Security and resource limits

Reject before amplification#

Text is capped at 65,536 UTF-8 bytes before large encoded copies. Nodes and relation terms share cumulative budgets across embedded patterns. U constraints are charged before permutation-wide copying. File and decoded HTTP-stream readers check actual bytes; Content-Length is not trusted.

Memory and execution boundaries#

The packaged Wasm module has a 32 MiB linear-memory ceiling. Unexpected traps quarantine the instance; later calls reject until a new instance is created. Ordinary invalid-input errors do not poison it. dispose() releases the reference but does not promise immediate garbage collection.

A separate audit, with explicit limits#

After cross-platform npm validation, a separate security workflow reruns malicious-input and transport regressions, audits documentation dependencies and queries exact locked versions in OSV. There are 10,000 bounded deterministic mutation cases; this is not coverage-guided fuzzing or a formal proof.

File outputs refuse existing destinations. Optional TCK bounds stdin/stdout/time and retained failure previews, but does not jail descendant processes. Only trusted commands should be run without a separate OS sandbox. No dataset or host-game certification is implied.

Recover an accepted npm upload#

The 0.1.1 OIDC upload was accepted; its old final checker stopped after about 38 seconds. Registry metadata and the actual tarball matched the original SHA-512. A read-only receipt can confirm it without a token or republishing.

node scripts/release-contract.mjs recover docs/release-receipts/0.1.1.json

The new checker separates pending visibility, terminal mismatch and exact existing artifacts. It verifies downloaded bytes and MIT text, retries only transient conditions and never changes a published version. The 0.3.0 hardening candidate must be published separately through main / publish / 0.3.0 after all checks pass.