@poe-platform/safe-js 0.1.25 → 0.1.26

package/README.md

@@ -55,6 +55,29 @@ const result = await run(`
 
 Properties stay inside the interpreter, not on native host functions. Arrows and object methods remain nonconstructible. Prototype links between callable or exotic objects (such as arrays) and accessor descriptors are unsupported; native `Function.prototype` is never exposed.
 
+<details>
+<summary>Object inspection and prototypes</summary>
+
+Ordinary objects inherit a sandbox-owned `Object.prototype`. Cached inspection works:
+
+```js
+const result = await run(`
+  const inspect = ({}).toString;
+  return [inspect.call([]), inspect.call(new Date(0)),
+    Object.getPrototypeOf({}) === Object.prototype];
+`);
+// result.returnValue: ["[object Array]", "[object Date]", true]
+```
+
+- `Object()` / `new Object()` create ordinary objects; passing an object preserves its identity.
+- `toString`, `valueOf`, `hasOwnProperty`, `propertyIsEnumerable` and `isPrototypeOf` support ordinary inspection. Type tags use sandbox brands, not guest-supplied fields.
+- Intrinsic methods are non-enumerable. Guest constructor prototypes inherit the ordinary Object prototype; explicit null/custom prototypes work with `Object.create`, `Object.setPrototypeOf` and literal `__proto__`. A computed `['__proto__']` remains an own data property.
+- Prototype mutations stay inside the current run or persistent realm and consume its retained-data budget. They never change native prototypes or another realm.
+
+Primitive boxing, inherited accessors, symbols and full Array/Function/exotic prototype graphs are unsupported. Use borrowed Object methods for inspecting those supported values. Explicit prototype links and mutated Object intrinsics are not portable checkpoint/copy data; project own data before crossing those boundaries. The conservative `AS011` lint rule still flags explicit `prototype`/`constructor` access; `run()` executes it without automatic linting.
+
+</details>
+
 <details>
 <summary>Dates and clocks</summary>
 

package/dist/safe-js/chunks/{chunk-BWVASPJX.js → chunk-2LVAGOJR.js}

@@ -6718,6 +6718,8 @@ function graphEntries(value) {
 var guestClosures = /* @__PURE__ */ new WeakSet();
 var functionProperties = /* @__PURE__ */ new WeakMap();
 var prototypes = /* @__PURE__ */ new WeakMap();
+var intrinsicPrototypes = /* @__PURE__ */ new WeakMap();
+var intrinsicConstructors = /* @__PURE__ */ new WeakMap();
 var descriptorObjects = /* @__PURE__ */ new WeakSet();
 function registerGuestClosure(closure) {
   guestClosures.add(closure);
@@ -6762,27 +6764,49 @@ function getGuestFunctionProperty(closure, key) {
   }
   return properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key)?.value;
 }
-function getSandboxPrototype(value) {
-  return prototypes.get(value) ?? null;
+function installObjectPrototype(budget, prototype, constructor) {
+  prototypes.set(prototype, null);
+  intrinsicPrototypes.set(budget, prototype);
+  const records = [prototype, materializeFunctionProperties(constructor)].map((value) => ({
+    value,
+    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+  }));
+  const unchanged = (before, after) => before !== void 0 && after !== void 0 && before.value === after.value && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+  intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+    const current = Object.getOwnPropertyDescriptors(value);
+    return Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
+  }));
+  budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])));
+}
+function releaseObjectPrototype(budget) {
+  const prototype = intrinsicPrototypes.get(budget);
+  if (prototype !== void 0) budget.setRetainedValues(prototype, void 0);
+  intrinsicPrototypes.delete(budget);
+}
+function getSandboxPrototype(value, budget) {
+  if (prototypes.has(value)) return prototypes.get(value) ?? null;
+  return budget !== void 0 && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
 }
 function setSandboxPrototype(value, prototype, budget) {
+  if (budget !== void 0 && intrinsicPrototypes.get(budget) === value && prototype !== null) {
+    throw new TypeError("Object.prototype has an immutable null prototype.");
+  }
   if (!isPrototypeRecord(value) || prototype !== null && !isPrototypeRecord(prototype)) {
     throw new TypeError(
       "Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported."
     );
   }
-  if (getSandboxPrototype(value) === prototype) return;
+  if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype) return;
   if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : value)) {
     throw new TypeError("Cannot change the prototype of a non-extensible object.");
   }
   let depth = 0;
-  for (let current = prototype; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = prototype; current !== null; current = getSandboxPrototype(current, budget)) {
     budget?.visitNode();
     assertSandboxDataDepth(depth++);
     if (current === value) throw new TypeError("Cyclic prototype value.");
   }
-  if (prototype === null) prototypes.delete(value);
-  else prototypes.set(value, prototype);
+  prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
   if (isGuestHostObject(value)) return false;
@@ -6798,6 +6822,8 @@ function hasManagedDescriptors(value) {
   return descriptorObjects.has(value);
 }
 function hasGuestObjectState(value) {
+  const intrinsicUnchanged = intrinsicConstructors.get(value);
+  if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
@@ -9504,6 +9530,7 @@ function createSandboxClosure(input) {
   if (input.sandbox === true) {
     Object.defineProperty(closure, "sandbox", { value: true });
   }
+  if (input.generator === true) Object.defineProperty(closure, "generator", { value: true });
   if (input.length !== void 0) {
     Object.defineProperty(closure, "length", { value: input.length });
   }
@@ -9791,7 +9818,7 @@ function measureSandboxData(values, options = {}) {
 function reconcileCompiledValues(budget, values, compilation, parent, escaping = []) {
   while (parent?.closed) parent = parent.parent;
   const included = /* @__PURE__ */ new Set();
-  const usage = measureSandboxData(values, { compileTickets: included });
+  const usage = measureSandboxData([...values, ...budget.retainedValues()], { compileTickets: included });
   const kept = /* @__PURE__ */ new Set();
   if (parent !== void 0) measureSandboxData(escaping, { compileTickets: kept });
   const transferred = /* @__PURE__ */ new Set();
@@ -25628,6 +25655,9 @@ async function evaluateObjectExpression(node, context) {
       return value;
     }
     if (isObjectPrototypeSetterProperty(property, key.value)) {
+      if (value.value === null || typeof value.value === "object") {
+        setSandboxPrototype(object, value.value, context.budget);
+      }
       continue;
     }
     defineSandboxProperty(object, String(key.value), value.value);
@@ -26432,7 +26462,7 @@ function forInKeys(object, budget) {
   const keys = [];
   const seen = /* @__PURE__ */ new Set();
   let depth = 0;
-  for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
     if (depth > 0) budget.visitNode();
     assertSandboxDataDepth(depth++);
     const properties = isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : current;
@@ -26448,7 +26478,7 @@ function forInKeys(object, budget) {
 function hasForInProperty(object, key, budget) {
   if (isGuestHostObject(object)) return getHostObjectKeys(object).includes(key);
   let depth = 0;
-  for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
     if (depth > 0) budget.visitNode();
     assertSandboxDataDepth(depth++);
     const properties = isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : current;
@@ -27449,7 +27479,7 @@ function applyBinaryOperator(node, left, right, context) {
           throw new TypeError("Function has a non-object prototype in instanceof check.");
         }
         let depth = 0;
-        for (let current = getSandboxPrototype(left); current !== null; current = getSandboxPrototype(current)) {
+        for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
           context.budget.visitNode();
           assertSandboxDataDepth(depth++);
           if (current === prototype) return true;
@@ -27663,7 +27693,7 @@ function getMemberValue(target, property, context) {
       return getPropertyValue(current, property, context);
     }
     if (Object.hasOwn(current, String(property))) return current[String(property)];
-    current = getSandboxPrototype(current);
+    current = getSandboxPrototype(current, context.budget);
     if (current !== null) {
       context.budget.visitNode();
       assertSandboxDataDepth(++depth);
@@ -27713,7 +27743,7 @@ function setSandboxProperty(target, property, value, budget) {
   } else {
     if (typeof prototypeOwner === "object" && prototypeOwner !== null) {
       let depth = 0;
-      for (let prototype = getSandboxPrototype(prototypeOwner); prototype !== null; prototype = getSandboxPrototype(prototype)) {
+      for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
         budget.visitNode();
         assertSandboxDataDepth(depth++);
         const properties = isSandboxClosure(prototype) ? prototype.properties : prototype;
@@ -28089,6 +28119,7 @@ function createInterpretedClosure(node, context, evaluateNode2) {
 function createGeneratorClosure(node, context, evaluateNode2) {
   return createSandboxClosure({
     guest: true,
+    generator: true,
     sandbox: true,
     length: getFunctionLength(node.params),
     ...node.id === void 0 ? {} : { name: node.id.name },
@@ -29827,10 +29858,138 @@ function ownDataValue(value, name) {
   return descriptor?.value;
 }
 
+// packages/safe-js/src/interp/globals/object.ts
+function createObjectGlobal(methods, budget) {
+  const construct = ([value]) => {
+    if (value === null || value === void 0) {
+      budget.chargeDataUsage(1);
+      return /* @__PURE__ */ Object.create(null);
+    }
+    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
+    return value;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "Object",
+    length: 1,
+    call: construct,
+    construct
+  });
+  const properties = materializeFunctionProperties(constructor);
+  const prototype = properties.prototype;
+  Object.defineProperty(properties, "prototype", { writable: false });
+  for (const [name, method] of Object.entries(methods)) {
+    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
+  }
+  const prototypeMethods = {
+    toString: createSandboxClosure({
+      sandbox: true,
+      name: "toString",
+      length: 0,
+      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
+    }),
+    valueOf: createSandboxClosure({
+      sandbox: true,
+      name: "valueOf",
+      length: 0,
+      call: (_args, context) => {
+        const value = requireReceiver(context?.thisValue);
+        if (typeof value !== "object")
+          throw new TypeError("Object primitive boxing is not supported.");
+        return value;
+      }
+    }),
+    hasOwnProperty: createSandboxClosure({
+      sandbox: true,
+      name: "hasOwnProperty",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        false
+      )
+    }),
+    propertyIsEnumerable: createSandboxClosure({
+      sandbox: true,
+      name: "propertyIsEnumerable",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        true
+      )
+    }),
+    isPrototypeOf: createSandboxClosure({
+      sandbox: true,
+      name: "isPrototypeOf",
+      length: 1,
+      call: ([value], context) => {
+        if (typeof value !== "object" || value === null) return false;
+        const receiver = requireReceiver(context?.thisValue);
+        let depth = 0;
+        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+          budget.visitNode();
+          assertSandboxDataDepth(depth++);
+          if (current === receiver) return true;
+        }
+        return false;
+      }
+    })
+  };
+  for (const [name, method] of Object.entries(prototypeMethods)) {
+    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
+  }
+  markDescriptorObject(prototype);
+  installObjectPrototype(budget, prototype, constructor);
+  return constructor;
+}
+function requireReceiver(value) {
+  if (value === null || value === void 0)
+    throw new TypeError("Object method requires a non-null receiver.");
+  return value;
+}
+function hasOwnSandboxProperty(value, key, enumerable) {
+  requireReceiver(value);
+  if (isGuestHostObject(value)) return getHostObjectKeys(value).includes(key);
+  let properties;
+  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
+  else if (isSandboxClosure(value)) {
+    if (key === "length" || key === "name") return !enumerable;
+    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
+  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
+    return false;
+  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
+  else properties = Object(value);
+  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
+}
+function typeTag(value) {
+  if (value === void 0) return "Undefined";
+  if (value === null) return "Null";
+  if (typeof value === "string") return "String";
+  if (typeof value === "number") return "Number";
+  if (typeof value === "boolean") return "Boolean";
+  if (isSandboxClosure(value)) {
+    while (value.boundTarget !== void 0) value = value.boundTarget;
+    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
+  }
+  if (Array.isArray(value)) return "Array";
+  if (isSandboxDate(value)) return "Date";
+  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
+  if (isSandboxRegex(value)) return "RegExp";
+  if (isSandboxMap(value)) return "Map";
+  if (isSandboxSet(value)) return "Set";
+  if (isSandboxPromise(value)) return "Promise";
+  if (isSandboxGenerator(value)) return "Generator";
+  if (isFloat32Array(value)) return "Float32Array";
+  return "Object";
+}
+
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
-    Object: {
+    Object: createObjectGlobal({
       keys: createSandboxClosure({
         sandbox: true,
         call: ([value]) => budgetSandboxValue2(getOwnEnumerableKeys(value), options.budget),
@@ -29848,7 +30007,11 @@ function createObjectArrayGlobals(options) {
       }),
       hasOwn: createSandboxClosure({
         sandbox: true,
-        call: ([value, key]) => Reflect.apply(Object.hasOwn, Object, [isSandboxClosure(value) ? objectProperties(value) : value, key]),
+        call: ([value, key], context) => {
+          if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
+          const name = sandboxString(key, options.budget, context);
+          return typeof name === "string" ? hasOwnSandboxProperty(value, name, false) : name.then((property) => hasOwnSandboxProperty(value, property, false));
+        },
         name: "hasOwn"
       }),
       getOwnPropertyDescriptor: createSandboxClosure({
@@ -29889,7 +30052,7 @@ function createObjectArrayGlobals(options) {
         call: ([value]) => {
           if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
           objectProperties(value);
-          return getSandboxPrototype(value);
+          return getSandboxPrototype(value, options.budget);
         },
         name: "getPrototypeOf"
       }),
@@ -29964,7 +30127,7 @@ function createObjectArrayGlobals(options) {
         call: ([target, ...sources]) => assignSandboxValues(target, sources, options.budget),
         name: "assign"
       })
-    },
+    }, options.budget),
     Array: createSandboxClosure({
       sandbox: true,
       call: (args) => createArrayFromConstructorArgs(args, options.budget),
@@ -30491,6 +30654,7 @@ var RealmState = class {
       this.budget.setRetainedValues(this, this.retainedRoots);
       this.tracker.onFatalRejection((error) => this.poison(error));
     } catch (error) {
+      releaseObjectPrototype(this.budget);
       this.compilation.dispose();
       this.lease.release();
       throw error;
@@ -31057,6 +31221,7 @@ var RealmState = class {
     for (const reference of this.guestReferences.keys()) revokeGuestReference(reference, this);
     this.guestReferences.clear();
     this.budget.setRetainedValues(this, void 0);
+    releaseObjectPrototype(this.budget);
     this.disposal = (async () => {
       const errors = [];
       for (const cleanup of this.cleanups.splice(0).reverse()) {
@@ -32065,6 +32230,7 @@ function run(source, options = {}) {
         }
       });
     } finally {
+      releaseObjectPrototype(budget);
       compilation.dispose();
       operation.release();
     }
@@ -32307,4 +32473,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-BWVASPJX.js.map
+//# sourceMappingURL=chunk-2LVAGOJR.js.map