@poe-platform/safe-js 0.1.720 → 0.1.722

package/dist/safe-js/chunks/{chunk-KK5NCR5R.js → chunk-EH5A2EQI.js}

@@ -1,10 +1,10 @@
 import {
   restore
-} from "./chunk-NJM2Q74Z.js";
+} from "./chunk-7SBQ7WTV.js";
 import {
   attachDumpController,
   createDumpController
-} from "./chunk-A7CADQAD.js";
+} from "./chunk-S2GFVXSI.js";
 import {
   getOwnErrorCode,
   hasOwnErrorCode
@@ -12,7 +12,7 @@ import {
 import {
   hashParsedAst,
   hashSource
-} from "./chunk-U6KZ2DQ2.js";
+} from "./chunk-K3ZRBAG5.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -21,6 +21,9 @@ import {
   PromiseReplay,
   SandboxJobQueue,
   Scope,
+  arrayBufferDetached,
+  arrayBufferLength,
+  arrayBufferOptions,
   attachExecutionControl,
   attachSourceLoader,
   awaitSandboxValue,
@@ -30,8 +33,10 @@ import {
   consumeSettledHostCall,
   copyHostValueToSandbox,
   createBuiltinBindings,
+  createEvalSource,
   createGuestReference,
   createHostCallbackContext,
+  createImmutableEmptyModuleEnvironment,
   createLiveHostObject,
   createModuleEnvironment,
   createModuleNamespace,
@@ -44,15 +49,19 @@ import {
   decodeReplayData,
   deepCopyFromSandbox,
   deepCopyToSandbox,
+  denyGuestStringCompilation,
   encodeReplayData,
   enterRunningState,
   enterSnapshotRun,
   exportHostCapability,
   getExtensionSetup,
+  getRealmGlobalObject,
   guestProxyStates,
+  hostObjectGuestRoot,
   inMemoryRunSnapshots,
   interpret,
   invokeBuiltinClosure,
+  isSandboxArrayBuffer,
   isSandboxClosure,
   isSandboxCollectionIterator,
   isSandboxMap,
@@ -75,6 +84,7 @@ import {
   releaseObjectPrototype,
   resolveModuleImports,
   resolveModuleNamespace,
+  retainValues,
   revokeGuestCallback,
   revokeGuestReference,
   revokeHostObject,
@@ -90,7 +100,7 @@ import {
   withSandboxPromiseRejectionTracker,
   wrapCallerInjectedBindings,
   wrapCancelableBindings
-} from "./chunk-KP6I45ET.js";
+} from "./chunk-BNIEPGDU.js";
 import {
   Budget,
   CompileScope,
@@ -105,20 +115,21 @@ import {
   parseSourceModule,
   replaceErrorStack,
   safeAddEvent
-} from "./chunk-IDQ67DY2.js";
+} from "./chunk-RYVHEOHM.js";
 
 // packages/safe-js/src/realm.ts
-import { AsyncLocalStorage } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { types } from "node:util";
 
 // packages/safe-js/src/modules/source-graph.ts
+import { AsyncLocalStorage } from "node:async_hooks";
 var ambiguous = /* @__PURE__ */ Symbol("ambiguous module export");
 var sourceRecords = /* @__PURE__ */ new WeakSet();
 var SourceModuleGraph = class {
   constructor(options) {
     this.options = options;
     this.jobs = options.jobs ?? new SandboxJobQueue();
-    attachSourceLoader(options.modules, this.import.bind(this));
+    attachSourceLoader(options.modules, this.import.bind(this), { preserveImmutableNamespaces: true });
     options.budget?.setRetainedValues(this, () => [...this.records.values()].flatMap((record) => [record.id, record.source, ...record.parsed.requests, ...record.scope.retainedDataRoots()]));
   }
   options;
@@ -126,60 +137,169 @@ var SourceModuleGraph = class {
   records = /* @__PURE__ */ new Map();
   requests = /* @__PURE__ */ new Map();
   requestDataSize = 0;
+  lookupDataSize = 0;
   pendingImports = /* @__PURE__ */ new Set();
+  fulfilledImports = 0;
+  rejectedImports = 0;
+  importGroup = new AsyncLocalStorage();
   jobs;
   evaluationStack = [];
   evaluationIndex = 0;
   close() {
     this.options.budget?.setRetainedValues(this, void 0);
     this.options.budget?.setRetainedDataUsage(this.requests, 0);
+    for (const record of this.records.values()) {
+      record.explicitExports.clear();
+      record.localImports.clear();
+      record.starExports.length = 0;
+    }
+    this.options.budget?.setRetainedDataUsage(this.records, 0);
+    this.lookupDataSize = 0;
     this.requestDataSize = 0;
     this.records.clear();
     this.requests.clear();
   }
+  sourceModuleStatus() {
+    return Object.freeze({
+      pendingImports: this.pendingImports.size,
+      preparedModules: this.records.size,
+      fulfilledImports: this.fulfilledImports,
+      rejectedImports: this.rejectedImports
+    });
+  }
   import(specifier, referrer) {
+    const group = this.importGroup.getStore();
+    const cancelDeadline = this.startImportDeadline();
     const pending = (async () => {
       const entry = await this.load(specifier, referrer);
       if (!isRecord(entry)) return entry;
       await this.loadGraph(entry);
-      await this.link(entry);
+      if (this.options.serializePreparation) await this.jobs.run(() => this.link(entry));
+      else await this.link(entry);
       await this.evaluate(entry);
       await this.jobs.drain();
       return this.namespace(entry);
     })();
     this.pendingImports.add(pending);
-    void pending.then(() => this.pendingImports.delete(pending), () => this.pendingImports.delete(pending));
+    group?.add(pending);
+    const release = () => {
+      cancelDeadline();
+      this.pendingImports.delete(pending);
+      group?.delete(pending);
+    };
+    void pending.then(
+      () => {
+        this.fulfilledImports++;
+        release();
+      },
+      () => {
+        this.rejectedImports++;
+        release();
+      }
+    );
     return pending;
   }
-  async settle() {
+  startImportDeadline() {
+    const policy = this.options.importDeadline;
+    const signal = this.options.signal;
+    if (policy === void 0 || signal?.aborted) return () => {
+    };
+    const deadline = Date.now() + policy.timeoutMs;
+    let expired = false;
+    const expire = (reason) => {
+      if (expired) return;
+      expired = true;
+      cancel();
+      policy.abort(reason);
+    };
+    const releaseDeadline = this.options.budget?.acquireDeadline(deadline, expire);
+    const timer = setTimeout(() => {
+      expire(new SandboxError({
+        budget: "deadline",
+        current: Date.now(),
+        limit: deadline
+      }));
+    }, policy.timeoutMs);
+    const cancel = () => {
+      clearTimeout(timer);
+      releaseDeadline?.();
+      signal?.removeEventListener("abort", cancel);
+    };
+    signal?.addEventListener("abort", cancel, { once: true });
+    return cancel;
+  }
+  withoutImportGroup(task) {
+    return this.importGroup.exit(task);
+  }
+  withImportGroup(task) {
+    const group = /* @__PURE__ */ new Set();
+    return this.importGroup.run(group, async () => {
+      const result = await task();
+      await this.settle(group);
+      return result;
+    });
+  }
+  async settle(pendingImports = this.pendingImports) {
     do {
-      await Promise.allSettled([...this.pendingImports]);
+      await Promise.allSettled([...pendingImports]);
       await this.jobs.drain();
-    } while (this.pendingImports.size > 0);
+    } while (pendingImports.size > 0);
   }
   async evaluateSource(source, beforeEvaluation) {
-    const entry = this.register(source);
+    const entry = this.options.serializePreparation ? await this.jobs.run(() => this.register(source)) : this.register(source);
     await this.loadGraph(entry);
-    await this.link(entry);
+    if (this.options.serializePreparation) await this.jobs.run(() => this.link(entry));
+    else await this.link(entry);
     beforeEvaluation?.(entry.parsed.module);
     await this.evaluate(entry);
     await this.jobs.drain();
     return this.namespace(entry);
   }
   register(source) {
+    this.options.assertActive?.();
+    this.options.signal?.throwIfAborted();
     const known = this.records.get(source.id);
     if (known !== void 0) {
       if (known.source !== source.source) throw new TypeError(`Source identity '${source.id}' changed within the graph.`);
       return known;
     }
     this.options.budget?.chargeDataUsage(source.source.length + source.id.length + 1);
-    const parsed = parseSourceModule(source.source, source.id, this.options.compilation?.owner ?? this.options.compileOwner);
+    const parsed = parseSourceModule(source.source, source.id, this.options.compilation?.owner ?? this.options.compileOwner, { sharedPositions: true, compactAst: true });
+    const explicitExports = /* @__PURE__ */ new Map();
+    const localImports = /* @__PURE__ */ new Map();
+    const starExports = [];
+    for (const entry of parsed.exports) {
+      this.options.budget?.visitNode();
+      if (entry.exported === void 0) {
+        const lookupDataSize = this.lookupDataSize + 1;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        starExports.push(entry);
+      } else if (!explicitExports.has(entry.exported)) {
+        const lookupDataSize = this.lookupDataSize + entry.exported.length + 2;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        explicitExports.set(entry.exported, entry);
+      }
+    }
+    for (const entry of parsed.imports) {
+      this.options.budget?.visitNode();
+      if (!localImports.has(entry.local)) {
+        const lookupDataSize = this.lookupDataSize + entry.local.length + 2;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        localImports.set(entry.local, entry);
+      }
+    }
     const importMeta = /* @__PURE__ */ Object.create(null);
     setSandboxPrototype(importMeta, null);
     const record = {
       id: source.id,
       source: source.source,
       parsed,
+      explicitExports,
+      localImports,
+      starExports,
       scope: new Scope({ this: void 0 }, this.options.scope, importMeta, { functionBoundary: true }),
       dependencies: /* @__PURE__ */ new Map()
     };
@@ -205,7 +325,7 @@ var SourceModuleGraph = class {
       if (source === void 0) throw new TypeError(`Source resolver denied '${specifier}' from '${referrer}'.`);
       if (typeof source.id !== "string" || source.id.length === 0 || typeof source.source !== "string")
         throw new TypeError("Source resolver must supply a nonempty identity and source text.");
-      return this.register(source);
+      return this.options.serializePreparation ? this.jobs.run(() => this.register(source)) : this.register(source);
     })();
     this.requests.set(key, request);
     return request;
@@ -315,24 +435,17 @@ var SourceModuleGraph = class {
     const leave = this.options.budget?.enterCall();
     try {
       visited.add(key);
-      const explicit = record.parsed.exports.find((entry) => {
-        this.options.budget?.visitNode();
-        return entry.exported === name;
-      });
+      const explicit = record.explicitExports.get(name);
       if (explicit?.local !== void 0) {
-        const imported = record.parsed.imports.find((entry) => {
-          this.options.budget?.visitNode();
-          return entry.local === explicit.local;
-        });
+        const imported = record.localImports.get(explicit.local);
         if (imported === void 0 || imported.namespace === true) return { record, name: explicit.local };
         return this.resolveDependency(record, imported.request, imported.imported, visited);
       }
       if (explicit?.request !== void 0) return this.resolveDependency(record, explicit.request, explicit.imported, visited, explicit.namespace);
       if (name === "default") return void 0;
       let resolved;
-      for (const entry of record.parsed.exports) {
+      for (const entry of record.starExports) {
         this.options.budget?.visitNode();
-        if (entry.exported !== void 0) continue;
         const candidate = this.resolveDependency(record, entry.request, name, visited);
         if (candidate === ambiguous) return ambiguous;
         if (candidate === void 0) continue;
@@ -459,7 +572,7 @@ var SourceModuleGraph = class {
   async execute(record, modulePhase, onSuspend) {
     const result = await interpret(
       { type: "BlockStatement", body: record.parsed.module.body, span: record.parsed.module.span },
-      { ...this.options, scope: record.scope, useScopeDirectly: true, jobs: this.jobs, nested: true, modulePhase, onSuspend }
+      { ...this.options, scope: record.scope, useScopeDirectly: true, captureSnapshot: false, jobs: this.jobs, nested: true, modulePhase, onSuspend }
     );
     this.stats.nodeVisits += result.stats.nodeVisits;
     if (!result.ok) throw new Error(result.error.message);
@@ -488,9 +601,15 @@ function createReplayableRandom(options = {}) {
 }
 
 // packages/safe-js/src/realm.ts
+var retainedArrayPrototype = Array.prototype;
+var nativeRetainedArrayPrototype = Object.setPrototypeOf;
+var nativeRetainedArrayAppend = Function.prototype.call.bind(Array.prototype.push);
+var freezeSourceReference = Object.freeze;
 var RealmState = class {
   constructor(options, queue = new SandboxJobQueue()) {
     this.options = options;
+    if (options.classicScripts !== void 0 && typeof options.classicScripts !== "boolean")
+      throw new TypeError("Realm classicScripts must be a boolean.");
     this.queue = queue;
     const limitInput = readDataRecord(options.limits ?? {}, "Realm limits");
     this.limits = {
@@ -524,6 +643,8 @@ var RealmState = class {
     if (this.extensions.length > this.limits.extensions)
       throw new RangeError("Realm extension limit exceeded.");
     this.globals = readDataRecord(options.bindings ?? {}, "Realm bindings");
+    if (options.classicScripts && ["this", "globalThis"].some((name) => Object.hasOwn(this.globals, name)))
+      throw new TypeError("Classic Script receiver bindings cannot be replaced.");
     this.modules = readModules(options.modules);
     const grants = new Set(readStringList(options.grants ?? [], "Realm grants"));
     for (const extension of this.extensions) getExtensionSetup(extension);
@@ -536,7 +657,7 @@ var RealmState = class {
       this.consoleExtension = extensionName;
     }
     this.budget = options.budget ?? new Budget({ maxCallDepth: 1e3 });
-    this.lease = this.budget.acquireCompileOwner(true);
+    this.lease = this.budget.acquireRealmOwner();
     this.compilation = new CompileScope(this.lease.owner);
     this.bridge = {
       owner: this,
@@ -570,6 +691,8 @@ var RealmState = class {
       );
       for (const extension of this.extensions) {
         const manifest = extension.manifest;
+        if (options.classicScripts && manifest.globals?.some((name) => name === "this" || name === "globalThis"))
+          throw new TypeError("Classic Script receiver bindings cannot be replaced.");
         if (names.has(manifest.name))
           throw new TypeError(`Duplicate extension '${manifest.name}'.`);
         names.add(manifest.name);
@@ -609,7 +732,7 @@ var RealmState = class {
   lease;
   compilation;
   controller = new AbortController();
-  phase = new AsyncLocalStorage();
+  phase = new AsyncLocalStorage2();
   queue;
   tracker = createSandboxPromiseRejectionTracker();
   bridge;
@@ -621,6 +744,8 @@ var RealmState = class {
   resources;
   callbacks = /* @__PURE__ */ new Map();
   pendingCallbacks = /* @__PURE__ */ new Set();
+  pendingWork = /* @__PURE__ */ new Set();
+  releaseReconciliation;
   callbackCache = /* @__PURE__ */ new WeakMap();
   hostObjects = /* @__PURE__ */ new Set();
   guestReferences = /* @__PURE__ */ new Map();
@@ -646,11 +771,17 @@ var RealmState = class {
     signal: this.controller.signal,
     realm: this.bridge
   });
-  retainedRoots = () => [
-    ...this.callbacks.values(),
-    ...Array.from(this.pendingCallbacks, (pending) => pending.closure),
-    ...this.guestReferences.values()
-  ];
+  retainedRoots = () => {
+    const roots = nativeRetainedArrayPrototype([], null);
+    for (const object of this.hostObjects) {
+      const root = hostObjectGuestRoot(object);
+      if (root !== void 0) nativeRetainedArrayAppend(roots, root);
+    }
+    for (const closure of this.callbacks.values()) nativeRetainedArrayAppend(roots, closure);
+    for (const pending of this.pendingCallbacks) nativeRetainedArrayAppend(roots, pending.closure);
+    for (const reference of this.guestReferences.values()) nativeRetainedArrayAppend(roots, reference);
+    return nativeRetainedArrayPrototype(roots, retainedArrayPrototype);
+  };
   captureArguments = (operation, args, copy) => {
     const from = this.retainedOperations.get(operation)?.from ?? args.length;
     const values = copy(args.slice(0, from));
@@ -676,7 +807,7 @@ var RealmState = class {
       }
       if (captured.length > 0)
         this.budget.reconcileDataUsage(
-          measureSandboxData([...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()])
+          measureSandboxData([...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots(), ...this.budget.retainedValues()])
         );
       return { args: values, rollback };
     } catch (error) {
@@ -685,6 +816,40 @@ var RealmState = class {
       throw error;
     }
   };
+  createArrayBufferReference = (buffer) => {
+    this.assertOpen();
+    if (!isSandboxArrayBuffer(buffer) || arrayBufferDetached(buffer) || arrayBufferOptions(buffer) !== void 0 || Reflect.ownKeys(buffer).length !== 0)
+      throw new TypeError(
+        "Live buffer references require a fixed, attached, plain ArrayBuffer without metadata."
+      );
+    let reference;
+    try {
+      this.budget.allocateArrayLength(arrayBufferLength(buffer));
+      this.checkCollection(
+        this.guestReferences.size + 1,
+        this.limits.guestReferences,
+        "guest reference"
+      );
+      const root = [buffer];
+      reference = createGuestReference(root, this, this.assertOpen);
+      this.guestReferences.set(reference, root);
+      this.budget.reconcileDataUsage(
+        measureSandboxData([
+          ...this.scope?.retainedDataRoots() ?? [],
+          ...this.retainedRoots(),
+          ...this.budget.retainedValues()
+        ])
+      );
+      return reference;
+    } catch (error) {
+      if (reference !== void 0) {
+        revokeGuestReference(reference, this);
+        this.guestReferences.delete(reference);
+      }
+      if (error instanceof SandboxError) this.poison(error);
+      throw error;
+    }
+  };
   releaseGuestReference = (reference) => {
     readGuestReference(reference, this);
     revokeGuestReference(reference, this);
@@ -713,6 +878,34 @@ var RealmState = class {
         void this.dispose().catch(() => void 0);
       });
   }
+  trackWork(pending) {
+    this.pendingWork.add(pending);
+    void pending.then(
+      () => {
+        this.pendingWork.delete(pending);
+      },
+      () => {
+        this.pendingWork.delete(pending);
+      }
+    );
+    return pending;
+  }
+  reconcileWhenIdle() {
+    if (this.closed || this.active !== void 0 || this.pendingCallbacks.size > 0) return;
+    this.releaseReconciliation?.();
+    this.releaseReconciliation = void 0;
+    try {
+      reconcileCompiledValues(
+        this.budget,
+        [...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()],
+        this.compilation
+      );
+    } catch (error) {
+      this.poison(error);
+      void this.dispose().catch(() => void 0);
+      throw error;
+    }
+  }
   chargeWork = (units = 1) => {
     this.assertOpen();
     if (!Number.isSafeInteger(units) || units < 0)
@@ -811,6 +1004,7 @@ var RealmState = class {
       owner: this,
       assertActive: this.assertOpen,
       chargeWork: this.chargeWork,
+      chargeGuestData: (units) => this.budget.chargeDataUsage(units),
       checkLength: (length) => this.budget.allocateArrayLength(length),
       checkString: (value) => {
         this.budget.allocateString(value);
@@ -880,7 +1074,7 @@ var RealmState = class {
     });
     try {
       this.budget.reconcileDataUsage(
-        measureSandboxData([...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()])
+        measureSandboxData([...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots(), ...this.budget.retainedValues()])
       );
     } catch (error) {
       this.poison(error);
@@ -913,12 +1107,19 @@ var RealmState = class {
   };
   invokeCallback = this.executeCallback.bind(this);
   async executeCallback(callback, options = {}, completeSynchronous) {
-    if (this.closed || this.failure !== void 0) await this.dispose();
+    if ((this.closed || this.failure !== void 0) && this.options.callbackScheduling !== "after-prefix")
+      await this.dispose();
     this.assertOpen();
     const closure = readGuestCallback(callback, this);
     this.checkCollection(this.pendingCallbacks.size + 1, this.limits.callbacks, "pending callback");
-    const record = { closure };
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    const record = {
+      closure,
+      prefixComplete: false
+    };
     this.pendingCallbacks.add(record);
+    if (scheduled) this.releaseReconciliation ??= this.budget.deferReconciliation();
+    const rejectionOwner = scheduled ? this.tracker.startOperation() : void 0;
     const invoke = async () => {
       this.assertOpen();
       readGuestCallback(callback, this);
@@ -949,6 +1150,7 @@ var RealmState = class {
         if (isSandboxPromise(value) && value.synchronousPrefix !== void 0)
           await value.synchronousPrefix;
         this.assertOpen();
+        record.prefixComplete = true;
         completeSynchronous?.();
         const settled = await suspendJob(settlement);
         return this.exportValue(settled);
@@ -958,25 +1160,37 @@ var RealmState = class {
       }
     };
     try {
-      const active = this.active !== void 0;
-      const pending = withSandboxPromiseRejectionTracker(
-        this.tracker,
-        () => runResources.run(
-          this.resources,
-          () => withCancellationSignal(
-            this.controller.signal,
-            () => active && this.phase.getStore()?.active ? runAsyncPrefix(invoke) : this.queue.run(invoke)
+      const active = this.active !== void 0 || scheduled && this.phase.getStore()?.active === true;
+      const execute = () => this.tracker.withOperation(
+        rejectionOwner,
+        () => withSandboxPromiseRejectionTracker(
+          this.tracker,
+          () => runResources.run(
+            this.resources,
+            () => withCancellationSignal(
+              this.controller.signal,
+              () => active && this.phase.getStore()?.active ? runAsyncPrefix(invoke, completeSynchronous === void 0 && this.phase.getStore()?.extension !== void 0) : this.queue.run(invoke)
+            )
           )
         )
       );
-      record.promise = active ? pending : this.perform(() => pending);
-      return await record.promise;
+      const pending = scheduled && this.sourceGraph !== void 0 ? this.sourceGraph.withoutImportGroup(execute) : execute();
+      record.promise = scheduled ? this.trackWork(pending) : active ? pending : this.perform(() => pending);
+      const result = await record.promise;
+      if (scheduled) {
+        await this.checkUnhandledRejection(rejectionOwner);
+        this.assertOpen();
+      }
+      return result;
     } catch (error) {
-      if (error instanceof SandboxError) this.poison(error);
+      if (scheduled || error instanceof SandboxError) this.poison(error);
+      if (scheduled) void this.dispose().catch(() => void 0);
       throw error;
     } finally {
+      this.tracker.finishOperation(rejectionOwner);
       this.pendingCallbacks.delete(record);
-      if (!this.closed && this.active === void 0)
+      if (scheduled) this.reconcileWhenIdle();
+      else if (!this.closed && this.active === void 0)
         reconcileCompiledValues(
           this.budget,
           [...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()],
@@ -997,6 +1211,12 @@ var RealmState = class {
         },
         chargeWork: this.chargeWork,
         createHostObject: this.createHostObject,
+        createArrayBufferReference: (buffer) => {
+          this.assertOpen();
+          if (!extension.manifest.capabilities?.includes("array-buffer:share"))
+            throw new TypeError("Live buffers require the array-buffer:share grant.");
+          return this.createArrayBufferReference(buffer);
+        },
         startCallback: this.startCallback,
         invokeCallback: this.invokeCallback,
         releaseCallback: this.releaseCallback,
@@ -1081,71 +1301,129 @@ var RealmState = class {
     const bindings = wrapCallerInjectedBindings(this.globals, this.bridgeOptions());
     this.scope = new Scope(this.builtinBindings, void 0, void 0, { chargeData: false }).child(
       bindings,
-      { functionBoundary: true }
+      this.options.classicScripts ? { globalEnvironment: true } : { functionBoundary: true }
     );
+    if (this.options.classicScripts)
+      this.scope.declare("this", "const", getRealmGlobalObject(this.budget));
+    if (this.options.stringCompilation === "deny") denyGuestStringCompilation(this.scope);
   }
-  async evaluateRaw(source, filename = "<realm>", nested = false, sourceType) {
+  sourceModuleStatus = () => {
+    this.assertOpen();
+    return this.sourceGraph?.sourceModuleStatus() ?? Object.freeze({
+      pendingImports: 0,
+      preparedModules: 0,
+      fulfilledImports: 0,
+      rejectedImports: 0
+    });
+  };
+  ensureSourceGraph() {
+    this.assertOpen();
+    this.initialize();
+    if (this.sourceGraph !== void 0) return this.sourceGraph;
+    const moduleOptions = { ...this.bridgeOptions(), wrappedModules: this.convertedModules };
+    const modules = Object.keys(this.modules).length === 0 && this.convertedModules.size === 0 ? createImmutableEmptyModuleEnvironment(moduleOptions) : createModuleEnvironment(this.modules, moduleOptions);
+    return this.sourceGraph ??= new SourceModuleGraph({
+      resolver: this.options.sourceResolver ?? (() => void 0),
+      scope: this.scope,
+      modules,
+      budget: this.budget,
+      compilation: this.compilation,
+      signal: this.controller.signal,
+      jobs: this.queue,
+      assertActive: this.assertOpen,
+      surfaceUnhandledThrows: true,
+      serializePreparation: this.options.callbackScheduling === "after-prefix",
+      ...this.options.sourceImportTimeoutMs === void 0 ? {} : {
+        importDeadline: {
+          timeoutMs: this.options.sourceImportTimeoutMs,
+          abort: (reason) => {
+            this.poison(reason);
+            void this.close().catch(() => void 0);
+          }
+        }
+      }
+    });
+  }
+  async evaluateRaw(source, filename = "<realm>", nested = false, sourceType, reportUnhandledThrows = false) {
     this.assertOpen();
     if (typeof source !== "string") throw new TypeError("Realm source must be a string.");
     if (sourceType === "module") {
+      const prepare = () => {
+        this.ensureSourceGraph();
+      };
+      const scheduled = this.options.callbackScheduling === "after-prefix";
+      if (scheduled) await this.queue.run(prepare);
+      else prepare();
+      const graph = this.sourceGraph;
+      const before = graph.stats.nodeVisits;
+      const evaluate = async () => {
+        const namespace2 = await graph.evaluateSource({ id: filename, source }, (module) => {
+          this.sourceModuleHash = hashParsedAst(module);
+        });
+        if (!scheduled) await graph.settle();
+        return namespace2;
+      };
+      const namespace = scheduled ? await graph.withImportGroup(evaluate) : await evaluate();
+      return { ok: true, returnValue: namespace, snapshot: { bindings: {} }, stats: { nodeVisits: graph.stats.nodeVisits - before, currentDataSize: this.budget.currentDataSize, peakDataSize: this.budget.peakDataSize } };
+    }
+    const script = this.options.classicScripts ? createEvalSource(source, {}, this.lease.owner, filename, { compactAst: true }) : void 0;
+    const sourceReference = script && this.options.sourceResolver !== void 0 ? freezeSourceReference({ referrer: filename }) : void 0;
+    const releaseSource = script ? retainValues(this.budget, () => [script.source, sourceReference]) : void 0;
+    try {
+      if (script) this.budget.chargeDataUsage(measureSandboxData([script.source]));
+      if (sourceReference) this.budget.chargeDataUsage(measureSandboxData([sourceReference]));
+      const module = script?.node ?? parseExecutableModule(source, filename, this.lease.owner);
       this.initialize();
-      this.sourceGraph ??= new SourceModuleGraph({
-        resolver: this.options.sourceResolver ?? (() => void 0),
-        scope: this.scope,
-        modules: createModuleEnvironment(this.modules, { ...this.bridgeOptions(), wrappedModules: this.convertedModules }),
-        budget: this.budget,
-        compilation: this.compilation,
-        signal: this.controller.signal,
-        jobs: this.queue,
-        assertActive: this.assertOpen,
-        surfaceUnhandledThrows: true
-      });
-      const before = this.sourceGraph.stats.nodeVisits;
-      const namespace = await this.sourceGraph.evaluateSource({ id: filename, source }, (module2) => {
-        this.sourceModuleHash = hashParsedAst(module2);
+      const moduleOptions = { ...this.bridgeOptions(), wrappedModules: this.convertedModules };
+      const moduleEnvironment = script && Object.keys(this.modules).length === 0 && this.convertedModules.size === 0 ? createImmutableEmptyModuleEnvironment(moduleOptions) : createModuleEnvironment(this.modules, moduleOptions);
+      if (sourceReference)
+        attachSourceLoader(
+          moduleEnvironment,
+          (specifier, referrer) => this.ensureSourceGraph().import(specifier, referrer),
+          { preserveImmutableNamespaces: true }
+        );
+      const imports = script ? {} : resolveModuleImports(module, this.modules, {
+        environment: moduleEnvironment,
+        ...this.bridgeOptions(),
+        wrappedModules: this.convertedModules
       });
-      await this.sourceGraph.settle();
-      return { ok: true, returnValue: namespace, snapshot: { bindings: {} }, stats: { nodeVisits: this.sourceGraph.stats.nodeVisits - before, currentDataSize: this.budget.currentDataSize, peakDataSize: this.budget.peakDataSize } };
-    }
-    const module = parseExecutableModule(source, filename, this.lease.owner);
-    this.initialize();
-    const moduleEnvironment = createModuleEnvironment(this.modules, { ...this.bridgeOptions(), wrappedModules: this.convertedModules });
-    const imports = resolveModuleImports(module, this.modules, {
-      environment: moduleEnvironment,
-      ...this.bridgeOptions(),
-      wrappedModules: this.convertedModules
-    });
-    this.scope.moduleEnvironment = moduleEnvironment;
-    for (const [name, value] of Object.entries(imports)) {
-      const binding = this.scope.lookup(name);
-      if (!binding.found) this.scope.declare(name, "const", value);
-      else if (binding.value !== value) throw new TypeError(`Conflicting import '${name}'.`);
-    }
-    const result = await interpret(
-      {
-        type: "BlockStatement",
-        body: module.body.filter((statement) => statement.type !== "ImportDeclaration"),
-        span: module.span
-      },
-      {
-        scope: this.scope,
-        useScopeDirectly: true,
-        budget: this.budget,
-        compilation: this.compilation,
-        signal: this.controller.signal,
-        surfaceUnhandledThrows: true,
-        jobs: this.queue,
-        nested,
-        assertActive: this.assertOpen
+      this.scope.moduleEnvironment = moduleEnvironment;
+      for (const [name, value] of Object.entries(imports)) {
+        const binding = this.scope.lookup(name);
+        if (!binding.found) this.scope.declare(name, "const", value);
+        else if (binding.value !== value) throw new TypeError(`Conflicting import '${name}'.`);
       }
-    );
-    this.assertOpen();
-    return result;
+      const result = await interpret(
+        {
+          type: "BlockStatement",
+          body: module.body.filter((statement) => statement.type !== "ImportDeclaration"),
+          span: module.span
+        },
+        {
+          ...script ? { script: { strict: script.strict } } : {},
+          sourceReference,
+          scope: this.scope,
+          useScopeDirectly: true,
+          budget: this.budget,
+          compilation: this.compilation,
+          signal: this.controller.signal,
+          surfaceUnhandledThrows: true,
+          reportUnhandledThrows: script !== void 0 && reportUnhandledThrows,
+          jobs: this.queue,
+          nested,
+          assertActive: this.assertOpen
+        }
+      );
+      this.assertOpen();
+      return result;
+    } finally {
+      releaseSource?.();
+    }
   }
   evaluateNested = async (source, extension) => {
     this.assertOpen();
     const phase = this.phase.getStore();
-    if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0)
+    if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0 && !(this.options.callbackScheduling === "after-prefix" && this.pendingCallbacks.size > 0))
       throw new SandboxError("reentry");
     const leave = this.budget.enterCall();
     phase.evaluating = true;
@@ -1168,39 +1446,65 @@ var RealmState = class {
     }
   };
   evaluate = async (source, options = {}) => this.perform(async () => {
-    const result = await this.evaluateRaw(source, options.filename, false, options.sourceType);
+    const discard = Object.getOwnPropertyDescriptor(options, "discardResult");
+    if (discard && (!("value" in discard) || discard.value !== void 0 && typeof discard.value !== "boolean"))
+      throw new TypeError("Realm evaluation discardResult must be an own-data boolean.");
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    const reportUnhandledThrows = options.sourceType !== "module" && this.options.classicScriptErrors === "report";
+    const result = scheduled && options.sourceType !== "module" ? await this.queue.run(() => this.evaluateRaw(source, options.filename, true, void 0, reportUnhandledThrows)) : await this.evaluateRaw(source, options.filename, false, options.sourceType, reportUnhandledThrows);
     if (!result.ok) {
-      await this.dispose();
-      return { ok: false, error: result.error, stats: result.stats };
+      const recoverable = reportUnhandledThrows && result.error.code === "UNCAUGHT_EXCEPTION";
+      if (!scheduled && !recoverable) await this.dispose();
+      return { ok: false, error: result.error, stats: result.stats, ...recoverable ? { recoverable: true } : {} };
     }
-    return { ok: true, returnValue: this.exportValue(result.returnValue), stats: result.stats };
-  });
-  async perform(task) {
-    if (this.closed || this.failure !== void 0) await this.dispose();
+    return { ok: true, ...discard?.value === true ? {} : { returnValue: this.exportValue(result.returnValue) }, stats: result.stats };
+  }, (result) => !result.ok && !result.recoverable);
+  async checkUnhandledRejection(owner) {
+    const unhandled = await this.tracker.findUnhandledRejection(owner);
+    if (unhandled !== void 0) {
+      const error = new Error(
+        `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
+      );
+      error.name = "UnhandledRejectionError";
+      throw error;
+    }
+  }
+  async perform(task, failed) {
+    if ((this.closed || this.failure !== void 0) && this.options.callbackScheduling !== "after-prefix")
+      await this.dispose();
     this.assertOpen();
     if (this.active !== void 0) throw new SandboxError("reentry");
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    if (scheduled && (this.phase.getStore()?.active || [...this.pendingCallbacks].some((record) => !record.prefixComplete)))
+      throw new SandboxError("reentry");
+    const rejectionOwner = scheduled ? this.tracker.startOperation() : void 0;
     const pending = Promise.resolve().then(
-      () => withSandboxPromiseRejectionTracker(
-        this.tracker,
-        () => runResources.run(
-          this.resources,
-          () => withCancellationSignal(this.controller.signal, task)
+      () => this.tracker.withOperation(
+        rejectionOwner,
+        () => withSandboxPromiseRejectionTracker(
+          this.tracker,
+          () => runResources.run(
+            this.resources,
+            () => withCancellationSignal(this.controller.signal, task)
+          )
         )
       )
     );
     this.active = pending;
+    if (scheduled) this.trackWork(pending);
     try {
       const result = await pending;
-      await this.queue.drain();
-      const unhandled = await this.tracker.findUnhandledRejection();
-      if (unhandled !== void 0) {
-        const error = new Error(
-          `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
-        );
-        error.name = "UnhandledRejectionError";
-        throw error;
+      if (scheduled && failed?.(result)) {
+        this.closed = true;
+        this.controller.abort(new Error("SafeJS source evaluation failed."));
+        await this.dispose();
+        return result;
       }
+      if (scheduled) this.assertOpen();
+      await this.queue.drain();
+      await this.checkUnhandledRejection(rejectionOwner);
       if (this.failure !== void 0) throw this.failure.reason;
+      if (scheduled) this.assertOpen();
       if (!this.closed)
         reconcileCompiledValues(
           this.budget,
@@ -1218,12 +1522,22 @@ var RealmState = class {
       }
       throw reason;
     } finally {
-      this.active = void 0;
+      this.tracker.finishOperation(rejectionOwner);
+      if (this.active === pending) this.active = void 0;
+      if (scheduled) this.reconcileWhenIdle();
     }
   }
   close = () => {
     this.closed = true;
     this.controller.abort(new Error("SafeJS realm is closed."));
+    if (this.options.callbackScheduling === "after-prefix") {
+      const disposal = this.dispose();
+      if (this.phase.getStore()?.active) {
+        void disposal.catch(() => void 0);
+        return Promise.reject(new SandboxError("reentry"));
+      }
+      return disposal;
+    }
     if (this.phase.getStore()?.active) return this.dispose();
     return Promise.allSettled([
       this.active,
@@ -1235,6 +1549,21 @@ var RealmState = class {
     this.closed = true;
     this.controller.abort(new Error("SafeJS realm is closed."));
     this.options.signal?.removeEventListener("abort", this.abort);
+    if (this.options.callbackScheduling === "after-prefix") {
+      this.disposal = Promise.resolve().then(async () => {
+        while (this.pendingWork.size > 0) await Promise.allSettled([...this.pendingWork]);
+        await this.sourceGraph?.settle();
+        await this.queue.settle();
+        this.releaseReconciliation?.();
+        this.releaseReconciliation = void 0;
+        await this.releaseResources();
+      }).finally(() => this.queue.finish());
+      return this.disposal;
+    }
+    this.disposal = this.releaseResources().finally(() => this.queue.finish());
+    return this.disposal;
+  }
+  async releaseResources() {
     for (const callback of this.callbacks.keys()) revokeGuestCallback(callback, this);
     this.callbacks.clear();
     for (const object of this.hostObjects) revokeHostObject(object, this);
@@ -1246,28 +1575,25 @@ var RealmState = class {
     this.budget.setRetainedValues(this, void 0);
     this.sourceGraph?.close();
     releaseObjectPrototype(this.budget);
-    this.disposal = (async () => {
-      const errors = [];
-      for (const cleanup of this.cleanups.splice(0).reverse()) {
-        try {
-          await cleanup();
-        } catch (error) {
-          errors.push(error);
-        }
+    const errors = [];
+    for (const cleanup of this.cleanups.splice(0).reverse()) {
+      try {
+        await cleanup();
+      } catch (error) {
+        errors.push(error);
       }
-      this.scope = void 0;
-      this.convertedModules.clear();
-      for (const key of Object.keys(this.globals)) delete this.globals[key];
-      for (const key of Object.keys(this.modules)) delete this.modules[key];
-      for (const key of Object.keys(this.builtinBindings))
-        Reflect.deleteProperty(this.builtinBindings, key);
-      this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
-      reconcileCompiledValues(this.budget, [], this.compilation);
-      this.compilation.dispose();
-      this.lease.release();
-      if (errors.length > 0) throw new AggregateError(errors, "Realm cleanup failed.");
-    })().finally(() => this.queue.finish());
-    return this.disposal;
+    }
+    this.scope = void 0;
+    this.convertedModules.clear();
+    for (const key of Object.keys(this.globals)) delete this.globals[key];
+    for (const key of Object.keys(this.modules)) delete this.modules[key];
+    for (const key of Object.keys(this.builtinBindings))
+      Reflect.deleteProperty(this.builtinBindings, key);
+    this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
+    reconcileCompiledValues(this.budget, [], this.compilation);
+    this.compilation.dispose();
+    this.lease.release();
+    if (errors.length > 0) throw new AggregateError(errors, "Realm cleanup failed.");
   }
 };
 function readModules(input) {
@@ -1296,12 +1622,17 @@ function assertNames(actual, expected, label) {
 function createRealm(options = {}) {
   const state = new RealmState(readRealmOptions(options));
   return Object.freeze(attachExecutionControl({
+    stringCompilation: state.options.stringCompilation ?? "allow",
+    classicScriptErrors: state.options.classicScriptErrors ?? "fatal",
+    supportsDiscardResult: true,
+    sourceImportTimeoutMs: state.options.sourceImportTimeoutMs,
     extensions: Object.freeze(state.extensions.map((extension) => extension.manifest)),
     evaluate: state.evaluate,
     startCallback: state.startCallback,
     invokeCallback: state.invokeCallback,
     releaseCallback: state.releaseCallback,
     releaseGuestReference: state.releaseGuestReference,
+    sourceModuleStatus: state.sourceModuleStatus,
     close: state.close
   }, state.queue));
 }
@@ -1311,6 +1642,7 @@ async function runWithExtensions(source, options, jobs) {
       "Live extension runs do not support snapshots or entryPointArgs; use a persistent realm."
     );
   const state = new RealmState(readRealmOptions(options, true), jobs);
+  if (options.sourceLocation !== void 0) state.resources.sourceLocation = options.sourceLocation;
   try {
     const result = await state.perform(() => state.evaluateRaw(source, options.filename, false, options.sourceType));
     if (result.ok && options.sourceType !== "module") encodeReplayData(result.returnValue);
@@ -1352,10 +1684,25 @@ function readRealmOptions(value, oneShot = false) {
     "clock",
     "limits"
   ]);
+  if (!oneShot) supported.add("stringCompilation");
+  if (!oneShot) supported.add("classicScripts");
+  if (!oneShot) supported.add("classicScriptErrors");
+  if (!oneShot) supported.add("callbackScheduling");
+  if (!oneShot) supported.add("sourceImportTimeoutMs");
   for (const [key, entry] of Object.entries(options)) {
-    if (supported.has(key) || oneShot && (key === "filename" || key === "sourceType" || entry === void 0)) continue;
+    if (supported.has(key) || oneShot && (key === "filename" || key === "sourceType" || key === "sourceLocation" || entry === void 0)) continue;
     throw new TypeError(`Unsupported ${oneShot ? "extension-run" : "realm"} option '${key}'.`);
   }
+  if (options.callbackScheduling !== void 0 && options.callbackScheduling !== "after-prefix")
+    throw new TypeError("Realm callbackScheduling must be 'after-prefix'.");
+  if (options.sourceImportTimeoutMs !== void 0 && (!Number.isSafeInteger(options.sourceImportTimeoutMs) || Number(options.sourceImportTimeoutMs) < 1 || Number(options.sourceImportTimeoutMs) > 2147483647))
+    throw new TypeError("Realm sourceImportTimeoutMs must be an integer between 1 and 2147483647.");
+  if (options.stringCompilation !== void 0 && options.stringCompilation !== "allow" && options.stringCompilation !== "deny")
+    throw new TypeError("Realm stringCompilation must be 'allow' or 'deny'.");
+  if (options.classicScriptErrors !== void 0 && options.classicScriptErrors !== "fatal" && options.classicScriptErrors !== "report")
+    throw new TypeError("Realm classicScriptErrors must be 'fatal' or 'report'.");
+  if (options.classicScriptErrors === "report" && options.classicScripts !== true)
+    throw new TypeError("Reporting classic Script errors requires classicScripts:true.");
   return options;
 }
 
@@ -1876,7 +2223,10 @@ function run(source, options = {}) {
     const operation = budget.acquireCompileOwner(true);
     const compilation = new CompileScope(operation.owner);
     try {
-      const restoredSnapshot = options.snapshot === void 0 ? void 0 : restore(options.snapshot, { source }, operation.owner);
+      const restoredSnapshot = options.snapshot === void 0 ? void 0 : restore(options.snapshot, {
+        source,
+        ...options.importSpecifiers ? { importSpecifiers: options.importSpecifiers } : {}
+      }, operation.owner);
       const promiseReplay = new PromiseReplay(restoredSnapshot?.promiseReplay);
       return await promiseReplayContext.run(promiseReplay, async () => {
         const deactivateOtelSink = activateOtelSink(options.otelSink);
@@ -1900,15 +2250,16 @@ function run(source, options = {}) {
           const functionSourceText = executionSemantics === "jobs-v8" || executionSemantics === EXECUTION_SEMANTICS;
           runResources.getStore().functionSourceText = functionSourceText;
           runResources.getStore().hostDataMetadata = executionSemantics === EXECUTION_SEMANTICS;
+          if (options.sourceLocation !== void 0) runResources.getStore().sourceLocation = options.sourceLocation;
           const convertInitialInput = (convert) => executionSemantics === "jobs-v6" ? convert() : promiseReplayContext.exit(convert);
           if (restoredSnapshot !== void 0) {
             leaveSnapshotRun = enterSnapshotRun(options.snapshot ?? restoredSnapshot);
           }
           promiseReplay.attachBudget(budget);
           const filename = options.filename ?? "<input>";
-          const module = parseExecutableModule(source, filename, operation.owner);
+          const module = parseExecutableModule(source, filename, operation.owner, options.importSpecifiers);
           promiseReplay.validateNodes(module);
-          const sourceHash = findRegexLiteral(module) === void 0 ? hashSource(source, operation.owner, functionSourceText) : hashParsedAst(module, functionSourceText);
+          const sourceHash = findRegexLiteral(module) === void 0 && options.importSpecifiers === void 0 ? hashSource(source, operation.owner, functionSourceText) : hashParsedAst(module, functionSourceText);
           const hostCalls = new HostCallJournal(
             sourceHash,
             readHostCallSnapshot(restoredSnapshot),
@@ -2447,4 +2798,4 @@ export {
   UnhandledRejectionError,
   run
 };
-//# sourceMappingURL=chunk-KK5NCR5R.js.map
+//# sourceMappingURL=chunk-EH5A2EQI.js.map