poe-code 13.0.3 → 13.0.5

package/packages/safe-js/dist/interp/regex/parse.js

@@ -1,20 +1,37 @@
-export function parseRegex(source, flags = "") {
-    const parsedFlags = parseFlags(flags);
-    const parser = new RegexParser(source);
-    const body = parser.parse();
-    return {
-        source,
-        flags: parsedFlags,
-        captureCount: parser.captureCount,
-        body
-    };
+import { RegexCompileGuard } from "./compile-guard.js";
+export function parseRegex(source, flags = "", compilation, valueUnits = 0) {
+    const guard = new RegexCompileGuard(compilation);
+    try {
+        guard.checkLength(source.length);
+        guard.checkLength(flags.length, true);
+        guard.allocate(5 + valueUnits);
+        const parsedFlags = parseFlags(flags, guard);
+        const parser = new RegexParser(source, guard);
+        const body = parser.parse();
+        guard.allocate(5 + source.length);
+        const pattern = { source, flags: parsedFlags, captureCount: parser.captureCount, body };
+        guard.retain(pattern, valueUnits);
+        return pattern;
+    }
+    finally {
+        guard.close();
+    }
 }
 class RegexParser {
     source;
+    guard;
     captureCount = 0;
-    position = 0;
-    constructor(source) {
+    cursor = 0;
+    constructor(source, guard) {
         this.source = source;
+        this.guard = guard;
+    }
+    get position() {
+        return this.cursor;
+    }
+    set position(next) {
+        this.guard.work(Math.max(0, next - this.cursor));
+        this.cursor = next;
     }
     parse() {
         const body = this.parseAlternation();
@@ -27,22 +44,34 @@ class RegexParser {
         return body;
     }
     parseAlternation() {
+        this.guard.allocate(1);
+        this.guard.array(1);
         const alternatives = [this.parseSequence()];
         while (this.peek() === "|") {
             this.position += 1;
+            this.guard.array(alternatives.length + 1);
             alternatives.push(this.parseSequence());
         }
-        return alternatives.length === 1 ? alternatives[0] : { type: "alternation", alternatives };
+        if (alternatives.length === 1)
+            return alternatives[0];
+        this.guard.allocate(3);
+        return { type: "alternation", alternatives };
     }
     parseSequence() {
+        this.guard.allocate(1);
         const elements = [];
         while (!this.atEnd() && this.peek() !== ")" && this.peek() !== "|") {
+            this.guard.array(elements.length + 1);
             elements.push(this.parseQuantifiedAtom());
         }
         if (elements.length === 0) {
+            this.guard.allocate(2);
             return { type: "empty" };
         }
-        return elements.length === 1 ? elements[0] : { type: "sequence", elements };
+        if (elements.length === 1)
+            return elements[0];
+        this.guard.allocate(3);
+        return { type: "sequence", elements };
     }
     parseQuantifiedAtom() {
         const quantifierStart = this.position;
@@ -62,16 +91,20 @@ class RegexParser {
         if (!greedy) {
             this.position += 1;
         }
+        this.guard.allocate(Object.hasOwn(quantifier, "max") ? 6 : 5);
         return { type: "quantifier", body, ...quantifier, greedy };
     }
     parseAtom() {
         const character = this.take();
         switch (character) {
             case ".":
+                this.guard.allocate(2);
                 return { type: "dot" };
             case "^":
+                this.guard.allocate(3);
                 return { type: "anchor", kind: "start" };
             case "$":
+                this.guard.allocate(3);
                 return { type: "anchor", kind: "end" };
             case "(":
                 return this.parseGroup(this.position - 1);
@@ -80,12 +113,15 @@ class RegexParser {
             case "\\":
                 return this.parseEscape(false, this.position - 1);
             default:
+                this.guard.allocate(3 + character.length);
                 return { type: "literal", value: character };
         }
     }
     parseGroup(start) {
         let capturing = true;
         if (this.peek() === "?") {
+            this.guard.allocate(Math.min(3, this.source.length - this.position));
+            this.guard.work(Math.min(3, this.source.length - this.position));
             const extension = this.source.slice(this.position, this.position + 3);
             if (extension.startsWith("?:")) {
                 capturing = false;
@@ -104,12 +140,22 @@ class RegexParser {
                 this.fail("Unsupported group construct", start);
             }
         }
+        if (capturing)
+            this.guard.allocate(1);
         const index = capturing ? ++this.captureCount : undefined;
-        const body = this.parseAlternation();
+        this.guard.enterGroup();
+        let body;
+        try {
+            body = this.parseAlternation();
+        }
+        finally {
+            this.guard.leaveGroup();
+        }
         if (this.peek() !== ")") {
             this.fail("Unterminated group", start);
         }
         this.position += 1;
+        this.guard.allocate(5);
         return { type: "group", capturing, index, body };
     }
     parseCharacterClass(start) {
@@ -117,12 +163,15 @@ class RegexParser {
         if (negated) {
             this.position += 1;
         }
+        this.guard.allocate(1);
         const items = [];
         while (!this.atEnd()) {
             if (this.peek() === "]") {
                 this.position += 1;
+                this.guard.allocate(4);
                 return { type: "characterClass", negated, items };
             }
+            this.guard.array(items.length + 1);
             const left = this.parseClassItem(start);
             if (this.peek() === "-" && this.source[this.position + 1] !== "]") {
                 const rangePosition = this.position;
@@ -134,6 +183,7 @@ class RegexParser {
                 if (left.value.charCodeAt(0) > right.value.charCodeAt(0)) {
                     this.fail("Character class range is out of order", rangePosition);
                 }
+                this.guard.allocate(4 + left.value.length + right.value.length);
                 items.push({ type: "range", from: left.value, to: right.value });
             }
             else {
@@ -151,6 +201,7 @@ class RegexParser {
             this.position += 1;
             const escaped = this.parseEscape(true, escapeStart);
             if (escaped.type === "literal") {
+                this.guard.allocate(3 + escaped.value.length);
                 return { type: "character", value: escaped.value };
             }
             if (escaped.type === "characterClass" && escaped.items.length === 1) {
@@ -158,6 +209,7 @@ class RegexParser {
             }
             this.fail("Unsupported character class escape", escapeStart);
         }
+        this.guard.allocate(4);
         return { type: "character", value: this.take() };
     }
     parseEscape(inCharacterClass, start) {
@@ -172,11 +224,14 @@ class RegexParser {
             this.fail("Unicode property escapes are not supported", start);
         }
         if (escaped === "x") {
+            this.guard.allocate(4);
             return { type: "literal", value: this.parseHexEscape(2, "hexadecimal", start) };
         }
         if (escaped === "u") {
+            this.guard.allocate(4);
             return { type: "literal", value: this.parseHexEscape(4, "Unicode", start) };
         }
+        this.guard.allocate(25);
         const kinds = {
             d: { kind: "digit", negated: false },
             D: { kind: "digit", negated: true },
@@ -187,11 +242,15 @@ class RegexParser {
         };
         const kind = kinds[escaped];
         if (kind !== undefined) {
+            this.guard.allocate(9);
+            this.guard.array(1);
             return { type: "characterClass", negated: false, items: [{ type: "kind", ...kind }] };
         }
         if (!inCharacterClass && (escaped === "b" || escaped === "B")) {
+            this.guard.allocate(3);
             return { type: "wordBoundary", negated: escaped === "B" };
         }
+        this.guard.allocate(8);
         const controls = {
             b: "\b",
             f: "\f",
@@ -201,10 +260,13 @@ class RegexParser {
             v: "\v",
             "0": "\0"
         };
+        this.guard.allocate(4);
         return { type: "literal", value: controls[escaped] ?? escaped };
     }
     parseHexEscape(length, name, start) {
         const end = this.position + length;
+        this.guard.allocate(Math.min(length, this.source.length - this.position));
+        this.guard.work(Math.min(length, this.source.length - this.position));
         const digits = this.source.slice(this.position, end);
         if (digits.length !== length || !allHexDigits(digits)) {
             this.fail(`Invalid ${name} escape`, start);
@@ -216,14 +278,17 @@ class RegexParser {
         const character = this.peek();
         if (character === "*") {
             this.position += 1;
+            this.guard.allocate(2);
             return { min: 0 };
         }
         if (character === "+") {
             this.position += 1;
+            this.guard.allocate(2);
             return { min: 1 };
         }
         if (character === "?") {
             this.position += 1;
+            this.guard.allocate(3);
             return { min: 0, max: 1 };
         }
         if (character !== "{") {
@@ -238,6 +303,7 @@ class RegexParser {
         }
         if (this.peek() === "}") {
             this.position += 1;
+            this.guard.allocate(3);
             return { min, max: min };
         }
         if (this.peek() !== ",") {
@@ -252,6 +318,7 @@ class RegexParser {
         if (max !== undefined && min > max) {
             this.fail("Quantifier range is out of order", start);
         }
+        this.guard.allocate(3);
         return { min, max };
     }
     parseDecimal() {
@@ -262,6 +329,8 @@ class RegexParser {
         if (start === this.position) {
             return undefined;
         }
+        this.guard.allocate(this.position - start);
+        this.guard.work(this.position - start);
         const value = Number(this.source.slice(start, this.position));
         if (!Number.isSafeInteger(value)) {
             this.fail("Quantifier is too large", start);
@@ -283,7 +352,8 @@ class RegexParser {
         throw new SyntaxError(`${message} at position ${position}`);
     }
 }
-function parseFlags(flags) {
+function parseFlags(flags, guard) {
+    guard.allocate(10);
     const parsed = {
         global: false,
         ignoreCase: false,
@@ -297,6 +367,7 @@ function parseFlags(flags) {
         s: "dotAll"
     };
     for (let position = 0; position < flags.length; position += 1) {
+        guard.work(1);
         const flag = flags[position];
         const name = names[flag];
         if (name === undefined) {

package/packages/safe-js/dist/interp/values.d.ts

@@ -1,4 +1,5 @@
-import type { Budget } from "./budget.js";
+import type { Budget, CompileTicket } from "./budget.js";
+import { CompileScope } from "./regex/compile-guard.js";
 import type { GeneratorChannel } from "./generator.js";
 import { type RegexPattern } from "./regex/parse.js";
 export { createSandboxArguments, isSandboxArguments } from "./arguments.js";
@@ -35,6 +36,7 @@ export type SandboxRegex = {
     readonly [sandboxRegexPattern]: RegexPattern;
 };
 export type SandboxCallContext = {
+    readonly compilation?: CompileScope;
     readonly span?: {
         readonly end: {
             readonly column: number;
@@ -84,6 +86,7 @@ export type SandboxGenerator = {
 };
 type CopyFromSandboxOptions = {
     wrapClosure?: (value: SandboxClosure) => unknown;
+    compilation?: CompileScope;
 };
 export declare function createSandboxClosure(input: {
     async?: boolean;
@@ -110,7 +113,7 @@ export declare function createSandboxGenerator(channel: GeneratorChannel, metada
 } | undefined): SandboxGenerator;
 export declare function createSandboxMap(entries?: Iterable<readonly [SandboxValue, SandboxValue]>): SandboxMap;
 export declare function createSandboxSet(values?: Iterable<SandboxValue>): SandboxSet;
-export declare function createSandboxRegex(source: string, flags?: string, lastIndex?: number): SandboxRegex;
+export declare function createSandboxRegex(source: string, flags?: string, lastIndex?: number, compilation?: CompileScope): SandboxRegex;
 export declare function getSandboxRegexPattern(regex: SandboxRegex): RegexPattern;
 export declare function isSandboxClosure(value: unknown): value is SandboxClosure;
 export declare function isSandboxMap(value: unknown): value is SandboxMap;
@@ -124,7 +127,9 @@ export declare function allocateProducedSandboxValue(value: SandboxValue, budget
 export declare function measureSandboxData(values: Iterable<unknown>, options?: {
     ignoreClosures?: boolean;
     ignoreClosureCaptures?: boolean;
+    compileTickets?: Set<CompileTicket>;
 }): number;
+export declare function reconcileCompiledValues(budget: Budget, values: Iterable<unknown>, compilation?: CompileScope, parent?: CompileScope, escaping?: Iterable<unknown>): void;
 export declare function deepCopyFromSandbox(value: SandboxPromise, options?: CopyFromSandboxOptions): Promise<unknown>;
 export declare function deepCopyFromSandbox(value: SandboxValue, options?: CopyFromSandboxOptions): unknown;
 export declare function defineOwnDataProperty(target: object, key: string, value: unknown): void;

package/packages/safe-js/dist/interp/values.js

@@ -1,4 +1,6 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
+import { types as nodeTypes } from "node:util";
+import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
 import { copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
 import { SandboxError } from "./budget.js";
 import { observeSandboxPromise, trackSandboxPromise } from "./promise-tracker.js";
@@ -142,11 +144,15 @@ export function createSandboxSet(values = []) {
     });
     return Object.freeze(set);
 }
-export function createSandboxRegex(source, flags = "", lastIndex = 0) {
+export function createSandboxRegex(source, flags = "", lastIndex = 0, compilation) {
+    if (typeof source !== "string" || typeof flags !== "string") {
+        throw new TypeError("Invalid sandbox RegExp source or flags: expected own string data properties.");
+    }
+    const pattern = parseRegex(source, flags, compilation, 7 + source.length + flags.length);
     const regex = { kind: "regex", source, flags, lastIndex };
     Object.defineProperties(regex, {
         [sandboxRegexBrand]: { value: true },
-        [sandboxRegexPattern]: { value: parseRegex(source, flags) }
+        [sandboxRegexPattern]: { value: pattern }
     });
     return Object.seal(regex);
 }
@@ -254,7 +260,14 @@ export function measureSandboxData(values, options = {}) {
         if (isSandboxPromise(value))
             return;
         if (isSandboxRegex(value)) {
-            usage += value.source.length + value.flags.length;
+            const { source, flags } = captureRegexData(value);
+            const compiled = regexCompiledData(getSandboxRegexPattern(value));
+            const staged = compiled.ticket === undefined
+                ? 0
+                : compiled.ticket.owner.budget.compileTicketUsage(compiled.ticket);
+            usage += Math.max(6 + source.length + flags.length + compiled.units, staged - 1);
+            if (compiled.ticket !== undefined)
+                options.compileTickets?.add(compiled.ticket);
             return;
         }
         const entries = isSandboxArguments(value)
@@ -272,6 +285,43 @@ export function measureSandboxData(values, options = {}) {
         visit(value);
     return usage;
 }
+export function reconcileCompiledValues(budget, values, compilation, parent, escaping = []) {
+    while (parent?.closed)
+        parent = parent.parent;
+    const included = new Set();
+    const usage = measureSandboxData(values, { compileTickets: included });
+    const kept = new Set();
+    if (parent !== undefined)
+        measureSandboxData(escaping, { compileTickets: kept });
+    const transferred = new Set();
+    for (const ticket of included) {
+        if (!kept.has(ticket)) {
+            transferred.add(ticket);
+        }
+    }
+    const retained = budget.reconcileCompileData(usage, included, transferred, undefined, parent === undefined);
+    for (const ticket of retained)
+        compilation?.tickets.delete(ticket);
+    if (compilation !== undefined && parent !== undefined)
+        compilation.forward(included, parent);
+}
+function captureRegexData(value) {
+    const source = Object.getOwnPropertyDescriptor(value, "source");
+    const flags = Object.getOwnPropertyDescriptor(value, "flags");
+    if (source === undefined ||
+        !("value" in source) ||
+        typeof source.value !== "string" ||
+        flags === undefined ||
+        !("value" in flags) ||
+        typeof flags.value !== "string") {
+        throw new TypeError("Invalid sandbox RegExp source or flags: expected own string data properties.");
+    }
+    const cursor = Object.getOwnPropertyDescriptor(value, "lastIndex");
+    if (cursor === undefined || !("value" in cursor)) {
+        throw new TypeError("Invalid sandbox RegExp lastIndex: expected an own data property.");
+    }
+    return { source: source.value, flags: flags.value, lastIndex: cursor.value };
+}
 export function deepCopyFromSandbox(value, options = {}) {
     return copyFromSandbox(value, {
         seen: new WeakMap()
@@ -411,6 +461,31 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (isSandboxPrimitive(value)) {
         return value;
     }
+    if (nodeTypes.isProxy(value))
+        throw new TypeError("Unsupported proxy sandbox value.");
+    const regexBrand = Object.getOwnPropertyDescriptor(value, sandboxRegexBrand);
+    if (regexBrand !== undefined) {
+        if (!("value" in regexBrand) || regexBrand.value !== true) {
+            throw new TypeError("Invalid sandbox RegExp brand.");
+        }
+        const { source, flags, lastIndex } = captureRegexData(value);
+        const guard = new RegexCompileGuard(options.compilation);
+        try {
+            guard.preflight(source, flags);
+            const existing = state.seen.get(value);
+            if (existing !== undefined)
+                return existing;
+            guard.allocate(1 + source.length + flags.length);
+            const regex = new RegExp(source, flags);
+            regex.lastIndex = lastIndex;
+            guard.retainScratch();
+            state.seen.set(value, regex);
+            return regex;
+        }
+        finally {
+            guard.close();
+        }
+    }
     if (isFloat32Array(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -441,17 +516,28 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     }
     if (isSandboxPromise(value)) {
         observeSandboxPromise(value);
-        return value.promise.then((resolved) => copyFromSandbox(resolved, { seen: new WeakMap() }, "<root>", options), (reason) => Promise.reject(reason instanceof SandboxError
-            ? reason
-            : copyFromSandbox(reason, { seen: new WeakMap() }, "<root>", options)));
+        const copySettlement = (settled) => {
+            const owner = options.compilation?.owner;
+            const operation = owner?.budget.acquireCompileOwner(false, owner);
+            const compilation = new CompileScope(operation?.owner);
+            try {
+                return copyFromSandbox(settled, { seen: new WeakMap() }, "<root>", {
+                    ...options,
+                    compilation
+                });
+            }
+            finally {
+                compilation.dispose();
+                operation?.release();
+            }
+        };
+        return value.promise.then(copySettlement, (reason) => Promise.reject(reason instanceof SandboxError ? reason : copySettlement(reason)));
     }
     if (isSandboxGenerator(value)) {
         throw new TypeError("Sandbox generators cannot cross into host values.");
     }
     if (isSandboxRegex(value)) {
-        const regex = new RegExp(value.source, value.flags);
-        regex.lastIndex = value.lastIndex;
-        return regex;
+        throw new TypeError("Invalid sandbox RegExp brand.");
     }
     if (isSandboxMap(value)) {
         const existing = state.seen.get(value);

package/packages/safe-js/dist/modules/registry.d.ts

@@ -1,4 +1,4 @@
-import type { Budget } from "../interp/budget.js";
+import type { Budget, CompileOwner } from "../interp/budget.js";
 import type { HostCallJournal } from "../interp/host-call.js";
 import { type CallerInjectedBinding } from "../interp/host-bridge.js";
 import type { SandboxValue } from "../interp/values.js";
@@ -9,6 +9,7 @@ export declare function createUnknownModuleMessage(moduleName: string, moduleNam
 export declare function createUnknownExportMessage(moduleName: string, exportName: string, availableExports: readonly string[]): string;
 export declare function resolveModuleImports(module: Module, modules: ModuleRegistry | undefined, options: {
     budget: Budget;
+    compileOwner?: CompileOwner;
     hostCalls?: HostCallJournal;
     signal?: AbortSignal;
     allowMissing?: boolean;

package/packages/safe-js/dist/modules/registry.js

@@ -37,6 +37,7 @@ function bindImportDeclaration(declaration, registry, wrappedModules, bindings,
     const wrappedExports = wrappedModules.get(moduleName) ??
         createBindingRecord(wrapCancelableBindings(wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
             budget: options.budget,
+            compileOwner: options.compileOwner,
             hostCalls: options.hostCalls,
             moduleId: moduleName,
             signal: options.signal

package/packages/safe-js/dist/parse/hash.d.ts

@@ -1,3 +1,4 @@
 import { type Module, type ParseResult } from "./parser.js";
-export declare function hashSource(source: string): string;
+import { type CompileOwner } from "../interp/budget.js";
+export declare function hashSource(source: string, owner?: CompileOwner): string;
 export declare function hashParsedAst(ast: Module | ParseResult): string;

package/packages/safe-js/dist/parse/hash.js

@@ -1,13 +1,16 @@
 import { parse, parseModule } from "./parser.js";
+import { SandboxError } from "../interp/budget.js";
 const FNV_OFFSET_BASIS = 0x811c9dc5;
 const FNV_PRIME = 0x01000193;
 const IGNORED_KEYS = new Set(["nodeId", "raw", "span"]);
-export function hashSource(source) {
+export function hashSource(source, owner) {
     try {
-        return hashParsedAst(parse(source));
+        return hashParsedAst(parse(source, "<input>", owner));
     }
-    catch {
-        return hashParsedAst(parseModule(source));
+    catch (error) {
+        if (error instanceof SandboxError)
+            throw error;
+        return hashParsedAst(parseModule(source, "<input>", owner));
     }
 }
 export function hashParsedAst(ast) {

package/packages/safe-js/dist/parse/parser.d.ts

@@ -1,5 +1,6 @@
 import { type Position } from "./tokenizer.js";
 import { type ExportDefaultDeclaration, type ExportNamedDeclaration } from "./parse-export.js";
+import { type CompileOwner } from "../interp/budget.js";
 export type { ExportDefaultDeclaration, ExportNamedDeclaration } from "./parse-export.js";
 export type SourceSpan = {
     start: Position;
@@ -349,6 +350,7 @@ export type ArrowFunctionExpression = BaseNode & {
 export type FunctionNode = ArrowFunctionExpression | FunctionDeclaration | FunctionExpression;
 export type Expression = ArrowFunctionExpression | AssignmentExpression | ArrayExpression | AwaitExpression | BinaryExpression | BooleanLiteral | CallExpression | ConditionalExpression | FunctionExpression | Identifier | LogicalExpression | MemberExpression | MetaProperty | NewExpression | NullLiteral | NumericLiteral | ObjectExpression | RegexLiteral | SequenceExpression | StringLiteral | TaggedTemplateExpression | TemplateLiteral | ThisExpression | UnaryExpression | UpdateExpression | UndefinedLiteral | YieldExpression;
 export type ParseResult = Expression | Statement;
-export declare function parse(source: string, filename?: string): ParseResult;
-export declare function parseModule(source: string, filename?: string): Module;
-export declare function parseExecutableModule(source: string, filename?: string): Module;
+export declare function parse(source: string, filename?: string, owner?: CompileOwner): ParseResult;
+export declare function parseModule(source: string, filename?: string, owner?: CompileOwner): Module;
+export declare function parseExecutableModule(source: string, filename?: string, owner?: CompileOwner): Module;
+export declare function findRegexLiteral(node: unknown): RegexLiteral | undefined;