poe-code 8.0.1 → 9.0.0

package/packages/safejs/dist/chunks/{chunk-ME5BTAZT.js → chunk-GQBEEFVQ.js}

@@ -16919,7 +16919,7 @@ function serializeArguments(value, serializeValue) {
 
 // packages/safejs/src/snapshot/dump-format.ts
 var DUMP_FORMAT_VERSION = 1;
-var EXECUTION_SEMANTICS = "jobs-v4";
+var EXECUTION_SEMANTICS = "jobs-v5";
 var SKIP_VALUE = /* @__PURE__ */ Symbol("SafeJS.skip-dump-value");
 function serializeSafeJSSnapshot(snapshot) {
   const replayError = Object.getOwnPropertyDescriptor(snapshot, "replayError");
@@ -20360,7 +20360,7 @@ function decodeReplayData(input, options = {}) {
         restored.set(id, capability);
         return capability;
       }
-      return createSandboxClosure({
+      const copy = createSandboxClosure({
         ...capability,
         boundTarget: capability.boundTarget,
         cancellationSignal: capability.cancellationSignal,
@@ -20374,6 +20374,8 @@ function decodeReplayData(input, options = {}) {
           return properties;
         }
       });
+      options.onCapabilityRestored?.(capability, copy);
+      return copy;
     }
     if (kind === "map") {
       const result2 = createSandboxMap();
@@ -20492,7 +20494,12 @@ var HostCallJournal = class {
     this.budget = budget;
     this.recordedReplay = replay !== void 0;
     if (replay !== void 0) {
-      const replayRecords = restoreReplayCalls(replay, this.encodedOutcomes, this.callbackSizes);
+      const replayRecords = restoreReplayCalls(
+        replay,
+        this.encodedOutcomes,
+        this.callbackSizes,
+        this.requiredHostCapabilities
+      );
       const restoredRunId = replayRecords[0]?.runId ?? records[0]?.runId ?? randomUUID();
       validateRestoredRecords(records, restoredRunId, sourceHash);
       for (const record2 of records) {
@@ -20544,8 +20551,10 @@ var HostCallJournal = class {
   retainedSize = 0;
   outcomeSizes = /* @__PURE__ */ new Map();
   capabilities = /* @__PURE__ */ new Map();
+  requiredHostCapabilities = /* @__PURE__ */ new Set();
   capabilityIds = /* @__PURE__ */ new WeakMap();
   nativeClosures = /* @__PURE__ */ new WeakMap();
+  hostSources = /* @__PURE__ */ new WeakMap();
   encodedOutcomes = /* @__PURE__ */ new Map();
   callbackSizes = /* @__PURE__ */ new Map();
   completedCallbackOwners = /* @__PURE__ */ new Set();
@@ -20698,6 +20707,30 @@ var HostCallJournal = class {
     if (!this.capabilityIds.has(closure)) this.capabilityIds.set(closure, identity);
     this.nativeClosures.set(native, closure);
   }
+  registerHostCapability(path, closure, native) {
+    const identity = `host:${path}`;
+    const existing = this.capabilities.get(identity);
+    if (existing !== void 0 && existing !== closure)
+      throw new TypeError(`Conflicting replay capability '${identity}'.`);
+    this.capabilities.set(identity, closure);
+    if (!this.capabilityIds.has(closure)) this.capabilityIds.set(closure, identity);
+    if (!this.nativeClosures.has(native)) this.nativeClosures.set(native, closure);
+    this.hostSources.set(closure, native);
+  }
+  rebindHostCapability(original, restored) {
+    const identity = this.capabilityIds.get(original);
+    const source = this.hostSources.get(original);
+    if (identity === void 0 || source === void 0) return;
+    this.capabilities.set(identity, restored);
+    this.capabilityIds.set(restored, identity);
+    this.nativeClosures.set(source, restored);
+    this.hostSources.set(restored, source);
+  }
+  validateHostCapabilities() {
+    for (const identity of this.requiredHostCapabilities) {
+      if (!this.capabilities.has(identity)) throw new UnresolvedReplayCapabilityError(identity);
+    }
+  }
   waitForCapability(id) {
     if (this.capabilities.has(id)) return Promise.resolve();
     const owner = id.slice(0, id.lastIndexOf("/function/"));
@@ -20808,7 +20841,7 @@ var HostCallJournal = class {
 function copyOutcome(outcome) {
   return outcome.status === "fulfilled" ? { status: "fulfilled", value: deepCopyToSandbox(outcome.value) } : { status: "rejected", reason: deepCopyToSandbox(outcome.reason) };
 }
-function restoreReplayCalls(input, encodedOutcomes, callbackSizes) {
+function restoreReplayCalls(input, encodedOutcomes, callbackSizes, requiredHostCapabilities = /* @__PURE__ */ new Set()) {
   validateSnapshotData(input);
   if (input === null || typeof input !== "object" || !("version" in input) || input.version !== 1 || !("calls" in input) || !Array.isArray(input.calls)) {
     throw new TypeError("Invalid host call replay header.");
@@ -20829,7 +20862,23 @@ function restoreReplayCalls(input, encodedOutcomes, callbackSizes) {
       );
     }
   }
-  const resolveCapability = (id) => capabilities.get(id);
+  const resolveCapability = (id) => {
+    if (!capabilities.has(id) && id.startsWith("host:")) {
+      const path = JSON.parse(id.slice(5));
+      if (!Array.isArray(path) || path.length < 2 || path.some((value) => typeof value !== "string"))
+        throw new TypeError("Invalid host capability identity.");
+      requiredHostCapabilities.add(id);
+      capabilities.set(
+        id,
+        createSandboxClosure({
+          call: () => {
+            throw new TypeError("Host capability has not been reconstructed.");
+          }
+        })
+      );
+    }
+    return capabilities.get(id);
+  };
   return input.calls.map((entry, index) => {
     if (entry === null || typeof entry !== "object" || Array.isArray(entry))
       throw new TypeError("Invalid replay call.");
@@ -21785,18 +21834,25 @@ function readHostOperationPolicy(operation) {
   return hostOperationPolicies.get(operation);
 }
 function wrapCallerInjectedBindings(bindings, options) {
+  options = { ...options, registerCapabilities: true };
   const state = { seen: /* @__PURE__ */ new WeakMap() };
   const copied = Object.fromEntries(
     Object.entries(bindings).map(([name, value]) => [
       name,
-      typeof value === "function" ? wrapCallerInjectedFunction(name, value, options, state) : copyHostValueToSandbox(value, [], { ...options, operation: name }, state, "<root>")
+      typeof value === "function" ? wrapCallerInjectedFunction(name, value, { ...options, capabilityPath: [name] }, state) : copyHostValueToSandbox(
+        value,
+        [],
+        { ...options, operation: name, capabilityPath: [name] },
+        state,
+        "<root>"
+      )
     ])
   );
   options.budget.provisionDataUsage(measureSandboxData(Object.values(copied)));
   return copied;
 }
 function wrapCallerInjectedFunction(name, value, options, state) {
-  const existing = state.seen.get(value);
+  const existing = state.seen.get(value) ?? options.hostCalls?.nativeClosures.get(value);
   if (existing !== void 0) return existing;
   const bindingName = name === "default" && value.name.length > 0 ? value.name : name;
   const callable = value;
@@ -21911,6 +21967,16 @@ function wrapCallerInjectedFunction(name, value, options, state) {
     name: bindingName,
     properties: (closure) => {
       state.seen.set(value, closure);
+      if (options.registerCapabilities) {
+        options.hostCalls?.registerHostCapability(
+          JSON.stringify([
+            options.moduleId ?? "<bindings>",
+            ...options.capabilityPath ?? [bindingName]
+          ]),
+          closure,
+          value
+        );
+      }
       return copyFunctionProperties(callable, [], options, state, options.operation ?? bindingName) ?? {};
     }
   });
@@ -22081,7 +22147,7 @@ function copyHostResultToSandbox(result, stackFrames, options) {
   const value = copyHostValueToSandbox(
     result,
     stackFrames,
-    options,
+    { ...options, registerCapabilities: false },
     {
       seen: /* @__PURE__ */ new WeakMap()
     },
@@ -22381,7 +22447,7 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
       copy[index] = copyHostValueToSandbox(
         descriptor.value,
         stackFrames,
-        options,
+        { ...options, capabilityPath: [...options.capabilityPath ?? [], String(index)] },
         state,
         `${path}[${index}]`
       );
@@ -22397,9 +22463,22 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
     state.seen.set(value, copy);
     budget.allocateCollectionEntries(value.size);
     for (const [key, entry] of value) {
+      const ordinal = copy.entries.size;
       copy.entries.set(
-        copyHostValueToSandbox(key, stackFrames, options, state, `${path}.<key>`),
-        copyHostValueToSandbox(entry, stackFrames, options, state, `${path}.<value>`)
+        copyHostValueToSandbox(
+          key,
+          stackFrames,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], `key:${ordinal}`] },
+          state,
+          `${path}.<key>`
+        ),
+        copyHostValueToSandbox(
+          entry,
+          stackFrames,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], `value:${ordinal}`] },
+          state,
+          `${path}.<value>`
+        )
       );
     }
     return copy;
@@ -22414,7 +22493,16 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
     budget.allocateCollectionEntries(value.size);
     for (const entry of value) {
       copy.values.add(
-        copyHostValueToSandbox(entry, stackFrames, options, state, `${path}.<value>`)
+        copyHostValueToSandbox(
+          entry,
+          stackFrames,
+          {
+            ...options,
+            capabilityPath: [...options.capabilityPath ?? [], String(copy.values.size)]
+          },
+          state,
+          `${path}.<value>`
+        )
       );
     }
     return copy;
@@ -22442,7 +22530,7 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
         value: copyHostValueToSandbox(
           descriptor.value,
           stackFrames,
-          options,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], key] },
           state,
           joinPath2(path, key)
         )
@@ -22515,7 +22603,7 @@ function copyFunctionProperties(callable, stackFrames, options, state, path) {
     properties[key] = copyHostValueToSandbox(
       descriptor.value,
       stackFrames,
-      options,
+      { ...options, capabilityPath: [...options.capabilityPath ?? [], key] },
       state,
       joinPath2(path, key)
     );
@@ -22895,6 +22983,41 @@ function isLockedFileError(error) {
   return code !== void 0 && LOCKED_FILE_ERROR_CODES.has(code);
 }
 
+// packages/safejs/src/interp/resources.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
+var runResources = new AsyncLocalStorage5();
+async function withRunResources(signal, execute) {
+  const controller = new AbortController();
+  const cancel = () => controller.abort(signal?.reason);
+  const cleanups = /* @__PURE__ */ new Set();
+  const resources = {
+    signal: controller.signal,
+    add(close) {
+      cleanups.add(close);
+    }
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  let result;
+  let failure;
+  let errors = [];
+  try {
+    result = await runResources.run(resources, execute);
+  } catch (error) {
+    failure = { reason: error };
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+    controller.abort(new Error("SafeJS run finished."));
+    const outcomes = await Promise.allSettled(
+      [...cleanups].map((close) => Promise.resolve().then(close))
+    );
+    errors = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
+  }
+  if (failure !== void 0) throw failure.reason;
+  if (errors.length > 0) throw new AggregateError(errors, "SafeJS resource cleanup failed.");
+  return result;
+}
+
 // packages/safejs/src/interp/globals/console-json.ts
 function createConsoleJsonGlobals(options) {
   const sink = options.sink ?? console;
@@ -28068,7 +28191,7 @@ var UnsnapshotableValueError = class extends Error {
 
 // packages/safejs/src/snapshot/replay-inputs.ts
 var validationPromise = createSandboxPromise(Promise.resolve(void 0));
-function prepareReplayInputs(current, saved, preparePromise) {
+function prepareReplayInputs(current, saved, preparePromise, onCapabilityRestored) {
   const identities = /* @__PURE__ */ new WeakMap();
   const capabilities = /* @__PURE__ */ new Map();
   const promises = /* @__PURE__ */ new Map();
@@ -28139,6 +28262,7 @@ function prepareReplayInputs(current, saved, preparePromise) {
   assertReplayInputShape(validated);
   const restored = decodeReplayData(saved, {
     resolveCapability,
+    onCapabilityRestored,
     resolvePromise: (id) => {
       const value = readCapability(id);
       if (!promises.has(id) && preparePromise !== void 0)
@@ -28176,7 +28300,7 @@ function run(source, options = {}) {
   const lifecycle = { hostCallbackDepth: 0 };
   const dumpController = createDumpController(lifecycle);
   const promiseTracker = createSandboxPromiseRejectionTracker();
-  const result = withSandboxPromiseRejectionTracker(promiseTracker, async () => {
+  const execute = async () => {
     const promiseReplay = new PromiseReplay(options.snapshot?.promiseReplay);
     return promiseReplayContext.run(promiseReplay, async () => {
       const deactivateOtelSink = activateOtelSink(options.otelSink);
@@ -28276,8 +28400,10 @@ function run(source, options = {}) {
             if (!isSandboxClosure(binding))
               throw new TypeError("Invalid initial promise operation.");
             return binding.call([]);
-          }
+          },
+          hostCalls.rebindHostCapability.bind(hostCalls)
         );
+        hostCalls.validateHostCapabilities();
         budget.setRetainedDataUsage(
           initialInputs,
           measureSandboxData(
@@ -28456,7 +28582,11 @@ function run(source, options = {}) {
         deactivateOtelSink();
       }
     });
-  });
+  };
+  const result = withRunResources(
+    options.signal,
+    () => withSandboxPromiseRejectionTracker(promiseTracker, execute)
+  );
   return attachDumpController(result, dumpController);
 }
 async function throwIfReturnedPromiseRejected(result) {
@@ -28636,6 +28766,7 @@ export {
   parse,
   parseModule,
   lint,
+  runResources,
   noopOtelSink,
   bindOtelSpan,
   activateOtelSpan,
@@ -28664,4 +28795,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-ME5BTAZT.js.map
+//# sourceMappingURL=chunk-GQBEEFVQ.js.map