circuitjson-toolkit 1.2.0 → 1.2.1

package/README.md

@@ -55,6 +55,12 @@ metadata ownership traversals now support deeply nested, valid ECAD documents
 up to 256 levels. See the
 [1.2.0 release notes](docs/release-notes-v1.2.0.md).
 
+Version 1.2.1 keeps large canonical documents and multi-document projects
+inside explicit worker budgets. Selected extensions may contain up to four
+million structured items, while exact project envelopes receive independent
+per-document, project-metadata, aggregate-byte, and repeated-work limits. See
+the [1.2.1 release notes](docs/release-notes-v1.2.1.md).
+
 Before 1.1.0:
 
 ```js
@@ -100,7 +106,7 @@ const model = document.model
 - Strict `ecad-toolkit.worker.v1` parsing/project protocol with progress,
   cancellation, and controlled buffer transfer
 - One-pass ownership for selected source extensions, with a separate 128 MiB /
-  2,000,000-item bound and exact direct/worker result parity
+  4,000,000-item bound and exact direct/worker result parity
 - Machine-readable capability inventory and packed downstream conformance
   harness
 - Explicit `/extensions` surface retaining every previous specialized API
@@ -201,11 +207,14 @@ falls back to direct execution only when worker construction is unavailable;
 explicit worker and runtime failures remain visible.
 
 Selected source-native extensions are captured once into an immutable owned
-snapshot. Their separate 128 MiB payload and 2,000,000-item ceilings permit
-realistic renderer/model graphs without weakening the worker protocol's 250 MB
-total-result ceiling; an over-limit extension fails visibly instead of being
-silently truncated. Binary extension values remain byte-backed and return
-defensive copies instead of expanding into JavaScript number arrays.
+snapshot. Their separate 128 MiB payload and 4,000,000-item ceilings permit
+realistic renderer/model graphs. Canonical standalone documents remain within
+a 250 MB result ceiling, while exact multi-document project envelopes use a
+256 MiB aggregate ceiling plus independent 250 MB per-document and metadata
+ceilings. Item and repeated-alias work budgets remain separately bounded; an
+over-limit extension or result fails visibly instead of being silently
+truncated. Binary extension values remain byte-backed and return defensive
+copies instead of expanding into JavaScript number arrays.
 When extensions are disabled, native documents and projects return the exact
 empty map `{}`. Bounded ZIP consumers can preflight local/central filenames and
 CRC32/size metadata with
@@ -319,6 +328,7 @@ copy while keeping sync, direct async, and worker results mutation-isolated.
 - [1.1.1 release notes](docs/release-notes-v1.1.1.md)
 - [1.1.2 release notes](docs/release-notes-v1.1.2.md)
 - [1.2.0 release notes](docs/release-notes-v1.2.0.md)
+- [1.2.1 release notes](docs/release-notes-v1.2.1.md)
 - [Library scope](spec/library-scope.md)
 
 ## Package scope

package/docs/api.md

@@ -53,12 +53,13 @@ make the common shape smaller.
 
 Validated source documents own selected extension values as one deeply
 immutable, descriptor-safe snapshot. This uses a distinct 128 MiB payload and
-2,000,000-item ceiling so large native renderer graphs do not inherit the
+4,000,000-item ceiling so large native renderer graphs do not inherit the
 compact metadata limit. The shared worker protocol applies the same ownership
-boundary after structured cloning and retains its 250 MB whole-result ceiling.
-Binary values preserve their `ArrayBuffer`/typed-view shape behind defensive
-copy access, so payload bytes do not inflate into one JavaScript number per
-byte.
+boundary after structured cloning. Canonical standalone documents retain a
+250 MB byte ceiling; exact multi-document projects use a 256 MiB aggregate
+ceiling with independent 250 MB document and project-metadata limits. Binary
+values preserve their `ArrayBuffer`/typed-view shape behind defensive copy
+access, so payload bytes do not inflate into one JavaScript number per byte.
 
 ### Errors
 

package/docs/model-format.md

@@ -102,15 +102,19 @@ must not duplicate the CircuitJSON model or keep a renamed renderer model.
 Default parsing excludes raw/base64/full-payload graphs.
 
 When a caller explicitly selects a native extension, the toolkit captures and
-freezes that graph once under a distinct ceiling of 2,000,000 structured items
+freezes that graph once under a distinct ceiling of 4,000,000 structured items
 and 128 MiB of string or binary content. The ceiling is shared across the
-selected namespace, applies equally after worker transfer, and remains below
-the worker's 250 MB whole-result limit. General document metadata keeps its
-smaller budget, so a large native projection cannot consume the canonical
-metadata allowance. Oversized graphs are rejected; they are never truncated or
-partially retained. Binary extension values remain byte-backed with their
-common buffer/view type and are exposed as defensive copies, preserving
-mutation isolation without expanding bytes into plain numeric arrays.
+selected namespace and applies equally after worker transfer. Canonical
+standalone documents allow the extension plus envelope overhead within five
+million result values and 250 MB. Exact project envelopes allow eight million
+aggregate values and 256 MiB, while each document stays within five million
+values and 250 MB and non-document project metadata stays within two million
+values and 250 MB. Reused graphs are charged independently to each local scope,
+and repeated accounting work is itself bounded by the aggregate project
+budget. Oversized graphs are rejected; they are never truncated or partially
+retained. Binary extension values remain byte-backed with their common
+buffer/view type and are exposed as defensive copies, preserving mutation
+isolation without expanding bytes into plain numeric arrays.
 
 Supported pre-union CircuitJSON aliases may be projected through
 `CircuitJsonDocument.normalizeModel()`. The copy-on-write form preserves exact

package/docs/release-notes-v1.2.1.md

@@ -0,0 +1,26 @@
+# circuitjson-toolkit 1.2.1
+
+## Large canonical worker results
+
+This patch release keeps valid high-fidelity documents and multi-document
+projects inside explicit, format-neutral worker limits:
+
+- Selected native extensions may contain up to 4,000,000 structured items and
+  128 MiB of string or binary content.
+- A canonical standalone document may contain up to 5,000,000 result values
+  within the existing 250 MB byte ceiling.
+- An exact canonical project may contain up to 8,000,000 aggregate values and
+  256 MiB, while every document retains its own 5,000,000-value and 250 MB
+  limits.
+- Non-document project metadata retains the generic 2,000,000-value and 250 MB
+  limits.
+
+Elevated budgets require the complete canonical document or project envelope;
+a schema string alone does not change generic result limits. Reused object
+graphs are charged independently to document and project-metadata scopes in a
+property-order-independent way. Repeated alias-accounting work is also capped
+by the project aggregate budget, keeping transport time bounded.
+
+No public class, method, package subpath, parameter, or result field is removed
+or renamed. Oversized results continue to fail visibly rather than being
+truncated.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "circuitjson-toolkit",
-    "version": "1.2.0",
+    "version": "1.2.1",
     "description": "Canonical CircuitJSON parsing, project, rendering, query, manufacturing, simulation, and scene contracts",
     "keywords": [
         "circuitjson",
@@ -54,6 +54,7 @@
         "docs/release-notes-v1.1.1.md",
         "docs/release-notes-v1.1.2.md",
         "docs/release-notes-v1.2.0.md",
+        "docs/release-notes-v1.2.1.md",
         "docs/testing.md",
         "spec",
         "LICENSE",

package/src/core/context/CircuitJsonReadOnlyDocument.mjs

@@ -13,7 +13,7 @@ const METADATA_BUDGETS = new WeakMap()
 const EXTENSION_METADATA_LIMITS = Object.freeze({
     label: 'Canonical extension data',
     maxBytes: 128 * 1024 * 1024,
-    maxItems: 2_000_000,
+    maxItems: 4_000_000,
     preserveBinary: true
 })
 const ASSET_SCALAR_FIELDS = new Set([

package/src/core/worker/WorkerRequestData.mjs

@@ -2,6 +2,7 @@ import { CircuitJsonValidationProof } from '../context/CircuitJsonValidationProo
 import { CircuitJsonReadOnlyDocument } from '../context/CircuitJsonReadOnlyDocument.mjs'
 import { ProtectedExtensionBinaryBoundary } from '../context/ProtectedExtensionBinaryBoundary.mjs'
 import { RuntimeProxyBoundary } from '../contracts/RuntimeProxyBoundary.mjs'
+import { WorkerResultShape } from './WorkerResultShape.mjs'
 
 const ARRAY_BUFFER_BYTE_LENGTH_GETTER = Object.getOwnPropertyDescriptor(
     ArrayBuffer.prototype,
@@ -56,6 +57,11 @@ const MAX_REQUEST_DEPTH = 256
 const MAX_REQUEST_VALUES = 100_000
 const MAX_RESULT_BYTES = 250_000_000
 const MAX_RESULT_VALUES = 2_000_000
+const MAX_DOCUMENT_RESULT_VALUES = 5_000_000
+// Project documents retain the single-result ceiling independently while this
+// aggregate ceiling bounds total worker traversal regardless of document count.
+const MAX_PROJECT_RESULT_VALUES = 8_000_000
+const MAX_PROJECT_RESULT_BYTES = 256 * 1024 * 1024
 const TYPED_ARRAYS = new Map(
     [
         Int8Array,
@@ -166,14 +172,28 @@ export class WorkerRequestData {
         const state = {
             bytes: 0,
             copyBinary: limits.copyBinary,
+            documentAccounted: null,
+            documentBytes: null,
+            documentValues: null,
             maxBytes: limits.bytes,
+            maxDocumentBytes: limits.bytes,
+            maxDocumentValues: MAX_DOCUMENT_RESULT_VALUES,
+            maxUnscopedBytes: limits.bytes,
+            maxUnscopedValues: limits.values,
             maxValues: limits.values,
             output: limits.output,
             prepared: new WeakMap(),
+            projectDocuments: null,
+            projectResult: false,
+            reaccountValues: 0,
             strictDescriptors: limits.strictDescriptors,
             transfer: { items: [], seen: new Set() },
             transferInput: limits.transferInput,
             trustProof: limits.trustProof,
+            unscopedAccounted: null,
+            unscopedBytes: 0,
+            unscopedIncomplete: new WeakSet(),
+            unscopedValues: 0,
             values: 0,
             visiting: new WeakSet()
         }
@@ -223,8 +243,26 @@ export class WorkerRequestData {
         if (state.visiting.has(value)) {
             throw new TypeError('Worker request data must not be cyclic.')
         }
-        if (state.prepared.has(value)) return state.prepared.get(value)
+        if (state.prepared.has(value)) {
+            const accounted = WorkerRequestData.#accountedScope(state)
+            if (accounted && !accounted.has(value)) {
+                WorkerRequestData.#accountPreparedValue(value, state, depth)
+            } else if (
+                accounted === state.unscopedAccounted &&
+                state.unscopedIncomplete.delete(value)
+            ) {
+                // The documents array itself was already charged unscoped.
+                WorkerRequestData.#accountPreparedContainer(
+                    value,
+                    state,
+                    depth,
+                    false
+                )
+            }
+            return state.prepared.get(value)
+        }
         WorkerRequestData.#reserveValues(state, 1)
+        WorkerRequestData.#accountedScope(state)?.add(value)
         state.visiting.add(value)
         try {
             const bufferLength = WorkerRequestData.#bufferLength(value)
@@ -305,18 +343,32 @@ export class WorkerRequestData {
                 'Worker requests may contain only plain data objects.'
             )
         }
-        const keys =
-            state.output && !state.strictDescriptors
-                ? Reflect.ownKeys(descriptors).filter(
-                      (key) =>
-                          typeof key === 'string' && descriptors[key].enumerable
-                  )
-                : Reflect.ownKeys(descriptors)
-        const documentResult =
+        const keys = WorkerResultShape.keys(
+            descriptors,
+            state.output,
+            state.strictDescriptors
+        )
+        const projectResult =
+            depth === 0 &&
+            state.output &&
+            WorkerResultShape.project(descriptors, keys)
+        if (projectResult) {
+            state.maxBytes = MAX_PROJECT_RESULT_BYTES
+            state.maxValues = MAX_PROJECT_RESULT_VALUES
+            state.projectResult = true
+            state.unscopedAccounted = new WeakSet([value])
+            state.unscopedBytes = state.bytes
+            state.unscopedValues = state.values
+        }
+        const canonicalDocumentResult =
+            state.output && WorkerResultShape.document(descriptors, keys)
+        if (depth === 0 && canonicalDocumentResult) {
+            state.maxValues = MAX_DOCUMENT_RESULT_VALUES
+        }
+        const provenDocumentResult =
             state.output &&
             state.trustProof &&
-            WorkerRequestData.#dataValue(descriptors.schema) ===
-                'ecad-toolkit.document.v1' &&
+            canonicalDocumentResult &&
             CircuitJsonValidationProof.has(value)
         WorkerRequestData.#reserveValues(state, keys.length)
         const prepared = prototype === null ? Object.create(null) : {}
@@ -330,13 +382,19 @@ export class WorkerRequestData {
                 configurable: true,
                 enumerable: true,
                 value:
-                    documentResult && key === 'model'
-                        ? WorkerRequestData.#documentModel(descriptors[key])
-                        : WorkerRequestData.#descriptorValue(
+                    projectResult && key === 'documents'
+                        ? WorkerRequestData.#projectDocuments(
                               descriptors[key],
                               state,
                               depth
-                          ),
+                          )
+                        : provenDocumentResult && key === 'model'
+                          ? WorkerRequestData.#documentModel(descriptors[key])
+                          : WorkerRequestData.#descriptorValue(
+                                descriptors[key],
+                                state,
+                                depth
+                            ),
                 writable: true
             })
         }
@@ -353,40 +411,113 @@ export class WorkerRequestData {
      * @returns {any[]} Prepared array.
      */
     static #prepareArray(value, prototype, descriptors, state, depth) {
-        const keys = Reflect.ownKeys(descriptors)
-        const length = WorkerRequestData.#dataValue(descriptors.length)
-        const visibleKeys =
-            state.output && !state.strictDescriptors
-                ? keys.filter(
-                      (key) =>
-                          key !== 'length' &&
-                          typeof key === 'string' &&
-                          descriptors[key].enumerable
+        const length = WorkerResultShape.arrayLength(
+            prototype,
+            descriptors,
+            state.output,
+            state.strictDescriptors
+        )
+        WorkerRequestData.#reserveValues(state, length)
+        const prepared = new Array(length)
+        state.prepared.set(value, prepared)
+        const projectDocuments = state.projectDocuments === value
+        for (let index = 0; index < length; index += 1) {
+            prepared[index] = projectDocuments
+                ? WorkerRequestData.#projectDocument(
+                      descriptors[String(index)],
+                      state,
+                      depth
                   )
-                : keys
-        if (
-            prototype !== Array.prototype ||
-            !Number.isSafeInteger(length) ||
-            length < 0 ||
-            (state.output && !state.strictDescriptors
-                ? visibleKeys.length !== length
-                : keys.length !== length + 1)
-        ) {
+                : WorkerRequestData.#descriptorValue(
+                      descriptors[String(index)],
+                      state,
+                      depth
+                  )
+        }
+        return prepared
+    }
+
+    /** @param {PropertyDescriptor | undefined} descriptor Descriptor. @param {Record<string, any>} state State. @param {number} depth Depth. @returns {unknown} Documents. */
+    static #projectDocuments(descriptor, state, depth) {
+        const value = WorkerRequestData.#descriptorDataValue(descriptor, state)
+        const reused = state.prepared.has(value)
+        state.projectDocuments = value
+        try {
+            const prepared = WorkerRequestData.#prepareValue(
+                value,
+                state,
+                depth + 1
+            )
+            if (reused) {
+                WorkerRequestData.#accountProjectDocuments(
+                    value,
+                    state,
+                    depth + 1
+                )
+            } else {
+                // Descendants were charged only to their document scopes.
+                state.unscopedIncomplete.add(value)
+            }
+            return prepared
+        } finally {
+            state.projectDocuments = null
+        }
+    }
+
+    /** @param {object} value Documents. @param {Record<string, any>} state State. @param {number} depth Depth. @returns {void} */
+    static #accountProjectDocuments(value, state, depth) {
+        let prototype
+        let descriptors
+        try {
+            prototype = Object.getPrototypeOf(value)
+            descriptors = Object.getOwnPropertyDescriptors(value)
+        } catch {
             throw new TypeError(
-                'Worker request arrays must be bounded, dense, and plain.'
+                'Worker request data could not be inspected safely.'
             )
         }
-        WorkerRequestData.#reserveValues(state, length)
-        const prepared = new Array(length)
-        state.prepared.set(value, prepared)
+        const length = WorkerResultShape.arrayLength(
+            prototype,
+            descriptors,
+            state.output,
+            state.strictDescriptors
+        )
         for (let index = 0; index < length; index += 1) {
-            prepared[index] = WorkerRequestData.#descriptorValue(
+            WorkerRequestData.#projectDocument(
                 descriptors[String(index)],
                 state,
                 depth
             )
         }
-        return prepared
+    }
+
+    /**
+     * Prepares one project document under the normal single-result ceiling.
+     * @param {PropertyDescriptor | undefined} descriptor Document descriptor.
+     * @param {Record<string, any>} state Traversal state.
+     * @param {number} depth Parent depth.
+     * @returns {unknown} Prepared document.
+     */
+    static #projectDocument(descriptor, state, depth) {
+        const previousMaxDocumentValues = state.maxDocumentValues
+        const document = WorkerRequestData.#dataValue(descriptor)
+        state.maxDocumentValues = WorkerResultShape.documentCandidate(
+            document,
+            state.strictDescriptors
+        )
+            ? MAX_DOCUMENT_RESULT_VALUES
+            : state.maxUnscopedValues
+        state.documentAccounted = new WeakSet()
+        state.documentBytes = 0
+        state.documentValues = 0
+        try {
+            return WorkerRequestData.#descriptorValue(descriptor, state, depth)
+        } finally {
+            state.documentAccounted = null
+            state.documentBytes = null
+            state.documentValues = null
+            state.maxDocumentValues = previousMaxDocumentValues
+        }
     }
 
     /**
@@ -397,24 +528,30 @@ export class WorkerRequestData {
      * @returns {unknown} Prepared value.
      */
     static #descriptorValue(descriptor, state, depth) {
+        return WorkerRequestData.#prepareValue(
+            WorkerRequestData.#descriptorDataValue(descriptor, state),
+            state,
+            depth + 1
+        )
+    }
+
+    /**
+     * Reads one enumerable descriptor through trusted internal boundaries only.
+     * @param {PropertyDescriptor | undefined} descriptor Descriptor candidate.
+     * @param {Record<string, any>} state Traversal state.
+     * @returns {unknown} Descriptor data value.
+     */
+    static #descriptorDataValue(descriptor, state) {
         if (state.trustProof) {
             const protectedData =
                 CircuitJsonReadOnlyDocument.readProtectedAssetData(descriptor)
             if (protectedData.trusted) {
-                return WorkerRequestData.#prepareValue(
-                    protectedData.value,
-                    state,
-                    depth + 1
-                )
+                return protectedData.value
             }
             const protectedExtensionBinary =
                 ProtectedExtensionBinaryBoundary.read(descriptor)
             if (protectedExtensionBinary.trusted) {
-                return WorkerRequestData.#prepareValue(
-                    protectedExtensionBinary.value,
-                    state,
-                    depth + 1
-                )
+                return protectedExtensionBinary.value
             }
         }
         if (
@@ -426,8 +563,138 @@ export class WorkerRequestData {
                 'Worker requests may contain only enumerable data properties.'
             )
         }
-        return WorkerRequestData.#prepareValue(
-            descriptor.value,
+        return descriptor.value
+    }
+
+    /**
+     * Charges one previously prepared graph to the active project document.
+     * @param {unknown} value Reused prepared value.
+     * @param {Record<string, any>} state Traversal state.
+     * @param {number} depth Container depth.
+     * @returns {void}
+     */
+    static #accountPreparedValue(value, state, depth) {
+        const type = typeof value
+        if (
+            value === null ||
+            ['undefined', 'boolean', 'number', 'bigint'].includes(type)
+        ) {
+            return
+        }
+        if (type === 'string') {
+            WorkerRequestData.#reserveAccountedBytes(state, value.length * 2)
+            return
+        }
+        if (type !== 'object') {
+            throw new TypeError(
+                'Worker requests may contain only clone-safe data.'
+            )
+        }
+        RuntimeProxyBoundary.assert(value, 'Worker request data')
+        if (depth > MAX_REQUEST_DEPTH) {
+            throw new TypeError('Worker request data is nested too deeply.')
+        }
+        const accounted = WorkerRequestData.#accountedScope(state)
+        if (accounted.has(value)) return
+        accounted.add(value)
+        WorkerRequestData.#reserveAccountedValues(state, 1)
+        const bufferLength = WorkerRequestData.#bufferLength(value)
+        if (bufferLength !== null) {
+            WorkerRequestData.#reserveAccountedBytes(state, bufferLength)
+            return
+        }
+        const sharedLength = WorkerRequestData.#sharedBufferLength(value)
+        if (sharedLength !== null) {
+            WorkerRequestData.#reserveAccountedBytes(state, sharedLength)
+            return
+        }
+        const view = WorkerRequestData.#view(value)
+        if (view) {
+            WorkerRequestData.#reserveAccountedBytes(state, view.byteLength)
+            return
+        }
+        WorkerRequestData.#accountPreparedContainer(value, state, depth)
+    }
+
+    /** @param {object} value Container. @param {Record<string, any>} state State. @param {number} depth Depth. @param {boolean} [accountEntries] Whether to charge its own entries. @returns {void} */
+    static #accountPreparedContainer(
+        value,
+        state,
+        depth,
+        accountEntries = true
+    ) {
+        let prototype
+        let descriptors
+        try {
+            prototype = Object.getPrototypeOf(value)
+            descriptors = Object.getOwnPropertyDescriptors(value)
+        } catch {
+            throw new TypeError(
+                'Worker request data could not be inspected safely.'
+            )
+        }
+        if (Array.isArray(value)) {
+            const length = WorkerResultShape.arrayLength(
+                prototype,
+                descriptors,
+                state.output,
+                state.strictDescriptors
+            )
+            if (accountEntries) {
+                WorkerRequestData.#reserveAccountedValues(state, length)
+            }
+            for (let index = 0; index < length; index += 1) {
+                WorkerRequestData.#accountDescriptor(
+                    descriptors[String(index)],
+                    state,
+                    depth
+                )
+            }
+            return
+        }
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError(
+                'Worker requests may contain only plain data objects.'
+            )
+        }
+        const keys = WorkerResultShape.keys(
+            descriptors,
+            state.output,
+            state.strictDescriptors
+        )
+        const provenDocumentResult =
+            state.output &&
+            state.trustProof &&
+            WorkerResultShape.document(descriptors, keys) &&
+            CircuitJsonValidationProof.has(value)
+        if (accountEntries) {
+            WorkerRequestData.#reserveAccountedValues(state, keys.length)
+        }
+        for (const key of keys) {
+            if (typeof key !== 'string') {
+                throw new TypeError('Worker request keys must be strings.')
+            }
+            WorkerRequestData.#reserveAccountedBytes(state, key.length * 2)
+            if (!(provenDocumentResult && key === 'model')) {
+                WorkerRequestData.#accountDescriptor(
+                    descriptors[key],
+                    state,
+                    depth
+                )
+            }
+        }
+    }
+
+    /**
+     * Charges one reused descriptor to the active document.
+     * @param {PropertyDescriptor | undefined} descriptor Descriptor candidate.
+     * @param {Record<string, any>} state Traversal state.
+     * @param {number} depth Parent depth.
+     * @returns {void}
+     */
+    static #accountDescriptor(descriptor, state, depth) {
+        WorkerRequestData.#accountPreparedValue(
+            WorkerRequestData.#descriptorDataValue(descriptor, state),
             state,
             depth + 1
         )
@@ -624,27 +891,106 @@ export class WorkerRequestData {
         transfer.items.push(value)
     }
 
-    /** @param {{ bytes: number }} state State. @param {number} count Bytes. */
+    /** @param {Record<string, any>} state State. @returns {WeakSet<object> | null} Active identities. */
+    static #accountedScope(state) {
+        if (state.documentAccounted) return state.documentAccounted
+        return state.projectResult ? state.unscopedAccounted : null
+    }
+
+    /** @param {{ documentBytes: number | null, maxDocumentBytes: number, maxUnscopedBytes: number, projectResult: boolean, unscopedBytes: number }} state State. @param {number} count Bytes. */
+    static #reserveAccountedBytes(state, count) {
+        const invalid = !Number.isSafeInteger(count) || count < 0
+        if (state.documentBytes !== null) {
+            if (
+                invalid ||
+                state.documentBytes + count > state.maxDocumentBytes
+            ) {
+                throw new TypeError(
+                    'Worker request data exceeds its byte limit.'
+                )
+            }
+            state.documentBytes += count
+            return
+        }
+        if (
+            invalid ||
+            !state.projectResult ||
+            state.unscopedBytes + count > state.maxUnscopedBytes
+        ) {
+            throw new TypeError('Worker request data exceeds its byte limit.')
+        }
+        state.unscopedBytes += count
+    }
+
+    /** @param {{ documentValues: number | null, maxDocumentValues: number, maxUnscopedValues: number, maxValues: number, projectResult: boolean, reaccountValues: number, unscopedValues: number }} state State. @param {number} count Values. */
+    static #reserveAccountedValues(state, count) {
+        const invalid =
+            !Number.isSafeInteger(count) ||
+            count < 0 ||
+            state.reaccountValues + count > state.maxValues
+        if (state.documentValues !== null) {
+            if (
+                invalid ||
+                state.documentValues + count > state.maxDocumentValues
+            ) {
+                throw new TypeError('Worker request data is too large.')
+            }
+            state.documentValues += count
+            state.reaccountValues += count
+            return
+        }
+        if (
+            invalid ||
+            !state.projectResult ||
+            state.unscopedValues + count > state.maxUnscopedValues
+        ) {
+            throw new TypeError('Worker request data is too large.')
+        }
+        state.unscopedValues += count
+        state.reaccountValues += count
+    }
+
+    /** @param {{ bytes: number, documentBytes: number | null, maxBytes: number, maxDocumentBytes: number, maxUnscopedBytes: number, projectResult: boolean, unscopedBytes: number }} state State. @param {number} count Bytes. */
     static #reserveBytes(state, count) {
+        const documentBytes = state.documentBytes
         if (
             !Number.isSafeInteger(count) ||
             count < 0 ||
-            state.bytes + count > state.maxBytes
+            state.bytes + count > state.maxBytes ||
+            (documentBytes !== null
+                ? documentBytes + count > state.maxDocumentBytes
+                : state.projectResult &&
+                  state.unscopedBytes + count > state.maxUnscopedBytes)
         ) {
             throw new TypeError('Worker request data exceeds its byte limit.')
         }
         state.bytes += count
+        if (documentBytes !== null) {
+            state.documentBytes += count
+        } else if (state.projectResult) {
+            state.unscopedBytes += count
+        }
     }
 
-    /** @param {{ values: number }} state State. @param {number} count Values. */
+    /** @param {{ documentValues: number | null, maxDocumentValues: number, maxUnscopedValues: number, maxValues: number, projectResult: boolean, unscopedValues: number, values: number }} state State. @param {number} count Values. */
     static #reserveValues(state, count) {
+        const documentValues = state.documentValues
         if (
             !Number.isSafeInteger(count) ||
             count < 0 ||
-            state.values + count > state.maxValues
+            state.values + count > state.maxValues ||
+            (documentValues !== null
+                ? documentValues + count > state.maxDocumentValues
+                : state.projectResult &&
+                  state.unscopedValues + count > state.maxUnscopedValues)
         ) {
             throw new TypeError('Worker request data is too large.')
         }
         state.values += count
+        if (documentValues !== null) {
+            state.documentValues += count
+        } else if (state.projectResult) {
+            state.unscopedValues += count
+        }
     }
 }

package/src/core/worker/WorkerResultShape.mjs

@@ -0,0 +1,222 @@
+import { RuntimeProxyBoundary } from '../contracts/RuntimeProxyBoundary.mjs'
+
+const DOCUMENT_FIELDS = Object.freeze([
+    'schema',
+    'id',
+    'modelSchema',
+    'model',
+    'source',
+    'extensions',
+    'assets',
+    'diagnostics',
+    'statistics'
+])
+const PROJECT_FIELDS = Object.freeze([
+    'schema',
+    'id',
+    'source',
+    'documents',
+    'project',
+    'extensions',
+    'assets',
+    'diagnostics',
+    'statistics'
+])
+
+/**
+ * Classifies canonical result envelopes through data descriptors only.
+ */
+export class WorkerResultShape {
+    /**
+     * Selects the exact property set traversed for one result container.
+     * @param {Record<string, PropertyDescriptor>} descriptors Descriptors.
+     * @param {boolean} output Whether result-output rules apply.
+     * @param {boolean} strictDescriptors Whether hidden properties are traversed.
+     * @returns {PropertyKey[]} Traversed keys.
+     */
+    static keys(descriptors, output, strictDescriptors) {
+        return output && !strictDescriptors
+            ? Reflect.ownKeys(descriptors).filter(
+                  (key) =>
+                      typeof key === 'string' && descriptors[key].enumerable
+              )
+            : Reflect.ownKeys(descriptors)
+    }
+
+    /**
+     * Validates a dense plain array and returns its captured length.
+     * @param {object | null} prototype Array prototype.
+     * @param {Record<string, PropertyDescriptor>} descriptors Descriptors.
+     * @param {boolean} output Whether result-output rules apply.
+     * @param {boolean} strictDescriptors Whether hidden properties are traversed.
+     * @returns {number} Dense array length.
+     */
+    static arrayLength(prototype, descriptors, output, strictDescriptors) {
+        const keys = Reflect.ownKeys(descriptors)
+        const length = WorkerResultShape.#value(descriptors.length)
+        const visibleKeys =
+            output && !strictDescriptors
+                ? keys.filter(
+                      (key) =>
+                          key !== 'length' &&
+                          typeof key === 'string' &&
+                          descriptors[key].enumerable
+                  )
+                : keys
+        if (
+            prototype !== Array.prototype ||
+            !Number.isSafeInteger(length) ||
+            length < 0 ||
+            (output && !strictDescriptors
+                ? visibleKeys.length !== length
+                : keys.length !== length + 1)
+        ) {
+            throw new TypeError(
+                'Worker request arrays must be bounded, dense, and plain.'
+            )
+        }
+        return length
+    }
+
+    /**
+     * Tests one already-inspected canonical document envelope.
+     * @param {Record<string, PropertyDescriptor>} descriptors Descriptors.
+     * @param {PropertyKey[]} keys Traversed keys.
+     * @returns {boolean} Whether the exact structural document shape matches.
+     */
+    static document(descriptors, keys) {
+        if (
+            !WorkerResultShape.#exactDataFields(
+                descriptors,
+                keys,
+                DOCUMENT_FIELDS
+            )
+        ) {
+            return false
+        }
+        return (
+            WorkerResultShape.#value(descriptors.schema) ===
+                'ecad-toolkit.document.v1' &&
+            typeof WorkerResultShape.#value(descriptors.id) === 'string' &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.modelSchema)
+            ) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.model)) &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.source)
+            ) &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.extensions)
+            ) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.assets)) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.diagnostics)) &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.statistics)
+            )
+        )
+    }
+
+    /**
+     * Tests one already-inspected canonical project envelope.
+     * @param {Record<string, PropertyDescriptor>} descriptors Descriptors.
+     * @param {PropertyKey[]} keys Traversed keys.
+     * @returns {boolean} Whether the exact structural project shape matches.
+     */
+    static project(descriptors, keys) {
+        if (
+            !WorkerResultShape.#exactDataFields(
+                descriptors,
+                keys,
+                PROJECT_FIELDS
+            )
+        ) {
+            return false
+        }
+        const project = WorkerResultShape.#value(descriptors.project)
+        return (
+            WorkerResultShape.#value(descriptors.schema) ===
+                'ecad-toolkit.project.v1' &&
+            typeof WorkerResultShape.#value(descriptors.id) === 'string' &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.source)
+            ) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.documents)) &&
+            (project === null || WorkerResultShape.#record(project)) &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.extensions)
+            ) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.assets)) &&
+            Array.isArray(WorkerResultShape.#value(descriptors.diagnostics)) &&
+            WorkerResultShape.#record(
+                WorkerResultShape.#value(descriptors.statistics)
+            )
+        )
+    }
+
+    /**
+     * Inspects a nested project document without reading accessor values.
+     * @param {unknown} value Candidate document.
+     * @param {boolean} strictDescriptors Whether hidden properties are traversed.
+     * @returns {boolean} Whether the exact structural document shape matches.
+     */
+    static documentCandidate(value, strictDescriptors) {
+        if (!WorkerResultShape.#record(value)) return false
+        RuntimeProxyBoundary.assert(value, 'Worker request data')
+        let prototype
+        let descriptors
+        try {
+            prototype = Object.getPrototypeOf(value)
+            descriptors = Object.getOwnPropertyDescriptors(value)
+        } catch {
+            return false
+        }
+        if (prototype !== Object.prototype && prototype !== null) return false
+        const keys = WorkerResultShape.keys(
+            descriptors,
+            true,
+            strictDescriptors
+        )
+        return WorkerResultShape.document(descriptors, keys)
+    }
+
+    /**
+     * Requires the exact enumerable own data field set.
+     * @param {Record<string, PropertyDescriptor>} descriptors Descriptors.
+     * @param {PropertyKey[]} keys Traversed keys.
+     * @param {string[]} fields Expected fields.
+     * @returns {boolean} Whether the field set matches.
+     */
+    static #exactDataFields(descriptors, keys, fields) {
+        if (
+            keys.length !== fields.length ||
+            keys.some((key) => typeof key !== 'string' || !fields.includes(key))
+        ) {
+            return false
+        }
+        return fields.every((field) => {
+            const descriptor = descriptors[field]
+            return Boolean(
+                descriptor &&
+                descriptor.enumerable === true &&
+                Object.hasOwn(descriptor, 'value')
+            )
+        })
+    }
+
+    /** @param {unknown} value Candidate. @returns {boolean} Whether value is record-shaped. */
+    static #record(value) {
+        return (
+            value !== null && typeof value === 'object' && !Array.isArray(value)
+        )
+    }
+
+    /** @param {PropertyDescriptor | undefined} descriptor Descriptor. @returns {unknown} Data value. */
+    static #value(descriptor) {
+        return descriptor && Object.hasOwn(descriptor, 'value')
+            ? descriptor.value
+            : undefined
+    }
+}
+
+Object.freeze(WorkerResultShape.prototype)
+Object.freeze(WorkerResultShape)