llm-chess-mcp 0.4.8 → 0.4.9

package/.env.example

@@ -5,5 +5,5 @@ LICHESS_TOKEN=
 # The published package bundles only Maia3 5m (~20 MB). Leave at 5m.
 MAIA3_MODEL=5m
 
-# Stockfish flavor: lite-single (default, ~7MB) | lite | single | full
+# Stockfish flavor: lite-single (default, ~7MB) | single-lite | lite | single | full | asm
 STOCKFISH_FLAVOR=lite-single

package/README.md

@@ -264,7 +264,10 @@ rejected:
 
 - Up to 1,000 games are retained per process; idle games expire after one hour.
 - `move_evaluate` accepts at most 10 moves per call.
-- Imported PGNs are limited to 1 MiB and 4,096 plies.
+- Imported PGNs are limited to 1 MiB, 256 headers, and 4,096 plies across the
+  mainline and variations, plus 32,768 structural elements and 16 KiB per
+  lexical token. Every variation is legality-checked; game state retains the
+  mainline. UTF-8 BOMs and standard escaped header values are supported.
 - Custom FENs reject inconsistent castling/en-passant metadata and impossible
   pawn or promotion material.
 - Stockfish accepts up to 32 active or queued analyses.

package/dist/chess-copy.js

@@ -8,6 +8,36 @@ const ORIGINAL_PIECES = {
 function squareColor(square) {
     return ((square.charCodeAt(0) - 97 + Number(square[1])) % 2);
 }
+function minimumPawnCaptures(chess, color) {
+    const pawns = chess
+        .findPiece({ type: "p", color })
+        .map((square) => ({
+        advances: color === "w" ? Number(square[1]) - 2 : 7 - Number(square[1]),
+        file: square.charCodeAt(0) - 97,
+    }))
+        .sort((left, right) => left.file - right.file);
+    let costs = new Map([[0, 0]]);
+    for (const pawn of pawns) {
+        const next = new Map();
+        for (const [mask, cost] of costs) {
+            for (let original = 0; original < 8; original += 1) {
+                const bit = 1 << original;
+                if (mask & bit)
+                    continue;
+                const captures = Math.abs(original - pawn.file);
+                if (captures > pawn.advances)
+                    continue;
+                const nextMask = mask | bit;
+                next.set(nextMask, Math.min(next.get(nextMask) ?? Infinity, cost + captures));
+            }
+        }
+        costs = next;
+    }
+    return Math.min(...costs.values());
+}
+function nonKingMaterial(chess, color) {
+    return ["p", "q", "r", "b", "n"].reduce((total, type) => total + chess.findPiece({ type, color }).length, 0);
+}
 function hasPiece(chess, square, type, color) {
     const piece = chess.get(square);
     return piece?.type === type && piece.color === color;
@@ -92,6 +122,14 @@ export function assertLegalPosition(chess) {
             throw new ChessError("INVALID_FEN", "FEN contains more promoted material than missing pawns allow");
         }
         assertCastlingPosition(chess, color);
+        const opponent = color === "w" ? "b" : "w";
+        const opponentPawns = chess.findPiece({ type: "p", color: opponent }).length;
+        const missingOpponentMaterial = 15 - nonKingMaterial(chess, opponent);
+        const possibleOpponentPromotions = 8 - opponentPawns;
+        if (minimumPawnCaptures(chess, color) >
+            missingOpponentMaterial + possibleOpponentPromotions) {
+            throw new ChessError("INVALID_FEN", "FEN pawn files require more captures than opposing material allows");
+        }
     }
     assertEnPassantPosition(chess);
     const turn = chess.turn();
@@ -107,6 +145,7 @@ export function snapshotChess(chess) {
     const initialFen = history[0]?.before ?? chess.fen();
     assertSafeFenCounters(initialFen);
     const snapshot = new Chess(initialFen);
+    assertLegalPosition(snapshot);
     const comments = new Map(chess.getComments().map(({ fen, comment }) => [fen, comment]));
     for (const [key, value] of Object.entries(chess.getHeaders())) {
         snapshot.setHeader(key, value);

package/dist/chess.d.ts

@@ -1,7 +1,7 @@
 import { Chess } from "chess.js";
 import type { Move } from "chess.js";
 export { assertLegalPosition, assertSafeFenCounters, snapshotChess, } from "./chess-copy.js";
-export { MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, pgnOf } from "./pgn.js";
+export { MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, pgnOf, } from "./pgn.js";
 import type { ChessState, DrawResult } from "./domain.js";
 export declare const MAX_EVALUATED_MOVES = 10;
 export declare function drawResult(chess: Chess): DrawResult | null;

package/dist/chess.js

@@ -1,6 +1,6 @@
 import { Chess } from "chess.js";
 export { assertLegalPosition, assertSafeFenCounters, snapshotChess, } from "./chess-copy.js";
-export { MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, pgnOf } from "./pgn.js";
+export { MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, pgnOf, } from "./pgn.js";
 import { ChessError } from "./errors.js";
 export const MAX_EVALUATED_MOVES = 10;
 function moveDescriptor(move) {

package/dist/engines/stockfish.js

@@ -19,6 +19,7 @@ const DEFAULT_TIMEOUTS = {
     stopGrace: 2000,
 };
 const DEFAULT_MAX_QUEUE = 32;
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export function resolveStockfishFlavor(value) {
     const normalized = (value || DEFAULT_FLAVOR).toLowerCase();
     if (!FLAVORS.has(normalized)) {
@@ -56,6 +57,22 @@ function asError(error) {
 function abortError(signal) {
     return asError(signal.reason ?? "stockfish request cancelled");
 }
+function ownOption(options, name) {
+    return Object.hasOwn(options, name) ? options[name] : undefined;
+}
+function mergeTimeouts(value) {
+    if (value === undefined)
+        return { ...DEFAULT_TIMEOUTS };
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("stockfish timeouts must be an object");
+    }
+    const timeouts = { ...DEFAULT_TIMEOUTS };
+    for (const name of Object.keys(DEFAULT_TIMEOUTS)) {
+        if (Object.hasOwn(value, name))
+            timeouts[name] = value[name];
+    }
+    return timeouts;
+}
 export class Stockfish {
     session = null;
     queue = [];
@@ -74,16 +91,18 @@ export class Stockfish {
     maxQueue;
     timeouts;
     constructor(options = {}) {
-        this.initEngine = options.init;
-        this.configuredFlavor = options.flavor;
-        this.maxQueue = options.maxQueue ?? DEFAULT_MAX_QUEUE;
-        this.timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
+        this.initEngine = ownOption(options, "init");
+        this.configuredFlavor = ownOption(options, "flavor");
+        this.maxQueue = ownOption(options, "maxQueue") ?? DEFAULT_MAX_QUEUE;
+        this.timeouts = mergeTimeouts(ownOption(options, "timeouts"));
         if (!Number.isInteger(this.maxQueue) || this.maxQueue < 1) {
             throw new Error("stockfish maxQueue must be a positive integer");
         }
         for (const [name, timeout] of Object.entries(this.timeouts)) {
-            if (!Number.isFinite(timeout) || timeout < 1) {
-                throw new Error(`stockfish ${name} timeout must be positive`);
+            if (!Number.isSafeInteger(timeout) ||
+                timeout < 1 ||
+                timeout > MAX_TIMER_DELAY_MS) {
+                throw new Error(`stockfish ${name} timeout must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS}`);
             }
         }
     }
@@ -113,7 +132,9 @@ export class Stockfish {
             const engine = (this.initEngine ?? loadStockfish())(selectedFlavor, (error, initializedEngine) => {
                 callbackCalled = true;
                 if (this.session !== session) {
-                    this.terminate(initializedEngine);
+                    if (initializedEngine !== this.session?.engine) {
+                        this.terminate(initializedEngine);
+                    }
                     return;
                 }
                 if (session.readySettled) {
@@ -121,8 +142,21 @@ export class Stockfish {
                         this.terminate(initializedEngine);
                     return;
                 }
-                if (session.engine && session.engine !== initializedEngine) {
-                    this.terminate(session.engine);
+                if (this.terminations.has(initializedEngine)) {
+                    this.failSession(session, new Error("stockfish initializer reused a terminated engine"));
+                    return;
+                }
+                const replacedEngine = session.engine;
+                if (replacedEngine && replacedEngine !== initializedEngine) {
+                    this.terminate(replacedEngine);
+                    if (this.session !== session ||
+                        session.readySettled ||
+                        session.engine !== replacedEngine) {
+                        if (initializedEngine !== this.session?.engine) {
+                            this.terminate(initializedEngine);
+                        }
+                        return;
+                    }
                 }
                 session.engine = initializedEngine;
                 if (error) {
@@ -141,12 +175,21 @@ export class Stockfish {
                 }, (handshakeError) => this.failSession(session, asError(handshakeError)));
             });
             if (callbackCalled) {
-                if (engine !== session.engine)
+                if (engine !== session.engine && engine !== this.session?.engine) {
                     this.terminate(engine);
+                }
             }
             else if (this.session === session && !session.readySettled) {
-                session.engine = engine;
-                engine.listener = () => { };
+                if (this.terminations.has(engine)) {
+                    this.failSession(session, new Error("stockfish initializer reused a terminated engine"));
+                }
+                else {
+                    session.engine = engine;
+                    engine.listener = () => { };
+                }
+            }
+            else if (engine !== this.session?.engine) {
+                this.terminate(engine);
             }
         }
         catch (error) {

package/dist/explorer-core.d.ts

@@ -10,6 +10,7 @@ export declare const EXPLORER_RATE_LIMIT_COOLDOWN_MS = 60000;
 export declare const EXPLORER_MAX_RESPONSE_BYTES: number;
 export declare const EXPLORER_MAX_MOVES = 256;
 export declare const EXPLORER_MAX_STRING_LENGTH = 256;
+export declare const EXPLORER_MAX_COOLDOWN_MS = 2147483647;
 export declare class ExplorerError extends Error {
     readonly kind: ExplorerErrorKind;
     readonly status?: number | undefined;

package/dist/explorer-core.js

@@ -8,6 +8,7 @@ export const EXPLORER_RATE_LIMIT_COOLDOWN_MS = 60_000;
 export const EXPLORER_MAX_RESPONSE_BYTES = 1024 * 1024;
 export const EXPLORER_MAX_MOVES = 256;
 export const EXPLORER_MAX_STRING_LENGTH = 256;
+export const EXPLORER_MAX_COOLDOWN_MS = 2_147_483_647;
 export class ExplorerError extends Error {
     kind;
     status;

package/dist/explorer-limiter.d.ts

@@ -1,3 +1,5 @@
+import type { ExplorerError } from "./explorer-core.js";
+export declare function isExplorerCooldownError(error: ExplorerError): boolean;
 export interface ExplorerLimiterOptions {
     callerSignal: AbortSignal | undefined;
     deadline: number;

package/dist/explorer-limiter.js

@@ -1,8 +1,18 @@
-import { awaitWithAbort, explorerError, throwIfAborted, } from "./explorer-core.js";
+import { awaitWithAbort, explorerError, EXPLORER_MAX_COOLDOWN_MS, throwIfAborted, } from "./explorer-core.js";
+const cooldownErrors = new WeakSet();
+function cooldownError() {
+    const error = explorerError("rate_limited");
+    cooldownErrors.add(error);
+    return error;
+}
+export function isExplorerCooldownError(error) {
+    return cooldownErrors.has(error);
+}
 class RequestLimiter {
     now;
     #active = false;
-    #cooldownUntil = 0;
+    #cooldownUntil;
+    #lastNow;
     #queue = [];
     constructor(now) {
         this.now = now;
@@ -11,7 +21,22 @@ class RequestLimiter {
         return this.#queue.length;
     }
     cooldown(ms, _now) {
-        this.#cooldownUntil = Math.max(this.#cooldownUntil, this.now() + ms);
+        if (!Number.isSafeInteger(ms) ||
+            ms < 0 ||
+            ms > EXPLORER_MAX_COOLDOWN_MS) {
+            throw explorerError("invalid_input");
+        }
+        const now = this.#readNow();
+        const cooldownUntil = now + ms;
+        if (!Number.isFinite(cooldownUntil) ||
+            Math.abs(cooldownUntil) > Number.MAX_SAFE_INTEGER ||
+            (ms > 0 && cooldownUntil <= now)) {
+            throw explorerError("invalid_input");
+        }
+        this.#cooldownUntil =
+            this.#cooldownUntil === undefined
+                ? cooldownUntil
+                : Math.max(this.#cooldownUntil, cooldownUntil);
     }
     run(options, request) {
         throwIfAborted(options.callerSignal);
@@ -66,18 +91,34 @@ class RequestLimiter {
         waiter.start();
     }
     #waitForCooldown(options) {
+        const now = this.#readNow();
         const cooldownUntil = this.#cooldownUntil;
-        const delay = cooldownUntil - this.now();
+        if (cooldownUntil === undefined)
+            return;
+        const delay = Math.ceil(cooldownUntil - now);
         if (delay <= 0)
             return;
         if (delay >= options.deadline - options.now()) {
-            throw explorerError("rate_limited");
+            throw cooldownError();
         }
         return awaitWithAbort(options.callerSignal, () => options.sleep(delay)).then(() => {
-            if (this.#cooldownUntil === cooldownUntil)
-                this.#cooldownUntil = 0;
+            const now = this.#readNow();
+            if (this.#cooldownUntil !== undefined && this.#cooldownUntil > now) {
+                throw cooldownError();
+            }
+            this.#cooldownUntil = undefined;
         });
     }
+    #readNow() {
+        const now = this.now();
+        if (!Number.isFinite(now) ||
+            Math.abs(now) > Number.MAX_SAFE_INTEGER ||
+            (this.#lastNow !== undefined && now < this.#lastNow)) {
+            throw explorerError("invalid_input");
+        }
+        this.#lastNow = now;
+        return now;
+    }
 }
 export function createExplorerLimiter(now = () => performance.now()) {
     return new RequestLimiter(now);

package/dist/explorer-response.js

@@ -118,6 +118,9 @@ export async function normalizeExplorerResponse(response, signal, options) {
         if (ucis.has(move.uci) || options.legalMoves.get(move.uci) !== move.san) {
             throw explorerError("invalid_response");
         }
+        if (sumCounts(move.white, move.draws, move.black) === 0) {
+            throw explorerError("invalid_response");
+        }
         ucis.add(move.uci);
         white = sumCounts(white, move.white);
         draws = sumCounts(draws, move.draws);

package/dist/explorer-retry.js

@@ -1,4 +1,5 @@
-import { awaitWithAbort, explorerError, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_RATE_LIMIT_COOLDOWN_MS, } from "./explorer-core.js";
+import { awaitWithAbort, explorerError, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_RATE_LIMIT_COOLDOWN_MS, } from "./explorer-core.js";
+import { isExplorerCooldownError } from "./explorer-limiter.js";
 const SHORT_WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 const LONG_WEEKDAYS = [
     "Sunday",
@@ -25,7 +26,7 @@ const MONTHS = [
 ];
 const IMF_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
 const RFC850_DATE = /^(Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
-const ASCTIME_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|[12]\d|3[01]) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
+const ASCTIME_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|0[1-9]|[12]\d|3[01]) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
 function httpDate(weekday, year, month, day, hour, minute, second) {
     const date = new Date(0);
     date.setUTCFullYear(year, month, day);
@@ -100,10 +101,10 @@ export function retryAfterMs(value, now) {
     return parseRetryAfterMs(value, now) ?? EXPLORER_DEFAULT_RETRY_DELAY_MS;
 }
 export function rateLimitCooldownMs(value, now) {
-    if (value === null || value.trim() === "") {
-        return EXPLORER_RATE_LIMIT_COOLDOWN_MS;
-    }
-    return parseRetryAfterMs(value, now) ?? EXPLORER_RATE_LIMIT_COOLDOWN_MS;
+    const delay = value === null || value.trim() === ""
+        ? EXPLORER_RATE_LIMIT_COOLDOWN_MS
+        : (parseRetryAfterMs(value, now) ?? EXPLORER_RATE_LIMIT_COOLDOWN_MS);
+    return Math.min(delay, EXPLORER_MAX_COOLDOWN_MS);
 }
 async function waitForRetry(options, delay, originalError) {
     if (delay >= options.deadline - options.now())
@@ -118,7 +119,12 @@ export async function retryExplorer(options, attemptRequest) {
         const outcome = await attemptRequest();
         if (outcome.type === "success")
             return outcome.result;
-        lastError = outcome.error;
+        lastError =
+            isExplorerCooldownError(outcome.error) &&
+                lastError?.kind === "rate_limited" &&
+                lastError.status !== undefined
+                ? lastError
+                : outcome.error;
         if (outcome.retry === "stop" || attempt + 1 >= options.maxAttempts) {
             throw lastError;
         }

package/dist/explorer.d.ts

@@ -1,10 +1,10 @@
 import { Chess } from "chess.js";
 import { z } from "zod/v4";
-import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError } from "./explorer-core.js";
+import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError } from "./explorer-core.js";
 import type { ExplorerErrorKind, ExplorerFetch, ExplorerResult } from "./explorer-core.js";
 import { createExplorerLimiter } from "./explorer-limiter.js";
 import type { ExplorerLimiter, ExplorerLimiterOptions } from "./explorer-limiter.js";
-export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
+export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
 export type { ExplorerErrorKind, ExplorerFetch, ExplorerLimiter, ExplorerLimiterOptions, ExplorerResult, };
 export declare const LICHESS_SPEEDS: readonly ["ultraBullet", "bullet", "blitz", "rapid", "classical", "correspondence"];
 export declare const LICHESS_RATINGS: readonly [0, 1000, 1200, 1400, 1600, 1800, 2000, 2200, 2500];

package/dist/explorer.js

@@ -1,11 +1,11 @@
 import { z } from "zod/v4";
-import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, explorerError, throwIfAborted, } from "./explorer-core.js";
+import { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, explorerError, throwIfAborted, } from "./explorer-core.js";
 import { createExplorerLimiter } from "./explorer-limiter.js";
 import { normalizeExplorerResponse } from "./explorer-response.js";
 import { rateLimitCooldownMs, retryAfterMs, retryExplorer, } from "./explorer-retry.js";
 import { requestExplorerTransport } from "./explorer-transport.js";
 const BASE = "https://explorer.lichess.org";
-export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
+export { EXPLORER_ATTEMPT_TIMEOUT_MS, EXPLORER_DEFAULT_RETRY_DELAY_MS, EXPLORER_ERROR_KINDS, EXPLORER_MAX_ATTEMPTS, EXPLORER_MAX_COOLDOWN_MS, EXPLORER_MAX_MOVES, EXPLORER_MAX_RESPONSE_BYTES, EXPLORER_MAX_STRING_LENGTH, EXPLORER_RATE_LIMIT_COOLDOWN_MS, EXPLORER_TOTAL_TIMEOUT_MS, ExplorerError, createExplorerLimiter, };
 export const LICHESS_SPEEDS = [
     "ultraBullet",
     "bullet",
@@ -32,6 +32,29 @@ export const lichessRatingSchema = z.union([
 const speedSet = new Set(LICHESS_SPEEDS);
 const ratingSet = new Set(LICHESS_RATINGS);
 const dbSet = new Set(["lichess", "masters"]);
+function snapshotArray(value) {
+    if (!Array.isArray(value))
+        throw explorerError("invalid_input");
+    try {
+        return Array.from(value);
+    }
+    catch {
+        throw explorerError("invalid_input");
+    }
+}
+function requestClock(now) {
+    let previous;
+    return () => {
+        const current = now();
+        if (!Number.isFinite(current) ||
+            Math.abs(current) > Number.MAX_SAFE_INTEGER ||
+            (previous !== undefined && current < previous)) {
+            throw explorerError("invalid_input");
+        }
+        previous = current;
+        return current;
+    };
+}
 export function explorerEnabled() {
     return (process.env.LICHESS_TOKEN || "").length > 0;
 }
@@ -44,30 +67,37 @@ function setupExplorerRequest(chess, db, speeds, ratings, options) {
         throw explorerError("disabled");
     if (!dbSet.has(db))
         throw explorerError("invalid_input");
-    if (!Array.isArray(speeds) ||
-        ![...speeds].every((speed) => speedSet.has(speed)) ||
-        new Set(speeds).size !== speeds.length) {
+    const speedValues = snapshotArray(speeds);
+    if (!speedValues.every((speed) => speedSet.has(speed)) ||
+        new Set(speedValues).size !== speedValues.length) {
         throw explorerError("invalid_input");
     }
-    if (!Array.isArray(ratings) ||
-        ![...ratings].every((rating) => ratingSet.has(rating)) ||
-        new Set(ratings).size !== ratings.length) {
+    const ratingValues = snapshotArray(ratings);
+    if (!ratingValues.every((rating) => ratingSet.has(rating)) ||
+        new Set(ratingValues).size !== ratingValues.length) {
         throw explorerError("invalid_input");
     }
-    if (db === "masters" && (speeds.length > 0 || ratings.length > 0)) {
+    if (db === "masters" && (speedValues.length > 0 || ratingValues.length > 0)) {
         throw explorerError("invalid_input");
     }
     const params = new URLSearchParams();
     params.set("fen", chess.fen());
-    if (speeds.length)
-        params.set("speeds", speeds.join(","));
-    if (ratings.length)
-        params.set("ratings", ratings.join(","));
-    const now = options.now ?? (() => performance.now());
+    if (speedValues.length)
+        params.set("speeds", speedValues.join(","));
+    if (ratingValues.length)
+        params.set("ratings", ratingValues.join(","));
+    const now = requestClock(options.now ?? (() => performance.now()));
+    const startedAt = now();
+    const deadline = startedAt + EXPLORER_TOTAL_TIMEOUT_MS;
+    if (!Number.isFinite(deadline) ||
+        Math.abs(deadline) > Number.MAX_SAFE_INTEGER ||
+        deadline <= startedAt) {
+        throw explorerError("invalid_input");
+    }
     return {
         callerSignal,
         db,
-        deadline: now() + EXPLORER_TOTAL_TIMEOUT_MS,
+        deadline,
         legalMoves: new Map(chess.moves({ verbose: true }).map((move) => [move.lan, move.san])),
         limiter: options.limiter ?? processExplorerLimiter,
         now,

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { buildServer } from "./server.js";
 export { serveHttp } from "./http.js";
 export type { HttpServerHandle, HttpServerOptions } from "./http.js";
 export type { AnalysisServices, AppServices, CandidateServices, ExplorerServices, GameServices, LifecycleServices, } from "./services.js";
-export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, snapshotChess, } from "./chess.js";
+export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, snapshotChess, } from "./chess.js";

package/dist/index.js

@@ -8,7 +8,7 @@ import { serveHttp } from "./http.js";
 import { buildServer } from "./server.js";
 export { buildServer } from "./server.js";
 export { serveHttp } from "./http.js";
-export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_PLIES, parseImportedPgn, snapshotChess, } from "./chess.js";
+export { drawResult, MAX_EVALUATED_MOVES, MAX_PGN_BYTES, MAX_PGN_HEADERS, MAX_PGN_PLIES, MAX_PGN_TOKEN_BYTES, parseImportedPgn, snapshotChess, } from "./chess.js";
 function installShutdown(closeTransport) {
     let shutdown;
     const close = () => (shutdown ??= closeTransport());

package/dist/intents.js

@@ -8,8 +8,8 @@ function safeDifference(left, right) {
     return result;
 }
 function safeSum(values) {
-    if (!values.every(Number.isSafeInteger)) {
-        throw new RangeError("chess count must be a safe integer");
+    if (!values.every((value) => Number.isSafeInteger(value) && value >= 0)) {
+        throw new RangeError("chess count must be a non-negative safe integer");
     }
     const result = values.reduce((sum, value) => sum + value, 0);
     if (!Number.isSafeInteger(result)) {
@@ -17,6 +17,18 @@ function safeSum(values) {
     }
     return result;
 }
+function assertLichessMove(move) {
+    if (move.count < 1) {
+        throw new RangeError("chess move count must be positive");
+    }
+    if (move.count !== safeSum([move.white, move.draws, move.black])) {
+        throw new RangeError("derived chess move count is inconsistent");
+    }
+    if (move.averageRating !== null &&
+        (!Number.isSafeInteger(move.averageRating) || move.averageRating < 0)) {
+        throw new RangeError("chess average rating must be a non-negative safe integer");
+    }
+}
 function toSan(chess, uci) {
     const m = chess.moves({ verbose: true }).find((x) => x.lan === uci);
     return m ? m.san : uci;
@@ -49,42 +61,93 @@ function objectiveFromLine(line, turn, bestCp) {
     };
 }
 export function explorerCandidateData(result) {
+    const totals = [result.white, result.draws, result.black];
+    let white = 0;
+    let draws = 0;
+    let black = 0;
+    const ucis = new Set();
     for (const move of result.moves) {
-        if (move.count !== safeSum([move.white, move.draws, move.black])) {
-            throw new RangeError("derived chess move count is inconsistent");
+        if (ucis.has(move.uci)) {
+            throw new RangeError("duplicate chess move");
         }
+        ucis.add(move.uci);
+        assertLichessMove(move);
+        white = safeSum([white, move.white]);
+        draws = safeSum([draws, move.draws]);
+        black = safeSum([black, move.black]);
+    }
+    if (white > result.white || draws > result.draws || black > result.black) {
+        throw new RangeError("chess move totals exceed explorer totals");
     }
     return {
         status: result.moves.length > 0 ? "available" : "no_data",
-        totalGames: safeSum([result.white, result.draws, result.black]),
+        totalGames: safeSum(totals),
         moves: result.moves,
     };
 }
 export function candidateSetFromData(chess, elo, sfLines, maiaMoves, lichessResult) {
+    if ((lichessResult.status === "disabled" ||
+        lichessResult.status === "unavailable") &&
+        lichessResult.moves.length > 0) {
+        throw new RangeError(`${lichessResult.status} explorer data cannot contain moves`);
+    }
+    if ((lichessResult.status === "available") !==
+        (lichessResult.moves.length > 0)) {
+        throw new RangeError(`${lichessResult.status} explorer data has inconsistent moves`);
+    }
     if (chess.isGameOver()) {
         return {
             candidates: [],
             moveSensitivity: { level: "low", topMoveSpreadCp: null },
         };
     }
-    const turn = chess.turn();
-    const maiaByUci = new Map(maiaMoves.map((move) => [move.uci, move.prob]));
     const legalUcis = new Set(chess.moves({ verbose: true }).map((move) => move.lan));
+    const turn = chess.turn();
+    const maiaByUci = new Map();
+    const maiaUcis = new Set();
+    for (const move of maiaMoves) {
+        if (maiaUcis.has(move.uci))
+            throw new RangeError("duplicate Maia move");
+        maiaUcis.add(move.uci);
+        if (!Number.isFinite(move.prob) || move.prob < 0 || move.prob > 1) {
+            throw new RangeError("Maia move probability must be between 0 and 1");
+        }
+        if (!legalUcis.has(move.uci))
+            continue;
+        maiaByUci.set(move.uci, move.prob);
+    }
     const sfByUci = new Map();
     for (const line of sfLines) {
         const uci = line.pv[0];
         const evaluation = toEval(line);
         if (uci !== undefined && legalUcis.has(uci) && evaluation !== null) {
+            if (sfByUci.has(uci))
+                throw new RangeError("duplicate Stockfish move");
             sfByUci.set(uci, { line, evaluation });
         }
     }
-    const lichessByUci = new Map(lichessResult.moves.map((move) => [move.uci, move]));
+    const totalGames = lichessResult.totalGames ?? 0;
+    safeSum([totalGames]);
+    const lichessByUci = new Map();
+    const lichessUcis = new Set();
+    for (const move of lichessResult.moves) {
+        if (lichessUcis.has(move.uci)) {
+            throw new RangeError("duplicate explorer move");
+        }
+        lichessUcis.add(move.uci);
+        assertLichessMove(move);
+        if (move.count > totalGames) {
+            throw new RangeError("chess move count exceeds explorer total");
+        }
+        if (!legalUcis.has(move.uci))
+            continue;
+        lichessByUci.set(move.uci, move);
+    }
     const normalizedSfLines = [...sfByUci.values()];
     const evals = normalizedSfLines.map(({ evaluation }) => evaluation);
     const bestCp = evals.length
         ? Math.max(...evals.map((value) => evalToCp(value)))
         : null;
-    const totalGames = lichessResult.totalGames ?? 0;
     const ucis = new Set([
         ...sfByUci.keys(),
         ...maiaByUci.keys(),
@@ -167,6 +230,7 @@ export function createCandidateComputation(dependencies) {
                 return await work();
             }
             catch (error) {
+                workSignal.throwIfAborted();
                 controller.abort(error);
                 throw error;
             }
@@ -194,6 +258,7 @@ export function createCandidateComputation(dependencies) {
             fatal(() => dependencies.humanMoveDistribution(chess, elo, elo, maiaTopN, workSignal)),
             fatal(explorer),
         ]);
+        workSignal.throwIfAborted();
         return candidateSetFromData(chess, elo, sfLines, maiaMoves, lichessResult);
     };
 }