@poe-platform/safe-js 0.1.799 → 0.1.800

package/dist/safe-js/chunks/{chunk-TBZILU4U.js → chunk-7THYP46K.js}

@@ -1,6 +1,6 @@
 import {
   isSandboxClosure
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 
 // packages/safe-js/src/lint/runtime-modules.ts
 var AsyncFunction = (async () => void 0).constructor;

package/dist/safe-js/chunks/{chunk-UU4T2KIT.js → chunk-CK3YK2EC.js}

@@ -1,6 +1,6 @@
 import {
   deepCopyToSandbox
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 
 // packages/safe-js/src/modules/harness.ts
 function makeHarnessModule(frontmatter, meta) {

package/dist/safe-js/chunks/{chunk-3O7HA6WT.js → chunk-F6Y734YA.js}

@@ -10,7 +10,7 @@ import {
   validateMigrationReconciliation,
   validateMigrationSemantics,
   validateSnapshotMigration
-} from "./chunk-ZKLJW27N.js";
+} from "./chunk-PMOXSLM5.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -20,7 +20,7 @@ import {
   serializeSafeJSSnapshot,
   validateDumpEnvelope,
   validateSnapshotData
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   parseModule
 } from "./chunk-A3LXCGMJ.js";

package/dist/safe-js/chunks/{chunk-OPYN6N5M.js → chunk-HPHCQNFV.js}

@@ -5,6 +5,7 @@ import {
   collectComments,
   formatParseError,
   hoistedVarDeclarations,
+  hostErrorData,
   numericTypedArrayConstructors,
   parseModule,
   tokenize
@@ -11174,6 +11175,158 @@ function hasOnlyRegexLiteralDiagnostics(diagnostics) {
   );
 }
 
+// packages/safe-js/src/modules/env.ts
+var EnvAccessError = class extends Error {
+  code = "ENV_ACCESS_DENIED";
+  variable;
+  constructor(variable) {
+    super(`Environment access denied for ${JSON.stringify(variable)}.`);
+    this.name = "EnvAccessError";
+    this.variable = variable;
+    hostErrorData.set(this, { code: this.code, variable });
+  }
+};
+function makeEnvModule(input) {
+  const options = normalizeEnvOptions(Array.isArray(input) ? { allow: input } : input);
+  const allowedNames = new Set(options.allow);
+  const values = options.values;
+  return {
+    get(name) {
+      const variable = readEnvName(name, "Environment variable name");
+      if (!allowedNames.has(variable)) throw new EnvAccessError(variable);
+      return readEnvValue(values ?? (typeof process !== "undefined" ? process.env ?? {} : {}), variable);
+    }
+  };
+}
+function parseEnvConfig(json) {
+  return normalizeEnvOptions(JSON.parse(json));
+}
+function normalizeEnvOptions(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new TypeError("Environment options must be an object.");
+  }
+  const fields = Object.getOwnPropertyDescriptors(input);
+  for (const key of Reflect.ownKeys(fields)) {
+    if (key !== "allow" && key !== "values") {
+      throw new TypeError("Unknown environment option.");
+    }
+    if (!("value" in fields[key])) {
+      throw new TypeError("Environment options must not contain accessors.");
+    }
+  }
+  const inputAllow = Object.getOwnPropertyDescriptor(input, "allow")?.value;
+  if (!Array.isArray(inputAllow)) {
+    throw new TypeError("Environment allow list must be an array of non-empty strings.");
+  }
+  const allow = [];
+  for (let index = 0; index < inputAllow.length; index += 1) {
+    const descriptor = Object.getOwnPropertyDescriptor(inputAllow, index);
+    if (descriptor === void 0 || !("value" in descriptor)) {
+      throw new TypeError("Environment allow list must contain only own data entries.");
+    }
+    allow.push(readEnvName(descriptor.value, `Environment allow list[${index}]`));
+  }
+  const inputValues = Object.getOwnPropertyDescriptor(input, "values")?.value;
+  if (inputValues === void 0) return { allow };
+  if (inputValues === null || typeof inputValues !== "object" || Array.isArray(inputValues)) {
+    throw new TypeError("Environment values must be an object.");
+  }
+  return {
+    allow,
+    values: Object.fromEntries(allow.map((name) => [name, readEnvValue(inputValues, name)]))
+  };
+}
+function readEnvValue(values, name) {
+  const descriptor = Object.getOwnPropertyDescriptor(values, name);
+  if (descriptor === void 0) return void 0;
+  if (!("value" in descriptor)) {
+    throw new TypeError(`Environment value for ${JSON.stringify(name)} must not be an accessor.`);
+  }
+  if (descriptor.value !== void 0 && typeof descriptor.value !== "string") {
+    throw new TypeError(
+      `Environment value for ${JSON.stringify(name)} must be a string or undefined.`
+    );
+  }
+  return descriptor.value;
+}
+function readEnvName(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`${label} must be a non-empty string.`);
+  }
+  if (value.includes("\0") || value.includes("=")) {
+    throw new TypeError(`${label} must not contain NUL or equals signs.`);
+  }
+  return value;
+}
+
+// packages/safe-js/src/modules/fail.ts
+var HarnessFailure = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HarnessFailure";
+  }
+};
+function makeFailModule() {
+  function fail(message) {
+    throw new HarnessFailure(readNonEmptyString(message, "Harness failure message"));
+  }
+  return {
+    default: fail
+  };
+}
+function readNonEmptyString(value, label) {
+  if (typeof value !== "string") {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  if (value.trim().length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return value;
+}
+
+// packages/safe-js/src/modules/metric.ts
+function makeMetricModule(npmRunner) {
+  return {
+    async run(name) {
+      const metricName = readNonEmptyString2(name, "Metric name");
+      const scriptName = `metric:${metricName}`;
+      const stdout = await npmRunner(scriptName);
+      const score = parseMetricScore(stdout, scriptName);
+      return score;
+    }
+  };
+}
+function parseMetricScore(stdout, scriptName) {
+  if (typeof stdout !== "string") {
+    throw new Error(`Metric runner for "${scriptName}" must resolve to a stdout string.`);
+  }
+  const scoreLine = stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).at(-1);
+  if (scoreLine === void 0) {
+    throw new Error(`Metric script "${scriptName}" must print a numeric score.`);
+  }
+  const score = Number(scoreLine);
+  if (!Number.isFinite(score)) {
+    throw new Error(`Metric script "${scriptName}" must print a numeric score.`);
+  }
+  return score;
+}
+function readNonEmptyString2(value, label) {
+  if (typeof value !== "string") {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  const normalizedValue = value.trim();
+  if (normalizedValue.length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return normalizedValue;
+}
+
 export {
-  lint
+  lint,
+  EnvAccessError,
+  makeEnvModule,
+  parseEnvConfig,
+  HarnessFailure,
+  makeFailModule,
+  makeMetricModule
 };

package/dist/safe-js/chunks/{chunk-W6C3Q6U4.js → chunk-LWHXSNF6.js}

@@ -2,11 +2,11 @@ import {
   McpError,
   connectMcpTransport,
   normalizeMcpOptions
-} from "./chunk-MCFRB5X3.js";
+} from "./chunk-SHMRT4QX.js";
 import {
   declareHostOperation,
   runResources
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   hostErrorData
 } from "./chunk-A3LXCGMJ.js";

package/dist/safe-js/chunks/{chunk-ZKLJW27N.js → chunk-PMOXSLM5.js}

@@ -2,7 +2,7 @@ import {
   HostCallJournal,
   decodeReplayData,
   validateSnapshotData
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   CompileScope,
   SandboxError,

package/dist/safe-js/chunks/{chunk-M6S3F3WM.js → chunk-QEDOBN2G.js}

@@ -7,15 +7,15 @@ import {
 } from "./chunk-ONWFPHUI.js";
 import {
   restore
-} from "./chunk-MDJ7MJYI.js";
+} from "./chunk-XOMGWE37.js";
 import {
   hashParsedAst,
   hashSource
-} from "./chunk-ZKLJW27N.js";
+} from "./chunk-PMOXSLM5.js";
 import {
   attachDumpController,
   createDumpController
-} from "./chunk-QTCPJ7FN.js";
+} from "./chunk-XV5OYKND.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -107,7 +107,7 @@ import {
   wrapCallerInjectedBindings,
   wrapCancelableBindings,
   wrapHostConstructor
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   Budget,
   CompileScope,

package/dist/safe-js/chunks/chunk-QRWRR6IA.js

@@ -0,0 +1,78 @@
+import {
+  createSeededRandom
+} from "./chunk-5RLD4TVI.js";
+
+// packages/safe-js/src/modules/time.ts
+function makeTimeModule(options = {}) {
+  const hasDeterministicRandom = options.random !== void 0 || options.seed !== void 0;
+  const random = options.random ?? (options.seed === void 0 ? () => Math.random() : createSeededRandom(options.seed).next);
+  const now = options.now ?? (() => Date.now());
+  const signal = options.signal;
+  async function sleep(ms) {
+    assertSleepDelay(ms);
+    return await new Promise((resolve, reject) => {
+      if (signal?.aborted === true) {
+        reject(createSleepAbortError());
+        return;
+      }
+      const start = performance.now();
+      let timeout = setTimeout(resolveSleep, ms);
+      function cleanup() {
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", rejectSleep);
+      }
+      function resolveSleep() {
+        const remainingMs = ms - (performance.now() - start);
+        if (remainingMs > 0) {
+          timeout = setTimeout(resolveSleep, remainingMs);
+          return;
+        }
+        cleanup();
+        resolve();
+      }
+      function rejectSleep() {
+        cleanup();
+        reject(createSleepAbortError());
+      }
+      signal?.addEventListener("abort", rejectSleep, { once: true });
+    });
+  }
+  return {
+    random,
+    now,
+    sleep,
+    uuid: hasDeterministicRandom ? () => createRandomUuid(random) : () => globalThis.crypto.randomUUID()
+  };
+}
+function createRandomUuid(random) {
+  const bytes = Array.from({ length: 16 }, () => Math.floor(readRandomUnit(random()) * 256));
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+function readRandomUnit(value) {
+  if (Number.isFinite(value) && value >= 0 && value < 1) {
+    return value;
+  }
+  throw new RangeError("time.uuid() random source must return a number in [0, 1).");
+}
+function assertSleepDelay(ms) {
+  if (Number.isFinite(ms) && ms >= 0) {
+    return;
+  }
+  throw new RangeError("time.sleep(ms) requires a non-negative finite millisecond delay.");
+}
+function createSleepAbortError() {
+  return new Error("time.sleep aborted.");
+}
+
+export {
+  makeTimeModule
+};

package/dist/safe-js/chunks/{chunk-MCFRB5X3.js → chunk-SHMRT4QX.js}

@@ -3753,6 +3753,7 @@ function snapshotLoopbackAuthorizationOptions(options) {
     ...options,
     openBrowser: options.openBrowser?.bind(options),
     readLine: options.readLine?.bind(options),
+    waitForCallback: options.waitForCallback?.bind(options),
     createServer: options.createServer?.bind(options),
     callbackPath: options.callbackPath,
     redirectUri: options.redirectUri,
@@ -3767,6 +3768,7 @@ async function createLoopbackAuthorizationSession(options = {}) {
   const timeoutMs = options.timeoutMs ?? 12e4;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
     throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  if (options.waitForCallback !== void 0) return createHostedAuthorizationSession(options, timeoutMs);
   const target = loopbackTarget(options);
   const server = options.createServer ? options.createServer() : http.createServer();
   const controller = new AbortController();
@@ -3829,6 +3831,72 @@ function loopbackTarget(options) {
     throw new Error("Invalid OAuth loopback callback path");
   return { port: 0, host: "127.0.0.1", callbackPath };
 }
+function validateAuthorizationRedirect(options) {
+  if (options.waitForCallback === void 0) {
+    loopbackTarget(options);
+    return;
+  }
+  if (typeof options.waitForCallback !== "function" || options.redirectUri === void 0)
+    throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
+  validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
+}
+function validateHostedOAuthRedirect(redirectUri, callbackPath) {
+  const url = new URL(redirectUri);
+  if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...redirectUri].some((char) => char.codePointAt(0) <= 32) || callbackPath !== void 0 && callbackPath !== url.pathname)
+    throw new Error("Invalid hosted OAuth redirect URI");
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+  validateAuthorizationRedirect(options);
+  const redirectUri = options.redirectUri, controller = new AbortController();
+  let used = false;
+  const aborted = () => controller.abort(options.signal?.reason);
+  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer.unref?.();
+  const cleanup = () => {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", aborted);
+  };
+  controller.signal.addEventListener("abort", cleanup, { once: true });
+  options.signal?.addEventListener("abort", aborted, { once: true });
+  if (options.signal?.aborted) aborted();
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used) throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        const authorization = new URL(authorizationUrl);
+        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+          throw new Error("OAuth authorization redirect mismatch");
+        const callback = await new Promise((resolve, reject) => {
+          const onAbort = () => reject(controller.signal.reason);
+          controller.signal.addEventListener("abort", onAbort, { once: true });
+          void Promise.resolve().then(() => {
+            controller.signal.throwIfAborted();
+            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+        });
+        controller.signal.throwIfAborted();
+        const url = new URL(callback), base = new URL(redirectUri);
+        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32)) throw new Error("OAuth callback redirect mismatch");
+        const params = readAuthorizationCallbackParameters(url);
+        for (const name of oauthCallbackParameters) url.searchParams.delete(name);
+        if (url.searchParams.toString() !== base.searchParams.toString()) throw new Error("OAuth callback redirect mismatch");
+        const expected = readExpectedAuthorizationCallback(authorizationUrl);
+        if (expected.state === null) throw new Error("OAuth authorization missing state");
+        validateAuthorizationCallbackBinding(params, expected);
+        if (params.error !== null) throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
+        return validateAuthorizationCallbackParameters(params, expected);
+      } finally {
+        controller.abort(new Error("OAuth authorization session closed"));
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
 async function startServer(server, port, host, signal) {
   signal.throwIfAborted();
   return new Promise((resolve, reject) => {
@@ -4076,7 +4144,9 @@ function normalizeStoredOAuthClient(value) {
   if (requestedRedirectUri !== void 0) {
     try {
       if (typeof requestedRedirectUri !== "string") throw new Error("Invalid redirect identity");
-      loopbackTarget({ redirectUri: requestedRedirectUri });
+      if (new URL(requestedRedirectUri).protocol === "https:")
+        validateHostedOAuthRedirect(requestedRedirectUri);
+      else loopbackTarget({ redirectUri: requestedRedirectUri });
     } catch {
       throw new Error("Invalid stored OAuth registration redirect identity");
     }
@@ -4968,7 +5038,7 @@ function isStoredOAuthTokensOrMissing(value) {
     return false;
   }
   const scope = getOwnEntry4(value, "scope");
-  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
+  return scope === void 0 || scope === "" || typeof scope === "string" && scope.trim().length > 0;
 }
 function isNonBlankOwnString(record2, key2) {
   const value = getOwnString(record2, key2);
@@ -5368,7 +5438,7 @@ async function requestTokens(input) {
     throw new Error("OAuth token response has invalid refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = normalizeOAuthScope(scope);
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
   if (scope !== void 0 && normalizedScope === void 0)
     throw new Error("Invalid OAuth scope syntax in token response");
   return {
@@ -5494,7 +5564,7 @@ function createDefaultOAuthClientProvider(options) {
   const clientMode = options.client.mode;
   const interactiveEnabled = options.allowInteractive !== false;
   const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
-  loopbackTarget(browser);
+  validateAuthorizationRedirect(browser);
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
@@ -6116,7 +6186,7 @@ function normalizeStoredTokens(value) {
   const scope = getOwnEntry6(value, "scope");
   const normalizedAccessToken = accessToken?.trim();
   const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
-  const normalizedScope = normalizeOAuthScope(scope);
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
   if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
@@ -6125,7 +6195,7 @@ function normalizeStoredTokens(value) {
     tokenType,
     expiresAt,
     ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
-    ...normalizedScope === void 0 || normalizedScope.length === 0 ? {} : { scope: normalizedScope }
+    ...normalizedScope === void 0 ? {} : { scope: normalizedScope }
   };
 }
 function getClientMetadata(client) {

package/dist/safe-js/chunks/{chunk-KULEMOAE.js → chunk-XAV2RKLO.js}

@@ -2524,115 +2524,6 @@ function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// packages/safe-js/src/modules/env.ts
-var EnvAccessError = class extends Error {
-  code = "ENV_ACCESS_DENIED";
-  variable;
-  constructor(variable) {
-    super(`Environment access denied for ${JSON.stringify(variable)}.`);
-    this.name = "EnvAccessError";
-    this.variable = variable;
-    hostErrorData.set(this, { code: this.code, variable });
-  }
-};
-function makeEnvModule(input) {
-  const options = normalizeEnvOptions(Array.isArray(input) ? { allow: input } : input);
-  const allowedNames = new Set(options.allow);
-  const values = options.values;
-  return {
-    get(name) {
-      const variable = readEnvName(name, "Environment variable name");
-      if (!allowedNames.has(variable)) throw new EnvAccessError(variable);
-      return readEnvValue(values ?? (typeof process !== "undefined" ? process.env ?? {} : {}), variable);
-    }
-  };
-}
-function parseEnvConfig(json) {
-  return normalizeEnvOptions(JSON.parse(json));
-}
-function normalizeEnvOptions(input) {
-  if (input === null || typeof input !== "object" || Array.isArray(input)) {
-    throw new TypeError("Environment options must be an object.");
-  }
-  const fields = Object.getOwnPropertyDescriptors(input);
-  for (const key of Reflect.ownKeys(fields)) {
-    if (key !== "allow" && key !== "values") {
-      throw new TypeError("Unknown environment option.");
-    }
-    if (!("value" in fields[key])) {
-      throw new TypeError("Environment options must not contain accessors.");
-    }
-  }
-  const inputAllow = Object.getOwnPropertyDescriptor(input, "allow")?.value;
-  if (!Array.isArray(inputAllow)) {
-    throw new TypeError("Environment allow list must be an array of non-empty strings.");
-  }
-  const allow = [];
-  for (let index = 0; index < inputAllow.length; index += 1) {
-    const descriptor = Object.getOwnPropertyDescriptor(inputAllow, index);
-    if (descriptor === void 0 || !("value" in descriptor)) {
-      throw new TypeError("Environment allow list must contain only own data entries.");
-    }
-    allow.push(readEnvName(descriptor.value, `Environment allow list[${index}]`));
-  }
-  const inputValues = Object.getOwnPropertyDescriptor(input, "values")?.value;
-  if (inputValues === void 0) return { allow };
-  if (inputValues === null || typeof inputValues !== "object" || Array.isArray(inputValues)) {
-    throw new TypeError("Environment values must be an object.");
-  }
-  return {
-    allow,
-    values: Object.fromEntries(allow.map((name) => [name, readEnvValue(inputValues, name)]))
-  };
-}
-function readEnvValue(values, name) {
-  const descriptor = Object.getOwnPropertyDescriptor(values, name);
-  if (descriptor === void 0) return void 0;
-  if (!("value" in descriptor)) {
-    throw new TypeError(`Environment value for ${JSON.stringify(name)} must not be an accessor.`);
-  }
-  if (descriptor.value !== void 0 && typeof descriptor.value !== "string") {
-    throw new TypeError(
-      `Environment value for ${JSON.stringify(name)} must be a string or undefined.`
-    );
-  }
-  return descriptor.value;
-}
-function readEnvName(value, label) {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new TypeError(`${label} must be a non-empty string.`);
-  }
-  if (value.includes("\0") || value.includes("=")) {
-    throw new TypeError(`${label} must not contain NUL or equals signs.`);
-  }
-  return value;
-}
-
-// packages/safe-js/src/modules/fail.ts
-var HarnessFailure = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "HarnessFailure";
-  }
-};
-function makeFailModule() {
-  function fail(message) {
-    throw new HarnessFailure(readNonEmptyString2(message, "Harness failure message"));
-  }
-  return {
-    default: fail
-  };
-}
-function readNonEmptyString2(value, label) {
-  if (typeof value !== "string") {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  if (value.trim().length === 0) {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  return value;
-}
-
 // packages/safe-js/src/modules/fs-config.ts
 import {
   createFileSystem,
@@ -2701,7 +2592,7 @@ function makeLogModule(sink = createJsonlStdoutSink()) {
       normalizedSink({
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         type: "event",
-        name: readNonEmptyString3(name, "Event name"),
+        name: readNonEmptyString2(name, "Event name"),
         payload
       });
     }
@@ -2724,7 +2615,7 @@ function createJsonlStdoutSink() {
   stdoutSinks.set(stream, sink);
   return sink;
 }
-function readNonEmptyString3(value, label) {
+function readNonEmptyString2(value, label) {
   if (typeof value !== "string") {
     throw new Error(`${label} must be a non-empty string.`);
   }
@@ -2796,43 +2687,6 @@ function toJsonValue(value, seen) {
   return String(value);
 }
 
-// packages/safe-js/src/modules/metric.ts
-function makeMetricModule(npmRunner) {
-  return {
-    async run(name) {
-      const metricName = readNonEmptyString4(name, "Metric name");
-      const scriptName = `metric:${metricName}`;
-      const stdout = await npmRunner(scriptName);
-      const score = parseMetricScore(stdout, scriptName);
-      return score;
-    }
-  };
-}
-function parseMetricScore(stdout, scriptName) {
-  if (typeof stdout !== "string") {
-    throw new Error(`Metric runner for "${scriptName}" must resolve to a stdout string.`);
-  }
-  const scoreLine = stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).at(-1);
-  if (scoreLine === void 0) {
-    throw new Error(`Metric script "${scriptName}" must print a numeric score.`);
-  }
-  const score = Number(scoreLine);
-  if (!Number.isFinite(score)) {
-    throw new Error(`Metric script "${scriptName}" must print a numeric score.`);
-  }
-  return score;
-}
-function readNonEmptyString4(value, label) {
-  if (typeof value !== "string") {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  const normalizedValue = value.trim();
-  if (normalizedValue.length === 0) {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  return normalizedValue;
-}
-
 export {
   formatInterpreterError,
   SPAWN_MODES,
@@ -2845,12 +2699,7 @@ export {
   createSpawnUsageAccumulator,
   runWithSpawnUsageAccumulator,
   makeAgentModule,
-  EnvAccessError,
-  makeEnvModule,
-  parseEnvConfig,
-  makeFailModule,
   parseFsConfig,
   resolveFsConfig,
-  makeLogModule,
-  makeMetricModule
+  makeLogModule
 };

package/dist/safe-js/chunks/{chunk-MDJ7MJYI.js → chunk-XOMGWE37.js}

@@ -2,7 +2,7 @@ import {
   hashParsedAst,
   hashSource,
   validateSnapshotMigration
-} from "./chunk-ZKLJW27N.js";
+} from "./chunk-PMOXSLM5.js";
 import {
   SnapshotValidationError,
   assertSnapshotInactive,
@@ -11,7 +11,7 @@ import {
   validateDumpEnvelope,
   validateGuestHeapSource,
   validateRuntimeSnapshotDescriptors
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   SandboxError,
   parseExecutableModule,