sygnal 7.0.0 → 7.2.0-preview.0

package/dist/sandbox-worker.cjs.js

@@ -0,0 +1,857 @@
+'use strict';
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+/*
+ * sygnal/sandbox: what the page and the guest kernel agree on (research: dev-plans/research/sandbox).
+ *
+ * The protocol is internal and versioned: a kernel built from another Sygnal version is refused
+ * at boot ('protocol'), never half understood. It is the part a native or edge host would
+ * reimplement:
+ *
+ *   page → guest  (QuickJS entries on the kernel's `__sandbox`):
+ *     dispatch(id, type, initJson) → 1 when prevented   fire(timerId)   resolve(fetchId, ok, json)
+ *     props(json)   start(exportName)   flush()          v (the protocol number)
+ *   guest → page  (host functions on `__host`, each checked):
+ *     render(json)  {v, tree, types, f?}: tree = [node], node = {i, t, a, s?, v?, k?, c} | {i, x} | id
+ *                   (an id alone: an unchanged subtree), types = DOM event types to forward,
+ *                   f = the id the guest moved focus to
+ *     emit(json)    {type, data}          log(level, text)
+ *     timer(id, ms) (ms < 0: setImmediate) clearTimer(id)   fetch(id, url, initJson)
+ *   page ↔ worker (postMessage; `isolation: 'worker'`):
+ *     → init {v, kernel, source, props, limits, fetch}  event {id, type, init}  props {p}  ping  fetched {id, ok, res|error}
+ *     ← ready {v, wasmMs, bootMs}  render {json}  emit {e}  log {l, x}  fetch {id, url, init}  pong  error {reason, message}
+ */
+const PROTOCOL = 1;
+class SandboxError extends Error {
+    constructor(reason, message) {
+        super(message);
+        this.name = 'SandboxError';
+        this.reason = reason;
+    }
+}
+// README §8: an instance per sandbox capped at 64 MB, heap 32 MB, stack 256 KB, boot 1 s, 100 ms per entry, CPU 50 %
+const DEFAULT_LIMITS = {
+    memoryBytes: 32 << 20, // QuickJS's heap (the kernel alone takes ~4 MB)
+    // QuickJS's own stack check must fire before the host engine's: at 512 KB a guest recursion
+    // overflows V8's native stack first, a host RangeError unwinds the WASM mid-call, and freeing
+    // that runtime aborts the whole module (README §5, finding 3). 384 KB and below are caught.
+    stackBytes: 256 << 10,
+    // the instance's whole linear memory (heap, ArrayBuffers, C stack): setMemoryLimit() doesn't
+    // count ArrayBuffer storage (README finding 1), a capped WebAssembly.Memory does
+    maxWasmBytes: 64 << 20,
+    bootMs: 1000, // kernel + component + first render
+    callMs: 100, // one event, timer or fetch reply, with the flush it causes
+    cpuShare: 0.5, // guest time per rolling second
+    hardMs: 1000, // worker: the watchdog terminates a worker silent this long
+    maxTimers: 64,
+    minTimerMs: 4,
+    maxFetches: 4, // in flight
+    maxMessageBytes: 1 << 20,
+    maxLogs: 100,
+};
+/** above this, a guest recursion can overflow the host's stack before QuickJS's check (a crash) */
+const MAX_STACK_BYTES = 384 << 10;
+function limitsOf(l) {
+    const out = { ...DEFAULT_LIMITS };
+    for (const k of Object.keys(l || {})) {
+        if (!(k in DEFAULT_LIMITS))
+            continue;
+        const v = Number(l[k]);
+        if (!(v > 0))
+            throw new TypeError(`sygnal/sandbox: limits.${k} must be a positive number`);
+        out[k] = v;
+    }
+    if (out.stackBytes > MAX_STACK_BYTES)
+        throw new RangeError(`sygnal/sandbox: limits.stackBytes over ${MAX_STACK_BYTES} can crash the WASM module instead of throwing in the guest`);
+    return out;
+}
+/** an allowlist entry is a URL prefix: same origin, path under its path */
+function allowed(u, allow) {
+    if (u.username || u.password)
+        return false;
+    return allow.some((a) => {
+        if (a instanceof RegExp)
+            return a.test(u.href);
+        const p = new URL(a);
+        return u.origin === p.origin && u.pathname.startsWith(p.pathname);
+    });
+}
+/**
+ * The request the page makes for a guest (both tiers): the allowlist, the methods, accept /
+ * content-type headers only, `credentials: 'omit'` (never the user's cookies), `redirect: 'error'`
+ * (a redirect could leave the allowlist), the response size capped. Resolves with a plain
+ * {status, headers, body} or rejects with the reason.
+ */
+async function capFetch(f, url, init, maxBytes, signal) {
+    if (!f)
+        throw new Error('no fetch capability');
+    let u;
+    try {
+        u = f.base ? new URL(url, f.base) : new URL(url);
+    }
+    catch {
+        throw new Error(`bad URL ${String(url).slice(0, 80)}`);
+    }
+    if (!allowed(u, f.allow || []))
+        throw new Error(`${u.origin}${u.pathname} is not allowed`);
+    const method = String(init?.method || 'GET').toUpperCase();
+    if (!(f.methods || ['GET']).map((m) => m.toUpperCase()).includes(method))
+        throw new Error(`method ${method} is not allowed`);
+    const headers = {};
+    for (const [k, v] of Object.entries(init?.headers || {}))
+        if (/^(accept|content-type)$/i.test(k))
+            headers[k] = String(v);
+    const body = typeof init?.body == 'string' && method !== 'GET' && method !== 'HEAD' ? init.body : undefined;
+    const r = await (f.impl || globalThis.fetch)(u.href, { method, headers, body, credentials: 'omit', redirect: 'error', signal });
+    const text = await r.text();
+    if (text.length > (f.maxBodyBytes || maxBytes))
+        throw new Error('response too large');
+    return { status: r.status, headers: { 'content-type': r.headers.get('content-type') || '' }, body: text };
+}
+
+/*
+ * The QuickJS WASM module: `quickjs-emscripten-core` + `@jitl/quickjs-wasmfile-release-sync`,
+ * optional peer dependencies (D209), loaded on first use. Stock packages only (README §9 Q6):
+ * a quickjs-ng variant can be passed as `variant`.
+ */
+let compiled = null;
+let shared = null;
+const isNode = () => typeof globalThis.process == 'object' && !!globalThis.process.versions?.node && typeof globalThis.window == 'undefined';
+/**
+ * A QuickJS module. By default a fresh instance whose own `WebAssembly.Memory` is capped at
+ * `maxWasmBytes` (64 MB): QuickJS's `setMemoryLimit()` doesn't count ArrayBuffer storage, so
+ * without the cap a guest can grow the instance to 2 GB (README finding 1). Instances share
+ * one compiled `WebAssembly.Module` (compiled once per page).
+ */
+async function loadQuickJS(opts = {}) {
+    if (opts.shared && !opts.wasm && !opts.variant && shared)
+        return shared;
+    const p = load(opts);
+    if (opts.shared && !opts.wasm && !opts.variant)
+        shared = p;
+    return p;
+}
+async function load({ maxWasmBytes = 64 << 20, shared: sh, variant, wasm }) {
+    let core, base;
+    try {
+        core = await import('quickjs-emscripten-core');
+        base = variant || (await import('@jitl/quickjs-wasmfile-release-sync')).default;
+    }
+    catch (e) {
+        throw new Error("sygnal/sandbox needs quickjs-emscripten-core and @jitl/quickjs-wasmfile-release-sync (optional peer dependencies): npm install quickjs-emscripten-core @jitl/quickjs-wasmfile-release-sync (" + (e?.message || e) + ')');
+    }
+    const custom = {};
+    if (wasm)
+        custom.wasmModule = wasm instanceof WebAssembly.Module ? wasm : await WebAssembly.compile(wasm);
+    else if (!variant && isNode())
+        custom.wasmModule = await (compiled ?? (compiled = nodeWasm()));
+    // a browser without `wasm` lets the variant fetch its .wasm itself (the bundler emits the file)
+    if (!sh)
+        custom.wasmMemory = new WebAssembly.Memory({ initial: 256, maximum: Math.max(256, Math.ceil(maxWasmBytes / 65536)) });
+    return core.newQuickJSWASMModuleFromVariant(Object.keys(custom).length ? core.newVariant(base, custom) : base);
+}
+async function nodeWasm() {
+    const [{ readFile }, { createRequire }] = await Promise.all([nodeImport('node:fs/promises'), nodeImport('node:module')]);
+    // next to sygnal (a peer), else from the app's root
+    let file;
+    try {
+        file = createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('sandbox-worker.cjs.js', document.baseURI).href))).resolve('@jitl/quickjs-wasmfile-release-sync/wasm');
+    }
+    catch {
+        file = createRequire(globalThis.process.cwd() + '/').resolve('@jitl/quickjs-wasmfile-release-sync/wasm');
+    }
+    return WebAssembly.compile(await readFile(file));
+}
+// Node built-ins by a name bundlers don't follow (a browser bundle never loads them)
+const nodeImport = (name) => import(/* @vite-ignore */ /* webpackIgnore: true */ name);
+/**
+ * Modules a guest crashed: the host's stack overflowed or the WASM trapped in the middle of a
+ * QuickJS call, so its C state was unwound without cleanup. createSandbox refuses them.
+ */
+const poisoned = new WeakSet();
+const checkModule = (QJS) => {
+    if (!QJS || typeof QJS.newRuntime != 'function')
+        throw new TypeError('sygnal/sandbox: quickjs must be a module from loadQuickJS()');
+    if (poisoned.has(QJS))
+        throw new SandboxError('crash', 'this QuickJS module crashed earlier; load a fresh one');
+};
+
+/*
+ * The page's side of the tree: mirrors the guest's serialized host tree into the real DOM through
+ * a sanitizer, and forwards DOM events back.
+ *
+ * Everything that arrives is untrusted (the guest can send any JSON). The mirror:
+ *   - creates only allowlisted tags and attributes (no on*, srcdoc, formaction, <script>,
+ *     <iframe>, <style>, <svg>, …); unknown tags are dropped, never rendered;
+ *   - checks URLs: <a href> only http(s)/mailto (clicks never navigate by themselves: see
+ *     bindEvents), <img src> only data:image/* or an allowlisted origin (an image is a request);
+ *   - filters inline style (no url(), image-set(), expression(), escapes; plain names only);
+ *   - prefixes ids (and for / aria-* references to them) so the guest can't clobber the page's
+ *     ids or `window.<id>`; `name` only on form fields; classes are kept (the page's design system
+ *     styles the guest) unless `classPrefix` is set;
+ *   - limits nodes, depth and text so a huge tree can't stall the page;
+ *   - confines layout: the root has `contain: content` (a containing block for position: fixed,
+ *     paint clipped), `isolation: isolate` and `overflow: hidden` (no overlaying the page).
+ * A violation is recorded (violations[]) and the offending part dropped; a malformed tree (a
+ * cycle, a node inside itself) throws, and the sandbox is killed.
+ */
+const TAGS = new Set(('div span p a button input textarea select option optgroup label ul ol li h1 h2 h3 h4 h5 h6 strong em b i u s small ' +
+    'code pre kbd br hr img table caption thead tbody tfoot tr td th colgroup col form fieldset legend section article header ' +
+    'footer nav main aside figure figcaption details summary progress meter time abbr blockquote q cite dl dt dd mark sub sup output').split(' '));
+const ATTRS = /^(class|title|role|tabindex|lang|dir|hidden|alt|width|height|colspan|rowspan|scope|open|value|placeholder|checked|selected|disabled|readonly|required|multiple|min|max|step|minlength|maxlength|pattern|size|rows|cols|wrap|autocomplete|spellcheck|start|reversed|datetime|high|low|optimum|label|draggable)$|^aria-[a-z-]+$|^data-[a-z0-9-]+$/;
+// no password or file inputs (phishing, file exfiltration)
+const INPUT_TYPES = /^(text|search|email|url|tel|number|range|date|time|datetime-local|month|week|color|checkbox|radio|button|submit|reset|hidden)$/;
+const ID_REFS = /^(for|aria-labelledby|aria-describedby|aria-controls|aria-owns|aria-activedescendant|list)$/;
+const SAFE_HREF = /^(https?:|mailto:)/i;
+const BAD_STYLE = /url\s*\(|image-set|expression|javascript:|\\|@|<|behavior|binding/i;
+const FIELD = /^(input|textarea|select|button|output|fieldset)$/;
+const CLASS_TOKEN = /^[A-Za-z0-9_-]+$/;
+const DEFAULT_POLICY = { maxNodes: 5000, maxDepth: 128, maxText: 1 << 20, imageOrigins: [], classPrefix: '' };
+/** one element's attributes and inline style through the allowlist (the mirror and SSR share it) */
+function sanitize(tag, n, prefix, policy, violate) {
+    const attrs = new Map();
+    const a = n.a && typeof n.a == 'object' ? n.a : {};
+    for (const k0 of Object.keys(a)) {
+        const k = String(k0).toLowerCase(), v = String(a[k0]);
+        if (k === 'id')
+            attrs.set('id', prefix + v);
+        else if (ID_REFS.test(k))
+            attrs.set(k, v.split(/\s+/).filter(Boolean).map((x) => prefix + x).join(' '));
+        else if (k === 'name') {
+            if (FIELD.test(tag))
+                attrs.set(k, v);
+            else
+                violate(`name on <${tag}>`);
+        }
+        else if (k === 'type') {
+            if (tag !== 'input' || INPUT_TYPES.test(v))
+                attrs.set(k, v);
+            else
+                violate(`input type ${v}`);
+        }
+        else if (k === 'href') {
+            if (tag === 'a' && SAFE_HREF.test(v.trim()))
+                attrs.set(k, v);
+            else
+                violate(`href ${v.slice(0, 40)}`);
+        }
+        else if (k === 'src') {
+            if (tag === 'img' && imageOk(v, policy))
+                attrs.set(k, v);
+            else
+                violate(`src ${v.slice(0, 40)}`);
+        }
+        else if (k === 'style')
+            violate('style attribute'); // inline style arrives as n.s, filtered below
+        else if (k === 'class' && policy.classPrefix)
+            attrs.set(k, v.split(/\s+/).filter((c) => CLASS_TOKEN.test(c)).map((c) => policy.classPrefix + c).join(' '));
+        else if (ATTRS.test(k))
+            attrs.set(k, v);
+        else
+            violate(`attribute ${k}`);
+    }
+    if (tag === 'a' && attrs.has('href')) {
+        attrs.set('rel', 'noopener noreferrer');
+        attrs.set('target', '_blank');
+    }
+    const css = [];
+    const s = n.s && typeof n.s == 'object' ? n.s : {};
+    for (const k of Object.keys(s)) {
+        const name = String(k).replace(/[A-Z]/g, (c) => '-' + c.toLowerCase()), v = String(s[k]);
+        if (!/^-?[a-z][a-z-]*$/.test(name) || BAD_STYLE.test(v)) {
+            violate(`style ${name}`);
+            continue;
+        }
+        css.push(`${name}: ${v}`);
+    }
+    return { attrs, css: css.join('; ') };
+}
+function imageOk(v, policy) {
+    if (/^data:image\/(png|gif|jpeg|webp);base64,/i.test(v))
+        return true;
+    try {
+        return policy.imageOrigins.includes(new URL(v).origin);
+    }
+    catch {
+        return false;
+    }
+}
+let roots = 0;
+function createMirror(container, opts = {}) {
+    const policy = { ...DEFAULT_POLICY, ...opts.policy };
+    const doc = container.ownerDocument;
+    const prefix = policy.idPrefix ?? `sbx${++roots}-`;
+    const root = doc.createElement('div');
+    root.setAttribute('data-sandbox-root', '');
+    root.style.cssText = 'contain: content; isolation: isolate; position: relative; overflow: hidden';
+    container.appendChild(root);
+    const nodes = new Map(); // guest id → real node
+    const idOf = new WeakMap(); // real node → guest id
+    const violations = [];
+    const violate = (what) => { if (violations.length < 100)
+        violations.push(what); };
+    let count = 0, text = 0, alive = new Set();
+    const keepSubtree = (n) => {
+        const i = idOf.get(n);
+        if (i !== undefined)
+            alive.add(i);
+        n.childNodes.forEach(keepSubtree);
+    };
+    function build(n, depth) {
+        if (depth > policy.maxDepth)
+            throw new Error('sandbox tree: too deep');
+        if (++count > policy.maxNodes)
+            throw new Error('sandbox tree: too many nodes');
+        if (typeof n == 'number') {
+            const real = nodes.get(n);
+            if (!real)
+                return null; // dropped by the sanitizer when it was sent
+            keepSubtree(real);
+            return real;
+        }
+        if (!n || typeof n != 'object' || typeof n.i != 'number')
+            throw new Error('sandbox tree: malformed node');
+        alive.add(n.i);
+        if (typeof n.x == 'string') {
+            if ((text += n.x.length) > policy.maxText)
+                throw new Error('sandbox tree: too much text');
+            let t = nodes.get(n.i);
+            if (!t || t.nodeType !== 3) {
+                t = doc.createTextNode(n.x);
+                nodes.set(n.i, t);
+                idOf.set(t, n.i);
+            }
+            else if (t.data !== n.x)
+                t.data = n.x;
+            return t;
+        }
+        const tag = String(n.t);
+        if (!TAGS.has(tag)) {
+            violate(`tag <${tag}>`);
+            return null;
+        }
+        let el = nodes.get(n.i);
+        if (!el || el.localName !== tag) {
+            el = doc.createElement(tag);
+            nodes.set(n.i, el);
+            idOf.set(el, n.i);
+        }
+        const { attrs: want, css } = sanitize(tag, n, prefix, policy, violate);
+        for (const a of [...el.attributes])
+            if (a.name !== 'style' && !want.has(a.name))
+                el.removeAttribute(a.name);
+        for (const [k, v] of want)
+            if (el.getAttribute(k) !== v)
+                el.setAttribute(k, v);
+        if ((el.getAttribute('style') || '') !== css)
+            css ? el.setAttribute('style', css) : el.removeAttribute('style');
+        // field state the guest controls
+        const f = el;
+        if ('v' in n && f.value !== String(n.v))
+            f.value = String(n.v);
+        if ('k' in n && (tag === 'input' || tag === 'option'))
+            tag === 'option' ? (f.selected = !!n.k) : (f.checked = !!n.k);
+        const kids = [];
+        for (const c of Array.isArray(n.c) ? n.c : []) {
+            const r = build(c, depth + 1);
+            if (r)
+                kids.push(r);
+        }
+        for (let i = 0; i < kids.length; i++) {
+            if (kids[i].contains(el))
+                throw new Error('sandbox tree: a node inside itself');
+            if (el.childNodes[i] !== kids[i])
+                el.insertBefore(kids[i], el.childNodes[i] || null);
+        }
+        while (el.childNodes.length > kids.length)
+            el.removeChild(el.lastChild);
+        return el;
+    }
+    return {
+        root, violations, prefix,
+        /** apply one render's tree; throws on a malformed one */
+        apply(tree) {
+            count = 0;
+            text = 0;
+            alive = new Set();
+            const top = [];
+            for (const n of Array.isArray(tree) ? tree : []) {
+                const r = build(n, 0);
+                if (r)
+                    top.push(r);
+            }
+            for (let i = 0; i < top.length; i++) {
+                if (root.childNodes[i] !== top[i])
+                    root.insertBefore(top[i], root.childNodes[i] || null);
+            }
+            while (root.childNodes.length > top.length)
+                root.removeChild(root.lastChild);
+            for (const k of [...nodes.keys()])
+                if (!alive.has(k))
+                    nodes.delete(k);
+        },
+        /**
+         * The guest moved focus (README §9 Q5): only with the focus capability, and only while the
+         * page's focus is already inside the box. A guest can manage focus in its own dialog, never
+         * take it from the page.
+         */
+        focus(id) {
+            const el = nodes.get(id);
+            if (!opts.focus)
+                return void violate('focus (no focus capability)');
+            if (!el || el.nodeType !== 1 || !root.contains(doc.activeElement) || doc.activeElement === el)
+                return;
+            el.focus?.();
+        },
+        /** the guest id of a real node, or of its nearest mirrored ancestor inside the root */
+        idFor(target) {
+            for (let n = target; n && n !== root; n = n.parentNode) {
+                const i = idOf.get(n);
+                if (i !== undefined)
+                    return i;
+            }
+            return undefined;
+        },
+        clear() { root.remove(); nodes.clear(); },
+    };
+}
+const FORWARD = /^(click|dblclick|input|change|submit|keydown|keyup|focus|blur|focusin|focusout|pointerdown|pointerup|mouseenter|mouseleave)$/;
+const NO_BUBBLE = /^(focus|blur|mouseenter|mouseleave)$/;
+const STOP = ('click dblclick auxclick contextmenu mousedown mouseup mouseover mouseout pointerdown pointerup pointerover pointerout ' +
+    'input change submit reset keydown keyup keypress beforeinput focusin focusout touchstart touchend wheel select').split(' ');
+const KEYS = ['key', 'code', 'shiftKey', 'ctrlKey', 'altKey', 'metaKey', 'button', 'clientX', 'clientY'];
+/**
+ * DOM events → the guest: one listener at the mirror's root per type the guest listens for
+ * (delegation, as the DOM driver does), with the event's plain fields and the target's value /
+ * checked. `dispatch` returns whether the guest prevented the default (in-thread: synchronous;
+ * a worker answers too late, so only declared keys are prevented). A form submit and a link
+ * click never act on the page by themselves: an unprevented link click goes to `navigate(href)`.
+ */
+function bindEvents(mirror, dispatch, navigate) {
+    const root = mirror.root, on = new Map();
+    const add = (key, l, capture = false) => {
+        on.set(key, [l, capture]);
+        root.addEventListener(key.replace(/^\$/, ''), l, capture);
+    };
+    function onEvent(e) {
+        const id = mirror.idFor(e.target);
+        if (id === undefined)
+            return;
+        const t = e.target, init = {};
+        for (const k of KEYS)
+            if (e[k] !== undefined)
+                init[k] = e[k];
+        if (t && /^(INPUT|TEXTAREA|SELECT)$/.test(t.tagName)) {
+            init.value = t.value;
+            if (t.type === 'checkbox' || t.type === 'radio')
+                init.checked = t.checked;
+        }
+        if (dispatch(id, e.type, init))
+            e.preventDefault();
+    }
+    add('$submit', (e) => e.preventDefault());
+    // The guest's elements are not the host app's: its delegated intents (DOM.select('.danger'),
+    // bubbling at the app root) must never see a sandboxed element's events, or a guest could render
+    // a class the host listens to and have the user trigger a host action. The page's own capture
+    // listeners still see them.
+    for (const t of STOP)
+        add('$' + t, (e) => e.stopPropagation());
+    const link = (e) => {
+        const a = e.target?.closest?.('a[href]');
+        if (!a || !root.contains(a))
+            return;
+        const was = e.defaultPrevented;
+        e.preventDefault();
+        if (!was)
+            navigate?.(a.getAttribute('href'));
+    };
+    add('$click', link);
+    return {
+        listen(types) {
+            for (const t of types)
+                if (!on.has(t) && FORWARD.test(t))
+                    add(t, onEvent, NO_BUBBLE.test(t));
+            // the link check runs after the guest's own click (whose preventDefault it honours): last
+            if (types.includes('click')) {
+                root.removeEventListener('click', link);
+                root.addEventListener('click', link);
+            }
+        },
+        detach() {
+            for (const [t, [l, c]] of on)
+                root.removeEventListener(t.replace(/^\$/, ''), l, c);
+            root.removeEventListener('click', link);
+            on.clear();
+        },
+    };
+}
+
+/*
+ * The in-thread engine: one guest in its own QuickJS runtime and context. Used directly for
+ * `isolation: 'thread'`, and inside the Worker for `isolation: 'worker'` (no container there:
+ * renders go out as JSON).
+ *
+ * Isolation comes from QuickJS: the guest's globals are QuickJS's own (no window, document,
+ * fetch, storage; the Function constructor reaches only the guest global). Its only way out is
+ * the `__host` functions below, each of which checks its arguments. Every entry (boot, an event,
+ * a timer, a fetch reply) runs under a deadline (the interrupt handler) with the runtime's
+ * memory and stack limits, and a CPU share over a rolling second. A guest that trips a limit is
+ * killed: there is no safe way to resume a context interrupted half way through a flush.
+ *
+ * The deadline stops accidents, not hostile code: QuickJS polls the interrupt handler once per
+ * 10,000 ticks and never inside a builtin (README finding 2). The Worker's watchdog is the hard stop.
+ */
+const ENTRIES = ['dispatch', 'fire', 'resolve', 'props', 'start', 'flush'];
+function createEngine(QJS, opts) {
+    checkModule(QJS);
+    const limits = opts.limits;
+    const now = () => performance.now();
+    const stats = { bootMs: 0, calls: 0, guestMs: 0, renders: 0, lastCallMs: 0 };
+    let deadline = Infinity;
+    const rt = QJS.newRuntime();
+    rt.setMemoryLimit(limits.memoryBytes);
+    rt.setMaxStackSize(limits.stackBytes);
+    rt.setInterruptHandler(() => now() > deadline);
+    const ctx = rt.newContext();
+    let dead = false, crashed = false, logs = 0, immediates = 0;
+    // renders are deltas against the previous one (unchanged subtrees are bare ids): all are applied, in order
+    const renders = [], emits = [];
+    const timers = new Map(), fetches = new Map();
+    const mirror = opts.container ? createMirror(opts.container, { policy: opts.policy, focus: !!opts.focus }) : null;
+    // a DOM event goes into the guest synchronously, so its preventDefault() reaches the page's event
+    const events = mirror && bindEvents(mirror, (id, type, init) => !!enter('dispatch', [id, type, JSON.stringify(init)]), (href) => opts.navigate?.(href));
+    // --- the bridge: the only functions the guest can reach --------------------------------------
+    const str = (h, max = limits.maxMessageBytes) => {
+        if (ctx.typeof(h) !== 'string')
+            throw new SandboxError('protocol', 'expected a string');
+        const s = ctx.getString(h);
+        if (s.length > max)
+            throw new SandboxError('protocol', `message over ${max} bytes`);
+        return s;
+    };
+    const num = (h) => {
+        const n = ctx.typeof(h) === 'number' ? ctx.getNumber(h) : NaN;
+        if (!Number.isFinite(n))
+            throw new SandboxError('protocol', 'expected a number');
+        return n;
+    };
+    const host = ctx.newObject();
+    const fn = (name, f) => {
+        const h = ctx.newFunction(name, (...a) => {
+            try {
+                return f(...a);
+            }
+            catch (e) {
+                // a protocol violation kills; anything else is thrown into the guest
+                if (e instanceof SandboxError)
+                    queueMicrotask(() => kill(e.reason, e.message));
+                return { error: ctx.newError(String(e?.message || e)) };
+            }
+        });
+        ctx.setProp(host, name, h);
+        h.dispose();
+    };
+    fn('render', (h) => {
+        if (renders.length >= 4)
+            throw new SandboxError('protocol', 'too many renders in one call');
+        renders.push(str(h));
+        stats.renders++;
+    });
+    fn('emit', (h) => {
+        // delivered when the guest call returns, after its render (never into a running guest call)
+        if (emits.length >= 64)
+            throw new SandboxError('protocol', 'too many EVENTS in one call');
+        const ev = JSON.parse(str(h, 64 << 10));
+        if (!ev || typeof ev != 'object' || typeof ev.type != 'string')
+            throw new SandboxError('protocol', 'an event needs a string type');
+        emits.push(ev);
+    });
+    fn('log', (lv, h) => {
+        if (++logs > limits.maxLogs)
+            return;
+        const level = str(lv, 16), text = str(h, 4096);
+        if (opts.log)
+            opts.log(level, text);
+        else
+            console[level === 'error' ? 'error' : level === 'warn' ? 'warn' : 'log']('[sandbox]', text);
+    });
+    fn('timer', (idH, msH) => {
+        const id = num(idH), raw = num(msH);
+        // < 0: setImmediate (the core's macrotask hop), counted apart from the component's timers
+        if (raw < 0) {
+            if (immediates >= 16)
+                throw new Error('sandbox: too many setImmediate');
+            immediates++;
+            timers.set(id, setTimeout(() => { immediates--; timers.delete(id); enter('fire', [id]); }, 0));
+            return;
+        }
+        const ms = Math.max(limits.minTimerMs, Math.min(raw, 2 ** 31 - 1));
+        if (timers.size - immediates >= limits.maxTimers)
+            throw new Error(`sandbox: more than ${limits.maxTimers} timers`);
+        timers.set(id, setTimeout(() => { timers.delete(id); enter('fire', [id]); }, ms));
+    });
+    fn('clearTimer', (idH) => {
+        const id = num(idH);
+        clearTimeout(timers.get(id));
+        timers.delete(id);
+    });
+    fn('fetch', (idH, urlH, initH) => {
+        const id = num(idH), url = str(urlH, 4096), init = JSON.parse(str(initH, 256 << 10));
+        const done = (ok, payload) => { fetches.delete(id); if (!dead)
+            enter('resolve', [id, ok ? 1 : 0, payload]); };
+        if (fetches.size >= limits.maxFetches)
+            return void queueMicrotask(() => done(false, 'sandbox fetch denied: too many requests in flight'));
+        const ac = new AbortController();
+        fetches.set(id, ac);
+        capFetch(opts.fetch, url, init, limits.maxMessageBytes, ac.signal)
+            .then((res) => done(true, JSON.stringify(res)), (e) => done(false, `sandbox fetch denied: ${String(e?.message || e)}`));
+    });
+    ctx.setProp(ctx.global, '__host', host);
+    host.dispose();
+    // --- entering the guest -----------------------------------------------------------------------
+    let windowStart = now(), windowMs = 0;
+    const entries = {};
+    function enter(name, args, budget = limits.callMs) {
+        if (dead)
+            return;
+        const t0 = now();
+        deadline = t0 + budget;
+        let out;
+        try {
+            const hs = args.map((a) => (typeof a == 'number' ? ctx.newNumber(a) : ctx.newString(String(a))));
+            const r = ctx.callFunction(entries[name], ctx.undefined, ...hs);
+            hs.forEach((h) => h.dispose());
+            out = settle(r);
+            // the promise jobs (the core's flush is a microtask) run under the same deadline
+            settle(rt.executePendingJobs(10000));
+            if (rt.hasPendingJob())
+                throw new SandboxError('timeout', 'endless promise jobs');
+            // then the tree, once
+            settle(ctx.callFunction(entries.flush, ctx.undefined));
+        }
+        catch (e) {
+            deadline = Infinity;
+            kill(e.reason || classify(e), e.message || String(e));
+            return;
+        }
+        deadline = Infinity;
+        const ms = now() - t0;
+        stats.calls++;
+        stats.guestMs += ms;
+        stats.lastCallMs = ms;
+        if (t0 - windowStart > 1000) {
+            windowStart = t0;
+            windowMs = 0;
+        }
+        if ((windowMs += ms) > limits.cpuShare * 1000) {
+            kill('cpu', `over ${limits.cpuShare * 100}% CPU`);
+            return;
+        }
+        deliver();
+        return out;
+    }
+    function settle(r) {
+        if (r.error) {
+            const e = ctx.dump(r.error);
+            r.error.dispose();
+            const err = new Error(typeof e == 'object' && e ? `${e.name}: ${e.message}` : String(e));
+            err.guest = true;
+            throw err;
+        }
+        const v = ctx.typeof(r.value) === 'number' ? ctx.getNumber(r.value) : undefined;
+        r.value.dispose?.();
+        return v;
+    }
+    function classify(e) {
+        // not the guest's own exception: the host's stack or the WASM gave out mid-call (finding 3)
+        if (!e.guest) {
+            poisoned.add(QJS);
+            crashed = true;
+            return 'crash';
+        }
+        if (/out of memory|stack overflow/i.test(e.message))
+            return 'memory';
+        if (/interrupted/i.test(e.message)) {
+            // near the memory limit every allocation collects the whole heap: that thrash ends as a timeout
+            try {
+                const h = rt.computeMemoryUsage(), m = ctx.dump(h);
+                h.dispose();
+                if (m.memory_used_size > 0.9 * limits.memoryBytes)
+                    return 'memory';
+            }
+            catch { }
+            return 'timeout';
+        }
+        return 'error';
+    }
+    function deliver() {
+        while (renders.length && !dead) {
+            const json = renders.shift();
+            if (!mirror) {
+                opts.onRender?.(json);
+                continue;
+            }
+            try {
+                applyRender(mirror, events, json);
+            }
+            catch (e) {
+                kill('protocol', e.message);
+            }
+        }
+        while (emits.length && !dead)
+            opts.onEmit?.(emits.shift());
+    }
+    // --- lifecycle --------------------------------------------------------------------------------
+    function kill(reason, message) {
+        if (dead)
+            return;
+        dead = true;
+        cleanup();
+        opts.onError?.(new SandboxError(reason, message));
+    }
+    function cleanup() {
+        for (const t of timers.values())
+            clearTimeout(t);
+        for (const ac of fetches.values())
+            ac.abort();
+        timers.clear();
+        fetches.clear();
+        if (mirror) {
+            events.detach();
+            mirror.clear();
+        }
+        // a crashed runtime is leaked: freeing it asserts (an abort that would end the whole module)
+        if (crashed)
+            return;
+        for (const k in entries)
+            entries[k]?.alive && entries[k].dispose();
+        try {
+            ctx.dispose();
+            rt.dispose();
+        }
+        catch {
+            poisoned.add(QJS);
+        }
+    }
+    const t0 = now();
+    deadline = t0 + limits.bootMs;
+    try {
+        settle(ctx.evalCode(opts.kernel, 'sygnal-sandbox-kernel.js'));
+        const sbx = ctx.getProp(ctx.global, '__sandbox');
+        const v = ctx.typeof(sbx) === 'object' ? ctx.getProp(sbx, 'v') : null;
+        const version = v && ctx.typeof(v) === 'number' ? ctx.getNumber(v) : 0;
+        v?.dispose();
+        if (version !== PROTOCOL) {
+            sbx.dispose();
+            throw new SandboxError('protocol', version
+                ? `the kernel speaks protocol ${version}, this sygnal/sandbox ${PROTOCOL}: rebuild it from the installed sygnal`
+                : 'not a sandbox kernel: import it from sygnal/sandbox/kernel?raw through sygnal/vite, or build it with buildSandboxKernel()');
+        }
+        // the kernel's own functions, taken before the component runs (it could replace __sandbox)
+        for (const k of ENTRIES)
+            entries[k] = ctx.getProp(sbx, k);
+        sbx.dispose();
+        settle(ctx.evalCode(opts.source, 'component.js'));
+        deadline = Infinity;
+        if (opts.props !== undefined)
+            enter('props', [JSON.stringify(opts.props)], limits.bootMs);
+        enter('start', [opts.exportName || ''], Math.max(1, limits.bootMs - (now() - t0)));
+    }
+    catch (e) {
+        deadline = Infinity;
+        kill(e.reason || classify(e), e.message);
+    }
+    stats.bootMs = now() - t0;
+    return {
+        stats,
+        get dead() { return dead; },
+        get violations() { return mirror ? mirror.violations : []; },
+        root: mirror ? mirror.root : null,
+        setProps(p) { enter('props', [JSON.stringify(p ?? null)]); },
+        /** an event as if it came from the element with that guest id (tests, benchmarks, the worker) */
+        dispatch(id, type, init = {}) { return enter('dispatch', [id, type, JSON.stringify(init)]); },
+        memory() {
+            if (dead)
+                return null;
+            const h = rt.computeMemoryUsage(), m = ctx.dump(h);
+            h.dispose();
+            return m;
+        },
+        dispose() { if (!dead) {
+            dead = true;
+            cleanup();
+        } },
+    };
+}
+/** one render message onto a mirror (both tiers); throws on a malformed one */
+function applyRender(mirror, events, json) {
+    const msg = JSON.parse(json);
+    if (!msg || typeof msg != 'object' || msg.v !== PROTOCOL)
+        throw new Error('sandbox render: wrong protocol');
+    mirror.apply(msg.tree);
+    events.listen(Array.isArray(msg.types) ? msg.types.map(String) : []);
+    if (typeof msg.f == 'number')
+        mirror.focus(msg.f);
+}
+
+/*
+ * Inside the Worker (a browser Worker or Node's worker_threads): one sandbox, the QuickJS side of
+ * `isolation: 'worker'` (worker.ts). Built as dist/sandbox-worker.{esm,cjs}.js; its only imports
+ * are the optional peers. No DOM here: renders go to the page as JSON, fetches go to the page
+ * (its policy, its fetch), and the page's watchdog terminates the worker when it stops answering.
+ */
+const g = globalThis;
+let port = null;
+const post = (m) => port.postMessage(m);
+const fetches = new Map();
+let sb = null, fetchSeq = 0;
+function onMessage(m) {
+    if (!m || typeof m != 'object')
+        return;
+    if (m.t === 'init')
+        return void init(m).catch((e) => post({ t: 'error', reason: 'error', message: String(e?.message || e) }));
+    if (m.t === 'ping')
+        return post({ t: 'pong' });
+    if (m.t === 'fetched') {
+        const f = fetches.get(m.id);
+        fetches.delete(m.id);
+        return f && (m.ok ? f.ok(m.res) : f.fail(new Error(m.error)));
+    }
+    if (!sb)
+        return;
+    if (m.t === 'event')
+        sb.dispatch(m.id, String(m.type), m.init || {});
+    else if (m.t === 'props')
+        sb.setProps(m.p);
+}
+async function init(m) {
+    if (m.v !== PROTOCOL)
+        return post({ t: 'error', reason: 'protocol', message: `the page speaks protocol ${m.v}, the worker ${PROTOCOL}` });
+    const limits = limitsOf(m.limits);
+    const t0 = performance.now();
+    const QJS = await loadQuickJS({ maxWasmBytes: limits.maxWasmBytes, wasm: m.wasm });
+    const wasmMs = performance.now() - t0;
+    sb = createEngine(QJS, {
+        kernel: m.kernel, source: m.source, exportName: m.exportName, props: m.props, limits,
+        // checked here (the allowlist) and again on the page, which makes the request
+        fetch: m.fetch && { ...m.fetch, impl: (url, init) => new Promise((ok, fail) => {
+                const id = ++fetchSeq;
+                fetches.set(id, { ok, fail });
+                post({ t: 'fetch', id, url, init: { method: init.method, headers: init.headers, body: init.body } });
+            }).then((r) => ({ status: r.status, headers: { get: (k) => r.headers[k.toLowerCase()] ?? null }, text: async () => r.body })) },
+        onEmit: (e) => post({ t: 'emit', e }),
+        log: (l, x) => post({ t: 'log', l, x }),
+        onRender: (json) => post({ t: 'render', json }),
+        onError: (e) => post({ t: 'error', reason: e.reason, message: e.message }),
+    });
+    post({ t: 'ready', v: PROTOCOL, wasmMs, bootMs: sb.stats.bootMs });
+}
+if (typeof g.process == 'object' && g.process.versions?.node && typeof g.WorkerGlobalScope == 'undefined') {
+    // worker_threads: parentPort (it holds messages until the listener is attached)
+    nodeImport('node:worker_threads').then((m) => { port = m.parentPort; port.on('message', onMessage); });
+}
+else {
+    port = g;
+    g.addEventListener('message', (e) => onMessage(e.data));
+}
+//# sourceMappingURL=sandbox-worker.cjs.js.map