@poe-platform/safe-js 0.1.730 → 0.1.732

package/README.md

@@ -36,7 +36,7 @@ console.log(result.returnValue);
 
 `run()` takes source text, not a file path. Success returns `ok`, `returnValue`, `snapshot`, and `stats`. Handle both an `ok: false` result and a rejected promise: parsing, budget exhaustion, cancellation, and some execution failures can reject. Top-level `await` in this example lets rejections reach Node.
 
-`@poe-platform/safe-js/core` exposes `run`, `createRealm`, `defineExtension`, `lint`, `Budget`, and replayable-random helpers. The shared filesystem lives in `@poe-platform/safe-fs`, with a portable `/core` entry. Existing `@poe-platform/safe-js/fs`, `/fs/core`, and `/fs/node` imports re-export it. Legacy `poe-code/safe-js` imports remain available through the CLI package but use a separate runtime; keep factories and errors within one import family.
+`@poe-platform/safe-js/core` exposes `run`, `createRealm`, `defineExtension`, `lint`, `Budget`, and replayable-random helpers. The `/core`, `/workerd`, and `/modules/fs` workspace entries bundle with the `workerd` or `browser` condition without Node built-ins. Supply a `@poe-code/safe-fs` adapter for filesystem capabilities; `createRootedSourceResolver(root, adapter)` grants portable source imports. File snapshots, migrations, harnesses, and file-running helpers also accept an `adapter`. The shared filesystem lives in `@poe-platform/safe-fs`, with a portable `/core` entry. Existing `@poe-platform/safe-js/fs`, `/fs/core`, and `/fs/node` imports re-export it. Legacy `poe-code/safe-js` imports remain available through the CLI package but use a separate runtime; keep factories and errors within one import family.
 
 ## Supported features
 
@@ -237,7 +237,7 @@ Execution gives host timers and cancellation turns between guest nodes after ela
 | `extensions` | Explicit `defineExtension(...)` registrations; `[]`. Setup runs once, on first evaluation, not on construction or unused close. |
 | `grants` | Granted capability names; `[]`. Every requested capability must be granted before any extension setup runs. |
 | `builtinOverrides` | Optional `{ console: "extension-name" }` authorizes that registered extension to replace only the builtin console. It must declare `console` and export a host object created in the realm. No overrides by default. |
-| `limits` | Positive integer caps: `extensions: 32`, `hostObjects: 1024`, `callbacks: 1024`, `guestReferences: 1024`, `cleanups: 1024`, `nestedEvaluations: 16`. Collection budgets also apply. |
+| `limits` | Optional positive integer caps for `extensions`, `hostObjects`, `callbacks`, `guestReferences`, `cleanups`, and `nestedEvaluations`. Every cap defaults to `Infinity` and accepts explicit `Infinity`. Collection budgets also apply. |
 | `stringCompilation` | Optional `"allow"` (default) or `"deny"`. Denial raises a catchable guest EvalError for string eval and Function/AsyncFunction/GeneratorFunction/AsyncGeneratorFunction compilation, including retained callbacks. Host source evaluation remains available. This is separate from WebAssembly compilation policy. |
 | `classicScripts` | Optional boolean, default `false`. Evaluations use classic Script grammar with persistent globals: top-level `this` is the intrinsic global object, `var` and functions create global properties, and `let`/`const` remain lexical. Injected capabilities stay immutable lexical bindings. Explicit source modules retain module semantics. |
 | `classicScriptErrors` | Optional `"fatal"` (default) or `"report"`; reporting requires `classicScripts: true`. Ordinary escaped Script exceptions return `ok: false` with `recoverable: true` while preserving realm state. Syntax, budget, cancellation, module, callback and unhandled rejection failures remain fatal. |
@@ -445,7 +445,7 @@ For one-shot use, `run(source, { extensions, grants, ... })` accepts the same re
 | `snapshotIntervalMs` | Periodic checkpoint interval when persistence is configured: 30,000 ms; `0` disables periodic writes. Capture happens at interpreter yield points. |
 | `hostCallResumeProvider` | Reconciles pending external operations on restore; returns a matching `HostCallResumeProof`. |
 
-`new Budget(options?)` accepts optional limits. A custom budget replaces the default, so include `maxCallDepth` if you want that guard.
+`new Budget(options?)` accepts optional limits, each unlimited by default. Explicit `Infinity` also disables a limit. Set `maxCallDepth` to opt into a recursion guard in `run()` or `createRealm()`.
 
 | Option | Limit |
 | --- | --- |
@@ -536,7 +536,7 @@ Factories return exports to register in `modules`; calling a factory alone does
 | --- | --- |
 | `makeAgentModule(spawnAgent, options?)` | Inject the agent runner. Options: `defaultRetry`, `onEvent`, `otelSink`. Exposes `spawn`, `spawn.retry`, and `spawn.parallel`; call options follow this table. |
 | `makeMcpModule(options)` | Required `servers` map: stdio `{ command, args?, cwd?, env? }` or HTTP `{ url, headers? }`. Options: `requestTimeoutMs` (30,000), `closeTimeoutMs` (1,000), `maxToolPages` (100), `signal`, and injected `fetch`/`spawn`. Named clients expose `tools`, `tool`, `toolBatch`, and `close`; close managed clients when finished. A custom connector function is also accepted. |
-| `makeFsModule(options?)` | Node-backed `{ root?, fs? }`, or shared-filesystem `{ adapter, root?, cwd?, signal? }`; do not combine `fs` and `adapter`. Node access without `root` is unconfined. Rooted calls sharing the same adapter or Node implementation are serialized through path checks and backend completion to prevent guest namespace races. External host mutations or distinct adapters over the same storage require independent backend confinement. With an adapter, `root` confines access and `cwd` selects the virtual relative-path base; without `root`, explicit `cwd` also confines access. Omitting both uses virtual `/`. Adapter text reads pass a byte cap derived conservatively from the guest string and remaining data limits to the backend before decoding. Each read is also capped at 419,430 input bytes. A shared 16 MiB host read allowance reserves ten bytes per input byte for collection, copies, encoding expansion and admission; concurrent reads that exceed it reject, and reservations release after the underlying read settles and decoding finishes, including when cancellation rejects the caller earlier. Native Node/injected `fs` implementations retain their own read behavior. Read text with `readFile(path, "utf8")`; see the [module methods](src/modules/fs.ts) and [filesystem package](../safe-fs/README.md). |
+| `makeFsModule(options?)` | Node-backed `{ root?, fs? }`, or shared-filesystem `{ adapter, root?, cwd?, signal? }`; do not combine `fs` and `adapter`. Node access without `root` is unconfined. Rooted calls sharing the same adapter or Node implementation are serialized through path checks and backend completion to prevent guest namespace races. External host mutations or distinct adapters over the same storage require independent backend confinement. With an adapter, `root` confines access and `cwd` selects the virtual relative-path base; without `root`, explicit `cwd` also confines access. Omitting both uses virtual `/`. Adapter text reads pass a byte cap derived conservatively from the guest string and remaining data limits to the backend before decoding. Optional `readFileMaxBytes` and `hostReadMemoryLimit` default to `Infinity` and accept explicit `Infinity`. A finite host allowance reserves ten bytes per input byte for collection, copies, encoding expansion and admission across concurrent reads from that module; reservations release after the underlying read settles and decoding finishes, including when cancellation rejects the caller earlier. Native Node/injected `fs` implementations retain their own read behavior. Read text with `readFile(path, "utf8")`; see the [module methods](src/modules/fs.ts) and [filesystem package](../safe-fs/README.md). |
 | `makeEnvModule(namesOrOptions)` | Allowed-name array or `{ allow, values? }`; exposes `get(name)`. `parseEnvConfig(json)` accepts the object form. |
 | `makeTimeModule(options?)` | `now`, `random`, `seed`, `signal`; exposes `now`, `random`, `sleep`, `uuid`. Defaults to host time/randomness; `seed` makes the random generator deterministic, and explicit `random` takes precedence. |
 | `makeLogModule(sink)` | Sends timestamped `info`, `error`, and `event` entries to your callback. |
@@ -548,7 +548,7 @@ Factories return exports to register in `modules`; calling a factory alone does
 
 `spawn.retry(definition, options, retryOptions)` and `defaultRetry` use `{ maxAttempts, backoffMs, isErrorRetryable?, isRetryable? }`. `spawn.parallel(calls, options?)` accepts definition/options tuples or spawn-handle factories; options are `check`, `maxConcurrent`, `failFast`, and `signal`. Usage helpers are `createSpawnUsageAccumulator()` and `runWithSpawnUsageAccumulator(accumulator, operation)`.
 
-**Config files.** `parseMcpConfig(json, directory)` accepts `servers` and the three numeric MCP limits, resolving stdio paths against `directory`. `parseFsConfig(json)` accepts `{ adapter: { type, options }, root?, cwd? }`; `resolveFsConfig(config, { registry? })` constructs the adapter for `makeFsModule`. Built-in types are `memory` and `real`; `real` requires an absolute host `options.root`. Outer `root`/`cwd` are absolute virtual paths. Custom registry descriptors supply `validateOptions` and `create`. Signals and injected functions are SDK options, not JSON fields.
+**Config files.** `parseMcpConfig(json, directory)` accepts `servers` and the three numeric MCP limits, resolving stdio paths against `directory`. `parseFsConfig(json)` accepts `{ adapter: { type, options }, root?, cwd?, readFileMaxBytes?, hostReadMemoryLimit? }`; `resolveFsConfig(config, { registry? })` constructs the adapter for `makeFsModule`. Built-in types are `memory` and `real`; `real` requires an absolute host `options.root`. Outer `root`/`cwd` are absolute virtual paths. Custom registry descriptors supply `validateOptions` and `create`. Signals and injected functions are SDK options, not JSON fields.
 
 </details>
 

package/dist/safe-js/chunks/{chunk-SJZWSPWD.js → chunk-2GVBG23M.js}

@@ -14,4 +14,4 @@ export {
   getOwnErrorCode,
   hasOwnErrorCode
 };
-//# sourceMappingURL=chunk-SJZWSPWD.js.map
+//# sourceMappingURL=chunk-2GVBG23M.js.map

package/dist/safe-js/chunks/{chunk-SJZWSPWD.js.map → chunk-2GVBG23M.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/error-codes.ts"],
-  "sourcesContent": ["export function getOwnErrorCode(error: unknown): string | undefined {\n  if (\n    typeof error !== \"object\" ||\n    error === null ||\n    !Object.prototype.hasOwnProperty.call(error, \"code\")\n  ) {\n    return undefined;\n  }\n\n  const code = (error as { code?: unknown }).code;\n  return typeof code === \"string\" ? code : undefined;\n}\n\nexport function hasOwnErrorCode(error: unknown, code: string): error is NodeJS.ErrnoException {\n  return getOwnErrorCode(error) === code;\n}\n"],
+  "sourcesContent": ["export function getOwnErrorCode(error: unknown): string | undefined {\n  if (\n    typeof error !== \"object\" ||\n    error === null ||\n    !Object.prototype.hasOwnProperty.call(error, \"code\")\n  ) {\n    return undefined;\n  }\n\n  const code = (error as { code?: unknown }).code;\n  return typeof code === \"string\" ? code : undefined;\n}\n\nexport function hasOwnErrorCode(error: unknown, code: string): error is NodeJS.ErrnoException {\n  return getOwnErrorCode(error) === code;\n}\n\nexport type SystemError = Error & { code?: string; errno?: number; syscall?: string; path?: string; dest?: string };\n"],
   "mappings": ";AAAO,SAAS,gBAAgB,OAAoC;AAClE,MACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,MAAM,GACnD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEO,SAAS,gBAAgB,OAAgB,MAA8C;AAC5F,SAAO,gBAAgB,KAAK,MAAM;AACpC;",
   "names": []
 }

package/dist/safe-js/chunks/{chunk-MW2QLYVN.js → chunk-3ITVV2R6.js}

@@ -148,48 +148,58 @@ function isJsonValue(value, options = {}) {
   const maxNodes = options.maxNodes ?? 1e4;
   const maxDepth = options.maxDepth ?? 64;
   if (maxNodes !== Infinity && (!Number.isSafeInteger(maxNodes) || maxNodes < 1)) throw new Error("maxNodes must be a positive safe integer");
-  if (!Number.isSafeInteger(maxDepth) || maxDepth < 0 || maxDepth > 256) throw new Error("maxDepth must be an integer between 0 and 256");
+  if (maxDepth !== Infinity && (!Number.isSafeInteger(maxDepth) || maxDepth < 0)) throw new Error("maxDepth must be a nonnegative safe integer or Infinity");
   const ancestors = /* @__PURE__ */ new Set();
+  const stack = [];
+  function* properties(item2) {
+    if (Array.isArray(item2)) {
+      for (let index = 0; index < item2.length; index++) yield Object.getOwnPropertyDescriptor(item2, String(index));
+    } else for (const key2 in item2) {
+      const property = Object.getOwnPropertyDescriptor(item2, key2);
+      if (property !== void 0) yield property;
+    }
+  }
   let nodes = 0;
-  const visit = (item, depth) => {
+  let item = value, depth = 0;
+  while (true) {
     if (++nodes > maxNodes || depth > maxDepth) return false;
-    if (item === null || typeof item === "string" || typeof item === "boolean") return true;
-    if (typeof item === "number") return Number.isFinite(item);
-    if (typeof item !== "object" || ancestors.has(item)) return false;
-    if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) return false;
-    let hookOwner = item;
-    let prototypeDepth = 0;
-    while (hookOwner !== null) {
-      if (++prototypeDepth > 64) return false;
-      const serializationHook = Object.getOwnPropertyDescriptor(hookOwner, "toJSON");
-      if (serializationHook !== void 0) {
-        if (!("value" in serializationHook) || typeof serializationHook.value === "function") return false;
-        break;
-      }
-      hookOwner = Object.getPrototypeOf(hookOwner);
-    }
-    ancestors.add(item);
-    let valid = true;
-    if (Array.isArray(item)) {
-      if (item.length > maxNodes) valid = false;
-      else for (let index = 0; index < item.length; index++) {
-        const property = Object.getOwnPropertyDescriptor(item, String(index));
-        if (property === void 0 || !("value" in property) || !visit(property.value, depth + 1)) {
-          valid = false;
-          break;
+    if (item !== null && typeof item !== "string" && typeof item !== "boolean") {
+      if (typeof item === "number") {
+        if (!Number.isFinite(item)) return false;
+      } else {
+        if (typeof item !== "object" || ancestors.has(item)) return false;
+        if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) return false;
+        let hookOwner = item;
+        let prototypeDepth = 0;
+        while (hookOwner !== null) {
+          if (++prototypeDepth > 64) return false;
+          const serializationHook = Object.getOwnPropertyDescriptor(hookOwner, "toJSON");
+          if (serializationHook !== void 0) {
+            if (!("value" in serializationHook) || typeof serializationHook.value === "function") return false;
+            break;
+          }
+          hookOwner = Object.getPrototypeOf(hookOwner);
         }
+        if (Array.isArray(item) && item.length > maxNodes - nodes) return false;
+        ancestors.add(item);
+        stack.push({ owner: item, children: properties(item), depth });
       }
-    } else for (const key2 in item) {
-      const property = Object.getOwnPropertyDescriptor(item, key2);
-      if (property !== void 0 && (!("value" in property) || !visit(property.value, depth + 1))) {
-        valid = false;
+    }
+    let next;
+    while (stack.length) {
+      const frame = stack[stack.length - 1];
+      next = frame.children.next();
+      if (!next.done) {
+        if (next.value === void 0 || !("value" in next.value)) return false;
+        item = next.value.value;
+        depth = frame.depth + 1;
         break;
       }
+      ancestors.delete(frame.owner);
+      stack.pop();
     }
-    ancestors.delete(item);
-    return valid;
-  };
-  return visit(value, 0);
+    if (!stack.length) return true;
+  }
 }
 
 // packages/toolcraft-schema/src/json-schema/utils.ts
@@ -3637,38 +3647,39 @@ async function waitForOAuthOperation(operation, signal) {
 // packages/mcp-oauth/src/client/bounded-json.ts
 function copyBoundedOAuthJson(value, message) {
   const invalid = () => new Error(message);
-  let nodes = 0;
-  function copy(input, depth) {
-    if (++nodes > 2e4 || depth > 64) throw invalid();
-    if (input === null || typeof input === "boolean" || typeof input === "string") return input;
-    if (typeof input === "number" && Number.isFinite(input)) return input;
-    if (typeof input !== "object" || input === null) throw invalid();
-    const descriptors = Object.getOwnPropertyDescriptors(input);
-    if (Array.isArray(input)) {
-      const length = descriptors.length?.value;
-      if (length > 2e4) throw invalid();
-      const result2 = [];
-      for (let index = 0; index < length; index++) {
-        const descriptor = descriptors[String(index)];
-        if (descriptor === void 0 || !Object.hasOwn(descriptor, "value")) throw invalid();
-        result2.push(copy(descriptor.value, depth + 1));
-      }
-      return result2;
-    }
-    if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null) throw invalid();
-    return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key2, descriptor]) => {
-      if (!Object.hasOwn(descriptor, "value")) throw invalid();
-      return [key2, copy(descriptor.value, depth + 1)];
-    }));
-  }
-  let result;
+  const ancestors = /* @__PURE__ */ new Set();
+  const root = {};
+  const tasks = [{ input: value, target: root, key: "value" }];
   try {
-    result = copy(value, 0);
+    while (tasks.length) {
+      const task = tasks.pop();
+      if ("leave" in task) {
+        ancestors.delete(task.leave);
+        continue;
+      }
+      const { input, target, key: key2 } = task;
+      let output = input;
+      if (input !== null && typeof input !== "boolean" && typeof input !== "string" && !(typeof input === "number" && Number.isFinite(input))) {
+        if (typeof input !== "object" || input === null || ancestors.has(input)) throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        const array = Array.isArray(input);
+        if (!array && Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null) throw invalid();
+        output = array ? [] : {};
+        ancestors.add(input);
+        tasks.push({ leave: input });
+        const keys = array ? Array.from({ length: input.length }, (_, index) => String(index)) : Object.keys(descriptors).filter((name) => descriptors[name].enumerable);
+        for (let index = keys.length - 1; index >= 0; index--) {
+          const name = keys[index], descriptor = descriptors[name];
+          if (descriptor === void 0 || !Object.hasOwn(descriptor, "value")) throw invalid();
+          tasks.push({ input: descriptor.value, target: output, key: name });
+        }
+      }
+      Object.defineProperty(target, key2, { value: output, enumerable: true, configurable: true, writable: true });
+    }
+    return root.value;
   } catch {
     throw invalid();
   }
-  if (Buffer.byteLength(JSON.stringify(result), "utf8") > 64 * 1024) throw invalid();
-  return result;
 }
 
 // packages/mcp-oauth/src/client/loopback-authorization.ts
@@ -7817,7 +7828,7 @@ var HttpTransport = class {
   }
   async completeInitialization(options) {
     validateRequestTimer(options.timeoutMs, "timeoutMs");
-    const deadline = options.timeoutMs > 0 ? AbortSignal.timeout(Math.ceil(options.timeoutMs)) : void 0;
+    const deadline = options.timeoutMs !== Infinity && options.timeoutMs > 0 ? AbortSignal.timeout(Math.ceil(options.timeoutMs)) : void 0;
     const signals = [options.signal, deadline].filter((signal2) => signal2 !== void 0);
     const signal = signals.length === 0 ? new AbortController().signal : AbortSignal.any(signals);
     signal.throwIfAborted();
@@ -8632,7 +8643,7 @@ var SseParser = class {
   }
 };
 function validateRequestTimer(value, name) {
-  if (!Number.isFinite(value) || value < 0 || value > 2147483647)
+  if (value !== Infinity && (!Number.isFinite(value) || value < 0 || value > 2147483647))
     throw new Error(`${name} must be a non-negative finite number no greater than 2147483647`);
 }
 var JsonRpcMessageLayer = class {
@@ -8728,7 +8739,7 @@ var JsonRpcMessageLayer = class {
       currentRequestId = id;
       onRequestId?.(id);
     } };
-    const deadline = timeoutMs === null ? void 0 : setTimeout(() => {
+    const deadline = timeoutMs === null || timeoutMs === Infinity ? void 0 : setTimeout(() => {
       let reason = new Error(`JSON-RPC request "${method}" timed out after ${timeoutMs}ms`);
       try {
         if (currentRequestId !== void 0) options.onTimeout?.(currentRequestId);
@@ -9818,4 +9829,4 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 
 */
-//# sourceMappingURL=chunk-MW2QLYVN.js.map
+//# sourceMappingURL=chunk-3ITVV2R6.js.map