wasm-idle 0.7.2 → 1.0.0

package/dist/playground/assetBridge.js

@@ -1,46 +1,306 @@
-import { CLANGD_RUNTIME_LOAD_ASSETS, CLANG_RUNTIME_LOAD_ASSETS, JAVA_RUNTIME_LOAD_ASSETS, PYTHON_RUNTIME_LOAD_ASSETS } from './assets';
+import { RUNTIME_LOAD_ASSETS } from './assets';
+import { ProtocolError, verifyRuntimeAssetIntegrity, verifyRuntimeAssetPair } from '@wasm-idle/core';
+import { decompressGzip } from '@wasm-idle/llvm-core';
+import { readPythonPackageAssets } from './pythonPackageLock';
 const encoder = new TextEncoder();
-const transferBuffer = (bytes) => bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength
-    ? bytes.buffer
-    : bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-const expectedAssetsForRuntime = (runtime) => new Set(runtime === 'python'
-    ? [...PYTHON_RUNTIME_LOAD_ASSETS]
-    : runtime === 'java'
-        ? [...JAVA_RUNTIME_LOAD_ASSETS]
-        : runtime === 'clang'
-            ? [...CLANG_RUNTIME_LOAD_ASSETS]
-            : [...CLANGD_RUNTIME_LOAD_ASSETS]);
+const DEFAULT_STREAM_BUFFER_BYTES = 64 * 1024;
+const MAX_RUNTIME_ASSET_BYTES = 128 * 1024 * 1024;
+const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const typedArrayTagGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, Symbol.toStringTag)?.get;
+const typedArrayBufferGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, 'buffer')?.get;
+const typedArrayByteLengthGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, 'byteLength')?.get;
+const typedArrayByteOffsetGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, 'byteOffset')?.get;
+const arrayBufferByteLengthGetter = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength')?.get;
+const blobSizeGetter = Object.getOwnPropertyDescriptor(Blob.prototype, 'size')?.get;
+const blobTypeGetter = Object.getOwnPropertyDescriptor(Blob.prototype, 'type')?.get;
+const runtimeAssetSizeError = (asset, maxBytes = MAX_RUNTIME_ASSET_BYTES) => new Error(`Runtime asset ${asset} exceeds the ${maxBytes} byte limit`);
+const requireRuntimeAssetSize = (asset, byteLength, maxBytes = MAX_RUNTIME_ASSET_BYTES) => {
+    if (!Number.isSafeInteger(byteLength) || byteLength < 0) {
+        throw new Error(`Runtime asset ${asset} has an invalid byte length`);
+    }
+    if (byteLength > maxBytes)
+        throw runtimeAssetSizeError(asset, maxBytes);
+};
+const canonicalUint8Array = (value) => {
+    if (!typedArrayTagGetter ||
+        !typedArrayBufferGetter ||
+        !typedArrayByteLengthGetter ||
+        !typedArrayByteOffsetGetter) {
+        throw new Error('Uint8Array intrinsic accessors are unavailable');
+    }
+    if (Reflect.apply(typedArrayTagGetter, value, []) !== 'Uint8Array') {
+        throw new TypeError('Runtime asset byte data must be a Uint8Array');
+    }
+    const buffer = Reflect.apply(typedArrayBufferGetter, value, []);
+    const byteLength = Reflect.apply(typedArrayByteLengthGetter, value, []);
+    const byteOffset = Reflect.apply(typedArrayByteOffsetGetter, value, []);
+    return new Uint8Array(buffer, byteOffset, byteLength);
+};
+const detachedRuntimeAssetBytesError = (asset) => new Error(`Runtime asset ${asset} byte data is detached or invalid`);
+const tryCanonicalUint8Array = (value, asset) => {
+    if (!typedArrayTagGetter)
+        throw new Error('Uint8Array intrinsic accessors are unavailable');
+    let tag;
+    try {
+        tag = Reflect.apply(typedArrayTagGetter, value, []);
+    }
+    catch {
+        return undefined;
+    }
+    if (tag !== 'Uint8Array')
+        return undefined;
+    try {
+        return canonicalUint8Array(value);
+    }
+    catch {
+        throw detachedRuntimeAssetBytesError(asset);
+    }
+};
+const tryArrayBufferByteLength = (value) => {
+    if (!arrayBufferByteLengthGetter)
+        return undefined;
+    try {
+        return Reflect.apply(arrayBufferByteLengthGetter, value, []);
+    }
+    catch {
+        return undefined;
+    }
+};
+const snapshotArrayBufferBytes = (value, asset, maxBytes) => {
+    const byteLength = tryArrayBufferByteLength(value);
+    if (byteLength === undefined)
+        return undefined;
+    requireRuntimeAssetSize(asset, byteLength, maxBytes);
+    try {
+        return Uint8Array.from(new Uint8Array(value));
+    }
+    catch {
+        throw detachedRuntimeAssetBytesError(asset);
+    }
+};
+const snapshotLoaderBytes = (value, asset, maxBytes) => {
+    const bytes = tryCanonicalUint8Array(value, asset);
+    if (!bytes)
+        return snapshotArrayBufferBytes(value, asset, maxBytes);
+    requireRuntimeAssetSize(asset, bytes.byteLength, maxBytes);
+    return Uint8Array.from(bytes);
+};
+const snapshotMaterializedArrayBuffer = (value, asset, maxBytes) => {
+    const bytes = snapshotArrayBufferBytes(value, asset, maxBytes);
+    if (!bytes) {
+        throw new Error(`Runtime asset ${asset} materialization did not return an ArrayBuffer`);
+    }
+    return bytes;
+};
+const tryCanonicalBlob = (value) => {
+    if (!blobSizeGetter || !blobTypeGetter)
+        return undefined;
+    try {
+        return {
+            blob: value,
+            size: Reflect.apply(blobSizeGetter, value, []),
+            type: Reflect.apply(blobTypeGetter, value, [])
+        };
+    }
+    catch {
+        return undefined;
+    }
+};
+export const boundedUtf8ByteLength = (value, maxBytes = MAX_RUNTIME_ASSET_BYTES) => {
+    let byteLength = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x7f) {
+            byteLength += 1;
+        }
+        else if (codeUnit <= 0x7ff) {
+            byteLength += 2;
+        }
+        else if (codeUnit >= 0xd800 &&
+            codeUnit <= 0xdbff &&
+            index + 1 < value.length &&
+            value.charCodeAt(index + 1) >= 0xdc00 &&
+            value.charCodeAt(index + 1) <= 0xdfff) {
+            byteLength += 4;
+            index += 1;
+        }
+        else {
+            byteLength += 3;
+        }
+        if (byteLength > maxBytes)
+            return byteLength;
+    }
+    return byteLength;
+};
+const runtimeAssetAbortReason = (signal) => signal.reason ?? new DOMException('Runtime asset load aborted', 'AbortError');
+const requireBridgeMaxAssetBytes = (value) => {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new TypeError('Worker asset bridge maxAssetBytes must be a positive safe integer');
+    }
+    return value;
+};
+const cancelResponseBody = (response, reason) => {
+    try {
+        void Promise.resolve(response.body?.cancel(reason)).catch(() => undefined);
+    }
+    catch {
+        // Preserve the asset failure that caused cancellation.
+    }
+};
+const readAbortableArrayBuffer = async (source, signal) => {
+    if (signal.aborted)
+        throw runtimeAssetAbortReason(signal);
+    let cancelOnAbort;
+    const aborted = new Promise((_resolve, reject) => {
+        cancelOnAbort = () => reject(runtimeAssetAbortReason(signal));
+        signal.addEventListener('abort', cancelOnAbort, { once: true });
+    });
+    try {
+        const materialized = source.arrayBuffer();
+        const bytes = await Promise.race([materialized, aborted]);
+        if (signal.aborted)
+            throw runtimeAssetAbortReason(signal);
+        return bytes;
+    }
+    finally {
+        if (cancelOnAbort)
+            signal.removeEventListener('abort', cancelOnAbort);
+    }
+};
+const transferBuffer = (bytes, transferOwnership = false) => {
+    const canonicalBytes = canonicalUint8Array(bytes);
+    const buffer = canonicalBytes.buffer;
+    const transferableBuffer = buffer instanceof ArrayBuffer ? buffer : undefined;
+    const transferableByteLength = transferableBuffer && arrayBufferByteLengthGetter
+        ? Reflect.apply(arrayBufferByteLengthGetter, transferableBuffer, [])
+        : undefined;
+    return transferOwnership &&
+        transferableBuffer &&
+        canonicalBytes.byteOffset === 0 &&
+        canonicalBytes.byteLength === transferableByteLength
+        ? transferableBuffer
+        : Uint8Array.from(canonicalBytes).buffer;
+};
+const expectedAssetsForRuntime = (runtime) => new Set(RUNTIME_LOAD_ASSETS[runtime]);
+const integrityKey = (config) => JSON.stringify(Object.entries(config.integrity || {})
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([asset, entry]) => [
+    asset,
+    typeof entry === 'string'
+        ? entry
+        : {
+            sha256: entry.sha256,
+            bytes: entry.bytes,
+            mediaType: entry.mediaType,
+            uncompressedSha256: entry.uncompressedSha256,
+            uncompressedBytes: entry.uncompressedBytes
+        }
+]));
+const allowedBaseUrlsKey = (config) => JSON.stringify([...(config.allowedBaseUrls || [])].sort());
 class RuntimeLoadProgress {
-    fractions = new Map();
+    samples = new Map();
     expectedAssets;
+    phaseId;
     progress;
+    lockedTotal;
+    measurementInvalid = false;
     constructor(runtime) {
         this.expectedAssets = expectedAssetsForRuntime(runtime);
+        this.phaseId = `${runtime}:runtime-assets`;
         this.reset();
     }
     reset(progress) {
         this.progress = progress;
-        this.fractions.clear();
+        this.samples.clear();
+        this.lockedTotal = undefined;
+        this.measurementInvalid = false;
         for (const asset of this.expectedAssets)
-            this.fractions.set(asset, 0);
+            this.samples.set(asset, { loaded: 0 });
         this.emit();
     }
     update(asset, loaded, total) {
         if (!this.expectedAssets.has(asset))
             return;
-        const fraction = total && total > 0 ? Math.min(loaded / total, 1) : loaded > 0 ? 1 : 0;
-        this.fractions.set(asset, fraction);
+        if (!Number.isSafeInteger(loaded) || loaded < 0) {
+            this.measurementInvalid = true;
+            this.emit();
+            return;
+        }
+        const previous = this.samples.get(asset) || { loaded: 0 };
+        let nextTotal = previous.total;
+        if (total !== undefined) {
+            if (!Number.isSafeInteger(total) || total <= 0) {
+                this.measurementInvalid = true;
+            }
+            else if (previous.total !== undefined && previous.total !== total) {
+                this.measurementInvalid = true;
+            }
+            else {
+                nextTotal = total;
+            }
+        }
+        const nextLoaded = Math.max(previous.loaded, loaded);
+        if (nextTotal !== undefined && nextLoaded > nextTotal) {
+            this.measurementInvalid = true;
+        }
+        this.samples.set(asset, {
+            loaded: nextLoaded,
+            ...(nextTotal === undefined ? {} : { total: nextTotal })
+        });
         this.emit();
     }
+    activity(phase, asset) {
+        if (!this.progress)
+            return;
+        const action = phase === 'decompressing' ? 'Decompressing' : 'Verifying';
+        const label = `${action} ${asset}`;
+        if (this.progress.report) {
+            this.progress.report({
+                kind: 'activity',
+                phase,
+                phaseId: `${this.phaseId}:${asset}`,
+                label
+            });
+            return;
+        }
+        this.progress.set?.(0, label);
+    }
     emit() {
         if (!this.progress)
             return;
-        if (!this.fractions.size)
-            return this.progress.set?.(0);
-        let total = 0;
-        for (const fraction of this.fractions.values())
-            total += fraction;
-        this.progress.set?.(total / this.fractions.size);
+        let completedBytes = 0;
+        let totalBytes = 0;
+        let allTotalsKnown = this.samples.size > 0;
+        for (const sample of this.samples.values()) {
+            if (sample.total === undefined) {
+                allTotalsKnown = false;
+                continue;
+            }
+            completedBytes += sample.loaded;
+            totalBytes += sample.total;
+        }
+        if (!Number.isSafeInteger(completedBytes) || !Number.isSafeInteger(totalBytes)) {
+            this.measurementInvalid = true;
+        }
+        if (allTotalsKnown && this.lockedTotal === undefined)
+            this.lockedTotal = totalBytes;
+        if (this.lockedTotal !== undefined && this.lockedTotal !== totalBytes) {
+            this.measurementInvalid = true;
+        }
+        const measurement = allTotalsKnown && !this.measurementInvalid && totalBytes > 0
+            ? { kind: 'bytes', completed: completedBytes, total: totalBytes }
+            : undefined;
+        if (this.progress.report) {
+            this.progress.report({
+                kind: 'activity',
+                phase: 'downloading',
+                phaseId: this.phaseId,
+                label: 'Downloading runtime assets',
+                ...(measurement ? { measurement } : {})
+            });
+            return;
+        }
+        this.progress.set?.(measurement ? measurement.completed / measurement.total : 0);
     }
 }
 export class WorkerAssetBridge {
@@ -48,44 +308,190 @@ export class WorkerAssetBridge {
     runtime;
     config;
     progress;
-    constructor(worker, runtime, config, progress) {
+    expectedAssets;
+    pythonPackageAssets = new Set();
+    generation = 0;
+    state = 'active';
+    activeLoads = new Set();
+    maxAssetBytes;
+    constructor(worker, runtime, config, progress, maxAssetBytes = MAX_RUNTIME_ASSET_BYTES) {
         this.worker = worker;
         this.runtime = runtime;
         this.config = config;
+        this.maxAssetBytes = requireBridgeMaxAssetBytes(maxAssetBytes);
         this.progress = new RuntimeLoadProgress(runtime);
+        this.expectedAssets = expectedAssetsForRuntime(runtime);
         this.progress.reset(progress);
     }
-    matches(config) {
-        return (this.config.baseUrl === config.baseUrl &&
+    matches(config, maxAssetBytes = this.maxAssetBytes) {
+        return (this.state === 'active' &&
+            this.maxAssetBytes === requireBridgeMaxAssetBytes(maxAssetBytes) &&
+            this.config.baseUrl === config.baseUrl &&
             this.config.loader === config.loader &&
+            integrityKey(this.config) === integrityKey(config) &&
+            allowedBaseUrlsKey(this.config) === allowedBaseUrlsKey(config) &&
             this.config.useAssetBridge === config.useAssetBridge);
     }
-    rebind(worker, config, progress) {
-        this.worker = worker;
-        this.config = config;
-        this.progress.reset(progress);
+    rebind(worker, config, progress, maxAssetBytes = this.maxAssetBytes) {
+        if (this.state === 'disposed') {
+            throw new Error('Cannot rebind a disposed worker asset bridge');
+        }
+        if (this.state === 'rebinding') {
+            throw new Error('Cannot rebind a worker asset bridge while another rebind is active');
+        }
+        const nextMaxAssetBytes = requireBridgeMaxAssetBytes(maxAssetBytes);
+        const preservePythonPackageAssets = this.matches(config, nextMaxAssetBytes);
+        this.state = 'rebinding';
+        const generation = ++this.generation;
+        this.progress.reset();
+        try {
+            this.abortActiveLoads();
+            if (!preservePythonPackageAssets)
+                this.pythonPackageAssets.clear();
+            if (this.state !== 'rebinding' || this.generation !== generation) {
+                throw new Error('Cannot rebind a disposed worker asset bridge');
+            }
+            this.worker = worker;
+            this.config = config;
+            this.maxAssetBytes = nextMaxAssetBytes;
+            this.progress.reset(progress);
+            if (this.state !== 'rebinding' || this.generation !== generation) {
+                throw new Error('Cannot rebind a disposed worker asset bridge');
+            }
+            this.state = 'active';
+        }
+        catch (error) {
+            if (this.state === 'rebinding' && this.generation === generation)
+                this.dispose();
+            throw error;
+        }
+    }
+    dispose() {
+        if (this.state === 'disposed')
+            return;
+        this.state = 'disposed';
+        this.generation += 1;
+        this.progress.reset();
+        this.pythonPackageAssets.clear();
+        this.abortActiveLoads();
     }
     resetProgress(progress) {
+        if (this.state !== 'active')
+            return;
         this.progress.reset(progress);
     }
+    configuredReceiptByteLimit(asset, value) {
+        if (value === undefined)
+            return undefined;
+        if (!Number.isSafeInteger(value) || value < 0) {
+            throw new ProtocolError(`Runtime asset ${asset} has an invalid integrity byte count`, {
+                phase: 'asset',
+                runtimeId: this.runtime
+            });
+        }
+        const byteLimit = value;
+        if (byteLimit > this.maxAssetBytes) {
+            throw runtimeAssetSizeError(asset, this.maxAssetBytes);
+        }
+        return byteLimit;
+    }
+    runtimeAssetByteLimit(asset) {
+        const configured = this.config.integrity?.[asset];
+        if (!configured || typeof configured === 'string')
+            return this.maxAssetBytes;
+        return (this.configuredReceiptByteLimit(asset, configured.uncompressedBytes ?? configured.bytes) ?? this.maxAssetBytes);
+    }
+    sourceAssetByteLimit(asset) {
+        const configured = this.config.integrity?.[asset];
+        if (!configured || typeof configured === 'string')
+            return this.maxAssetBytes;
+        const paired = configured.uncompressedBytes !== undefined ||
+            configured.uncompressedSha256 !== undefined;
+        if (asset.endsWith('.gz')) {
+            if (!paired)
+                return this.maxAssetBytes;
+            const deliveryLimit = this.configuredReceiptByteLimit(asset, configured.bytes);
+            const runtimeLimit = this.configuredReceiptByteLimit(asset, configured.uncompressedBytes);
+            return deliveryLimit !== undefined || runtimeLimit !== undefined
+                ? Math.max(deliveryLimit ?? 0, runtimeLimit ?? 0)
+                : this.maxAssetBytes;
+        }
+        const deliveryLimit = this.configuredReceiptByteLimit(asset, configured.bytes);
+        const runtimeLimit = this.configuredReceiptByteLimit(asset, configured.uncompressedBytes);
+        return deliveryLimit !== undefined || runtimeLimit !== undefined
+            ? Math.max(deliveryLimit ?? 0, runtimeLimit ?? 0)
+            : this.maxAssetBytes;
+    }
     handleMessage(event) {
         const assetRequest = event.data?.assetRequest;
         if (assetRequest) {
-            void this.respond(assetRequest);
+            if (this.state === 'active')
+                void this.respond(assetRequest);
             return true;
         }
         const assetProgress = event.data?.assetProgress;
         if (assetProgress) {
-            this.progress.update(assetProgress.asset, assetProgress.loaded, assetProgress.total);
+            if (this.state === 'active') {
+                this.progress.update(assetProgress.asset, assetProgress.loaded, assetProgress.total);
+            }
             return true;
         }
         return false;
     }
     async respond(request) {
+        if (this.state !== 'active')
+            return;
+        const worker = this.worker;
+        const generation = this.generation;
+        const controller = new AbortController();
+        this.activeLoads.add(controller);
         try {
-            const loaded = await this.loadAsset(request.asset);
-            const buffer = transferBuffer(loaded.bytes);
-            this.worker.postMessage({
+            const loaded = await this.loadAsset(request.asset, controller.signal);
+            const deliveryBytes = canonicalUint8Array(loaded.bytes);
+            const sourceAssetByteLimit = this.sourceAssetByteLimit(request.asset);
+            const runtimeAssetByteLimit = this.runtimeAssetByteLimit(request.asset);
+            requireRuntimeAssetSize(request.asset, deliveryBytes.byteLength, sourceAssetByteLimit);
+            let normalizedRuntimeBytes;
+            if (request.asset.endsWith('.gz')) {
+                this.progress.activity('decompressing', request.asset);
+                normalizedRuntimeBytes = await decompressGzip(deliveryBytes, request.asset, runtimeAssetByteLimit, controller.signal);
+            }
+            else {
+                normalizedRuntimeBytes = deliveryBytes;
+            }
+            const runtimeBytes = canonicalUint8Array(normalizedRuntimeBytes);
+            requireRuntimeAssetSize(request.asset, runtimeBytes.byteLength, runtimeAssetByteLimit);
+            const httpDecodedGzip = (loaded.contentEncoding || '')
+                .toLowerCase()
+                .split(',')
+                .map((encoding) => encoding.trim())
+                .includes('gzip');
+            if (controller.signal.aborted || generation !== this.generation)
+                return;
+            let cancelOnAbort;
+            const aborted = new Promise((_resolve, reject) => {
+                cancelOnAbort = () => reject(runtimeAssetAbortReason(controller.signal));
+                controller.signal.addEventListener('abort', cancelOnAbort, { once: true });
+            });
+            try {
+                if (this.config.integrity?.[request.asset]) {
+                    this.progress.activity('verifying', request.asset);
+                }
+                const verification = this.verifyIntegrity(request.asset, deliveryBytes, runtimeBytes, loaded.mimeType, !httpDecodedGzip);
+                await Promise.race([verification, aborted]);
+            }
+            finally {
+                if (cancelOnAbort) {
+                    controller.signal.removeEventListener('abort', cancelOnAbort);
+                }
+            }
+            if (controller.signal.aborted || generation !== this.generation)
+                return;
+            if (this.runtime === 'python' && request.asset === 'pyodide-lock.json') {
+                this.pythonPackageAssets = readPythonPackageAssets(runtimeBytes);
+            }
+            const buffer = transferBuffer(runtimeBytes, normalizedRuntimeBytes === deliveryBytes ? loaded.transferOwnership : true);
+            worker.postMessage({
                 assetResponse: {
                     id: request.id,
                     ok: true,
@@ -95,104 +501,422 @@ export class WorkerAssetBridge {
             }, [buffer]);
         }
         catch (error) {
-            this.worker.postMessage({
-                assetResponse: {
-                    id: request.id,
-                    ok: false,
-                    error: error instanceof Error ? error.message : String(error)
-                }
-            });
+            if (controller.signal.aborted || generation !== this.generation)
+                return;
+            try {
+                worker.postMessage({
+                    assetResponse: {
+                        id: request.id,
+                        ok: false,
+                        error: error instanceof Error ? error.message : String(error)
+                    }
+                });
+            }
+            catch {
+                // The worker may already be terminated. There is no remaining response channel.
+            }
+        }
+        finally {
+            this.activeLoads.delete(controller);
         }
     }
-    async loadAsset(asset) {
-        const reportProgress = (loaded, total) => this.progress.update(asset, loaded, total);
+    async loadAsset(asset, signal) {
+        if (!this.expectedAssets.has(asset) && !this.pythonPackageAssets.has(asset)) {
+            throw new Error(`Unexpected ${this.runtime} runtime asset: ${asset}`);
+        }
+        if (this.config.integrity && !Object.hasOwn(this.config.integrity, asset)) {
+            throw new Error(`Runtime asset ${asset} is missing integrity metadata`);
+        }
+        if (signal.aborted) {
+            throw runtimeAssetAbortReason(signal);
+        }
+        const sourceAssetByteLimit = this.sourceAssetByteLimit(asset);
+        this.runtimeAssetByteLimit(asset);
+        const reportProgress = (loaded, total) => {
+            if (!signal.aborted)
+                this.progress.update(asset, loaded, total);
+        };
         if (this.config.loader) {
-            const loaded = await this.normalizeLoaderResult(await this.config.loader({
+            const pendingResult = Promise.resolve(this.config.loader({
                 runtime: this.runtime,
                 asset,
-                reportProgress
-            }), asset);
+                reportProgress,
+                signal
+            }));
+            const result = await new Promise((resolve, reject) => {
+                let settled = false;
+                const onAbort = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    signal.removeEventListener('abort', onAbort);
+                    reject(runtimeAssetAbortReason(signal));
+                };
+                signal.addEventListener('abort', onAbort, { once: true });
+                void pendingResult.then((value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    signal.removeEventListener('abort', onAbort);
+                    resolve(value);
+                }, (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    signal.removeEventListener('abort', onAbort);
+                    reject(error);
+                });
+                if (signal.aborted)
+                    onAbort();
+            });
+            if (signal.aborted) {
+                throw runtimeAssetAbortReason(signal);
+            }
+            const loaded = await this.normalizeLoaderResult(result, asset, signal, sourceAssetByteLimit);
+            if (signal.aborted) {
+                throw runtimeAssetAbortReason(signal);
+            }
             if (loaded)
                 return loaded;
         }
-        return await this.fetchAsset(new URL(asset, this.config.baseUrl).href, asset);
+        return await this.fetchAsset(asset, asset, signal, sourceAssetByteLimit);
     }
-    async normalizeLoaderResult(result, asset) {
+    async verifyIntegrity(asset, deliveryBytes, runtimeBytes, mimeType, hasDeliveryBytes = true) {
+        const configured = this.config.integrity?.[asset];
+        if (!configured)
+            return;
+        const expected = typeof configured === 'string' ? { sha256: configured } : configured;
+        if (expected.uncompressedSha256 !== undefined || expected.uncompressedBytes !== undefined) {
+            if (hasDeliveryBytes) {
+                await verifyRuntimeAssetPair({
+                    asset,
+                    compressed: deliveryBytes,
+                    uncompressed: runtimeBytes,
+                    expected,
+                    mimeType
+                });
+            }
+            else {
+                await verifyRuntimeAssetIntegrity({
+                    asset,
+                    bytes: runtimeBytes,
+                    expected,
+                    stage: 'uncompressed',
+                    mimeType
+                });
+            }
+            return;
+        }
+        await verifyRuntimeAssetIntegrity({
+            asset,
+            bytes: runtimeBytes,
+            expected: {
+                ...expected,
+                uncompressedSha256: expected.sha256,
+                uncompressedBytes: expected.bytes ?? runtimeBytes.byteLength
+            },
+            stage: 'uncompressed',
+            mimeType
+        });
+    }
+    async normalizeLoaderResult(result, asset, signal, maxAssetBytes) {
         if (!result)
             return null;
         if (typeof result === 'string' || result instanceof URL) {
-            return await this.fetchAsset(String(result), asset);
-        }
-        if (result instanceof ArrayBuffer) {
-            const bytes = new Uint8Array(result);
-            this.progress.update(asset, bytes.byteLength, bytes.byteLength);
-            return { bytes };
+            return await this.fetchAsset(String(result), asset, signal, maxAssetBytes);
         }
-        if (result instanceof Uint8Array) {
-            this.progress.update(asset, result.byteLength, result.byteLength);
-            return { bytes: result };
+        const directBytes = snapshotLoaderBytes(result, asset, maxAssetBytes);
+        if (directBytes) {
+            this.progress.update(asset, directBytes.byteLength, directBytes.byteLength);
+            return { bytes: directBytes, transferOwnership: true };
         }
-        if (result instanceof Blob) {
-            const bytes = new Uint8Array(await result.arrayBuffer());
+        const directBlob = tryCanonicalBlob(result);
+        const wrappedBlob = typeof result === 'object' && result !== null && 'data' in result
+            ? {
+                value: tryCanonicalBlob(result.data),
+                mimeType: result.mimeType
+            }
+            : undefined;
+        const loaderBlob = directBlob
+            ? { ...directBlob, mimeType: directBlob.type || undefined }
+            : wrappedBlob?.value
+                ? {
+                    ...wrappedBlob.value,
+                    mimeType: wrappedBlob.mimeType || wrappedBlob.value.type || undefined
+                }
+                : undefined;
+        if (loaderBlob) {
+            const { blob, size, mimeType } = loaderBlob;
+            requireRuntimeAssetSize(asset, size, maxAssetBytes);
+            const source = await readAbortableArrayBuffer(blob, signal);
+            const bytes = snapshotMaterializedArrayBuffer(source, asset, maxAssetBytes);
             this.progress.update(asset, bytes.byteLength, bytes.byteLength);
-            return { bytes, mimeType: result.type || undefined };
+            return { bytes, mimeType, transferOwnership: true };
         }
         if ('url' in result && result.url) {
-            return await this.fetchAsset(String(result.url), asset);
+            return await this.fetchAsset(String(result.url), asset, signal, maxAssetBytes);
         }
         if ('data' in result) {
             if (typeof result.data === 'string') {
-                const bytes = encoder.encode(result.data);
+                requireRuntimeAssetSize(asset, boundedUtf8ByteLength(result.data, maxAssetBytes), maxAssetBytes);
+                const bytes = canonicalUint8Array(encoder.encode(result.data));
+                requireRuntimeAssetSize(asset, bytes.byteLength, maxAssetBytes);
                 this.progress.update(asset, bytes.byteLength, bytes.byteLength);
-                return { bytes, mimeType: result.mimeType };
+                return { bytes, mimeType: result.mimeType, transferOwnership: true };
             }
-            if (result.data instanceof ArrayBuffer) {
-                const bytes = new Uint8Array(result.data);
+            const bytes = snapshotLoaderBytes(result.data, asset, maxAssetBytes);
+            if (bytes) {
                 this.progress.update(asset, bytes.byteLength, bytes.byteLength);
-                return { bytes, mimeType: result.mimeType };
-            }
-            if (result.data instanceof Uint8Array) {
-                this.progress.update(asset, result.data.byteLength, result.data.byteLength);
-                return { bytes: result.data, mimeType: result.mimeType };
+                return {
+                    bytes,
+                    mimeType: result.mimeType,
+                    transferOwnership: true
+                };
             }
-            const bytes = new Uint8Array(await result.data.arrayBuffer());
-            this.progress.update(asset, bytes.byteLength, bytes.byteLength);
-            return { bytes, mimeType: result.mimeType || result.data.type || undefined };
         }
         return null;
     }
-    async fetchAsset(url, asset) {
-        const response = await fetch(url);
-        if (!response.ok)
-            throw new Error(`Failed to load ${asset}: ${response.status}`);
-        const contentLength = Number(response.headers.get('content-length') || 0) || undefined;
+    async fetchAsset(url, asset, signal, maxAssetBytes = this.sourceAssetByteLimit(asset)) {
+        const requestUrl = this.requireAllowedAssetUrl(asset, url);
+        if (signal.aborted)
+            throw runtimeAssetAbortReason(signal);
+        const pendingResponse = Promise.resolve(fetch(requestUrl.href, {
+            signal,
+            credentials: 'omit',
+            redirect: 'error',
+            referrerPolicy: 'no-referrer'
+        }));
+        const response = await new Promise((resolve, reject) => {
+            let settled = false;
+            const onAbort = () => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener('abort', onAbort);
+                reject(runtimeAssetAbortReason(signal));
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            void pendingResponse.then((candidate) => {
+                if (settled) {
+                    const reason = runtimeAssetAbortReason(signal);
+                    cancelResponseBody(candidate, reason);
+                    return;
+                }
+                settled = true;
+                signal.removeEventListener('abort', onAbort);
+                resolve(candidate);
+            }, (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener('abort', onAbort);
+                reject(error);
+            });
+            if (signal.aborted)
+                onAbort();
+        });
+        if (signal.aborted) {
+            const reason = runtimeAssetAbortReason(signal);
+            cancelResponseBody(response, reason);
+            throw reason;
+        }
+        if (response.url) {
+            let finalResponseUrl;
+            try {
+                finalResponseUrl = new URL(response.url).href;
+            }
+            catch {
+                const error = new Error(`Runtime asset ${asset} final response URL does not match the requested asset`);
+                cancelResponseBody(response, error);
+                throw error;
+            }
+            if (response.redirected || finalResponseUrl !== requestUrl.href) {
+                const error = new Error(`Runtime asset ${asset} final response URL does not match the requested asset`);
+                cancelResponseBody(response, error);
+                throw error;
+            }
+        }
+        if (!response.ok) {
+            const error = new Error(`Failed to load ${asset}: ${response.status}`);
+            cancelResponseBody(response, error);
+            throw error;
+        }
+        const originalContentLength = response.headers.get('x-wasm-idle-original-content-length');
+        const contentLengthHeader = originalContentLength !== null
+            ? 'x-wasm-idle-original-content-length'
+            : 'content-length';
+        const rawContentLength = originalContentLength ?? response.headers.get('content-length');
+        let contentLength;
+        if (rawContentLength !== null) {
+            const normalizedContentLength = rawContentLength.trim();
+            const parsedContentLength = Number(normalizedContentLength);
+            if (!/^\d+$/u.test(normalizedContentLength) ||
+                !Number.isSafeInteger(parsedContentLength)) {
+                const error = new ProtocolError(`Runtime asset ${asset} has an invalid ${contentLengthHeader}`, { phase: 'asset', runtimeId: this.runtime });
+                cancelResponseBody(response, error);
+                throw error;
+            }
+            contentLength = parsedContentLength;
+        }
+        if (contentLength !== undefined && contentLength > maxAssetBytes) {
+            const error = runtimeAssetSizeError(asset, maxAssetBytes);
+            cancelResponseBody(response, error);
+            throw error;
+        }
         const mimeType = response.headers.get('content-type') || undefined;
+        const contentEncoding = response.headers.get('content-encoding') || undefined;
         if (!response.body) {
-            const bytes = new Uint8Array(await response.arrayBuffer());
+            const bytes = snapshotMaterializedArrayBuffer(await readAbortableArrayBuffer(response, signal), asset, maxAssetBytes);
             this.progress.update(asset, bytes.byteLength, contentLength ?? bytes.byteLength);
-            return { bytes, mimeType };
+            return { bytes, contentEncoding, mimeType, transferOwnership: true };
         }
         const reader = response.body.getReader();
+        let readerCancelled = false;
+        if (signal.aborted) {
+            const reason = runtimeAssetAbortReason(signal);
+            readerCancelled = true;
+            try {
+                void reader.cancel(reason).catch(() => undefined);
+            }
+            catch { }
+            try {
+                reader.releaseLock();
+            }
+            catch { }
+            throw reason;
+        }
+        let cancelOnAbort;
+        const aborted = new Promise((_resolve, reject) => {
+            cancelOnAbort = () => {
+                const reason = runtimeAssetAbortReason(signal);
+                if (!readerCancelled) {
+                    readerCancelled = true;
+                    try {
+                        void reader.cancel(reason).catch(() => undefined);
+                    }
+                    catch { }
+                }
+                reject(reason);
+            };
+            signal.addEventListener('abort', cancelOnAbort, { once: true });
+        });
         let receivedLength = 0;
-        const chunks = [];
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            const chunk = Uint8Array.from(value);
-            chunks.push(chunk);
-            receivedLength += chunk.byteLength;
-            this.progress.update(asset, receivedLength, contentLength);
-        }
-        const bytes = new Uint8Array(receivedLength);
-        let position = 0;
-        for (const chunk of chunks) {
-            bytes.set(chunk, position);
-            position += chunk.byteLength;
-        }
-        this.progress.update(asset, receivedLength, contentLength ?? receivedLength);
-        return { bytes, mimeType };
+        let bytes = new Uint8Array(Math.min(maxAssetBytes, contentLength || DEFAULT_STREAM_BUFFER_BYTES));
+        let loadedAsset;
+        let releaseError;
+        try {
+            while (true) {
+                if (signal.aborted)
+                    throw runtimeAssetAbortReason(signal);
+                const pendingRead = reader.read();
+                const { done, value } = await Promise.race([pendingRead, aborted]);
+                if (signal.aborted)
+                    throw runtimeAssetAbortReason(signal);
+                if (done)
+                    break;
+                if (!value)
+                    continue;
+                const chunk = canonicalUint8Array(value);
+                const nextLength = receivedLength + chunk.byteLength;
+                if (nextLength > maxAssetBytes) {
+                    const error = runtimeAssetSizeError(asset, maxAssetBytes);
+                    readerCancelled = true;
+                    try {
+                        void reader.cancel(error).catch(() => undefined);
+                    }
+                    catch { }
+                    throw error;
+                }
+                if (nextLength > bytes.byteLength) {
+                    const nextCapacity = Math.min(maxAssetBytes, Math.max(nextLength, bytes.byteLength * 2));
+                    const grown = new Uint8Array(nextCapacity);
+                    grown.set(bytes.subarray(0, receivedLength));
+                    bytes = grown;
+                }
+                bytes.set(chunk, receivedLength);
+                receivedLength = nextLength;
+                this.progress.update(asset, receivedLength, contentLength);
+            }
+            if (receivedLength !== bytes.byteLength)
+                bytes = bytes.slice(0, receivedLength);
+            this.progress.update(asset, receivedLength, contentLength ?? receivedLength);
+            loadedAsset = { bytes, contentEncoding, mimeType, transferOwnership: true };
+        }
+        catch (error) {
+            if (signal.aborted) {
+                const reason = runtimeAssetAbortReason(signal);
+                if (!readerCancelled) {
+                    readerCancelled = true;
+                    try {
+                        void reader.cancel(reason).catch(() => undefined);
+                    }
+                    catch { }
+                }
+                throw reason;
+            }
+            if (!readerCancelled) {
+                readerCancelled = true;
+                try {
+                    void reader.cancel(error).catch(() => undefined);
+                }
+                catch { }
+            }
+            throw error;
+        }
+        finally {
+            if (cancelOnAbort)
+                signal.removeEventListener('abort', cancelOnAbort);
+            try {
+                reader.releaseLock();
+            }
+            catch (error) {
+                if (!signal.aborted)
+                    releaseError = error;
+            }
+        }
+        if (releaseError)
+            throw releaseError;
+        return loadedAsset;
+    }
+    requireAllowedAssetUrl(asset, value) {
+        let url;
+        try {
+            url = new URL(value, this.config.baseUrl);
+        }
+        catch {
+            throw new Error(`Runtime asset ${asset} has an invalid URL`);
+        }
+        if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+            throw new Error(`Runtime asset ${asset} uses an unsupported URL scheme: ${url.protocol}`);
+        }
+        if (url.username || url.password) {
+            throw new Error(`Runtime asset ${asset} URL must not include credentials`);
+        }
+        if (url.hash) {
+            throw new Error(`Runtime asset ${asset} URL must not include a fragment`);
+        }
+        const allowed = [this.config.baseUrl, ...(this.config.allowedBaseUrls || [])].some((baseUrl) => {
+            let base;
+            try {
+                base = new URL(baseUrl, url);
+            }
+            catch {
+                return false;
+            }
+            if (base.protocol !== 'https:' && base.protocol !== 'http:')
+                return false;
+            const basePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname}/`;
+            return url.origin === base.origin && url.pathname.startsWith(basePath);
+        });
+        if (!allowed) {
+            throw new Error(`Runtime asset ${asset} URL is outside the allowed asset bases`);
+        }
+        return url;
+    }
+    abortActiveLoads() {
+        const controllers = [...this.activeLoads];
+        this.activeLoads.clear();
+        for (const controller of controllers)
+            controller.abort();
     }
 }