rea-agents 5.0.0 → 6.1.0

package/dist/browser/WebSourceMapFetcher.js

@@ -1,39 +1,112 @@
 import * as t from "@babel/types";
-import { AnyMap, eachMapping } from "@jridgewell/trace-mapping";
+import { decodeValidatedSourceMapLeaves, isBeforeSourceMapLeafStop, resolveSourceMapSource, } from "../javascript/sourceMaps/DecodedSourceMap.js";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
 import { isUrlLikeModuleSpecifier } from "../domain/webBundleAnalyzerAst.js";
 import { analyzeParsedJavaScriptReferences } from "../domain/javascript/javascriptSemanticAnalysis.js";
 import { traverseJavaScriptAst } from "../domain/javascript/javascriptSemanticTraversal.js";
 import { parseJavaScriptSource } from "../domain/javascript/javascriptSourceParser.js";
-import { hasValidSourceMapContents } from "../domain/sourceMapContents.js";
 import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 import { safeParseJson } from "../domain/safeJson.js";
-import { flattenSourceMapLeaves, isVersion3Map, } from "../domain/sourceMapEnvelope.js";
+import { jsonParts } from "../domain/jsonSerialization.js";
+import { inspectSourceMapValue, SourceMapFormatFailure, } from "../javascript/sourceMaps/SourceMapFormat.js";
+import { WEB_SOURCE_MAP_LIMITS } from "../domain/webSourceLocation.js";
+// Source maps are normally fetched as a small part of a larger inspection.
+// Bound a stalled server to 30 seconds and bound raw map input retained for
+// parsing to 64 MiB per inspection. Both limits apply at the network boundary;
+// hitting either produces an explicit fetch_failed item, never truncated data.
+const SOURCE_MAP_FETCH_TIMEOUT_MS = 30_000;
+const SOURCE_MAP_RESPONSE_BYTES = 64 * 1024 * 1024;
+const SOURCE_MAP_OUTPUT_BYTES = WEB_SOURCE_MAP_LIMITS.outputBytes;
+const SOURCE_MAP_FAILURE_LIMITATION_RESERVE = 512;
+const SOURCE_MAP_COLLECTION_ENVELOPE_RESERVE = 1_024;
 /** Fetch and validate approved source maps without browser credentials. */
 export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch: globalThis.fetch }) => {
     const items = [];
-    for (const request of requests) {
-        if (signal?.aborted === true)
-            throw signal.reason;
-        items.push(await fetchOne(request, input, signal, host));
+    const operationController = new AbortController();
+    const timeout = setTimeout(() => operationController.abort(new SourceMapDeadlineError()), host.timeoutMs ?? SOURCE_MAP_FETCH_TIMEOUT_MS);
+    const abortFromCaller = () => operationController.abort(signal?.reason);
+    signal?.addEventListener("abort", abortFromCaller, { once: true });
+    const operationSignal = operationController.signal;
+    const deadlineAt = Date.now() + (host.timeoutMs ?? SOURCE_MAP_FETCH_TIMEOUT_MS);
+    const budget = {
+        retainedBytes: 0,
+        deadlineAt,
+        decodedRecords: {
+            records: 0,
+            expandedBytes: SOURCE_MAP_COLLECTION_ENVELOPE_RESERVE,
+            resolvedSourceBytes: 0,
+        },
+    };
+    let limitation;
+    try {
+        for (const request of requests) {
+            if (signal?.aborted === true)
+                throw signal.reason;
+            const reservation = sourceMapFailureReservation(request) + 1;
+            if (reservation >
+                SOURCE_MAP_OUTPUT_BYTES - budget.decodedRecords.expandedBytes) {
+                const unprocessed = requests.length - items.length;
+                limitation = `Source-map output budget was exhausted before processing ${String(unprocessed)} requested map${unprocessed === 1 ? "" : "s"}. Their results are unknown.`;
+                break;
+            }
+            const expandedBytesBeforeItem = budget.decodedRecords.expandedBytes;
+            budget.decodedRecords.expandedBytes += reservation;
+            if (operationSignal.aborted || Date.now() >= deadlineAt) {
+                items.push(emptySourceMapItem(request, "fetch_failed", "Source-map fetching exceeded its operation deadline."));
+                continue;
+            }
+            const item = await fetchOne(request, input, operationSignal, host, budget);
+            if (item.artifact === null)
+                budget.decodedRecords.expandedBytes =
+                    expandedBytesBeforeItem + reservation;
+            items.push(item);
+        }
     }
-    const retained = items.filter(({ status }) => status === "included" || status === "partial").length;
+    finally {
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", abortFromCaller);
+    }
+    if (signal?.aborted === true)
+        throw signal.reason;
     return webSourceMapsSchema.parse({
-        status: items.length === 0
-            ? "unavailable"
-            : retained === items.length &&
-                !items.some(({ status }) => status === "partial")
-                ? "included"
-                : retained > 0
-                    ? "partial"
-                    : "unavailable",
+        status: sourceMapsStatus(items, limitation !== undefined),
         requested: requests.length,
         processed: items.length,
         items,
+        ...(limitation === undefined ? {} : { limitation }),
     });
 };
-const fetchOne = async (request, input, signal, host) => {
+const sourceMapsStatus = (items, omitted) => {
+    const retained = items.filter(({ status }) => status === "included" || status === "partial").length;
+    if (items.length === 0 || retained === 0)
+        return "unavailable";
+    if (omitted)
+        return "partial";
+    return retained === items.length &&
+        !items.some(({ status }) => status === "partial")
+        ? "included"
+        : "partial";
+};
+class SourceMapDeadlineError extends Error {
+    constructor() {
+        super("Source-map fetching exceeded its operation deadline.");
+        this.name = "SourceMapDeadlineError";
+    }
+}
+class SourceMapSizeLimitError extends Error {
+    constructor() {
+        super("Source-map response exceeded the retained-byte budget.");
+        this.name = "SourceMapSizeLimitError";
+    }
+}
+class SourceMapEncodingError extends Error {
+    constructor() {
+        super("Source-map response is not valid UTF-8.");
+        this.name = "SourceMapEncodingError";
+    }
+}
+const fetchOne = async (request, input, signal, host, budget) => {
     if (!approvedUrl(request.fetchUrl, input.allowed_origins))
         return emptySourceMapItem(request, "policy_filtered", "Declared source-map URL is outside the approved exact origins.");
     try {
@@ -45,24 +118,38 @@ const fetchOne = async (request, input, signal, host) => {
             await response.body?.cancel();
             return emptySourceMapItem(request, "fetch_failed", `Source-map server returned HTTP ${String(response.status)}.`);
         }
-        return normalizeSourceMap(request, await response.text(), fetchedUrl);
+        checkOperation(undefined, signal, budget.deadlineAt);
+        return normalizeSourceMap(request, await readBoundedText(response, budget, host.maxResponseBytes ?? SOURCE_MAP_RESPONSE_BYTES, signal), fetchedUrl, {
+            signal,
+            deadlineAt: budget.deadlineAt,
+            budget: budget.decodedRecords,
+        });
     }
     catch (cause) {
-        if (signal?.aborted === true)
+        if (signal?.aborted === true &&
+            !(signal.reason instanceof SourceMapDeadlineError))
             throw cause;
-        return emptySourceMapItem(request, "fetch_failed", "Source-map fetch or validation failed.");
+        if (cause instanceof SourceMapEncodingError)
+            return emptySourceMapItem(request, "invalid", cause.message);
+        return emptySourceMapItem(request, "fetch_failed", cause instanceof SourceMapSizeLimitError
+            ? cause.message
+            : cause instanceof SourceMapDeadlineError
+                ? cause.message
+                : "Source-map fetch or validation failed.");
     }
 };
 const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signal, host) => {
     let current = initialUrl;
     const visited = new Set();
     for (;;) {
+        if (signal?.aborted === true)
+            throw signal.reason;
         if (!approvedUrl(current, allowedOrigins))
             return undefined;
         if (visited.has(current))
             throw new Error("source_map_redirect_loop");
         visited.add(current);
-        const response = await host.fetch(current, {
+        const response = await promiseWithAbort(host.fetch(current, {
             method: "GET",
             headers: {
                 Accept: "application/json, application/source-map+json;q=0.9",
@@ -71,7 +158,11 @@ const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signa
             credentials: "omit",
             referrerPolicy: "no-referrer",
             ...(signal === undefined ? {} : { signal }),
-        });
+        }), signal);
+        if (signal !== undefined && signalIsAborted(signal)) {
+            await response.body?.cancel(signal.reason).catch(() => undefined);
+            throw signal.reason;
+        }
         if (response.status < 300 || response.status >= 400)
             return { response, fetchedUrl: current };
         const location = response.headers.get("location");
@@ -81,40 +172,205 @@ const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signa
         current = new URL(location, current).href;
     }
 };
-const normalizeSourceMap = (request, text, fetchedUrl) => {
-    if (!validSourceMapEnvelope(text))
-        return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.");
+const readBoundedText = async (response, budget, maxBytes, signal) => {
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    const chunks = [];
+    let bytes = 0;
     try {
-        const map = new AnyMap(text, fetchedUrl);
-        const resolvedBySource = new Map();
-        const originalSources = map.sources.map((source, index) => {
-            const content = map.sourcesContent?.[index];
-            const resolved = map.resolvedSources[index] ?? source ?? "[unknown-source]";
-            if (source !== null)
-                resolvedBySource.set(source, resolved);
-            return {
-                source: sanitizeSource(resolved),
-                artifact: typeof content === "string"
-                    ? createWebTextArtifact(content, sourceMediaType(source))
-                    : null,
-            };
+        for (;;) {
+            if (signal?.aborted === true)
+                throw signal.reason;
+            const { done, value } = await readWithAbort(reader, signal);
+            if (done)
+                break;
+            const nextBytes = value?.byteLength ?? 0;
+            if (budget.retainedBytes + bytes + nextBytes > maxBytes) {
+                await reader.cancel(new SourceMapSizeLimitError());
+                throw new SourceMapSizeLimitError();
+            }
+            if (value !== undefined)
+                chunks.push(value);
+            bytes += nextBytes;
+        }
+    }
+    finally {
+        // Aborting cancels the reader in readWithAbort. It owns the pending read
+        // until that cancellation settles, so releasing the lock here can throw.
+        if (signal?.aborted !== true)
+            reader.releaseLock();
+    }
+    budget.retainedBytes += bytes;
+    const joined = new Uint8Array(bytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+    }
+    catch {
+        throw new SourceMapEncodingError();
+    }
+};
+const readWithAbort = (reader, signal) => {
+    if (signal === undefined)
+        return reader.read();
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            void reader.cancel(signal.reason).catch(() => undefined);
+            reject(signal.reason);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void reader.read().then((value) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(value);
+        }, (cause) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            void reader.cancel(cause).catch(() => undefined);
+            reject(cause);
         });
-        const mappings = [];
-        eachMapping(map, (mapping) => {
-            if (mapping.source === null ||
-                mapping.originalLine === null ||
-                mapping.originalColumn === null)
+    });
+};
+const signalIsAborted = (signal) => signal?.aborted === true;
+const promiseWithAbort = (promise, signal) => {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(signal.reason);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        void promise.then((response) => {
+            if (settled || signal.aborted) {
+                void response.body?.cancel(signal.reason).catch(() => undefined);
+                if (!settled) {
+                    settled = true;
+                    cleanup();
+                    reject(signal.reason);
+                }
                 return;
-            mappings.push({
-                generated_line: mapping.generatedLine,
-                generated_column: mapping.generatedColumn,
-                source: sanitizeSource(resolvedBySource.get(mapping.source) ?? mapping.source),
-                original_line: mapping.originalLine,
-                original_column: mapping.originalColumn,
-                name: mapping.name ?? null,
-            });
+            }
+            settled = true;
+            cleanup();
+            resolve(response);
+        }, (cause) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(cause);
+        });
+    });
+};
+const normalizeSourceMap = (request, text, fetchedUrl, context) => {
+    const parsedJson = safeParseJson(text);
+    if (!parsedJson.ok)
+        return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.");
+    const retainedBytesBeforeMap = context.budget.expandedBytes;
+    try {
+        const check = () => checkOperation(undefined, context.signal, context.deadlineAt);
+        const inspected = inspectSourceMapValue(parsedJson.value, {
+            profile: "browser-collection",
+            budget: context.budget,
+            check,
         });
-        const modules = originalModuleEdges(originalSources);
+        context.budget.expandedBytes =
+            retainedBytesBeforeMap -
+                sourceMapFailureReservation(request) +
+                sourceMapSuccessReservation(request);
+        consumeExpandedBytes(context.budget, jsonBytes(text) +
+            artifactMetadataBytes("application/source-map+json", text) -
+            4);
+        const sourcesByRaw = new Map();
+        const resolvedByRoot = new Map();
+        preflightResolvedSourceBytes(inspected.leaves, fetchedUrl, context.budget, resolvedByRoot, sourcesByRaw, check);
+        check();
+        const decoded = decodeValidatedSourceMapLeaves(inspected.leaves, fetchedUrl, check);
+        const sourceJsonBytes = new Map();
+        const nameJsonBytes = new Map();
+        const originalSources = [];
+        for (const { leaf, resolvedSources } of decoded) {
+            for (const [index, rawSource] of leaf.map.sources.entries()) {
+                if ((index & 255) === 0)
+                    check();
+                const resolved = resolvedSources[index] ?? rawSource ?? "[unknown-source]";
+                const sanitized = cachedSanitized(sourcesByRaw, resolved);
+                const content = leaf.map.sourcesContent?.[index] ?? null;
+                consumeExpandedBytes(context.budget, cachedJsonBytes(sourceJsonBytes, sanitized) +
+                    sourceEntryOverheadBytes() +
+                    (originalSources.length === 0 ? 0 : 1) +
+                    (content === null
+                        ? 0
+                        : jsonBytes(content) +
+                            artifactMetadataBytes(sourceMediaType(rawSource), content) -
+                            4));
+                originalSources.push({
+                    source: sanitized,
+                    artifact: content === null
+                        ? null
+                        : createWebTextArtifact(content, sourceMediaType(rawSource)),
+                });
+            }
+        }
+        const mappings = [];
+        for (const { leaf, rows, resolvedSources } of decoded)
+            for (const [line, row] of rows.entries()) {
+                if ((line & 255) === 0)
+                    check();
+                for (const segment of row) {
+                    if (!isBeforeSourceMapLeafStop(leaf, line, segment[0]))
+                        continue;
+                    if (segment.length === 1)
+                        continue;
+                    const rawSource = leaf.map.sources[segment[1]];
+                    const resolved = resolvedSources[segment[1]] ?? rawSource ?? "[unknown-source]";
+                    const source = cachedSanitized(sourcesByRaw, resolved);
+                    const name = segment.length === 5 ? (leaf.map.names[segment[4]] ?? null) : null;
+                    const generatedLine = leaf.offset.line + line + 1;
+                    const generatedColumn = segment[0] + (line === 0 ? leaf.offset.column : 0);
+                    consumeExpandedBytes(context.budget, cachedJsonBytes(sourceJsonBytes, source) +
+                        (name === null ? 4 : cachedJsonBytes(nameJsonBytes, name)) +
+                        mappingRowBytes(generatedLine, generatedColumn, segment[2] + 1, segment[3]) +
+                        (mappings.length === 0 ? 0 : 1));
+                    mappings.push({
+                        generated_line: generatedLine,
+                        generated_column: generatedColumn,
+                        source,
+                        original_line: segment[2] + 1,
+                        original_column: segment[3],
+                        name,
+                    });
+                }
+            }
+        const modules = originalModuleEdges(originalSources, check, (edge) => consumeExpandedBytes(context.budget, Buffer.byteLength(JSON.stringify(edge)) + 1));
+        check();
+        if (modules.incomplete.length > 0)
+            consumeExpandedBytes(context.budget, jsonBytes(`Module edges are incomplete: ${modules.incomplete.length} of ${originalSources.filter(({ artifact }) => artifact !== null).length} original sources could not be parsed in full (${modules.incomplete.join(", ")}).`) - 4);
         const parsed = {
             ...sourceMapContext(request),
             artifact: createWebTextArtifact(text, "application/source-map+json"),
@@ -122,6 +378,7 @@ const normalizeSourceMap = (request, text, fetchedUrl) => {
             original_module_edges: modules.edges,
             mappings,
         };
+        check();
         return modules.incomplete.length === 0
             ? { ...parsed, status: "included", limitation: null }
             : {
@@ -131,18 +388,27 @@ const normalizeSourceMap = (request, text, fetchedUrl) => {
             };
     }
     catch (cause) {
-        void cause;
-        return emptySourceMapItem(request, "invalid", "Source-map mappings could not be decoded safely.");
+        // Failed maps publish no artifact or mapping rows. Release their output
+        // reservation while keeping cumulative fetch and decoder-work accounting.
+        context.budget.expandedBytes = retainedBytesBeforeMap;
+        if (cause instanceof SourceMapFormatFailure && cause.reason === "limit")
+            return emptySourceMapItem(request, "fetch_failed", cause.message);
+        if (context.signal?.aborted === true ||
+            cause instanceof SourceMapDeadlineError)
+            throw cause;
+        return emptySourceMapItem(request, "invalid", "Source-map JSON mappings could not be decoded safely.");
     }
 };
-const originalModuleEdges = (sources) => {
+const originalModuleEdges = (sources, check, beforeEdge) => {
     const edges = [];
     const seen = new Set();
     const incomplete = [];
     for (const source of sources) {
+        check();
         if (source.artifact === null)
             continue;
         const parsed = parseJavaScriptSource(source.artifact.text);
+        check();
         if (parsed === null) {
             incomplete.push(source.source);
             continue;
@@ -154,6 +420,7 @@ const originalModuleEdges = (sources) => {
         let unboundRequires;
         traverseJavaScriptAst(parsed, {
             enter: (node) => {
+                check();
                 const dependency = originalDependency(node);
                 if (dependency === null)
                     return;
@@ -171,33 +438,27 @@ const originalModuleEdges = (sources) => {
                 if (seen.has(key))
                     return;
                 seen.add(key);
-                edges.push({
+                const edge = {
                     from_source: source.source,
                     kind,
                     specifier,
                     resolved_source: resolveOriginalSource(specifier, source.source),
-                });
+                };
+                beforeEdge(edge);
+                edges.push(edge);
             },
         });
     }
     return { edges, incomplete };
 };
-const validSourceMapEnvelope = (text) => {
-    const parsedResult = safeParseJson(text);
-    if (!parsedResult.ok)
-        return false;
-    const parsed = parsedResult.value;
-    if (isVersion3Map(parsed) && typeof parsed.mappings === "string")
-        return validSourceMapLeaf(parsed);
-    const leaves = flattenSourceMapLeaves(parsed, { validateOffsets: true });
-    if (leaves === undefined)
-        return false;
-    return leaves.every(validSourceMapLeaf);
+const checkOperation = (callerSignal, operationSignal, deadlineAt) => {
+    if (callerSignal?.aborted === true)
+        throw callerSignal.reason;
+    if (operationSignal?.aborted === true)
+        throw operationSignal.reason;
+    if (Date.now() >= deadlineAt)
+        throw new SourceMapDeadlineError();
 };
-const validSourceMapLeaf = (map) => typeof map.mappings === "string" &&
-    Array.isArray(map.sources) &&
-    Array.isArray(map.names) &&
-    hasValidSourceMapContents(map.sources.length, map.sourcesContent);
 const approvedUrl = (value, allowedOrigins) => {
     try {
         const parsed = new URL(value);
@@ -235,6 +496,99 @@ const sanitizeSource = (value) => {
         return value;
     }
 };
+const preflightResolvedSourceBytes = (leaves, mapUrl, budget, resolvedByRoot, sanitizedByResolved, check) => {
+    let estimate = budget.expandedBytes;
+    let resolvedBytes = budget.resolvedSourceBytes;
+    for (const { map } of leaves) {
+        let sourcesForRoot = resolvedByRoot.get(map.sourceRoot ?? null);
+        if (sourcesForRoot === undefined) {
+            sourcesForRoot = new Map();
+            resolvedByRoot.set(map.sourceRoot ?? null, sourcesForRoot);
+        }
+        for (const source of map.sources) {
+            check();
+            const sourceKey = source ?? "";
+            let resolved = sourcesForRoot.get(sourceKey);
+            if (resolved === undefined)
+                resolved = resolveSourceMapSource(source, map.sourceRoot, mapUrl);
+            const bytes = Buffer.byteLength(resolved, "utf8");
+            if (bytes > SOURCE_MAP_RESPONSE_BYTES - resolvedBytes)
+                throw resolvedSourceLimitFailure();
+            resolvedBytes += bytes;
+            sourcesForRoot.set(sourceKey, resolved);
+            const sanitized = cachedSanitized(sanitizedByResolved, resolved);
+            estimate += jsonBytes(sanitized);
+            if (estimate > WEB_SOURCE_MAP_LIMITS.outputBytes)
+                throw expandedOutputFailure();
+        }
+    }
+    budget.resolvedSourceBytes = resolvedBytes;
+};
+const consumeExpandedBytes = (budget, bytes) => {
+    if (bytes > WEB_SOURCE_MAP_LIMITS.outputBytes - budget.expandedBytes)
+        throw expandedOutputFailure();
+    budget.expandedBytes += bytes;
+};
+const expandedOutputFailure = () => new SourceMapFormatFailure("limit", `Expanded source-map evidence exceeds the ${WEB_SOURCE_MAP_LIMITS.outputBytes / (1024 * 1024)} MiB public representation budget.`);
+const resolvedSourceLimitFailure = () => new SourceMapFormatFailure("limit", `Resolved source-map identities exceed the ${SOURCE_MAP_RESPONSE_BYTES / (1024 * 1024)} MiB decoder representation budget.`);
+const jsonBytes = (value) => {
+    let bytes = 0;
+    for (const part of jsonParts(value))
+        bytes += Buffer.byteLength(part, "utf8");
+    return bytes;
+};
+const artifactMetadataBytes = (mediaType, text) => Buffer.byteLength(JSON.stringify({
+    sha256: "0".repeat(64),
+    bytes: Buffer.byteLength(text),
+    media_type: mediaType,
+    charset: "utf-8",
+    text: "",
+})) - 2;
+const sourceMapFailureReservation = (request) => {
+    const envelope = emptySourceMapItem({ ...request, declaredUrl: "", scriptKey: "" }, "fetch_failed", "x".repeat(SOURCE_MAP_FAILURE_LIMITATION_RESERVE));
+    return (Buffer.byteLength(JSON.stringify(envelope)) -
+        4 +
+        jsonBytes(request.declaredUrl) +
+        jsonBytes(request.scriptKey));
+};
+const sourceMapSuccessReservation = (request) => {
+    const context = sourceMapContext({
+        ...request,
+        declaredUrl: "",
+        scriptKey: "",
+    });
+    const envelope = {
+        ...context,
+        status: "included",
+        artifact: null,
+        original_sources: [],
+        original_module_edges: [],
+        mappings: [],
+        limitation: null,
+    };
+    return (Buffer.byteLength(JSON.stringify(envelope)) -
+        4 +
+        jsonBytes(request.declaredUrl) +
+        jsonBytes(request.scriptKey));
+};
+const sourceEntryOverheadBytes = () => Buffer.byteLength('{"source":,"artifact":null}');
+const cachedJsonBytes = (cache, value) => {
+    const cached = cache.get(value);
+    if (cached !== undefined)
+        return cached;
+    const bytes = jsonBytes(value);
+    cache.set(value, bytes);
+    return bytes;
+};
+const cachedSanitized = (cache, value) => {
+    const cached = cache.get(value);
+    if (cached !== undefined)
+        return cached;
+    const sanitized = sanitizeSource(value);
+    cache.set(value, sanitized);
+    return sanitized;
+};
+const mappingRowBytes = (generatedLine, generatedColumn, originalLine, originalColumn) => Buffer.byteLength(`{"generated_line":${String(generatedLine)},"generated_column":${String(generatedColumn)},"source":,"original_line":${String(originalLine)},"original_column":${String(originalColumn)},"name":}`);
 const resolveOriginalSource = (specifier, base) => {
     if (!isUrlLikeModuleSpecifier(specifier))
         return null;

package/dist/browser/assets/LocalWebScriptArtifacts.js

@@ -1,5 +1,5 @@
 import { lstat, realpath } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { readStableArtifact } from "../../artifacts/readStableArtifact.js";
 import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
@@ -31,7 +31,7 @@ export class LocalWebScriptArtifacts {
             const portable = normalizeArtifactPath(selected.content.relative_path);
             if (portable !== selected.content.relative_path)
                 throw new ArtifactReaderFailure("path", `Selected source path changes during normalization: ${selected.content.relative_path}`);
-            const root = dirname(input.manifest_path);
+            const root = resolve(dirname(input.manifest_path));
             const sourcePath = join(root, "files", portable);
             targetPath = sourcePath;
             await assertContained(root, sourcePath);