poe-code 14.0.15 → 14.0.17

package/packages/safe-js/dist/chunks/{chunk-6ET7ZJGT.js → chunk-W6AHPZCN.js}

@@ -27,7 +27,7 @@ import {
   validateMigrationSemantics,
   validateSnapshotData,
   validateSnapshotMigration
-} from "./chunk-LBJGHXII.js";
+} from "./chunk-BW4SYRDC.js";
 import {
   createFileSystem,
   createNodeFileSystemAdapterRegistry,
@@ -8245,4 +8245,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-6ET7ZJGT.js.map
+//# sourceMappingURL=chunk-W6AHPZCN.js.map

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-6ET7ZJGT.js";
+} from "./chunks/chunk-W6AHPZCN.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-LBJGHXII.js";
+} from "./chunks/chunk-BW4SYRDC.js";
 import "./chunks/chunk-7M2SJPSZ.js";
 import "./chunks/chunk-2QRYPKQQ.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-LBJGHXII.js";
+} from "./chunks/chunk-BW4SYRDC.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-6ET7ZJGT.js";
+} from "./chunks/chunk-W6AHPZCN.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-LBJGHXII.js";
+} from "./chunks/chunk-BW4SYRDC.js";
 import "./chunks/chunk-7M2SJPSZ.js";
 import "./chunks/chunk-2QRYPKQQ.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/host-capabilities.d.ts

@@ -30,6 +30,8 @@ export type HostObjectDefinition = {
 export type HostObjectNamedDefinition = {
     keys(): readonly string[];
     get(name: string): unknown;
+    set?(name: string, value: unknown): void;
+    delete?(name: string): boolean;
     maxKeys: number;
     maxKeyCodeUnits: number;
     enumerable?: boolean;
@@ -39,6 +41,7 @@ export type HostObjectController = {
     assertActive(): void;
     chargeWork(units?: number): void;
     checkLength(length: number): void;
+    checkString(value: string): void;
     checkTemporaryDataSize(size: number): void;
     read(operation: () => unknown, validate?: (value: unknown) => unknown): SandboxValue;
     write(operation: (value: unknown) => void, value: SandboxValue): void;
@@ -63,6 +66,7 @@ export declare function revokeGuestCallback(callback: object, owner: object): vo
 export declare function revokeHostObject(value: HostObject, owner: object): void;
 export declare function getHostObjectMember(value: SandboxObject, key: string): SandboxValue;
 export declare function setHostObjectMember(value: SandboxObject, key: string, entry: SandboxValue): void;
+export declare function deleteHostObjectMember(value: SandboxObject, key: string): boolean;
 export declare function getHostObjectKeys(value: SandboxObject): string[];
 export declare function hasHostObjectMember(value: SandboxObject, key: string, enumerableOnly?: boolean): boolean;
 export declare function measureHostObjectData(value: SandboxObject): number;

package/packages/safe-js/dist/interp/host-capabilities.js

@@ -54,10 +54,16 @@ export function createLiveHostObject(definition, controller) {
     let named;
     if (input.named !== undefined) {
         const data = readDataRecord(input.named, "Named host capability");
-        if (Object.keys(data).some((key) => !["keys", "get", "maxKeys", "maxKeyCodeUnits", "enumerable"].includes(key)))
+        if (Object.keys(data).some((key) => !["keys", "get", "set", "delete", "maxKeys", "maxKeyCodeUnits", "enumerable"].includes(key)))
             throw new TypeError("Unknown named host capability field.");
-        if (typeof data.keys !== "function" || typeof data.get !== "function")
-            throw new TypeError("Named keys and get must be synchronous functions.");
+        for (const name of ["keys", "get", "set", "delete"]) {
+            const operation = data[name];
+            if (operation === undefined && (name === "set" || name === "delete"))
+                continue;
+            if (typeof operation !== "function" || types.isProxy(operation) ||
+                types.isAsyncFunction(operation) || types.isGeneratorFunction(operation))
+                throw new TypeError(`Named ${name} must be a synchronous non-generator function, not a proxy.`);
+        }
         if (typeof data.maxKeys !== "number" ||
             !Number.isInteger(data.maxKeys) ||
             data.maxKeys < 1 ||
@@ -73,6 +79,8 @@ export function createLiveHostObject(definition, controller) {
         named = {
             keys: data.keys,
             get: data.get,
+            set: data.set,
+            delete: data.delete,
             maxKeys: data.maxKeys,
             maxKeyCodeUnits: data.maxKeyCodeUnits,
             enumerable: data.enumerable
@@ -208,9 +216,33 @@ export function setHostObjectMember(value, key, entry) {
     state.controller.assertActive();
     state.controller.chargeWork();
     const property = state.properties.get(key);
-    if (property?.set === undefined)
+    if (property !== undefined) {
+        if (property.set === undefined)
+            throw new TypeError(`Host property '${key}' is not writable.`);
+        state.controller.write(property.set, entry);
+        return;
+    }
+    if (state.named?.set === undefined)
         throw new TypeError(`Host property '${key}' is not writable.`);
-    state.controller.write(property.set, entry);
+    namedMutationKeys(state, key, true);
+    state.controller.write((value) => state.named.set(key, value), entry);
+    namedKeys(state);
+}
+export function deleteHostObjectMember(value, key) {
+    const state = guestObjects.get(value);
+    state.controller.assertActive();
+    state.controller.chargeWork();
+    if (state.named?.delete === undefined)
+        throw new TypeError("Live host properties cannot be deleted.");
+    if (!namedMutationKeys(state, key, false).includes(key))
+        return true;
+    const deleted = state.controller.read(() => state.named.delete(key), (result) => {
+        if (typeof result !== "boolean")
+            throw new TypeError("Named delete must return a boolean.");
+        return result;
+    });
+    namedKeys(state);
+    return deleted;
 }
 export function getHostObjectKeys(value) {
     const state = guestObjects.get(value);
@@ -299,6 +331,31 @@ function canonicalIndex(key) {
         ? index
         : undefined;
 }
+function namedMutationKeys(state, key, create) {
+    state.controller.chargeWork(key.length);
+    state.controller.checkString(key);
+    if (["constructor", "prototype", "__proto__"].includes(key) ||
+        state.properties.has(key) || state.methods.has(key) ||
+        (state.indexed !== undefined && (key === "length" || canonicalIndex(key) !== undefined)))
+        throw new TypeError(`Host member '${key}' is protected from named mutation.`);
+    const named = state.named;
+    if (key.length > named.maxKeyCodeUnits)
+        throw new RangeError("Named key exceeds maximum UTF-16 code units.");
+    const keys = namedKeys(state);
+    if (create && !keys.includes(key)) {
+        const length = keys.length + 1;
+        if (length > named.maxKeys)
+            throw new RangeError("Named keys exceed maxKeys.");
+        state.controller.checkLength(length);
+        let units = key.length;
+        for (const existing of keys)
+            units += existing.length;
+        if (units > named.maxKeyCodeUnits)
+            throw new RangeError("Named keys exceed maximum UTF-16 code units.");
+        state.controller.checkTemporaryDataSize(1 + length + units);
+    }
+    return keys;
+}
 function namedKeys(state) {
     const named = state.named;
     return state.controller.read(named.keys, (value) => {

package/packages/safe-js/dist/interp/interpreter.js

@@ -1,5 +1,5 @@
 import { promiseReplayContext } from "./promise-replay.js";
-import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
+import { deleteHostObjectMember, getHostObjectKeys, getHostObjectMember, hasHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
 import { sandboxString } from "./string-coercion.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
@@ -1576,11 +1576,11 @@ async function evaluateDeleteExpression(node, context) {
     if (!isIndexableSandboxValue(member.object)) {
         throw new TypeError("Unary operator 'delete' requires a sandbox object property.");
     }
-    deleteSandboxProperty(member.object, member.property);
+    const deleted = deleteSandboxProperty(member.object, member.property);
     return {
         kind: "normal",
         hasValue: true,
-        value: true
+        value: deleted
     };
 }
 async function evaluateUpdateExpression(node, context) {
@@ -2403,13 +2403,13 @@ export function setSandboxProperty(target, property, value, budget) {
 }
 function deleteSandboxProperty(target, property) {
     if (isGuestHostObject(target))
-        throw new TypeError("Live host properties cannot be deleted.");
+        return deleteHostObjectMember(target, String(property));
     if (isGuestClosure(target))
         target = materializeFunctionProperties(target);
     if (Array.isArray(target)) {
         assertCollectionMutable(target);
     }
-    delete target[String(property)];
+    return delete target[String(property)];
 }
 function getClosureMemberValue(target, property, context) {
     return getFunctionMember(target, property, createFunctionMethodOptions(context));

package/packages/safe-js/dist/realm.js

@@ -313,6 +313,7 @@ class RealmState {
             assertActive: this.assertOpen,
             chargeWork: this.chargeWork,
             checkLength: (length) => this.budget.allocateArrayLength(length),
+            checkString: (value) => { this.budget.allocateString(value); },
             checkTemporaryDataSize: (size) => {
                 const temporary = {};
                 try {
@@ -326,7 +327,7 @@ class RealmState {
                 const value = this.invokeHost(operation, operation);
                 if (types.isPromise(value)) {
                     void Promise.resolve(value).catch(() => undefined);
-                    throw new TypeError("Live property getters must be synchronous.");
+                    throw new TypeError("Live property operations must be synchronous.");
                 }
                 return this.importValue(validate === undefined ? value : validate(value));
             },