llm-chess-mcp 0.4.8 → 0.4.10

package/.env.example

@@ -5,5 +5,5 @@ LICHESS_TOKEN=
 # The published package bundles only Maia3 5m (~20 MB). Leave at 5m.
 MAIA3_MODEL=5m
 
-# Stockfish flavor: lite-single (default, ~7MB) | lite | single | full
+# Stockfish flavor: lite-single (default, ~7MB) | single-lite | lite | single | full | asm
 STOCKFISH_FLAVOR=lite-single

package/README.md

@@ -264,7 +264,10 @@ rejected:
 
 - Up to 1,000 games are retained per process; idle games expire after one hour.
 - `move_evaluate` accepts at most 10 moves per call.
-- Imported PGNs are limited to 1 MiB and 4,096 plies.
+- Imported PGNs are limited to 1 MiB, 256 headers, and 4,096 plies across the
+  mainline and variations, plus 32,768 structural elements and 16 KiB per
+  lexical token. Every variation is legality-checked; game state retains the
+  mainline. UTF-8 BOMs and standard escaped header values are supported.
 - Custom FENs reject inconsistent castling/en-passant metadata and impossible
   pawn or promotion material.
 - Stockfish accepts up to 32 active or queued analyses.

package/dist/chess-copy.js

@@ -5,9 +5,75 @@ const ORIGINAL_PIECES = {
     r: 2,
     n: 2,
 };
+const CANONICAL_PGN_HEADERS = new Map([
+    "Event",
+    "Site",
+    "Date",
+    "Round",
+    "White",
+    "Black",
+    "Result",
+    "SetUp",
+    "FEN",
+].map((name) => [name.toLowerCase(), name]));
+function restoreHeaders(chess, sourceHeaders) {
+    const sourceNames = new Set(sourceHeaders.map(([key]) => key.toLowerCase()));
+    for (const key of Object.keys(chess.getHeaders())) {
+        if (!sourceNames.has(key.toLowerCase()))
+            chess.removeHeader(key);
+    }
+    const names = new Map();
+    for (const key of Object.keys(chess.getHeaders())) {
+        const existing = names.get(key.toLowerCase());
+        if (existing)
+            existing.push(key);
+        else
+            names.set(key.toLowerCase(), [key]);
+    }
+    for (const [key, value] of sourceHeaders) {
+        const lower = key.toLowerCase();
+        const canonical = CANONICAL_PGN_HEADERS.get(lower) ?? key;
+        for (const existing of names.get(lower) ?? []) {
+            if (existing !== canonical)
+                chess.removeHeader(existing);
+        }
+        chess.setHeader(canonical, value);
+        names.set(lower, [canonical]);
+    }
+}
 function squareColor(square) {
     return ((square.charCodeAt(0) - 97 + Number(square[1])) % 2);
 }
+function minimumPawnCaptures(chess, color) {
+    const pawns = chess
+        .findPiece({ type: "p", color })
+        .map((square) => ({
+        advances: color === "w" ? Number(square[1]) - 2 : 7 - Number(square[1]),
+        file: square.charCodeAt(0) - 97,
+    }))
+        .sort((left, right) => left.file - right.file);
+    let costs = new Map([[0, 0]]);
+    for (const pawn of pawns) {
+        const next = new Map();
+        for (const [mask, cost] of costs) {
+            for (let original = 0; original < 8; original += 1) {
+                const bit = 1 << original;
+                if (mask & bit)
+                    continue;
+                const captures = Math.abs(original - pawn.file);
+                if (captures > pawn.advances)
+                    continue;
+                const nextMask = mask | bit;
+                next.set(nextMask, Math.min(next.get(nextMask) ?? Infinity, cost + captures));
+            }
+        }
+        costs = next;
+    }
+    return Math.min(...costs.values());
+}
+function nonKingMaterial(chess, color) {
+    return ["p", "q", "r", "b", "n"].reduce((total, type) => total + chess.findPiece({ type, color }).length, 0);
+}
 function hasPiece(chess, square, type, color) {
     const piece = chess.get(square);
     return piece?.type === type && piece.color === color;
@@ -92,6 +158,14 @@ export function assertLegalPosition(chess) {
             throw new ChessError("INVALID_FEN", "FEN contains more promoted material than missing pawns allow");
         }
         assertCastlingPosition(chess, color);
+        const opponent = color === "w" ? "b" : "w";
+        const opponentPawns = chess.findPiece({ type: "p", color: opponent }).length;
+        const missingOpponentMaterial = 15 - nonKingMaterial(chess, opponent);
+        const possibleOpponentPromotions = 8 - opponentPawns;
+        if (minimumPawnCaptures(chess, color) >
+            missingOpponentMaterial + possibleOpponentPromotions) {
+            throw new ChessError("INVALID_FEN", "FEN pawn files require more captures than opposing material allows");
+        }
     }
     assertEnPassantPosition(chess);
     const turn = chess.turn();
@@ -107,14 +181,31 @@ export function snapshotChess(chess) {
     const initialFen = history[0]?.before ?? chess.fen();
     assertSafeFenCounters(initialFen);
     const snapshot = new Chess(initialFen);
-    const comments = new Map(chess.getComments().map(({ fen, comment }) => [fen, comment]));
-    for (const [key, value] of Object.entries(chess.getHeaders())) {
-        snapshot.setHeader(key, value);
+    assertLegalPosition(snapshot);
+    const comments = new Map(chess.getComments().map(({ fen, comment }) => [
+        fen,
+        /[{}]/.test(comment) ? comment.replace(/[\r\n]+/g, " ") : comment,
+    ]));
+    const sourceHeaders = Object.entries(chess.getHeaders());
+    const unsafeComments = [...comments.values()].some((comment) => /[{}]/.test(comment));
+    let markerPrefix = "\uE000";
+    if (unsafeComments) {
+        const occupied = [...sourceHeaders.flat(), ...comments.values()].join("\u0000");
+        while (occupied.includes(markerPrefix))
+            markerPrefix += "\uE001";
     }
+    const markerComments = [];
     const restoreComment = () => {
         const comment = comments.get(snapshot.fen());
-        if (comment !== undefined)
+        if (comment === undefined)
+            return;
+        if (!unsafeComments || !/[{}]/.test(comment)) {
             snapshot.setComment(comment);
+            return;
+        }
+        const marker = `${markerPrefix}${markerComments.length}${markerPrefix}`;
+        markerComments.push(comment);
+        snapshot.setComment(marker);
     };
     restoreComment();
     for (const move of history) {
@@ -122,5 +213,31 @@ export function snapshotChess(chess) {
         restoreComment();
     }
     assertSafeFenCounters(snapshot.fen());
-    return snapshot;
+    if (!unsafeComments) {
+        restoreHeaders(snapshot, sourceHeaders);
+        return snapshot;
+    }
+    const escapedPrefix = markerPrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const marker = new RegExp(`\\{${escapedPrefix}(\\d+)${escapedPrefix}\\}`, "g");
+    const pgn = snapshot.pgn().replace(marker, (_match, index) => {
+        return `;${markerComments[Number(index)]}\n`;
+    });
+    const restored = new Chess();
+    restored.loadPgn(pgn);
+    const restoredHistory = restored.history({ verbose: true });
+    while (restored.undo()) { }
+    const restoreSafeComment = () => {
+        const comment = comments.get(restored.fen());
+        if (comment !== undefined && !/[{}]/.test(comment)) {
+            restored.setComment(comment);
+        }
+    };
+    restoreSafeComment();
+    for (const move of restoredHistory) {
+        restored.move(moveDescriptor(move));
+        restoreSafeComment();
+    }
+    restoreHeaders(restored, sourceHeaders);
+    assertSafeFenCounters(restored.fen());
+    return restored;
 }

package/dist/chess.d.ts

@@ -1,7 +1,7 @@
 import { Chess } from "chess.js";
 import type { Move } from "chess.js";
 export { assertLegalPosition, assertSafeFenCounters, snapshotChess, } from "./chess-copy.js";
-export { MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, pgnOf } from "./pgn.js";
+export { MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, pgnOf, } from "./pgn.js";
 import type { ChessState, DrawResult } from "./domain.js";
 export declare const MAX_EVALUATED_MOVES = 10;
 export declare function drawResult(chess: Chess): DrawResult | null;

package/dist/chess.js

@@ -1,6 +1,6 @@
 import { Chess } from "chess.js";
 export { assertLegalPosition, assertSafeFenCounters, snapshotChess, } from "./chess-copy.js";
-export { MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, pgnOf } from "./pgn.js";
+export { MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, pgnOf, } from "./pgn.js";
 import { ChessError } from "./errors.js";
 export const MAX_EVALUATED_MOVES = 10;
 function moveDescriptor(move) {

package/dist/engines/stockfish.js

@@ -19,6 +19,7 @@ const DEFAULT_TIMEOUTS = {
     stopGrace: 2000,
 };
 const DEFAULT_MAX_QUEUE = 32;
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export function resolveStockfishFlavor(value) {
     const normalized = (value || DEFAULT_FLAVOR).toLowerCase();
     if (!FLAVORS.has(normalized)) {
@@ -56,6 +57,22 @@ function asError(error) {
 function abortError(signal) {
     return asError(signal.reason ?? "stockfish request cancelled");
 }
+function ownOption(options, name) {
+    return Object.hasOwn(options, name) ? options[name] : undefined;
+}
+function mergeTimeouts(value) {
+    if (value === undefined)
+        return { ...DEFAULT_TIMEOUTS };
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("stockfish timeouts must be an object");
+    }
+    const timeouts = { ...DEFAULT_TIMEOUTS };
+    for (const name of Object.keys(DEFAULT_TIMEOUTS)) {
+        if (Object.hasOwn(value, name))
+            timeouts[name] = value[name];
+    }
+    return timeouts;
+}
 export class Stockfish {
     session = null;
     queue = [];
@@ -74,16 +91,18 @@ export class Stockfish {
     maxQueue;
     timeouts;
     constructor(options = {}) {
-        this.initEngine = options.init;
-        this.configuredFlavor = options.flavor;
-        this.maxQueue = options.maxQueue ?? DEFAULT_MAX_QUEUE;
-        this.timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
+        this.initEngine = ownOption(options, "init");
+        this.configuredFlavor = ownOption(options, "flavor");
+        this.maxQueue = ownOption(options, "maxQueue") ?? DEFAULT_MAX_QUEUE;
+        this.timeouts = mergeTimeouts(ownOption(options, "timeouts"));
         if (!Number.isInteger(this.maxQueue) || this.maxQueue < 1) {
             throw new Error("stockfish maxQueue must be a positive integer");
         }
         for (const [name, timeout] of Object.entries(this.timeouts)) {
-            if (!Number.isFinite(timeout) || timeout < 1) {
-                throw new Error(`stockfish ${name} timeout must be positive`);
+            if (!Number.isSafeInteger(timeout) ||
+                timeout < 1 ||
+                timeout > MAX_TIMER_DELAY_MS) {
+                throw new Error(`stockfish ${name} timeout must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS}`);
             }
         }
     }
@@ -113,7 +132,9 @@ export class Stockfish {
             const engine = (this.initEngine ?? loadStockfish())(selectedFlavor, (error, initializedEngine) => {
                 callbackCalled = true;
                 if (this.session !== session) {
-                    this.terminate(initializedEngine);
+                    if (initializedEngine !== this.session?.engine) {
+                        this.terminate(initializedEngine);
+                    }
                     return;
                 }
                 if (session.readySettled) {
@@ -121,8 +142,21 @@ export class Stockfish {
                         this.terminate(initializedEngine);
                     return;
                 }
-                if (session.engine && session.engine !== initializedEngine) {
-                    this.terminate(session.engine);
+                if (this.terminations.has(initializedEngine)) {
+                    this.failSession(session, new Error("stockfish initializer reused a terminated engine"));
+                    return;
+                }
+                const replacedEngine = session.engine;
+                if (replacedEngine && replacedEngine !== initializedEngine) {
+                    this.terminate(replacedEngine);
+                    if (this.session !== session ||
+                        session.readySettled ||
+                        session.engine !== replacedEngine) {
+                        if (initializedEngine !== this.session?.engine) {
+                            this.terminate(initializedEngine);
+                        }
+                        return;
+                    }
                 }
                 session.engine = initializedEngine;
                 if (error) {
@@ -141,12 +175,21 @@ export class Stockfish {
                 }, (handshakeError) => this.failSession(session, asError(handshakeError)));
             });
             if (callbackCalled) {
-                if (engine !== session.engine)
+                if (engine !== session.engine && engine !== this.session?.engine) {
                     this.terminate(engine);
+                }
             }
             else if (this.session === session && !session.readySettled) {
-                session.engine = engine;
-                engine.listener = () => { };
+                if (this.terminations.has(engine)) {
+                    this.failSession(session, new Error("stockfish initializer reused a terminated engine"));
+                }
+                else {
+                    session.engine = engine;
+                    engine.listener = () => { };
+                }
+            }
+            else if (engine !== this.session?.engine) {
+                this.terminate(engine);
             }
         }
         catch (error) {

package/dist/explorer-core.d.ts

@@ -10,6 +10,7 @@ export declare const EXPLORER_RATE_LIMIT_COOLDOWN_MS = 60000;
 export declare const EXPLORER_MAX_RESPONSE_BYTES: number;
 export declare const EXPLORER_MAX_MOVES = 256;
 export declare const EXPLORER_MAX_STRING_LENGTH = 256;
+export declare const EXPLORER_MAX_COOLDOWN_MS = 2147483647;
 export declare class ExplorerError extends Error {
     readonly kind: ExplorerErrorKind;
     readonly status?: number | undefined;

package/dist/explorer-core.js

@@ -8,6 +8,7 @@ export const EXPLORER_RATE_LIMIT_COOLDOWN_MS = 60_000;
 export const EXPLORER_MAX_RESPONSE_BYTES = 1024 * 1024;
 export const EXPLORER_MAX_MOVES = 256;
 export const EXPLORER_MAX_STRING_LENGTH = 256;
+export const EXPLORER_MAX_COOLDOWN_MS = 2_147_483_647;
 export class ExplorerError extends Error {
     kind;
     status;

package/dist/explorer-limiter.d.ts

@@ -1,3 +1,5 @@
+import type { ExplorerError } from "./explorer-core.js";
+export declare function isExplorerCooldownError(error: ExplorerError): boolean;
 export interface ExplorerLimiterOptions {
     callerSignal: AbortSignal | undefined;
     deadline: number;

package/dist/explorer-limiter.js

@@ -1,8 +1,18 @@
-import { awaitWithAbort, explorerError, throwIfAborted, } from "./explorer-core.js";
+import { awaitWithAbort, explorerError, EXPLORER_MAX_COOLDOWN_MS, throwIfAborted, } from "./explorer-core.js";
+const cooldownErrors = new WeakSet();
+function cooldownError() {
+    const error = explorerError("rate_limited");
+    cooldownErrors.add(error);
+    return error;
+}
+export function isExplorerCooldownError(error) {
+    return cooldownErrors.has(error);
+}
 class RequestLimiter {
     now;
     #active = false;
-    #cooldownUntil = 0;
+    #cooldownUntil;
+    #lastNow;
     #queue = [];
     constructor(now) {
         this.now = now;
@@ -11,7 +21,22 @@ class RequestLimiter {
         return this.#queue.length;
     }
     cooldown(ms, _now) {
-        this.#cooldownUntil = Math.max(this.#cooldownUntil, this.now() + ms);
+        if (!Number.isSafeInteger(ms) ||
+            ms < 0 ||
+            ms > EXPLORER_MAX_COOLDOWN_MS) {
+            throw explorerError("invalid_input");
+        }
+        const now = this.#readNow();
+        const cooldownUntil = now + ms;
+        if (!Number.isFinite(cooldownUntil) ||
+            Math.abs(cooldownUntil) > Number.MAX_SAFE_INTEGER ||
+            (ms > 0 && cooldownUntil <= now)) {
+            throw explorerError("invalid_input");
+        }
+        this.#cooldownUntil =
+            this.#cooldownUntil === undefined
+                ? cooldownUntil
+                : Math.max(this.#cooldownUntil, cooldownUntil);
     }
     run(options, request) {
         throwIfAborted(options.callerSignal);
@@ -66,18 +91,34 @@ class RequestLimiter {
         waiter.start();
     }
     #waitForCooldown(options) {
+        const now = this.#readNow();
         const cooldownUntil = this.#cooldownUntil;
-        const delay = cooldownUntil - this.now();
+        if (cooldownUntil === undefined)
+            return;
+        const delay = Math.ceil(cooldownUntil - now);
         if (delay <= 0)
             return;
         if (delay >= options.deadline - options.now()) {
-            throw explorerError("rate_limited");
+            throw cooldownError();
         }
         return awaitWithAbort(options.callerSignal, () => options.sleep(delay)).then(() => {
-            if (this.#cooldownUntil === cooldownUntil)
-                this.#cooldownUntil = 0;
+            const now = this.#readNow();
+            if (this.#cooldownUntil !== undefined && this.#cooldownUntil > now) {
+                throw cooldownError();
+            }
+            this.#cooldownUntil = undefined;
         });
     }
+    #readNow() {
+        const now = this.now();
+        if (!Number.isFinite(now) ||
+            Math.abs(now) > Number.MAX_SAFE_INTEGER ||
+            (this.#lastNow !== undefined && now < this.#lastNow)) {
+            throw explorerError("invalid_input");
+        }
+        this.#lastNow = now;
+        return now;
+    }
 }
 export function createExplorerLimiter(now = () => performance.now()) {
     return new RequestLimiter(now);

package/dist/explorer-response.js

@@ -118,6 +118,9 @@ export async function normalizeExplorerResponse(response, signal, options) {
         if (ucis.has(move.uci) || options.legalMoves.get(move.uci) !== move.san) {
             throw explorerError("invalid_response");
         }
+        if (sumCounts(move.white, move.draws, move.black) === 0) {
+            throw explorerError("invalid_response");
+        }
         ucis.add(move.uci);
         white = sumCounts(white, move.white);
         draws = sumCounts(draws, move.draws);

package/dist/explorer-retry.js

@@ -1,4 +1,5 @@
-import { awaitWithAbort, explorerError, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_RATE_LIMIT_COOLDOWN_MS, } from "./explorer-core.js";
+import { awaitWithAbort, explorerError, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_RATE_LIMIT_COOLDOWN_MS, } from "./explorer-core.js";
+import { isExplorerCooldownError } from "./explorer-limiter.js";
 const SHORT_WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 const LONG_WEEKDAYS = [
     "Sunday",
@@ -25,7 +26,7 @@ const MONTHS = [
 ];
 const IMF_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
 const RFC850_DATE = /^(Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
-const ASCTIME_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|[12]\d|3[01]) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
+const ASCTIME_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|0[1-9]|[12]\d|3[01]) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
 function httpDate(weekday, year, month, day, hour, minute, second) {
     const date = new Date(0);
     date.setUTCFullYear(year, month, day);
@@ -100,10 +101,10 @@ export function retryAfterMs(value, now) {
     return parseRetryAfterMs(value, now) ?? EXPLORER_DEFAULT_RETRY_DELAY_MS;
 }
 export function rateLimitCooldownMs(value, now) {
-    if (value === null || value.trim() === "") {
-        return EXPLORER_RATE_LIMIT_COOLDOWN_MS;
-    }
-    return parseRetryAfterMs(value, now) ?? EXPLORER_RATE_LIMIT_COOLDOWN_MS;
+    const delay = value === null || value.trim() === ""
+        ? EXPLORER_RATE_LIMIT_COOLDOWN_MS
+        : (parseRetryAfterMs(value, now) ?? EXPLORER_RATE_LIMIT_COOLDOWN_MS);
+    return Math.min(delay, EXPLORER_MAX_COOLDOWN_MS);
 }
 async function waitForRetry(options, delay, originalError) {
     if (delay >= options.deadline - options.now())
@@ -118,7 +119,12 @@ export async function retryExplorer(options, attemptRequest) {
         const outcome = await attemptRequest();
         if (outcome.type === "success")
             return outcome.result;
-        lastError = outcome.error;
+        lastError =
+            isExplorerCooldownError(outcome.error) &&
+                lastError?.kind === "rate_limited" &&
+                lastError.status !== undefined
+                ? lastError
+                : outcome.error;
         if (outcome.retry === "stop" || attempt + 1 >= options.maxAttempts) {
             throw lastError;
         }

package/dist/explorer.d.ts

@@ -1,10 +1,10 @@
 import { Chess } from "chess.js";
 import { z } from "zod/v4";
-import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError } from "./explorer-core.js";
+import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError } from "./explorer-core.js";
 import type { ExplorerErrorKind, ExplorerFetch, ExplorerResult } from "./explorer-core.js";
 import { createExplorerLimiter } from "./explorer-limiter.js";
 import type { ExplorerLimiter, ExplorerLimiterOptions } from "./explorer-limiter.js";
-export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
+export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
 export type { ExplorerErrorKind, ExplorerFetch, ExplorerLimiter, ExplorerLimiterOptions, ExplorerResult, };
 export declare const LICHESS_SPEEDS: readonly ["ultraBullet", "bullet", "blitz", "rapid", "classical", "correspondence"];
 export declare const LICHESS_RATINGS: readonly [0, 1000, 1200, 1400, 1600, 1800, 2000, 2200, 2500];

package/dist/explorer.js

@@ -1,11 +1,11 @@
 import { z } from "zod/v4";
-import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, explorerError, throwIfAborted, } from "./explorer-core.js";
+import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, explorerError, throwIfAborted, } from "./explorer-core.js";
 import { createExplorerLimiter } from "./explorer-limiter.js";
 import { normalizeExplorerResponse } from "./explorer-response.js";
 import { rateLimitCooldownMs, retryAfterMs, retryExplorer, } from "./explorer-retry.js";
 import { requestExplorerTransport } from "./explorer-transport.js";
 const BASE = "https://explorer.lichess.org";
-export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
+export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
 export const LICHESS_SPEEDS = [
     "ultraBullet",
     "bullet",
@@ -32,6 +32,29 @@ export const lichessRatingSchema = z.union([
 const speedSet = new Set(LICHESS_SPEEDS);
 const ratingSet = new Set(LICHESS_RATINGS);
 const dbSet = new Set(["lichess", "masters"]);
+function snapshotArray(value) {
+    if (!Array.isArray(value))
+        throw explorerError("invalid_input");
+    try {
+        return Array.from(value);
+    }
+    catch {
+        throw explorerError("invalid_input");
+    }
+}
+function requestClock(now) {
+    let previous;
+    return () => {
+        const current = now();
+        if (!Number.isFinite(current) ||
+            Math.abs(current) > Number.MAX_SAFE_INTEGER ||
+            (previous !== undefined && current < previous)) {
+            throw explorerError("invalid_input");
+        }
+        previous = current;
+        return current;
+    };
+}
 export function explorerEnabled() {
     return (process.env.LICHESS_TOKEN || "").length > 0;
 }
@@ -44,30 +67,37 @@ function setupExplorerRequest(chess, db, speeds, ratings, options) {
         throw explorerError("disabled");
     if (!dbSet.has(db))
         throw explorerError("invalid_input");
-    if (!Array.isArray(speeds) ||
-        ![...speeds].every((speed) => speedSet.has(speed)) ||
-        new Set(speeds).size !== speeds.length) {
+    const speedValues = snapshotArray(speeds);
+    if (!speedValues.every((speed) => speedSet.has(speed)) ||
+        new Set(speedValues).size !== speedValues.length) {
         throw explorerError("invalid_input");
     }
-    if (!Array.isArray(ratings) ||
-        ![...ratings].every((rating) => ratingSet.has(rating)) ||
-        new Set(ratings).size !== ratings.length) {
+    const ratingValues = snapshotArray(ratings);
+    if (!ratingValues.every((rating) => ratingSet.has(rating)) ||
+        new Set(ratingValues).size !== ratingValues.length) {
         throw explorerError("invalid_input");
     }
-    if (db === "masters" && (speeds.length > 0 || ratings.length > 0)) {
+    if (db === "masters" && (speedValues.length > 0 || ratingValues.length > 0)) {
         throw explorerError("invalid_input");
     }
     const params = new URLSearchParams();
     params.set("fen", chess.fen());
-    if (speeds.length)
-        params.set("speeds", speeds.join(","));
-    if (ratings.length)
-        params.set("ratings", ratings.join(","));
-    const now = options.now ?? (() => performance.now());
+    if (speedValues.length)
+        params.set("speeds", speedValues.join(","));
+    if (ratingValues.length)
+        params.set("ratings", ratingValues.join(","));
+    const now = requestClock(options.now ?? (() => performance.now()));
+    const startedAt = now();
+    const deadline = startedAt + EXPLORER_TOTAL_TIMEOUT_MS;
+    if (!Number.isFinite(deadline) ||
+        Math.abs(deadline) > Number.MAX_SAFE_INTEGER ||
+        deadline <= startedAt) {
+        throw explorerError("invalid_input");
+    }
     return {
         callerSignal,
         db,
-        deadline: now() + EXPLORER_TOTAL_TIMEOUT_MS,
+        deadline,
         legalMoves: new Map(chess.moves({ verbose: true }).map((move) => [move.lan, move.san])),
         limiter: options.limiter ?? processExplorerLimiter,
         now,

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { buildServer } from "./server.js";
 export { serveHttp } from "./http.js";
 export type { HttpServerHandle, HttpServerOptions } from "./http.js";
 export type { AnalysisServices, AppServices, CandidateServices, ExplorerServices, GameServices, LifecycleServices, } from "./services.js";
-export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, snapshotChess, } from "./chess.js";
+export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, snapshotChess, } from "./chess.js";

package/dist/index.js

@@ -8,7 +8,7 @@ import { serveHttp } from "./http.js";
 import { buildServer } from "./server.js";
 export { buildServer } from "./server.js";
 export { serveHttp } from "./http.js";
-export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, snapshotChess, } from "./chess.js";
+export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, snapshotChess, } from "./chess.js";
 function installShutdown(closeTransport) {
     let shutdown;
     const close = () => (shutdown ??= closeTransport());