@highstate/designer 0.19.1 → 0.21.1

package/.output/server/node_modules/devalue/src/stringify.js

@@ -5,7 +5,8 @@ import {
 	is_plain_object,
 	is_primitive,
 	stringify_key,
-	stringify_string
+	stringify_string,
+	valid_array_indices
 } from './utils.js';
 import {
 	HOLE,
@@ -13,6 +14,7 @@ import {
 	NEGATIVE_INFINITY,
 	NEGATIVE_ZERO,
 	POSITIVE_INFINITY,
+	SPARSE,
 	UNDEFINED
 } from './constants.js';
 import { encode64 } from './base64.js';
@@ -44,17 +46,13 @@ export function stringify(value, reducers) {
 
 	/** @param {any} thing */
 	function flatten(thing) {
-		if (typeof thing === 'function') {
-			throw new DevalueError(`Cannot stringify a function`, keys);
-		}
-
 		if (thing === undefined) return UNDEFINED;
 		if (Number.isNaN(thing)) return NAN;
 		if (thing === Infinity) return POSITIVE_INFINITY;
 		if (thing === -Infinity) return NEGATIVE_INFINITY;
 		if (thing === 0 && 1 / thing < 0) return NEGATIVE_ZERO;
 
-		if (indexes.has(thing)) return indexes.get(thing);
+		if (indexes.has(thing)) return /** @type {number} */ (indexes.get(thing));
 
 		const index = p++;
 		indexes.set(thing, index);
@@ -67,6 +65,12 @@ export function stringify(value, reducers) {
 			}
 		}
 
+		if (typeof thing === 'function') {
+			throw new DevalueError(`Cannot stringify a function`, keys, thing, value);
+		} else if (typeof thing === 'symbol') {
+			throw new DevalueError(`Cannot stringify a Symbol primitive`, keys, thing, value);
+		}
+
 		let str = '';
 
 		if (is_primitive(thing)) {
@@ -78,11 +82,8 @@ export function stringify(value, reducers) {
 				case 'Number':
 				case 'String':
 				case 'Boolean':
-					str = `["Object",${stringify_primitive(thing)}]`;
-					break;
-
 				case 'BigInt':
-					str = `["BigInt",${thing}]`;
+					str = `["Object",${flatten(thing.valueOf())}]`;
 					break;
 
 				case 'Date':
@@ -105,24 +106,89 @@ export function stringify(value, reducers) {
 						: `["RegExp",${stringify_string(source)}]`;
 					break;
 
-				case 'Array':
+				case 'Array': {
+					// For dense arrays (no holes), we iterate normally.
+					// When we encounter the first hole, we call Object.keys
+					// to determine the sparseness, then decide between:
+					//   - HOLE encoding: [-2, val, -2, ...] (default)
+					//   - Sparse encoding: [-7, length, idx, val, ...] (for very sparse arrays)
+					// Only the sparse path avoids iterating every slot, which
+					// is what protects against the DoS of e.g. `arr[1000000] = 1`.
+					let mostly_dense = false;
+
 					str = '[';
 
 					for (let i = 0; i < thing.length; i += 1) {
 						if (i > 0) str += ',';
 
-						if (i in thing) {
+						if (Object.hasOwn(thing, i)) {
 							keys.push(`[${i}]`);
 							str += flatten(thing[i]);
 							keys.pop();
-						} else {
+						} else if (mostly_dense) {
+							// Use dense encoding. The heuristic guarantees the
+							// array is only mildly sparse, so iterating over every
+							// slot is fine.
 							str += HOLE;
+						} else {
+							// Decide between HOLE encoding and sparse encoding.
+							//
+							// HOLE encoding: each hole is serialized as the HOLE
+							// sentinel (-2). For example, [, "a", ,] becomes
+							// [-2, 0, -2]. Each hole costs 3 chars ("-2" + comma).
+							//
+							// Sparse encoding: lists only populated indices.
+							// For example, [, "a", ,] becomes [-7, 3, 1, 0] — the
+							// -7 sentinel, the array length (3), then index-value
+							// pairs. This avoids paying per-hole, but each element
+							// costs extra chars to write its index.
+							//
+							// The values are the same size either way, so the
+							// choice comes down to structural overhead:
+							//
+							//   HOLE overhead:
+							//     3 chars per hole ("-2" + comma)
+							//     = (L - P) * 3
+							//
+							//   Sparse overhead:
+							//     "-7,"          — 3 chars (sparse sentinel + comma)
+							//     + length + "," — (d + 1) chars (array length + comma)
+							//     + per element: index + "," — (d + 1) chars
+							//     = (4 + d) + P * (d + 1)
+							//
+							// where L is the array length, P is the number of
+							// populated elements, and d is the number of digits
+							// in L (an upper bound on the digits in any index).
+							//
+							// Sparse encoding is cheaper when:
+							//   (4 + d) + P * (d + 1) < (L - P) * 3
+							const populated_keys = valid_array_indices(/** @type {any[]} */ (thing));
+							const population = populated_keys.length;
+							const d = String(thing.length).length;
+
+							const hole_cost = (thing.length - population) * 3;
+							const sparse_cost = 4 + d + population * (d + 1);
+
+							if (hole_cost > sparse_cost) {
+								str = '[' + SPARSE + ',' + thing.length;
+								for (let j = 0; j < populated_keys.length; j++) {
+									const key = populated_keys[j];
+									keys.push(`[${key}]`);
+									str += ',' + key + ',' + flatten(thing[key]);
+									keys.pop();
+								}
+								break;
+							} else {
+								mostly_dense = true;
+								str += HOLE;
+							}
 						}
 					}
 
 					str += ']';
 
 					break;
+				}
 
 				case 'Set':
 					str = '["Set"';
@@ -138,9 +204,7 @@ export function stringify(value, reducers) {
 					str = '["Map"';
 
 					for (const [key, value] of thing) {
-						keys.push(
-							`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`
-						);
+						keys.push(`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`);
 						str += `,${flatten(key)},${flatten(value)}`;
 						keys.pop();
 					}
@@ -153,23 +217,22 @@ export function stringify(value, reducers) {
 				case 'Uint8ClampedArray':
 				case 'Int16Array':
 				case 'Uint16Array':
+				case 'Float16Array':
 				case 'Int32Array':
 				case 'Uint32Array':
 				case 'Float32Array':
 				case 'Float64Array':
 				case 'BigInt64Array':
-				case 'BigUint64Array': {
+				case 'BigUint64Array':
+				case 'DataView': {
 					/** @type {import("./types.js").TypedArray} */
 					const typedArray = thing;
 					str = '["' + type + '",' + flatten(typedArray.buffer);
 
-					const a = thing.byteOffset;
-					const b = a + thing.byteLength;
-
 					// handle subarrays
-					if (a > 0 || b !== typedArray.buffer.byteLength) {
-						const m = +/(\d+)/.exec(type)[1] / 8;
-						str += `,${a / m},${b / m}`;
+					if (typedArray.byteLength !== typedArray.buffer.byteLength) {
+						// to be used with `new TypedArray(buffer, byteOffset, length)`
+						str += `,${typedArray.byteOffset},${typedArray.length}`;
 					}
 
 					str += ']';
@@ -198,22 +261,25 @@ export function stringify(value, reducers) {
 
 				default:
 					if (!is_plain_object(thing)) {
-						throw new DevalueError(
-							`Cannot stringify arbitrary non-POJOs`,
-							keys
-						);
+						throw new DevalueError(`Cannot stringify arbitrary non-POJOs`, keys, thing, value);
 					}
 
 					if (enumerable_symbols(thing).length > 0) {
-						throw new DevalueError(
-							`Cannot stringify POJOs with symbolic keys`,
-							keys
-						);
+						throw new DevalueError(`Cannot stringify POJOs with symbolic keys`, keys, thing, value);
 					}
 
 					if (Object.getPrototypeOf(thing) === null) {
 						str = '["null"';
-						for (const key in thing) {
+						for (const key of Object.keys(thing)) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
 							keys.push(stringify_key(key));
 							str += `,${stringify_string(key)},${flatten(thing[key])}`;
 							keys.pop();
@@ -222,7 +288,16 @@ export function stringify(value, reducers) {
 					} else {
 						str = '{';
 						let started = false;
-						for (const key in thing) {
+						for (const key of Object.keys(thing)) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
 							if (started) str += ',';
 							started = true;
 							keys.push(stringify_key(key));
@@ -253,7 +328,6 @@ export function stringify(value, reducers) {
 function stringify_primitive(thing) {
 	const type = typeof thing;
 	if (type === 'string') return stringify_string(thing);
-	if (thing instanceof String) return stringify_string(thing.toString());
 	if (thing === void 0) return UNDEFINED.toString();
 	if (thing === 0 && 1 / thing < 0) return NEGATIVE_ZERO.toString();
 	if (type === 'bigint') return `["BigInt","${thing}"]`;

package/.output/server/node_modules/devalue/src/uneval.js

@@ -6,7 +6,8 @@ import {
 	is_plain_object,
 	is_primitive,
 	stringify_key,
-	stringify_string
+	stringify_string,
+	valid_array_indices
 } from './utils.js';
 
 const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_$';
@@ -29,10 +30,6 @@ export function uneval(value, replacer) {
 
 	/** @param {any} thing */
 	function walk(thing) {
-		if (typeof thing === 'function') {
-			throw new DevalueError(`Cannot stringify a function`, keys);
-		}
-
 		if (!is_primitive(thing)) {
 			if (counts.has(thing)) {
 				counts.set(thing, counts.get(thing) + 1);
@@ -50,6 +47,10 @@ export function uneval(value, replacer) {
 				}
 			}
 
+			if (typeof thing === 'function') {
+				throw new DevalueError(`Cannot stringify a function`, keys, thing, value);
+			}
+
 			const type = get_type(thing);
 
 			switch (type) {
@@ -77,9 +78,7 @@ export function uneval(value, replacer) {
 
 				case 'Map':
 					for (const [key, value] of thing) {
-						keys.push(
-							`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`
-						);
+						keys.push(`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`);
 						walk(value);
 						keys.pop();
 					}
@@ -90,12 +89,14 @@ export function uneval(value, replacer) {
 				case 'Uint8ClampedArray':
 				case 'Int16Array':
 				case 'Uint16Array':
+				case 'Float16Array':
 				case 'Int32Array':
 				case 'Uint32Array':
 				case 'Float32Array':
 				case 'Float64Array':
 				case 'BigInt64Array':
 				case 'BigUint64Array':
+				case 'DataView':
 					walk(thing.buffer);
 					return;
 
@@ -114,25 +115,30 @@ export function uneval(value, replacer) {
 
 				default:
 					if (!is_plain_object(thing)) {
-						throw new DevalueError(
-							`Cannot stringify arbitrary non-POJOs`,
-							keys
-						);
+						throw new DevalueError(`Cannot stringify arbitrary non-POJOs`, keys, thing, value);
 					}
 
 					if (enumerable_symbols(thing).length > 0) {
-						throw new DevalueError(
-							`Cannot stringify POJOs with symbolic keys`,
-							keys
-						);
+						throw new DevalueError(`Cannot stringify POJOs with symbolic keys`, keys, thing, value);
 					}
 
-					for (const key in thing) {
+					for (const key of Object.keys(thing)) {
+						if (key === '__proto__') {
+							throw new DevalueError(
+								`Cannot stringify objects with __proto__ keys`,
+								keys,
+								thing,
+								value
+							);
+						}
+
 						keys.push(stringify_key(key));
 						walk(thing[key]);
 						keys.pop();
 					}
 			}
+		} else if (typeof thing === 'symbol') {
+			throw new DevalueError(`Cannot stringify a Symbol primitive`, keys, thing, value);
 		}
 	}
 
@@ -170,12 +176,14 @@ export function uneval(value, replacer) {
 			case 'Number':
 			case 'String':
 			case 'Boolean':
+			case 'BigInt':
 				return `Object(${stringify(thing.valueOf())})`;
 
 			case 'RegExp':
-				return `new RegExp(${stringify_string(thing.source)}, "${
-					thing.flags
-				}")`;
+				const { source, flags } = thing;
+				return flags
+					? `new RegExp(${stringify_string(source)},"${flags}")`
+					: `new RegExp(${stringify_string(source)})`;
 
 			case 'Date':
 				return `new Date(${thing.getTime()})`;
@@ -186,12 +194,83 @@ export function uneval(value, replacer) {
 			case 'URLSearchParams':
 				return `new URLSearchParams(${stringify_string(thing.toString())})`;
 
-			case 'Array':
-				const members = /** @type {any[]} */ (thing).map((v, i) =>
-					i in thing ? stringify(v) : ''
-				);
+			case 'Array': {
+				// For dense arrays (no holes), we iterate normally.
+				// When we encounter the first hole, we call Object.keys
+				// to determine the sparseness, then decide between:
+				//   - Array literal with holes: [,"a",,] (default)
+				//   - Object.assign: Object.assign(Array(n),{...}) (for very sparse arrays)
+				// Only the Object.assign path avoids iterating every slot, which
+				// is what protects against the DoS of e.g. `arr[1000000] = 1`.
+				let has_holes = false;
+
+				let result = '[';
+
+				for (let i = 0; i < thing.length; i += 1) {
+					if (i > 0) result += ',';
+
+					if (Object.hasOwn(thing, i)) {
+						result += stringify(thing[i]);
+					} else if (!has_holes) {
+						// Decide between array literal and Object.assign.
+						//
+						// Array literal: holes are consecutive commas.
+						// For example, [, "a", ,] is written as [,"a",,].
+						// Each hole costs 1 char (a comma).
+						//
+						// Object.assign: populated indices are listed explicitly.
+						// For example, [, "a", ,] would be written as
+						// Object.assign(Array(3),{1:"a"}). This avoids paying
+						// per-hole, but has a large fixed overhead for the
+						// "Object.assign(Array(n),{...})" wrapper, and each
+						// element costs extra chars for its index and colon.
+						//
+						// The serialized values are the same size either way, so
+						// the choice comes down to the structural overhead:
+						//
+						//   Array literal overhead:
+						//     1 char per element or hole (comma separators)
+						//     + 2 chars for "[" and "]"
+						//     = L + 2
+						//
+						//   Object.assign overhead:
+						//     "Object.assign(Array(" — 20 chars
+						//     + length              — d chars
+						//     + "),{"               — 3 chars
+						//     + for each populated element:
+						//       index + ":" + ","   — (d + 2) chars
+						//     + "})"                — 2 chars
+						//     = (25 + d) + P * (d + 2)
+						//
+						// where L is the array length, P is the number of
+						// populated elements, and d is the number of digits
+						// in L (an upper bound on the digits in any index).
+						//
+						// Object.assign is cheaper when:
+						//   (25 + d) + P * (d + 2) < L + 2
+						const populated_keys = valid_array_indices(/** @type {any[]} */ (thing));
+						const population = populated_keys.length;
+						const d = String(thing.length).length;
+
+						const hole_cost = thing.length + 2;
+						const sparse_cost = 25 + d + population * (d + 2);
+
+						if (hole_cost > sparse_cost) {
+							const entries = populated_keys.map((k) => `${k}:${stringify(thing[k])}`).join(',');
+							return `Object.assign(Array(${thing.length}),{${entries}})`;
+						}
+
+						// Re-process this index as a hole in the array literal
+						has_holes = true;
+						i -= 1;
+					}
+					// else: already decided on array literal, hole is just an empty slot
+					// (the comma separator is all we need — no content for this position)
+				}
+
 				const tail = thing.length === 0 || thing.length - 1 in thing ? '' : ',';
-				return `[${members.join(',')}${tail}]`;
+				return result + tail + ']';
+			}
 
 			case 'Set':
 			case 'Map':
@@ -202,6 +281,7 @@ export function uneval(value, replacer) {
 			case 'Uint8ClampedArray':
 			case 'Int16Array':
 			case 'Uint16Array':
+			case 'Float16Array':
 			case 'Int32Array':
 			case 'Uint32Array':
 			case 'Float32Array':
@@ -210,25 +290,40 @@ export function uneval(value, replacer) {
 			case 'BigUint64Array': {
 				let str = `new ${type}`;
 
-				if (counts.get(thing.buffer) === 1) {
+				if (!names.has(thing.buffer)) {
 					const array = new thing.constructor(thing.buffer);
 					str += `([${array}])`;
 				} else {
-					str += `([${stringify(thing.buffer)}])`;
+					str += `(${stringify(thing.buffer)})`;
 				}
 
-				const a = thing.byteOffset;
-				const b = a + thing.byteLength;
-
 				// handle subarrays
-				if (a > 0 || b !== thing.buffer.byteLength) {
-					const m = +/(\d+)/.exec(type)[1] / 8;
-					str += `.subarray(${a / m},${b / m})`;
+				if (thing.byteLength !== thing.buffer.byteLength) {
+					const start = thing.byteOffset / thing.BYTES_PER_ELEMENT;
+					const end = start + thing.length;
+					str += `.subarray(${start},${end})`;
 				}
 
 				return str;
 			}
 
+			case 'DataView': {
+				let str = `new DataView`;
+
+				if (!names.has(thing.buffer)) {
+					str += `(new Uint8Array([${new Uint8Array(thing.buffer)}]).buffer`;
+				} else {
+					str += `(${stringify(thing.buffer)}`;
+				}
+
+				// handle subviews
+				if (thing.byteLength !== thing.buffer.byteLength) {
+					str += `,${thing.startOffset},${thing.byteLength}`;
+				}
+
+				return str + ')';
+			}
+
 			case 'ArrayBuffer': {
 				const ui8 = new Uint8Array(thing);
 				return `new Uint8Array([${ui8.toString()}]).buffer`;
@@ -246,14 +341,10 @@ export function uneval(value, replacer) {
 
 			default:
 				const keys = Object.keys(thing);
-				const obj = keys
-					.map((key) => `${safe_key(key)}:${stringify(thing[key])}`)
-					.join(',');
+				const obj = keys.map((key) => `${safe_key(key)}:${stringify(thing[key])}`).join(',');
 				const proto = Object.getPrototypeOf(thing);
 				if (proto === null) {
-					return keys.length > 0
-						? `{${obj},__proto__:null}`
-						: `{__proto__:null}`;
+					return keys.length > 0 ? `{${obj},__proto__:null}` : `{__proto__:null}`;
 				}
 
 				return `{${obj}}`;
@@ -291,17 +382,30 @@ export function uneval(value, replacer) {
 				case 'Number':
 				case 'String':
 				case 'Boolean':
+				case 'BigInt':
 					values.push(`Object(${stringify(thing.valueOf())})`);
 					break;
 
 				case 'RegExp':
-					values.push(thing.toString());
+					const { source, flags } = thing;
+					const regexp = flags
+						? `new RegExp(${stringify_string(source)},"${flags}")`
+						: `new RegExp(${stringify_string(source)})`
+					values.push(regexp);
 					break;
 
 				case 'Date':
 					values.push(`new Date(${thing.getTime()})`);
 					break;
 
+				case 'URL':
+					values.push(`new URL(${stringify_string(thing.toString())})`);
+					break;
+
+				case 'URLSearchParams':
+					values.push(`new URLSearchParams(${stringify_string(thing.toString())})`);
+					break;
+
 				case 'Array':
 					values.push(`Array(${thing.length})`);
 					/** @type {any[]} */ (thing).forEach((v, i) => {
@@ -327,29 +431,75 @@ export function uneval(value, replacer) {
 					);
 					break;
 
+				case 'Int8Array':
+				case 'Uint8Array':
+				case 'Uint8ClampedArray':
+				case 'Int16Array':
+				case 'Uint16Array':
+				case 'Float16Array':
+				case 'Int32Array':
+				case 'Uint32Array':
+				case 'Float32Array':
+				case 'Float64Array':
+				case 'BigInt64Array':
+				case 'BigUint64Array': {
+					let str = `new ${type}`;
+
+					if (!names.has(thing.buffer)) {
+						const array = new thing.constructor(thing.buffer);
+						str += `([${array}])`;
+					} else {
+						str += `(${stringify(thing.buffer)})`;
+					}
+
+					// handle subarrays
+					if (thing.byteLength !== thing.buffer.byteLength) {
+						const start = thing.byteOffset / thing.BYTES_PER_ELEMENT;
+						const end = start + thing.length;
+						str += `.subarray(${start},${end})`;
+					}
+
+					values.push(`{}`);
+					statements.push(`${name}=${str}`);
+					break;
+				}
+
+				case 'DataView': {
+					let str = `new DataView`;
+
+					if (!names.has(thing.buffer)) {
+						str += `(new Uint8Array([${new Uint8Array(thing.buffer)}]).buffer`;
+					} else {
+						str += `(${stringify(thing.buffer)}`;
+					}
+
+					// handle subviews
+					if (thing.byteLength !== thing.buffer.byteLength) {
+						str += `,${thing.byteOffset},${thing.byteLength}`;
+					}
+
+					str += ')';
+
+					values.push(`{}`);
+					statements.push(`${name}=${str}`);
+					break;
+				}
+
 				case 'ArrayBuffer':
-					values.push(
-						`new Uint8Array([${new Uint8Array(thing).join(',')}]).buffer`
-					);
+					values.push(`new Uint8Array([${new Uint8Array(thing)}]).buffer`);
 					break;
 
 				default:
-					values.push(
-						Object.getPrototypeOf(thing) === null ? 'Object.create(null)' : '{}'
-					);
+					values.push(Object.getPrototypeOf(thing) === null ? 'Object.create(null)' : '{}');
 					Object.keys(thing).forEach((key) => {
-						statements.push(
-							`${name}${safe_prop(key)}=${stringify(thing[key])}`
-						);
+						statements.push(`${name}${safe_prop(key)}=${stringify(thing[key])}`);
 					});
 			}
 		});
 
 		statements.push(`return ${str}`);
 
-		return `(function(${params.join(',')}){${statements.join(
-			';'
-		)}}(${values.join(',')}))`;
+		return `(function(${params.join(',')}){${statements.join(';')}}(${values.join(',')}))`;
 	} else {
 		return str;
 	}
@@ -379,9 +529,7 @@ function escape_unsafe_chars(str) {
 
 /** @param {string} key */
 function safe_key(key) {
-	return /^[_$a-zA-Z][_$a-zA-Z0-9]*$/.test(key)
-		? key
-		: escape_unsafe_chars(JSON.stringify(key));
+	return /^[_$a-zA-Z][_$a-zA-Z0-9]*$/.test(key) ? key : escape_unsafe_chars(JSON.stringify(key));
 }
 
 /** @param {string} key */
@@ -393,11 +541,12 @@ function safe_prop(key) {
 
 /** @param {any} thing */
 function stringify_primitive(thing) {
-	if (typeof thing === 'string') return stringify_string(thing);
+	const type = typeof thing;
+	if (type === 'string') return stringify_string(thing);
 	if (thing === void 0) return 'void 0';
 	if (thing === 0 && 1 / thing < 0) return '-0';
 	const str = String(thing);
-	if (typeof thing === 'number') return str.replace(/^(-)?0\./, '$1.');
-	if (typeof thing === 'bigint') return thing + 'n';
+	if (type === 'number') return str.replace(/^(-)?0\./, '$1.');
+	if (type === 'bigint') return thing + 'n';
 	return str;
 }