poe-code 13.0.1 → 13.0.3

package/README.md

@@ -263,9 +263,9 @@ Uses `POE_API_KEY` or the stored credential and honors `POE_BASE_URL`. Throws an
 
 ### Shared filesystem foundation
 
-`poe-code@12.0.7` publishes the Node.js foundation at `poe-code/safe-fs`
+`poe-code@13.0.0` publishes the Node.js foundation at `poe-code/safe-fs`
 and shared filesystem integration for the SafeJS SDK and both CLIs.
-The installed release was verified on Node 18.18.2, 18.20.8, 20.20.0,
+The installed release was verified on Node 18.18.2, 18.20.8, 20.19.2, 20.20.0,
 22.22.2 and 24.14.0, including public runtime and TypeScript consumers.
 `@poe-code/safe-fs` is the private workspace name, not a public npm import.
 
@@ -280,8 +280,8 @@ const filesystem = new MemoryFileSystem();
 await filesystem.writeFile("/note", new TextEncoder().encode("hello"));
 ```
 
-The current source uses canonical SafeJS names; the versioned C verification
-above predates that rename. SafeJS accepts these adapters through
+Canonical SafeJS names shipped in `poe-code@12.0.8` and were reverified in
+`13.0.0`. SafeJS accepts these adapters through
 `makeFsModule({ adapter, root?, cwd?, signal? })`
 from `poe-code/safe-js`. The legacy `poe-code/safejs` routes and `poe-safejs` binary
 remain aliases to the identical canonical artifacts. Both `poe-safe-js` and `poe-code harness run` accept
@@ -290,7 +290,7 @@ legacy `--fs` and `--fs-root` options retain their Node-backed behavior.
 
 The default public entries target Node.js. Full browser runtime support,
 safe-bash runtime migration and removal of legacy adapter copies remain pending. Canonical and legacy
-SafeJS names share artifacts; publication is tracked in the rename plan.
+SafeJS names share the same published artifacts.
 The host-directory adapter is not race-proof OS isolation. See the
 [foundation documentation](packages/safe-fs/README.md) for configuration,
 capabilities and backend limitations.
@@ -318,6 +318,27 @@ in both pages and module workers on Chromium 149.0.7827.55, Firefox 150.0.2 and
 Playwright WebKit 26.4: 102 checks total, plus 11 negative browser-graph cases
 and 20 strict browser type profiles. This is FS-only coverage, not Safari
 certification, browser SafeJS execution or coverage of unreleased guest codecs.
+Those earlier checks did not establish WebDAV request-stream transport support.
+
+#### WebDAV streaming migration in 13.0.0
+
+Custom or bound Fetch functions must now declare `requestStreamSupport`:
+`"native"` for faithful current-realm native delegation, `true` for a trusted
+custom transport that preserves and consumes stream bodies, or `false` to
+disable streaming. Exact `globalThis.fetch` is probed automatically. Unknown
+transports reject with `ENOTSUP` before source acquisition or any DAV I/O;
+ordinary byte writes are unchanged. This is a programmatic adapter option,
+not a new environment variable, CLI flag or JSON configuration field. `true`
+is a host assertion, not protection against a dishonest transport.
+
+The actual `13.0.0` registry artifact passed 50 native Node HTTP controls and
+390 browser assertions across Chromium, Firefox and WebKit pages and workers,
+including 134 zero-source/no-I/O cases. Native Firefox/WebKit streaming safely
+rejects; genuine Chromium HTTP/2 streaming passes in the exercised deployment.
+Native Chromium HTTP/1 streaming remains unsupported. These are bounded FS
+transport results, not certification of every server or a browser SafeJS SDK.
+See the [WebDAV contract](packages/safe-fs/README.md#breaking-change-declare-custom-request-stream-support)
+and [release record](docs/plans/webdav-stream-capability-fix.md#verified-1300-publication--august-30-2026).
 
 Full browser SafeJS SDK/runtime support remains pending. Guest codec integration,
 portable SDK declaration closure and shared host-call policy/replay metadata

package/dist/index.js

@@ -138898,14 +138898,6 @@ function enterRunningState(object) {
     runningObjects.delete(object);
   };
 }
-function enterCollectionCallback(object) {
-  const leaveRunning = enterRunningState(object);
-  lockedCollections.add(object);
-  return () => {
-    lockedCollections.delete(object);
-    leaveRunning();
-  };
-}
 function assertCollectionMutable(object) {
   if (lockedCollections.has(object)) {
     throw new SandboxError("reentry");
@@ -143225,6 +143217,93 @@ var init_misc = __esm({
   }
 });
 
+// packages/safe-js/src/interp/string-coercion.ts
+function sandboxString(value, budget, context, joining = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "function") throw new TypeError("Expected a sandbox value.");
+    return budget.allocateString(String(value));
+  }
+  return stringifyObject2(value, budget, context, joining);
+}
+async function stringifyObject2(value, budget, context, joining) {
+  const leaveCall = budget.enterCall();
+  try {
+    budget.visitNode();
+    for (const name of ["toString", "valueOf"]) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, name);
+      let result;
+      if (descriptor === void 0) {
+        if (name === "valueOf") continue;
+        result = await defaultToString(value, budget, context, joining);
+      } else {
+        const hook = ownDataValue(value, name);
+        if (!isSandboxClosure(hook)) continue;
+        if (context?.invokeClosure === void 0) {
+          throw new TypeError("String hooks require a sandbox call context.");
+        }
+        result = await context.invokeClosure(hook, [], value);
+      }
+      if (result === null || typeof result !== "object") {
+        return sandboxString(result, budget, context, joining);
+      }
+    }
+    throw new TypeError("Cannot convert object to primitive value");
+  } finally {
+    leaveCall();
+  }
+}
+async function defaultToString(value, budget, context, joining) {
+  if (Array.isArray(value) || isFloat32Array(value)) {
+    if (Object.hasOwn(value, "join")) {
+      const join21 = ownDataValue(value, "join");
+      if (!isSandboxClosure(join21))
+        return isFloat32Array(value) ? "[object Float32Array]" : "[object Array]";
+      if (context?.invokeClosure === void 0) {
+        throw new TypeError("String hooks require a sandbox call context.");
+      }
+      return context.invokeClosure(join21, [], value);
+    }
+    if (joining.has(value)) return "";
+    joining.add(value);
+    try {
+      const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
+      let text5 = "";
+      for (let index = 0; index < length; index++) {
+        budget.visitNode();
+        const element = ownDataValue(value, String(index));
+        const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
+        text5 = budget.allocateString(text5 + (index === 0 ? "" : ",") + part);
+      }
+      return text5;
+    } finally {
+      joining.delete(value);
+    }
+  }
+  if (sandboxErrorTypes.has(value)) {
+    const nameValue = ownDataValue(value, "name");
+    const name = nameValue === void 0 ? "Error" : await sandboxString(nameValue, budget, context, joining);
+    const messageValue2 = ownDataValue(value, "message");
+    const message2 = messageValue2 === void 0 ? "" : await sandboxString(messageValue2, budget, context, joining);
+    return name === "" ? message2 : message2 === "" ? name : `${name}: ${message2}`;
+  }
+  return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
+}
+function ownDataValue(value, name) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, name);
+  if (descriptor !== void 0 && !Object.hasOwn(descriptor, "value")) {
+    throw new TypeError("String conversion requires sandbox data properties.");
+  }
+  return descriptor?.value;
+}
+var init_string_coercion = __esm({
+  "packages/safe-js/src/interp/string-coercion.ts"() {
+    "use strict";
+    init_shape();
+    init_float32();
+    init_values();
+  }
+});
+
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
@@ -143320,9 +143399,7 @@ function createObjectArrayGlobals(options) {
     }),
     String: createSandboxClosure({
       sandbox: true,
-      call: ([value]) => options.budget.allocateString(
-        typeof value === "object" && value !== null && sandboxErrorTypes.has(value) && !Object.hasOwn(value, "toString") ? Error.prototype.toString.call(value) : String(value)
-      ),
+      call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
       name: "String",
       properties: {
         raw: createSandboxClosure({
@@ -143538,10 +143615,10 @@ function getTemplateRawParts(template2) {
 var init_object_array = __esm({
   "packages/safe-js/src/interp/globals/object-array.ts"() {
     "use strict";
-    init_shape();
     init_float32();
     init_float32array2();
     init_iteration();
+    init_string_coercion();
     init_values();
   }
 });
@@ -143584,7 +143661,7 @@ async function callArrayMethod(value, methodName, args, options, stack = []) {
   if (isCallbackArrayMethod(methodName)) {
     let callbackState = activeArrayCallbacks.get(value);
     if (callbackState === void 0) {
-      callbackState = { depth: 0, leave: enterCollectionCallback(value) };
+      callbackState = { depth: 0, leave: enterRunningState(value) };
       activeArrayCallbacks.set(value, callbackState);
     }
     callbackState.depth += 1;
@@ -143835,42 +143912,63 @@ function getRequiredCallback(methodName, value) {
 async function mapArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   const result = new Array(length);
-  for (let index = 0; index < length; index += 1) {
-    if (!(index in value)) {
-      continue;
+  options.budget.setRetainedValues(result, () => [result]);
+  try {
+    for (let index = 0; index < length; index += 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      result[index] = await callArrayCallback(
+        callback,
+        value[index],
+        index,
+        value,
+        options,
+        stack,
+        thisValue
+      );
     }
-    result[index] = await callArrayCallback(
-      callback,
-      value[index],
-      index,
-      value,
-      options,
-      stack,
-      thisValue
-    );
+    return result;
+  } finally {
+    options.budget.setRetainedValues(result, void 0);
   }
-  return result;
 }
 async function filterArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   const result = [];
-  for (let index = 0; index < length; index += 1) {
-    if (!(index in value)) {
-      continue;
-    }
-    if (await callArrayCallback(callback, value[index], index, value, options, stack, thisValue)) {
-      result.push(value[index]);
+  options.budget.setRetainedValues(result, () => [result]);
+  try {
+    for (let index = 0; index < length; index += 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      const entry = value[index];
+      if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
+        result.push(entry);
+      }
     }
+    return result;
+  } finally {
+    options.budget.setRetainedValues(result, void 0);
   }
-  return result;
 }
 async function findInArray(value, callback, options, stack, thisValue) {
-  const index = await findIndexInArray(value, callback, options, stack, thisValue);
-  return index < 0 ? void 0 : value[index];
+  const length = value.length;
+  for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
+    const entry = index in value ? value[index] : void 0;
+    if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
+      return entry;
+    }
+  }
+  return void 0;
 }
 async function findIndexInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
     const entry = index in value ? value[index] : void 0;
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return index;
@@ -143881,6 +143979,7 @@ async function findIndexInArray(value, callback, options, stack, thisValue) {
 async function findLastInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = length - 1; index >= 0; index -= 1) {
+    options.budget.visitNode();
     const entry = index in value ? value[index] : void 0;
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return entry;
@@ -143891,6 +143990,7 @@ async function findLastInArray(value, callback, options, stack, thisValue) {
 async function findLastIndexInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = length - 1; index >= 0; index -= 1) {
+    options.budget.visitNode();
     const entry = index in value ? value[index] : void 0;
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return index;
@@ -143901,6 +144001,7 @@ async function findLastIndexInArray(value, callback, options, stack, thisValue)
 async function someInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
     if (!(index in value)) {
       continue;
     }
@@ -143913,6 +144014,7 @@ async function someInArray(value, callback, options, stack, thisValue) {
 async function everyInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
     if (!(index in value)) {
       continue;
     }
@@ -143924,10 +144026,10 @@ async function everyInArray(value, callback, options, stack, thisValue) {
 }
 async function reduceArray(value, callback, hasInitialValue, initialValue, options, stack) {
   const length = value.length;
-  const start = findNextDefinedIndex(value, 0, 1, length);
   if (hasInitialValue) {
-    return reduceFromLeft(value, callback, initialValue, start, length, options, stack);
+    return reduceFromLeft(value, callback, initialValue, 0, length, options, stack);
   }
+  const start = findNextDefinedIndex(value, 0, 1, length, options.budget);
   if (start < 0) {
     throw new TypeError("Reduce of empty array with no initial value.");
   }
@@ -143935,10 +144037,10 @@ async function reduceArray(value, callback, hasInitialValue, initialValue, optio
 }
 async function reduceRightArray(value, callback, hasInitialValue, initialValue, options, stack) {
   const length = value.length;
-  const start = findNextDefinedIndex(value, length - 1, -1, length);
   if (hasInitialValue) {
-    return reduceFromRight(value, callback, initialValue, start, length, options, stack);
+    return reduceFromRight(value, callback, initialValue, length - 1, length, options, stack);
   }
+  const start = findNextDefinedIndex(value, length - 1, -1, length, options.budget);
   if (start < 0) {
     throw new TypeError("Reduce of empty array with no initial value.");
   }
@@ -143946,27 +144048,42 @@ async function reduceRightArray(value, callback, hasInitialValue, initialValue,
 }
 async function reduceFromLeft(value, callback, accumulator, startIndex, length, options, stack) {
   let current = accumulator;
-  for (let index = startIndex; index < length; index += 1) {
-    if (!(index in value)) {
-      continue;
+  const retainedAccumulator = {};
+  options.budget.setRetainedValues(retainedAccumulator, () => [current]);
+  try {
+    for (let index = startIndex; index < length; index += 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      current = await options.callClosure(callback, [current, value[index], index, value], stack);
     }
-    current = await options.callClosure(callback, [current, value[index], index, value], stack);
+    return current;
+  } finally {
+    options.budget.setRetainedValues(retainedAccumulator, void 0);
   }
-  return current;
 }
 async function reduceFromRight(value, callback, accumulator, startIndex, length, options, stack) {
   let current = accumulator;
-  for (let index = Math.min(startIndex, length - 1); index >= 0; index -= 1) {
-    if (!(index in value)) {
-      continue;
+  const retainedAccumulator = {};
+  options.budget.setRetainedValues(retainedAccumulator, () => [current]);
+  try {
+    for (let index = Math.min(startIndex, length - 1); index >= 0; index -= 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      current = await options.callClosure(callback, [current, value[index], index, value], stack);
     }
-    current = await options.callClosure(callback, [current, value[index], index, value], stack);
+    return current;
+  } finally {
+    options.budget.setRetainedValues(retainedAccumulator, void 0);
   }
-  return current;
 }
 async function forEachArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
     if (!(index in value)) {
       continue;
     }
@@ -143976,33 +144093,40 @@ async function forEachArray(value, callback, options, stack, thisValue) {
 async function flatMapArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   const result = [];
-  for (let index = 0; index < length; index += 1) {
-    if (!(index in value)) {
-      continue;
-    }
-    const mapped = await callArrayCallback(
-      callback,
-      value[index],
-      index,
-      value,
-      options,
-      stack,
-      thisValue
-    );
-    if (Array.isArray(mapped)) {
-      for (let mappedIndex = 0; mappedIndex < mapped.length; mappedIndex += 1) {
-        if (!(mappedIndex in mapped)) {
-          continue;
+  options.budget.setRetainedValues(result, () => [result]);
+  try {
+    for (let index = 0; index < length; index += 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      const mapped = await callArrayCallback(
+        callback,
+        value[index],
+        index,
+        value,
+        options,
+        stack,
+        thisValue
+      );
+      if (Array.isArray(mapped)) {
+        for (let mappedIndex = 0; mappedIndex < mapped.length; mappedIndex += 1) {
+          options.budget.visitNode();
+          if (!(mappedIndex in mapped)) {
+            continue;
+          }
+          result.push(mapped[mappedIndex]);
+          options.budget.allocateArrayLength(result.length);
         }
-        result.push(mapped[mappedIndex]);
-        options.budget.allocateArrayLength(result.length);
+        continue;
       }
-      continue;
+      result.push(mapped);
+      options.budget.allocateArrayLength(result.length);
     }
-    result.push(mapped);
-    options.budget.allocateArrayLength(result.length);
+    return result;
+  } finally {
+    options.budget.setRetainedValues(result, void 0);
   }
-  return result;
 }
 function flattenArray(value, depth, budget) {
   const result = [];
@@ -144024,47 +144148,59 @@ function appendFlattenedEntries(value, depth, result, budget) {
   }
 }
 async function sortArray(value, comparator, options, stack) {
+  const length = value.length;
   const definedValues = [];
   let undefinedCount = 0;
-  for (let index = 0; index < value.length; index += 1) {
-    if (!(index in value)) {
-      continue;
+  let currentEntry;
+  options.budget.setRetainedValues(definedValues, () => [definedValues, currentEntry]);
+  try {
+    for (let index = 0; index < length; index += 1) {
+      options.budget.visitNode();
+      if (!(index in value)) {
+        continue;
+      }
+      const entry = value[index];
+      if (entry === void 0) {
+        undefinedCount += 1;
+        continue;
+      }
+      definedValues.push(entry);
     }
-    const entry = value[index];
-    if (entry === void 0) {
-      undefinedCount += 1;
-      continue;
+    for (let index = 1; index < definedValues.length; index += 1) {
+      currentEntry = definedValues[index];
+      let cursor2 = index - 1;
+      while (cursor2 >= 0 && await compareEntries(definedValues[cursor2], currentEntry, comparator, options, stack) > 0) {
+        definedValues[cursor2 + 1] = definedValues[cursor2];
+        cursor2 -= 1;
+      }
+      definedValues[cursor2 + 1] = currentEntry;
     }
-    definedValues.push(entry);
-  }
-  for (let index = 1; index < definedValues.length; index += 1) {
-    const entry = definedValues[index];
-    let cursor2 = index - 1;
-    while (cursor2 >= 0 && await compareEntries(definedValues[cursor2], entry, comparator, options, stack) > 0) {
-      definedValues[cursor2 + 1] = definedValues[cursor2];
-      cursor2 -= 1;
+    currentEntry = void 0;
+    for (let index = 0; index < definedValues.length; index += 1) {
+      value[index] = definedValues[index];
     }
-    definedValues[cursor2 + 1] = entry;
-  }
-  for (let index = 0; index < definedValues.length; index += 1) {
-    value[index] = definedValues[index];
-  }
-  for (let index = 0; index < undefinedCount; index += 1) {
-    value[definedValues.length + index] = void 0;
-  }
-  for (let index = definedValues.length + undefinedCount; index < value.length; index += 1) {
-    delete value[index];
+    for (let index = 0; index < undefinedCount; index += 1) {
+      value[definedValues.length + index] = void 0;
+    }
+    for (let index = definedValues.length + undefinedCount; index < length; index += 1) {
+      options.budget.visitNode();
+      delete value[index];
+    }
+  } finally {
+    options.budget.setRetainedValues(definedValues, void 0);
   }
 }
 async function compareEntries(left, right, comparator, options, stack) {
+  options.budget.visitNode();
   const result = Number(await options.callClosure(comparator, [left, right], stack));
   return Number.isNaN(result) ? 0 : result;
 }
 async function callArrayCallback(callback, value, index, array, options, stack, thisValue) {
   return options.callClosure(callback, [value, index, array], stack, thisValue);
 }
-function findNextDefinedIndex(value, startIndex, direction, length) {
+function findNextDefinedIndex(value, startIndex, direction, length, budget) {
   for (let index = startIndex; direction > 0 ? index < length : index >= 0; index += direction) {
+    budget.visitNode();
     if (index in value) {
       return index;
     }
@@ -147823,6 +147959,7 @@ async function invokeSandboxClosure(callee, args, context, stack, span, thisValu
       {
         stack,
         thisValue,
+        invokeClosure: (closure, argumentsList, receiver) => invokeSandboxClosure(closure, argumentsList, context, stack, span, receiver),
         ...span === void 0 ? {} : { span }
       }
     ]);
@@ -156468,7 +156605,7 @@ var init_package2 = __esm({
   "package.json"() {
     package_default2 = {
       name: "poe-code",
-      version: "13.0.1",
+      version: "13.0.3",
       description: "CLI tool to configure Poe API for developer workflows.",
       license: "MIT",
       type: "module",