poe-code 14.0.5 → 14.0.7

package/packages/safe-js/dist/interp/interpreter.js

@@ -1,6 +1,7 @@
 import { promiseReplayContext } from "./promise-replay.js";
+import { getHostObjectKeys, getHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
-import { SandboxJobQueue, suspendJob } from "./jobs.js";
+import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
 import { withCancellationSignal } from "./cancel.js";
 import { attachErrorSpan, formatErrorStack, readErrorSpan, replaceErrorStack } from "../error/shape.js";
 import { evaluateArrowFunctionExpression, evaluateFunctionExpression, evaluateAwaitExpression, emitResumeBreakpoint, createInterpretedClosure, normalizeClosureResult } from "./async.js";
@@ -26,6 +27,8 @@ import { isSandboxErrorConstructorInstance } from "./globals/error.js";
 import { isSandboxMapConstructor, isSandboxSetConstructor } from "./globals/collections.js";
 import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
+import { dateString, dateTime, isSandboxDate } from "./date.js";
+import { getDateMember, getDatePrototype, isDateConstructor } from "./globals/date.js";
 import { createSandboxRegex, allocateProducedSandboxValue, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, reconcileCompiledValues } from "./values.js";
 import { Scope } from "./scope.js";
 import { hoistVarDeclarations } from "./var-hoist.js";
@@ -98,9 +101,10 @@ export async function interpret(node, options = {}) {
             peakDataSize: { enumerable: false, value: 0, writable: true }
         });
         const activeLoopIterations = new Map();
-        const jobs = new SandboxJobQueue();
+        const jobs = options.jobs ?? new SandboxJobQueue();
         hoistVarDeclarations(node, scope);
         const context = {
+            assertActive: options.assertActive,
             compilation,
             budget,
             callStack: [],
@@ -119,8 +123,9 @@ export async function interpret(node, options = {}) {
             generatorYield: options.generatorYield,
             resumeTarget: { nodeId: options.snapshot?.resumeNodeId }
         };
-        const evaluation = await withCancellationSignal(options.signal, () => jobs.run(() => evaluateNode(node, context)));
-        await jobs.drain();
+        const evaluation = await withCancellationSignal(options.signal, () => options.nested ? runAsyncPrefix(() => evaluateNode(node, context)) : jobs.run(() => evaluateNode(node, context)));
+        if (!options.nested)
+            await jobs.drain();
         const snapshot = scope.snapshot();
         reconcileDataBudget(budget, stats, scope, "hasValue" in evaluation && evaluation.hasValue ? evaluation.value : undefined, compilation, options.compilation);
         if (evaluation.kind === "error") {
@@ -167,6 +172,7 @@ export async function interpret(node, options = {}) {
 }
 export { Scope } from "./scope.js";
 async function evaluateNode(node, context) {
+    context.assertActive?.();
     const replayWait = promiseReplayContext.getStore()?.beforeNode(node.nodeId);
     if (replayWait !== undefined)
         await suspendJob(replayWait);
@@ -1119,6 +1125,8 @@ function forInObject(value) {
     return undefined;
 }
 function forInKeys(object, budget) {
+    if (isGuestHostObject(object))
+        return getHostObjectKeys(object);
     const keys = [];
     const seen = new Set();
     let depth = 0;
@@ -1140,6 +1148,8 @@ function forInKeys(object, budget) {
     return keys;
 }
 function hasForInProperty(object, key, budget) {
+    if (isGuestHostObject(object))
+        return getHostObjectKeys(object).includes(key);
     let depth = 0;
     for (let current = object; current !== null; current = getSandboxPrototype(current)) {
         if (depth > 0)
@@ -1630,6 +1640,8 @@ async function evaluateMemberExpression(node, context) {
     };
 }
 function getPropertyValue(target, property, context) {
+    if (isGuestHostObject(target))
+        return getHostObjectMember(target, String(property));
     if (typeof target === "string")
         return getStringMember(target, property, context.budget);
     if (typeof target === "number")
@@ -1638,6 +1650,8 @@ function getPropertyValue(target, property, context) {
         return undefined;
     if (isFloat32Array(target))
         return getFloat32Member(target, property, context.budget);
+    if (isSandboxDate(target))
+        return getDateMember(property, context.budget, context.compilation?.owner);
     if (isSandboxMap(target))
         return getMapMember(target, property, createMapMethodOptions(context));
     if (isSandboxSet(target))
@@ -1854,6 +1868,9 @@ async function evaluateMemberCallExpression(node, context) {
     if (isSandboxMap(member.object)) {
         return evaluatePrimitiveMemberCall(node, "Map", member.property, getMapMember(member.object, member.property, createMapMethodOptions(context)), context);
     }
+    if (isSandboxDate(member.object)) {
+        return evaluateResolvedCallExpression(node, getDateMember(member.property, context.budget, context.compilation?.owner), context, member.object);
+    }
     if (isFloat32Array(member.object)) {
         return evaluateResolvedCallExpression(node, getFloat32Member(member.object, member.property, context.budget), context, member.object);
     }
@@ -2066,6 +2083,8 @@ function applyBinaryOperator(node, left, right, context) {
             }
             if (isFloat32ArrayConstructor(right))
                 return isFloat32Array(left);
+            if (isDateConstructor(right))
+                return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
             if (isSandboxSetConstructor(right) && isSandboxSet(left)) {
                 return true;
             }
@@ -2131,8 +2150,8 @@ function applyAdditionOperator(left, right, context) {
     return toNumber(leftPrimitive) + toNumber(rightPrimitive);
 }
 function compareRelational(left, right, operator) {
-    const leftPrimitive = toPrimitive(left);
-    const rightPrimitive = toPrimitive(right);
+    const leftPrimitive = isSandboxDate(left) ? dateTime(left) : toPrimitive(left);
+    const rightPrimitive = isSandboxDate(right) ? dateTime(right) : toPrimitive(right);
     if (typeof leftPrimitive === "string" && typeof rightPrimitive === "string") {
         switch (operator) {
             case "<":
@@ -2215,6 +2234,8 @@ function toPrimitive(value) {
     return toString(value);
 }
 async function toNumericPrimitive(value, context) {
+    if (isSandboxDate(value))
+        return dateTime(value);
     if (isPrimitiveCoercionType(getCoercionType(value))) {
         return value;
     }
@@ -2237,6 +2258,8 @@ async function toNumericPrimitive(value, context) {
     return toString(value);
 }
 function toNumber(value) {
+    if (isSandboxDate(value))
+        return dateTime(value);
     if (typeof value === "number") {
         return value;
     }
@@ -2255,6 +2278,8 @@ function toNumber(value) {
     return toNumber(toPrimitive(value));
 }
 function toString(value) {
+    if (isSandboxDate(value))
+        return dateString(value);
     if (Array.isArray(value)) {
         return value
             .map((entry) => (entry === null || entry === undefined ? "" : toString(entry)))
@@ -2284,6 +2309,8 @@ function isPlainSandboxObject(value) {
         !isSandboxRegex(value));
 }
 function getMemberValue(target, property, context) {
+    if (isGuestHostObject(target))
+        return getHostObjectMember(target, String(property));
     let current = target;
     let depth = 0;
     while (typeof current === "object" && current !== null) {
@@ -2311,6 +2338,12 @@ function getArrayMemberValue(target, property, context) {
     return getArrayMember(target, property, createArrayMethodOptions(context));
 }
 export function setSandboxProperty(target, property, value, budget) {
+    if (isSandboxDate(target))
+        throw new TypeError("Date own properties are not supported.");
+    if (isGuestHostObject(target)) {
+        setHostObjectMember(target, String(property), value);
+        return;
+    }
     const prototypeOwner = target;
     if (isGuestClosure(target))
         target = materializeFunctionProperties(target);
@@ -2359,6 +2392,8 @@ export function setSandboxProperty(target, property, value, budget) {
     }
 }
 function deleteSandboxProperty(target, property) {
+    if (isGuestHostObject(target))
+        throw new TypeError("Live host properties cannot be deleted.");
     if (isGuestClosure(target))
         target = materializeFunctionProperties(target);
     if (Array.isArray(target)) {

package/packages/safe-js/dist/interp/object-model.js

@@ -1,4 +1,5 @@
 import { assertSandboxDataDepth } from "../graph-depth.js";
+import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "./values.js";
 const guestClosures = new WeakSet();
 const functionProperties = new WeakMap();
@@ -62,6 +63,8 @@ export function getSandboxDataProperty(value, key, budget) {
     let current = value;
     let depth = 0;
     while (typeof current === "object" && current !== null) {
+        if (isGuestHostObject(current))
+            return getHostObjectMember(current, String(key));
         if (isGuestClosure(current))
             return getGuestFunctionProperty(current, String(key));
         if (isSandboxClosure(current)) {
@@ -108,6 +111,8 @@ export function setSandboxPrototype(value, prototype, budget) {
         prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+    if (isGuestHostObject(value))
+        return false;
     if (isSandboxClosure(value) ||
         isSandboxGenerator(value) ||
         isSandboxMap(value) ||
@@ -125,6 +130,8 @@ export function hasManagedDescriptors(value) {
     return descriptorObjects.has(value);
 }
 export function hasGuestObjectState(value) {
+    if (isLiveCapability(value))
+        return true;
     if (functionProperties.has(value) || prototypes.has(value))
         return true;
     return (descriptorObjects.has(value) &&

package/packages/safe-js/dist/interp/string-coercion.js

@@ -1,4 +1,5 @@
 import { sandboxErrorTypes } from "../error/shape.js";
+import { dateString, isSandboxDate } from "./date.js";
 import { float32Storage, isFloat32Array } from "./float32.js";
 import { isSandboxClosure, isSandboxPromise } from "./values.js";
 export function sandboxString(value, budget, context, joining = new Set()) {
@@ -41,6 +42,8 @@ async function stringifyObject(value, budget, context, joining) {
     }
 }
 async function defaultToString(value, budget, context, joining) {
+    if (isSandboxDate(value))
+        return budget.allocateString(dateString(value));
     if (Array.isArray(value) || isFloat32Array(value)) {
         if (Object.hasOwn(value, "join")) {
             const join = ownDataValue(value, "join");

package/packages/safe-js/dist/interp/values.d.ts

@@ -12,7 +12,7 @@ declare const sandboxRegexPattern: unique symbol;
 declare const sandboxSetBrand: unique symbol;
 declare const sandboxRetainedValues: unique symbol;
 export type SandboxPrimitive = string | number | boolean | null | undefined;
-export type SandboxValue = SandboxPrimitive | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
+export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
 export type SandboxObject = {
     [key: string]: SandboxValue;
 };
@@ -86,6 +86,7 @@ export type SandboxGenerator = {
 };
 type CopyFromSandboxOptions = {
     wrapClosure?: (value: SandboxClosure) => unknown;
+    unwrapHostObject?: (value: SandboxObject) => unknown;
     compilation?: CompileScope;
 };
 export declare function createSandboxClosure(input: {

package/packages/safe-js/dist/interp/values.js

@@ -1,4 +1,6 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
+import { copyNativeDate, exportDate, isSandboxDate } from "./date.js";
+import { getHostObjectKeys, getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { types as nodeTypes } from "node:util";
 import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
 import { copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
@@ -70,6 +72,8 @@ export function createSandboxClosure(input) {
     return Object.freeze(closure);
 }
 export function ownEnumerableSandboxEntries(value) {
+    if (isGuestHostObject(value))
+        return getHostObjectKeys(value).map(key => [key, getHostObjectMember(value, key)]);
     if (value === null || value === undefined)
         throw new TypeError("Cannot convert undefined or null to object.");
     if (isGuestClosure(value))
@@ -222,6 +226,15 @@ export function measureSandboxData(values, options = {}) {
         assertSandboxDataDepth(depth);
         seen.add(value);
         usage += 1;
+        if (isSandboxDate(value)) {
+            usage += 8;
+            return;
+        }
+        if (isGuestHostObject(value)) {
+            for (const key of getHostObjectKeys(value))
+                usage += key.length + 1;
+            return;
+        }
         const prototype = getSandboxPrototype(value);
         if (prototype !== null)
             visit(prototype, depth + 1);
@@ -376,6 +389,8 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     if (isSandboxPrimitive(value)) {
         return value;
     }
+    if (isLiveCapability(value))
+        throw new TypeError("Live capabilities require their owning realm bridge.");
     if (isSandboxClosure(value) ||
         isSandboxGenerator(value) ||
         isSandboxRegex(value) ||
@@ -425,6 +440,14 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         }
         return sandboxPromise;
     }
+    if (nodeTypes.isDate(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = copyNativeDate(value);
+        state.seen.set(value, copy);
+        return copy;
+    }
     if (isFloat32Array(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -508,6 +531,11 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (isSandboxPrimitive(value)) {
         return value;
     }
+    if (isGuestHostObject(value)) {
+        if (options.unwrapHostObject === undefined)
+            throw new TypeError("Live capabilities require their owning realm bridge.");
+        return options.unwrapHostObject(value);
+    }
     if (nodeTypes.isProxy(value))
         throw new TypeError("Unsupported proxy sandbox value.");
     if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
@@ -552,6 +580,14 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             Object.preventExtensions(copy);
         return copy;
     }
+    if (isSandboxDate(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = exportDate(value);
+        state.seen.set(value, copy);
+        return copy;
+    }
     if (isSandboxClosure(value)) {
         if (options.wrapClosure === undefined) {
             throw new TypeError("Sandbox closures cannot cross into host values without an explicit wrapper.");

package/packages/safe-js/dist/lint/rules/known-globals.d.ts

@@ -1 +1 @@
-export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "Error", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "structuredClone", "SyntaxError", "TypeError", "console"];
+export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "Date", "Error", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "structuredClone", "SyntaxError", "TypeError", "console"];

package/packages/safe-js/dist/lint/rules/known-globals.js

@@ -2,6 +2,7 @@ export const KNOWN_RUNTIME_GLOBALS = [
     "AggregateError",
     "Array",
     "Boolean",
+    "Date",
     "Error",
     "Infinity",
     "isFinite",

package/packages/safe-js/dist/modules/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Budget, CompileOwner } from "../interp/budget.js";
 import type { HostCallJournal } from "../interp/host-call.js";
-import { type CallerInjectedBinding } from "../interp/host-bridge.js";
+import { type RealmBridge, type CallerInjectedBinding } from "../interp/host-bridge.js";
 import type { SandboxValue } from "../interp/values.js";
 import type { Module } from "../parse/parser.js";
 export type ModuleExports = ReadonlyMap<string, CallerInjectedBinding> | Record<string, CallerInjectedBinding>;
@@ -9,6 +9,8 @@ export declare function createUnknownModuleMessage(moduleName: string, moduleNam
 export declare function createUnknownExportMessage(moduleName: string, exportName: string, availableExports: readonly string[]): string;
 export declare function resolveModuleImports(module: Module, modules: ModuleRegistry | undefined, options: {
     budget: Budget;
+    realm?: RealmBridge;
+    wrappedModules?: Map<string, Record<string, SandboxValue>>;
     compileOwner?: CompileOwner;
     hostCalls?: HostCallJournal;
     signal?: AbortSignal;

package/packages/safe-js/dist/modules/registry.js

@@ -17,7 +17,7 @@ export function createUnknownExportMessage(moduleName, exportName, availableExpo
 export function resolveModuleImports(module, modules, options) {
     const registry = normalizeModuleRegistry(modules);
     const bindings = createBindingRecord();
-    const wrappedModules = new Map();
+    const wrappedModules = options.wrappedModules ?? new Map();
     for (const statement of module.body) {
         if (statement.type !== "ImportDeclaration") {
             continue;
@@ -36,6 +36,7 @@ function bindImportDeclaration(declaration, registry, wrappedModules, bindings,
     }
     const wrappedExports = wrappedModules.get(moduleName) ??
         createBindingRecord(wrapCancelableBindings(wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
+            realm: options.realm,
             budget: options.budget,
             compileOwner: options.compileOwner,
             hostCalls: options.hostCalls,

package/packages/safe-js/dist/parse/parser.js

@@ -1832,8 +1832,10 @@ class Parser {
             }
             break;
         }
-        this.expectPunctuator("(");
-        const args = this.parseArguments();
+        const optional = this.consumePunctuator("?.");
+        if (optional !== undefined)
+            throw new DisallowedSyntaxError("new optional chain", optional.start);
+        const args = this.consumePunctuator("(") === undefined ? [] : this.parseArguments();
         const end = this.previousToken();
         return {
             node: {

package/packages/safe-js/dist/realm.d.ts

@@ -0,0 +1,46 @@
+import { Budget } from "./interp/budget.js";
+import { type InterpreterResult } from "./interp/interpreter.js";
+import { type CallerInjectedBinding } from "./interp/host-bridge.js";
+import { type CallbackOptions, type SafeJSExtension } from "./extensions.js";
+import { type ModuleRegistry } from "./modules/registry.js";
+import type { ConsoleSink } from "./interp/globals/console-json.js";
+import type { RunClock, RunOptions, RunResult } from "./run.js";
+export type RealmLimits = {
+    extensions?: number;
+    hostObjects?: number;
+    callbacks?: number;
+    guestReferences?: number;
+    cleanups?: number;
+    nestedEvaluations?: number;
+};
+export type RealmOptions = {
+    clock?: RunClock;
+    bindings?: Record<string, CallerInjectedBinding>;
+    modules?: ModuleRegistry;
+    extensions?: readonly SafeJSExtension[];
+    grants?: readonly string[];
+    budget?: Budget;
+    signal?: AbortSignal;
+    sink?: ConsoleSink;
+    randomSeed?: number;
+    limits?: RealmLimits;
+};
+export type RealmResult = (Omit<Extract<InterpreterResult, {
+    ok: true;
+}>, "snapshot" | "returnValue"> & {
+    returnValue?: unknown;
+}) | Omit<Extract<InterpreterResult, {
+    ok: false;
+}>, "snapshot">;
+export type SafeJSRealm = {
+    readonly extensions: readonly SafeJSExtension["manifest"][];
+    evaluate(source: string, options?: {
+        filename?: string;
+    }): Promise<RealmResult>;
+    invokeCallback(callback: unknown, options?: CallbackOptions): Promise<unknown>;
+    releaseCallback(callback: unknown): void;
+    releaseGuestReference(reference: unknown): void;
+    close(): Promise<void>;
+};
+export declare function createRealm(options?: RealmOptions): SafeJSRealm;
+export declare function runWithExtensions(source: string, options: RunOptions): Promise<RunResult>;