npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

@endo/static-module-record

v1.1.2

Published

Shim for the SES StaticModuleRecord and module-to-program transformer

Downloads

10,181

Readme

StaticModuleRecord

This package provides a shim for the StaticModuleRecord constructor, suitable for use with the SES shim importHook. The static module record accepts a JavaScript module and converts it into a form that SES can use to securely emulate JavaScript modules (ESMs, the mjs file format) with compartments.

import 'ses';
import { StaticModuleRecord } from '@endo/static-module-record`;

const c1 = new Compartment({}, {}, {
  name: "first compartment",
  resolveHook: (moduleSpecifier, moduleReferrer) => {
    return resolve(moduleSpecifier, moduleReferrer);
  },
  importHook: async moduleSpecifier => {
    const moduleLocation = locate(moduleSpecifier);
    const moduleText = await retrieve(moduleLocation);
    return new StaticModuleRecord(moduleText, moduleLocation);
  },
});

Source maps

The StaticModuleRecord is a shim for what we hope to eventually call a native ModuleSource constructor. However, in the absence of a native ModuleSource, this produces a serializable object that emulates the behavior of ModuleSource in conjunction with the Compartment constructor from ses. A detail that leaks from the implementation is that the constructor rewrites the source, from an ESM [[Module]] grammar construction to a [[Program]] construction suitable for confining with the compartment's confined evaluator.

This transform attempts to be unobtrusive, but currently causes some alignment changes due to (hopefully temporary) limitations to the underlying code generator. In the interim, generating a source map can help.

The StaticModuleRecord constructor accepts non-standards-track sourceMapHook and sourceMapUrl options.

Previously, the sole option was a string argument for the sourceUrl, such that this would be appended to the generated source. This change allows for the old or new usage:

new StaticModuleRecord(source, sourceUrl);
// or
new StaticModuleRecord(source, { sourceUrl, sourceMapUrl, sourceMapHook });

The sourceMapUrl is necessary for generating a source map. The URL will appear only in the generated source map, so a fully qualified source map URL is safe and allows for continuity if the map is generated and debugged on the same host. This is important because Endo captures precompiled Static Module Records in bundles, excluding source maps, such that a relative path is not useful.

The sourceMapHook will receive a string source map and a details bag including:

  • source
  • sourceUrl
  • sourceMapUrl

Such that the receiver can store the source map somewhere as a side-effect.

Note: the sourceMapHook is synchronous and returns void. Exceptions thrown by the hook will propagate up through the constructor. If the hook returns a promise, it will be dropped and rejections will go uncaught. If the hook must do async work, these should be queued up as a job that the caller can later await.

Bug Disclosure

Please help us practice coordinated security bug disclosure, by using the instructions in SECURITY.md to report security-sensitive bugs privately.

For non-security bugs, please use the regular Issues page.