@poe-platform/safe-js 0.1.220 → 0.1.222

package/dist/safe-js/chunks/{chunk-3IUIZXWX.js → chunk-BWMXJOKV.js}

@@ -27,7 +27,7 @@ import {
   validateMigrationSemantics,
   validateSnapshotData,
   validateSnapshotMigration
-} from "./chunk-AYL6LSPV.js";
+} from "./chunk-M7KI5UI3.js";
 
 // packages/safe-js/src/migrate.ts
 import { createHash } from "node:crypto";
@@ -8249,4 +8249,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-3IUIZXWX.js.map
+//# sourceMappingURL=chunk-BWMXJOKV.js.map

package/dist/safe-js/chunks/{chunk-AYL6LSPV.js → chunk-M7KI5UI3.js}

@@ -8555,6 +8555,11 @@ function captureGuestHeapNode(value, encode) {
   }
   const origin = getClosureOrigin(value);
   if (origin === void 0) {
+    if (Array.isArray(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some((descriptor) => !("value" in descriptor) && retainedAccessorClosures(descriptor).length !== Number(descriptor.get !== void 0) + Number(descriptor.set !== void 0))) return void 0;
+    if (Array.isArray(value) && (!Object.isExtensible(value) || hasExplicitSandboxPrototype(value) || Reflect.ownKeys(value).some((key) => {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      return key === "length" ? descriptor.writable !== true : !("value" in descriptor) || !descriptor.enumerable || !descriptor.configurable || !descriptor.writable;
+    }))) return { kind: "guest-array", state: captureObjectState(value, encode) };
     if (isLiveCapability(value) || isSandboxClosure(value) || isSandboxBox(value) || isSandboxDate(value) || isSandboxRegex(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value) || isSandboxArguments(value) || isSandboxCollectionIterator(value) || isSandboxRegExpIterator(value)) return void 0;
     const prototype = Object.getPrototypeOf(value);
     if ((prototype === null || prototype === Object.prototype) && hasGuestObjectState(value))
@@ -16637,13 +16642,13 @@ async function evaluateTemplateLiteral(node, context) {
 }
 async function evaluateTaggedTemplateExpression(node, context) {
   const invokeTag = async (tag2, receiver) => {
-    if (!isSandboxClosure(tag2)) throw new TypeError("Tagged template tag must be a function.");
     const call = createCallContinuation(node, tag2, context, receiver);
     context = call.context;
     const release = retainValues(context.budget, () => [tag2, receiver]);
     try {
       const values = await evaluateCallArguments(node.quasi.expressions, context, call.state);
       if (!values.ok) return values.result;
+      if (!isSandboxClosure(tag2)) throw new TypeError("Tagged template tag must be a function.");
       return {
         kind: "normal",
         hasValue: true,
@@ -16690,6 +16695,8 @@ function createTaggedTemplateStrings(node, context) {
     writable: false
   });
   taggedTemplateRawArrays.set(strings, raw);
+  Object.freeze(raw);
+  Object.freeze(strings);
   return strings;
 }
 async function evaluateArrowFunction(node, context) {
@@ -22290,9 +22297,9 @@ function absent(value) {
   const node = record2(value);
   return node.kind === "undefined" && Object.keys(node).length === 1;
 }
-function validateGuestHeapNode(raw, heap) {
+function validateGuestHeapNode(raw, heap, maxArrayLength = 4294967295) {
   const node = record2(raw);
-  if (!["intrinsic", "guest-function", "guest-generator", "scope-frame", "guest-object"].includes(String(node.kind))) return false;
+  if (!["intrinsic", "guest-function", "guest-generator", "scope-frame", "guest-object", "guest-array"].includes(String(node.kind))) return false;
   const reference = (value, kinds) => {
     const ref = record2(value);
     fields(ref, ["kind", "id"]);
@@ -22342,9 +22349,22 @@ function validateGuestHeapNode(raw, heap) {
     fields(node, ["kind", "id"], ["state"]);
     if (typeof node.id !== "string" || !intrinsicCatalogue().has(node.id)) throw new TypeError("Unknown intrinsic identity.");
     if (Object.hasOwn(node, "state")) state(node.state);
-  } else if (node.kind === "guest-object") {
+  } else if (node.kind === "guest-object" || node.kind === "guest-array") {
     fields(node, ["kind", "state"]);
     state(node.state);
+    if (node.kind === "guest-array") {
+      const properties = array(record2(record2(node.state).properties).properties).map((entry) => array(entry));
+      const length = properties.find((entry) => entry[0] === "length");
+      if (length === void 0) throw new TypeError("Missing guest array length.");
+      const descriptor = record2(length[1]);
+      if (descriptor.kind !== "data" || descriptor.configurable !== false || descriptor.enumerable !== false || integer(descriptor.value) > 4294967295) throw new TypeError("Invalid guest array length.");
+      if (descriptor.value > maxArrayLength) throw new TypeError("Guest array length exceeds allocation limit.");
+      for (const [key] of properties) {
+        if (typeof key !== "string") continue;
+        const index = Number(key);
+        if (Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key && index >= descriptor.value) throw new TypeError("Guest array index exceeds length.");
+      }
+    }
   } else if (node.kind === "guest-function") {
     fields(node, ["kind", "astNodeId", "scope", "state"], ["name", "environment"]);
     if (integer(node.astNodeId) < 1) throw new TypeError("Invalid guest AST identity.");
@@ -22387,17 +22407,17 @@ function validateGuestHeapNode(raw, heap) {
         } else if (expression.kind === "array") {
           fields(expression, ["kind", "values", "index"]);
           integer(expression.index);
-          reference(expression.values, ["array"]);
+          reference(expression.values, ["array", "guest-array"]);
         } else if (expression.kind === "call" || expression.kind === "new" || expression.kind === "tagged") {
           fields(expression, ["kind", "callee", "thisValue", "args", "index"]);
           integer(expression.index);
-          reference(expression.args, ["array"]);
+          reference(expression.args, ["array", "guest-array"]);
         } else if (expression.kind === "array-call") {
           fields(expression, ["kind", "target", "method", "args", "index"]);
           if (typeof expression.method !== "string") throw new TypeError("Invalid array method.");
           integer(expression.index);
-          reference(expression.args, ["array"]);
-          reference(expression.target, ["array"]);
+          reference(expression.args, ["array", "guest-array"]);
+          reference(expression.target, ["array", "guest-array"]);
         } else throw new TypeError("Invalid expression continuation.");
       }
     }
@@ -22660,7 +22680,7 @@ function validateDumpHeap(root, state) {
     validateErrorType(entry, path);
     validateSymbolEntries(entry, path, state, heap);
     try {
-      if (validateGuestHeapNode(entry, heap)) {
+      if (validateGuestHeapNode(entry, heap, state.limits.maxEntries)) {
         if (root.version !== 2) fail("unsupportedVersion", path, "guest heap records require dump version 2");
         continue;
       }
@@ -22889,7 +22909,7 @@ function validateGeneratorShape(record3, path, state) {
 function validateHeapValue(value, path, state, heap) {
   const record3 = requireRecord(value, path);
   try {
-    if (validateGuestHeapNode(record3, heap)) {
+    if (validateGuestHeapNode(record3, heap, state.limits.maxEntries)) {
       const tagged = state.validateTaggedPayloads;
       state.validateTaggedPayloads = false;
       try {
@@ -38762,4 +38782,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-AYL6LSPV.js.map
+//# sourceMappingURL=chunk-M7KI5UI3.js.map