@poe-platform/safe-js 0.1.721 → 0.1.723

package/dist/safe-js/chunks/{chunk-Q7B6JIMI.js → chunk-M6HUSN7X.js}

@@ -1,10 +1,10 @@
 import {
   restore
-} from "./chunk-A4L72WXV.js";
+} from "./chunk-KHJDAEET.js";
 import {
   attachDumpController,
   createDumpController
-} from "./chunk-BEXRQET4.js";
+} from "./chunk-5MT2LF3W.js";
 import {
   getOwnErrorCode,
   hasOwnErrorCode
@@ -12,7 +12,7 @@ import {
 import {
   hashParsedAst,
   hashSource
-} from "./chunk-GMPZBMPA.js";
+} from "./chunk-Y5ZXQHL6.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -36,6 +36,7 @@ import {
   createEvalSource,
   createGuestReference,
   createHostCallbackContext,
+  createImmutableEmptyModuleEnvironment,
   createLiveHostObject,
   createModuleEnvironment,
   createModuleNamespace,
@@ -48,6 +49,7 @@ import {
   decodeReplayData,
   deepCopyFromSandbox,
   deepCopyToSandbox,
+  denyGuestStringCompilation,
   encodeReplayData,
   enterRunningState,
   enterSnapshotRun,
@@ -55,6 +57,7 @@ import {
   getExtensionSetup,
   getRealmGlobalObject,
   guestProxyStates,
+  hostObjectGuestRoot,
   inMemoryRunSnapshots,
   interpret,
   invokeBuiltinClosure,
@@ -97,7 +100,7 @@ import {
   withSandboxPromiseRejectionTracker,
   wrapCallerInjectedBindings,
   wrapCancelableBindings
-} from "./chunk-DNA7BMBY.js";
+} from "./chunk-IZ52PAOD.js";
 import {
   Budget,
   CompileScope,
@@ -112,20 +115,21 @@ import {
   parseSourceModule,
   replaceErrorStack,
   safeAddEvent
-} from "./chunk-ILYJBA2D.js";
+} from "./chunk-RYVHEOHM.js";
 
 // packages/safe-js/src/realm.ts
-import { AsyncLocalStorage } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { types } from "node:util";
 
 // packages/safe-js/src/modules/source-graph.ts
+import { AsyncLocalStorage } from "node:async_hooks";
 var ambiguous = /* @__PURE__ */ Symbol("ambiguous module export");
 var sourceRecords = /* @__PURE__ */ new WeakSet();
 var SourceModuleGraph = class {
   constructor(options) {
     this.options = options;
     this.jobs = options.jobs ?? new SandboxJobQueue();
-    attachSourceLoader(options.modules, this.import.bind(this));
+    attachSourceLoader(options.modules, this.import.bind(this), { preserveImmutableNamespaces: true });
     options.budget?.setRetainedValues(this, () => [...this.records.values()].flatMap((record) => [record.id, record.source, ...record.parsed.requests, ...record.scope.retainedDataRoots()]));
   }
   options;
@@ -133,60 +137,169 @@ var SourceModuleGraph = class {
   records = /* @__PURE__ */ new Map();
   requests = /* @__PURE__ */ new Map();
   requestDataSize = 0;
+  lookupDataSize = 0;
   pendingImports = /* @__PURE__ */ new Set();
+  fulfilledImports = 0;
+  rejectedImports = 0;
+  importGroup = new AsyncLocalStorage();
   jobs;
   evaluationStack = [];
   evaluationIndex = 0;
   close() {
     this.options.budget?.setRetainedValues(this, void 0);
     this.options.budget?.setRetainedDataUsage(this.requests, 0);
+    for (const record of this.records.values()) {
+      record.explicitExports.clear();
+      record.localImports.clear();
+      record.starExports.length = 0;
+    }
+    this.options.budget?.setRetainedDataUsage(this.records, 0);
+    this.lookupDataSize = 0;
     this.requestDataSize = 0;
     this.records.clear();
     this.requests.clear();
   }
+  sourceModuleStatus() {
+    return Object.freeze({
+      pendingImports: this.pendingImports.size,
+      preparedModules: this.records.size,
+      fulfilledImports: this.fulfilledImports,
+      rejectedImports: this.rejectedImports
+    });
+  }
   import(specifier, referrer) {
+    const group = this.importGroup.getStore();
+    const cancelDeadline = this.startImportDeadline();
     const pending = (async () => {
       const entry = await this.load(specifier, referrer);
       if (!isRecord(entry)) return entry;
       await this.loadGraph(entry);
-      await this.link(entry);
+      if (this.options.serializePreparation) await this.jobs.run(() => this.link(entry));
+      else await this.link(entry);
       await this.evaluate(entry);
       await this.jobs.drain();
       return this.namespace(entry);
     })();
     this.pendingImports.add(pending);
-    void pending.then(() => this.pendingImports.delete(pending), () => this.pendingImports.delete(pending));
+    group?.add(pending);
+    const release = () => {
+      cancelDeadline();
+      this.pendingImports.delete(pending);
+      group?.delete(pending);
+    };
+    void pending.then(
+      () => {
+        this.fulfilledImports++;
+        release();
+      },
+      () => {
+        this.rejectedImports++;
+        release();
+      }
+    );
     return pending;
   }
-  async settle() {
+  startImportDeadline() {
+    const policy = this.options.importDeadline;
+    const signal = this.options.signal;
+    if (policy === void 0 || signal?.aborted) return () => {
+    };
+    const deadline = Date.now() + policy.timeoutMs;
+    let expired = false;
+    const expire = (reason) => {
+      if (expired) return;
+      expired = true;
+      cancel();
+      policy.abort(reason);
+    };
+    const releaseDeadline = this.options.budget?.acquireDeadline(deadline, expire);
+    const timer = setTimeout(() => {
+      expire(new SandboxError({
+        budget: "deadline",
+        current: Date.now(),
+        limit: deadline
+      }));
+    }, policy.timeoutMs);
+    const cancel = () => {
+      clearTimeout(timer);
+      releaseDeadline?.();
+      signal?.removeEventListener("abort", cancel);
+    };
+    signal?.addEventListener("abort", cancel, { once: true });
+    return cancel;
+  }
+  withoutImportGroup(task) {
+    return this.importGroup.exit(task);
+  }
+  withImportGroup(task) {
+    const group = /* @__PURE__ */ new Set();
+    return this.importGroup.run(group, async () => {
+      const result = await task();
+      await this.settle(group);
+      return result;
+    });
+  }
+  async settle(pendingImports = this.pendingImports) {
     do {
-      await Promise.allSettled([...this.pendingImports]);
+      await Promise.allSettled([...pendingImports]);
       await this.jobs.drain();
-    } while (this.pendingImports.size > 0);
+    } while (pendingImports.size > 0);
   }
   async evaluateSource(source, beforeEvaluation) {
-    const entry = this.register(source);
+    const entry = this.options.serializePreparation ? await this.jobs.run(() => this.register(source)) : this.register(source);
     await this.loadGraph(entry);
-    await this.link(entry);
+    if (this.options.serializePreparation) await this.jobs.run(() => this.link(entry));
+    else await this.link(entry);
     beforeEvaluation?.(entry.parsed.module);
     await this.evaluate(entry);
     await this.jobs.drain();
     return this.namespace(entry);
   }
   register(source) {
+    this.options.assertActive?.();
+    this.options.signal?.throwIfAborted();
     const known = this.records.get(source.id);
     if (known !== void 0) {
       if (known.source !== source.source) throw new TypeError(`Source identity '${source.id}' changed within the graph.`);
       return known;
     }
     this.options.budget?.chargeDataUsage(source.source.length + source.id.length + 1);
-    const parsed = parseSourceModule(source.source, source.id, this.options.compilation?.owner ?? this.options.compileOwner);
+    const parsed = parseSourceModule(source.source, source.id, this.options.compilation?.owner ?? this.options.compileOwner, { sharedPositions: true, compactAst: true });
+    const explicitExports = /* @__PURE__ */ new Map();
+    const localImports = /* @__PURE__ */ new Map();
+    const starExports = [];
+    for (const entry of parsed.exports) {
+      this.options.budget?.visitNode();
+      if (entry.exported === void 0) {
+        const lookupDataSize = this.lookupDataSize + 1;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        starExports.push(entry);
+      } else if (!explicitExports.has(entry.exported)) {
+        const lookupDataSize = this.lookupDataSize + entry.exported.length + 2;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        explicitExports.set(entry.exported, entry);
+      }
+    }
+    for (const entry of parsed.imports) {
+      this.options.budget?.visitNode();
+      if (!localImports.has(entry.local)) {
+        const lookupDataSize = this.lookupDataSize + entry.local.length + 2;
+        this.options.budget?.setRetainedDataUsage(this.records, lookupDataSize);
+        this.lookupDataSize = lookupDataSize;
+        localImports.set(entry.local, entry);
+      }
+    }
     const importMeta = /* @__PURE__ */ Object.create(null);
     setSandboxPrototype(importMeta, null);
     const record = {
       id: source.id,
       source: source.source,
       parsed,
+      explicitExports,
+      localImports,
+      starExports,
       scope: new Scope({ this: void 0 }, this.options.scope, importMeta, { functionBoundary: true }),
       dependencies: /* @__PURE__ */ new Map()
     };
@@ -212,7 +325,7 @@ var SourceModuleGraph = class {
       if (source === void 0) throw new TypeError(`Source resolver denied '${specifier}' from '${referrer}'.`);
       if (typeof source.id !== "string" || source.id.length === 0 || typeof source.source !== "string")
         throw new TypeError("Source resolver must supply a nonempty identity and source text.");
-      return this.register(source);
+      return this.options.serializePreparation ? this.jobs.run(() => this.register(source)) : this.register(source);
     })();
     this.requests.set(key, request);
     return request;
@@ -322,24 +435,17 @@ var SourceModuleGraph = class {
     const leave = this.options.budget?.enterCall();
     try {
       visited.add(key);
-      const explicit = record.parsed.exports.find((entry) => {
-        this.options.budget?.visitNode();
-        return entry.exported === name;
-      });
+      const explicit = record.explicitExports.get(name);
       if (explicit?.local !== void 0) {
-        const imported = record.parsed.imports.find((entry) => {
-          this.options.budget?.visitNode();
-          return entry.local === explicit.local;
-        });
+        const imported = record.localImports.get(explicit.local);
         if (imported === void 0 || imported.namespace === true) return { record, name: explicit.local };
         return this.resolveDependency(record, imported.request, imported.imported, visited);
       }
       if (explicit?.request !== void 0) return this.resolveDependency(record, explicit.request, explicit.imported, visited, explicit.namespace);
       if (name === "default") return void 0;
       let resolved;
-      for (const entry of record.parsed.exports) {
+      for (const entry of record.starExports) {
         this.options.budget?.visitNode();
-        if (entry.exported !== void 0) continue;
         const candidate = this.resolveDependency(record, entry.request, name, visited);
         if (candidate === ambiguous) return ambiguous;
         if (candidate === void 0) continue;
@@ -466,7 +572,7 @@ var SourceModuleGraph = class {
   async execute(record, modulePhase, onSuspend) {
     const result = await interpret(
       { type: "BlockStatement", body: record.parsed.module.body, span: record.parsed.module.span },
-      { ...this.options, scope: record.scope, useScopeDirectly: true, jobs: this.jobs, nested: true, modulePhase, onSuspend }
+      { ...this.options, scope: record.scope, useScopeDirectly: true, captureSnapshot: false, jobs: this.jobs, nested: true, modulePhase, onSuspend }
     );
     this.stats.nodeVisits += result.stats.nodeVisits;
     if (!result.ok) throw new Error(result.error.message);
@@ -495,6 +601,10 @@ function createReplayableRandom(options = {}) {
 }
 
 // packages/safe-js/src/realm.ts
+var retainedArrayPrototype = Array.prototype;
+var nativeRetainedArrayPrototype = Object.setPrototypeOf;
+var nativeRetainedArrayAppend = Function.prototype.call.bind(Array.prototype.push);
+var freezeSourceReference = Object.freeze;
 var RealmState = class {
   constructor(options, queue = new SandboxJobQueue()) {
     this.options = options;
@@ -622,7 +732,7 @@ var RealmState = class {
   lease;
   compilation;
   controller = new AbortController();
-  phase = new AsyncLocalStorage();
+  phase = new AsyncLocalStorage2();
   queue;
   tracker = createSandboxPromiseRejectionTracker();
   bridge;
@@ -634,6 +744,8 @@ var RealmState = class {
   resources;
   callbacks = /* @__PURE__ */ new Map();
   pendingCallbacks = /* @__PURE__ */ new Set();
+  pendingWork = /* @__PURE__ */ new Set();
+  releaseReconciliation;
   callbackCache = /* @__PURE__ */ new WeakMap();
   hostObjects = /* @__PURE__ */ new Set();
   guestReferences = /* @__PURE__ */ new Map();
@@ -659,11 +771,17 @@ var RealmState = class {
     signal: this.controller.signal,
     realm: this.bridge
   });
-  retainedRoots = () => [
-    ...this.callbacks.values(),
-    ...Array.from(this.pendingCallbacks, (pending) => pending.closure),
-    ...this.guestReferences.values()
-  ];
+  retainedRoots = () => {
+    const roots = nativeRetainedArrayPrototype([], null);
+    for (const object of this.hostObjects) {
+      const root = hostObjectGuestRoot(object);
+      if (root !== void 0) nativeRetainedArrayAppend(roots, root);
+    }
+    for (const closure of this.callbacks.values()) nativeRetainedArrayAppend(roots, closure);
+    for (const pending of this.pendingCallbacks) nativeRetainedArrayAppend(roots, pending.closure);
+    for (const reference of this.guestReferences.values()) nativeRetainedArrayAppend(roots, reference);
+    return nativeRetainedArrayPrototype(roots, retainedArrayPrototype);
+  };
   captureArguments = (operation, args, copy) => {
     const from = this.retainedOperations.get(operation)?.from ?? args.length;
     const values = copy(args.slice(0, from));
@@ -760,6 +878,34 @@ var RealmState = class {
         void this.dispose().catch(() => void 0);
       });
   }
+  trackWork(pending) {
+    this.pendingWork.add(pending);
+    void pending.then(
+      () => {
+        this.pendingWork.delete(pending);
+      },
+      () => {
+        this.pendingWork.delete(pending);
+      }
+    );
+    return pending;
+  }
+  reconcileWhenIdle() {
+    if (this.closed || this.active !== void 0 || this.pendingCallbacks.size > 0) return;
+    this.releaseReconciliation?.();
+    this.releaseReconciliation = void 0;
+    try {
+      reconcileCompiledValues(
+        this.budget,
+        [...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()],
+        this.compilation
+      );
+    } catch (error) {
+      this.poison(error);
+      void this.dispose().catch(() => void 0);
+      throw error;
+    }
+  }
   chargeWork = (units = 1) => {
     this.assertOpen();
     if (!Number.isSafeInteger(units) || units < 0)
@@ -858,6 +1004,7 @@ var RealmState = class {
       owner: this,
       assertActive: this.assertOpen,
       chargeWork: this.chargeWork,
+      chargeGuestData: (units) => this.budget.chargeDataUsage(units),
       checkLength: (length) => this.budget.allocateArrayLength(length),
       checkString: (value) => {
         this.budget.allocateString(value);
@@ -960,12 +1107,19 @@ var RealmState = class {
   };
   invokeCallback = this.executeCallback.bind(this);
   async executeCallback(callback, options = {}, completeSynchronous) {
-    if (this.closed || this.failure !== void 0) await this.dispose();
+    if ((this.closed || this.failure !== void 0) && this.options.callbackScheduling !== "after-prefix")
+      await this.dispose();
     this.assertOpen();
     const closure = readGuestCallback(callback, this);
     this.checkCollection(this.pendingCallbacks.size + 1, this.limits.callbacks, "pending callback");
-    const record = { closure };
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    const record = {
+      closure,
+      prefixComplete: false
+    };
     this.pendingCallbacks.add(record);
+    if (scheduled) this.releaseReconciliation ??= this.budget.deferReconciliation();
+    const rejectionOwner = scheduled ? this.tracker.startOperation() : void 0;
     const invoke = async () => {
       this.assertOpen();
       readGuestCallback(callback, this);
@@ -996,6 +1150,7 @@ var RealmState = class {
         if (isSandboxPromise(value) && value.synchronousPrefix !== void 0)
           await value.synchronousPrefix;
         this.assertOpen();
+        record.prefixComplete = true;
         completeSynchronous?.();
         const settled = await suspendJob(settlement);
         return this.exportValue(settled);
@@ -1005,25 +1160,37 @@ var RealmState = class {
       }
     };
     try {
-      const active = this.active !== void 0;
-      const pending = withSandboxPromiseRejectionTracker(
-        this.tracker,
-        () => runResources.run(
-          this.resources,
-          () => withCancellationSignal(
-            this.controller.signal,
-            () => active && this.phase.getStore()?.active ? runAsyncPrefix(invoke, completeSynchronous === void 0 && this.phase.getStore()?.extension !== void 0) : this.queue.run(invoke)
+      const active = this.active !== void 0 || scheduled && this.phase.getStore()?.active === true;
+      const execute = () => this.tracker.withOperation(
+        rejectionOwner,
+        () => withSandboxPromiseRejectionTracker(
+          this.tracker,
+          () => runResources.run(
+            this.resources,
+            () => withCancellationSignal(
+              this.controller.signal,
+              () => active && this.phase.getStore()?.active ? runAsyncPrefix(invoke, completeSynchronous === void 0 && this.phase.getStore()?.extension !== void 0) : this.queue.run(invoke)
+            )
           )
         )
       );
-      record.promise = active ? pending : this.perform(() => pending);
-      return await record.promise;
+      const pending = scheduled && this.sourceGraph !== void 0 ? this.sourceGraph.withoutImportGroup(execute) : execute();
+      record.promise = scheduled ? this.trackWork(pending) : active ? pending : this.perform(() => pending);
+      const result = await record.promise;
+      if (scheduled) {
+        await this.checkUnhandledRejection(rejectionOwner);
+        this.assertOpen();
+      }
+      return result;
     } catch (error) {
-      if (error instanceof SandboxError) this.poison(error);
+      if (scheduled || error instanceof SandboxError) this.poison(error);
+      if (scheduled) void this.dispose().catch(() => void 0);
       throw error;
     } finally {
+      this.tracker.finishOperation(rejectionOwner);
       this.pendingCallbacks.delete(record);
-      if (!this.closed && this.active === void 0)
+      if (scheduled) this.reconcileWhenIdle();
+      else if (!this.closed && this.active === void 0)
         reconcileCompiledValues(
           this.budget,
           [...this.scope?.retainedDataRoots() ?? [], ...this.retainedRoots()],
@@ -1138,37 +1305,83 @@ var RealmState = class {
     );
     if (this.options.classicScripts)
       this.scope.declare("this", "const", getRealmGlobalObject(this.budget));
+    if (this.options.stringCompilation === "deny") denyGuestStringCompilation(this.scope);
+  }
+  sourceModuleStatus = () => {
+    this.assertOpen();
+    return this.sourceGraph?.sourceModuleStatus() ?? Object.freeze({
+      pendingImports: 0,
+      preparedModules: 0,
+      fulfilledImports: 0,
+      rejectedImports: 0
+    });
+  };
+  ensureSourceGraph() {
+    this.assertOpen();
+    this.initialize();
+    if (this.sourceGraph !== void 0) return this.sourceGraph;
+    const moduleOptions = { ...this.bridgeOptions(), wrappedModules: this.convertedModules };
+    const modules = Object.keys(this.modules).length === 0 && this.convertedModules.size === 0 ? createImmutableEmptyModuleEnvironment(moduleOptions) : createModuleEnvironment(this.modules, moduleOptions);
+    return this.sourceGraph ??= new SourceModuleGraph({
+      resolver: this.options.sourceResolver ?? (() => void 0),
+      scope: this.scope,
+      modules,
+      budget: this.budget,
+      compilation: this.compilation,
+      signal: this.controller.signal,
+      jobs: this.queue,
+      assertActive: this.assertOpen,
+      surfaceUnhandledThrows: true,
+      serializePreparation: this.options.callbackScheduling === "after-prefix",
+      ...this.options.sourceImportTimeoutMs === void 0 ? {} : {
+        importDeadline: {
+          timeoutMs: this.options.sourceImportTimeoutMs,
+          abort: (reason) => {
+            this.poison(reason);
+            void this.close().catch(() => void 0);
+          }
+        }
+      }
+    });
   }
-  async evaluateRaw(source, filename = "<realm>", nested = false, sourceType) {
+  async evaluateRaw(source, filename = "<realm>", nested = false, sourceType, reportUnhandledThrows = false) {
     this.assertOpen();
     if (typeof source !== "string") throw new TypeError("Realm source must be a string.");
     if (sourceType === "module") {
-      this.initialize();
-      this.sourceGraph ??= new SourceModuleGraph({
-        resolver: this.options.sourceResolver ?? (() => void 0),
-        scope: this.scope,
-        modules: createModuleEnvironment(this.modules, { ...this.bridgeOptions(), wrappedModules: this.convertedModules }),
-        budget: this.budget,
-        compilation: this.compilation,
-        signal: this.controller.signal,
-        jobs: this.queue,
-        assertActive: this.assertOpen,
-        surfaceUnhandledThrows: true
-      });
-      const before = this.sourceGraph.stats.nodeVisits;
-      const namespace = await this.sourceGraph.evaluateSource({ id: filename, source }, (module) => {
-        this.sourceModuleHash = hashParsedAst(module);
-      });
-      await this.sourceGraph.settle();
-      return { ok: true, returnValue: namespace, snapshot: { bindings: {} }, stats: { nodeVisits: this.sourceGraph.stats.nodeVisits - before, currentDataSize: this.budget.currentDataSize, peakDataSize: this.budget.peakDataSize } };
+      const prepare = () => {
+        this.ensureSourceGraph();
+      };
+      const scheduled = this.options.callbackScheduling === "after-prefix";
+      if (scheduled) await this.queue.run(prepare);
+      else prepare();
+      const graph = this.sourceGraph;
+      const before = graph.stats.nodeVisits;
+      const evaluate = async () => {
+        const namespace2 = await graph.evaluateSource({ id: filename, source }, (module) => {
+          this.sourceModuleHash = hashParsedAst(module);
+        });
+        if (!scheduled) await graph.settle();
+        return namespace2;
+      };
+      const namespace = scheduled ? await graph.withImportGroup(evaluate) : await evaluate();
+      return { ok: true, returnValue: namespace, snapshot: { bindings: {} }, stats: { nodeVisits: graph.stats.nodeVisits - before, currentDataSize: this.budget.currentDataSize, peakDataSize: this.budget.peakDataSize } };
     }
-    const script = this.options.classicScripts ? createEvalSource(source, {}, this.lease.owner, filename) : void 0;
-    const releaseSource = script ? retainValues(this.budget, () => [script.source]) : void 0;
+    const script = this.options.classicScripts ? createEvalSource(source, {}, this.lease.owner, filename, { compactAst: true }) : void 0;
+    const sourceReference = script && this.options.sourceResolver !== void 0 ? freezeSourceReference({ referrer: filename }) : void 0;
+    const releaseSource = script ? retainValues(this.budget, () => [script.source, sourceReference]) : void 0;
     try {
       if (script) this.budget.chargeDataUsage(measureSandboxData([script.source]));
+      if (sourceReference) this.budget.chargeDataUsage(measureSandboxData([sourceReference]));
       const module = script?.node ?? parseExecutableModule(source, filename, this.lease.owner);
       this.initialize();
-      const moduleEnvironment = createModuleEnvironment(this.modules, { ...this.bridgeOptions(), wrappedModules: this.convertedModules });
+      const moduleOptions = { ...this.bridgeOptions(), wrappedModules: this.convertedModules };
+      const moduleEnvironment = script && Object.keys(this.modules).length === 0 && this.convertedModules.size === 0 ? createImmutableEmptyModuleEnvironment(moduleOptions) : createModuleEnvironment(this.modules, moduleOptions);
+      if (sourceReference)
+        attachSourceLoader(
+          moduleEnvironment,
+          (specifier, referrer) => this.ensureSourceGraph().import(specifier, referrer),
+          { preserveImmutableNamespaces: true }
+        );
       const imports = script ? {} : resolveModuleImports(module, this.modules, {
         environment: moduleEnvironment,
         ...this.bridgeOptions(),
@@ -1188,12 +1401,14 @@ var RealmState = class {
         },
         {
           ...script ? { script: { strict: script.strict } } : {},
+          sourceReference,
           scope: this.scope,
           useScopeDirectly: true,
           budget: this.budget,
           compilation: this.compilation,
           signal: this.controller.signal,
           surfaceUnhandledThrows: true,
+          reportUnhandledThrows: script !== void 0 && reportUnhandledThrows,
           jobs: this.queue,
           nested,
           assertActive: this.assertOpen
@@ -1208,7 +1423,7 @@ var RealmState = class {
   evaluateNested = async (source, extension) => {
     this.assertOpen();
     const phase = this.phase.getStore();
-    if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0)
+    if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0 && !(this.options.callbackScheduling === "after-prefix" && this.pendingCallbacks.size > 0))
       throw new SandboxError("reentry");
     const leave = this.budget.enterCall();
     phase.evaluating = true;
@@ -1231,39 +1446,65 @@ var RealmState = class {
     }
   };
   evaluate = async (source, options = {}) => this.perform(async () => {
-    const result = await this.evaluateRaw(source, options.filename, false, options.sourceType);
+    const discard = Object.getOwnPropertyDescriptor(options, "discardResult");
+    if (discard && (!("value" in discard) || discard.value !== void 0 && typeof discard.value !== "boolean"))
+      throw new TypeError("Realm evaluation discardResult must be an own-data boolean.");
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    const reportUnhandledThrows = options.sourceType !== "module" && this.options.classicScriptErrors === "report";
+    const result = scheduled && options.sourceType !== "module" ? await this.queue.run(() => this.evaluateRaw(source, options.filename, true, void 0, reportUnhandledThrows)) : await this.evaluateRaw(source, options.filename, false, options.sourceType, reportUnhandledThrows);
     if (!result.ok) {
-      await this.dispose();
-      return { ok: false, error: result.error, stats: result.stats };
+      const recoverable = reportUnhandledThrows && result.error.code === "UNCAUGHT_EXCEPTION";
+      if (!scheduled && !recoverable) await this.dispose();
+      return { ok: false, error: result.error, stats: result.stats, ...recoverable ? { recoverable: true } : {} };
     }
-    return { ok: true, returnValue: this.exportValue(result.returnValue), stats: result.stats };
-  });
-  async perform(task) {
-    if (this.closed || this.failure !== void 0) await this.dispose();
+    return { ok: true, ...discard?.value === true ? {} : { returnValue: this.exportValue(result.returnValue) }, stats: result.stats };
+  }, (result) => !result.ok && !result.recoverable);
+  async checkUnhandledRejection(owner) {
+    const unhandled = await this.tracker.findUnhandledRejection(owner);
+    if (unhandled !== void 0) {
+      const error = new Error(
+        `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
+      );
+      error.name = "UnhandledRejectionError";
+      throw error;
+    }
+  }
+  async perform(task, failed) {
+    if ((this.closed || this.failure !== void 0) && this.options.callbackScheduling !== "after-prefix")
+      await this.dispose();
     this.assertOpen();
     if (this.active !== void 0) throw new SandboxError("reentry");
+    const scheduled = this.options.callbackScheduling === "after-prefix";
+    if (scheduled && (this.phase.getStore()?.active || [...this.pendingCallbacks].some((record) => !record.prefixComplete)))
+      throw new SandboxError("reentry");
+    const rejectionOwner = scheduled ? this.tracker.startOperation() : void 0;
     const pending = Promise.resolve().then(
-      () => withSandboxPromiseRejectionTracker(
-        this.tracker,
-        () => runResources.run(
-          this.resources,
-          () => withCancellationSignal(this.controller.signal, task)
+      () => this.tracker.withOperation(
+        rejectionOwner,
+        () => withSandboxPromiseRejectionTracker(
+          this.tracker,
+          () => runResources.run(
+            this.resources,
+            () => withCancellationSignal(this.controller.signal, task)
+          )
         )
       )
     );
     this.active = pending;
+    if (scheduled) this.trackWork(pending);
     try {
       const result = await pending;
-      await this.queue.drain();
-      const unhandled = await this.tracker.findUnhandledRejection();
-      if (unhandled !== void 0) {
-        const error = new Error(
-          `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
-        );
-        error.name = "UnhandledRejectionError";
-        throw error;
+      if (scheduled && failed?.(result)) {
+        this.closed = true;
+        this.controller.abort(new Error("SafeJS source evaluation failed."));
+        await this.dispose();
+        return result;
       }
+      if (scheduled) this.assertOpen();
+      await this.queue.drain();
+      await this.checkUnhandledRejection(rejectionOwner);
       if (this.failure !== void 0) throw this.failure.reason;
+      if (scheduled) this.assertOpen();
       if (!this.closed)
         reconcileCompiledValues(
           this.budget,
@@ -1281,12 +1522,22 @@ var RealmState = class {
       }
       throw reason;
     } finally {
-      this.active = void 0;
+      this.tracker.finishOperation(rejectionOwner);
+      if (this.active === pending) this.active = void 0;
+      if (scheduled) this.reconcileWhenIdle();
     }
   }
   close = () => {
     this.closed = true;
     this.controller.abort(new Error("SafeJS realm is closed."));
+    if (this.options.callbackScheduling === "after-prefix") {
+      const disposal = this.dispose();
+      if (this.phase.getStore()?.active) {
+        void disposal.catch(() => void 0);
+        return Promise.reject(new SandboxError("reentry"));
+      }
+      return disposal;
+    }
     if (this.phase.getStore()?.active) return this.dispose();
     return Promise.allSettled([
       this.active,
@@ -1298,6 +1549,21 @@ var RealmState = class {
     this.closed = true;
     this.controller.abort(new Error("SafeJS realm is closed."));
     this.options.signal?.removeEventListener("abort", this.abort);
+    if (this.options.callbackScheduling === "after-prefix") {
+      this.disposal = Promise.resolve().then(async () => {
+        while (this.pendingWork.size > 0) await Promise.allSettled([...this.pendingWork]);
+        await this.sourceGraph?.settle();
+        await this.queue.settle();
+        this.releaseReconciliation?.();
+        this.releaseReconciliation = void 0;
+        await this.releaseResources();
+      }).finally(() => this.queue.finish());
+      return this.disposal;
+    }
+    this.disposal = this.releaseResources().finally(() => this.queue.finish());
+    return this.disposal;
+  }
+  async releaseResources() {
     for (const callback of this.callbacks.keys()) revokeGuestCallback(callback, this);
     this.callbacks.clear();
     for (const object of this.hostObjects) revokeHostObject(object, this);
@@ -1309,28 +1575,25 @@ var RealmState = class {
     this.budget.setRetainedValues(this, void 0);
     this.sourceGraph?.close();
     releaseObjectPrototype(this.budget);
-    this.disposal = (async () => {
-      const errors = [];
-      for (const cleanup of this.cleanups.splice(0).reverse()) {
-        try {
-          await cleanup();
-        } catch (error) {
-          errors.push(error);
-        }
+    const errors = [];
+    for (const cleanup of this.cleanups.splice(0).reverse()) {
+      try {
+        await cleanup();
+      } catch (error) {
+        errors.push(error);
       }
-      this.scope = void 0;
-      this.convertedModules.clear();
-      for (const key of Object.keys(this.globals)) delete this.globals[key];
-      for (const key of Object.keys(this.modules)) delete this.modules[key];
-      for (const key of Object.keys(this.builtinBindings))
-        Reflect.deleteProperty(this.builtinBindings, key);
-      this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
-      reconcileCompiledValues(this.budget, [], this.compilation);
-      this.compilation.dispose();
-      this.lease.release();
-      if (errors.length > 0) throw new AggregateError(errors, "Realm cleanup failed.");
-    })().finally(() => this.queue.finish());
-    return this.disposal;
+    }
+    this.scope = void 0;
+    this.convertedModules.clear();
+    for (const key of Object.keys(this.globals)) delete this.globals[key];
+    for (const key of Object.keys(this.modules)) delete this.modules[key];
+    for (const key of Object.keys(this.builtinBindings))
+      Reflect.deleteProperty(this.builtinBindings, key);
+    this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
+    reconcileCompiledValues(this.budget, [], this.compilation);
+    this.compilation.dispose();
+    this.lease.release();
+    if (errors.length > 0) throw new AggregateError(errors, "Realm cleanup failed.");
   }
 };
 function readModules(input) {
@@ -1359,12 +1622,17 @@ function assertNames(actual, expected, label) {
 function createRealm(options = {}) {
   const state = new RealmState(readRealmOptions(options));
   return Object.freeze(attachExecutionControl({
+    stringCompilation: state.options.stringCompilation ?? "allow",
+    classicScriptErrors: state.options.classicScriptErrors ?? "fatal",
+    supportsDiscardResult: true,
+    sourceImportTimeoutMs: state.options.sourceImportTimeoutMs,
     extensions: Object.freeze(state.extensions.map((extension) => extension.manifest)),
     evaluate: state.evaluate,
     startCallback: state.startCallback,
     invokeCallback: state.invokeCallback,
     releaseCallback: state.releaseCallback,
     releaseGuestReference: state.releaseGuestReference,
+    sourceModuleStatus: state.sourceModuleStatus,
     close: state.close
   }, state.queue));
 }
@@ -1374,6 +1642,7 @@ async function runWithExtensions(source, options, jobs) {
       "Live extension runs do not support snapshots or entryPointArgs; use a persistent realm."
     );
   const state = new RealmState(readRealmOptions(options, true), jobs);
+  if (options.sourceLocation !== void 0) state.resources.sourceLocation = options.sourceLocation;
   try {
     const result = await state.perform(() => state.evaluateRaw(source, options.filename, false, options.sourceType));
     if (result.ok && options.sourceType !== "module") encodeReplayData(result.returnValue);
@@ -1415,11 +1684,25 @@ function readRealmOptions(value, oneShot = false) {
     "clock",
     "limits"
   ]);
+  if (!oneShot) supported.add("stringCompilation");
   if (!oneShot) supported.add("classicScripts");
+  if (!oneShot) supported.add("classicScriptErrors");
+  if (!oneShot) supported.add("callbackScheduling");
+  if (!oneShot) supported.add("sourceImportTimeoutMs");
   for (const [key, entry] of Object.entries(options)) {
-    if (supported.has(key) || oneShot && (key === "filename" || key === "sourceType" || entry === void 0)) continue;
+    if (supported.has(key) || oneShot && (key === "filename" || key === "sourceType" || key === "sourceLocation" || entry === void 0)) continue;
     throw new TypeError(`Unsupported ${oneShot ? "extension-run" : "realm"} option '${key}'.`);
   }
+  if (options.callbackScheduling !== void 0 && options.callbackScheduling !== "after-prefix")
+    throw new TypeError("Realm callbackScheduling must be 'after-prefix'.");
+  if (options.sourceImportTimeoutMs !== void 0 && (!Number.isSafeInteger(options.sourceImportTimeoutMs) || Number(options.sourceImportTimeoutMs) < 1 || Number(options.sourceImportTimeoutMs) > 2147483647))
+    throw new TypeError("Realm sourceImportTimeoutMs must be an integer between 1 and 2147483647.");
+  if (options.stringCompilation !== void 0 && options.stringCompilation !== "allow" && options.stringCompilation !== "deny")
+    throw new TypeError("Realm stringCompilation must be 'allow' or 'deny'.");
+  if (options.classicScriptErrors !== void 0 && options.classicScriptErrors !== "fatal" && options.classicScriptErrors !== "report")
+    throw new TypeError("Realm classicScriptErrors must be 'fatal' or 'report'.");
+  if (options.classicScriptErrors === "report" && options.classicScripts !== true)
+    throw new TypeError("Reporting classic Script errors requires classicScripts:true.");
   return options;
 }
 
@@ -1940,7 +2223,10 @@ function run(source, options = {}) {
     const operation = budget.acquireCompileOwner(true);
     const compilation = new CompileScope(operation.owner);
     try {
-      const restoredSnapshot = options.snapshot === void 0 ? void 0 : restore(options.snapshot, { source }, operation.owner);
+      const restoredSnapshot = options.snapshot === void 0 ? void 0 : restore(options.snapshot, {
+        source,
+        ...options.importSpecifiers ? { importSpecifiers: options.importSpecifiers } : {}
+      }, operation.owner);
       const promiseReplay = new PromiseReplay(restoredSnapshot?.promiseReplay);
       return await promiseReplayContext.run(promiseReplay, async () => {
         const deactivateOtelSink = activateOtelSink(options.otelSink);
@@ -1964,15 +2250,16 @@ function run(source, options = {}) {
           const functionSourceText = executionSemantics === "jobs-v8" || executionSemantics === EXECUTION_SEMANTICS;
           runResources.getStore().functionSourceText = functionSourceText;
           runResources.getStore().hostDataMetadata = executionSemantics === EXECUTION_SEMANTICS;
+          if (options.sourceLocation !== void 0) runResources.getStore().sourceLocation = options.sourceLocation;
           const convertInitialInput = (convert) => executionSemantics === "jobs-v6" ? convert() : promiseReplayContext.exit(convert);
           if (restoredSnapshot !== void 0) {
             leaveSnapshotRun = enterSnapshotRun(options.snapshot ?? restoredSnapshot);
           }
           promiseReplay.attachBudget(budget);
           const filename = options.filename ?? "<input>";
-          const module = parseExecutableModule(source, filename, operation.owner);
+          const module = parseExecutableModule(source, filename, operation.owner, options.importSpecifiers);
           promiseReplay.validateNodes(module);
-          const sourceHash = findRegexLiteral(module) === void 0 ? hashSource(source, operation.owner, functionSourceText) : hashParsedAst(module, functionSourceText);
+          const sourceHash = findRegexLiteral(module) === void 0 && options.importSpecifiers === void 0 ? hashSource(source, operation.owner, functionSourceText) : hashParsedAst(module, functionSourceText);
           const hostCalls = new HostCallJournal(
             sourceHash,
             readHostCallSnapshot(restoredSnapshot),
@@ -2511,4 +2798,4 @@ export {
   UnhandledRejectionError,
   run
 };
-//# sourceMappingURL=chunk-Q7B6JIMI.js.map
+//# sourceMappingURL=chunk-M6HUSN7X.js.map