@poe-platform/safe-js 0.1.725 → 0.1.727

package/README.md

@@ -53,6 +53,18 @@ console.log(result.returnValue);
 
 Scripts have no ambient `process`, `require`, `fetch`, or filesystem access. Host functions still execute with the host's privileges. Register only the capabilities the script needs; this is not OS or process isolation.
 
+`new Promise(executor)` is supported, as are the Promise static helpers and
+`then`, `catch`, and `finally`. The executor runs synchronously with `resolve`
+and `reject`; its return value is ignored, thrown errors reject the promise,
+and the first resolve or reject call wins. Resolving adopts promises and
+thenables; resolving a promise with itself rejects with a `TypeError`.
+Executor work uses the interpreter's existing budgets, and budget exhaustion
+remains fatal even after settlement. For example,
+`await run("return await new Promise(resolve => resolve(42));")` returns a
+successful result with `returnValue: 42`. Browser event and timer adapters
+require the host to grant those capabilities; Promise construction does not
+provide ambient browser APIs.
+
 ```js
 const result = await run(`
   function Counter(value) { this.value = value; }

package/dist/safe-js/chunks/{chunk-ECTNNLWN.js → chunk-4QDOJTAL.js}

@@ -7,7 +7,7 @@ import {
   validateMigrationReconciliation,
   validateMigrationSemantics,
   validateSnapshotMigration
-} from "./chunk-Y7LSEUWV.js";
+} from "./chunk-EBNKJYZV.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -17,10 +17,10 @@ import {
   serializeSafeJSSnapshot,
   validateDumpEnvelope,
   validateSnapshotData
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   parseModule
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/migration-file.ts
 import { randomUUID } from "node:crypto";
@@ -179,4 +179,4 @@ export {
   migrateSnapshot,
   migrateSnapshotFile
 };
-//# sourceMappingURL=chunk-ECTNNLWN.js.map
+//# sourceMappingURL=chunk-4QDOJTAL.js.map

package/dist/safe-js/chunks/{chunk-Y7LSEUWV.js → chunk-EBNKJYZV.js}

@@ -2,14 +2,14 @@ import {
   HostCallJournal,
   decodeReplayData,
   validateSnapshotData
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   CompileScope,
   SandboxError,
   functionSources,
   parse,
   parseModule
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/parse/hash.ts
 var FNV_OFFSET_BASIS = 2166136261;
@@ -219,4 +219,4 @@ export {
   validateMigrationReconciliation,
   validateSnapshotMigration
 };
-//# sourceMappingURL=chunk-Y7LSEUWV.js.map
+//# sourceMappingURL=chunk-EBNKJYZV.js.map

package/dist/safe-js/chunks/{chunk-HG5QP5UC.js → chunk-EG3QWREA.js}

@@ -8,7 +8,7 @@ import {
   numericTypedArrayConstructors,
   parseModule,
   tokenize
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/lint/rules/AS001.ts
 function AS001(source, options = {}) {
@@ -11177,4 +11177,4 @@ function hasOnlyRegexLiteralDiagnostics(diagnostics) {
 export {
   lint
 };
-//# sourceMappingURL=chunk-HG5QP5UC.js.map
+//# sourceMappingURL=chunk-EG3QWREA.js.map

package/dist/safe-js/chunks/{chunk-V2ESZF34.js → chunk-EZEB4AIH.js}

@@ -2,7 +2,7 @@ import {
   hashParsedAst,
   hashSource,
   validateSnapshotMigration
-} from "./chunk-Y7LSEUWV.js";
+} from "./chunk-EBNKJYZV.js";
 import {
   SnapshotValidationError,
   assertSnapshotInactive,
@@ -15,13 +15,13 @@ import {
   validateGuestFunctionAst,
   validateRuntimeSnapshotDescriptors,
   validateTemplateObjects
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   ParseError,
   parseExecutableModule,
   parseModule,
   replaceErrorStack
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/restore.ts
 var SnapshotMismatchError = class extends Error {
@@ -111,4 +111,4 @@ export {
   SnapshotMismatchError,
   restore
 };
-//# sourceMappingURL=chunk-V2ESZF34.js.map
+//# sourceMappingURL=chunk-EZEB4AIH.js.map

package/dist/safe-js/chunks/{chunk-K6F5QLZQ.js → chunk-GZT57PW4.js}

@@ -6,10 +6,10 @@ import {
 import {
   declareHostOperation,
   runResources
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   hostErrorData
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/modules/mcp.ts
 var DEFAULT_TOOL_BATCH_CONCURRENCY = 4;
@@ -402,4 +402,4 @@ function isPlainObjectRecord(value) {
 export {
   makeMcpModule
 };
-//# sourceMappingURL=chunk-K6F5QLZQ.js.map
+//# sourceMappingURL=chunk-GZT57PW4.js.map

package/dist/safe-js/chunks/{chunk-6YSHQ5ET.js → chunk-IZX26NC7.js}

@@ -5,7 +5,7 @@ import {
   accessDeniedSystemError,
   declareBudgetedHostOperation,
   declareHostOperation
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 
 // packages/safe-js/src/modules/fs.ts
 import { constants as nodeFsConstants } from "node:fs";
@@ -721,4 +721,4 @@ export {
   FS_OPTION_SURFACE,
   makeFsModule
 };
-//# sourceMappingURL=chunk-6YSHQ5ET.js.map
+//# sourceMappingURL=chunk-IZX26NC7.js.map

package/dist/safe-js/chunks/{chunk-6OE64YMG.js → chunk-MFCEBCGV.js}

@@ -14,7 +14,7 @@ import {
   safeRecordException,
   safeStartSpan,
   splitSourceLines
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/error/format.ts
 var DEFAULT_MAX_MESSAGE_LENGTH = 1e4;
@@ -2841,4 +2841,4 @@ export {
   makeLogModule,
   makeMetricModule
 };
-//# sourceMappingURL=chunk-6OE64YMG.js.map
+//# sourceMappingURL=chunk-MFCEBCGV.js.map

package/dist/safe-js/chunks/{chunk-PKRGP34X.js → chunk-RXESEKV6.js}

@@ -1,10 +1,10 @@
 import {
   restore
-} from "./chunk-V2ESZF34.js";
+} from "./chunk-EZEB4AIH.js";
 import {
   attachDumpController,
   createDumpController
-} from "./chunk-FYSWUSHN.js";
+} from "./chunk-VW2VLHK2.js";
 import {
   getOwnErrorCode,
   hasOwnErrorCode
@@ -12,7 +12,7 @@ import {
 import {
   hashParsedAst,
   hashSource
-} from "./chunk-Y7LSEUWV.js";
+} from "./chunk-EBNKJYZV.js";
 import {
   DUMP_FORMAT_VERSION,
   EXECUTION_SEMANTICS,
@@ -100,7 +100,7 @@ import {
   withSandboxPromiseRejectionTracker,
   wrapCallerInjectedBindings,
   wrapCancelableBindings
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   Budget,
   CompileScope,
@@ -115,7 +115,7 @@ import {
   parseSourceModule,
   replaceErrorStack,
   safeAddEvent
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -2825,4 +2825,4 @@ export {
   UnhandledRejectionError,
   run
 };
-//# sourceMappingURL=chunk-PKRGP34X.js.map
+//# sourceMappingURL=chunk-RXESEKV6.js.map

package/dist/safe-js/chunks/{chunk-O2CPPE6M.js → chunk-TFLQJ5NE.js}

@@ -1,6 +1,6 @@
 import {
   deepCopyToSandbox
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 
 // packages/safe-js/src/modules/harness.ts
 function makeHarnessModule(frontmatter, meta) {
@@ -52,4 +52,4 @@ ${prompt}`;
 export {
   makeHarnessModule
 };
-//# sourceMappingURL=chunk-O2CPPE6M.js.map
+//# sourceMappingURL=chunk-TFLQJ5NE.js.map

package/dist/safe-js/chunks/{chunk-FYSWUSHN.js → chunk-VW2VLHK2.js}

@@ -1,10 +1,10 @@
 import {
   SnapshotNotReadyError,
   serializeSafeJSSnapshot
-} from "./chunk-QU2F65UQ.js";
+} from "./chunk-ZSIY6K54.js";
 import {
   SandboxError
-} from "./chunk-KOO6YGQG.js";
+} from "./chunk-Y5EZYHU6.js";
 
 // packages/safe-js/src/snapshot/dump.ts
 var RUN_DUMP_CONTROLLER = /* @__PURE__ */ Symbol("SafeJS.run-dump-controller");
@@ -195,4 +195,4 @@ export {
   dumpCurrent,
   serializeRunSnapshot
 };
-//# sourceMappingURL=chunk-FYSWUSHN.js.map
+//# sourceMappingURL=chunk-VW2VLHK2.js.map

package/dist/safe-js/chunks/{chunk-KOO6YGQG.js → chunk-Y5EZYHU6.js}

@@ -362,6 +362,15 @@ var Budget = class _Budget {
       });
     }
   }
+  reserveString(length) {
+    if (!Number.isSafeInteger(length) || length < 0) {
+      throw new RangeError("string length must be a nonnegative safe integer");
+    }
+    if (this.accounting.allChecksSuspended === 0 && this.accounting.limits.stringLength !== void 0 && length > this.accounting.limits.stringLength) {
+      throw new SandboxError({ budget: "stringLength", current: length, limit: this.accounting.limits.stringLength });
+    }
+    return this.provisionDataUsage(length);
+  }
   allocateArrayLength(length) {
     if (this.accounting.allChecksSuspended === 0 && this.accounting.limits.arrayLength !== void 0 && length > this.accounting.limits.arrayLength) {
       throw new SandboxError({
@@ -2009,8 +2018,30 @@ var stride = 3;
 var legacyEscape = 256;
 var tokenCacheSize = 256;
 var CompactTokens = class {
-  constructor(sourcePositions) {
+  constructor(sourcePositions, lazyPositions = false) {
     this.sourcePositions = sourcePositions;
+    if (!lazyPositions) return;
+    class ParserToken {
+      constructor(type, value, start, end) {
+        this.type = type;
+        this.value = value;
+        this.#start = start;
+        this.#end = end;
+      }
+      type;
+      value;
+      #start;
+      #end;
+      get start() {
+        if (typeof this.#start === "number") this.#start = sourcePositions.position(this.#start);
+        return this.#start;
+      }
+      get end() {
+        if (typeof this.#end === "number") this.#end = sourcePositions.position(this.#end);
+        return this.#end;
+      }
+    }
+    this.parserToken = (type, value, start, end) => new ParserToken(type, value, start, end);
   }
   sourcePositions;
   rows = new Uint32Array(1024 * stride);
@@ -2018,6 +2049,7 @@ var CompactTokens = class {
   templates = /* @__PURE__ */ new Map();
   tokens = /* @__PURE__ */ new Map();
   last;
+  parserToken;
   // Only indexing, iteration, length, push and at are used by the lexer/parser.
   // Historical tokens are materialized on demand in a bounded cache.
   indexed = new Proxy([], {
@@ -2065,7 +2097,12 @@ var CompactTokens = class {
     if (cached !== void 0) return cached;
     const base = index * stride;
     const bits = this.rows[base + 2];
-    const token = {
+    const token = this.parserToken?.(
+      types[bits & 255],
+      this.values[index],
+      this.rows[base],
+      this.rows[base + 1]
+    ) ?? {
       type: types[bits & 255],
       value: this.values[index],
       start: this.sourcePositions.position(this.rows[base]),
@@ -2194,8 +2231,8 @@ function tokenize(source, options = {}) {
   const lexer = new Lexer(source, options);
   return lexer.tokenize();
 }
-function tokenizeCompact(source, options, positions) {
-  const tokens = new CompactTokens(positions);
+function tokenizeCompact(source, options, positions, lazyPositions = false) {
+  const tokens = new CompactTokens(positions, lazyPositions);
   new Lexer(source, { ...options, sharedPositions: true }, tokens.indexed).tokenize();
   return tokens.finish();
 }
@@ -4233,7 +4270,7 @@ function parseSourceModule(source, filename = "<input>", owner, options = {}) {
       throw new SandboxError({ budget: "stringLength", current: source.length, limit });
     owner?.budget.visitNode(source.length);
     const tokenOptions = { allowRegexLiterals: true, statementList: true, compilation, sharedPositions: options.sharedPositions };
-    const tokens = options.compactAst ? tokenizeCompact(source, tokenOptions, new CompactSourcePositions(source)) : tokenize(source, tokenOptions);
+    const tokens = options.compactAst ? tokenizeCompact(source, tokenOptions, new CompactSourcePositions(source), true) : tokenize(source, tokenOptions);
     parser = new Parser(
       tokens,
       source,
@@ -4323,7 +4360,7 @@ function parseEvalScript(source, context = {}, owner, filename = "<eval>", optio
       allowHtmlComments: true,
       compilation
     };
-    const tokens = options.compactAst ? tokenizeCompact(source, tokenOptions, new CompactSourcePositions(source)) : tokenize(source, tokenOptions);
+    const tokens = options.compactAst ? tokenizeCompact(source, tokenOptions, new CompactSourcePositions(source), true) : tokenize(source, tokenOptions);
     const parser = new Parser(tokens, source, compilation, "normal", {
       grammar,
       newTarget: context.newTarget === true,
@@ -5012,30 +5049,50 @@ var Parser = class {
     return { type: "BlockStatement", body: [statement], span: statement.span };
   }
   parseIfStatement() {
-    if (this.ifStatementDepth >= MAX_IF_STATEMENT_DEPTH) {
-      const token = this.currentToken();
-      throw new Error(
-        `If statement nesting limit exceeded at line ${token.start.line}, column ${token.start.column}.`
-      );
-    }
-    this.ifStatementDepth += 1;
+    const pending = [];
+    let entered = 0;
     try {
-      const ifToken = this.expectKeyword("if");
-      this.expectPunctuator("(");
-      const test = this.parseExpression({ allowSequence: true }).node;
-      this.expectPunctuator(")");
-      const consequent = this.parseIfClause();
-      const elseToken = this.consumeKeyword("else");
-      const alternate = elseToken === void 0 ? void 0 : this.parseIfClause();
-      return {
-        type: "IfStatement",
-        test,
-        consequent,
-        alternate,
-        span: createSpan2(ifToken.start, alternate?.span.end ?? consequent.span.end)
-      };
+      for (; ; ) {
+        if (this.ifStatementDepth >= MAX_IF_STATEMENT_DEPTH) {
+          const token2 = this.currentToken();
+          throw new Error(
+            `If statement nesting limit exceeded at line ${token2.start.line}, column ${token2.start.column}.`
+          );
+        }
+        this.ifStatementDepth++;
+        entered++;
+        const token = this.expectKeyword("if");
+        this.expectPunctuator("(");
+        const test = this.parseExpression({ allowSequence: true }).node;
+        this.expectPunctuator(")");
+        const consequent = this.parseIfClause();
+        const hasElse = this.consumeKeyword("else") !== void 0;
+        if (hasElse && this.currentToken().type === "keyword" && this.currentToken().value === "if") {
+          pending.push({ token, test, consequent });
+          continue;
+        }
+        const alternate = hasElse ? this.parseIfClause() : void 0;
+        let result = {
+          type: "IfStatement",
+          test,
+          consequent,
+          alternate,
+          span: createSpan2(token.start, alternate?.span.end ?? consequent.span.end)
+        };
+        while (pending.length > 0) {
+          const parent = pending.pop();
+          result = {
+            type: "IfStatement",
+            test: parent.test,
+            consequent: parent.consequent,
+            alternate: result,
+            span: createSpan2(parent.token.start, result.span.end)
+          };
+        }
+        return result;
+      }
     } finally {
-      this.ifStatementDepth -= 1;
+      this.ifStatementDepth -= entered;
     }
   }
   parseSwitchStatement() {
@@ -8661,4 +8718,4 @@ export {
   Float16Array2 as Float16Array,
   numericTypedArrayConstructors
 };
-//# sourceMappingURL=chunk-KOO6YGQG.js.map
+//# sourceMappingURL=chunk-Y5EZYHU6.js.map