAAC;IAC5D,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,mBAAmB,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,OAAO,KAAK,OAAO,KAAK,QAAQ,CAAC;AACnC,CAAC"}

package/dist/wasm-sandbox/workers.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The platform seam for running one WASM call off the host thread.
+ *
+ * A call has to be killable: the scalar contract lets a pack export an
+ * infinite loop, and nothing short of destroying the thread stops one. Node
+ * gets `worker_threads`, a browser gets a Web Worker, and the rest of the host
+ * (`./host.ts`) knows neither — it asks a {@link WasmWorkerFactory} for a
+ * worker and terminates it when a call overruns.
+ *
+ * Both workers are created from an inline source string rather than a file
+ * URL. A separate entry file would have to survive `tsx`, vitest, the compiled
+ * `dist/`, and the esbuild backend bundle, each of which resolves it
+ * differently; the source is eleven lines, so it travels with the caller
+ * instead.
+ *
+ * `WebAssembly.Module` is structured-cloneable, so the compiled module crosses
+ * to the worker without being recompiled there.
+ */
+export interface WasmCallRequest {
+    readonly module: WebAssembly.Module;
+    readonly exportName: string;
+    readonly args: readonly number[];
+}
+/** One worker, serving one call at a time. */
+export interface WasmCallWorker {
+    /** Instantiate fresh, call, discard. Rejects if the guest export throws. */
+    call(request: WasmCallRequest): Promise<{
+        value: number | undefined;
+    }>;
+    /** Destroy the thread. Any in-flight call rejects. */
+    terminate(): void;
+}
+export interface WasmWorkerFactory {
+    create(): Promise<WasmCallWorker>;
+}
+/**
+ * The factory for the current runtime.
+ *
+ * Node is preferred when both look available, because an Electron renderer has
+ * both and `worker_threads` is the path the rest of the host is exercised on.
+ */
+export declare const defaultWasmWorkerFactory: WasmWorkerFactory;
+//# sourceMappingURL=workers.d.ts.map

package/dist/wasm-sandbox/workers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../../src/wasm-sandbox/workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACvE,sDAAsD;IACtD,SAAS,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAqJD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAOtC,CAAC"}

package/dist/wasm-sandbox/workers.js

@@ -0,0 +1,150 @@
+/**
+ * The platform seam for running one WASM call off the host thread.
+ *
+ * A call has to be killable: the scalar contract lets a pack export an
+ * infinite loop, and nothing short of destroying the thread stops one. Node
+ * gets `worker_threads`, a browser gets a Web Worker, and the rest of the host
+ * (`./host.ts`) knows neither — it asks a {@link WasmWorkerFactory} for a
+ * worker and terminates it when a call overruns.
+ *
+ * Both workers are created from an inline source string rather than a file
+ * URL. A separate entry file would have to survive `tsx`, vitest, the compiled
+ * `dist/`, and the esbuild backend bundle, each of which resolves it
+ * differently; the source is eleven lines, so it travels with the caller
+ * instead.
+ *
+ * `WebAssembly.Module` is structured-cloneable, so the compiled module crosses
+ * to the worker without being recompiled there.
+ */
+import { importNodeBuiltin } from "@nodetool-ai/config";
+import { isString } from "../utils/type-guards.js";
+/**
+ * The worker body, as an expression over `receive` and `send`.
+ *
+ * A fresh `WebAssembly.Instance` per message is the instance-per-call rule:
+ * mutable globals and linear memory start at their declared initial values
+ * every time, and a terminated worker therefore destroys nothing the
+ * invocation owned.
+ */
+const WORKER_BODY = `function (receive, send) {
+  receive(function (message) {
+    try {
+      var instance = new WebAssembly.Instance(message.module, {});
+      var exported = instance.exports[message.exportName];
+      if (typeof exported !== "function") {
+        send({ id: message.id, error: "WASM export " + message.exportName + " is not callable" });
+        return;
+      }
+      var value = exported.apply(null, message.args);
+      send({ id: message.id, value: value === undefined ? null : value });
+    } catch (error) {
+      send({ id: message.id, error: (error && error.message) ? String(error.message) : String(error) });
+    }
+  });
+}`;
+const NODE_WORKER_SOURCE = `const { parentPort } = require("node:worker_threads");
+(${WORKER_BODY})(
+  (handler) => parentPort.on("message", handler),
+  (reply) => parentPort.postMessage(reply)
+);
+`;
+const BROWSER_WORKER_SOURCE = `(${WORKER_BODY})(
+  (handler) => { self.onmessage = (event) => handler(event.data); },
+  (reply) => self.postMessage(reply)
+);
+`;
+/** Shared plumbing: one outstanding call, correlated by id, settled once. */
+class ChannelWorker {
+    post;
+    kill;
+    pending;
+    nextId = 0;
+    dead = false;
+    constructor(post, kill) {
+        this.post = post;
+        this.kill = kill;
+    }
+    receive(reply) {
+        const pending = this.pending;
+        if (pending === undefined)
+            return;
+        this.pending = undefined;
+        if (isString(reply.error)) {
+            pending.reject(new Error(reply.error));
+            return;
+        }
+        pending.resolve({ value: reply.value === null ? undefined : reply.value });
+    }
+    fail(error) {
+        const pending = this.pending;
+        this.pending = undefined;
+        pending?.reject(error);
+    }
+    call(request) {
+        if (this.dead)
+            return Promise.reject(new Error("the WASM worker was terminated"));
+        if (this.pending !== undefined) {
+            return Promise.reject(new Error("the WASM worker is already running a call"));
+        }
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending = { resolve, reject };
+            this.post({
+                id,
+                module: request.module,
+                exportName: request.exportName,
+                args: [...request.args]
+            });
+        });
+    }
+    terminate() {
+        if (this.dead)
+            return;
+        this.dead = true;
+        this.kill();
+        this.fail(new Error("the WASM call exceeded its per-call timeout"));
+    }
+}
+async function createNodeWorker() {
+    const threads = await importNodeBuiltin("node:worker_threads");
+    if (threads === null) {
+        throw new Error("node:worker_threads is unavailable, so WASM sandbox modules cannot run");
+    }
+    const worker = new threads.Worker(NODE_WORKER_SOURCE, { eval: true });
+    const channel = new ChannelWorker((message) => worker.postMessage(message), () => void worker.terminate());
+    worker.on("message", (reply) => channel.receive(reply));
+    worker.on("error", (error) => channel.fail(error));
+    // A pooled worker must never hold the process open on its own — and this has
+    // to come *after* the listeners above, which re-ref the worker's public port.
+    worker.unref();
+    return channel;
+}
+async function createBrowserWorker() {
+    const url = URL.createObjectURL(new Blob([BROWSER_WORKER_SOURCE], { type: "text/javascript" }));
+    const worker = new Worker(url);
+    const channel = new ChannelWorker((message) => worker.postMessage(message), () => {
+        worker.terminate();
+        URL.revokeObjectURL(url);
+    });
+    worker.onmessage = (event) => channel.receive(event.data);
+    worker.onerror = (event) => channel.fail(new Error(event.message || "the WASM worker failed"));
+    return channel;
+}
+const hasWebWorkers = () => typeof Worker !== "undefined" && typeof Blob !== "undefined" && typeof URL !== "undefined";
+/**
+ * The factory for the current runtime.
+ *
+ * Node is preferred when both look available, because an Electron renderer has
+ * both and `worker_threads` is the path the rest of the host is exercised on.
+ */
+export const defaultWasmWorkerFactory = {
+    async create() {
+        const threads = await importNodeBuiltin("node:worker_threads");
+        if (threads !== null)
+            return createNodeWorker();
+        if (hasWebWorkers())
+            return createBrowserWorker();
+        throw new Error("this runtime has no worker implementation, so WASM sandbox modules cannot run");
+    }
+};
+//# sourceMappingURL=workers.js.map

package/dist/wasm-sandbox/workers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.js","sourceRoot":"","sources":["../../src/wasm-sandbox/workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAoBnD;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;EAelB,CAAC;AAEH,MAAM,kBAAkB,GAAG;GACxB,WAAW;;;;CAIb,CAAC;AAEF,MAAM,qBAAqB,GAAG,IAAI,WAAW;;;;CAI5C,CAAC;AAOF,6EAA6E;AAC7E,MAAM,aAAa;IAME,IAAI;IACJ,IAAI;IANf,OAAO,CAAsB;IAC7B,MAAM,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,KAAK,CAAC;IAErB,YACmB,IAAoD,EACpD,IAAgB;oBADhB,IAAI;oBACJ,IAAI;IACpB,CAAC;IAEJ,OAAO,CAAC,KAA4D;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,KAAY;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,OAAwB;QAC3B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE;gBACF,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACtE,CAAC;CACF;AAWD,KAAK,UAAU,gBAAgB;IAC7B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAoB,qBAAqB,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EACxC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAC9B,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAA4D,EAAE,EAAE,CACpF,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CACvB,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAC7B,IAAI,IAAI,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAC/D,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EACxC,GAAG,EAAE;QACH,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CACF,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE,CACzC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAA6D,CAAC,CAAC;IACvF,MAAM,CAAC,OAAO,GAAG,CAAC,KAAiB,EAAE,EAAE,CACrC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,aAAa,GAAG,GAAY,EAAE,CAClC,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,OAAO,GAAG,KAAK,WAAW,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAoB,qBAAqB,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,gBAAgB,EAAE,CAAC;QAChD,IAAI,aAAa,EAAE;YAAE,OAAO,mBAAmB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;CACF,CAAC"}