How to control module resolution, instantiation and evaluation in Realms

[caridy]

Note: follow up for issue #94.

For stage 2, we have decided to remove the import and meta traps. This issue can be used to track the progress on this important use-case.

[erights]

I am a bit confused about something.

IIUC the plan is to keep the evaluation of module code in an api separate from the Realms api. The to-be-proposed realms support for trapping the import expression corresponds to the case of a script triggering an async loading of a set of linked-together modules. This would return some kind of module object, which is the beginning of the module api.

However, as @ljharb points out at #127 (comment) , there is no import.meta expression outside of modules. (Prior to this comment I was confused on this.) Given this, the trapping of import.meta should be moved to the yet-to-be designed module api, yes?

[erights]

Btw, because there's no way for the shim to support the import expression trap without accurate parsing and source-to-source rewriting, the shim instead rejects code containing an import expression. This is an implementation limit of the shim compared to the spec.

In the absence of a parser, the implementation limit of the shim is even more severe, as explained at #127

[Jamesernator]

As some prior art Node's experimental vm.Module allows execution in separate realms e.g.:

import vm from 'vm';

const context = vm.createContext();

const trustedKeyStorageModule = new vm.SourceTextModule(`
  const { fs, storageDirectory } = import.meta.unsafe;

  export function loadValue(key) {
    const text = await fs.promises.readFile(storageDirectory + encodeURIComponent(key), key);
    return JSON.parse(text);
  }

  export async function storeValue(key, value) {
    const serialized = JSON.serialize(value);
    await fs.promises.writeFile(storageDirectory + encodeURIComponent(key), serialized);
  }
`, {
  context,
  initializeImportMeta(meta) {
    meta.unsafe = { fs: require('fs'), storageDirectory: 'file:///path/to/storage/' },
  },
});

const untrustedModule = new vm.SourceTextModule(`
  import { loadValue, storeValue } from 'sys:key-storage';

  async function main() {
    await storeValue('x', 2000);
  }

  main();
`, { context });

await untrustedModule.link((specifier) => {
  if (specifier === 'sys:key-storage') {
    return trustedKeyStorageModule;
  }
  throw new Error("Module not found");
});

await unstrustedModule.evaluate();

[caridy]

this issue is now deferred to the parameterized evaluator instead of the realm proposal itself.