@smthrs/harness 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/QuickJSSandbox.js

@@ -0,0 +1,987 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var QuickJSSandbox_exports = {};
+__export(QuickJSSandbox_exports, {
+  ComputeClock: () => ComputeClock,
+  Variant: () => Variant,
+  cacheSuccessful: () => cacheSuccessful,
+  layer: () => layer,
+  layerClockLive: () => layerClockLive,
+  layerVariant: () => layerVariant,
+  layerVariantLive: () => layerVariantLive,
+  layerWithVariant: () => layerWithVariant,
+  loadModule: () => loadModule,
+  make: () => make,
+  makeWithClock: () => makeWithClock,
+  makeWithVariant: () => makeWithVariant
+});
+module.exports = __toCommonJS(QuickJSSandbox_exports);
+var import_quickjs_singlefile_browser_release_sync = __toESM(require("@jitl/quickjs-singlefile-browser-release-sync"), 1);
+var import_effect = require("effect");
+var import_quickjs_emscripten_core = require("quickjs-emscripten-core");
+var Cell = __toESM(require("./Cell.js"), 1);
+var bytes = __toESM(require("./internal/bytes.js"), 1);
+var elide = __toESM(require("./internal/elide.js"), 1);
+var printChannel = __toESM(require("./internal/printChannel.js"), 1);
+var import_refusal = require("./internal/refusal.js");
+var Sandbox = __toESM(require("./Sandbox.js"), 1);
+var VariablesPanel = __toESM(require("./VariablesPanel.js"), 1);
+const preludeIntrinsics = `  var keysOf = Object.keys
+  var freezeValue = Object.freeze
+  var prototypeOf = Object.getPrototypeOf
+  var objectPrototype = Object.prototype
+  var define = Object.defineProperty
+  var isArray = Array.isArray
+  var stringify = JSON.stringify
+  var parse = JSON.parse
+  var finite = Number.isFinite
+  var render = String
+  var Fault = TypeError
+  var Deferred = Promise
+  var argumentsOf = Array.prototype.slice`;
+const preludeHelpers = `${preludeIntrinsics}
+  var freeze = function (value) {
+    if (value !== null && typeof value === "object") {
+      keysOf(value).forEach(function (key) { freeze(value[key]) })
+      freezeValue(value)
+    }
+    return value
+  }
+  var encode = function (label, input) {
+    var seen = []
+    var visit = function (value) {
+      if (value === null || typeof value === "string" || typeof value === "boolean") return
+      if (typeof value === "number" && finite(value)) return
+      if (typeof value !== "object") throw new Fault(label + " must be JSON-serializable")
+      if (seen.indexOf(value) >= 0) throw new Fault(label + " must be JSON-serializable")
+      var prototype = prototypeOf(value)
+      if (!isArray(value) && prototype !== objectPrototype && prototype !== null) {
+        throw new Fault(label + " must be JSON-serializable")
+      }
+      seen.push(value)
+      keysOf(value).forEach(function (key) { visit(value[key]) })
+      seen.pop()
+    }
+    visit(input)
+    return stringify(input)
+  }
+  var settleEnvelope = function (settled) {
+    // A failed call RESOLVES with the failure envelope; only teardown throws.
+    // See Cell.callFailure for why.
+    if (settled.ok) return settled.value
+    if (settled.aborted) throw new Error(settled.failure.error.message)
+    return settled.failure
+  }
+  var dispatch = function (flow, input, at) { return bridge(flow, input, at).then(settleEnvelope) }
+  // The at option is whatever the cell wrote, so it is encoded defensively
+  // rather than strictly: a value JSON cannot hold travels as null and the
+  // boundary answers it as an ordinary invalid_input, instead of throwing out
+  // of a cell that has already paid for the calls before this line.
+  var encodeAt = function (value) {
+    try { return encode("ctx.call at", value === undefined ? null : value) } catch (error) { return "null" }
+  }`;
+const baseHandle = Cell.checkpoint(Cell.baseCheckpoint);
+const checkpointFlow = "checkpoint";
+const decodedAt = (encoded) => encoded === "" ? void 0 : import_effect.Schema.decodeUnknownSync(import_effect.Schema.Json)(JSON.parse(encoded));
+const preludeCall = (guard) => `    call: function (flow, input, options) {
+      if (typeof flow !== "string") return Deferred.reject(new Fault("ctx.call expects a flow name as its first argument"))
+${guard}      var encoded = encode("ctx.call input", input === undefined ? null : input)
+      var at = options === null || typeof options !== "object" ? undefined : options.at
+      if (at === undefined) return dispatch(flow, encoded, "")
+      // A handle the cell never awaited is a promise, and that spelling is the
+      // one the ruling wrote: \`const cp = ctx.checkpoint()\`. The pin lands where
+      // that line is, because the queue settles in issue order, so awaiting the
+      // handle later cannot move the tree it names. Both spellings are accepted.
+      if (at !== null && typeof at === "object" && typeof at.then === "function") {
+        return at.then(function (resolved) { return dispatch(flow, encoded, encodeAt(resolved)) })
+      }
+      return dispatch(flow, encoded, encodeAt(at))
+    },
+    checkpoint: function () {
+${guard}      return pin().then(settleEnvelope)
+    },
+    base: freeze(parse(${JSON.stringify(JSON.stringify(baseHandle))})),`;
+const sealedCall = Cell.callFailure(
+  (0, import_refusal.refusal)(
+    "run_completed",
+    "This run was already completed: an earlier line of this cell called ctx.done or ctx.park, which takes effect where it is called, so no further flow call is dispatched."
+  )
+);
+const replPrelude = (catalog) => `(function () {
+  var bridge = globalThis.__call
+  var pin = globalThis.__checkpoint
+  var print = globalThis.__print
+  var intent = globalThis.__intent
+${preludeHelpers}
+  delete globalThis.__call
+  delete globalThis.__checkpoint
+  delete globalThis.__print
+  delete globalThis.__intent
+  delete globalThis.Date
+  delete Math.random
+  // Removed for the same reason as the two above: it makes the realm answer a
+  // question dishonestly. Every reading the panel probe takes goes through the
+  // intrinsics captured before any cell ran, and every property comes off its
+  // own descriptor, so a cell can neither rebind reflection nor hide weight
+  // behind a getter. Neither defence survives a value that IS the trap: a proxy
+  // answers \`getOwnPropertyNames\` from its handler, so one wrapping a
+  // megabyte-wide target weighs as an empty object while the realm holds the
+  // target alive, and the run's only ceiling over string data reads zero for it.
+  // No reading of a proxy can be trusted \u2014 any number it reports is a number the
+  // handler chose \u2014 and nothing else in this realm can construct one, so the
+  // constructor goes rather than the accounting. \`Reflect\` stays: it offers no
+  // way to make a proxy and the probe does not read through it.
+  delete globalThis.Proxy
+  // The seal: once this frame has said how the run ends, it has ended, and the
+  // calls a cell would have made after that line are not dispatched. It lives
+  // here rather than on the host because ctx.call has to answer synchronously,
+  // and it is cleared per frame by the function this prelude returns \u2014 a park
+  // whose reason is refused is asked again inside the same frame, and a realm
+  // still sealed from the refused attempt would answer that retry with nothing.
+  var catalog = freeze(${catalog})
+  var sealed = null
+  var sealedEnvelope = freeze(parse(${JSON.stringify(JSON.stringify(sealedCall))}))
+  var unprintable = function (value, error) {
+    var kind = isArray(value) ? "array" : typeof value
+    var why = error !== null && typeof error === "object" && error.message ? error.message : render(error)
+    return "[unprintable " + kind + ": " + why + " \u2014 the value is still bound, so print the part of it you need]"
+  }
+  var show = function (values) {
+    var parts = []
+    for (var index = 0; index < values.length; index++) {
+      var value = values[index]
+      if (typeof value === "string") parts.push({ text: value })
+      else if (value === undefined) parts.push({ text: "undefined" })
+      else {
+        var encoded = null
+        var refused = false
+        try { encoded = stringify(value) } catch (error) { refused = true; parts.push({ text: unprintable(value, error) }) }
+        // JSON answers \`undefined\` rather than throwing for a value it has no
+        // notation for at all \u2014 a function, a symbol \u2014 and those read best as
+        // themselves. It throws only for a value it cannot walk, and that is
+        // the one case where naming the reason beats printing "[object Object]".
+        if (!refused) parts.push(encoded === undefined ? { text: render(value) } : { json: parse(encoded) })
+      }
+    }
+    print(stringify(parts))
+  }
+  var line = function () { show(argumentsOf.call(arguments)) }
+  var host = function (name, value) {
+    define(globalThis, name, { value: value, writable: false, enumerable: true, configurable: false })
+  }
+  host("console", freezeValue({ log: line, info: line, warn: line, error: line }))
+  host("ctx", freezeValue({
+${preludeCall(`      if (sealed !== null) return Deferred.resolve(sealed)
+`)}
+    get flows() { return catalog },
+    done: function (output) {
+      if (sealed !== null) return
+      if (arguments.length === 0) {
+        throw new Fault("ctx.done(output) takes the run's answer; call it with the value the task asked for")
+      }
+      var encoded = encode("ctx.done output", output === undefined ? null : output)
+      sealed = sealedEnvelope
+      intent("done", encoded)
+    },
+    park: function (reason, message) {
+      if (sealed !== null) return
+      var encoded = encode("ctx.park message", { reason: reason === undefined ? null : reason, message: message === undefined ? "" : message })
+      sealed = sealedEnvelope
+      intent("park", encoded)
+    },
+    justify: function (text) { intent("justify", encode("ctx.justify text", text === undefined ? "" : text)) }
+  }))
+  // Handed back to the host, which calls it as each frame opens. See the seal
+  // above for why the clearing is per frame rather than per run.
+  return function (nextCatalog) {
+    sealed = null
+    if (nextCatalog !== undefined) catalog = freeze(parse(nextCatalog))
+  }
+})()`;
+const Catalog = import_effect.Schema.Record(import_effect.Schema.String, Cell.FlowProjection);
+const catalogOf = (flows) => {
+  const encoded = import_effect.Schema.encodeSync(Catalog)(flows);
+  const normalized = Object.fromEntries(
+    Object.entries(encoded).map(([name, projection]) => [
+      name,
+      Object.fromEntries(
+        Object.entries(projection).flatMap(
+          ([field, value]) => import_effect.Option.isOption(value) ? import_effect.Option.isSome(value) ? [[field, value.value]] : [] : [[field, value]]
+        )
+      )
+    ])
+  );
+  return JSON.stringify(normalized);
+};
+const raisedFrom = (dumped) => {
+  if (typeof dumped === "object" && dumped !== null) {
+    const record = dumped;
+    return new Cell.Raised({
+      name: typeof record.name === "string" ? record.name : "Error",
+      // Never `String(object)`: a cell that threw a structured value is told
+      // what it threw. See `Sandbox` `describe`.
+      message: typeof record.message === "string" ? record.message : Sandbox.raisedOutcome(dumped).message
+    });
+  }
+  return new Cell.Raised({ name: "Error", message: String(dumped) });
+};
+const handleFromJson = (context, defineDataProperty, value, depth = 0) => {
+  if (value === null) return context.null;
+  switch (typeof value) {
+    case "boolean":
+      return value ? context.true : context.false;
+    case "number":
+      return context.newNumber(value);
+    case "string":
+      return context.newString(value);
+  }
+  if (depth >= 128) throw new Error("The flow result exceeds 128 levels of JSON nesting");
+  const container = Array.isArray(value) ? context.newArray() : context.newObject();
+  try {
+    for (const [key, item] of Object.entries(value)) {
+      const child = handleFromJson(context, defineDataProperty, item, depth + 1);
+      try {
+        const property = context.newString(key);
+        try {
+          context.unwrapResult(
+            context.callFunction(defineDataProperty, context.undefined, container, property, child)
+          ).dispose();
+        } finally {
+          property.dispose();
+        }
+      } finally {
+        child.dispose();
+      }
+    }
+    return container;
+  } catch (error) {
+    container.dispose();
+    throw error;
+  }
+};
+const cacheSuccessful = (load) => {
+  let loaded;
+  return () => {
+    if (loaded === void 0) {
+      const pending = load();
+      loaded = pending;
+      void pending.catch(() => {
+        loaded = void 0;
+      });
+    }
+    return loaded;
+  };
+};
+class Variant extends import_effect.Context.Service()(
+  "@smthrs/harness/QuickJSSandbox/Variant"
+) {
+}
+const layerVariantLive = import_effect.Layer.succeed(Variant)({ variant: import_quickjs_singlefile_browser_release_sync.default });
+const layerVariant = (variant) => import_effect.Layer.succeed(Variant)({ variant });
+const compiled = /* @__PURE__ */ new WeakMap();
+const loaderFor = (variant) => {
+  const known = compiled.get(variant);
+  if (known !== void 0) return known;
+  const loader = cacheSuccessful(() => (0, import_quickjs_emscripten_core.newQuickJSWASMModuleFromVariant)(variant));
+  compiled.set(variant, loader);
+  return loader;
+};
+class ComputeClock extends import_effect.Context.Service()(
+  "@smthrs/harness/QuickJSSandbox/ComputeClock"
+) {
+}
+const layerClockLive = import_effect.Layer.succeed(ComputeClock)({ now: () => Date.now() });
+const capabilities = {
+  calls: true,
+  memoryBytes: true,
+  steps: true,
+  timeMs: true
+};
+const timeLimitExceeded = (timeMs) => new Cell.Rejected({
+  code: "limit_exceeded",
+  message: `This cell exceeded its wall-clock limit of ${timeMs} milliseconds`
+});
+const parkReasons = ["waiting-input", "waiting-event", "waiting-quota"];
+const parkPayload = import_effect.Schema.decodeUnknownSync(
+  import_effect.Schema.Struct({ reason: import_effect.Schema.Json, message: import_effect.Schema.Json })
+);
+const printParts = import_effect.Schema.decodeUnknownSync(
+  import_effect.Schema.Array(
+    import_effect.Schema.Union([
+      import_effect.Schema.Struct({ text: import_effect.Schema.String }),
+      import_effect.Schema.Struct({ json: import_effect.Schema.Json })
+    ])
+  )
+);
+const printed = (encoded) => {
+  const parts = printParts(JSON.parse(encoded));
+  const rendered = parts.map((part) => "text" in part ? part.text : printChannel.render(part.json));
+  const whole = rendered.reduce(
+    (joined, part, index) => index === 0 ? part : joined + (part.includes("\n") || rendered[index - 1].includes("\n") ? "\n" : " ") + part,
+    ""
+  );
+  const wholeBytes = bytes.size(whole);
+  if (wholeBytes <= Sandbox.printFrameBytes) return { text: whole, bytes: wholeBytes };
+  const edge = Math.floor(Sandbox.printFrameBytes / 2);
+  return {
+    text: `${elide.headSlice(whole, edge)}${elide.tailSlice(whole, edge)}`,
+    bytes: wholeBytes
+  };
+};
+const replOutcome = (recorded, justification) => {
+  if (recorded !== void 0 && recorded.kind === "park") {
+    const reason = parkReasons.find((candidate) => candidate === recorded.reason);
+    if (reason === void 0) {
+      return new Cell.Rejected({
+        code: "invalid_transition",
+        message: `ctx.park was called with reason ${JSON.stringify(recorded.reason)}. Call it as ctx.park(reason, message) with reason one of "waiting-input", "waiting-event" or "waiting-quota".`
+      });
+    }
+    return new Cell.Settled({
+      transition: Sandbox.replTransition({ _tag: "Park", reason, message: recorded.message }, justification)
+    });
+  }
+  return new Cell.Settled({
+    transition: Sandbox.replTransition(
+      recorded === void 0 ? void 0 : { _tag: "Done", output: recorded.output, value: recorded.value },
+      justification
+    )
+  });
+};
+const weighNodes = 2e5;
+const weighDepth = 32;
+const panelProbe = (baseline) => `(function (ownNames, descriptorOf, keysOf, isArray, stringify, String, mapSize, mapEntries, mapNext, setSize, setValues, setNext, skip) {
+  return function () {
+    var names = ownNames(globalThis)
+    var out = []
+    var total = 0
+    var budget = ${weighNodes}
+    var partial = false
+    var partialRoot = null
+    var partialBytes = 0
+    // The ancestors of the value being weighed, and the whole of this walk's
+    // repeat detection. A cycle is the one repeat that MUST be cut, because it
+    // never ends, and an ancestor list cuts it at the cost of the depth ceiling
+    // rather than of the whole graph. Two siblings that share one object are
+    // counted twice, which over-states such a realm: a ceiling that errs toward
+    // refusing is the safe direction, and the refusal is spent on the frame it
+    // lands in, so the next cell runs and can restructure. A Set or a WeakSet
+    // would dedupe them properly and cannot be used here: allocating either
+    // inside a realm that is at its heap ceiling, which is the realm this probe
+    // exists to weigh, leaves the runtime unable to assert itself empty at
+    // teardown and aborts the host process.
+    var path = []
+    var weigh = function (value, depth) {
+      var kind = typeof value
+      if (depth > ${weighDepth}) {
+        partial = true
+        return 0
+      }
+      if (budget <= 0) {
+        partial = true
+        return 0
+      }
+      budget = budget - 1
+      // Code units, not UTF-8 bytes, and deliberately: this walk answers "how
+      // much of the host's memory is this realm holding", and QuickJS stores a
+      // string as one or two bytes per code unit, so a unit count is the honest
+      // reading of the thing being bounded. It is also the only O(1) one, and
+      // that is load-bearing: the probe runs at frame close under the cell's own
+      // interrupt budget, so a scan of a two-hundred-megabyte realm is killed
+      // part way and a realm that cannot be weighed at all reads as weighing
+      // nothing. UTF-8 bytes are the unit of what the model is SHOWN, which is
+      // the print channel and the call ledger, not of what the realm holds.
+      if (kind === "string") return value.length
+      if (value === null || kind !== "object") return 8
+      for (var up = 0; up < path.length; up++) if (path[up] === value) return 8
+      path.push(value)
+      var sum = 8
+      // An array is walked by index so keysOf never allocates a second array as
+      // long as the first. Each transient descriptor dies with its iteration,
+      // and the same node budget that bounds the walk bounds that pressure.
+      // Reading through the descriptor is load-bearing: an index accessor is
+      // cell code, not data the memory probe may execute.
+      if (isArray(value)) {
+        var count = value.length
+        for (var item = 0; item < count && !partial; item++) {
+          var property = descriptorOf(value, String(item))
+          if (property === undefined || !("value" in property)) sum = sum + 8
+          else sum = sum + weigh(property.value, depth + 1)
+        }
+        path.pop()
+        return sum
+      }
+      // Collection entries live in internal slots, not own properties. Use
+      // captured native methods for both branding and iteration: instanceof,
+      // Symbol.iterator, and methods read from the value are cell-controlled.
+      // Catch only a failed brand check, never an incomplete entry traversal.
+      var isMap = false
+      var isSet = false
+      try {
+        mapSize(value)
+        isMap = true
+      } catch (error) {
+        try { setSize(value); isSet = true } catch (error) {}
+      }
+      if (isMap || isSet) {
+        // Iterator allocation can exhaust the heap too. Let that failure reach
+        // the outer catch so the reading is partial rather than empty.
+        var iterator = isMap ? mapEntries(value) : setValues(value)
+        while (!partial) {
+          var entry = isMap ? mapNext(iterator) : setNext(iterator)
+          if (entry.done) break
+          if (isMap) {
+            sum = sum + weigh(entry.value[0], depth + 1)
+            sum = sum + weigh(entry.value[1], depth + 1)
+          } else sum = sum + weigh(entry.value, depth + 1)
+        }
+      }
+      var keys = keysOf(value)
+      for (var key = 0; key < keys.length && !partial; key++) {
+        var property = descriptorOf(value, keys[key])
+        sum = sum + keys[key].length
+        if (property === undefined || !("value" in property)) sum = sum + 8
+        else sum = sum + weigh(property.value, depth + 1)
+      }
+      path.pop()
+      return sum
+    }
+    var dataProperty = function (value, name, fallbackValue) {
+      var descriptor = descriptorOf(value, name)
+      return descriptor !== undefined && "value" in descriptor ? descriptor.value : fallbackValue
+    }
+    for (var index = 0; index < names.length; index++) {
+      var name = names[index]
+      if (skip.indexOf(name) >= 0) continue
+      var before = total
+      try {
+        var descriptor = descriptorOf(globalThis, name)
+        if (descriptor === undefined || !("value" in descriptor)) {
+          total = total + 8
+          out.push({ name: name, type: descriptor === undefined ? "unreadable" : "accessor", size: "", bytes: 8 })
+          continue
+        }
+        var value = descriptor.value
+        var kind = typeof value
+        var bytes = weigh(value, 0)
+        total = total + bytes
+        if (value === null) out.push({ name: name, type: "null", size: "", bytes: bytes })
+        else if (kind === "undefined") out.push({ name: name, type: "unset", size: "", bytes: bytes })
+        else if (kind === "string") out.push({ name: name, type: "string", size: value.length + " chars", bytes: bytes })
+        else if (kind === "function") out.push({ name: name, type: "function", size: "arity " + dataProperty(value, "length", 0), bytes: bytes })
+        else if (isArray(value)) out.push({ name: name, type: "array", size: dataProperty(value, "length", 0) + " items", bytes: bytes })
+        else if (kind === "object") out.push({ name: name, type: "object", size: keysOf(value).length + " keys", bytes: bytes })
+        else out.push({ name: name, type: kind, size: String(value), bytes: bytes })
+        if (partial) {
+          partialRoot = name
+          partialBytes = bytes
+          break
+        }
+      } catch (error) {
+        // A name the probe cannot read at all: a proxy that refuses reflection,
+        // or a realm so large that walking it is itself what runs out of heap.
+        // Either way this reading is a floor and not a total, so it is reported
+        // as partial rather than weighed at nothing. No accessor is invoked to
+        // get here: every property read above goes through its own descriptor.
+        total = before + 8
+        out.push({ name: name, type: "unreadable", size: "", bytes: 8 })
+        partial = true
+        partialRoot = name
+        partialBytes = 8
+        break
+      }
+    }
+    return stringify(partialRoot === null
+      ? { names: out, bytes: total, partial: false }
+      : { names: out, bytes: total, partial: true, partialRoot: partialRoot, partialBytes: partialBytes })
+  }
+})(
+  Object.getOwnPropertyNames,
+  Object.getOwnPropertyDescriptor,
+  Object.keys,
+  Array.isArray,
+  JSON.stringify,
+  String,
+  Function.prototype.call.bind(Object.getOwnPropertyDescriptor(Map.prototype, "size").get),
+  Function.prototype.call.bind(Map.prototype.entries),
+  Function.prototype.call.bind(Object.getPrototypeOf(new Map().entries()).next),
+  Function.prototype.call.bind(Object.getOwnPropertyDescriptor(Set.prototype, "size").get),
+  Function.prototype.call.bind(Set.prototype.values),
+  Function.prototype.call.bind(Object.getPrototypeOf(new Set().values()).next),
+  JSON.parse(${baseline})
+)`;
+const Weighed = import_effect.Schema.Struct({
+  name: import_effect.Schema.String,
+  type: import_effect.Schema.String,
+  size: import_effect.Schema.String,
+  bytes: import_effect.Schema.Number
+});
+const ProbeReading = {
+  names: import_effect.Schema.Array(Weighed),
+  bytes: import_effect.Schema.Number
+};
+const decodeProbe = import_effect.Schema.decodeUnknownSync(
+  import_effect.Schema.Union([
+    import_effect.Schema.Struct({ ...ProbeReading, partial: import_effect.Schema.Literal(false) }),
+    import_effect.Schema.Struct({
+      ...ProbeReading,
+      partial: import_effect.Schema.Literal(true),
+      partialRoot: import_effect.Schema.String,
+      partialBytes: import_effect.Schema.Number
+    })
+  ])
+);
+const overBudget = (held, ceiling, weighed) => {
+  const heaviest = [...weighed].sort((left, right) => right.bytes - left.bytes).slice(0, 3).map((entry) => `${entry.name} (${entry.bytes})`);
+  return new Cell.Rejected({
+    code: "limit_exceeded",
+    message: `The names this realm holds weigh ${held} bytes, over this run's ceiling of ${ceiling}. Nothing ran this frame, and your next cell does run: spend it freeing the largest by assigning over them \u2014 ${heaviest.join(", ")} \u2014 because a name a cell bound can be reassigned but never deleted. Every other name is still bound, and a realm still over the ceiling after that cell is refused again.`
+  });
+};
+const tooLargeToWeigh = (held, ceiling, root, bytes2) => new Cell.Rejected({
+  code: "limit_exceeded",
+  message: `This realm is too large to measure: weighing it stopped inside ${root} (${bytes2}) before it finished, so the ${held} bytes counted are a floor and not a total, and this run's ceiling of ${ceiling} is treated as spent. Nothing ran this frame, and your next cell does run: spend it freeing that name by assigning over it, because a name a cell bound can be reassigned but never deleted. Every other name is still bound, and a realm still too large to weigh after that cell is refused again.`
+});
+const openRealm = (module2, options, clock) => import_effect.Effect.gen(function* () {
+  const realmLimits = Sandbox.withDefaults(capabilities, options.limits);
+  let timeMs = realmLimits.timeMs ?? Sandbox.defaultLimits.timeMs;
+  const memoryBytes = realmLimits.memoryBytes ?? Sandbox.defaultLimits.memoryBytes;
+  let stepBudget = realmLimits.steps;
+  let clockBase = clock.now();
+  let steps = 0;
+  let exhausted;
+  let pending = [];
+  let closing = true;
+  let ordinal = 0;
+  let boundary = { terminal: "timeout", dispatched: -1, settled: -1 };
+  let lines = [];
+  let retained = 0;
+  let unread = 0;
+  let recorded;
+  let justification;
+  const acquired = yield* import_effect.Effect.acquireRelease(
+    import_effect.Effect.sync(() => {
+      const runtime2 = module2.newRuntime();
+      if (realmLimits.memoryBytes !== void 0) {
+        runtime2.setMemoryLimit(realmLimits.memoryBytes);
+      }
+      runtime2.setInterruptHandler(() => {
+        if (clock.now() - clockBase >= timeMs) {
+          exhausted = exhausted ?? timeLimitExceeded(timeMs);
+          return true;
+        }
+        if (stepBudget !== void 0 && ++steps > stepBudget) {
+          exhausted = exhausted ?? new Cell.Rejected({
+            code: "limit_exceeded",
+            message: `This cell exceeded its limit of ${stepBudget} interpreter steps`
+          });
+          return true;
+        }
+        return false;
+      });
+      const context2 = runtime2.newContext();
+      return { runtime: runtime2, context: context2 };
+    }),
+    ({ context: context2, runtime: runtime2 }) => import_effect.Effect.sync(() => {
+      context2.dispose();
+      runtime2.dispose();
+    })
+  );
+  const { context, runtime } = acquired;
+  const defineDataProperty = yield* import_effect.Effect.acquireRelease(
+    import_effect.Effect.sync(
+      () => context.unwrapResult(context.evalCode(
+        `(function (defineProperty) {
+  return function (object, key, value) {
+    defineProperty(object, key, {
+      value: value,
+      writable: true,
+      enumerable: true,
+      configurable: true
+    })
+  }
+})(Object.defineProperty)`
+      ))
+    ),
+    (handle) => import_effect.Effect.sync(() => handle.dispose())
+  );
+  const install = (name, implementation) => {
+    const handle = context.newFunction(name, implementation);
+    context.setProp(context.global, name, handle);
+    handle.dispose();
+  };
+  const heapUsed = () => {
+    const snapshot2 = runtime.computeMemoryUsage();
+    try {
+      const usage = context.dump(snapshot2);
+      return usage.memory_used_size;
+    } finally {
+      snapshot2.dispose();
+    }
+  };
+  const abort = (message) => {
+    closing = true;
+    for (const call of pending.splice(0)) call.abort(message);
+  };
+  const queue = (kind, flow, input, at) => {
+    if (closing) throw new Error("The cell is closing; no further host calls are accepted");
+    const deferred = context.newPromise();
+    const reply = (payload) => {
+      const remaining = Math.max(0, memoryBytes - heapUsed());
+      let payloadBytes = 64 * 1024;
+      const values = [payload];
+      while (values.length > 0 && payloadBytes < remaining) {
+        const value = values.pop();
+        payloadBytes += 64;
+        if (typeof value === "string") payloadBytes += bytes.size(value) * 2;
+        else if (value !== null && typeof value === "object") {
+          for (const [key, child] of Object.entries(value)) {
+            payloadBytes += 128 + bytes.size(key) * 2;
+            values.push(child);
+          }
+        }
+      }
+      if (payloadBytes >= remaining) {
+        exhausted = exhausted ?? new Cell.Rejected({
+          code: "limit_exceeded",
+          reason: "heap",
+          message: `The flow result is estimated to need ${payloadBytes} bytes of QuickJS heap, but only ${remaining} bytes remain under this run's ceiling of ${memoryBytes}. The result was not materialized.`
+        });
+        deferred.resolve(context.undefined);
+        deferred.dispose();
+        return;
+      }
+      let handle;
+      try {
+        handle = handleFromJson(context, defineDataProperty, payload);
+        deferred.resolve(handle);
+      } catch {
+        exhausted = new Cell.Rejected({
+          code: "limit_exceeded",
+          reason: "heap",
+          message: "Materializing the flow result exceeded the realm's limits."
+        });
+        deferred.resolve(context.undefined);
+      } finally {
+        handle?.dispose();
+        deferred.dispose();
+      }
+    };
+    pending.push({
+      ordinal: ordinal++,
+      flow,
+      input,
+      kind,
+      ...at === void 0 ? {} : { at },
+      settle: (result) => reply(
+        result.outcome === "success" ? { ok: true, value: result.value ?? null } : { ok: false, aborted: false, failure: Cell.callFailure(result) }
+      ),
+      abort: (message) => reply({
+        ok: false,
+        aborted: true,
+        failure: Cell.callFailure((0, import_refusal.refusal)(void 0, message))
+      })
+    });
+    return deferred.handle;
+  };
+  install("__call", (flowHandle, inputHandle, atHandle) => queue(
+    "call",
+    context.getString(flowHandle),
+    import_effect.Schema.decodeUnknownSync(import_effect.Schema.Json)(JSON.parse(context.getString(inputHandle))),
+    decodedAt(context.getString(atHandle))
+  ));
+  install("__checkpoint", () => queue("checkpoint", checkpointFlow, null, void 0));
+  install("__print", (partsHandle) => {
+    if (retained >= Sandbox.printRetainedBytes) {
+      unread = unread + 1;
+      return context.undefined;
+    }
+    const line = printed(context.getString(partsHandle));
+    retained = retained + bytes.size(line.text) + 1;
+    lines.push(line);
+    return context.undefined;
+  });
+  install("__intent", (kindHandle, payloadHandle) => {
+    const kind = context.getString(kindHandle);
+    const payload = import_effect.Schema.decodeUnknownSync(import_effect.Schema.Json)(JSON.parse(context.getString(payloadHandle)));
+    if (kind === "done") recorded = { kind: "done", output: Cell.renderText(payload), value: payload };
+    else if (kind === "park") {
+      const park = parkPayload(payload);
+      recorded = { kind: "park", reason: park.reason, message: Cell.renderText(park.message) };
+    } else justification = Cell.renderText(payload);
+    return context.undefined;
+  });
+  const installed = context.evalCode(replPrelude(catalogOf(options.flows)));
+  if (installed.error !== void 0) {
+    const failure = context.dump(installed.error);
+    installed.error.dispose();
+    return yield* new Sandbox.SandboxError({
+      code: "runtime_failed",
+      message: "The sandbox prelude failed to install",
+      cause: failure
+    });
+  }
+  const openFrame = installed.value;
+  yield* import_effect.Effect.addFinalizer(() => import_effect.Effect.sync(() => openFrame.dispose()));
+  const snapshot = context.unwrapResult(
+    context.evalCode("JSON.stringify(Object.getOwnPropertyNames(globalThis))")
+  );
+  const baseline = context.getString(snapshot);
+  snapshot.dispose();
+  const probe = context.unwrapResult(context.evalCode(panelProbe(JSON.stringify(baseline))));
+  yield* import_effect.Effect.addFinalizer(() => import_effect.Effect.sync(() => probe.dispose()));
+  let bindings = [];
+  let weighed = [];
+  let held = 0;
+  let unweighed;
+  const evaluateFrame = (evaluation, limits) => {
+    const totalMs = limits.totalMs ?? Sandbox.defaultLimits.totalMs;
+    const frameStarted = clock.now();
+    let pausedAtForFrame;
+    let pausedMs = 0;
+    return import_effect.Effect.gen(function* () {
+      timeMs = limits.timeMs ?? Sandbox.defaultLimits.timeMs;
+      stepBudget = limits.steps;
+      clockBase = clock.now();
+      steps = 0;
+      exhausted = void 0;
+      pending = [];
+      closing = false;
+      ordinal = 0;
+      boundary = { terminal: "timeout", dispatched: -1, settled: -1 };
+      lines = [];
+      retained = 0;
+      unread = 0;
+      recorded = void 0;
+      justification = void 0;
+      if (evaluation.flows === void 0) {
+        context.unwrapResult(context.callFunction(openFrame, context.undefined)).dispose();
+      } else {
+        const catalog = context.newString(catalogOf(evaluation.flows));
+        try {
+          context.unwrapResult(context.callFunction(openFrame, context.undefined, catalog)).dispose();
+        } finally {
+          catalog.dispose();
+        }
+      }
+      const frameOf = (outcome2) => ({
+        outcome: outcome2,
+        ...outcome2._tag === "rejected" && outcome2.code === "limit_exceeded" ? { boundary: { ...boundary, terminal: "settled" } } : {},
+        prints: printChannel.buffer(lines, unread),
+        bindings
+      });
+      if (unweighed !== void 0) {
+        const refusal2 = tooLargeToWeigh(held, memoryBytes, unweighed.root, unweighed.bytes);
+        unweighed = void 0;
+        held = 0;
+        return frameOf(refusal2);
+      }
+      if (held > memoryBytes) {
+        const refusal2 = overBudget(held, memoryBytes, weighed);
+        held = 0;
+        return frameOf(refusal2);
+      }
+      const compiled2 = evaluation.program ?? Sandbox.compile(evaluation.cell);
+      if (compiled2 instanceof Cell.Rejected) return frameOf(compiled2);
+      const started = context.evalCode(compiled2, `cell-${evaluation.frame}.js`, 128);
+      if (started.error !== void 0) {
+        const failure = context.dump(started.error);
+        started.error.dispose();
+        return frameOf(
+          new Cell.Rejected({
+            code: "compile_failed",
+            /* v8 ignore next -- QuickJS reports a compile failure as an Error object, so the `message` arm is what a parser disagreement takes; `String(failure)` only discharges the `unknown` `context.dump` is typed as */
+            message: `The cell did not compile: ${typeof failure === "object" && failure !== null && "message" in failure ? String(failure.message) : String(failure)}`
+          })
+        );
+      }
+      const cellHandle = started.value;
+      let settled;
+      const poll = () => {
+        if (closing) return;
+        runtime.executePendingJobs();
+        if (exhausted !== void 0) {
+          settled = exhausted;
+          return;
+        }
+        const state = context.getPromiseState(cellHandle);
+        if (state.type === "pending") return;
+        if (state.type === "fulfilled") {
+          state.value.dispose();
+          settled = replOutcome(recorded, justification);
+          return;
+        }
+        const error = context.dump(state.error);
+        state.error.dispose();
+        settled = raisedFrom(error);
+      };
+      const outcome = yield* Sandbox.driveCell({
+        pending,
+        replay: evaluation.replay,
+        progress: (dispatched, settled2) => {
+          boundary = { terminal: "timeout", dispatched, settled: settled2 };
+        },
+        ...evaluation.mint === void 0 ? {} : {
+          mint: (mint) => import_effect.Effect.suspend(() => {
+            const pausedAt = clock.now();
+            return evaluation.mint(mint).pipe(
+              import_effect.Effect.onExit(
+                () => import_effect.Effect.sync(() => {
+                  clockBase += clock.now() - pausedAt;
+                })
+              )
+            );
+          })
+        },
+        ...evaluation.bounded === void 0 ? {} : { bounded: evaluation.bounded },
+        flush: () => poll(),
+        finished: () => {
+          poll();
+          if (settled !== void 0) return settled;
+          if (pending.length > 0) return void 0;
+          return new Cell.Rejected({
+            code: "stalled",
+            message: "The cell awaited something that never settles. Inside a cell the only thing worth awaiting is ctx.call."
+          });
+        },
+        abort,
+        handler: (call) => import_effect.Effect.suspend(() => {
+          const pausedAt = clock.now();
+          const pausesFrame = limits.pauseTotalMsFor?.includes(call.flow) === true;
+          if (pausesFrame) pausedAtForFrame = pausedAt;
+          return evaluation.call(call).pipe(
+            import_effect.Effect.onExit(
+              () => import_effect.Effect.sync(() => {
+                clockBase += clock.now() - pausedAt;
+                if (pausesFrame) {
+                  pausedMs += clock.now() - pausedAt;
+                  pausedAtForFrame = void 0;
+                }
+              })
+            )
+          );
+        }),
+        limits
+      }).pipe(
+        // Closing is irreversible within this frame. Rejecting a bridge
+        // resumes user catch/finally blocks, so admission must close before
+        // any of those jobs can allocate another host-owned promise handle.
+        import_effect.Effect.ensuring(
+          import_effect.Effect.sync(() => {
+            closing = true;
+            try {
+              for (let jobs = 0; ; jobs++) {
+                abort("The cell was interrupted");
+                if (jobs >= 1024 || !runtime.hasPendingJob()) break;
+                runtime.executePendingJobs(1).dispose();
+              }
+            } finally {
+              cellHandle.dispose();
+            }
+          })
+        )
+      );
+      if (evaluation.replay !== void 0) {
+        return { outcome: evaluation.replay.outcome, prints: "", bindings, boundary: evaluation.replay.boundary };
+      }
+      const read = context.callFunction(probe, context.undefined);
+      if (read.error === void 0) {
+        const measured = decodeProbe(JSON.parse(context.getString(read.value)));
+        read.value.dispose();
+        weighed = measured.names;
+        held = measured.bytes;
+        unweighed = measured.partial ? { root: measured.partialRoot, bytes: measured.partialBytes } : void 0;
+        bindings = measured.names.map(
+          (entry) => new VariablesPanel.Binding({ name: entry.name, type: entry.type, size: entry.size })
+        );
+      } else {
+        read.error.dispose();
+      }
+      return frameOf(outcome);
+    }).pipe(
+      limits.pauseTotalMsFor?.length && evaluation.replay === void 0 ? import_effect.Effect.raceFirst(import_effect.Effect.gen(function* () {
+        for (; ; ) {
+          const now = clock.now();
+          const elapsed = now - frameStarted - pausedMs - (pausedAtForFrame === void 0 ? 0 : now - pausedAtForFrame);
+          const remaining = totalMs - elapsed;
+          if (remaining <= 0) {
+            return {
+              outcome: timeLimitExceeded(totalMs),
+              boundary,
+              prints: "",
+              bindings
+            };
+          }
+          yield* import_effect.Effect.sleep(import_effect.Duration.millis(Math.max(1, remaining)));
+        }
+      })) : import_effect.Effect.timeoutOrElse({
+        // Replay is stopped by its recorded boundary, not a second clock.
+        duration: evaluation.replay === void 0 ? totalMs : Infinity,
+        orElse: () => import_effect.Effect.succeed({
+          outcome: timeLimitExceeded(totalMs),
+          boundary,
+          prints: "",
+          bindings
+        })
+      })
+    );
+  };
+  const evaluate = (evaluation) => Sandbox.evaluationLimits(realmLimits, evaluation.limits).pipe(
+    import_effect.Effect.flatMap((limits) => evaluateFrame(evaluation, limits))
+  );
+  return { evaluate };
+});
+const loadModule = (loader) => import_effect.Effect.tryPromise({
+  try: loader,
+  catch: (cause) => new Sandbox.SandboxError({
+    code: "runtime_failed",
+    message: "QuickJS WebAssembly module could not be loaded",
+    cause
+  })
+});
+const makeWithVariant = import_effect.Effect.gen(function* () {
+  const clock = yield* ComputeClock;
+  const { variant } = yield* Variant;
+  const module2 = yield* loadModule(loaderFor(variant));
+  return Sandbox.make({
+    capabilities,
+    openRealm: (options) => openRealm(module2, options, clock)
+  });
+});
+const makeWithClock = makeWithVariant.pipe(
+  import_effect.Effect.provide(layerVariantLive)
+);
+const make = makeWithClock.pipe(
+  import_effect.Effect.provide(layerClockLive)
+);
+const layerWithVariant = import_effect.Layer.effect(
+  Sandbox.Sandbox
+)(makeWithVariant.pipe(import_effect.Effect.provide(layerClockLive)));
+const layer = import_effect.Layer.effect(Sandbox.Sandbox)(make);
+//# sourceMappingURL=QuickJSSandbox.js.map