poe-code 13.0.3 → 13.0.4

package/packages/safe-js/dist/interp/host-call.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
 import { cloneSandboxValue, createSandboxClosure, defineOwnDataProperty, isArrayIndexKey, measureSandboxData } from "./values.js";
+import { CompileScope } from "./regex/compile-guard.js";
 import { decodeReplayData, encodeReplayData } from "../snapshot/replay-data.js";
 import { validateSnapshotData } from "../snapshot/validation.js";
 import { pendingHostCallResumeIdentityMatches } from "../snapshot/policy.js";
@@ -35,6 +36,7 @@ export class HostCallJournal {
     sourceHash;
     resumeProvider;
     budget;
+    compileOwner;
     runId;
     nextCall = 1;
     records;
@@ -59,54 +61,71 @@ export class HostCallJournal {
             throw new UnresolvedReplayCapabilityError(id);
         return capability;
     };
-    constructor(sourceHash, records = [], resumeProvider, replay, budget) {
+    constructor(sourceHash, records = [], resumeProvider, replay, budget, compileOwner) {
         this.sourceHash = sourceHash;
         this.resumeProvider = resumeProvider;
         this.budget = budget;
-        this.recordedReplay = replay !== undefined;
-        if (replay !== undefined) {
-            const replayRecords = restoreReplayCalls(replay, this.encodedOutcomes, this.callbackSizes, this.requiredHostCapabilities);
-            const restoredRunId = replayRecords[0]?.runId ?? records[0]?.runId ?? randomUUID();
-            validateRestoredRecords(records, restoredRunId, sourceHash);
-            for (const record of records) {
-                const replayRecord = replayRecords[readCallOrdinal(record) - 1];
-                if (replayRecord === undefined ||
-                    !callIdentityMatches(record, replayRecord) ||
-                    record.lifecycle !== replayRecord.lifecycle) {
-                    throw new HostCallResumabilityError(record, "reset", `Host call ${record.id} conflicts with the replay journal; reset is required.`);
+        this.compileOwner = compileOwner;
+        const operation = budget?.acquireCompileOwner(false, compileOwner);
+        this.compileOwner = operation?.owner;
+        const compilation = new CompileScope(operation?.owner);
+        try {
+            this.recordedReplay = replay !== undefined;
+            if (replay !== undefined) {
+                const replayRecords = restoreReplayCalls(replay, this.encodedOutcomes, this.callbackSizes, this.requiredHostCapabilities, compilation);
+                const restoredRunId = replayRecords[0]?.runId ?? records[0]?.runId ?? randomUUID();
+                validateRestoredRecords(records, restoredRunId, sourceHash);
+                for (const record of records) {
+                    const replayRecord = replayRecords[readCallOrdinal(record) - 1];
+                    if (replayRecord === undefined ||
+                        !callIdentityMatches(record, replayRecord) ||
+                        record.lifecycle !== replayRecord.lifecycle) {
+                        throw new HostCallResumabilityError(record, "reset", `Host call ${record.id} conflicts with the replay journal; reset is required.`);
+                    }
                 }
+                records = replayRecords;
             }
-            records = replayRecords;
-        }
-        this.runId = records[0]?.runId ?? randomUUID();
-        this.records = records.map((record) => ({
-            ...record,
-            ...(record.functions === undefined ? {} : { functions: [...record.functions] }),
-            ...(record.callbacks === undefined ? {} : { callbacks: structuredClone(record.callbacks) }),
-            ...(record.outcome === undefined ? {} : { outcome: copyOutcome(record.outcome) })
-        }));
-        validateRestoredRecords(this.records, this.runId, sourceHash);
-        this.retainedSize = this.records.length;
-        try {
-            this.budget?.setRetainedDataUsage(this, this.retainedSize);
-            for (const record of this.records) {
-                if (record.outcome !== undefined)
-                    this.retainOutcome(record, record.outcome);
-                for (const [index, callback] of (record.callbacks ?? []).entries()) {
-                    this.retainedSize +=
-                        1 +
-                            (this.callbackSizes.get(`${record.id}/callback/${index + 1}`) ??
-                                measureSandboxData([decodeReplayData(callback.arguments)]));
+            this.runId = records[0]?.runId ?? randomUUID();
+            this.records = records.map((record) => ({
+                ...record,
+                ...(record.functions === undefined ? {} : { functions: [...record.functions] }),
+                ...(record.callbacks === undefined ? {} : { callbacks: structuredClone(record.callbacks) }),
+                ...(record.outcome === undefined ? {} : { outcome: copyOutcome(record.outcome) })
+            }));
+            validateRestoredRecords(this.records, this.runId, sourceHash);
+            this.retainedSize = this.records.length;
+            try {
+                this.budget?.setRetainedDataUsage(this, this.retainedSize);
+                for (const record of this.records) {
+                    if (record.outcome !== undefined)
+                        this.retainOutcome(record, record.outcome);
+                    for (const [index, callback] of (record.callbacks ?? []).entries()) {
+                        let size = this.callbackSizes.get(`${record.id}/callback/${index + 1}`);
+                        if (size === undefined) {
+                            const validation = new CompileScope(operation?.owner);
+                            try {
+                                size = measureSandboxData([decodeReplayData(callback.arguments, {}, validation)]);
+                            }
+                            finally {
+                                validation.dispose();
+                            }
+                        }
+                        this.retainedSize += 1 + size;
+                    }
                 }
+                this.budget?.setRetainedDataUsage(this, this.retainedSize);
             }
-            this.budget?.setRetainedDataUsage(this, this.retainedSize);
+            catch (error) {
+                this.dispose();
+                throw error;
+            }
+            this.restored = [...this.records];
+            this.budget?.setRetainedValues(this, () => this.capabilities.values());
         }
-        catch (error) {
-            this.dispose();
-            throw error;
+        finally {
+            compilation.dispose();
+            operation?.release();
         }
-        this.restored = [...this.records];
-        this.budget?.setRetainedValues(this, () => this.capabilities.values());
     }
     issue(input) {
         const restored = this.restored[0];
@@ -318,16 +337,17 @@ export class HostCallJournal {
         }
         return positions;
     }
-    retainOutcome(record, outcome) {
-        const size = measureSandboxData([outcome.status === "fulfilled" ? outcome.value : outcome.reason], { ignoreClosures: true });
+    retainOutcome(record, outcome, budget = this.budget) {
+        const included = new Set();
+        const size = measureSandboxData([outcome.status === "fulfilled" ? outcome.value : outcome.reason], { ignoreClosures: true, compileTickets: included });
         const retainedSize = this.retainedSize + size - (this.outcomeSizes.get(record.id) ?? 0);
-        this.budget?.setRetainedDataUsage(this, retainedSize);
+        budget?.reconcileCompileData(retainedSize, included, included, this);
         let copied;
         try {
             copied = copyOutcome(outcome);
         }
         catch (error) {
-            this.budget?.setRetainedDataUsage(this, this.retainedSize);
+            budget?.setRetainedDataUsage(this, this.retainedSize);
             throw error;
         }
         this.retainedSize = retainedSize;
@@ -340,10 +360,21 @@ export class HostCallJournal {
             return undefined;
         const encoded = this.encodedOutcomes.get(record.id);
         if (encoded !== undefined) {
-            const value = decodeReplayData(encoded.data, { resolveCapability: this.resolveCapability });
-            return encoded.status === "fulfilled"
-                ? { status: "fulfilled", value }
-                : { status: "rejected", reason: value };
+            const budget = this.compileOwner?.budget ?? this.budget;
+            const operation = budget?.acquireCompileOwner(false, this.compileOwner);
+            const compilation = new CompileScope(operation?.owner);
+            try {
+                const value = decodeReplayData(encoded.data, { resolveCapability: this.resolveCapability }, compilation);
+                const outcome = encoded.status === "fulfilled"
+                    ? { status: "fulfilled", value }
+                    : { status: "rejected", reason: value };
+                this.retainOutcome(record, outcome, budget);
+                return outcome;
+            }
+            finally {
+                compilation.dispose();
+                operation?.release();
+            }
         }
         const outcome = this.outcomes.get(record.id);
         return outcome === undefined ? undefined : copyOutcome(outcome);
@@ -376,7 +407,7 @@ function copyOutcome(outcome) {
         ? { status: "fulfilled", value: cloneSandboxValue(outcome.value) }
         : { status: "rejected", reason: cloneSandboxValue(outcome.reason) };
 }
-function restoreReplayCalls(input, encodedOutcomes, callbackSizes, requiredHostCapabilities = new Set()) {
+function restoreReplayCalls(input, encodedOutcomes, callbackSizes, requiredHostCapabilities = new Set(), compilation) {
     validateSnapshotData(input);
     if (input === null ||
         typeof input !== "object" ||
@@ -444,11 +475,19 @@ function restoreReplayCalls(input, encodedOutcomes, callbackSizes, requiredHostC
                     !Number.isSafeInteger(callback.id) ||
                     callback.id < 1 ||
                     !Number.isSafeInteger(callback.step) ||
-                    callback.step < previousStep ||
-                    !Array.isArray(decodeReplayData(callback.arguments, { resolveCapability })))
+                    callback.step < previousStep)
                     throw new TypeError("Invalid replay callback.");
                 previousStep = callback.step;
-                callbackSizes.set(`${entry.id}/callback/${index + 1}`, measureSandboxData([decodeReplayData(callback.arguments, { resolveCapability })]));
+                const validation = new CompileScope(compilation?.owner);
+                try {
+                    const args = decodeReplayData(callback.arguments, { resolveCapability }, validation);
+                    if (!Array.isArray(args))
+                        throw new TypeError("Invalid replay callback.");
+                    callbackSizes.set(`${entry.id}/callback/${index + 1}`, measureSandboxData([args]));
+                }
+                finally {
+                    validation.dispose();
+                }
             }
         }
         let outcome;
@@ -457,7 +496,7 @@ function restoreReplayCalls(input, encodedOutcomes, callbackSizes, requiredHostC
                 typeof entry.outcome !== "object" ||
                 !["fulfilled", "rejected"].includes(entry.outcome.status))
                 throw new TypeError("Invalid replay call outcome.");
-            const value = decodeReplayData(entry.outcome.data, { resolveCapability });
+            const value = decodeReplayData(entry.outcome.data, { resolveCapability }, compilation);
             encodedOutcomes.set(entry.id, structuredClone(entry.outcome));
             outcome =
                 entry.outcome.status === "fulfilled"

package/packages/safe-js/dist/interp/interpreter.d.ts

@@ -1,7 +1,8 @@
 import type { ParseResult, SourceSpan } from "../parse.js";
 import { type InterpreterYieldPoint } from "./async.js";
 import type { GeneratorCompletion } from "./generator.js";
-import { Budget } from "./budget.js";
+import { Budget, type CompileOwner } from "./budget.js";
+import { CompileScope } from "./regex/compile-guard.js";
 import { type SandboxValue } from "./values.js";
 import { Scope } from "./scope.js";
 export type InterpreterValue = SandboxValue;
@@ -41,6 +42,8 @@ export type InterpreterResult = {
     stats: InterpreterStats;
 };
 export type InterpretOptions = {
+    compilation?: CompileScope;
+    compileOwner?: CompileOwner;
     captureReplayState?: () => unknown;
     bindings?: Record<string, InterpreterValue>;
     budget?: Budget;

package/packages/safe-js/dist/interp/interpreter.js

@@ -6,6 +6,7 @@ import { attachErrorSpan, formatErrorStack, readErrorSpan, replaceErrorStack } f
 import { evaluateArrowFunctionExpression, evaluateFunctionExpression, evaluateAwaitExpression, emitResumeBreakpoint, createInterpretedClosure, normalizeClosureResult } from "./async.js";
 import { HostCallResumabilityError } from "./host-call.js";
 import { Budget, SandboxError } from "./budget.js";
+import { CompileScope, RegexCompileGuard } from "./regex/compile-guard.js";
 import { coerceThrownValue, createCapturedException, evaluateThrowStatement as evaluateThrowStatementResult, evaluateTryStatement as evaluateTryStatementResult, isCapturedException, surfaceThrownValue } from "./exceptions.js";
 import { callArrayMethod, getArrayMember, isArrayMethodName } from "./methods/array.js";
 import { getFunctionMember } from "./methods/function.js";
@@ -23,7 +24,7 @@ import { isSandboxErrorConstructor, isSandboxErrorConstructorInstance } from "./
 import { isSandboxMapConstructor, isSandboxSetConstructor } from "./globals/collections.js";
 import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
-import { createSandboxRegex, allocateProducedSandboxValue, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, measureSandboxData } from "./values.js";
+import { createSandboxRegex, allocateProducedSandboxValue, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, reconcileCompiledValues } from "./values.js";
 import { Scope } from "./scope.js";
 import { hoistVarDeclarations } from "./var-hoist.js";
 const taggedTemplateRawArrays = new WeakMap();
@@ -77,81 +78,90 @@ const dispatchTable = {
 };
 export async function interpret(node, options = {}) {
     const budget = options.budget ?? new Budget();
-    const scope = options.scope === undefined
-        ? new Scope(options.bindings, undefined, undefined, {
-            chargeData: false
-        }, options.snapshot?.bindings).child({}, { functionBoundary: true })
-        : options.useScopeDirectly === true && options.bindings === undefined
-            ? options.scope
-            : options.scope.child(options.bindings ?? {}, {
-                functionBoundary: true
-            });
-    const stats = { nodeVisits: 0 };
-    Object.defineProperties(stats, {
-        currentDataSize: { enumerable: false, value: 0, writable: true },
-        peakDataSize: { enumerable: false, value: 0, writable: true }
-    });
-    const activeLoopIterations = new Map();
-    const jobs = new SandboxJobQueue();
-    hoistVarDeclarations(node, scope);
-    const context = {
-        budget,
-        callStack: [],
-        onYield: options.onYield,
-        captureReplayState: options.captureReplayState,
-        rootNode: node,
-        scope,
-        signal: options.signal,
-        stats,
-        activeLoopIterations,
-        restoredLoopIterations: new Map(Object.entries(options.snapshot?.loopIterations ?? {}).map(([nodeId, iteration]) => [
-            Number(nodeId),
-            iteration
-        ])),
-        generatorResume: options.generatorResume,
-        generatorYield: options.generatorYield,
-        resumeTarget: { nodeId: options.snapshot?.resumeNodeId }
-    };
-    const evaluation = await withCancellationSignal(options.signal, () => jobs.run(() => evaluateNode(node, context)));
-    await jobs.drain();
-    const snapshot = scope.snapshot();
-    reconcileDataBudget(budget, stats, scope, "hasValue" in evaluation && evaluation.hasValue ? evaluation.value : undefined);
-    if (evaluation.kind === "error") {
-        return {
-            ok: false,
-            error: evaluation.error,
-            snapshot,
-            stats
+    const operation = budget.acquireCompileOwner(false, options.compileOwner ?? options.compilation?.owner);
+    const compilation = new CompileScope(operation.owner, options.compilation);
+    try {
+        const scope = options.scope === undefined
+            ? new Scope(options.bindings, undefined, undefined, {
+                chargeData: false
+            }, options.snapshot?.bindings).child({}, { functionBoundary: true })
+            : options.useScopeDirectly === true && options.bindings === undefined
+                ? options.scope
+                : options.scope.child(options.bindings ?? {}, {
+                    functionBoundary: true
+                });
+        const stats = { nodeVisits: 0 };
+        Object.defineProperties(stats, {
+            currentDataSize: { enumerable: false, value: 0, writable: true },
+            peakDataSize: { enumerable: false, value: 0, writable: true }
+        });
+        const activeLoopIterations = new Map();
+        const jobs = new SandboxJobQueue();
+        hoistVarDeclarations(node, scope);
+        const context = {
+            compilation,
+            budget,
+            callStack: [],
+            onYield: options.onYield,
+            captureReplayState: options.captureReplayState,
+            rootNode: node,
+            scope,
+            signal: options.signal,
+            stats,
+            activeLoopIterations,
+            restoredLoopIterations: new Map(Object.entries(options.snapshot?.loopIterations ?? {}).map(([nodeId, iteration]) => [
+                Number(nodeId),
+                iteration
+            ])),
+            generatorResume: options.generatorResume,
+            generatorYield: options.generatorYield,
+            resumeTarget: { nodeId: options.snapshot?.resumeNodeId }
         };
-    }
-    if (evaluation.kind === "throw") {
-        if (options.surfaceUnhandledThrows === true) {
-            throw surfaceThrownValue(evaluation.value, budget, evaluation.stackFrames, evaluation.span);
+        const evaluation = await withCancellationSignal(options.signal, () => jobs.run(() => evaluateNode(node, context)));
+        await jobs.drain();
+        const snapshot = scope.snapshot();
+        reconcileDataBudget(budget, stats, scope, "hasValue" in evaluation && evaluation.hasValue ? evaluation.value : undefined, compilation, options.compilation);
+        if (evaluation.kind === "error") {
+            return {
+                ok: false,
+                error: evaluation.error,
+                snapshot,
+                stats
+            };
+        }
+        if (evaluation.kind === "throw") {
+            if (options.surfaceUnhandledThrows === true) {
+                throw surfaceThrownValue(evaluation.value, budget, evaluation.stackFrames, evaluation.span);
+            }
+            throw evaluation.value;
+        }
+        if ((evaluation.kind === "break" || evaluation.kind === "continue") &&
+            evaluation.label !== undefined) {
+            return {
+                ok: false,
+                error: createError("LABEL_NOT_FOUND", evaluation.node ?? node, `Label '${evaluation.label}' not found`),
+                snapshot,
+                stats
+            };
+        }
+        if (evaluation.hasValue) {
+            return {
+                ok: true,
+                returnValue: evaluation.value,
+                snapshot,
+                stats
+            };
         }
-        throw evaluation.value;
-    }
-    if ((evaluation.kind === "break" || evaluation.kind === "continue") &&
-        evaluation.label !== undefined) {
-        return {
-            ok: false,
-            error: createError("LABEL_NOT_FOUND", evaluation.node ?? node, `Label '${evaluation.label}' not found`),
-            snapshot,
-            stats
-        };
-    }
-    if (evaluation.hasValue) {
         return {
             ok: true,
-            returnValue: evaluation.value,
             snapshot,
             stats
         };
     }
-    return {
-        ok: true,
-        snapshot,
-        stats
-    };
+    finally {
+        compilation.dispose();
+        operation.release();
+    }
 }
 export { Scope } from "./scope.js";
 async function evaluateNode(node, context) {
@@ -171,9 +181,20 @@ async function evaluateNode(node, context) {
             error: createError("UNSUPPORTED_NODE", node, `Unsupported AST node type '${node.type}'.`)
         };
     }
+    const compilation = new CompileScope(context.compilation?.owner, context.compilation);
+    const evaluationContext = {
+        ...context,
+        compilation,
+        get generatorResume() {
+            return context.generatorResume;
+        },
+        set generatorResume(value) {
+            context.generatorResume = value;
+        }
+    };
     try {
-        const result = await handler(node, context);
-        reconcileDataBudget(context.budget, context.stats, context.scope, "hasValue" in result && result.hasValue ? result.value : undefined);
+        const result = await handler(node, evaluationContext);
+        reconcileDataBudget(context.budget, context.stats, context.scope, "hasValue" in result && result.hasValue ? result.value : undefined, compilation, context.compilation);
         return result;
     }
     catch (error) {
@@ -193,6 +214,7 @@ async function evaluateNode(node, context) {
         const exception = isCapturedException(error)
             ? coerceThrownValue(error.reason, context.budget, error.stackFrames, node.span, error.sandbox)
             : coerceThrownValue(error, context.budget, context.callStack, node.span, true);
+        reconcileDataBudget(context.budget, context.stats, context.scope, exception, compilation, context.compilation);
         return {
             kind: "throw",
             hasValue: true,
@@ -201,9 +223,12 @@ async function evaluateNode(node, context) {
             value: exception
         };
     }
+    finally {
+        compilation.dispose();
+    }
 }
-function reconcileDataBudget(budget, stats, scope, transient) {
-    budget.reconcileDataUsage(measureSandboxData([...scope.retainedValues(), ...budget.retainedValues(), transient]));
+function reconcileDataBudget(budget, stats, scope, transient, compilation, parent) {
+    reconcileCompiledValues(budget, [...scope.retainedValues(), ...budget.retainedValues(), transient], compilation, parent, [transient]);
     stats.currentDataSize = budget.currentDataSize;
     stats.peakDataSize = budget.peakDataSize;
 }
@@ -215,13 +240,23 @@ async function evaluatePrimitiveLiteral(node, context) {
         value
     };
 }
-async function evaluateRegexLiteral(node, _context) {
+async function evaluateRegexLiteral(node, context) {
     const lastSlash = node.raw.lastIndexOf("/");
-    return {
-        kind: "normal",
-        hasValue: true,
-        value: createSandboxRegex(node.raw.slice(1, lastSlash), node.raw.slice(lastSlash + 1))
-    };
+    const guard = new RegexCompileGuard(context.compilation);
+    try {
+        guard.checkLength(Math.max(0, lastSlash - 1));
+        guard.checkLength(node.raw.length - lastSlash - 1, true);
+        guard.allocate(Math.max(0, node.raw.length - 2));
+        guard.work(Math.max(0, node.raw.length - 2));
+        return {
+            kind: "normal",
+            hasValue: true,
+            value: createSandboxRegex(node.raw.slice(1, lastSlash), node.raw.slice(lastSlash + 1), 0, context.compilation)
+        };
+    }
+    finally {
+        guard.close();
+    }
 }
 async function evaluateEmptyStatement(_node, _context) {
     return {
@@ -1836,7 +1871,7 @@ async function evaluateStringMethodCall(node, target, methodName, context) {
         return {
             kind: "normal",
             hasValue: true,
-            value: await callStringMethod(target, methodName, args.value, context.budget, (closure, closureArgs) => invokeSandboxClosure(closure, closureArgs, context, context.callStack))
+            value: await callStringMethod(target, methodName, args.value, context.budget, (closure, closureArgs) => invokeSandboxClosure(closure, closureArgs, context, context.callStack), context.compilation)
         };
     }
     catch (error) {
@@ -2333,6 +2368,7 @@ async function invokeSandboxClosure(callee, args, context, stack, span, thisValu
             {
                 stack,
                 thisValue,
+                compilation: context.compilation,
                 invokeClosure: (closure, argumentsList, receiver) => invokeSandboxClosure(closure, argumentsList, context, stack, span, receiver),
                 ...(span === undefined ? {} : { span })
             }

package/packages/safe-js/dist/interp/methods/string.d.ts

@@ -1,9 +1,10 @@
 import type { Expression } from "../../parse.js";
 import { Budget } from "../budget.js";
+import { CompileScope } from "../regex/compile-guard.js";
 import { type SandboxClosure, type SandboxValue } from "../values.js";
 type StringMethodName = "at" | "charAt" | "charCodeAt" | "codePointAt" | "concat" | "endsWith" | "includes" | "indexOf" | "lastIndexOf" | "localeCompare" | "match" | "matchAll" | "normalize" | "padEnd" | "padStart" | "repeat" | "replace" | "replaceAll" | "slice" | "search" | "split" | "startsWith" | "substr" | "substring" | "toLowerCase" | "toUpperCase" | "trim" | "trimEnd" | "trimStart";
 export declare function getStringMember(value: string, property: string | number, budget: Budget): SandboxValue | undefined;
 export declare function isStringMethodName(property: string | number): property is StringMethodName;
 export declare function validateStringMethodArguments(_methodName: StringMethodName, _args: readonly Expression[]): void;
-export declare function callStringMethod(value: string, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>): SandboxValue | Promise<SandboxValue>;
+export declare function callStringMethod(value: string, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, parent?: CompileScope): SandboxValue | Promise<SandboxValue>;
 export {};