@poe-platform/safe-js 0.1.196 → 0.1.198

package/dist/safe-js/chunks/{chunk-UODKI7OO.js → chunk-4WIZV3GZ.js}

@@ -27,7 +27,7 @@ import {
   validateMigrationSemantics,
   validateSnapshotData,
   validateSnapshotMigration
-} from "./chunk-KMQUDIYF.js";
+} from "./chunk-T43UKNMF.js";
 
 // packages/safe-js/src/migrate.ts
 import { createHash } from "node:crypto";
@@ -8249,4 +8249,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-UODKI7OO.js.map
+//# sourceMappingURL=chunk-4WIZV3GZ.js.map

package/dist/safe-js/chunks/{chunk-KMQUDIYF.js → chunk-T43UKNMF.js}

@@ -711,7 +711,7 @@ var RegexCompileGuard = class {
     this.work(flags.length);
   }
   retain(pattern, valueUnits = 0) {
-    const units = 10 + pattern.source.length + measureNode(pattern.body);
+    const units = measurePattern(pattern);
     if (this.ticket !== void 0) {
       this.ticket.owner.budget.resizeCompileTicket(this.ticket, units + valueUnits);
     }
@@ -728,7 +728,15 @@ var RegexCompileGuard = class {
   }
 };
 function regexCompiledData(pattern) {
-  return compiledData.get(pattern) ?? { units: 10 + pattern.source.length + measureNode(pattern.body) };
+  return compiledData.get(pattern) ?? { units: measurePattern(pattern) };
+}
+function measurePattern(pattern) {
+  let units = 10 + pattern.source.length + measureNode(pattern.body);
+  if (pattern.groups !== void 0) {
+    units += 1;
+    for (const [name, indices] of Object.entries(pattern.groups)) units += name.length + 2 + indices.length;
+  }
+  return units;
 }
 function measureNode(node) {
   switch (node.type) {
@@ -737,6 +745,8 @@ function measureNode(node) {
       return 2;
     case "literal":
       return 3 + node.value.length;
+    case "namedBackreference":
+      return 3 + node.name.length;
     case "anchor":
     case "wordBoundary":
     case "backreference":
@@ -756,7 +766,7 @@ function measureNode(node) {
       return usage;
     }
     case "group":
-      return 5 + measureNode(node.body);
+      return 5 + measureNode(node.body) + (node.name === void 0 ? 0 : 1 + node.name.length);
     case "lookahead":
     case "lookbehind":
       return 4 + measureNode(node.body);
@@ -2049,6 +2059,8 @@ function createIdentifier(token, name) {
 }
 
 // packages/safe-js/src/interp/regex/parse.ts
+var groupNameStart = /^[$_\p{ID_Start}]$/u;
+var groupNamePart = /^[$\u200c\u200d\p{ID_Continue}]$/u;
 function parseRegex(source, flags = "", compilation, valueUnits = 0) {
   const guard = new RegexCompileGuard(compilation);
   try {
@@ -2060,6 +2072,7 @@ function parseRegex(source, flags = "", compilation, valueUnits = 0) {
     const body = parser.parse();
     guard.allocate(5 + source.length);
     const pattern = { source, flags: parsedFlags, captureCount: parser.captureCount, body };
+    if (Object.keys(parser.namedGroups).length > 0) pattern.groups = parser.namedGroups;
     guard.retain(pattern, valueUnits);
     return pattern;
   } finally {
@@ -2076,6 +2089,8 @@ var RegexParser = class {
   captureCount = 0;
   cursor = 0;
   totalCaptureCount;
+  hasNamedCaptures = false;
+  namedGroups = /* @__PURE__ */ Object.create(null);
   get position() {
     return this.cursor;
   }
@@ -2091,6 +2106,7 @@ var RegexParser = class {
       }
       this.fail(`Unexpected character '${this.peek()}'`);
     }
+    if (Object.keys(this.namedGroups).length > 0) this.validateNamedGroups(body);
     return body;
   }
   parseAlternation() {
@@ -2167,6 +2183,7 @@ var RegexParser = class {
   }
   parseGroup(start) {
     let capturing = true;
+    let name;
     let assertionNegated;
     let lookbehind = false;
     if (this.peek() === "?") {
@@ -2186,13 +2203,20 @@ var RegexParser = class {
         lookbehind = true;
         this.position += 3;
       } else if (extension.startsWith("?<")) {
-        this.fail("Named groups are not supported", start);
+        this.position += 2;
+        name = this.parseGroupName(start);
       } else {
         this.fail("Unsupported group construct", start);
       }
     }
     if (capturing) this.guard.allocate(1);
     const index = capturing ? ++this.captureCount : void 0;
+    if (name !== void 0) {
+      this.guard.allocate(name.length + 2);
+      const indices = this.namedGroups[name] ??= [];
+      this.guard.array(indices.length + 1);
+      indices.push(index);
+    }
     this.guard.enterGroup();
     let body;
     try {
@@ -2209,7 +2233,7 @@ var RegexParser = class {
       return { type: lookbehind ? "lookbehind" : "lookahead", negated: assertionNegated, body };
     }
     this.guard.allocate(5);
-    return { type: "group", capturing, index, body };
+    return { type: "group", capturing, index, body, ...name === void 0 ? {} : { name } };
   }
   parseCharacterClass(start) {
     const negated = this.peek() === "^";
@@ -2269,6 +2293,15 @@ var RegexParser = class {
       this.fail("Trailing escape", start);
     }
     const escaped = this.take();
+    if (escaped === "k") {
+      this.totalCaptureCount ??= this.countAllCaptures();
+      if (this.hasNamedCaptures) {
+        if (inCharacterClass || this.take() !== "<") this.fail("Invalid named backreference", start);
+        const name = this.parseGroupName(start);
+        this.guard.allocate(3 + name.length);
+        return { type: "namedBackreference", name };
+      }
+    }
     if (isDecimalDigit2(escaped)) {
       if (!inCharacterClass && escaped !== "0") {
         let end = this.position;
@@ -2358,10 +2391,62 @@ var RegexParser = class {
       else if (character === "\\") escaped = true;
       else if (character === "[") characterClass = true;
       else if (character === "]") characterClass = false;
-      else if (!characterClass && character === "(" && this.source[index + 1] !== "?") count++;
+      else if (!characterClass && character === "(") {
+        const named = this.source[index + 1] === "?" && this.source[index + 2] === "<" && this.source[index + 3] !== "=" && this.source[index + 3] !== "!";
+        if (named) this.hasNamedCaptures = true;
+        if (named || this.source[index + 1] !== "?") count++;
+      }
     }
     return count;
   }
+  parseGroupName(start) {
+    let name = "";
+    while (!this.atEnd() && this.peek() !== ">") {
+      let character = this.take();
+      if (character === "\\") {
+        if (this.take() !== "u") this.fail("Invalid group name escape", start);
+        if (this.peek() === "{") {
+          this.position++;
+          const begin = this.position;
+          while (!this.atEnd() && this.peek() !== "}") this.position++;
+          this.guard.allocate(this.position - begin);
+          const digits = this.source.slice(begin, this.position);
+          const point = Number.parseInt(digits, 16);
+          if (this.take() !== "}" || digits.length === 0 || !allHexDigits(digits) || point > 1114111)
+            this.fail("Invalid group name escape", start);
+          character = String.fromCodePoint(point);
+        } else character = this.parseHexEscape(4, "Unicode", start);
+      }
+      this.guard.allocate(character.length);
+      name += character;
+    }
+    if (this.take() !== ">" || name.length === 0) this.fail("Invalid group name", start);
+    let first = true;
+    for (const character of name) {
+      this.guard.work(1);
+      if (!(first ? groupNameStart : groupNamePart).test(character)) this.fail("Invalid group name", start);
+      first = false;
+    }
+    return name;
+  }
+  validateNamedGroups(node) {
+    this.guard.work(1);
+    this.guard.allocate(1);
+    const names = /* @__PURE__ */ new Set();
+    if (node.type === "namedBackreference" && !Object.hasOwn(this.namedGroups, node.name))
+      this.fail("Unknown named backreference");
+    if (node.type === "group" && node.name !== void 0) names.add(node.name);
+    const children = node.type === "sequence" ? node.elements : node.type === "alternation" ? node.alternatives : node.type === "group" || node.type === "quantifier" || node.type === "lookahead" || node.type === "lookbehind" ? [node.body] : [];
+    for (const child of children) {
+      for (const name of this.validateNamedGroups(child)) {
+        this.guard.work(1);
+        if (names.has(name) && node.type !== "alternation") this.fail("Duplicate capture group name");
+        this.guard.allocate(1);
+        names.add(name);
+      }
+    }
+    return names;
+  }
   parseQuantifier() {
     const character = this.peek();
     if (character === "*") {
@@ -7694,6 +7779,9 @@ function getSandboxPrototype(value, budget) {
 function hasExplicitSandboxPrototype(value) {
   return prototypes.has(value);
 }
+function hasNullObjectPrototype(value) {
+  return prototypes.get(value) === null && !Array.isArray(value) && !isSandboxClosure(value) && !isSandboxRegex(value);
+}
 function getSandboxPropertyDescriptor(value, key, budget) {
   const hostProperties = isSandboxClosure(value) ? value.properties : void 0;
   if (isSandboxClosure(value) && !isGuestClosure(value))
@@ -7775,7 +7863,7 @@ function hasGuestObjectState(value) {
   const intrinsicUnchanged = intrinsicConstructors.get(value);
   if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
-  if (functionProperties.has(value) || prototypes.has(value)) return true;
+  if (functionProperties.has(value) || prototypes.has(value) && !hasNullObjectPrototype(value)) return true;
   if (isSandboxBox(value) || isSandboxDate(value)) return false;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
@@ -8096,6 +8184,7 @@ function serializeHeapReference(value, path, state) {
       });
       state.heap[String(id)] = {
         kind: "object",
+        ...hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {},
         entries: serializeObjectEntries(value, path, state),
         ...symbolEntries.length === 0 ? {} : { symbolEntries },
         ...errorType === void 0 ? {} : { errorType }
@@ -8129,7 +8218,7 @@ function indexHeapContainers(snapshot) {
   const heapIds = /* @__PURE__ */ new Map();
   let nextId = 1;
   for (const [value, stat2] of stats.entries()) {
-    if (stat2.count > 1 || stat2.cyclic || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat2.count > 1 || stat2.cyclic || hasNullObjectPrototype(value) || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -8315,6 +8404,8 @@ function validateDumpHeap(root, state) {
       continue;
     }
     if (entry.kind === "object") {
+      if (Object.hasOwn(entry, "sandboxNullPrototype") && entry.sandboxNullPrototype !== true)
+        fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
       requireRecord(entry.entries, `${path}.entries`);
       continue;
     }
@@ -8435,7 +8526,11 @@ function validateTaggedValue(record2, path, state) {
       return;
     case "array":
     case "arguments":
+      return;
     case "object":
+      if (Object.hasOwn(record2, "sandboxNullPrototype") && record2.sandboxNullPrototype !== true)
+        fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
+      return;
     case "map":
     case "set":
     case "collection-iterator":
@@ -9363,7 +9458,7 @@ function matchRegexFrom(pattern, input, startIndex) {
     return null;
   }
   for (let attempt = startIndex; attempt <= input.length; attempt += 1) {
-    const context = { input, flags: pattern.flags, direction: 1, work: { steps: 0 } };
+    const context = { input, flags: pattern.flags, groups: pattern.groups, direction: 1, work: { steps: 0 } };
     charge(context);
     const initialState = {
       position: attempt,
@@ -9371,7 +9466,7 @@ function matchRegexFrom(pattern, input, startIndex) {
     };
     const result = matchNode(pattern.body, initialState, context).next();
     if (!result.done) {
-      return toRegexMatch(input, attempt, result.value, pattern.flags.hasIndices);
+      return toRegexMatch(input, attempt, result.value, pattern.flags.hasIndices, pattern.groups);
     }
     if (pattern.flags.sticky) break;
   }
@@ -9389,8 +9484,19 @@ function* matchNode(node, state, context) {
         yield { ...state, position: state.position + context.direction };
       }
       return;
-    case "backreference": {
-      const capture = state.captures[node.index - 1];
+    case "backreference":
+    case "namedBackreference": {
+      let capture;
+      if (node.type === "backreference") capture = state.captures[node.index - 1];
+      else {
+        for (const index of context.groups?.[node.name] ?? []) {
+          charge(context);
+          if (state.captures[index - 1] !== void 0) {
+            capture = state.captures[index - 1];
+            break;
+          }
+        }
+      }
       if (capture === void 0) {
         yield state;
         return;
@@ -9535,7 +9641,7 @@ function matchesCharacterClassItem(character, item, ignoreCase) {
   const matched = item.kind === "digit" ? isDigit(character) : item.kind === "word" ? isWordCharacter(character) : isSpaceCharacter(character);
   return item.negated ? !matched : matched;
 }
-function toRegexMatch(input, start, state, hasIndices) {
+function toRegexMatch(input, start, state, hasIndices, groups) {
   const match = {
     index: start,
     text: input.slice(start, state.position),
@@ -9546,6 +9652,15 @@ function toRegexMatch(input, start, state, hasIndices) {
   if (hasIndices) {
     match.indices = [[start, state.position], ...state.captures.map((capture) => capture === void 0 ? void 0 : [capture.start, capture.end])];
   }
+  if (groups !== void 0) {
+    match.groups = /* @__PURE__ */ Object.create(null);
+    if (hasIndices) match.indicesGroups = /* @__PURE__ */ Object.create(null);
+    for (const [name, indices] of Object.entries(groups)) {
+      const index = indices.find((index2) => state.captures[index2 - 1] !== void 0);
+      match.groups[name] = index === void 0 ? void 0 : match.captures[index - 1];
+      if (match.indicesGroups !== void 0) match.indicesGroups[name] = index === void 0 ? void 0 : match.indices[index];
+    }
+  }
   return match;
 }
 function cloneState(state) {
@@ -10168,7 +10283,7 @@ function callReplaceLikeMethod(value, methodName, args, budget, callClosure, use
   );
 }
 async function replaceRegex(value, regex, replacement, budget, callClosure, context) {
-  if (hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
+  if (getSandboxRegexPattern(regex).groups !== void 0 || hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
     return regexReplace(value, regex, replacement, budget, callClosure, context);
   if (regex.flags.includes("g")) regex.lastIndex = 0;
   const cursor = regex.lastIndex;
@@ -10218,7 +10333,7 @@ async function regexReplace(input, regex, replacementInput, budget, callClosure,
     input = void 0;
     replacement = isSandboxClosure(replacementInput) ? replacementInput : await sandboxString(replacementInput, budget, context);
     replacementInput = void 0;
-    if (isSandboxRegex(regex) && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
+    if (isSandboxRegex(regex) && getSandboxRegexPattern(regex).groups === void 0 && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
       release();
       return await replaceRegex(value, regex, replacement, budget, callClosure, context);
     }
@@ -16819,11 +16934,13 @@ function toMatchArray(match, input, budget) {
   }
   budget?.allocateArrayLength(match.captures.length + 1);
   const result = [match.text, ...match.captures];
-  Object.assign(result, { index: match.index, input, groups: void 0 });
+  if (match.groups !== void 0) setSandboxPrototype(match.groups, null, budget);
+  if (match.indicesGroups !== void 0) setSandboxPrototype(match.indicesGroups, null, budget);
+  Object.assign(result, { index: match.index, input, groups: match.groups });
   if (match.indices !== void 0) {
     budget?.allocateArrayLength(match.indices.length);
     budget?.allocateArrayLength(2);
-    Object.assign(match.indices, { groups: void 0 });
+    Object.assign(match.indices, { groups: match.indicesGroups });
     Object.assign(result, { indices: match.indices });
   }
   return result;
@@ -17970,6 +18087,7 @@ function encodeReplayData(value, options = {}) {
       nodes[id] = {
         kind: Array.isArray(entry) ? "array" : "object",
         nullPrototype: prototype === null,
+        ...hasNullObjectPrototype(entry) ? { sandboxNullPrototype: true } : {},
         ...errorType === void 0 ? {} : { errorType },
         extensible: Object.isExtensible(entry),
         properties,
@@ -18192,6 +18310,10 @@ function decodeReplayData(input, options = {}, parent) {
         throw new TypeError("Invalid replay object metadata.");
       }
       const result2 = kind === "array" ? [] : Object.create(node.nullPrototype ? null : Object.prototype);
+      if (Object.hasOwn(node, "sandboxNullPrototype")) {
+        if (kind !== "object" || node.sandboxNullPrototype !== true) throw new TypeError("Invalid replay object prototype.");
+        setSandboxPrototype(result2, null);
+      }
       if (Object.hasOwn(node, "errorType")) {
         sandboxErrorTypes.set(result2, node.errorType);
       }
@@ -21827,6 +21949,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     const copy = createPlainObject(
       !cloneSandboxCollections || Object.getPrototypeOf(value) === null
     );
+    if (!state.structuredClone && hasNullObjectPrototype(value)) setSandboxPrototype(copy, null);
     state.seen.set(value, copy);
     const errorType = sandboxErrorTypes.get(value);
     if (errorType !== void 0) sandboxErrorTypes.set(copy, errorType);
@@ -22038,7 +22161,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (existing !== void 0) {
       return existing;
     }
-    const copy = createPlainObject(Object.getPrototypeOf(value) === null);
+    const copy = createPlainObject(hasNullObjectPrototype(value) || Object.getPrototypeOf(value) === null);
     state.seen.set(value, copy);
     for (const entry of getEnumerableObjectEntries(value, path)) {
       defineOwnDataProperty(
@@ -37166,4 +37289,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-KMQUDIYF.js.map
+//# sourceMappingURL=chunk-T43UKNMF.js.map