@poe-platform/safe-js 0.1.799 → 0.1.801

package/dist/safe-js/chunks/chunk-QRWRR6IA.js

@@ -0,0 +1,78 @@
+import {
+  createSeededRandom
+} from "./chunk-5RLD4TVI.js";
+
+// packages/safe-js/src/modules/time.ts
+function makeTimeModule(options = {}) {
+  const hasDeterministicRandom = options.random !== void 0 || options.seed !== void 0;
+  const random = options.random ?? (options.seed === void 0 ? () => Math.random() : createSeededRandom(options.seed).next);
+  const now = options.now ?? (() => Date.now());
+  const signal = options.signal;
+  async function sleep(ms) {
+    assertSleepDelay(ms);
+    return await new Promise((resolve, reject) => {
+      if (signal?.aborted === true) {
+        reject(createSleepAbortError());
+        return;
+      }
+      const start = performance.now();
+      let timeout = setTimeout(resolveSleep, ms);
+      function cleanup() {
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", rejectSleep);
+      }
+      function resolveSleep() {
+        const remainingMs = ms - (performance.now() - start);
+        if (remainingMs > 0) {
+          timeout = setTimeout(resolveSleep, remainingMs);
+          return;
+        }
+        cleanup();
+        resolve();
+      }
+      function rejectSleep() {
+        cleanup();
+        reject(createSleepAbortError());
+      }
+      signal?.addEventListener("abort", rejectSleep, { once: true });
+    });
+  }
+  return {
+    random,
+    now,
+    sleep,
+    uuid: hasDeterministicRandom ? () => createRandomUuid(random) : () => globalThis.crypto.randomUUID()
+  };
+}
+function createRandomUuid(random) {
+  const bytes = Array.from({ length: 16 }, () => Math.floor(readRandomUnit(random()) * 256));
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+function readRandomUnit(value) {
+  if (Number.isFinite(value) && value >= 0 && value < 1) {
+    return value;
+  }
+  throw new RangeError("time.uuid() random source must return a number in [0, 1).");
+}
+function assertSleepDelay(ms) {
+  if (Number.isFinite(ms) && ms >= 0) {
+    return;
+  }
+  throw new RangeError("time.sleep(ms) requires a non-negative finite millisecond delay.");
+}
+function createSleepAbortError() {
+  return new Error("time.sleep aborted.");
+}
+
+export {
+  makeTimeModule
+};

package/dist/safe-js/chunks/{chunk-MDJ7MJYI.js → chunk-XOMGWE37.js}

@@ -2,7 +2,7 @@ import {
   hashParsedAst,
   hashSource,
   validateSnapshotMigration
-} from "./chunk-ZKLJW27N.js";
+} from "./chunk-PMOXSLM5.js";
 import {
   SnapshotValidationError,
   assertSnapshotInactive,
@@ -11,7 +11,7 @@ import {
   validateDumpEnvelope,
   validateGuestHeapSource,
   validateRuntimeSnapshotDescriptors
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   SandboxError,
   parseExecutableModule,

package/dist/safe-js/chunks/{chunk-QTCPJ7FN.js → chunk-XV5OYKND.js}

@@ -1,7 +1,7 @@
 import {
   SnapshotNotReadyError,
   serializeSafeJSSnapshot
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   SandboxError
 } from "./chunk-A3LXCGMJ.js";

package/dist/safe-js/chunks/{chunk-OTVZWRYE.js → chunk-YCFOANSU.js}

@@ -7,7 +7,7 @@ import {
 import {
   declareBudgetedHostOperation,
   declareHostOperation
-} from "./chunk-ULPZIHB5.js";
+} from "./chunk-5RLD4TVI.js";
 import {
   basename,
   dirname,
@@ -34,11 +34,14 @@ import {
 // packages/safe-js/src/modules/canonical-path.ts
 var MISSING_PATH_CODES = ["ENOENT", "ENOTDIR"];
 var NOT_A_SYMLINK_CODES = [...MISSING_PATH_CODES, "EINVAL"];
-var MAX_SYMLINK_FOLLOWS = 32;
-async function resolveCanonicalPath({ realpath, readlink }, path) {
+async function resolveCanonicalPath({ realpath, readlink }, path, maxSymlinkFollows = Infinity) {
+  if (maxSymlinkFollows !== Infinity && (!Number.isSafeInteger(maxSymlinkFollows) || maxSymlinkFollows < 0)) {
+    throw new RangeError("maxSymlinkFollows must be a nonnegative safe integer or Infinity");
+  }
   const missingSegments = [];
   let current = path;
   let follows = 0;
+  const visited = /* @__PURE__ */ new Set();
   while (true) {
     try {
       const canonicalCurrent = await realpath(current);
@@ -49,9 +52,10 @@ async function resolveCanonicalPath({ realpath, readlink }, path) {
       }
       const target = await readSymlinkTarget(readlink, current);
       if (target !== void 0) {
-        if (++follows > MAX_SYMLINK_FOLLOWS) {
+        if (++follows > maxSymlinkFollows || visited.has(current)) {
           throw createLoopError(path);
         }
+        visited.add(current);
         current = isAbsolutePath(target) ? target : `${dirname(current)}${sep}${target}`;
         continue;
       }
@@ -264,9 +268,10 @@ var NULL_BYTE = "\0";
 var [ACCESS_DENIED_ERRNO, ACCESS_DENIED_MESSAGE] = accessDeniedSystemError;
 function makeFsModule(options = {}) {
   assertSupportedPlatform();
+  const maxSymlinkFollows = options.maxSymlinkFollows ?? Infinity;
   const hostReadMemoryLimit = options.hostReadMemoryLimit ?? Infinity;
   const readFileMaxBytes = options.readFileMaxBytes ?? Infinity;
-  for (const limit of [hostReadMemoryLimit, readFileMaxBytes]) {
+  for (const limit of [hostReadMemoryLimit, readFileMaxBytes, maxSymlinkFollows]) {
     if (limit !== Infinity && (!Number.isSafeInteger(limit) || limit < 0))
       throw new TypeError("Filesystem read limits must be non-negative safe integers or Infinity.");
   }
@@ -288,7 +293,7 @@ function makeFsModule(options = {}) {
     cwd: options.root === void 0 ? options.cwd : void 0,
     signal: options.signal
   });
-  const fs = options.root === void 0 ? implementation : makeRootedFs(implementation, options.root, options.adapter, options.cwd, options.signal);
+  const fs = options.root === void 0 ? implementation : makeRootedFs(implementation, options.root, options.adapter, options.cwd, options.signal, maxSymlinkFollows);
   let readFile = bindStringResult(fs, "readFile");
   if (options.adapter !== void 0) {
     const boundedRead = async (args, budget) => {
@@ -316,7 +321,7 @@ function makeFsModule(options = {}) {
         }
       });
       const portable = bridge;
-      const boundedFs = options.root === void 0 ? portable : makeRootedFs(portable, options.root, options.adapter, options.cwd, options.signal);
+      const boundedFs = options.root === void 0 ? portable : makeRootedFs(portable, options.root, options.adapter, options.cwd, options.signal, maxSymlinkFollows);
       return await invoke(boundedFs, "readFile", args);
     };
     const directRead = declare("readFile", "re-issue", (...args) => boundedRead(args));
@@ -408,7 +413,7 @@ function invoke(fs, name, args) {
   return Reflect.apply(fs[name], fs, args);
 }
 var rootedFsOperations = /* @__PURE__ */ new WeakMap();
-function makeRootedFs(fs, root, adapter, cwd, signal) {
+function makeRootedFs(fs, root, adapter, cwd, signal, maxSymlinkFollows = Infinity) {
   if (root.trim().length === 0) {
     throw new Error("fs module root must be a non-empty string.");
   }
@@ -429,7 +434,7 @@ function makeRootedFs(fs, root, adapter, cwd, signal) {
         return await invoke(
           fs,
           name,
-          await resolvePathArguments(fs, resolvedRoot, name, args, adapter, cwd, signal)
+          await resolvePathArguments(fs, resolvedRoot, name, args, adapter, cwd, signal, maxSymlinkFollows)
         );
       } finally {
         release();
@@ -450,8 +455,8 @@ function assertRootCanConfineOptions(name, args) {
     throw createUnsupportedOptionError("cp", "dereference", ROOT_REFUSED_DEREFERENCE_REASON);
   }
 }
-async function resolvePathArguments(fs, root, name, args, adapter, cwd, signal) {
-  const canonicalRoot = await resolveCanonicalPath(readCanonicalPathFs(fs), resolve(root));
+async function resolvePathArguments(fs, root, name, args, adapter, cwd, signal, maxSymlinkFollows = Infinity) {
+  const canonicalRoot = await resolveCanonicalPath(readCanonicalPathFs(fs), resolve(root), maxSymlinkFollows);
   const base = cwd ?? canonicalRoot;
   const resolved = [...args];
   if (name === "symlink") {
@@ -475,7 +480,7 @@ async function resolvePathArguments(fs, root, name, args, adapter, cwd, signal)
     await assertInsideRoot(fs, canonicalRoot, name, [checkedTarget, linkPath], adapter, signal, [
       targetPath,
       linkPath
-    ]);
+    ], maxSymlinkFollows);
     return resolved;
   }
   const paths = FS_PATH_ARGUMENTS[name].map((_, index) => {
@@ -483,12 +488,12 @@ async function resolvePathArguments(fs, root, name, args, adapter, cwd, signal)
     resolved[index] = path;
     return path;
   });
-  await assertInsideRoot(fs, canonicalRoot, name, paths, adapter, signal);
+  await assertInsideRoot(fs, canonicalRoot, name, paths, adapter, signal, paths, maxSymlinkFollows);
   if (name === "mkdtemp") {
     const prefix = args[0];
     const absolutePrefix = isAbsolutePath(prefix) ? prefix : `${base}${sep}${prefix}`;
     const parent = absolutePrefix.endsWith(sep) ? absolutePrefix : dirname(absolutePrefix);
-    await assertInsideRoot(fs, canonicalRoot, name, [parent], adapter, signal, paths);
+    await assertInsideRoot(fs, canonicalRoot, name, [parent], adapter, signal, paths, maxSymlinkFollows);
     resolved[0] = absolutePrefix;
   }
   if (adapter !== void 0 && name === "mkdir") {
@@ -506,15 +511,15 @@ async function resolvePathArguments(fs, root, name, args, adapter, cwd, signal)
   }
   return resolved;
 }
-async function assertInsideRoot(fs, canonicalRoot, name, paths, adapter, signal, reportedPaths = paths) {
+async function assertInsideRoot(fs, canonicalRoot, name, paths, adapter, signal, reportedPaths = paths, maxSymlinkFollows = Infinity) {
   for (const path of paths) {
-    if (await escapesRoot(fs, canonicalRoot, path, adapter, signal)) {
+    if (await escapesRoot(fs, canonicalRoot, path, adapter, signal, maxSymlinkFollows)) {
       throw createAccessDeniedError(name, reportedPaths[0], reportedPaths[1]);
     }
   }
 }
-async function escapesRoot(fs, canonicalRoot, path, adapter, signal) {
-  const canonicalPath = await resolveCanonicalPath(readCanonicalPathFs(fs), path);
+async function escapesRoot(fs, canonicalRoot, path, adapter, signal, maxSymlinkFollows = Infinity) {
+  const canonicalPath = await resolveCanonicalPath(readCanonicalPathFs(fs), path, maxSymlinkFollows);
   return !await (adapter === void 0 ? containsPath(readStat(fs), canonicalRoot, canonicalPath) : containsAdapterPath(adapter, canonicalRoot, canonicalPath, signal));
 }
 async function containsAdapterPath(adapter, canonicalRoot, canonicalPath, signal) {

package/dist/safe-js/chunks/{cli-runtime-DYXJZCGV.js → cli-runtime-L4IABN2W.js}

@@ -3,22 +3,22 @@ import {
   extractBlock,
   formatInterpreterError,
   makeAgentModule,
-  makeEnvModule,
-  makeFailModule,
   makeLogModule,
-  makeMetricModule,
   maskSource,
-  parseEnvConfig,
   parseFsConfig,
   resolveFsConfig,
   splitFrontmatter
-} from "./chunk-KULEMOAE.js";
+} from "./chunk-4KMUWNZD.js";
 import {
   parseMcpConfig
-} from "./chunk-MCFRB5X3.js";
+} from "./chunk-6H5VC5W5.js";
 import {
-  lint
-} from "./chunk-OPYN6N5M.js";
+  lint,
+  makeEnvModule,
+  makeFailModule,
+  makeMetricModule,
+  parseEnvConfig
+} from "./chunk-HPHCQNFV.js";
 import {
   createBrokenPipeState,
   createSafeOutputStream,
@@ -72,7 +72,7 @@ async function runCli(argv, options, usage) {
     async () => {
       try {
         if (argv[0] === "migrate") {
-          const { migrateSnapshotFile } = await import("./migration-file-EEGIOHQB.js");
+          const { migrateSnapshotFile } = await import("./migration-file-4CYSJ6LO.js");
           const result = await migrateSnapshotFile({
             ...parseMigrationArgs(argv.slice(1)),
             cwd: options.cwd ?? readCurrentWorkingDirectory(),
@@ -291,12 +291,12 @@ async function assertHarnessFile(input) {
 }
 async function runScriptFile(filepath, parsed, options) {
   const [{ run }, { restore }, { dump, dumpCurrent }, { createLintModulesFromRuntimeRegistry }, { makeFsModule }, { makeMcpModule }] = await Promise.all([
-    import("./run-Q74MU3QQ.js"),
-    import("./restore-U3CCH36B.js"),
-    import("./dump-XDJEF2LG.js"),
-    import("./runtime-modules-SL5D6LAJ.js"),
+    import("./run-M6N5KCPF.js"),
+    import("./restore-GDHBT5ZD.js"),
+    import("./dump-KUPBSXSL.js"),
+    import("./runtime-modules-MGSXY4BN.js"),
     import("../modules/fs.js"),
-    import("./mcp-PTCA53MN.js")
+    import("./mcp-5TMFK3UE.js")
   ]);
   const loaded = loadExecutableSource(filepath, await options.readFile(filepath, "utf8"));
   const meta = {
@@ -534,7 +534,7 @@ async function createRuntime(frontmatter, meta, options) {
     };
   }
   const [{ makeHarnessModule }, { makeFsModule }] = await Promise.all([
-    import("./harness-32OOFC5A.js"),
+    import("./harness-3DDUS3RY.js"),
     import("../modules/fs.js")
   ]);
   const state = {

package/dist/safe-js/chunks/{dump-XDJEF2LG.js → dump-KUPBSXSL.js}

@@ -4,8 +4,8 @@ import {
   dump,
   dumpCurrent,
   serializeRunSnapshot
-} from "./chunk-QTCPJ7FN.js";
-import "./chunk-ULPZIHB5.js";
+} from "./chunk-XV5OYKND.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-JCHJGIQA.js";
 import "./chunk-CQ52GEHY.js";

package/dist/safe-js/chunks/{harness-32OOFC5A.js → harness-3DDUS3RY.js}

@@ -1,7 +1,7 @@
 import {
   makeHarnessModule
-} from "./chunk-UU4T2KIT.js";
-import "./chunk-ULPZIHB5.js";
+} from "./chunk-CK3YK2EC.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-JCHJGIQA.js";
 import "./chunk-CQ52GEHY.js";

package/dist/safe-js/chunks/{mcp-PTCA53MN.js → mcp-5TMFK3UE.js}

@@ -1,8 +1,8 @@
 import {
   makeMcpModule
-} from "./chunk-W6C3Q6U4.js";
-import "./chunk-MCFRB5X3.js";
-import "./chunk-ULPZIHB5.js";
+} from "./chunk-IB6WAQAE.js";
+import "./chunk-6H5VC5W5.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-JCHJGIQA.js";
 import "./chunk-CQ52GEHY.js";

package/dist/safe-js/chunks/{migration-file-EEGIOHQB.js → migration-file-4CYSJ6LO.js}

@@ -1,10 +1,10 @@
 import {
   migrateSnapshotFile
-} from "./chunk-3O7HA6WT.js";
+} from "./chunk-F6Y734YA.js";
 import "./chunk-DIG26TEI.js";
 import "./chunk-ONWFPHUI.js";
-import "./chunk-ZKLJW27N.js";
-import "./chunk-ULPZIHB5.js";
+import "./chunk-PMOXSLM5.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-MMN3IESA.js";
 import "./chunk-JCHJGIQA.js";

package/dist/safe-js/chunks/{restore-U3CCH36B.js → restore-GDHBT5ZD.js}

@@ -1,9 +1,9 @@
 import {
   SnapshotMismatchError,
   restore
-} from "./chunk-MDJ7MJYI.js";
-import "./chunk-ZKLJW27N.js";
-import "./chunk-ULPZIHB5.js";
+} from "./chunk-XOMGWE37.js";
+import "./chunk-PMOXSLM5.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-JCHJGIQA.js";
 import "./chunk-CQ52GEHY.js";

package/dist/safe-js/chunks/{run-Q74MU3QQ.js → run-M6N5KCPF.js}

@@ -1,14 +1,14 @@
 import {
   UnhandledRejectionError,
   run
-} from "./chunk-M6S3F3WM.js";
+} from "./chunk-HFRBLE6Y.js";
 import "./chunk-DHGJSEFX.js";
 import "./chunk-DIG26TEI.js";
 import "./chunk-ONWFPHUI.js";
-import "./chunk-MDJ7MJYI.js";
-import "./chunk-ZKLJW27N.js";
-import "./chunk-QTCPJ7FN.js";
-import "./chunk-ULPZIHB5.js";
+import "./chunk-XOMGWE37.js";
+import "./chunk-PMOXSLM5.js";
+import "./chunk-XV5OYKND.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-MMN3IESA.js";
 import "./chunk-JCHJGIQA.js";

package/dist/safe-js/chunks/{runtime-modules-SL5D6LAJ.js → runtime-modules-MGSXY4BN.js}

@@ -1,7 +1,7 @@
 import {
   createLintModulesFromRuntimeRegistry
-} from "./chunk-TBZILU4U.js";
-import "./chunk-ULPZIHB5.js";
+} from "./chunk-7THYP46K.js";
+import "./chunk-5RLD4TVI.js";
 import "./chunk-A3LXCGMJ.js";
 import "./chunk-JCHJGIQA.js";
 import "./chunk-CQ52GEHY.js";

package/dist/safe-js/cli.js

@@ -13,7 +13,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 async function runCli(argv, options = {}) {
   if (!argv.includes("--help") && !argv.includes("-h")) {
-    const runtime = await import("./chunks/cli-runtime-DYXJZCGV.js");
+    const runtime = await import("./chunks/cli-runtime-L4IABN2W.js");
     return runtime.runCli(argv, options, createUsage());
   }
   const brokenPipe = createBrokenPipeState();
@@ -32,7 +32,7 @@ async function runCli(argv, options = {}) {
         stderr.write(`${error instanceof Error ? error.message : String(error)}
 `);
         if (brokenPipe.closed) return 0;
-        const { exitCodeForError } = await import("./chunks/cli-runtime-DYXJZCGV.js");
+        const { exitCodeForError } = await import("./chunks/cli-runtime-L4IABN2W.js");
         return exitCodeForError(error);
       }
     }

package/dist/safe-js/core.d.ts

@@ -12,3 +12,9 @@ export { Budget } from "./interp/budget.js";
 export type { SnapshotValidationCode } from "./snapshot/validation.js";
 export type { SourceResolver, SourceModule } from "./modules/source-graph.js";
 export { createRootedSourceResolver } from "./modules/source-files.js";
+export * from "./modules/env.js";
+export * from "./modules/fail.js";
+export * from "./modules/fs.js";
+export * from "./modules/harness.js";
+export * from "./modules/metric.js";
+export * from "./modules/time.js";

package/dist/safe-js/core.js

@@ -1,6 +1,22 @@
 import {
-  lint
-} from "./chunks/chunk-OPYN6N5M.js";
+  makeTimeModule
+} from "./chunks/chunk-QRWRR6IA.js";
+import {
+  makeHarnessModule
+} from "./chunks/chunk-CK3YK2EC.js";
+import {
+  EnvAccessError,
+  HarnessFailure,
+  lint,
+  makeEnvModule,
+  makeFailModule,
+  makeMetricModule,
+  parseEnvConfig
+} from "./chunks/chunk-HPHCQNFV.js";
+import {
+  FS_OPTION_SURFACE,
+  makeFsModule
+} from "./chunks/chunk-YCFOANSU.js";
 import {
   createRootedSourceResolver
 } from "./chunks/chunk-3NFTBEZR.js";
@@ -8,17 +24,17 @@ import {
   createRealm,
   createReplayableRandom,
   run
-} from "./chunks/chunk-M6S3F3WM.js";
+} from "./chunks/chunk-HFRBLE6Y.js";
 import "./chunks/chunk-DHGJSEFX.js";
 import "./chunks/chunk-DIG26TEI.js";
 import "./chunks/chunk-ONWFPHUI.js";
-import "./chunks/chunk-MDJ7MJYI.js";
-import "./chunks/chunk-ZKLJW27N.js";
-import "./chunks/chunk-QTCPJ7FN.js";
+import "./chunks/chunk-XOMGWE37.js";
+import "./chunks/chunk-PMOXSLM5.js";
+import "./chunks/chunk-XV5OYKND.js";
 import {
   admitNativePromiseProperties,
   defineExtension
-} from "./chunks/chunk-ULPZIHB5.js";
+} from "./chunks/chunk-5RLD4TVI.js";
 import {
   Budget
 } from "./chunks/chunk-A3LXCGMJ.js";
@@ -27,11 +43,21 @@ import "./chunks/chunk-JCHJGIQA.js";
 import "./chunks/chunk-CQ52GEHY.js";
 export {
   Budget,
+  EnvAccessError,
+  FS_OPTION_SURFACE,
+  HarnessFailure,
   admitNativePromiseProperties,
   createRealm,
   createReplayableRandom,
   createRootedSourceResolver,
   defineExtension,
   lint,
+  makeEnvModule,
+  makeFailModule,
+  makeFsModule,
+  makeHarnessModule,
+  makeMetricModule,
+  makeTimeModule,
+  parseEnvConfig,
   run
 };