@poe-platform/safe-js 0.1.83 → 0.1.85

package/README.md

@@ -444,7 +444,7 @@ For embedding, `runCli(argv, options?)` comes from `@poe-platform/safe-js/cli`.
 ## Meaningful limitations
 
 - **Not a full JavaScript engine.** No user-defined classes, async generators, dynamic imports, or automatic multi-file/npm resolution. No browser build, DOM, general Node API, `eval`, or `Function` constructor. Ordinary guest constructor prototypes are supported, but native and exotic prototype chains are not. Built-in coverage is selective; lint success is not a runtime compatibility guarantee.
-- **Some familiar syntax differs.** Binary `in` is unsupported; use `Object.hasOwn(object, key)` for own-property checks. Regex supports `g`, `i`, `m`, and `s`, but not lookaround, backreferences, named groups, Unicode property escapes, or other flags. Compilation and matching have fixed limits in addition to configured budgets.
+- **Some familiar syntax differs.** Regex supports `g`, `i`, `m`, and `s`, but not lookaround, backreferences, named groups, Unicode property escapes, or other flags. Compilation and matching have fixed limits in addition to configured budgets.
 - **Budgets are not hard resource isolation.** Limits govern interpreter work, not arbitrary host functions or total process memory. Deadlines are checked cooperatively; cancellation cannot forcibly stop a blocking host call or undo its effects. Add host-operation timeouts and external isolation where required.
 - **Recovery is not exactly-once delivery.** Replay can repeat work and consumes budget again. Pending side effects need external reconciliation; opaque host handles and native iterator frames are not portable checkpoint state. Keep compatible source for ordinary restore or explicitly migrate. Checkpoints can contain input data and host results: store them as sensitive data.
 - **Filesystem access is a grant, not an OS sandbox.** The helper is a subset of `node:fs/promises`, with text-oriented results and no file handles, streams, or Buffer API. Root checks do not isolate the process from concurrent filesystem changes. Prefer narrow host operations when a script only needs a few files.

package/dist/safe-js/chunks/{chunk-BL5U2VOU.js → chunk-LWIWUCBZ.js}

@@ -27,7 +27,7 @@ import {
   validateMigrationSemantics,
   validateSnapshotData,
   validateSnapshotMigration
-} from "./chunk-CSC4EXIV.js";
+} from "./chunk-TNPFJ4XS.js";
 
 // packages/safe-js/src/migrate.ts
 import { createHash } from "node:crypto";
@@ -8245,4 +8245,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-BL5U2VOU.js.map
+//# sourceMappingURL=chunk-LWIWUCBZ.js.map

package/dist/safe-js/chunks/{chunk-CSC4EXIV.js → chunk-TNPFJ4XS.js}

@@ -25081,6 +25081,134 @@ function isObjectLike(value) {
   return typeof value === "object" && value !== null;
 }
 
+// packages/safe-js/src/interp/globals/object.ts
+function createObjectGlobal(methods, budget) {
+  const construct = ([value]) => {
+    if (value === null || value === void 0) {
+      budget.chargeDataUsage(1);
+      return /* @__PURE__ */ Object.create(null);
+    }
+    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
+    return value;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "Object",
+    length: 1,
+    call: construct,
+    construct
+  });
+  const properties = materializeFunctionProperties(constructor);
+  const prototype = properties.prototype;
+  Object.defineProperty(properties, "prototype", { writable: false });
+  for (const [name, method] of Object.entries(methods)) {
+    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
+  }
+  const prototypeMethods = {
+    toString: createSandboxClosure({
+      sandbox: true,
+      name: "toString",
+      length: 0,
+      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
+    }),
+    valueOf: createSandboxClosure({
+      sandbox: true,
+      name: "valueOf",
+      length: 0,
+      call: (_args, context) => {
+        const value = requireReceiver(context?.thisValue);
+        if (typeof value !== "object")
+          throw new TypeError("Object primitive boxing is not supported.");
+        return value;
+      }
+    }),
+    hasOwnProperty: createSandboxClosure({
+      sandbox: true,
+      name: "hasOwnProperty",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        false
+      )
+    }),
+    propertyIsEnumerable: createSandboxClosure({
+      sandbox: true,
+      name: "propertyIsEnumerable",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        true
+      )
+    }),
+    isPrototypeOf: createSandboxClosure({
+      sandbox: true,
+      name: "isPrototypeOf",
+      length: 1,
+      call: ([value], context) => {
+        if (typeof value !== "object" || value === null) return false;
+        const receiver = requireReceiver(context?.thisValue);
+        let depth = 0;
+        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+          budget.visitNode();
+          assertSandboxDataDepth(depth++);
+          if (current === receiver) return true;
+        }
+        return false;
+      }
+    })
+  };
+  for (const [name, method] of Object.entries(prototypeMethods)) {
+    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
+  }
+  markDescriptorObject(prototype);
+  installObjectPrototype(budget, prototype, constructor);
+  return constructor;
+}
+function requireReceiver(value) {
+  if (value === null || value === void 0)
+    throw new TypeError("Object method requires a non-null receiver.");
+  return value;
+}
+function hasOwnSandboxProperty(value, key, enumerable) {
+  requireReceiver(value);
+  if (isGuestHostObject(value)) return hasHostObjectMember(value, key, enumerable);
+  let properties;
+  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
+  else if (isSandboxClosure(value)) {
+    if (key === "length" || key === "name") return !enumerable;
+    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
+  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
+    return false;
+  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
+  else properties = Object(value);
+  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
+}
+function typeTag(value) {
+  if (value === void 0) return "Undefined";
+  if (value === null) return "Null";
+  if (typeof value === "string") return "String";
+  if (typeof value === "number") return "Number";
+  if (typeof value === "boolean") return "Boolean";
+  if (isSandboxClosure(value)) {
+    while (value.boundTarget !== void 0) value = value.boundTarget;
+    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
+  }
+  if (Array.isArray(value)) return "Array";
+  if (isSandboxDate(value)) return "Date";
+  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
+  if (isSandboxRegex(value)) return "RegExp";
+  if (isSandboxMap(value)) return "Map";
+  if (isSandboxSet(value)) return "Set";
+  if (isSandboxPromise(value)) return "Promise";
+  if (isSandboxGenerator(value)) return "Generator";
+  if (isFloat32Array(value)) return "Float32Array";
+  return "Object";
+}
+
 // packages/safe-js/src/interp/globals/collections.ts
 var mapConstructors = /* @__PURE__ */ new WeakSet();
 var setConstructors = /* @__PURE__ */ new WeakSet();
@@ -26083,11 +26211,14 @@ async function evaluateBinaryExpression(node, context) {
   if (right.kind !== "normal") {
     return right;
   }
-  const value = node.operator === "in" && isGuestHostObject(right.value) ? hasHostObjectMember(right.value, await sandboxString(left.value, context.budget, {
-    stack: context.callStack,
-    thisValue: void 0,
-    invokeClosure: (closure, args, thisValue) => invokeSandboxClosure(closure, args, context, context.callStack, void 0, thisValue)
-  })) : applyBinaryOperator(node, left.value, right.value, context);
+  let leftValue = left.value;
+  if (node.operator === "in") {
+    if (typeof right.value !== "object" || right.value === null) {
+      throw new TypeError("Right-hand side of 'in' must be an object.");
+    }
+    leftValue = await toPropertyKey(leftValue, context);
+  }
+  const value = applyBinaryOperator(node, leftValue, right.value, context);
   return {
     kind: "normal",
     hasValue: true,
@@ -27795,8 +27926,43 @@ function applyBinaryOperator(node, left, right, context) {
       }
       return false;
     case "in":
-      throw createError("UNSUPPORTED_NODE", node, "Binary operator 'in' is not supported.");
+      return hasSandboxProperty(right, left, context);
+  }
+}
+async function toPropertyKey(value, context) {
+  if (isPlainSandboxObject(value) && !isSandboxDate(value) && !isFloat32Array(value) && !isSandboxGenerator(value) && !isGuestHostObject(value)) {
+    for (const name of ["toString", "valueOf"]) {
+      const method = getMemberValue(value, name, context);
+      if (!isSandboxClosure(method)) continue;
+      const primitive = await invokeSandboxClosure(method, [], context, context.callStack, void 0, value);
+      if (primitive === null || typeof primitive !== "object") {
+        return context.budget.allocateString(String(primitive));
+      }
+    }
+    throw new TypeError("Cannot convert object to primitive value.");
+  }
+  return sandboxString(value, context.budget, {
+    stack: context.callStack,
+    thisValue: void 0,
+    invokeClosure: (closure, args, thisValue) => invokeSandboxClosure(closure, args, context, context.callStack, void 0, thisValue)
+  });
+}
+function hasSandboxProperty(value, key, context) {
+  let current = value;
+  let depth = 0;
+  while (typeof current === "object" && current !== null) {
+    if (isGuestHostObject(current)) return hasHostObjectMember(current, key);
+    if (hasOwnSandboxProperty(current, key, false)) return true;
+    if (Array.isArray(current) || !isPlainSandboxObject(current) || isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current)) {
+      return getPropertyValue(current, key, context) !== void 0;
+    }
+    current = getSandboxPrototype(current, context.budget);
+    if (current !== null) {
+      context.budget.visitNode();
+      assertSandboxDataDepth(++depth);
+    }
   }
+  return false;
 }
 async function applyCompoundAssignmentOperator(operator, left, right, context) {
   left = await toNumericPrimitive(left, context);
@@ -30094,134 +30260,6 @@ function assertStructuredCloneable(value, seen) {
   }
 }
 
-// packages/safe-js/src/interp/globals/object.ts
-function createObjectGlobal(methods, budget) {
-  const construct = ([value]) => {
-    if (value === null || value === void 0) {
-      budget.chargeDataUsage(1);
-      return /* @__PURE__ */ Object.create(null);
-    }
-    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
-    return value;
-  };
-  const constructor = createSandboxClosure({
-    guest: true,
-    sandbox: true,
-    name: "Object",
-    length: 1,
-    call: construct,
-    construct
-  });
-  const properties = materializeFunctionProperties(constructor);
-  const prototype = properties.prototype;
-  Object.defineProperty(properties, "prototype", { writable: false });
-  for (const [name, method] of Object.entries(methods)) {
-    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
-  }
-  const prototypeMethods = {
-    toString: createSandboxClosure({
-      sandbox: true,
-      name: "toString",
-      length: 0,
-      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
-    }),
-    valueOf: createSandboxClosure({
-      sandbox: true,
-      name: "valueOf",
-      length: 0,
-      call: (_args, context) => {
-        const value = requireReceiver(context?.thisValue);
-        if (typeof value !== "object")
-          throw new TypeError("Object primitive boxing is not supported.");
-        return value;
-      }
-    }),
-    hasOwnProperty: createSandboxClosure({
-      sandbox: true,
-      name: "hasOwnProperty",
-      length: 1,
-      call: async ([key], context) => hasOwnSandboxProperty(
-        requireReceiver(context?.thisValue),
-        await sandboxString(key, budget, context),
-        false
-      )
-    }),
-    propertyIsEnumerable: createSandboxClosure({
-      sandbox: true,
-      name: "propertyIsEnumerable",
-      length: 1,
-      call: async ([key], context) => hasOwnSandboxProperty(
-        requireReceiver(context?.thisValue),
-        await sandboxString(key, budget, context),
-        true
-      )
-    }),
-    isPrototypeOf: createSandboxClosure({
-      sandbox: true,
-      name: "isPrototypeOf",
-      length: 1,
-      call: ([value], context) => {
-        if (typeof value !== "object" || value === null) return false;
-        const receiver = requireReceiver(context?.thisValue);
-        let depth = 0;
-        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
-          budget.visitNode();
-          assertSandboxDataDepth(depth++);
-          if (current === receiver) return true;
-        }
-        return false;
-      }
-    })
-  };
-  for (const [name, method] of Object.entries(prototypeMethods)) {
-    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
-  }
-  markDescriptorObject(prototype);
-  installObjectPrototype(budget, prototype, constructor);
-  return constructor;
-}
-function requireReceiver(value) {
-  if (value === null || value === void 0)
-    throw new TypeError("Object method requires a non-null receiver.");
-  return value;
-}
-function hasOwnSandboxProperty(value, key, enumerable) {
-  requireReceiver(value);
-  if (isGuestHostObject(value)) return hasHostObjectMember(value, key, enumerable);
-  let properties;
-  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
-  else if (isSandboxClosure(value)) {
-    if (key === "length" || key === "name") return !enumerable;
-    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
-  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
-    return false;
-  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
-  else properties = Object(value);
-  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
-  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
-}
-function typeTag(value) {
-  if (value === void 0) return "Undefined";
-  if (value === null) return "Null";
-  if (typeof value === "string") return "String";
-  if (typeof value === "number") return "Number";
-  if (typeof value === "boolean") return "Boolean";
-  if (isSandboxClosure(value)) {
-    while (value.boundTarget !== void 0) value = value.boundTarget;
-    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
-  }
-  if (Array.isArray(value)) return "Array";
-  if (isSandboxDate(value)) return "Date";
-  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
-  if (isSandboxRegex(value)) return "RegExp";
-  if (isSandboxMap(value)) return "Map";
-  if (isSandboxSet(value)) return "Set";
-  if (isSandboxPromise(value)) return "Promise";
-  if (isSandboxGenerator(value)) return "Generator";
-  if (isFloat32Array(value)) return "Float32Array";
-  return "Object";
-}
-
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
@@ -32772,4 +32810,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-CSC4EXIV.js.map
+//# sourceMappingURL=chunk-TNPFJ4XS.js.map