@theqrl/hypc 0.2.0 → 0.3.1

package/linker.js

@@ -30,6 +30,23 @@ function libraryHash(fullyQualifiedLibraryName, length) {
 function libraryHashPlaceholder(fullyQualifiedLibraryName) {
     return `$${libraryHash(fullyQualifiedLibraryName, HASH_PLACEHOLDER_BODY_LENGTH)}$`;
 }
+/**
+ * Applies the compiler's address checksum to a hex address body: a letter is upper case when
+ * the matching nibble of SHAKE-256 (64 bytes) of the lower-case body is 8 or more.
+ * Mirrors `checksummedAddressBody` in hyperion's libhyputil/CommonData.cpp.
+ */
+function checksummedAddressBody(body) {
+    const lower = body.toLowerCase();
+    const hash = (0, js_sha3_1.shake256)(lower, ADDRESS_HEX_LENGTH * 4);
+    return [...lower].map((c, i) => (c >= 'a' && c <= 'f' && parseInt(hash[i], 16) >= 8 ? c.toUpperCase() : c)).join('');
+}
+/**
+ * Accepts an all-lower-case or all-upper-case body, or a mixed-case body with a valid checksum,
+ * as the compiler does for `settings.libraries`.
+ */
+function passesAddressChecksum(body) {
+    return body === body.toLowerCase() || body === body.toUpperCase() || body === checksummedAddressBody(body);
+}
 /**
  * Finds all placeholders corresponding to the specified library label and replaces them
  * with a concrete address. Works with both hex-encoded and binary bytecode as long as
@@ -105,6 +122,9 @@ function linkBytecode(bytecode, libraries) {
         }
         // remove address prefix
         hexAddress = hexAddress.slice(ADDRESS_PREFIX.length);
+        if (!passesAddressChecksum(hexAddress)) {
+            throw new Error(`Invalid address checksum specified for ${libraryName}`);
+        }
         bytecode = replacePlaceholder(bytecode, libraryName, hexAddress);
         bytecode = replacePlaceholder(bytecode, libraryHashPlaceholder(libraryName), hexAddress);
     }

package/package.json

@@ -1,16 +1,21 @@
 {
     "name": "@theqrl/hypc",
-    "version": "0.2.0",
+    "version": "0.3.1",
     "description": "Hyperion compiler",
     "main": "index.js",
     "bin": {
         "hypcjs": "hypc.js"
     },
+    "files": [
+        "*.js",
+        "bindings/*.js",
+        "common/*.js"
+    ],
     "scripts": {
         "build": "tsc",
         "postbuild": "node build/postbuild.js && cp README.md LICENSE dist/",
-        "lint": "eslint --ext .js,.ts .",
-        "lint:fix": "eslint --fix --ext .js,.ts .",
+        "lint": "eslint .",
+        "lint:fix": "eslint --fix .",
         "updateBinary": "node build/clean.js && ts-node ./downloadCurrentVersion.ts && ts-node ./verifyVersion.ts",
         "prepack": "node build/pack-publish-block.js",
         "build:tarball": "npm run updateBinary && npm run build && BYPASS_SAFETY_CHECK=true npm pack ./dist",
@@ -19,8 +24,7 @@
         "copyTestFiles": "cp -r ./test/resources ./dist/test/",
         "pretest": "npm run lint && npm run build && npm run copyTestFiles",
         "test": "cd dist && tape ./test/index.js --no-remote-versions",
-        "coverage": "nyc npm run test",
-        "coveralls": "npm run coverage && coveralls <coverage/lcov.info"
+        "coverage": "nyc npm run test"
     },
     "repository": {
         "type": "git",
@@ -37,33 +41,29 @@
         "url": "https://github.com/theQRL/hypc-js/issues"
     },
     "homepage": "https://github.com/theQRL/hypc-js#readme",
+    "engines": {
+        "node": ">=22.12.0"
+    },
     "dependencies": {
         "command-exists": "^1.2.8",
-        "commander": "^8.1.0",
-        "follow-redirects": "^1.12.1",
-        "js-sha3": "0.8.0",
-        "memorystream": "^0.3.1",
-        "semver": "^5.5.0",
-        "tmp": "0.0.33"
+        "commander": "^15.0.0",
+        "follow-redirects": "^1.16.2",
+        "js-sha3": "0.13.0",
+        "semver": "^7.8.5",
+        "tmp": "0.2.7"
     },
     "devDependencies": {
-        "@types/node": "^16.11.7",
-        "@types/semver": "^7.3.9",
-        "@types/tape": "^4.13.2",
+        "@types/node": "^22.12.0",
+        "@types/semver": "^7.8.0",
+        "@types/tape": "^5.8.1",
         "@types/tmp": "^0.2.3",
-        "@typescript-eslint/eslint-plugin": "^5.8.0",
-        "@typescript-eslint/parser": "^5.8.0",
-        "coveralls": "^3.0.0",
-        "eslint": "^7.32.0",
-        "eslint-config-standard": "^16.0.3",
-        "eslint-plugin-import": "^2.25.3",
-        "eslint-plugin-node": "^11.1.0",
-        "eslint-plugin-promise": "^5.1.1",
-        "nyc": "^15.1.0",
-        "tape": "^4.11.0",
+        "eslint": "^10.13.0",
+        "neostandard": "^0.14.1",
+        "nyc": "^18.0.0",
+        "tape": "^5.10.3",
         "tape-spawn": "^1.4.2",
         "ts-node": "^10.4.0",
-        "typescript": "^4.5.4"
+        "typescript": "~6.0.2"
     },
     "nyc": {
         "exclude": [

package/smtchecker.js

@@ -1,4 +1,5 @@
 "use strict";
+const helpers_1 = require("./common/helpers");
 // This function checks the standard JSON output for auxiliaryInputRequested,
 // where smtlib2queries represent the queries created by the SMTChecker.
 // The function runs an SMT solver on each query and adjusts the input for
@@ -29,7 +30,8 @@ function smtCallback(solverFunction, solver) {
             return { contents: result };
         }
         catch (err) {
-            return { error: err };
+            // The compiler takes the error as a string, like the contents.
+            return { error: (0, helpers_1.describeException)(err) };
         }
     };
 }

package/smtsolver.js

@@ -15,34 +15,51 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 const command_exists_1 = require("command-exists");
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const tmp = __importStar(require("tmp"));
 // Timeout in ms.
 const timeout = 10000;
+// Solver answers are short; this only bounds a runaway solver.
+const maxBuffer = 64 * 1024 * 1024;
 const potentialSolvers = [
     {
         name: 'z3',
         command: 'z3',
-        params: '-smt2 rlimit=20000000 rewriter.pull_cheap_ite=true fp.spacer.q3.use_qgen=true fp.spacer.mbqi=false fp.spacer.ground_pobs=false'
+        params: ['-smt2', 'rlimit=20000000', 'rewriter.pull_cheap_ite=true', 'fp.spacer.q3.use_qgen=true', 'fp.spacer.mbqi=false', 'fp.spacer.ground_pobs=false']
     },
     {
         name: 'Eldarica',
         command: 'eld',
-        params: '-horn -t:' + (timeout / 1000) // Eldarica takes timeout in seconds.
+        params: ['-horn', '-t:' + (timeout / 1000)] // Eldarica takes timeout in seconds.
+    },
+    {
+        name: 'cvc5',
+        command: 'cvc5',
+        params: ['--lang=smt2', '--tlimit=' + timeout]
     },
     {
         name: 'cvc4',
         command: 'cvc4',
-        params: '--lang=smt2 --tlimit=' + timeout
+        params: ['--lang=smt2', '--tlimit=' + timeout]
     }
 ];
 const solvers = potentialSolvers.filter(solver => (0, command_exists_1.sync)(solver.command));
@@ -59,18 +76,26 @@ function solve(query, solver) {
     fs.writeFileSync(tmpFile.name, query);
     let solverOutput;
     try {
-        solverOutput = (0, child_process_1.execSync)(solver.command + ' ' + solver.params + ' ' + tmpFile.name, {
+        // No shell: the solver gets its arguments as an array. A caller's solver configuration may
+        // still give params as one string, as before; it is split on whitespace.
+        const params = typeof solver.params === 'string' ? solver.params.split(/\s+/).filter(Boolean) : solver.params;
+        solverOutput = (0, child_process_1.execFileSync)(solver.command, [...params, tmpFile.name], {
             encoding: 'utf8',
-            maxBuffer: 1024 * 1024 * 1024,
+            maxBuffer,
             stdio: 'pipe',
-            timeout: timeout // Enforce timeout on the process, since solvers can sometimes go around it.
+            timeout, // Enforce timeout on the process, since solvers can sometimes go around it.
+            killSignal: 'SIGKILL' // A solver can ignore SIGTERM.
         }).toString();
     }
     catch (e) {
-        // execSync throws if the process times out or returns != 0.
+        // The output was cut off at maxBuffer, so even an answer at its start cannot be trusted.
+        if (e.code === 'ENOBUFS') {
+            throw new Error(`Failed to solve SMT query. The solver wrote more than ${maxBuffer} bytes.`);
+        }
+        // execFileSync throws if the process times out or returns != 0.
         // The latter might happen with z3 if the query asks for a model
         // for an UNSAT formula. We can still use stdout.
-        solverOutput = e.stdout.toString();
+        solverOutput = (e.stdout || '').toString();
         if (!solverOutput.startsWith('sat') &&
             !solverOutput.startsWith('unsat') &&
             !solverOutput.startsWith('unknown') &&
@@ -79,8 +104,10 @@ function solve(query, solver) {
             throw new Error('Failed to solve SMT query. ' + e.toString());
         }
     }
-    // Trigger early manual cleanup
-    tmpFile.removeCallback();
+    finally {
+        // Trigger early manual cleanup
+        tmpFile.removeCallback();
+    }
     return solverOutput;
 }
 module.exports = {

package/translate.js

@@ -42,7 +42,7 @@ function translateErrors(ret, errors) {
             type = 'Error';
         }
         ret.push({
-            type: type,
+            type,
             component: 'general',
             severity: (type === 'Warning') ? 'warning' : 'error',
             message: errors[error],

package/verifyVersion.js

@@ -16,13 +16,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/wrapper.js

@@ -1,20 +1,161 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-const memorystream_1 = __importDefault(require("memorystream"));
+const crypto_1 = require("crypto");
 const follow_redirects_1 = require("follow-redirects");
+const fs = __importStar(require("fs"));
+const js_sha3_1 = require("js-sha3");
+const path = __importStar(require("path"));
 const formatters_1 = require("./formatters");
 const helpers_1 = require("./common/helpers");
 const bindings_1 = __importDefault(require("./bindings"));
 const translate_1 = __importDefault(require("./translate"));
 const Module = module.constructor;
-function wrapper(hypjson) {
-    const { coreBindings, compileBindings, methodFlags } = (0, bindings_1.default)(hypjson);
+/**
+ * Wraps an Emscripten compiler module in the hypc-js API.
+ *
+ * A JavaScript exception that unwinds through the compiler's wasm frames, such as the RangeError
+ * of a stack overflow inside the compiler, leaves that module instance unable to compile (see
+ * `guarded` in bindings/compile.ts). `compile` throws the exception, and the next compilation
+ * runs on a fresh instance of the module, which `reload` returns. By default a module that
+ * `require` loaded is reloaded from its file, and `loadRemoteVersion` reloads from the downloaded
+ * source. Where neither applies, as in a browser or a bundle, pass a function that returns a fresh
+ * module. Without one, the same instance goes on once the compiler has discarded the abandoned
+ * compilation, which compilers from 0.3.0 on do in hyperion_reset(); with an older compiler, or
+ * after a WebAssembly trap, the next compilation returns an error that says the module cannot be
+ * used again.
+ *
+ * @param hypjson The Emscripten compiled Hyperion object.
+ * @param reload Returns a fresh instance of the same module.
+ */
+function wrapper(hypjson, reload = reloaderFor(hypjson)) {
+    let bindings = (0, bindings_1.default)(hypjson);
+    const { methodFlags } = bindings;
+    // Why no compilation can run any more, once that is certain: the instance cannot compile, and no
+    // fresh one can be loaded.
+    let unusable;
+    // Set while the instance goes on after discarding an abandoned compilation and its next output
+    // has not yet shown whether the compiler supports that; holds why it was needed.
+    let recoveringInPlace;
+    const withoutReplacement = (why) => `The compiler module cannot be used again: ${why}. Load a fresh module, or pass a function that does so as the second argument of setupMethods.`;
+    // The bindings of the current module instance, after an exception unwound through the previous
+    // one: of a fresh instance where one can be loaded, otherwise of the same instance after asking
+    // it to discard the abandoned compilation. Throws when neither is possible.
+    function usableBindings() {
+        if (unusable !== undefined) {
+            throw new Error(unusable);
+        }
+        if (!bindings.poisoned) {
+            return bindings;
+        }
+        const why = `an exception unwound through the compiler during an earlier compilation (${(0, helpers_1.describeException)(bindings.poisonedBy)})`;
+        if (reload !== undefined) {
+            try {
+                bindings = (0, bindings_1.default)(reload());
+            }
+            catch (e) {
+                throw new Error(`The compiler module cannot be used again: ${why}, and reloading it failed: ${(0, helpers_1.describeException)(e)}`);
+            }
+            return bindings;
+        }
+        // No fresh instance can be loaded here, as in a browser or a bundle. A JavaScript exception
+        // leaves the instance's memory intact, and hyperion_reset() of compilers from 0.3.0 on
+        // discards the abandoned compilation's state, so the same instance can go on; whether this
+        // compiler does that shows in its next output (see compileMethod). What the abandoned
+        // compilation allocated stays allocated, since its destructors never ran and cannot be run
+        // now, which is why a fresh instance is preferred wherever one can be loaded. After a trap (a
+        // WebAssembly.RuntimeError, which is also what an Emscripten abort throws) the memory cannot
+        // be trusted.
+        if (typeof WebAssembly !== 'undefined' && bindings.poisonedBy instanceof WebAssembly.RuntimeError) {
+            unusable = withoutReplacement(`${why}, and the instance cannot be reused after a WebAssembly trap`);
+            throw new Error(unusable);
+        }
+        if ((0, helpers_1.isNil)(bindings.coreBindings.reset)) {
+            unusable = withoutReplacement(`${why}, and this compiler has no hyperion_reset() to discard it with`);
+            throw new Error(unusable);
+        }
+        try {
+            bindings.coreBindings.reset();
+        }
+        catch (e) {
+            unusable = withoutReplacement(`${why}, and hyperion_reset() failed afterwards: ${(0, helpers_1.describeException)(e)}`);
+            throw new Error(unusable);
+        }
+        bindings.poisoned = false;
+        bindings.poisonedBy = undefined;
+        recoveringInPlace = why;
+        return bindings;
+    }
+    // The compile method of that name, run on the current module instance, or null if the compiler
+    // lacks the method.
+    function compileMethod(name) {
+        if ((0, helpers_1.isNil)(bindings.compileBindings[name])) {
+            return null;
+        }
+        return function (...args) {
+            let current;
+            try {
+                current = usableBindings();
+            }
+            catch (e) {
+                return (0, formatters_1.formatFatalError)(e.message);
+            }
+            const output = current.compileBindings[name](...args);
+            if (recoveringInPlace !== undefined) {
+                const why = recoveringInPlace;
+                recoveringInPlace = undefined;
+                if (reportsStaleCompilerStack(output)) {
+                    unusable = withoutReplacement(`${why}, and this compiler's hyperion_reset() does not discard the abandoned compilation (compilers from 0.3.0 on do)`);
+                    return (0, formatters_1.formatFatalError)(unusable);
+                }
+            }
+            return output;
+        };
+    }
+    const compileBindings = {
+        compileJson: compileMethod('compileJson'),
+        compileJsonCallback: compileMethod('compileJsonCallback'),
+        compileJsonMulti: compileMethod('compileJsonMulti'),
+        compileStandard: compileMethod('compileStandard')
+    };
     return {
-        version: coreBindings.version,
-        semver: coreBindings.versionToSemver,
-        license: coreBindings.license,
+        version: () => bindings.coreBindings.version(),
+        semver: () => bindings.coreBindings.versionToSemver(),
+        license: () => bindings.coreBindings.license(),
         lowlevel: {
             compileSingle: compileBindings.compileJson,
             compileMulti: compileBindings.compileJsonMulti,
@@ -28,36 +169,170 @@ function wrapper(hypjson) {
             nativeStandardJSON: methodFlags.compileJsonStandardSupported
         },
         compile: compileStandardWrapper.bind(this, compileBindings),
-        // Loads the compiler of the given version from the github repository
-        // instead of from the local filesystem.
+        // Loads the compiler of the given version from binaries.theqrl.org instead of from the
+        // local filesystem, after checking it against list.json.
         loadRemoteVersion,
         // Use this if you want to add wrapper functions around the pure module.
         setupMethods: wrapper
     };
 }
-function loadRemoteVersion(versionString, callback) {
-    const memoryStream = new memorystream_1.default(null, { readable: false });
-    const url = `https://binaries.theqrl.org/bin/hypjson-${versionString}.js`;
-    follow_redirects_1.https.get(url, response => {
+// Loads the source of a compiler module as require() does, in a Module of its own that is in
+// neither require.cache nor module.children, so that an instance can be dropped once it is no
+// longer usable. Emscripten's Node support adds a process-wide `unhandledRejection` listener on
+// every load, which would accumulate and keep every instance alive; the listeners a load adds are
+// removed again.
+function loadModuleSource(source, filename) {
+    const events = ['uncaughtException', 'unhandledRejection'];
+    const listenersBefore = events.map(event => process.listeners(event));
+    try {
+        const hypjson = new Module(filename);
+        hypjson.filename = filename;
+        hypjson.paths = Module._nodeModulePaths(path.dirname(filename));
+        hypjson._compile(source, filename);
+        hypjson.loaded = true;
+        return hypjson.exports;
+    }
+    finally {
+        events.forEach((event, i) => {
+            for (const listener of process.listeners(event)) {
+                if (!listenersBefore[i].includes(listener)) {
+                    process.removeListener(event, listener);
+                }
+            }
+        });
+    }
+}
+// A function that loads a fresh instance of a module that require() loaded, found through
+// require.cache; undefined where there is no such record, as in a browser or a bundle.
+function reloaderFor(hypjson) {
+    const cache = typeof require === 'function' ? require.cache : undefined;
+    if (!cache) {
+        return undefined;
+    }
+    const record = Object.keys(cache)
+        .map(key => cache[key])
+        .find(entry => entry && entry.exports === hypjson && typeof entry.filename === 'string');
+    if (!record) {
+        return undefined;
+    }
+    return () => loadModuleSource(fs.readFileSync(record.filename, 'utf8'), record.filename);
+}
+// True if the compiler's output reports the CompilerStack of an abandoned compilation, which is
+// what an instance whose hyperion_reset() did not discard it answers to every compilation.
+function reportsStaleCompilerStack(output) {
+    let parsed;
+    try {
+        parsed = JSON.parse(output);
+    }
+    catch (e) {
+        return false;
+    }
+    const errors = parsed && parsed.errors;
+    return Array.isArray(errors) && errors.some(error => {
+        // Compilers before 0.4.x reported errors as strings.
+        const message = typeof error === 'string' ? error : error && error.message;
+        const internal = typeof error === 'string' || (error && error.type === 'InternalCompilerError');
+        return internal && typeof message === 'string' && message.includes('You shall not have another CompilerStack aside me.');
+    });
+}
+const BINARIES_HOST = 'binaries.theqrl.org';
+const BINARIES_URL = `https://${BINARIES_HOST}/bin/`;
+// list.json is a few kilobytes and a compiler build about 9 MB.
+const MAX_LIST_BYTES = 1024 * 1024;
+const MAX_BUILD_BYTES = 64 * 1024 * 1024;
+// Follow redirects only to https URLs on the binaries host.
+function beforeRedirect(options) {
+    if (options.protocol !== 'https:' || options.hostname !== BINARIES_HOST) {
+        throw new Error(`Refusing to follow a redirect to ${options.protocol}//${options.hostname}.`);
+    }
+}
+// Calls back once, with an error or the complete body of a 200 response.
+function download(url, maxBytes, callback) {
+    let done = false;
+    const finish = (error, body) => {
+        if (!done) {
+            done = true;
+            callback(error, body);
+        }
+    };
+    follow_redirects_1.https.get(url, { beforeRedirect, maxRedirects: 5 }, response => {
         if (response.statusCode !== 200) {
-            callback(new Error(`Error retrieving binary: ${response.statusMessage}`));
+            response.resume();
+            finish(new Error(`Error retrieving ${url}: ${response.statusCode} ${response.statusMessage}`));
+            return;
         }
-        else {
-            response.pipe(memoryStream);
-            response.on('end', () => {
-                // Based on the require-from-string package.
-                const hypjson = new Module();
-                hypjson._compile(memoryStream.toString(), `hypjson-${versionString}.js`);
-                if (module.parent && module.parent.children) {
-                    // Make sure the module is plugged into the hierarchy correctly to have parent
-                    // properly garbage collected.
-                    module.parent.children.splice(module.parent.children.indexOf(hypjson), 1);
-                }
-                callback(null, wrapper(hypjson.exports));
-            });
+        const chunks = [];
+        let length = 0;
+        response.on('data', chunk => {
+            length += chunk.length;
+            if (length > maxBytes) {
+                response.destroy();
+                finish(new Error(`${url} is larger than ${maxBytes} bytes.`));
+            }
+            else {
+                chunks.push(chunk);
+            }
+        });
+        response.on('end', () => finish(null, Buffer.concat(chunks)));
+        response.on('error', finish);
+    }).on('error', finish);
+}
+// The list.json entry for "latest", a release such as "0.2.0", or a build such as
+// "v0.2.0+commit.e36a0aea".
+function findBuild(list, versionString) {
+    const releases = list.releases || {};
+    const buildPath = versionString === 'latest'
+        ? releases[list.latestRelease]
+        : releases[versionString] || `hypjson-${versionString}.js`;
+    const build = (list.builds || []).find(entry => entry.path === buildPath);
+    if (!build ||
+        !/^hypjson-v[0-9A-Za-z.+-]+\.js$/.test(build.path) ||
+        typeof build.keccak256 !== 'string' ||
+        typeof build.sha256 !== 'string') {
+        throw new Error(`Version ${versionString} is not in ${BINARIES_URL}list.json.`);
+    }
+    return build;
+}
+// Downloads a compiler build and runs it only if its keccak256 and sha256 match list.json.
+function loadRemoteVersion(versionString, callback) {
+    download(BINARIES_URL + 'list.json', MAX_LIST_BYTES, (listError, listBody) => {
+        if (listError) {
+            callback(listError);
+            return;
+        }
+        let build;
+        try {
+            build = findBuild(JSON.parse(listBody.toString('utf8')), versionString);
+        }
+        catch (e) {
+            callback(e);
+            return;
         }
-    }).on('error', function (error) {
-        callback(error);
+        download(BINARIES_URL + build.path, MAX_BUILD_BYTES, (error, body) => {
+            if (error) {
+                callback(error);
+                return;
+            }
+            const keccak = '0x' + (0, js_sha3_1.keccak256)(body);
+            const sha256 = '0x' + (0, crypto_1.createHash)('sha256').update(body).digest('hex');
+            if (keccak !== build.keccak256.toLowerCase() || sha256 !== build.sha256.toLowerCase()) {
+                callback(new Error(`${build.path} does not match the keccak256 and sha256 in list.json, so it was not run.`));
+                return;
+            }
+            let hypc;
+            try {
+                // The source stays referenced so that a fresh instance can be loaded if an exception
+                // unwinds through this one (see wrapper).
+                const source = body.toString('utf8');
+                const load = () => loadModuleSource(source, build.path);
+                hypc = wrapper(load(), load);
+            }
+            catch (e) {
+                callback(e);
+                return;
+            }
+            callback(null, hypc);
+        });
     });
 }
 // Expects a Standard JSON I/O but supports old compilers
@@ -87,12 +362,12 @@ function compileStandardWrapper(compile, inputRaw, readCallback) {
     }
     // Try to wrap around old versions
     if (!(0, helpers_1.isNil)(compile.compileJsonCallback)) {
-        const inputJson = JSON.stringify({ sources: sources });
+        const inputJson = JSON.stringify({ sources });
         const output = compile.compileJsonCallback(inputJson, optimize, readCallback);
         return translateOutput(output, libraries);
     }
     if (!(0, helpers_1.isNil)(compile.compileJsonMulti)) {
-        const output = compile.compileJsonMulti(JSON.stringify({ sources: sources }), optimize);
+        const output = compile.compileJsonMulti(JSON.stringify({ sources }), optimize);
         return translateOutput(output, libraries);
     }
     // Try our luck with an ancient compiler