runframe 1.0.0

package/dist/test-corpus.js

@@ -0,0 +1,225 @@
+/**
+ * Escape test corpus: Known sandboxing attacks that MUST fail
+ * Used to verify the sandbox actually blocks dangerous operations
+ */
+export const ESCAPE_TESTS = [
+    {
+        name: "Prototype poisoning: Array.prototype.push",
+        code: `
+      Array.prototype.push = function() { throw new Error("ESCAPED!"); };
+      const arr = [];
+      arr.push(1);
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Prototype poisoning: Object.prototype.toString",
+        code: `
+      Object.prototype.toString = () => "ESCAPED";
+      ({}).toString();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Function constructor escape",
+        code: `
+      const fn = Function("return process.env");
+      fn();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "eval() forbidden",
+        code: `
+      eval("process.exit(1)");
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "require() forbidden",
+        code: `
+      const fs = require("fs");
+      fs.readFileSync("/etc/passwd");
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "process global forbidden",
+        code: `
+      process.exit(1);
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Worker threads forbidden",
+        code: `
+      const { Worker } = require("worker_threads");
+      new Worker("x.js");
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Buffer forbidden",
+        code: `
+      const buf = Buffer.alloc(1024);
+      buf.toString();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Dynamic import forbidden",
+        code: `
+      import("fs").then(m => m.readFileSync("/"));
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Constructor property escape",
+        code: `
+      const arr = [];
+      const Ctor = arr.constructor.constructor;
+      const fn = new Ctor("return process");
+      fn();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Symbol.iterator manipulation",
+        code: `
+      Array.prototype[Symbol.iterator] = function() {
+        throw new Error("ESCAPED");
+      };
+      const arr = [1, 2, 3];
+      for (const x of arr) {}
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "__proto__ poisoning",
+        code: `
+      const obj = {};
+      obj.__proto__.ESCAPED = true;
+      ({}).ESCAPED;
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Constructor.constructor escape via array",
+        code: `
+      const Ctor = [].constructor.constructor;
+      const fn = new Ctor("return process");
+      fn();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Constructor.constructor escape via object",
+        code: `
+      const Ctor = ({}).constructor.constructor;
+      const fn = new Ctor("return process");
+      fn();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Constructor.constructor escape via string",
+        code: `
+      const Ctor = "".constructor.constructor;
+      const fn = new Ctor("return process");
+      fn();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "getPrototypeOf escape",
+        code: `
+      const proto = Object.getPrototypeOf([]);
+      const Ctor = proto.constructor.constructor;
+      new Ctor("process.exit()")();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Reflection getOwnPropertyDescriptor escape",
+        code: `
+      const desc = Object.getOwnPropertyDescriptor({}, "x");
+      desc.constructor.constructor("process.exit()")();
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "__proto__ pollution",
+        code: `
+      const obj = {};
+      obj.__proto__.ESCAPED = true;
+      ({}).ESCAPED;
+    `,
+        shouldBlock: true
+    },
+    {
+        name: "Safe: Basic arithmetic",
+        code: `
+      1 + 2 + 3;
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: Array operations",
+        code: `
+      const arr = [1, 2, 3];
+      arr.map(x => x * 2);
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: Object creation",
+        code: `
+      const obj = { a: 1, b: 2 };
+      Object.keys(obj);
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: JSON serialization",
+        code: `
+      JSON.stringify({ x: 1, y: 2 });
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: String operations",
+        code: `
+      "hello world".toUpperCase().split(" ");
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: Math operations",
+        code: `
+      Math.sqrt(16) + Math.PI;
+    `,
+        shouldBlock: false
+    },
+    {
+        name: "Safe: Deterministic date",
+        code: `
+      const d = new Date();
+      d.getTime();
+    `,
+        shouldBlock: false
+    }
+];
+/**
+ * Check if a test result is correct
+ */
+export function checkTestResult(test, threw, timedOut) {
+    if (test.shouldBlock) {
+        // Dangerous code should either throw or timeout
+        return threw || timedOut;
+    }
+    else {
+        // Safe code should succeed without throwing
+        return !threw && !timedOut;
+    }
+}
+//# sourceMappingURL=test-corpus.js.map

package/dist/test-corpus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-corpus.js","sourceRoot":"","sources":["../src/test-corpus.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC;QACE,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,gDAAgD;QACtD,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE;;;;;KAKL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE;;;;;;KAML;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,0CAA0C;QAChD,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,4CAA4C;QAClD,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,IAAI;KAClB;IAED;QACE,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE;;;;KAIL;QACD,WAAW,EAAE,IAAI;KAClB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE;;KAEL;QACD,WAAW,EAAE,KAAK;KACnB;IAED;QACE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;;;KAGL;QACD,WAAW,EAAE,KAAK;KACnB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB,EAAE,KAAc,EAAE,QAAiB;IACjF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,gDAAgD;QAChD,OAAO,KAAK,IAAI,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/vm-runtime.d.ts

@@ -0,0 +1,21 @@
+import { CapabilityGrant } from "./capabilities.js";
+import { StatsCollector } from "./stats.js";
+import { PromiseTracker } from "./async.js";
+/**
+ * Freeze all intrinsic constructors and their prototypes
+ * This prevents prototype poisoning attacks AND constructor.constructor escapes
+ */
+export declare function freezeIntrinsics(): void;
+export declare function createSandboxScope(capabilities: CapabilityGrant, statsCollector: StatsCollector, promiseTracker: PromiseTracker, seed?: number): Record<string, unknown>;
+export interface SandboxRuntimeOptions {
+    capabilities?: Partial<CapabilityGrant>;
+    seed?: number;
+}
+/**
+ * Run code in a strict, isolated VM context with full tracking
+ */
+export declare function runInSandbox(code: string, options?: SandboxRuntimeOptions): Promise<{
+    result: unknown;
+    stats: StatsCollector;
+}>;
+//# sourceMappingURL=vm-runtime.d.ts.map

package/dist/vm-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-runtime.d.ts","sourceRoot":"","sources":["../src/vm-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAA4B,MAAM,YAAY,CAAC;AAoDtE;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAsCvC;AAmED,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,EAC7B,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,cAAc,EAC9B,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6GzB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC,CA6DrD"}

package/dist/vm-runtime.js

@@ -0,0 +1,276 @@
+import vm from "node:vm";
+import { createCapabilityGrant, createCapabilityMembrane } from "./capabilities.js";
+import { createDeterministicGlobals } from "./deterministic.js";
+import { StatsCollector } from "./stats.js";
+import { PromiseTracker, createPromiseInterceptor } from "./async.js";
+/**
+ * Intrinsics that we want to lock down
+ * These are the core objects that malicious code could use to break out
+ */
+const INTRINSICS_TO_FREEZE = [
+    Object,
+    Array,
+    Function,
+    Promise,
+    Map,
+    Set,
+    WeakMap,
+    WeakSet,
+    Date,
+    RegExp,
+    Error,
+    TypeError,
+    ReferenceError,
+    SyntaxError,
+    RangeError
+];
+/**
+ * Recursively freeze an object and all its properties
+ * Prevents any modification of the prototype chain
+ */
+function deepFreeze(obj, visited = new WeakSet()) {
+    if (obj === null || typeof obj !== "object")
+        return;
+    if (visited.has(obj))
+        return;
+    visited.add(obj);
+    Object.freeze(obj);
+    // Freeze all properties
+    for (const prop of Object.getOwnPropertyNames(obj)) {
+        const descriptor = Object.getOwnPropertyDescriptor(obj, prop);
+        if (descriptor && descriptor.value) {
+            deepFreeze(descriptor.value, visited);
+        }
+    }
+    // Freeze symbol properties too
+    for (const sym of Object.getOwnPropertySymbols(obj)) {
+        const descriptor = Object.getOwnPropertyDescriptor(obj, sym);
+        if (descriptor && descriptor.value) {
+            deepFreeze(descriptor.value, visited);
+        }
+    }
+}
+/**
+ * Freeze all intrinsic constructors and their prototypes
+ * This prevents prototype poisoning attacks AND constructor.constructor escapes
+ */
+export function freezeIntrinsics() {
+    // Freeze each intrinsic deeply
+    for (const intrinsic of INTRINSICS_TO_FREEZE) {
+        deepFreeze(intrinsic);
+        deepFreeze(intrinsic.prototype);
+    }
+    // Block .constructor access on all prototype chains
+    const blockConstructor = (proto) => {
+        if (proto === null || typeof proto !== "object")
+            return;
+        try {
+            Object.defineProperty(proto, "constructor", {
+                value: undefined,
+                writable: false,
+                enumerable: false,
+                configurable: false
+            });
+        }
+        catch { }
+    };
+    // Block on all prototypes
+    for (const intrinsic of INTRINSICS_TO_FREEZE) {
+        blockConstructor(intrinsic.prototype);
+        blockConstructor(Object.getPrototypeOf(intrinsic));
+    }
+    // Freeze Object static methods that could be used to escape
+    Object.freeze(Object.getPrototypeOf);
+    Object.freeze(Object.getOwnPropertyDescriptor);
+    Object.freeze(Object.getOwnPropertyNames);
+    Object.freeze(Object.keys);
+    Object.freeze(Object.values);
+    Object.freeze(Object.entries);
+    // Block Reflect API if available
+    if (typeof Reflect !== "undefined") {
+        Object.freeze(Reflect);
+    }
+}
+/**
+ * Create a Proxy handler that blocks dangerous property access
+ * Prevents constructor.constructor and __proto__ escapes
+ */
+function createConstructorBlockingProxy(target) {
+    return new Proxy(target, {
+        get(obj, prop, receiver) {
+            // Block constructor property
+            if (prop === "constructor" ||
+                prop === "__proto__" ||
+                prop === "__constructor") {
+                throw new Error(`Access to property '${String(prop)}' is forbidden`);
+            }
+            // Block dangerous reflection methods
+            if (prop === "getPrototypeOf" ||
+                prop === "setPrototypeOf" ||
+                prop === "getOwnPropertyDescriptor" ||
+                prop === "getOwnPropertyNames" ||
+                prop === "getOwnPropertySymbols") {
+                throw new Error(`Access to reflection method '${String(prop)}' is forbidden`);
+            }
+            return Reflect.get(obj, prop, receiver);
+        },
+        set(obj, prop, value) {
+            if (prop === "constructor" || prop === "__proto__") {
+                throw new Error(`Cannot assign to property '${String(prop)}'`);
+            }
+            return false; // Reject all writes
+        },
+        has(obj, prop) {
+            if (prop === "constructor" || prop === "__proto__") {
+                return false;
+            }
+            return Reflect.has(obj, prop);
+        },
+        ownKeys(obj) {
+            return Reflect.ownKeys(obj).filter((key) => key !== "constructor" && key !== "__proto__");
+        },
+        getOwnPropertyDescriptor(obj, prop) {
+            if (prop === "constructor" || prop === "__proto__") {
+                return undefined;
+            }
+            return Reflect.getOwnPropertyDescriptor(obj, prop);
+        }
+    });
+}
+export function createSandboxScope(capabilities, statsCollector, promiseTracker, seed) {
+    const deterministicGlobals = createDeterministicGlobals(seed);
+    const sandbox = Object.create(null, {
+        // Safe console (captured, no actual I/O)
+        console: {
+            value: createCapabilityMembrane({
+                log: (..._args) => {
+                    // no-op: prevent information leakage
+                },
+                error: (..._args) => {
+                    // no-op
+                },
+                warn: (..._args) => {
+                    // no-op
+                },
+                info: (..._args) => {
+                    // no-op
+                },
+                debug: (..._args) => {
+                    // no-op
+                }
+            }, "console", capabilities.console),
+            writable: false,
+            enumerable: true
+        },
+        // Deterministic date
+        Date: {
+            value: createCapabilityMembrane(deterministicGlobals.Date, "date", capabilities.date),
+            writable: false,
+            enumerable: true
+        },
+        // Safe Math (no random)
+        Math: {
+            value: createCapabilityMembrane(deterministicGlobals.Math, "math", capabilities.math),
+            writable: false,
+            enumerable: true
+        },
+        // Safe JSON
+        JSON: {
+            value: createCapabilityMembrane(deterministicGlobals.JSON, "json", capabilities.json),
+            writable: false,
+            enumerable: true
+        },
+        // Promise with tracking
+        Promise: {
+            value: createPromiseInterceptor(promiseTracker),
+            writable: false,
+            enumerable: true
+        },
+        // Safe undefined (can't be shadowed)
+        undefined: {
+            value: undefined,
+            writable: false,
+            enumerable: true
+        },
+        // Stats collector hook
+        __STATS__: {
+            value: statsCollector,
+            writable: false,
+            enumerable: false
+        },
+        // Deterministic seed function (if enabled)
+        __SEED__: {
+            value: deterministicGlobals.Math_random,
+            writable: false,
+            enumerable: false
+        },
+        // Block reflection APIs
+        Object: {
+            value: createConstructorBlockingProxy(Object),
+            writable: false,
+            enumerable: true
+        },
+        // Remove Reflect if available
+        Reflect: {
+            value: createConstructorBlockingProxy(Reflect || {}),
+            writable: false,
+            enumerable: false
+        }
+    });
+    // Lock down the sandbox object itself
+    return Object.freeze(sandbox);
+}
+/**
+ * Run code in a strict, isolated VM context with full tracking
+ */
+export async function runInSandbox(code, options = {}) {
+    const stats = new StatsCollector();
+    stats.start();
+    try {
+        // Step 1: Freeze intrinsics FIRST, before creating context
+        freezeIntrinsics();
+        const capabilities = createCapabilityGrant(options.capabilities);
+        const promiseTracker = new PromiseTracker();
+        // Step 2: Build sandbox scope with capabilities and tracking
+        const sandbox = createSandboxScope(capabilities, stats, promiseTracker, options.seed);
+        // Step 3: Create VM context with strict settings
+        const context = vm.createContext(sandbox, {
+            name: "node-sandbox",
+            codeGeneration: {
+                strings: false, // No eval, Function constructor
+                wasm: false // No WebAssembly
+            }
+        });
+        // Step 4: Wrap user code in strict mode
+        const wrapped = `
+"use strict";
+(async () => {
+  return (${code});
+})();
+    `;
+        // Step 5: Compile and execute
+        const script = new vm.Script(wrapped, {
+            filename: "sandboxed.js",
+            lineOffset: 0,
+            columnOffset: 0
+        });
+        // Extra safety timeout (main limit is in main thread)
+        const result = await script.runInContext(context, {
+            timeout: 10000, // 10 second internal timeout
+            displayErrors: true,
+            breakOnSigint: true
+        });
+        // Wait for all promises to settle
+        await promiseTracker.waitForAll(5000);
+        stats.markCompleted();
+        return { result, stats };
+    }
+    catch (err) {
+        stats.recordError(err instanceof Error ? err.message : String(err));
+        throw err;
+    }
+    finally {
+        stats.updateMemory();
+    }
+}
+//# sourceMappingURL=vm-runtime.js.map

package/dist/vm-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-runtime.js","sourceRoot":"","sources":["../src/vm-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAI3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtE;;;GAGG;AACH,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,GAAG;IACH,GAAG;IACH,OAAO;IACP,OAAO;IACP,IAAI;IACJ,MAAM;IACN,KAAK;IACL,SAAS;IACT,cAAc;IACd,WAAW;IACX,UAAU;CACX,CAAC;AAEF;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAY,EAAE,OAAO,GAAG,IAAI,OAAO,EAAE;IACvD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAa,CAAC;QAAE,OAAO;IAEvC,OAAO,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnB,wBAAwB;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACnC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACnC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,+BAA+B;IAC/B,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAE,EAAE;QAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QACxD,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC1C,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC;IAEF,0BAA0B;IAC1B,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,gBAAgB,CAAE,SAAoC,CAAC,SAAS,CAAC,CAAC;QAClE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9B,iCAAiC;IACjC,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAmB,MAAS;IACjE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ;YACrB,6BAA6B;YAC7B,IACE,IAAI,KAAK,aAAa;gBACtB,IAAI,KAAK,WAAW;gBACpB,IAAI,KAAK,eAAe,EACxB,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CACpD,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,IACE,IAAI,KAAK,gBAAgB;gBACzB,IAAI,KAAK,gBAAgB;gBACzB,IAAI,KAAK,0BAA0B;gBACnC,IAAI,KAAK,qBAAqB;gBAC9B,IAAI,KAAK,uBAAuB,EAChC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK;YAClB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,CAAC,IAAI,CAAC,GAAG,CAC9C,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,oBAAoB;QACpC,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,GAAG;YACT,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,CACtD,CAAC;QACJ,CAAC;QAED,wBAAwB,CAAC,GAAG,EAAE,IAAI;YAChC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,OAAO,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;KACF,CAAM,CAAC;AACV,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAA6B,EAC7B,cAA8B,EAC9B,cAA8B,EAC9B,IAAa;IAEb,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAClC,yCAAyC;QACzC,OAAO,EAAE;YACP,KAAK,EAAE,wBAAwB,CAC7B;gBACE,GAAG,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE;oBAC3B,qCAAqC;gBACvC,CAAC;gBACD,KAAK,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE;oBAC7B,QAAQ;gBACV,CAAC;gBACD,IAAI,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE;oBAC5B,QAAQ;gBACV,CAAC;gBACD,IAAI,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE;oBAC5B,QAAQ;gBACV,CAAC;gBACD,KAAK,EAAE,CAAC,GAAG,KAAgB,EAAE,EAAE;oBAC7B,QAAQ;gBACV,CAAC;aACF,EACD,SAAS,EACT,YAAY,CAAC,OAAO,CACrB;YACD,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,qBAAqB;QACrB,IAAI,EAAE;YACJ,KAAK,EAAE,wBAAwB,CAC7B,oBAAoB,CAAC,IAAW,EAChC,MAAM,EACN,YAAY,CAAC,IAAI,CAClB;YACD,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,wBAAwB;QACxB,IAAI,EAAE;YACJ,KAAK,EAAE,wBAAwB,CAC7B,oBAAoB,CAAC,IAAW,EAChC,MAAM,EACN,YAAY,CAAC,IAAI,CAClB;YACD,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,YAAY;QACZ,IAAI,EAAE;YACJ,KAAK,EAAE,wBAAwB,CAC7B,oBAAoB,CAAC,IAAW,EAChC,MAAM,EACN,YAAY,CAAC,IAAI,CAClB;YACD,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,wBAAwB;QACxB,OAAO,EAAE;YACP,KAAK,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC/C,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,qCAAqC;QACrC,SAAS,EAAE;YACT,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,uBAAuB;QACvB,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;SAClB;QAED,2CAA2C;QAC3C,QAAQ,EAAE;YACR,KAAK,EAAE,oBAAoB,CAAC,WAAW;YACvC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;SAClB;QAED,wBAAwB;QACxB,MAAM,EAAE;YACN,KAAK,EAAE,8BAA8B,CAAC,MAAM,CAAC;YAC7C,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB;QAED,8BAA8B;QAC9B,OAAO,EAAE;YACP,KAAK,EAAE,8BAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;YACpD,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;SAClB;KACF,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAQ,CAAC;AACvC,CAAC;AAOD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;IACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,IAAI,CAAC;QACH,2DAA2D;QAC3D,gBAAgB,EAAE,CAAC;QAEnB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,MAAM,OAAO,GAAG,kBAAkB,CAChC,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,CAAC,IAAI,CACb,CAAC;QAEF,iDAAiD;QACjD,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE;YACxC,IAAI,EAAE,cAAc;YACpB,cAAc,EAAE;gBACd,OAAO,EAAE,KAAK,EAAG,gCAAgC;gBACjD,IAAI,EAAE,KAAK,CAAM,iBAAiB;aACnC;SACF,CAAC,CAAC;QAEH,wCAAwC;QACxC,MAAM,OAAO,GAAG;;;YAGR,IAAI;;KAEX,CAAC;QAEF,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YACpC,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;YAChD,OAAO,EAAE,KAAK,EAAE,6BAA6B;YAC7C,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtC,KAAK,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,YAAY,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/worker-pool.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Worker thread pool for reusing workers
+ * Dramatically reduces memory and spawn overhead
+ */
+import { Worker } from "node:worker_threads";
+export interface PooledWorker {
+    worker: Worker;
+    busy: boolean;
+    lastUsed: number;
+}
+export interface PoolConfig {
+    minWorkers: number;
+    maxWorkers: number;
+    idleTimeout: number;
+    memoryMb: number;
+}
+export declare class WorkerPool {
+    private workers;
+    private waitQueue;
+    private config;
+    constructor(config: PoolConfig);
+    private createPooledWorker;
+    /**
+     * Get an available worker from the pool
+     */
+    acquire(): Promise<Worker>;
+    /**
+     * Release worker back to pool
+     */
+    release(worker: Worker): void;
+    /**
+     * Clean up idle workers
+     */
+    cleanup(): void;
+    /**
+     * Terminate all workers
+     */
+    destroy(): Promise<void>;
+    /**
+     * Get pool stats
+     */
+    stats(): PoolStats;
+}
+export interface PoolStats {
+    totalWorkers: number;
+    busyWorkers: number;
+    idleWorkers: number;
+    waitingRequests: number;
+}
+/**
+ * Default pool configuration
+ */
+export declare const DEFAULT_POOL_CONFIG: PoolConfig;
+/**
+ * High-concurrency configuration
+ */
+export declare const HIGH_CONCURRENCY_CONFIG: PoolConfig;
+/**
+ * Low-resource configuration
+ */
+export declare const LOW_RESOURCE_CONFIG: PoolConfig;
+//# sourceMappingURL=worker-pool.d.ts.map

package/dist/worker-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../src/worker-pool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAO7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAGT;IACR,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,EAAE,UAAU;IAQ9B,OAAO,CAAC,kBAAkB;IAY1B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BhC;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAgB7B;;OAEG;IACH,OAAO,IAAI,IAAI;IAsBf;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;OAEG;IACH,KAAK,IAAI,SAAS;CAQnB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAKjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAKrC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAKjC,CAAC"}