@poe-platform/safe-js 0.1.138 → 0.1.139

package/dist/safe-js/chunks/{chunk-WBWD7ZCM.js → chunk-EZAX76DY.js}

@@ -6527,6 +6527,64 @@ function serializedDateTime(value) {
   return Number.isNaN(time) ? null : time;
 }
 
+// packages/safe-js/src/interp/accessors.ts
+var accessorClosures = /* @__PURE__ */ new WeakMap();
+var getterAdapters = /* @__PURE__ */ new WeakMap();
+var setterAdapters = /* @__PURE__ */ new WeakMap();
+function accessorAdapter(closure, kind) {
+  if (kind === "get") {
+    let adapter2 = getterAdapters.get(closure);
+    if (adapter2 === void 0) {
+      adapter2 = () => void 0;
+      getterAdapters.set(closure, adapter2);
+      accessorClosures.set(adapter2, closure);
+    }
+    return adapter2;
+  }
+  let adapter = setterAdapters.get(closure);
+  if (adapter === void 0) {
+    adapter = () => {
+      throw new TypeError("Accessor writes require sandbox execution.");
+    };
+    setterAdapters.set(closure, adapter);
+    accessorClosures.set(adapter, closure);
+  }
+  return adapter;
+}
+function accessorClosure(adapter) {
+  if (adapter === void 0) return void 0;
+  const closure = accessorClosures.get(adapter);
+  if (closure === void 0) throw new TypeError("Native accessors cannot execute in the sandbox.");
+  return closure;
+}
+function retainedAccessorClosures(descriptor) {
+  const closures = [];
+  for (const adapter of [descriptor.get, descriptor.set]) {
+    const closure = adapter === void 0 ? void 0 : accessorClosures.get(adapter);
+    if (closure !== void 0) closures.push(closure);
+  }
+  return closures;
+}
+function readPropertyDescriptor(descriptor, receiver, context, allowNativeGetter = false) {
+  if ("value" in descriptor) return descriptor.value;
+  if (descriptor.get === void 0) return void 0;
+  const getter = accessorClosures.get(descriptor.get);
+  if (getter === void 0) {
+    if (!allowNativeGetter) throw new TypeError("Native accessors cannot execute in the sandbox.");
+    return Reflect.apply(descriptor.get, receiver, []);
+  }
+  if (context?.invokeClosure === void 0)
+    throw new TypeError("Accessor reads require sandbox execution.");
+  return context.invokeClosure(getter, [], receiver);
+}
+function writePropertyDescriptor(descriptor, receiver, value, context) {
+  const setter = accessorClosure(descriptor.set);
+  if (setter === void 0) throw new TypeError("Cannot assign to a getter-only property.");
+  if (context?.invokeClosure === void 0)
+    throw new TypeError("Accessor writes require sandbox execution.");
+  return context.invokeClosure(setter, [value], receiver).then(() => void 0);
+}
+
 // packages/safe-js/src/interp/collection-brands.ts
 var sandboxMapBrand = /* @__PURE__ */ Symbol("SandboxMap");
 var sandboxSetBrand = /* @__PURE__ */ Symbol("SandboxSet");
@@ -7317,15 +7375,23 @@ function registerIntrinsicPrototype(budget, prototype, constructor) {
     ...record2,
     descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record2.value)))
   }));
-  const unchanged = (before, after) => before !== void 0 && after !== void 0 && Object.is(before.value, after.value) && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
-  intrinsicConstructors.set(constructor, () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
-    const current = Object.getOwnPropertyDescriptors(value);
-    return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit && Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
-  }));
-  budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
-    ...getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)],
-    ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])
-  ]));
+  const unchanged = (before, after) => before !== void 0 && after !== void 0 && Object.is(before.value, after.value) && before.get === after.get && before.set === after.set && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+  intrinsicConstructors.set(
+    constructor,
+    () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
+      const current = Object.getOwnPropertyDescriptors(value);
+      return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit && Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
+    })
+  );
+  budget.setRetainedValues(
+    prototype,
+    () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
+      ...getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)],
+      ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(
+        ([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value, ...retainedAccessorClosures(descriptor)]
+      )
+    ])
+  );
 }
 function releaseObjectPrototype(budget) {
   for (const prototype of intrinsicPrototypeRoots.get(budget) ?? []) budget.setRetainedValues(prototype, void 0);
@@ -7344,6 +7410,24 @@ function getSandboxPrototype(value, budget) {
 function hasExplicitSandboxPrototype(value) {
   return prototypes.has(value);
 }
+function getSandboxPropertyDescriptor(value, key, budget) {
+  const hostProperties = isSandboxClosure(value) ? value.properties : void 0;
+  if (isSandboxClosure(value) && !isGuestClosure(value))
+    return hostProperties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(hostProperties, key);
+  let current = value;
+  let depth = 0;
+  while (typeof current === "object" && current !== null && (Array.isArray(current) || isPrototypeRecord(current))) {
+    const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
+    const descriptor = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key);
+    if (descriptor !== void 0) return descriptor;
+    current = getSandboxPrototype(current, budget);
+    if (current !== null) {
+      budget?.visitNode();
+      assertSandboxDataDepth(++depth);
+    }
+  }
+  return void 0;
+}
 function getSandboxDataProperty(value, key, budget) {
   let current = value;
   let depth = 0;
@@ -8907,7 +8991,7 @@ async function callRegexMethod(target, methodName, args, budget, context) {
   try {
     const input = await sandboxString(args[0], budget, context);
     if (methodName === "test") {
-      const exec = context?.getProperty === void 0 ? getSandboxDataProperty(target, "exec", budget) : context.getProperty(target, "exec");
+      const exec = context?.getProperty === void 0 ? getSandboxDataProperty(target, "exec", budget) : await context.getProperty(target, "exec");
       if (isSandboxClosure(exec)) {
         const result = await invokeBuiltinClosure(exec, [input], budget, context, target);
         if (result !== null && typeof result !== "object") {
@@ -9011,6 +9095,7 @@ function functionString(value) {
 // packages/safe-js/src/interp/string-coercion.ts
 var defaultStringHook = /* @__PURE__ */ Symbol("defaultStringHook");
 var defaultValueHook = /* @__PURE__ */ Symbol("defaultValueHook");
+var joiningArrays = /* @__PURE__ */ new WeakSet();
 function sandboxNumber(value, budget, context) {
   if (value === null || typeof value !== "object") {
     if (typeof value === "function") throw new TypeError("Expected a sandbox value.");
@@ -9025,12 +9110,30 @@ function sandboxString(value, budget, context, joining = /* @__PURE__ */ new Set
   }
   return objectToPrimitive(value, budget, context, joining, "string").then((primitive) => budget.allocateString(String(primitive)));
 }
+async function joinSandboxArray(value, length, separator, budget, context, joining = /* @__PURE__ */ new Set()) {
+  if (joiningArrays.has(value)) return "";
+  joiningArrays.add(value);
+  let text = "";
+  const release = retainValues(budget, () => [value, text, separator]);
+  try {
+    for (let index = 0; index < length; index++) {
+      budget.visitNode();
+      const element = await readCoercionProperty(value, String(index), context);
+      const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
+      text = budget.allocateString(text + (index === 0 ? "" : separator) + part);
+    }
+    return text;
+  } finally {
+    release();
+    joiningArrays.delete(value);
+  }
+}
 async function objectToPrimitive(value, budget, context, joining, hint) {
   const leaveCall = budget.enterCall();
   try {
     budget.visitNode();
     for (const name of hint === "string" ? ["toString", "valueOf"] : ["valueOf", "toString"]) {
-      const hook = conversionHook(value, name, budget);
+      const hook = await conversionHook(value, name, budget, context);
       let result;
       if (hook === defaultStringHook) {
         result = await defaultToString(value, budget, context, joining);
@@ -9050,7 +9153,7 @@ async function objectToPrimitive(value, budget, context, joining, hint) {
     leaveCall();
   }
 }
-function conversionHook(value, name, budget) {
+function conversionHook(value, name, budget, context) {
   const implicitBuiltin = !hasExplicitSandboxPrototype(value) && (Array.isArray(value) || isSandboxDate(value) || isFloat32Array(value) || sandboxErrorTypes.has(value) || isSandboxClosure(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxCollectionIterator(value) || isSandboxPromise(value) || isSandboxRegex(value) || isSandboxGenerator(value) || isGuestHostObject(value));
   let current = value;
   let depth = 0;
@@ -9058,9 +9161,7 @@ function conversionHook(value, name, budget) {
     const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
     const descriptor = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, name);
     if (descriptor !== void 0) {
-      if (!Object.hasOwn(descriptor, "value"))
-        throw new TypeError("String conversion requires sandbox data properties.");
-      return descriptor.value;
+      return readPropertyDescriptor(descriptor, value, context);
     }
     const parent = getSandboxPrototype(current, budget);
     if (current === value && (implicitBuiltin || parent === null && !hasExplicitSandboxPrototype(value))) {
@@ -9079,7 +9180,8 @@ async function defaultToString(value, budget, context, joining) {
   if (isSandboxClosure(value)) return budget.allocateString(functionString(value));
   if (isSandboxMap(value)) return "[object Map]";
   if (isSandboxSet(value)) return "[object Set]";
-  if (isSandboxCollectionIterator(value)) return collectionIteratorState(value).collectionKind === "map" ? "[object Map Iterator]" : "[object Set Iterator]";
+  if (isSandboxCollectionIterator(value))
+    return collectionIteratorState(value).collectionKind === "map" ? "[object Map Iterator]" : "[object Set Iterator]";
   if (isSandboxGenerator(value)) return "[object Generator]";
   if (isSandboxRegex(value)) {
     return budget.allocateString(
@@ -9089,35 +9191,20 @@ async function defaultToString(value, budget, context, joining) {
   if (isSandboxDate(value)) return budget.allocateString(dateString(value));
   if (Array.isArray(value) || isFloat32Array(value)) {
     if (Object.hasOwn(value, "join")) {
-      const join = ownDataValue(value, "join");
+      const join = await readCoercionProperty(value, "join", context);
       if (!isSandboxClosure(join))
         return isFloat32Array(value) ? "[object Float32Array]" : "[object Array]";
       return invokeBuiltinClosure(join, [], budget, context, value);
     }
-    if (joining.has(value)) return "";
-    joining.add(value);
-    let text = "";
-    const release = retainValues(budget, () => [text]);
-    try {
-      const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
-      for (let index = 0; index < length; index++) {
-        budget.visitNode();
-        const element = ownDataValue(value, String(index));
-        const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
-        text = budget.allocateString(text + (index === 0 ? "" : ",") + part);
-      }
-      return text;
-    } finally {
-      release();
-      joining.delete(value);
-    }
+    const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
+    return joinSandboxArray(value, length, ",", budget, context, joining);
   }
   if (sandboxErrorTypes.has(value)) {
-    const nameValue = ownDataValue(value, "name");
+    const nameValue = await readCoercionProperty(value, "name", context);
     const name = nameValue === void 0 ? "Error" : await sandboxString(nameValue, budget, context, joining);
     const release = retainValues(budget, () => [name]);
     try {
-      const messageValue = ownDataValue(value, "message");
+      const messageValue = await readCoercionProperty(value, "message", context);
       const message = messageValue === void 0 ? "" : await sandboxString(messageValue, budget, context, joining);
       return name === "" ? message : message === "" ? name : `${name}: ${message}`;
     } finally {
@@ -9126,12 +9213,153 @@ async function defaultToString(value, budget, context, joining) {
   }
   return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
 }
-function ownDataValue(value, name) {
+function readCoercionProperty(value, name, context) {
+  if (context?.getProperty !== void 0) return context.getProperty(value, name);
   const descriptor = Object.getOwnPropertyDescriptor(value, name);
-  if (descriptor !== void 0 && !Object.hasOwn(descriptor, "value")) {
-    throw new TypeError("String conversion requires sandbox data properties.");
+  return descriptor === void 0 ? void 0 : readPropertyDescriptor(descriptor, value, context);
+}
+
+// packages/safe-js/src/interp/globals/object.ts
+function createObjectGlobal(methods, budget) {
+  const construct = ([value]) => {
+    if (value === null || value === void 0) {
+      budget.chargeDataUsage(1);
+      return /* @__PURE__ */ Object.create(null);
+    }
+    if (typeof value !== "object") {
+      const box = createSandboxBox(value);
+      budget.chargeDataUsage(measureSandboxData([box]));
+      return box;
+    }
+    return value;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "Object",
+    length: 1,
+    call: construct,
+    construct: (args, context) => {
+      if (context?.newTarget === void 0 || context.newTarget === constructor)
+        return construct(args);
+      const value = construct([]);
+      const prototype2 = context.getProperty(context.newTarget, "prototype");
+      const finish = (prototype3) => {
+        if (typeof prototype3 === "object" && prototype3 !== null)
+          setSandboxPrototype(value, prototype3, budget);
+        return value;
+      };
+      return prototype2 instanceof Promise ? prototype2.then(finish) : finish(prototype2);
+    }
+  });
+  const properties = materializeFunctionProperties(constructor);
+  const prototype = properties.prototype;
+  Object.defineProperty(properties, "prototype", { writable: false });
+  for (const [name, method] of Object.entries(methods)) {
+    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
+  }
+  const prototypeMethods = {
+    toString: createSandboxClosure({
+      sandbox: true,
+      name: "toString",
+      length: 0,
+      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
+    }),
+    valueOf: createSandboxClosure({
+      sandbox: true,
+      name: "valueOf",
+      length: 0,
+      call: (_args, context) => {
+        const value = requireReceiver(context?.thisValue);
+        return construct([value]);
+      }
+    }),
+    hasOwnProperty: createSandboxClosure({
+      sandbox: true,
+      name: "hasOwnProperty",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        false
+      )
+    }),
+    propertyIsEnumerable: createSandboxClosure({
+      sandbox: true,
+      name: "propertyIsEnumerable",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        true
+      )
+    }),
+    isPrototypeOf: createSandboxClosure({
+      sandbox: true,
+      name: "isPrototypeOf",
+      length: 1,
+      call: ([value], context) => {
+        if (typeof value !== "object" || value === null) return false;
+        const receiver = requireReceiver(context?.thisValue);
+        let depth = 0;
+        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+          budget.visitNode();
+          assertSandboxDataDepth(depth++);
+          if (current === receiver) return true;
+        }
+        return false;
+      }
+    })
+  };
+  for (const [name, method] of Object.entries(prototypeMethods)) {
+    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
+  }
+  markDescriptorObject(prototype);
+  installObjectPrototype(budget, prototype, constructor);
+  return constructor;
+}
+function requireReceiver(value) {
+  if (value === null || value === void 0)
+    throw new TypeError("Object method requires a non-null receiver.");
+  return value;
+}
+function hasOwnSandboxProperty(value, key, enumerable) {
+  requireReceiver(value);
+  if (isGuestHostObject(value)) return hasHostObjectMember(value, key, enumerable);
+  let properties;
+  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
+  else if (isSandboxClosure(value)) {
+    if (key === "length" || key === "name") return !enumerable;
+    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
+  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
+    return false;
+  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
+  else properties = Object(value);
+  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
+}
+function typeTag(value) {
+  if (isSandboxBox(value)) value = boxedValue(value);
+  if (value === void 0) return "Undefined";
+  if (value === null) return "Null";
+  if (typeof value === "string") return "String";
+  if (typeof value === "number") return "Number";
+  if (typeof value === "boolean") return "Boolean";
+  if (isSandboxClosure(value)) {
+    while (value.boundTarget !== void 0) value = value.boundTarget;
+    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
   }
-  return descriptor?.value;
+  if (Array.isArray(value)) return "Array";
+  if (isSandboxDate(value)) return "Date";
+  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
+  if (isSandboxRegex(value)) return "RegExp";
+  if (isSandboxMap(value)) return "Map";
+  if (isSandboxSet(value)) return "Set";
+  if (isSandboxCollectionIterator(value)) return collectionIteratorState(value).collectionKind === "map" ? "Map Iterator" : "Set Iterator";
+  if (isSandboxPromise(value)) return "Promise";
+  if (isSandboxGenerator(value)) return "Generator";
+  if (isFloat32Array(value)) return "Float32Array";
+  return "Object";
 }
 
 // packages/safe-js/src/interp/property-key.ts
@@ -9514,12 +9742,34 @@ async function bindArrayPattern(pattern, value, context, evaluateNode2) {
   if (!Array.isArray(value)) {
     throw new TypeError("Array catch bindings require an array value.");
   }
+  let cursor = 0;
+  let done = false;
+  const next = async () => {
+    if (done || cursor >= value.length) {
+      done = true;
+      return { done: true, value: void 0 };
+    }
+    const key = cursor++;
+    return {
+      done: false,
+      value: context.getProperty === void 0 ? getSandboxDataProperty(value, key, context.budget) : await context.getProperty(value, key)
+    };
+  };
   for (let index = 0; index < pattern.elements.length; index += 1) {
     const element = pattern.elements[index];
     if (element === null) {
+      await next();
       continue;
     }
-    const elementValue = element.type === "RestElement" ? value.slice(index) : value[index];
+    let elementValue;
+    if (element.type === "RestElement") {
+      const rest = [];
+      for (let entry = await next(); !entry.done; entry = await next()) {
+        context.budget.allocateArrayLength(rest.length + 1);
+        rest.push(entry.value);
+      }
+      elementValue = rest;
+    } else elementValue = (await next()).value;
     const binding = await bindPattern(element, elementValue, context, evaluateNode2);
     if (!binding.ok) {
       return binding;
@@ -9534,7 +9784,7 @@ async function bindObjectPattern(pattern, value, context, evaluateNode2) {
   const excludedKeys = /* @__PURE__ */ new Set();
   for (const property of pattern.properties) {
     if (property.type === "RestElement") {
-      const restValue = copyObjectRest(value, excludedKeys);
+      const restValue = await copyObjectRest(value, excludedKeys, context);
       const binding2 = await bindPattern(property, restValue, context, evaluateNode2);
       if (!binding2.ok) {
         return binding2;
@@ -9548,7 +9798,7 @@ async function bindObjectPattern(pattern, value, context, evaluateNode2) {
     excludedKeys.add(String(key.value));
     const binding = await bindPattern(
       property.value,
-      context.getProperty === void 0 ? getSandboxDataProperty(value, key.value, context.budget) : context.getProperty(value, key.value),
+      context.getProperty === void 0 ? getSandboxDataProperty(value, key.value, context.budget) : await context.getProperty(value, key.value),
       context,
       evaluateNode2
     );
@@ -9592,12 +9842,18 @@ function getStaticPropertyKey(property) {
       throw new TypeError(`Unsupported catch binding property key '${property.type}'.`);
   }
 }
-function copyObjectRest(value, excludedKeys) {
+async function copyObjectRest(value, excludedKeys, context) {
   const rest = /* @__PURE__ */ Object.create(null);
-  for (const [key, entryValue] of ownEnumerableSandboxEntries(value, excludedKeys)) {
-    rest[key] = entryValue;
+  const release = retainValues(context.budget, () => [value, rest]);
+  try {
+    for (const key of ownEnumerableSandboxKeys(value)) {
+      if (excludedKeys.has(key) || !hasOwnSandboxProperty(value, key, true)) continue;
+      rest[key] = context.getProperty === void 0 ? getSandboxDataProperty(value, key, context.budget) : await context.getProperty(value, key);
+    }
+    return rest;
+  } finally {
+    release();
   }
-  return rest;
 }
 
 // packages/safe-js/src/interp/running-state.ts
@@ -9673,6 +9929,18 @@ function getSandboxIterator(value, budget, context) {
   if (isSandboxSet(value)) {
     return collectionIterator(value.values);
   }
+  if (Array.isArray(value) && context?.getProperty !== void 0) {
+    let index = 0;
+    return {
+      asynchronous: true,
+      snapshotIndex: () => index,
+      next: async () => {
+        if (index >= value.length) return { done: true, value: void 0 };
+        budget?.visitNode();
+        return { done: false, value: await context.getProperty(value, index++) };
+      }
+    };
+  }
   if (typeof value !== "object" && typeof value !== "function" || value === null) {
     return void 0;
   }
@@ -10067,7 +10335,7 @@ async function callPromiseClosure(callback, args, thisValue, budget, context) {
     const values = args.map(
       (value) => value instanceof Error && !(value instanceof SandboxError) ? coerceThrownValue(value, budget, stack) : value
     );
-    let result = callback.call(values, { stack, thisValue });
+    let result = callback.call(values, { ...context, stack, thisValue, newTarget: void 0 });
     if (callback.async !== true) result = await result;
     else if (isPromiseLike(result)) result = createSandboxPromise(Promise.resolve(result));
     if (isSandboxPromise(result) && result.synchronousPrefix !== void 0) {
@@ -10094,11 +10362,11 @@ function getPromisePrototype(budget) {
           target.promise.then(
             (value) => {
               consumeSettledHostCall(target);
-              return runPromiseReaction(onFulfilled, value, "fulfilled", budget, chained);
+              return runPromiseReaction(onFulfilled, value, "fulfilled", budget, chained, context);
             },
             (reason) => {
               consumeSettledHostCall(target);
-              return runPromiseReaction(onRejected, reason, "rejected", budget, chained);
+              return runPromiseReaction(onRejected, reason, "rejected", budget, chained, context);
             }
           )
         );
@@ -10110,12 +10378,18 @@ function getPromisePrototype(budget) {
       sandbox: true,
       call: ([onRejected], context) => {
         const target = context?.thisValue;
-        const then = readPromiseReceiverProperty(target, "then", prototype);
-        if (!isSandboxClosure(then)) throw new TypeError("Promise.catch requires a callable then.");
-        return then.call([void 0, onRejected], {
-          stack: context?.stack ?? [],
-          thisValue: target
-        });
+        const invoke = (then2) => {
+          if (!isSandboxClosure(then2))
+            throw new TypeError("Promise.catch requires a callable then.");
+          return then2.call([void 0, onRejected], {
+            ...context,
+            stack: context?.stack ?? [],
+            thisValue: target,
+            newTarget: void 0
+          });
+        };
+        const then = readPromiseReceiverProperty(target, "then", prototype, context);
+        return then instanceof Promise ? then.then(invoke) : invoke(then);
       },
       name: "catch"
     }),
@@ -10126,46 +10400,57 @@ function getPromisePrototype(budget) {
         if (typeof target !== "object" || target === null) {
           throw new TypeError("Promise.finally requires an object receiver.");
         }
-        validatePromiseConstructorProperty(target, prototype);
-        const then = readPromiseReceiverProperty(target, "then", prototype);
-        if (!isSandboxClosure(then))
-          throw new TypeError("Promise.finally requires a callable then.");
-        const handlers = isSandboxClosure(onFinally) ? ["fulfilled", "rejected"].map(
-          (state) => createSandboxClosure({
-            sandbox: true,
-            retainedValues: () => [onFinally],
-            call: async ([value]) => {
-              const result = await callPromiseClosure(
-                onFinally,
-                [],
-                void 0,
-                budget,
-                context
-              );
-              const pending = isSandboxPromise(result) && getPromiseMember("constructor", budget) === intrinsicPromiseConstructors.get(budget) ? result : createSandboxPromise(resolveSandboxValue(result, { budget }));
-              const cleanupThen = getPromiseMember("then", budget);
-              if (!isSandboxClosure(cleanupThen))
-                throw new TypeError("Promise cleanup requires a callable then.");
-              return callPromiseClosure(
-                cleanupThen,
-                [
-                  createSandboxClosure({
-                    sandbox: true,
-                    retainedValues: () => [value],
-                    call: () => {
-                      if (state === "rejected") throw value;
-                      return value;
-                    }
-                  })
-                ],
-                pending,
-                budget,
-                context
-              );
-            }
-          })
-        ) : [onFinally, onFinally];
-        return then.call(handlers, { stack: context?.stack ?? [], thisValue: target });
+        const invoke = (then) => {
+          if (!isSandboxClosure(then))
+            throw new TypeError("Promise.finally requires a callable then.");
+          const handlers = isSandboxClosure(onFinally) ? ["fulfilled", "rejected"].map(
+            (state) => createSandboxClosure({
+              sandbox: true,
+              retainedValues: () => [onFinally],
+              call: async ([value]) => {
+                const result = await callPromiseClosure(
+                  onFinally,
+                  [],
+                  void 0,
+                  budget,
+                  context
+                );
+                const pending = isSandboxPromise(result) && getPromiseMember("constructor", budget) === intrinsicPromiseConstructors.get(budget) ? result : createSandboxPromise(resolveSandboxValue(result, { budget }));
+                const cleanupThen = getPromiseMember("then", budget);
+                if (!isSandboxClosure(cleanupThen))
+                  throw new TypeError("Promise cleanup requires a callable then.");
+                return callPromiseClosure(
+                  cleanupThen,
+                  [
+                    createSandboxClosure({
+                      sandbox: true,
+                      retainedValues: () => [value],
+                      call: () => {
+                        if (state === "rejected") throw value;
+                        return value;
+                      }
+                    })
+                  ],
+                  pending,
+                  budget,
+                  context
+                );
+              }
+            })
+          ) : [onFinally, onFinally];
+          return then.call(handlers, {
+            ...context,
+            stack: context?.stack ?? [],
+            thisValue: target,
+            newTarget: void 0
+          });
+        };
+        const finish = () => {
+          const then = readPromiseReceiverProperty(target, "then", prototype, context);
+          return then instanceof Promise ? then.then(invoke) : invoke(then);
+        };
+        const validation = validatePromiseConstructorProperty(target, prototype, context);
+        return validation instanceof Promise ? validation.then(finish) : finish();
       },
       name: "finally"
     })
@@ -10176,15 +10461,19 @@ function getPromisePrototype(budget) {
   promisePrototypes.set(budget, prototype);
   return prototype;
 }
-function readPromiseReceiverProperty(receiver, property, prototype) {
+function readPromiseReceiverProperty(receiver, property, prototype, context) {
+  if (!isSandboxPromise(receiver) && context?.getProperty !== void 0)
+    return context.getProperty(receiver, property);
   const properties = isSandboxPromise(receiver) ? prototype : isSandboxClosure(receiver) ? receiver.properties : receiver;
   return typeof properties === "object" && properties !== null && Object.hasOwn(properties, property) ? properties[property] : void 0;
 }
-function validatePromiseConstructorProperty(receiver, prototype) {
-  const constructor = readPromiseReceiverProperty(receiver, "constructor", prototype);
-  if (constructor !== void 0 && (typeof constructor !== "object" || constructor === null)) {
-    throw new TypeError("Promise constructor property must be an object.");
-  }
+function validatePromiseConstructorProperty(receiver, prototype, context) {
+  const validate = (constructor2) => {
+    if (constructor2 !== void 0 && (typeof constructor2 !== "object" || constructor2 === null))
+      throw new TypeError("Promise constructor property must be an object.");
+  };
+  const constructor = readPromiseReceiverProperty(receiver, "constructor", prototype, context);
+  return constructor instanceof Promise ? constructor.then(validate) : validate(constructor);
 }
 async function settleIterable(iterable, method, budget, constructor, context) {
   const capability = await createPromiseCapability(constructor, budget, context);
@@ -10219,7 +10508,7 @@ async function settleIterable(iterable, method, budget, constructor, context) {
     }
   };
   try {
-    const promiseResolve = readPromiseReceiverProperty(constructor, "resolve", prototype);
+    const promiseResolve = await readPromiseReceiverProperty(constructor, "resolve", prototype, context);
     if (!isSandboxClosure(promiseResolve))
       throw new TypeError("Promise constructor requires a callable resolve.");
     const iterator = getSandboxIterator(iterable, budget, context);
@@ -10269,7 +10558,7 @@ async function settleIterable(iterable, method, budget, constructor, context) {
             });
           });
           remaining++;
-          const then = readPromiseReceiverProperty(entry, "then", prototype);
+          const then = await readPromiseReceiverProperty(entry, "then", prototype, context);
           if (!isSandboxClosure(then))
             throw new TypeError("Promise resolver result requires a callable then.");
           await callPromiseClosure(then, handlers, entry, budget, context);
@@ -10356,7 +10645,11 @@ function resolveSandboxValueNow(value, options) {
       }
     );
   }
-  const then = getThenable(value);
+  const then = getThenable(value, options.budget);
+  if (then instanceof Promise)
+    return then.then(
+      (method) => method === void 0 ? budgetIfNeeded(value, options.budget) : resolveThenable(value, method, options)
+    );
   if (then !== void 0) {
     return resolveThenable(value, then, options);
   }
@@ -10376,7 +10669,7 @@ function resolveThenable(value, then, options) {
       try {
         if (settlement.state === "fulfilled") {
           resolve(
-            isSandboxPromise(settlement.value) || getThenable(settlement.value) !== void 0 ? resolveSandboxValueNow(settlement.value, options) : budgetIfNeeded(settlement.value, options.budget)
+            requiresPromiseResolution(settlement.value, options.budget) ? resolveSandboxValueNow(settlement.value, options) : budgetIfNeeded(settlement.value, options.budget)
           );
         } else {
           reject(budgetIfNeeded(settlement.value, options.budget));
@@ -10432,7 +10725,7 @@ function resolveThenable(value, then, options) {
     ).catch(reject);
   });
 }
-function runPromiseReaction(handler, value, state, budget, self) {
+function runPromiseReaction(handler, value, state, budget, self, context) {
   return new Promise((resolve, reject) => {
     if (state === "rejected" && value instanceof SandboxError && (value.code === "budgetExceeded" || value.code === "reentry")) {
       reject(value);
@@ -10446,14 +10739,14 @@ function runPromiseReaction(handler, value, state, budget, self) {
         reject(
           createSubsetErrorValue("TypeError", "Promise cannot resolve to itself.", [], budget)
         );
-      } else if (isSandboxPromise(result) || getThenable(result) !== void 0) {
+      } else if (requiresPromiseResolution(result, budget)) {
         resolve(resolvePromiseResult(result, budget, self));
       } else {
         resolve(budgetSandboxValue(result, budget));
       }
     };
     if (isSandboxClosure(handler)) {
-      callInPromiseJob(handler, [argument], void 0, { fulfilled, rejected: reject }).catch(
+      callInPromiseJob(handler, [argument], void 0, { fulfilled, rejected: reject }, context).catch(
         reject
       );
     } else {
@@ -10464,10 +10757,10 @@ function runPromiseReaction(handler, value, state, budget, self) {
     }
   });
 }
-function callInPromiseJob(handler, args, thisValue = void 0, completion) {
+function callInPromiseJob(handler, args, thisValue = void 0, completion, context) {
   return runPromiseJob(async () => {
     try {
-      let result = handler.call(args, { stack: [], thisValue });
+      let result = handler.call(args, { ...context, stack: [], thisValue, newTarget: void 0 });
       if (handler.async !== true) result = await result;
       if (isSandboxPromise(result) && result.synchronousPrefix !== void 0) {
         await result.synchronousPrefix;
@@ -10500,7 +10793,7 @@ function resolvePromiseResult(result, budget, self) {
       settled = true;
       try {
         if (state === "rejected") reject(budgetSandboxValue(value, budget));
-        else if (isSandboxPromise(value) || getThenable(value) !== void 0) {
+        else if (requiresPromiseResolution(value, budget)) {
           resolve(resolvePromiseResult(value, budget, self));
         } else {
           resolve(budgetSandboxValue(value, budget));
@@ -10548,11 +10841,23 @@ function resolvePromiseResult(result, budget, self) {
 function isSelfResolution(result, self) {
   return self !== void 0 && (result === self || isSandboxPromise(result) && result.promise === self.promise);
 }
-function getThenable(value) {
+function requiresPromiseResolution(value, budget) {
+  if (isSandboxPromise(value)) return true;
+  const descriptor = getSandboxPropertyDescriptor(value, "then", budget);
+  return descriptor !== void 0 && (!("value" in descriptor) || isSandboxClosure(descriptor.value));
+}
+function getThenable(value, budget) {
   if (typeof value !== "object" || value === null || isSandboxPromise(value)) {
     return void 0;
   }
-  const then = isSandboxClosure(value) ? value.properties?.then : value.then;
+  const descriptor = getSandboxPropertyDescriptor(value, "then", budget);
+  if (descriptor !== void 0 && !("value" in descriptor)) {
+    const getter = accessorClosure(descriptor.get);
+    if (getter === void 0) return void 0;
+    const result = budget === void 0 ? getter.call([], { stack: [], thisValue: value }) : callPromiseClosure(getter, [], value, budget);
+    return Promise.resolve(result).then((then2) => isSandboxClosure(then2) ? then2 : void 0);
+  }
+  const then = descriptor?.value;
   return isSandboxClosure(then) ? then : void 0;
 }
 function budgetIfNeeded(value, budget) {
@@ -10843,6 +11148,13 @@ function ownEnumerableSandboxEntries(value, excludedKeys) {
   else entries = Object.entries(Object(value));
   return excludedKeys === void 0 ? entries : entries.filter(([key]) => !excludedKeys.has(key));
 }
+function ownEnumerableSandboxKeys(value) {
+  if (isGuestHostObject(value)) return getHostObjectKeys(value);
+  if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
+  if (isGuestClosure(value)) return Object.keys(value.properties ?? {});
+  if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value)) return [];
+  return Object.keys(Object(value));
+}
 function createSandboxPromise(promise, metadata = {}) {
   const original = metadata.trackReplay === false ? promise : promiseReplayContext.getStore()?.track(promise) ?? promise;
   const sandboxPromise = {
@@ -10997,6 +11309,7 @@ function measureSandboxData(values, options = {}) {
       for (const [key, descriptor] of boxedDataProperties(value)) {
         usage += key.length + 1;
         if ("value" in descriptor) visit(descriptor.value, depth + 1);
+        else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
       }
       return;
     }
@@ -11029,6 +11342,7 @@ function measureSandboxData(values, options = {}) {
           if (key === "length") continue;
           usage += key.length + 1;
           if ("value" in descriptor) visit(descriptor.value, depth + 1);
+          else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
         }
         return;
       }
@@ -11067,6 +11381,7 @@ function measureSandboxData(values, options = {}) {
             if (key === "prototype" || key === "name" || key === "length") continue;
             usage += key.length + 1;
             if ("value" in descriptor) visit(descriptor.value, depth + 1);
+            else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
           }
         } else visit(value.properties, depth + 1);
       }
@@ -11110,7 +11425,8 @@ function measureSandboxData(values, options = {}) {
       const descriptor = descriptors[key];
       if (!descriptor.enumerable && !hasManagedDescriptors(value)) continue;
       usage += key.length;
-      visit("value" in descriptor ? descriptor.value : void 0, depth + 1);
+      if ("value" in descriptor) visit(descriptor.value, depth + 1);
+      else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
     }
   };
   for (const value of values) visit(value);
@@ -24466,24 +24782,32 @@ async function bindAssignmentPattern2(pattern, value, target, scope, context) {
 async function bindArrayPattern2(pattern, value, target, scope, context) {
   const iterator = isSandboxCollectionIterator(value) ? value : void 0;
   const values = iterator === void 0 ? getArrayPatternValues(value) : void 0;
+  let cursor = 0;
+  let done = false;
+  const next = async () => {
+    if (iterator !== void 0) return nextCollectionIterator(iterator, context.budget);
+    if (done || cursor >= values.length) {
+      done = true;
+      return { done: true, value: void 0 };
+    }
+    return { done: false, value: await context.getProperty(values, cursor++) };
+  };
   for (let index = 0; index < pattern.elements.length; index += 1) {
     const element = pattern.elements[index];
     if (element === null) {
-      if (iterator !== void 0) nextCollectionIterator(iterator, context.budget);
+      await next();
       continue;
     }
     let elementValue;
-    if (iterator === void 0) {
-      elementValue = element.type === "RestElement" ? values.slice(index) : values[index];
-    } else if (element.type === "RestElement") {
+    if (element.type === "RestElement") {
       const rest = [];
-      for (let entry = nextCollectionIterator(iterator, context.budget); !entry.done; entry = nextCollectionIterator(iterator, context.budget)) {
+      for (let entry = await next(); !entry.done; entry = await next()) {
         context.budget?.allocateArrayLength(rest.length + 1);
         rest.push(entry.value);
       }
       elementValue = rest;
     } else {
-      elementValue = nextCollectionIterator(iterator, context.budget).value;
+      elementValue = (await next()).value;
     }
     const binding = await bindPattern2(element, elementValue, target, scope, context);
     if (!binding.ok) {
@@ -24501,7 +24825,7 @@ async function bindObjectPattern2(pattern, value, target, scope, context) {
     if (property.type === "RestElement") {
       const binding2 = await bindPattern2(
         property,
-        copyObjectRestValue(value, excludedKeys),
+        await copyObjectRestValue(value, excludedKeys, context),
         target,
         scope,
         context
@@ -24518,7 +24842,7 @@ async function bindObjectPattern2(pattern, value, target, scope, context) {
     excludedKeys.add(String(key.value));
     const binding = await bindPattern2(
       property.value,
-      context.getProperty(value, key.value),
+      await context.getProperty(value, key.value),
       target,
       scope,
       context
@@ -24544,7 +24868,7 @@ async function bindMemberExpression(pattern, value, scope, context) {
   if (!isIndexableValue(object.value)) {
     throw new TypeError("Assignment expressions require a sandbox object property.");
   }
-  context.setProperty(object.value, await context.toPropertyKey(property.value), value);
+  await context.setProperty(object.value, await context.toPropertyKey(property.value), value);
   return { ok: true };
 }
 async function evaluatePatternKey(property, context) {
@@ -24595,12 +24919,18 @@ function describeRuntimeValue(value) {
   if (typeof value === "object") return value.constructor?.name ?? "Object";
   return typeof value;
 }
-function copyObjectRestValue(value, excludedKeys) {
+async function copyObjectRestValue(value, excludedKeys, context) {
   const rest = /* @__PURE__ */ Object.create(null);
-  for (const [key, entryValue] of ownEnumerableSandboxEntries(value, excludedKeys)) {
-    defineProperty(rest, key, entryValue);
+  const release = context.budget === void 0 ? () => void 0 : retainValues(context.budget, () => [value, rest]);
+  try {
+    for (const key of ownEnumerableSandboxKeys(value)) {
+      if (excludedKeys.has(key) || !hasOwnSandboxProperty(value, key, true)) continue;
+      defineProperty(rest, key, await context.getProperty(value, key));
+    }
+    return rest;
+  } finally {
+    release();
   }
-  return rest;
 }
 function isIndexableValue(value) {
   return typeof value === "object" && value !== null;
@@ -24734,144 +25064,6 @@ function getDatePrototype(value, budget, owner) {
   return prototype === value ? null : prototype ?? null;
 }
 
-// packages/safe-js/src/interp/globals/object.ts
-function createObjectGlobal(methods, budget) {
-  const construct = ([value]) => {
-    if (value === null || value === void 0) {
-      budget.chargeDataUsage(1);
-      return /* @__PURE__ */ Object.create(null);
-    }
-    if (typeof value !== "object") {
-      const box = createSandboxBox(value);
-      budget.chargeDataUsage(measureSandboxData([box]));
-      return box;
-    }
-    return value;
-  };
-  const constructor = createSandboxClosure({
-    guest: true,
-    sandbox: true,
-    name: "Object",
-    length: 1,
-    call: construct,
-    construct: (args, context) => {
-      if (context?.newTarget === void 0 || context.newTarget === constructor) return construct(args);
-      const value = construct([]);
-      const prototype2 = context.getProperty(context.newTarget, "prototype");
-      if (typeof prototype2 === "object" && prototype2 !== null) setSandboxPrototype(value, prototype2, budget);
-      return value;
-    }
-  });
-  const properties = materializeFunctionProperties(constructor);
-  const prototype = properties.prototype;
-  Object.defineProperty(properties, "prototype", { writable: false });
-  for (const [name, method] of Object.entries(methods)) {
-    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
-  }
-  const prototypeMethods = {
-    toString: createSandboxClosure({
-      sandbox: true,
-      name: "toString",
-      length: 0,
-      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
-    }),
-    valueOf: createSandboxClosure({
-      sandbox: true,
-      name: "valueOf",
-      length: 0,
-      call: (_args, context) => {
-        const value = requireReceiver(context?.thisValue);
-        return construct([value]);
-      }
-    }),
-    hasOwnProperty: createSandboxClosure({
-      sandbox: true,
-      name: "hasOwnProperty",
-      length: 1,
-      call: async ([key], context) => hasOwnSandboxProperty(
-        requireReceiver(context?.thisValue),
-        await sandboxString(key, budget, context),
-        false
-      )
-    }),
-    propertyIsEnumerable: createSandboxClosure({
-      sandbox: true,
-      name: "propertyIsEnumerable",
-      length: 1,
-      call: async ([key], context) => hasOwnSandboxProperty(
-        requireReceiver(context?.thisValue),
-        await sandboxString(key, budget, context),
-        true
-      )
-    }),
-    isPrototypeOf: createSandboxClosure({
-      sandbox: true,
-      name: "isPrototypeOf",
-      length: 1,
-      call: ([value], context) => {
-        if (typeof value !== "object" || value === null) return false;
-        const receiver = requireReceiver(context?.thisValue);
-        let depth = 0;
-        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
-          budget.visitNode();
-          assertSandboxDataDepth(depth++);
-          if (current === receiver) return true;
-        }
-        return false;
-      }
-    })
-  };
-  for (const [name, method] of Object.entries(prototypeMethods)) {
-    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
-  }
-  markDescriptorObject(prototype);
-  installObjectPrototype(budget, prototype, constructor);
-  return constructor;
-}
-function requireReceiver(value) {
-  if (value === null || value === void 0)
-    throw new TypeError("Object method requires a non-null receiver.");
-  return value;
-}
-function hasOwnSandboxProperty(value, key, enumerable) {
-  requireReceiver(value);
-  if (isGuestHostObject(value)) return hasHostObjectMember(value, key, enumerable);
-  let properties;
-  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
-  else if (isSandboxClosure(value)) {
-    if (key === "length" || key === "name") return !enumerable;
-    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
-  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
-    return false;
-  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
-  else properties = Object(value);
-  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
-  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
-}
-function typeTag(value) {
-  if (isSandboxBox(value)) value = boxedValue(value);
-  if (value === void 0) return "Undefined";
-  if (value === null) return "Null";
-  if (typeof value === "string") return "String";
-  if (typeof value === "number") return "Number";
-  if (typeof value === "boolean") return "Boolean";
-  if (isSandboxClosure(value)) {
-    while (value.boundTarget !== void 0) value = value.boundTarget;
-    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
-  }
-  if (Array.isArray(value)) return "Array";
-  if (isSandboxDate(value)) return "Date";
-  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
-  if (isSandboxRegex(value)) return "RegExp";
-  if (isSandboxMap(value)) return "Map";
-  if (isSandboxSet(value)) return "Set";
-  if (isSandboxCollectionIterator(value)) return collectionIteratorState(value).collectionKind === "map" ? "Map Iterator" : "Set Iterator";
-  if (isSandboxPromise(value)) return "Promise";
-  if (isSandboxGenerator(value)) return "Generator";
-  if (isFloat32Array(value)) return "Float32Array";
-  return "Object";
-}
-
 // packages/safe-js/src/interp/globals/numeric-parsers.ts
 function createNumericParsers(budget) {
   return {
@@ -25477,12 +25669,17 @@ function createPrimitiveConstructor(options, budget) {
   const prototype = createSandboxBox(initial);
   const allocate = (value, context) => {
     const box = createSandboxBox(value);
+    const finish = (prototype2) => {
+      if (typeof prototype2 === "object" && prototype2 !== null)
+        setSandboxPrototype(box, prototype2, budget);
+      budget.chargeDataUsage(measureSandboxData([box]));
+      return box;
+    };
     if (context?.newTarget !== void 0 && context.newTarget !== constructor) {
       const prototype2 = context.getProperty(context.newTarget, "prototype");
-      if (typeof prototype2 === "object" && prototype2 !== null) setSandboxPrototype(box, prototype2, budget);
+      return prototype2 instanceof Promise ? prototype2.then(finish) : finish(prototype2);
     }
-    budget.chargeDataUsage(measureSandboxData([box]));
-    return box;
+    return finish(void 0);
   };
   const constructor = createSandboxClosure({
     guest: true,
@@ -25543,147 +25740,185 @@ function createPrimitiveConstructor(options, budget) {
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
-    Object: createObjectGlobal({
-      keys: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => budgetSandboxValue2(getOwnEnumerableKeys(value), options.budget),
-        name: "keys"
-      }),
-      values: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => allocateProducedSandboxValue(getOwnEnumerableValues(value), options.budget),
-        name: "values"
-      }),
-      entries: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => allocateProducedSandboxValue(ownEnumerableSandboxEntries(value), options.budget),
-        name: "entries"
-      }),
-      hasOwn: createSandboxClosure({
-        sandbox: true,
-        call: ([value, key], context) => {
-          if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
-          const name = sandboxString(key, options.budget, context);
-          return typeof name === "string" ? hasOwnSandboxProperty(value, name, false) : name.then((property) => hasOwnSandboxProperty(value, property, false));
-        },
-        name: "hasOwn"
-      }),
-      getOwnPropertyDescriptor: createSandboxClosure({
-        sandbox: true,
-        call: async ([value, key], context) => {
-          const descriptor = Object.getOwnPropertyDescriptor(objectProperties(value), await sandboxString(key, options.budget, context));
-          if (descriptor !== void 0 && !("value" in descriptor)) throw new TypeError("Only data property descriptors are supported.");
-          return descriptor === void 0 ? void 0 : allocateProducedSandboxValue(descriptor, options.budget);
-        },
-        name: "getOwnPropertyDescriptor"
-      }),
-      getOwnPropertyNames: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => budgetSandboxValue2(Object.getOwnPropertyNames(objectProperties(value)), options.budget),
-        name: "getOwnPropertyNames"
-      }),
-      defineProperty: createSandboxClosure({
-        sandbox: true,
-        call: async ([value, key, descriptor], context) => {
-          defineDataProperty(value, await sandboxString(key, options.budget, context), dataDescriptor(descriptor), options.budget);
-          return value;
-        },
-        name: "defineProperty"
-      }),
-      defineProperties: createSandboxClosure({
-        sandbox: true,
-        call: ([value, descriptors]) => {
-          const properties = ownEnumerableSandboxEntries(descriptors).map(([key, descriptor]) => [key, dataDescriptor(descriptor)]);
-          for (const [key, descriptor] of properties) {
-            defineDataProperty(value, key, descriptor, options.budget);
-          }
-          return value;
-        },
-        name: "defineProperties"
-      }),
-      getPrototypeOf: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => {
-          if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
-          if (value !== null && value !== void 0 && typeof value !== "object") value = createSandboxBox(value);
-          objectProperties(value);
-          return getSandboxPrototype(value, options.budget);
-        },
-        name: "getPrototypeOf"
-      }),
-      setPrototypeOf: createSandboxClosure({
-        sandbox: true,
-        call: ([value, prototype]) => {
-          objectProperties(value, true);
-          if (prototype !== null) objectProperties(prototype);
-          setSandboxPrototype(value, prototype, options.budget);
-          return value;
-        },
-        name: "setPrototypeOf"
-      }),
-      create: createSandboxClosure({
-        sandbox: true,
-        call: ([prototype, descriptors]) => {
-          if (prototype !== null) objectProperties(prototype);
-          const value = /* @__PURE__ */ Object.create(null);
-          setSandboxPrototype(value, prototype, options.budget);
-          if (descriptors !== void 0) {
-            const properties = ownEnumerableSandboxEntries(descriptors).map(([key, descriptor]) => [key, dataDescriptor(descriptor)]);
-            for (const [key, descriptor] of properties) {
-              defineDataProperty(value, key, descriptor, options.budget);
-            }
-          }
-          return allocateProducedSandboxValue(value, options.budget);
-        },
-        name: "create"
-      }),
-      is: createSandboxClosure({
-        sandbox: true,
-        call: ([left, right]) => Reflect.apply(Object.is, Object, [left, right]),
-        name: "is"
-      }),
-      fromEntries: createSandboxClosure({
-        sandbox: true,
-        call: ([value], context) => {
-          const iterator = getSandboxIterator(value, options.budget, context);
-          if (iterator === void 0) {
-            throw new TypeError("Object.fromEntries requires an iterable.");
-          }
-          if (context === void 0 && !iterator.generator && !iterator.asynchronous) {
+    Object: createObjectGlobal(
+      {
+        keys: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => budgetSandboxValue2(ownEnumerableSandboxKeys(value), options.budget),
+          name: "keys"
+        }),
+        values: createSandboxClosure({
+          sandbox: true,
+          call: ([value], context) => context === void 0 ? allocateProducedSandboxValue(
+            ownEnumerableSandboxEntries(value).map(([, entry]) => entry),
+            options.budget
+          ) : getOwnEnumerableEntries(value, options.budget, context).then(
+            (entries) => allocateProducedSandboxValue(
+              entries.map(([, entry]) => entry),
+              options.budget
+            )
+          ),
+          name: "values"
+        }),
+        entries: createSandboxClosure({
+          sandbox: true,
+          call: ([value], context) => context === void 0 ? allocateProducedSandboxValue(ownEnumerableSandboxEntries(value), options.budget) : getOwnEnumerableEntries(value, options.budget, context).then(
+            (entries) => allocateProducedSandboxValue(entries, options.budget)
+          ),
+          name: "entries"
+        }),
+        hasOwn: createSandboxClosure({
+          sandbox: true,
+          call: ([value, key], context) => {
+            if (value === null || value === void 0)
+              throw new TypeError("Cannot convert undefined or null to object.");
+            const name = sandboxString(key, options.budget, context);
+            return typeof name === "string" ? hasOwnSandboxProperty(value, name, false) : name.then((property) => hasOwnSandboxProperty(value, property, false));
+          },
+          name: "hasOwn"
+        }),
+        getOwnPropertyDescriptor: createSandboxClosure({
+          sandbox: true,
+          call: async ([value, key], context) => {
+            const descriptor = Object.getOwnPropertyDescriptor(
+              objectProperties(value),
+              await sandboxString(key, options.budget, context)
+            );
+            if (descriptor === void 0) return void 0;
             return allocateProducedSandboxValue(
-              Object.setPrototypeOf(
-                Reflect.apply(Object.fromEntries, Object, [{ [Symbol.iterator]: () => iterator }]),
-                null
-              ),
+              exposePropertyDescriptor(descriptor),
               options.budget
             );
-          }
-          return objectFromSandboxEntries(value, iterator, options.budget, context);
-        },
-        name: "fromEntries"
-      }),
-      freeze: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => {
-          if (isGuestHostObject(value)) throw new TypeError("Live host objects cannot be frozen.");
-          if (typeof value === "object" && value !== null) {
-            Object.freeze(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
-          }
-          return value;
-        },
-        name: "freeze"
-      }),
-      isFrozen: createSandboxClosure({
-        sandbox: true,
-        call: ([value]) => Object.isFrozen(isGuestClosure(value) ? materializeFunctionProperties(value) : value),
-        name: "isFrozen"
-      }),
-      assign: createSandboxClosure({
-        sandbox: true,
-        call: ([target, ...sources]) => assignSandboxValues(target, sources, options.budget),
-        name: "assign"
-      })
-    }, options.budget),
+          },
+          name: "getOwnPropertyDescriptor"
+        }),
+        getOwnPropertyDescriptors: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => {
+            const descriptors = /* @__PURE__ */ Object.create(null);
+            for (const [key, descriptor] of Object.entries(
+              Object.getOwnPropertyDescriptors(objectProperties(value))
+            ))
+              defineOwnDataProperty(descriptors, key, exposePropertyDescriptor(descriptor));
+            return allocateProducedSandboxValue(descriptors, options.budget);
+          },
+          name: "getOwnPropertyDescriptors"
+        }),
+        getOwnPropertyNames: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => budgetSandboxValue2(Object.getOwnPropertyNames(objectProperties(value)), options.budget),
+          name: "getOwnPropertyNames"
+        }),
+        defineProperty: createSandboxClosure({
+          sandbox: true,
+          call: async ([value, key, descriptor], context) => {
+            objectProperties(value, true);
+            const property = await sandboxString(key, options.budget, context);
+            defineDataProperty(
+              value,
+              property,
+              await propertyDescriptor(descriptor, options.budget, context),
+              options.budget
+            );
+            return value;
+          },
+          name: "defineProperty"
+        }),
+        defineProperties: createSandboxClosure({
+          sandbox: true,
+          call: async ([value, descriptors], context) => {
+            await definePropertiesFromObject(value, descriptors, options.budget, context);
+            return value;
+          },
+          name: "defineProperties"
+        }),
+        getPrototypeOf: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => {
+            if (isSandboxDate(value))
+              return getDatePrototype(value, options.budget, options.compileOwner);
+            if (value !== null && value !== void 0 && typeof value !== "object")
+              value = createSandboxBox(value);
+            objectProperties(value);
+            return getSandboxPrototype(value, options.budget);
+          },
+          name: "getPrototypeOf"
+        }),
+        setPrototypeOf: createSandboxClosure({
+          sandbox: true,
+          call: ([value, prototype]) => {
+            objectProperties(value, true);
+            if (prototype !== null) objectProperties(prototype);
+            setSandboxPrototype(value, prototype, options.budget);
+            return value;
+          },
+          name: "setPrototypeOf"
+        }),
+        create: createSandboxClosure({
+          sandbox: true,
+          call: async ([prototype, descriptors], context) => {
+            if (prototype !== null) objectProperties(prototype);
+            const value = /* @__PURE__ */ Object.create(null);
+            setSandboxPrototype(value, prototype, options.budget);
+            if (descriptors !== void 0) {
+              await definePropertiesFromObject(value, descriptors, options.budget, context);
+            }
+            return allocateProducedSandboxValue(value, options.budget);
+          },
+          name: "create"
+        }),
+        is: createSandboxClosure({
+          sandbox: true,
+          call: ([left, right]) => Reflect.apply(Object.is, Object, [left, right]),
+          name: "is"
+        }),
+        fromEntries: createSandboxClosure({
+          sandbox: true,
+          call: ([value], context) => {
+            const iterator = getSandboxIterator(value, options.budget, context);
+            if (iterator === void 0) {
+              throw new TypeError("Object.fromEntries requires an iterable.");
+            }
+            if (context === void 0 && !iterator.generator && !iterator.asynchronous) {
+              return allocateProducedSandboxValue(
+                Object.setPrototypeOf(
+                  Reflect.apply(Object.fromEntries, Object, [
+                    { [Symbol.iterator]: () => iterator }
+                  ]),
+                  null
+                ),
+                options.budget
+              );
+            }
+            return objectFromSandboxEntries(value, iterator, options.budget, context);
+          },
+          name: "fromEntries"
+        }),
+        freeze: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => {
+            if (isGuestHostObject(value))
+              throw new TypeError("Live host objects cannot be frozen.");
+            if (typeof value === "object" && value !== null) {
+              Object.freeze(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
+            }
+            return value;
+          },
+          name: "freeze"
+        }),
+        isFrozen: createSandboxClosure({
+          sandbox: true,
+          call: ([value]) => Object.isFrozen(isGuestClosure(value) ? materializeFunctionProperties(value) : value),
+          name: "isFrozen"
+        }),
+        assign: createSandboxClosure({
+          sandbox: true,
+          call: ([target, ...sources], context) => assignSandboxValues(target, sources, options.budget, context),
+          name: "assign"
+        })
+      },
+      options.budget
+    ),
     Array: createSandboxClosure({
       sandbox: true,
       call: (args) => createArrayFromConstructorArgs(args, options.budget),
@@ -25707,66 +25942,75 @@ function createObjectArrayGlobals(options) {
         })
       }
     }),
-    String: createPrimitiveConstructor({
-      call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
-      name: "String",
-      properties: {
-        raw: createSandboxClosure({
-          sandbox: true,
-          call: (args) => stringRaw(args, options.budget),
-          name: "raw"
-        }),
-        fromCharCode: createSandboxClosure({
-          sandbox: true,
-          call: (args) => options.budget.allocateString(Reflect.apply(String.fromCharCode, String, [...args])),
-          name: "fromCharCode"
-        }),
-        fromCodePoint: createSandboxClosure({
-          sandbox: true,
-          call: (args) => options.budget.allocateString(Reflect.apply(String.fromCodePoint, String, [...args])),
-          name: "fromCodePoint"
-        })
-      }
-    }, options.budget),
-    Number: createPrimitiveConstructor({
-      call: (args, context) => sandboxNumber(args.length === 0 ? 0 : args[0], options.budget, context),
-      name: "Number",
-      properties: {
-        isFinite: createSandboxClosure({
-          sandbox: true,
-          call: ([value]) => typeof value === "number" && Number.isFinite(value),
-          name: "isFinite"
-        }),
-        isNaN: createSandboxClosure({
-          sandbox: true,
-          call: ([value]) => typeof value === "number" && Number.isNaN(value),
-          name: "isNaN"
-        }),
-        isInteger: createSandboxClosure({
-          sandbox: true,
-          call: ([value]) => typeof value === "number" && Number.isInteger(value),
-          name: "isInteger"
-        }),
-        ...createNumericParsers(options.budget),
-        isSafeInteger: createSandboxClosure({
-          sandbox: true,
-          call: ([value]) => typeof value === "number" && Number.isSafeInteger(value),
-          name: "isSafeInteger"
-        }),
-        MAX_SAFE_INTEGER: Number.MAX_SAFE_INTEGER,
-        MIN_SAFE_INTEGER: Number.MIN_SAFE_INTEGER,
-        EPSILON: Number.EPSILON,
-        MAX_VALUE: Number.MAX_VALUE,
-        MIN_VALUE: Number.MIN_VALUE,
-        NaN: Number.NaN,
-        NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
-        POSITIVE_INFINITY: Number.POSITIVE_INFINITY
-      }
-    }, options.budget),
-    Boolean: createPrimitiveConstructor({
-      call: ([value]) => Boolean(value),
-      name: "Boolean"
-    }, options.budget)
+    String: createPrimitiveConstructor(
+      {
+        call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
+        name: "String",
+        properties: {
+          raw: createSandboxClosure({
+            sandbox: true,
+            call: (args, context) => stringRaw(args, options.budget, context),
+            name: "raw"
+          }),
+          fromCharCode: createSandboxClosure({
+            sandbox: true,
+            call: (args) => options.budget.allocateString(Reflect.apply(String.fromCharCode, String, [...args])),
+            name: "fromCharCode"
+          }),
+          fromCodePoint: createSandboxClosure({
+            sandbox: true,
+            call: (args) => options.budget.allocateString(Reflect.apply(String.fromCodePoint, String, [...args])),
+            name: "fromCodePoint"
+          })
+        }
+      },
+      options.budget
+    ),
+    Number: createPrimitiveConstructor(
+      {
+        call: (args, context) => sandboxNumber(args.length === 0 ? 0 : args[0], options.budget, context),
+        name: "Number",
+        properties: {
+          isFinite: createSandboxClosure({
+            sandbox: true,
+            call: ([value]) => typeof value === "number" && Number.isFinite(value),
+            name: "isFinite"
+          }),
+          isNaN: createSandboxClosure({
+            sandbox: true,
+            call: ([value]) => typeof value === "number" && Number.isNaN(value),
+            name: "isNaN"
+          }),
+          isInteger: createSandboxClosure({
+            sandbox: true,
+            call: ([value]) => typeof value === "number" && Number.isInteger(value),
+            name: "isInteger"
+          }),
+          ...createNumericParsers(options.budget),
+          isSafeInteger: createSandboxClosure({
+            sandbox: true,
+            call: ([value]) => typeof value === "number" && Number.isSafeInteger(value),
+            name: "isSafeInteger"
+          }),
+          MAX_SAFE_INTEGER: Number.MAX_SAFE_INTEGER,
+          MIN_SAFE_INTEGER: Number.MIN_SAFE_INTEGER,
+          EPSILON: Number.EPSILON,
+          MAX_VALUE: Number.MAX_VALUE,
+          MIN_VALUE: Number.MIN_VALUE,
+          NaN: Number.NaN,
+          NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
+          POSITIVE_INFINITY: Number.POSITIVE_INFINITY
+        }
+      },
+      options.budget
+    ),
+    Boolean: createPrimitiveConstructor(
+      {
+        call: ([value]) => Boolean(value),
+        name: "Boolean"
+      },
+      options.budget
+    )
   };
 }
 async function objectFromSandboxEntries(items, iterator, budget, context) {
@@ -25776,7 +26020,15 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
   let value;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, iterator.retainedValue, object, entry, key, value, failure]);
+  budget.setRetainedValues(retained, () => [
+    items,
+    iterator.retainedValue,
+    object,
+    entry,
+    key,
+    value,
+    failure
+  ]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -25805,8 +26057,8 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
         if (typeof entry !== "object" || entry === null) {
           throw new TypeError("Object.fromEntries requires entry objects.");
         }
-        key = context?.getProperty !== void 0 ? context.getProperty(entry, 0) : getSandboxDataProperty(entry, 0, budget);
-        value = context?.getProperty !== void 0 ? context.getProperty(entry, 1) : getSandboxDataProperty(entry, 1, budget);
+        key = context?.getProperty !== void 0 ? await context.getProperty(entry, 0) : getSandboxDataProperty(entry, 0, budget);
+        value = context?.getProperty !== void 0 ? await context.getProperty(entry, 1) : getSandboxDataProperty(entry, 1, budget);
         const property = await sandboxString(key, budget, context);
         const growth = property.length + 1 + (budget.limits.dataSize === void 0 ? 0 : measureSandboxData([value]));
         budget.visitNode();
@@ -25823,7 +26075,7 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
     budget.setRetainedValues(retained, void 0);
   }
 }
-function assignSandboxValues(target, sources, budget) {
+function assignSandboxValues(target, sources, budget, context) {
   if (target === null || target === void 0) {
     throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
   }
@@ -25834,50 +26086,120 @@ function assignSandboxValues(target, sources, budget) {
   if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
     throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
   }
-  for (const source of sources) {
-    if (source === null || source === void 0) {
-      continue;
-    }
-    for (const [key, value] of ownEnumerableSandboxEntries(source)) {
-      setSandboxProperty(target, key, value, budget);
+  if (context === void 0) {
+    for (const source of sources) {
+      if (source === null || source === void 0) continue;
+      for (const [key, value] of ownEnumerableSandboxEntries(source))
+        setSandboxProperty(target, key, value, budget);
     }
+    return target;
   }
-  return target;
+  return (async () => {
+    const release = retainValues(budget, () => [target, ...sources]);
+    try {
+      for (const source of sources) {
+        if (source === null || source === void 0) continue;
+        for (const key of ownEnumerableSandboxKeys(source)) {
+          if (!hasOwnSandboxProperty(source, key, true)) continue;
+          const value = await (context.getProperty !== void 0 ? context.getProperty(source, key) : getSandboxDataProperty(source, key, budget));
+          await setSandboxProperty(target, key, value, budget, true, context);
+        }
+      }
+      return target;
+    } finally {
+      release();
+    }
+  })();
 }
 function objectProperties(value, mutable = false) {
   if (isSandboxDate(value)) {
     if (mutable) throw new TypeError("Date own properties and prototypes are not supported.");
     return value;
   }
-  if (isGuestHostObject(value)) throw new TypeError("Live host object descriptors are not supported.");
+  if (isGuestHostObject(value))
+    throw new TypeError("Live host object descriptors are not supported.");
   if (isGuestClosure(value)) return materializeFunctionProperties(value);
   if (isSandboxClosure(value)) {
     if (mutable) throw new TypeError("Host function properties are read only.");
     return value.properties ?? /* @__PURE__ */ Object.create(null);
   }
-  if (!isAssignableSandboxTarget(value)) throw new TypeError("Expected a sandbox object or function.");
+  if (!isAssignableSandboxTarget(value))
+    throw new TypeError("Expected a sandbox object or function.");
   return value;
 }
-function dataDescriptor(input) {
-  const source = objectProperties(input);
+function exposePropertyDescriptor(descriptor) {
+  return "value" in descriptor ? descriptor : {
+    get: accessorClosure(descriptor.get),
+    set: accessorClosure(descriptor.set),
+    enumerable: descriptor.enumerable,
+    configurable: descriptor.configurable
+  };
+}
+async function propertyDescriptor(input, budget, context) {
+  objectProperties(input);
   const descriptor = {};
-  for (const field of ["get", "set", "value", "writable", "enumerable", "configurable"]) {
-    const entry = Object.getOwnPropertyDescriptor(source, field);
-    if (entry === void 0) continue;
-    if (!("value" in entry) || field === "get" || field === "set") {
-      throw new TypeError("Only data property descriptors are supported.");
+  const release = retainValues(budget, () => [
+    input,
+    descriptor.value,
+    ...retainedAccessorClosures(descriptor)
+  ]);
+  try {
+    for (const field of [
+      "enumerable",
+      "configurable",
+      "value",
+      "writable",
+      "get",
+      "set"
+    ]) {
+      if (getSandboxPropertyDescriptor(input, field, budget) === void 0 && !hasOwnSandboxProperty(input, field, false))
+        continue;
+      const value = await (context?.getProperty !== void 0 ? context.getProperty(input, field) : getSandboxDataProperty(input, field, budget));
+      if (field === "get" || field === "set") {
+        if (value !== void 0 && !isSandboxClosure(value))
+          throw new TypeError("Accessor must be a function or undefined.");
+        descriptor[field] = value === void 0 ? void 0 : accessorAdapter(value, field);
+      } else if (field === "value") {
+        descriptor.value = value;
+      } else {
+        descriptor[field] = Boolean(value);
+      }
     }
-    if (field === "value") descriptor.value = entry.value;
-    else descriptor[field] = Boolean(entry.value);
+    if (("get" in descriptor || "set" in descriptor) && ("value" in descriptor || "writable" in descriptor))
+      throw new TypeError("A property cannot be both a data property and an accessor.");
+    return descriptor;
+  } finally {
+    release();
+  }
+}
+async function definePropertiesFromObject(target, descriptors, budget, context) {
+  objectProperties(target, true);
+  const properties = [];
+  const release = retainValues(budget, () => [
+    target,
+    descriptors,
+    properties,
+    ...properties.flatMap(([, descriptor]) => retainedAccessorClosures(descriptor))
+  ]);
+  try {
+    for (const key of ownEnumerableSandboxKeys(descriptors)) {
+      if (!hasOwnSandboxProperty(descriptors, key, true)) continue;
+      const descriptor = await (context?.getProperty !== void 0 ? context.getProperty(descriptors, key) : getSandboxDataProperty(descriptors, key, budget));
+      properties.push([key, await propertyDescriptor(descriptor, budget, context)]);
+    }
+    for (const [key, descriptor] of properties) defineDataProperty(target, key, descriptor, budget);
+  } finally {
+    release();
   }
-  return descriptor;
 }
 function defineDataProperty(target, key, descriptor, budget) {
   budget.visitNode();
-  if (isFloat32Array(target)) throw new TypeError("Typed array property descriptors are not supported.");
+  if (isFloat32Array(target))
+    throw new TypeError("Typed array property descriptors are not supported.");
   const properties = objectProperties(target, true);
   if (Array.isArray(properties)) {
-    if (key === "length" && "value" in descriptor) budget.allocateArrayLength(Number(descriptor.value));
+    if (key === "length" && "value" in descriptor)
+      budget.allocateArrayLength(Number(descriptor.value));
     else {
       const index = Number(key);
       if (Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key) {
@@ -25906,7 +26228,15 @@ async function arrayFromSandboxValues(args, budget, context) {
   let currentValue;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, iterator?.retainedValue, mapFn, constructor, result, currentValue, failure]);
+  budget.setRetainedValues(retained, () => [
+    items,
+    iterator?.retainedValue,
+    mapFn,
+    constructor,
+    result,
+    currentValue,
+    failure
+  ]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -25920,30 +26250,46 @@ async function arrayFromSandboxValues(args, budget, context) {
   try {
     let length = 0;
     if (iterator === void 0) {
-      const number = await sandboxNumber(read("length"), budget, context);
+      const number = await sandboxNumber(await read("length"), budget, context);
       length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
     }
-    result = isSandboxClosure(constructor) && constructor.construct !== void 0 ? await invokeBuiltinClosure(constructor, iterator === void 0 ? [length] : [], budget, context, void 0, true) : createArrayFromConstructorArgs([length], budget);
+    result = isSandboxClosure(constructor) && constructor.construct !== void 0 ? await invokeBuiltinClosure(
+      constructor,
+      iterator === void 0 ? [length] : [],
+      budget,
+      context,
+      void 0,
+      true
+    ) : createArrayFromConstructorArgs([length], budget);
     checkData(result, 0, true);
     let index = 0;
     while (iterator !== void 0 || index < length) {
       try {
         budget.visitNode();
-        if (iterator !== void 0 && index >= Number.MAX_SAFE_INTEGER) throw new TypeError("Array.from input is too long.");
+        if (iterator !== void 0 && index >= Number.MAX_SAFE_INTEGER)
+          throw new TypeError("Array.from input is too long.");
       } catch (error) {
         await closeOnThrow(error);
       }
       if (iterator !== void 0) {
         const next = await iterator.next();
-        if (typeof next !== "object" || next === null) throw new TypeError("Iterator result must be an object.");
+        if (typeof next !== "object" || next === null)
+          throw new TypeError("Iterator result must be an object.");
         if (next.done) break;
         currentValue = next.value;
       } else {
-        currentValue = read(index);
+        currentValue = await read(index);
       }
       try {
         if (Array.isArray(result)) budget.allocateArrayLength(index + 1);
-        if (mapFn !== void 0) currentValue = await invokeBuiltinClosure(mapFn, [currentValue, index], budget, context, thisValue);
+        if (mapFn !== void 0)
+          currentValue = await invokeBuiltinClosure(
+            mapFn,
+            [currentValue, index],
+            budget,
+            context,
+            thisValue
+          );
         const key = String(index);
         const growth = key.length + 1 + (Array.isArray(result) ? Math.max(0, index + 1 - result.length) : 0) + (budget.limits.dataSize === void 0 ? 0 : measureSandboxData([currentValue]));
         budget.visitNode();
@@ -25981,19 +26327,60 @@ function createArrayFromConstructorArgs(args, budget) {
     release();
   }
 }
-function getOwnEnumerableKeys(value) {
-  if (isGuestHostObject(value)) return getHostObjectKeys(value);
-  return ownEnumerableSandboxEntries(value).map(([key]) => key);
-}
-function getOwnEnumerableValues(value) {
-  return ownEnumerableSandboxEntries(value).map(([, entryValue]) => entryValue);
+async function getOwnEnumerableEntries(value, budget, context) {
+  const entries = [];
+  const release = retainValues(budget, () => [value, entries]);
+  try {
+    for (const key of ownEnumerableSandboxKeys(value)) {
+      if (!hasOwnSandboxProperty(value, key, true)) continue;
+      entries.push([
+        key,
+        await (context?.getProperty !== void 0 ? context.getProperty(value, key) : getSandboxDataProperty(value, key, budget))
+      ]);
+    }
+    return entries;
+  } finally {
+    release();
+  }
 }
 function budgetSandboxValue2(value, budget) {
   const sandboxValue = deepCopyToSandbox(value);
   return allocateProducedSandboxValue(sandboxValue, budget);
 }
-function stringRaw(args, budget) {
+function stringRaw(args, budget, context) {
   const [template, ...substitutions] = args;
+  if (context?.getProperty !== void 0)
+    return (async () => {
+      if (template === null || template === void 0)
+        throw new TypeError("String.raw requires a template object.");
+      const raw2 = await context.getProperty(template, "raw");
+      if (raw2 === null || raw2 === void 0)
+        throw new TypeError("String.raw requires raw strings.");
+      const number = await sandboxNumber(
+        await context.getProperty(raw2, "length"),
+        budget,
+        context
+      );
+      const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
+      let result2 = "";
+      const retained = {};
+      budget.setRetainedValues(retained, () => [raw2, result2]);
+      try {
+        for (let index = 0; index < length; index++) {
+          budget.visitNode();
+          result2 = budget.allocateString(
+            result2 + await sandboxString(await context.getProperty(raw2, index), budget, context)
+          );
+          if (index + 1 < length && index < substitutions.length)
+            result2 = budget.allocateString(
+              result2 + await sandboxString(substitutions[index], budget, context)
+            );
+        }
+        return result2;
+      } finally {
+        budget.setRetainedValues(retained, void 0);
+      }
+    })();
   const raw = getTemplateRawParts(template);
   let result = "";
   for (let index = 0; index < raw.length; index += 1) {
@@ -26030,7 +26417,7 @@ async function evaluateClass(node, context, evaluateNode2, callContext) {
       parent = result.value;
       if (parent !== null && (!isSandboxClosure(parent) || parent.construct === void 0))
         throw new TypeError("Class extends value is not a constructor or null.");
-      prototypeParent = parent === null ? null : callContext.getProperty(parent, "prototype");
+      prototypeParent = parent === null ? null : await callContext.getProperty(parent, "prototype");
       if (prototypeParent !== null && typeof prototypeParent !== "object")
         throw new TypeError("Class extends value has an invalid prototype.");
     }
@@ -26070,7 +26457,7 @@ async function evaluateClass(node, context, evaluateNode2, callContext) {
         };
         if (!derived) {
           thisValue = {};
-          const targetPrototype = invocation.getProperty(newTarget, "prototype");
+          const targetPrototype = await invocation.getProperty(newTarget, "prototype");
           if (typeof targetPrototype === "object" && targetPrototype !== null)
             setSandboxPrototype(thisValue, targetPrototype, context.budget);
         }
@@ -26215,7 +26602,13 @@ function getArrayMember(value, property, options) {
     return createSandboxClosure({
       sandbox: true,
       name: `Array#${property}`,
-      call: (args, context) => callArrayMethod(context?.thisValue, property, args, { ...options, context }, context?.stack ?? [])
+      call: (args, context) => callArrayMethod(
+        context?.thisValue,
+        property,
+        args,
+        { ...options, context },
+        context?.stack ?? []
+      )
     });
   }
   return void 0;
@@ -26231,7 +26624,8 @@ function isArrayMethodName(property) {
   return typeof property === "string" && arrayMethodNames.has(property);
 }
 async function callArrayMethod(receiver, methodName, args, options, stack = []) {
-  if (receiver === null || receiver === void 0) throw new TypeError("Array method requires a receiver.");
+  if (receiver === null || receiver === void 0)
+    throw new TypeError("Array method requires a receiver.");
   if (typeof receiver !== "object") {
     receiver = createSandboxBox(receiver);
     options.budget.chargeDataUsage(measureSandboxData([receiver]));
@@ -26268,38 +26662,44 @@ async function callArrayMethod(receiver, methodName, args, options, stack = [])
   }
 }
 async function arrayLikeView(receiver, options) {
-  const rawLength = options.context?.getProperty !== void 0 ? options.context.getProperty(receiver, "length") : getSandboxDataProperty(receiver, "length", options.budget);
+  const rawLength = options.context?.getProperty !== void 0 ? await options.context.getProperty(receiver, "length") : getSandboxDataProperty(receiver, "length", options.budget);
   const number = await sandboxNumber(rawLength, options.budget, options.context);
   const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
-  const view = new Proxy(/* @__PURE__ */ Object.create(null), {
-    get: (_target, key) => {
-      options.budget.visitNode();
-      if (key === "length") return length;
-      if (typeof key !== "string") return void 0;
-      return options.context?.getProperty !== void 0 ? options.context.getProperty(receiver, key) : getSandboxDataProperty(receiver, key, options.budget);
-    },
-    has: (_target, key) => {
-      options.budget.visitNode();
-      if (typeof key === "string" && options.hasProperty !== void 0) return options.hasProperty(receiver, key);
-      for (let current = receiver; current !== null; current = getSandboxPrototype(current, options.budget)) {
+  const view = new Proxy(
+    /* @__PURE__ */ Object.create(null),
+    {
+      get: (_target, key) => {
+        options.budget.visitNode();
+        if (key === "length") return length;
+        if (typeof key !== "string") return void 0;
+        return options.context?.getProperty !== void 0 ? options.context.getProperty(receiver, key) : getSandboxDataProperty(receiver, key, options.budget);
+      },
+      has: (_target, key) => {
+        options.budget.visitNode();
+        if (typeof key === "string" && options.hasProperty !== void 0)
+          return options.hasProperty(receiver, key);
+        for (let current = receiver; current !== null; current = getSandboxPrototype(current, options.budget)) {
+          options.budget.visitNode();
+          if (Object.hasOwn(current, key)) return true;
+        }
+        return false;
+      },
+      set: (_target, key, entry) => {
+        options.budget.visitNode();
+        if (typeof key !== "string") throw new TypeError("Array indices must be string keys.");
+        if (options.setProperty !== void 0) options.setProperty(receiver, key, entry);
+        else if (!Reflect.set(receiver, key, entry))
+          throw new TypeError(`Cannot assign property '${key}'.`);
+        return true;
+      },
+      deleteProperty: (_target, key) => {
         options.budget.visitNode();
-        if (Object.hasOwn(current, key)) return true;
+        if (typeof key === "string" && options.deleteProperty !== void 0)
+          return options.deleteProperty(receiver, key);
+        return Reflect.deleteProperty(receiver, key);
       }
-      return false;
-    },
-    set: (_target, key, entry) => {
-      options.budget.visitNode();
-      if (typeof key !== "string") throw new TypeError("Array indices must be string keys.");
-      if (options.setProperty !== void 0) options.setProperty(receiver, key, entry);
-      else if (!Reflect.set(receiver, key, entry)) throw new TypeError(`Cannot assign property '${key}'.`);
-      return true;
-    },
-    deleteProperty: (_target, key) => {
-      options.budget.visitNode();
-      if (typeof key === "string" && options.deleteProperty !== void 0) return options.deleteProperty(receiver, key);
-      return Reflect.deleteProperty(receiver, key);
     }
-  });
+  );
   arrayLikeSources.set(view, receiver);
   return view;
 }
@@ -26403,166 +26803,371 @@ async function callArrayMethodUnlocked(value, methodName, args, options, stack)
       );
     case "flat":
       return budgetProducedValue(
-        flattenArray(value, toIntegerOrInfinity(args[0] ?? 1), options.budget),
+        await flattenArray(
+          value,
+          args[0] === void 0 ? 1 : toIntegerOrInfinity(await sandboxNumber(args[0], options.budget, options.context)),
+          options
+        ),
         options.budget
       );
     case "includes":
-      return Reflect.apply(Array.prototype.includes, value, [...args]);
     case "indexOf":
-      return Reflect.apply(Array.prototype.indexOf, value, [...args]);
-    case "lastIndexOf":
-      return Reflect.apply(Array.prototype.lastIndexOf, value, [...args]);
-    case "join":
-      return options.budget.allocateString(Reflect.apply(Array.prototype.join, value, [...args]));
+    case "lastIndexOf": {
+      const length = value.length;
+      if (length === 0) return methodName === "includes" ? false : -1;
+      const reverse = methodName === "lastIndexOf";
+      const start = reverse && args.length < 2 ? length - 1 : toIntegerOrInfinity(await sandboxNumber(args[1], options.budget, options.context));
+      let index = reverse ? Math.min(start < 0 ? length + start : start, length - 1) : start < 0 ? Math.max(length + start, 0) : start;
+      for (; index >= 0 && index < length; index += reverse ? -1 : 1) {
+        options.budget.visitNode();
+        if (methodName !== "includes" && !(index in value)) continue;
+        const entry = await readArrayElement(value, index, options);
+        if (entry === args[0] || methodName === "includes" && Number.isNaN(entry) && Number.isNaN(args[0]))
+          return methodName === "includes" ? true : index;
+      }
+      return methodName === "includes" ? false : -1;
+    }
+    case "join": {
+      const length = value.length;
+      const separator = args[0] === void 0 ? "," : await sandboxString(args[0], options.budget, options.context);
+      return joinSandboxArray(
+        arrayLikeSources.get(value) ?? value,
+        length,
+        separator,
+        options.budget,
+        options.context
+      );
+    }
     case "slice": {
       const length = value.length;
-      const start = toIntegerOrInfinity(await sandboxNumber(args[0], options.budget, options.context));
+      const start = toIntegerOrInfinity(
+        await sandboxNumber(args[0], options.budget, options.context)
+      );
       const end = args[1] === void 0 ? length : toIntegerOrInfinity(await sandboxNumber(args[1], options.budget, options.context));
       const first = start < 0 ? Math.max(length + start, 0) : Math.min(start, length);
       const final = end < 0 ? Math.max(length + end, 0) : Math.min(end, length);
       const count = Math.max(final - first, 0);
       options.budget.allocateArrayLength(count);
       const result = new Array(count);
-      for (let index = 0; index < count; index += 1) {
-        options.budget.visitNode();
-        if (first + index in value) result[index] = value[first + index];
+      const release = retainValues(options.budget, () => [result]);
+      try {
+        for (let index = 0; index < count; index += 1) {
+          options.budget.visitNode();
+          if (first + index in value)
+            result[index] = await readArrayElement(value, first + index, options);
+        }
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        release();
+      }
+    }
+    case "concat": {
+      const result = [];
+      const retained = {};
+      options.budget.setRetainedValues(retained, () => [result]);
+      try {
+        for (const entry of [value, ...args]) {
+          if (!Array.isArray(entry)) {
+            options.budget.allocateArrayLength(result.length + 1);
+            result.push(entry);
+            continue;
+          }
+          const start = result.length;
+          const length = entry.length;
+          options.budget.allocateArrayLength(start + length);
+          result.length += length;
+          for (let index = 0; index < length; index++) {
+            options.budget.visitNode();
+            if (index in entry)
+              result[start + index] = await readArrayElement(entry, index, options);
+          }
+        }
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        options.budget.setRetainedValues(retained, void 0);
       }
-      return budgetProducedValue(result, options.budget);
     }
-    case "concat":
-      return budgetProducedValue(
-        Reflect.apply(Array.prototype.concat, value, [...args]),
-        options.budget
-      );
     case "splice": {
-      const removed = Reflect.apply(Array.prototype.splice, value, [...args]);
+      const length = value.length;
+      const start = toIntegerOrInfinity(
+        await sandboxNumber(args[0], options.budget, options.context)
+      );
+      const first = start < 0 ? Math.max(length + start, 0) : Math.min(start, length);
+      const inserted = Math.max(args.length - 2, 0);
+      const deleted = args.length === 0 ? 0 : args.length === 1 ? length - first : Math.min(
+        Math.max(
+          toIntegerOrInfinity(
+            await sandboxNumber(args[1], options.budget, options.context)
+          ),
+          0
+        ),
+        length - first
+      );
+      const nextLength = length + inserted - deleted;
+      if (nextLength > Number.MAX_SAFE_INTEGER)
+        throw new TypeError("Array-like length exceeds the safe integer limit.");
+      options.budget.allocateArrayLength(deleted);
+      const removed = new Array(deleted);
+      const retained = {};
+      options.budget.setRetainedValues(retained, () => [removed]);
+      try {
+        for (let index = 0; index < deleted; index++) {
+          options.budget.visitNode();
+          if (first + index in value)
+            removed[index] = await readArrayElement(value, first + index, options);
+        }
+        if (inserted < deleted) {
+          for (let index = first; index < length - deleted; index++)
+            await moveArrayElement(value, index + deleted, index + inserted, options);
+          for (let index = length; index > nextLength; index--)
+            deleteArrayElement(value, index - 1, options);
+        } else if (inserted > deleted) {
+          for (let index = length - deleted; index > first; index--)
+            await moveArrayElement(value, index + deleted - 1, index + inserted - 1, options);
+        }
+        for (let index = 0; index < inserted; index++)
+          await writeArrayProperty(value, first + index, args[index + 2], options);
+        await writeArrayProperty(value, "length", nextLength, options);
+      } finally {
+        options.budget.setRetainedValues(retained, void 0);
+      }
       budgetProducedValue(removed, options.budget);
       budgetProducedValue(value, options.budget);
       return removed;
     }
-    case "fill":
-      Reflect.apply(Array.prototype.fill, value, [...args]);
+    case "fill": {
+      const length = value.length;
+      const start = toIntegerOrInfinity(
+        await sandboxNumber(args[1], options.budget, options.context)
+      );
+      const end = args[2] === void 0 ? length : toIntegerOrInfinity(await sandboxNumber(args[2], options.budget, options.context));
+      const first = start < 0 ? Math.max(length + start, 0) : Math.min(start, length);
+      const final = end < 0 ? Math.max(length + end, 0) : Math.min(end, length);
+      for (let index = first; index < final; index++)
+        await writeArrayProperty(value, index, args[0], options);
       budgetProducedValue(value, options.budget);
       return value;
-    case "copyWithin":
-      Reflect.apply(Array.prototype.copyWithin, value, [...args]);
+    }
+    case "copyWithin": {
+      const length = value.length;
+      const target = toIntegerOrInfinity(
+        await sandboxNumber(args[0], options.budget, options.context)
+      );
+      const start = toIntegerOrInfinity(
+        await sandboxNumber(args[1], options.budget, options.context)
+      );
+      const end = args[2] === void 0 ? length : toIntegerOrInfinity(await sandboxNumber(args[2], options.budget, options.context));
+      let to = target < 0 ? Math.max(length + target, 0) : Math.min(target, length);
+      let from = start < 0 ? Math.max(length + start, 0) : Math.min(start, length);
+      const final = end < 0 ? Math.max(length + end, 0) : Math.min(end, length);
+      let count = Math.min(final - from, length - to);
+      const direction = from < to && to < from + count ? -1 : 1;
+      if (direction < 0) {
+        from += count - 1;
+        to += count - 1;
+      }
+      while (count-- > 0) {
+        await moveArrayElement(value, from, to, options);
+        from += direction;
+        to += direction;
+      }
       budgetProducedValue(value, options.budget);
       return value;
-    case "at":
-      return budgetProducedValue(
-        Reflect.apply(Array.prototype.at, value, [...args]),
-        options.budget
+    }
+    case "at": {
+      const length = value.length;
+      const index = toIntegerOrInfinity(
+        await sandboxNumber(args[0], options.budget, options.context)
       );
+      const actual = index < 0 ? length + index : index;
+      return actual < 0 || actual >= length ? void 0 : budgetProducedValue(await readArrayElement(value, actual, options), options.budget);
+    }
     case "sort":
-      if (args[0] === void 0) {
-        Reflect.apply(Array.prototype.sort, value, []);
+      await sortArray(
+        value,
+        args[0] === void 0 ? void 0 : getRequiredCallback(methodName, args[0]),
+        options,
+        stack
+      );
+      budgetProducedValue(value, options.budget);
+      return value;
+    case "reverse": {
+      const length = value.length;
+      let lowerValue;
+      let upperValue;
+      const release = retainValues(options.budget, () => [lowerValue, upperValue]);
+      try {
+        for (let lower = 0; lower < Math.floor(length / 2); lower++) {
+          options.budget.visitNode();
+          lowerValue = upperValue = void 0;
+          const upper = length - lower - 1;
+          const lowerExists = lower in value;
+          lowerValue = lowerExists ? await readArrayElement(value, lower, options) : void 0;
+          const upperExists = upper in value;
+          upperValue = upperExists ? await readArrayElement(value, upper, options) : void 0;
+          if (lowerExists && upperExists) {
+            await writeArrayProperty(value, lower, upperValue, options);
+            await writeArrayProperty(value, upper, lowerValue, options);
+          } else if (!lowerExists && upperExists) {
+            await writeArrayProperty(value, lower, upperValue, options);
+            deleteArrayElement(value, upper, options);
+          } else if (lowerExists) {
+            deleteArrayElement(value, lower, options);
+            await writeArrayProperty(value, upper, lowerValue, options);
+          }
+        }
         budgetProducedValue(value, options.budget);
         return value;
+      } finally {
+        release();
       }
-      await sortArray(value, getRequiredCallback(methodName, args[0]), options, stack);
-      budgetProducedValue(value, options.budget);
-      return value;
-    case "reverse":
-      Reflect.apply(Array.prototype.reverse, value, []);
-      budgetProducedValue(value, options.budget);
-      return value;
+    }
     case "toSorted": {
       const length = value.length;
       options.budget.allocateArrayLength(length);
       const result = new Array(length);
-      for (let index = 0; index < length; index += 1) {
-        options.budget.visitNode();
-        result[index] = value[index];
-      }
-      if (args[0] === void 0) {
-        result.sort();
-      } else {
-        await sortArray(result, getRequiredCallback(methodName, args[0]), options, stack);
+      const release = retainValues(options.budget, () => [result]);
+      try {
+        for (let index = 0; index < length; index += 1) {
+          options.budget.visitNode();
+          result[index] = await readArrayElement(value, index, options);
+        }
+        await sortArray(
+          result,
+          args[0] === void 0 ? void 0 : getRequiredCallback(methodName, args[0]),
+          options,
+          stack
+        );
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        release();
       }
-      return budgetProducedValue(result, options.budget);
     }
     case "toReversed": {
       const length = value.length;
       options.budget.allocateArrayLength(length);
       const result = new Array(length);
-      for (let index = 0; index < length; index += 1) {
-        options.budget.visitNode();
-        result[index] = value[length - index - 1];
+      const release = retainValues(options.budget, () => [result]);
+      try {
+        for (let index = 0; index < length; index += 1) {
+          options.budget.visitNode();
+          result[index] = await readArrayElement(value, length - index - 1, options);
+        }
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        release();
       }
-      return budgetProducedValue(result, options.budget);
     }
     case "toSpliced": {
       const length = value.length;
-      const start = toIntegerOrInfinity(await sandboxNumber(args[0], options.budget, options.context));
+      const start = toIntegerOrInfinity(
+        await sandboxNumber(args[0], options.budget, options.context)
+      );
       const first = start < 0 ? Math.max(length + start, 0) : Math.min(start, length);
       const inserted = Math.max(args.length - 2, 0);
-      const deleted = args.length === 0 ? 0 : args.length === 1 ? length - first : Math.min(Math.max(toIntegerOrInfinity(await sandboxNumber(args[1], options.budget, options.context)), 0), length - first);
+      const deleted = args.length === 0 ? 0 : args.length === 1 ? length - first : Math.min(
+        Math.max(
+          toIntegerOrInfinity(
+            await sandboxNumber(args[1], options.budget, options.context)
+          ),
+          0
+        ),
+        length - first
+      );
       const resultLength = length + inserted - deleted;
-      if (resultLength > Number.MAX_SAFE_INTEGER) throw new TypeError("Array-like length exceeds the safe integer limit.");
+      if (resultLength > Number.MAX_SAFE_INTEGER)
+        throw new TypeError("Array-like length exceeds the safe integer limit.");
       options.budget.allocateArrayLength(resultLength);
       const result = new Array(resultLength);
-      for (let index = 0; index < resultLength; index += 1) {
-        options.budget.visitNode();
-        result[index] = index < first ? value[index] : index < first + inserted ? args[index - first + 2] : value[index - inserted + deleted];
+      const release = retainValues(options.budget, () => [result]);
+      try {
+        for (let index = 0; index < resultLength; index += 1) {
+          options.budget.visitNode();
+          result[index] = index < first ? await readArrayElement(value, index, options) : index < first + inserted ? args[index - first + 2] : await readArrayElement(value, index - inserted + deleted, options);
+        }
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        release();
       }
-      return budgetProducedValue(result, options.budget);
     }
     case "with": {
       const length = value.length;
-      const index = toIntegerOrInfinity(args[0]);
+      const index = toIntegerOrInfinity(
+        options.context === void 0 ? args[0] : await sandboxNumber(args[0], options.budget, options.context)
+      );
       const actualIndex = index < 0 ? length + index : index;
       if (actualIndex < 0 || actualIndex >= length) {
         throw new RangeError("Invalid index");
       }
       options.budget.allocateArrayLength(length);
       const result = [];
-      for (let position = 0; position < length; position += 1) {
-        options.budget.visitNode();
-        result[position] = position === actualIndex ? args[1] : Array.isArray(value) && !Object.hasOwn(value, position) ? void 0 : value[position];
+      const release = retainValues(options.budget, () => [result]);
+      try {
+        for (let position = 0; position < length; position += 1) {
+          options.budget.visitNode();
+          result[position] = position === actualIndex ? args[1] : await readArrayElement(value, position, options);
+        }
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        release();
       }
-      return budgetProducedValue(result, options.budget);
     }
     case "push": {
-      const nextLength = appendArrayValues(value, args);
+      const nextLength = await appendArrayValues(value, args, options);
       budgetProducedValue(value, options.budget);
       return nextLength;
     }
     case "pop":
-      return budgetProducedValue(Reflect.apply(Array.prototype.pop, value, []), options.budget);
-    case "shift":
-      return budgetProducedValue(Reflect.apply(Array.prototype.shift, value, []), options.budget);
+    case "shift": {
+      const length = value.length;
+      if (length === 0) {
+        await writeArrayProperty(value, "length", 0, options);
+        return void 0;
+      }
+      const result = await readArrayElement(value, methodName === "pop" ? length - 1 : 0, options);
+      const retained = {};
+      options.budget.setRetainedValues(retained, () => [result]);
+      try {
+        if (methodName === "shift")
+          for (let index = 1; index < length; index++)
+            await moveArrayElement(value, index, index - 1, options);
+        deleteArrayElement(value, length - 1, options);
+        await writeArrayProperty(value, "length", length - 1, options);
+        return budgetProducedValue(result, options.budget);
+      } finally {
+        options.budget.setRetainedValues(retained, void 0);
+      }
+    }
     case "unshift": {
-      const nextLength = prependArrayValues(value, args);
+      const nextLength = await prependArrayValues(value, args, options);
       budgetProducedValue(value, options.budget);
       return nextLength;
     }
   }
 }
-function appendArrayValues(target, values) {
+async function appendArrayValues(target, values, options) {
   let length = target.length;
-  if (length + values.length > Number.MAX_SAFE_INTEGER) throw new TypeError("Array-like length exceeds the safe integer limit.");
+  if (length + values.length > Number.MAX_SAFE_INTEGER)
+    throw new TypeError("Array-like length exceeds the safe integer limit.");
   for (const value of values) {
-    target[length++] = value;
+    await writeArrayProperty(target, length++, value, options);
   }
-  target.length = length;
+  await writeArrayProperty(target, "length", length, options);
   return length;
 }
-function prependArrayValues(target, values) {
+async function prependArrayValues(target, values, options) {
   const originalLength = target.length;
   const length = originalLength + values.length;
-  if (length > Number.MAX_SAFE_INTEGER) throw new TypeError("Array-like length exceeds the safe integer limit.");
+  if (length > Number.MAX_SAFE_INTEGER)
+    throw new TypeError("Array-like length exceeds the safe integer limit.");
   for (let index = values.length === 0 ? -1 : originalLength - 1; index >= 0; index -= 1) {
     const targetIndex = index + values.length;
-    if (index in target) {
-      target[targetIndex] = target[index];
-    } else {
-      delete target[targetIndex];
-    }
+    await moveArrayElement(target, index, targetIndex, options);
   }
   for (let index = 0; index < values.length; index += 1) {
-    target[index] = values[index];
+    await writeArrayProperty(target, index, values[index], options);
   }
-  target.length = length;
+  await writeArrayProperty(target, "length", length, options);
   return length;
 }
 function isCallbackArrayMethod(methodName) {
@@ -26577,6 +27182,33 @@ function getRequiredCallback(methodName, value) {
   }
   return value;
 }
+function readArrayElement(value, index, options) {
+  const receiver = arrayLikeSources.get(value) ?? value;
+  return options.context?.getProperty !== void 0 ? options.context.getProperty(receiver, index) : getSandboxDataProperty(receiver, index, options.budget);
+}
+function writeArrayProperty(value, key, entry, options) {
+  options.budget.visitNode();
+  const receiver = arrayLikeSources.get(value) ?? value;
+  if (Array.isArray(receiver)) {
+    if (key === "length") options.budget.allocateArrayLength(Number(entry));
+    else if (typeof key === "number") options.budget.allocateArrayLength(key + 1);
+  }
+  if (options.setProperty !== void 0) return options.setProperty(receiver, String(key), entry);
+  if (!Reflect.set(receiver, key, entry))
+    throw new TypeError(`Cannot assign to read only property '${key}'.`);
+}
+function deleteArrayElement(value, index, options) {
+  options.budget.visitNode();
+  const receiver = arrayLikeSources.get(value) ?? value;
+  const deleted = options.deleteProperty === void 0 ? Reflect.deleteProperty(receiver, String(index)) : options.deleteProperty(receiver, String(index));
+  if (!deleted) throw new TypeError(`Cannot delete property '${index}'.`);
+}
+async function moveArrayElement(value, from, to, options) {
+  options.budget.visitNode();
+  if (from in value)
+    await writeArrayProperty(value, to, await readArrayElement(value, from, options), options);
+  else deleteArrayElement(value, to, options);
+}
 async function mapArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   options.budget.allocateArrayLength(length);
@@ -26590,7 +27222,7 @@ async function mapArray(value, callback, options, stack, thisValue) {
       }
       result[index] = await callArrayCallback(
         callback,
-        value[index],
+        await readArrayElement(value, index, options),
         index,
         value,
         options,
@@ -26613,7 +27245,7 @@ async function filterArray(value, callback, options, stack, thisValue) {
       if (!(index in value)) {
         continue;
       }
-      const entry = value[index];
+      const entry = await readArrayElement(value, index, options);
       if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
         result.push(entry);
       }
@@ -26627,7 +27259,7 @@ async function findInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
     options.budget.visitNode();
-    const entry = index in value ? value[index] : void 0;
+    const entry = await readArrayElement(value, index, options);
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return entry;
     }
@@ -26638,7 +27270,7 @@ async function findIndexInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = 0; index < length; index += 1) {
     options.budget.visitNode();
-    const entry = index in value ? value[index] : void 0;
+    const entry = await readArrayElement(value, index, options);
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return index;
     }
@@ -26649,7 +27281,7 @@ async function findLastInArray(value, callback, options, stack, thisValue) {
   const length = value.length;
   for (let index = length - 1; index >= 0; index -= 1) {
     options.budget.visitNode();
-    const entry = index in value ? value[index] : void 0;
+    const entry = await readArrayElement(value, index, options);
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return entry;
     }
@@ -26660,7 +27292,7 @@ async function findLastIndexInArray(value, callback, options, stack, thisValue)
   const length = value.length;
   for (let index = length - 1; index >= 0; index -= 1) {
     options.budget.visitNode();
-    const entry = index in value ? value[index] : void 0;
+    const entry = await readArrayElement(value, index, options);
     if (await callArrayCallback(callback, entry, index, value, options, stack, thisValue)) {
       return index;
     }
@@ -26674,7 +27306,15 @@ async function someInArray(value, callback, options, stack, thisValue) {
     if (!(index in value)) {
       continue;
     }
-    if (await callArrayCallback(callback, value[index], index, value, options, stack, thisValue)) {
+    if (await callArrayCallback(
+      callback,
+      await readArrayElement(value, index, options),
+      index,
+      value,
+      options,
+      stack,
+      thisValue
+    )) {
       return true;
     }
   }
@@ -26687,7 +27327,15 @@ async function everyInArray(value, callback, options, stack, thisValue) {
     if (!(index in value)) {
       continue;
     }
-    if (!await callArrayCallback(callback, value[index], index, value, options, stack, thisValue)) {
+    if (!await callArrayCallback(
+      callback,
+      await readArrayElement(value, index, options),
+      index,
+      value,
+      options,
+      stack,
+      thisValue
+    )) {
       return false;
     }
   }
@@ -26702,7 +27350,15 @@ async function reduceArray(value, callback, hasInitialValue, initialValue, optio
   if (start < 0) {
     throw new TypeError("Reduce of empty array with no initial value.");
   }
-  return reduceFromLeft(value, callback, value[start], start + 1, length, options, stack);
+  return reduceFromLeft(
+    value,
+    callback,
+    await readArrayElement(value, start, options),
+    start + 1,
+    length,
+    options,
+    stack
+  );
 }
 async function reduceRightArray(value, callback, hasInitialValue, initialValue, options, stack) {
   const length = value.length;
@@ -26713,7 +27369,15 @@ async function reduceRightArray(value, callback, hasInitialValue, initialValue,
   if (start < 0) {
     throw new TypeError("Reduce of empty array with no initial value.");
   }
-  return reduceFromRight(value, callback, value[start], start - 1, length, options, stack);
+  return reduceFromRight(
+    value,
+    callback,
+    await readArrayElement(value, start, options),
+    start - 1,
+    length,
+    options,
+    stack
+  );
 }
 async function reduceFromLeft(value, callback, accumulator, startIndex, length, options, stack) {
   let current = accumulator;
@@ -26725,7 +27389,16 @@ async function reduceFromLeft(value, callback, accumulator, startIndex, length,
       if (!(index in value)) {
         continue;
       }
-      current = await options.callClosure(callback, [current, value[index], index, arrayLikeSources.get(value) ?? value], stack);
+      current = await options.callClosure(
+        callback,
+        [
+          current,
+          await readArrayElement(value, index, options),
+          index,
+          arrayLikeSources.get(value) ?? value
+        ],
+        stack
+      );
     }
     return current;
   } finally {
@@ -26742,7 +27415,16 @@ async function reduceFromRight(value, callback, accumulator, startIndex, length,
       if (!(index in value)) {
         continue;
       }
-      current = await options.callClosure(callback, [current, value[index], index, arrayLikeSources.get(value) ?? value], stack);
+      current = await options.callClosure(
+        callback,
+        [
+          current,
+          await readArrayElement(value, index, options),
+          index,
+          arrayLikeSources.get(value) ?? value
+        ],
+        stack
+      );
     }
     return current;
   } finally {
@@ -26756,7 +27438,15 @@ async function forEachArray(value, callback, options, stack, thisValue) {
     if (!(index in value)) {
       continue;
     }
-    await callArrayCallback(callback, value[index], index, value, options, stack, thisValue);
+    await callArrayCallback(
+      callback,
+      await readArrayElement(value, index, options),
+      index,
+      value,
+      options,
+      stack,
+      thisValue
+    );
   }
 }
 async function flatMapArray(value, callback, options, stack, thisValue) {
@@ -26771,7 +27461,7 @@ async function flatMapArray(value, callback, options, stack, thisValue) {
       }
       const mapped = await callArrayCallback(
         callback,
-        value[index],
+        await readArrayElement(value, index, options),
         index,
         value,
         options,
@@ -26784,7 +27474,7 @@ async function flatMapArray(value, callback, options, stack, thisValue) {
           if (!(mappedIndex in mapped)) {
             continue;
           }
-          result.push(mapped[mappedIndex]);
+          result.push(await readArrayElement(mapped, mappedIndex, options));
           options.budget.allocateArrayLength(result.length);
         }
         continue;
@@ -26797,23 +27487,31 @@ async function flatMapArray(value, callback, options, stack, thisValue) {
     options.budget.setRetainedValues(result, void 0);
   }
 }
-function flattenArray(value, depth, budget) {
+async function flattenArray(value, depth, options) {
   const result = [];
-  appendFlattenedEntries(value, depth, result, budget);
-  return result;
+  const retained = {};
+  options.budget.setRetainedValues(retained, () => [result]);
+  try {
+    await appendFlattenedEntries(value, depth, result, options);
+    return result;
+  } finally {
+    options.budget.setRetainedValues(retained, void 0);
+  }
 }
-function appendFlattenedEntries(value, depth, result, budget) {
-  for (let index = 0; index < value.length; index += 1) {
+async function appendFlattenedEntries(value, depth, result, options) {
+  const length = value.length;
+  for (let index = 0; index < length; index += 1) {
+    options.budget.visitNode();
     if (!(index in value)) {
       continue;
     }
-    const entry = value[index];
+    const entry = await readArrayElement(value, index, options);
     if (depth > 0 && Array.isArray(entry)) {
-      appendFlattenedEntries(entry, depth - 1, result, budget);
+      await appendFlattenedEntries(entry, depth - 1, result, options);
       continue;
     }
     result.push(entry);
-    budget.allocateArrayLength(result.length);
+    options.budget.allocateArrayLength(result.length);
   }
 }
 async function sortArray(value, comparator, options, stack) {
@@ -26828,7 +27526,7 @@ async function sortArray(value, comparator, options, stack) {
       if (!(index in value)) {
         continue;
       }
-      const entry = value[index];
+      const entry = await readArrayElement(value, index, options);
       if (entry === void 0) {
         undefinedCount += 1;
         continue;
@@ -26846,14 +27544,14 @@ async function sortArray(value, comparator, options, stack) {
     }
     currentEntry = void 0;
     for (let index = 0; index < definedValues.length; index += 1) {
-      value[index] = definedValues[index];
+      await writeArrayProperty(value, index, definedValues[index], options);
     }
     for (let index = 0; index < undefinedCount; index += 1) {
-      value[definedValues.length + index] = void 0;
+      await writeArrayProperty(value, definedValues.length + index, void 0, options);
     }
     for (let index = definedValues.length + undefinedCount; index < length; index += 1) {
       options.budget.visitNode();
-      delete value[index];
+      deleteArrayElement(value, index, options);
     }
   } finally {
     options.budget.setRetainedValues(definedValues, void 0);
@@ -26861,11 +27559,30 @@ async function sortArray(value, comparator, options, stack) {
 }
 async function compareEntries(left, right, comparator, options, stack) {
   options.budget.visitNode();
-  const result = Number(await options.callClosure(comparator, [left, right], stack));
+  if (comparator === void 0) {
+    const leftString = await sandboxString(left, options.budget, options.context);
+    const release = retainValues(options.budget, () => [leftString]);
+    try {
+      const rightString = await sandboxString(right, options.budget, options.context);
+      return leftString < rightString ? -1 : leftString > rightString ? 1 : 0;
+    } finally {
+      release();
+    }
+  }
+  const result = await sandboxNumber(
+    await options.callClosure(comparator, [left, right], stack),
+    options.budget,
+    options.context
+  );
   return Number.isNaN(result) ? 0 : result;
 }
 async function callArrayCallback(callback, value, index, array, options, stack, thisValue) {
-  return options.callClosure(callback, [value, index, arrayLikeSources.get(array) ?? array], stack, thisValue);
+  return options.callClosure(
+    callback,
+    [value, index, arrayLikeSources.get(array) ?? array],
+    stack,
+    thisValue
+  );
 }
 function findNextDefinedIndex(value, startIndex, direction, length, budget) {
   for (let index = startIndex; direction > 0 ? index < length : index >= 0; index += direction) {
@@ -26950,7 +27667,8 @@ function getFunctionMember(target, property, options) {
   while (current !== null) {
     if (isGuestClosure(current)) {
       const value = getGuestFunctionProperty(current, String(property));
-      if (value !== void 0 || Object.hasOwn(current.properties ?? {}, String(property))) return value;
+      if (value !== void 0 || Object.hasOwn(current.properties ?? {}, String(property)))
+        return value;
     } else if (isSandboxClosure(current)) {
       if (current.properties !== void 0 && Object.hasOwn(current.properties, String(property)))
         return current.properties[String(property)];
@@ -26966,7 +27684,8 @@ function getFunctionMember(target, property, options) {
     }
   }
   if (current === null) return void 0;
-  if (property === "toString" && runResources.getStore()?.functionSourceText === false) return void 0;
+  if (property === "toString" && runResources.getStore()?.functionSourceText === false)
+    return void 0;
   if (!isFunctionMethodName(property)) {
     return void 0;
   }
@@ -26974,13 +27693,13 @@ function getFunctionMember(target, property, options) {
     sandbox: true,
     name: `Function#${property}`,
     ...property === "toString" ? { length: 0 } : {},
-    call: (args, context) => callFunctionMethod(context?.thisValue, property, args, options, context?.stack ?? [])
+    call: (args, context) => callFunctionMethod(context?.thisValue, property, args, options, context?.stack ?? [], context)
   });
 }
 function isFunctionMethodName(property) {
   return typeof property === "string" && functionMethodNames.has(property);
 }
-function callFunctionMethod(target, methodName, args, options, stack) {
+function callFunctionMethod(target, methodName, args, options, stack, context) {
   if (!isSandboxClosure(target)) {
     throw new TypeError(`Function#${methodName} requires a callable receiver.`);
   }
@@ -26991,28 +27710,46 @@ function callFunctionMethod(target, methodName, args, options, stack) {
   const thisValue = args[0];
   if (methodName === "bind") {
     const boundArgs = args.slice(1);
-    const bound = createSandboxClosure({
-      guest: true,
-      sandbox: true,
-      name: `bound ${target.name ?? ""}`,
-      length: target.length === void 0 ? void 0 : Math.max(0, target.length - boundArgs.length),
-      boundTarget: target,
-      retainedValues: () => [target, thisValue, ...boundArgs],
-      call: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], thisValue),
-      ...target.construct === void 0 ? {} : {
-        construct: (callArgs, context) => options.callClosure(
-          target,
-          [...boundArgs, ...callArgs],
-          context?.stack ?? [],
-          void 0,
-          true,
-          context?.newTarget === bound ? target : context?.newTarget
-        )
-      }
-    });
-    if (hasExplicitSandboxPrototype(target))
-      setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
-    return bound;
+    const bind = (length, name) => {
+      const bound = createSandboxClosure({
+        guest: true,
+        sandbox: true,
+        name: `bound ${name}`,
+        length,
+        boundTarget: target,
+        retainedValues: () => [target, thisValue, ...boundArgs, bound.name],
+        call: (callArgs, context2) => options.callClosure(target, [...boundArgs, ...callArgs], context2?.stack ?? [], thisValue),
+        ...target.construct === void 0 ? {} : {
+          construct: (callArgs, context2) => options.callClosure(
+            target,
+            [...boundArgs, ...callArgs],
+            context2?.stack ?? [],
+            void 0,
+            true,
+            context2?.newTarget === bound ? target : context2?.newTarget
+          )
+        }
+      });
+      if (hasExplicitSandboxPrototype(target))
+        setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+      return bound;
+    };
+    if (context?.getProperty === void 0)
+      return bind(
+        target.length === void 0 ? void 0 : Math.max(0, target.length - boundArgs.length),
+        target.name ?? ""
+      );
+    return (async () => {
+      const properties = target.properties;
+      const defaultName = target.name;
+      const hasLength = !isGuestClosure(target) || target.properties === void 0 || Object.hasOwn(target.properties, "length");
+      const length = hasLength ? await context.getProperty(target, "length") : void 0;
+      const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name") ? defaultName : await context.getProperty(target, "name");
+      return bind(
+        typeof length === "number" && !Number.isNaN(length) ? Math.max(0, Math.trunc(length) - boundArgs.length) : 0,
+        typeof name === "string" ? name : ""
+      );
+    })();
   }
   if (methodName === "call") {
     return options.callClosure(target, args.slice(1), stack, thisValue);
@@ -27024,7 +27761,24 @@ function callFunctionMethod(target, methodName, args, options, stack) {
   if (!Array.isArray(applyArgs)) {
     throw new TypeError("Function#apply requires an array or nullish arguments value.");
   }
-  return options.callClosure(target, applyArgs, stack, thisValue);
+  if (context?.getProperty === void 0)
+    return options.callClosure(target, applyArgs, stack, thisValue);
+  return (async () => {
+    const values = [];
+    const length = applyArgs.length;
+    options.budget?.allocateArrayLength(length);
+    const retained = {};
+    options.budget?.setRetainedValues(retained, () => values);
+    try {
+      for (let index = 0; index < length; index++) {
+        options.budget?.visitNode();
+        values.push(await context.getProperty(applyArgs, index));
+      }
+      return await options.callClosure(target, values, stack, thisValue);
+    } finally {
+      options.budget?.setRetainedValues(retained, void 0);
+    }
+  })();
 }
 
 // packages/safe-js/src/interp/methods/collection-callback.ts
@@ -27336,15 +28090,24 @@ function createCollectionGlobals(options) {
         context,
         retainedValues: () => [key, value],
         append: (entry) => {
-          if (typeof entry !== "object" || entry === null) throw new TypeError("Map constructor requires entry objects.");
-          key = context?.getProperty !== void 0 ? context.getProperty(entry, 0) : getSandboxDataProperty(entry, 0, options.budget);
-          value = context?.getProperty !== void 0 ? context.getProperty(entry, 1) : getSandboxDataProperty(entry, 1, options.budget);
-          const added = map.entries.has(key) ? 0 : 1;
-          const growth = added + (options.budget.limits.dataSize === void 0 ? 0 : measureSandboxData([key, value]));
-          options.budget.allocateCollectionEntries(map.entries.size + added);
-          map.entries.set(key, value);
-          key = value = void 0;
-          return growth;
+          if (typeof entry !== "object" || entry === null)
+            throw new TypeError("Map constructor requires entry objects.");
+          const store = (entryValue) => {
+            value = entryValue;
+            const added = map.entries.has(key) ? 0 : 1;
+            const growth = added + (options.budget.limits.dataSize === void 0 ? 0 : measureSandboxData([key, value]));
+            options.budget.allocateCollectionEntries(map.entries.size + added);
+            map.entries.set(key, value);
+            key = value = void 0;
+            return growth;
+          };
+          const readValue = (entryKey) => {
+            key = entryKey;
+            const result2 = context?.getProperty !== void 0 ? context.getProperty(entry, 1) : getSandboxDataProperty(entry, 1, options.budget);
+            return result2 instanceof Promise ? result2.then(store) : store(result2);
+          };
+          const result = context?.getProperty !== void 0 ? context.getProperty(entry, 0) : getSandboxDataProperty(entry, 0, options.budget);
+          return result instanceof Promise ? result.then(readValue) : readValue(result);
         }
       });
     },
@@ -27382,7 +28145,13 @@ function isSandboxMapConstructor(value) {
 function isSandboxSetConstructor(value) {
   return typeof value === "object" && value !== null && setConstructors.has(value);
 }
-function populateCollection(source, collection, { name, budget, context, append, retainedValues }) {
+function populateCollection(source, collection, {
+  name,
+  budget,
+  context,
+  append,
+  retainedValues
+}) {
   budget.allocateCollectionEntries(0);
   if (source === void 0 || source === null) return collection;
   const iterator = getSandboxIterator(source, budget, context);
@@ -27390,7 +28159,14 @@ function populateCollection(source, collection, { name, budget, context, append,
   let entry;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [source, iterator.retainedValue, collection, entry, failure, ...retainedValues?.() ?? []]);
+  budget.setRetainedValues(retained, () => [
+    source,
+    iterator.retainedValue,
+    collection,
+    entry,
+    failure,
+    ...retainedValues?.() ?? []
+  ]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -27400,21 +28176,29 @@ function populateCollection(source, collection, { name, budget, context, append,
     };
     try {
       const closing = iterator.return?.();
-      if (iterator.generator || iterator.asynchronous) return Promise.resolve(closing).then(() => {
-        throw error;
-      }, rethrow);
+      if (iterator.generator || iterator.asynchronous)
+        return Promise.resolve(closing).then(() => {
+          throw error;
+        }, rethrow);
     } catch (closeError) {
       return rethrow(closeError);
     }
     throw error;
   };
   const consume = (result) => {
-    if (typeof result !== "object" || result === null) throw new TypeError("Iterator result must be an object.");
+    if (typeof result !== "object" || result === null)
+      throw new TypeError("Iterator result must be an object.");
     if (result.done) return true;
     entry = result.value;
     try {
       budget.visitNode();
       const growth = append(entry);
+      if (growth instanceof Promise)
+        return growth.then((size) => {
+          entry = void 0;
+          checkData(collection, size);
+          return false;
+        }).catch(closeOnThrow);
       entry = void 0;
       checkData(collection, growth);
     } catch (error) {
@@ -27422,7 +28206,7 @@ function populateCollection(source, collection, { name, budget, context, append,
     }
     return false;
   };
-  if (iterator.generator || iterator.asynchronous) {
+  if (iterator.generator || iterator.asynchronous || context !== void 0) {
     return (async () => {
       try {
         checkData(collection, 0, true);
@@ -28226,7 +29010,8 @@ async function evaluateTaggedTemplateExpression(node, context) {
   if (node.tag.type === "MemberExpression") return evaluateMemberAccess(node.tag, context, async (member) => {
     if (member.kind === "nullish") throw new TypeError("Tagged template tag must be a function.");
     const key = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-    return invokeTag(getPropertyValue(member.object, key, context), member.superReceiver === void 0 ? member.object : member.superReceiver.value);
+    const receiver = member.superReceiver === void 0 ? member.object : member.superReceiver.value;
+    return invokeTag(await getPropertyValue(member.object, key, context, receiver), receiver);
   });
   const tag = await evaluateNode(node.tag, context);
   return tag.kind === "normal" ? invokeTag(tag.value, void 0) : tag;
@@ -28321,7 +29106,8 @@ async function evaluateBinaryExpression(node, context) {
       if (isSandboxBox(rightValue) && (!equality || left.value !== null && left.value !== void 0 && typeof left.value !== "object"))
         rightValue = await toNumericPrimitive(rightValue, context);
     }
-    const value = applyBinaryOperator(node, leftValue, rightValue, context);
+    const operation = applyBinaryOperator(node, leftValue, rightValue, context);
+    const value = operation instanceof Promise ? await operation : operation;
     return {
       kind: "normal",
       hasValue: true,
@@ -28412,8 +29198,17 @@ async function evaluateMemberAssignmentExpression(node, context) {
       if (member.object === null || member.object === void 0) {
         throw new TypeError("Cannot assign properties of null or undefined.");
       }
-      property = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-      current = getPropertyValue(member.object, property, context);
+      property = await toPropertyKey(
+        member.property,
+        context.budget,
+        createCoercionContext(context)
+      );
+      current = await getPropertyValue(
+        member.object,
+        property,
+        context,
+        member.superReceiver === void 0 ? member.object : member.superReceiver.value
+      );
     }
     if (node.operator === "&&=" && !isTruthy(current)) {
       return {
@@ -28449,9 +29244,22 @@ async function evaluateMemberAssignmentExpression(node, context) {
         throw new TypeError("Cannot assign properties of null or undefined.");
       }
       operands = [value];
-      property ??= await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-      if (member.superReceiver === void 0) setSandboxProperty(member.object, property, value, context.budget);
-      else setSuperProperty(member.object, member.superReceiver.value, property, value, context.budget);
+      property ??= await toPropertyKey(
+        member.property,
+        context.budget,
+        createCoercionContext(context)
+      );
+      if (member.superReceiver === void 0)
+        await setSandboxProperty(
+          member.object,
+          property,
+          value,
+          context.budget,
+          true,
+          createCoercionContext(context)
+        );
+      else
+        await setSuperProperty(member.object, member.superReceiver.value, property, value, context);
       return {
         kind: "normal",
         hasValue: true,
@@ -29526,11 +30334,11 @@ async function evaluateMemberUpdateExpression(node, context) {
     }
     const property = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
     const current = toNumber(
-      await toNumericPrimitive(getPropertyValue(member.object, property, context), context)
+      await toNumericPrimitive(await getPropertyValue(member.object, property, context, member.superReceiver === void 0 ? member.object : member.superReceiver.value), context)
     );
     const next = node.operator === "++" ? current + 1 : current - 1;
-    if (member.superReceiver === void 0) setSandboxProperty(member.object, property, next, context.budget);
-    else setSuperProperty(member.object, member.superReceiver.value, property, next, context.budget);
+    if (member.superReceiver === void 0) await setSandboxProperty(member.object, property, next, context.budget, true, createCoercionContext(context));
+    else await setSuperProperty(member.object, member.superReceiver.value, property, next, context);
     return {
       kind: "normal",
       hasValue: true,
@@ -29547,28 +30355,38 @@ async function evaluateMemberExpression(node, context) {
     return {
       kind: "normal",
       hasValue: true,
-      value: getPropertyValue(member.object, await toPropertyKey(member.property, context.budget, createCoercionContext(context)), context)
+      value: await getPropertyValue(
+        member.object,
+        await toPropertyKey(member.property, context.budget, createCoercionContext(context)),
+        context,
+        member.superReceiver === void 0 ? member.object : member.superReceiver.value
+      )
     };
   });
 }
-function getPropertyValue(target, property, context) {
+function getPropertyValue(target, property, context, receiver = target) {
   if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
+  const descriptor = getSandboxPropertyDescriptor(target, property, context.budget);
+  if (descriptor !== void 0)
+    return readPropertyDescriptor(descriptor, receiver, createCoercionContext(context), true);
   if (typeof target === "string" || typeof target === "number" || typeof target === "boolean") {
     const prototype = getBoxedPrototype(target, context.budget);
     if (prototype !== void 0) {
       if (typeof target === "string" && (property === "length" || getStringIndex(property) !== void 0))
         return getStringMember(target, property, context.budget);
-      return getMemberValue(prototype, property, context);
+      return getPropertyValue(prototype, property, context, receiver);
     }
   }
   if (typeof target === "string") return getStringMember(target, property, context.budget);
   if (typeof target === "number") return getNumberMember(property, context.budget);
   if (typeof target === "boolean") return void 0;
   if (isFloat32Array(target)) return getFloat32Member(target, property, context.budget);
-  if (isSandboxDate(target)) return getDateMember(property, context.budget, context.compilation?.owner);
+  if (isSandboxDate(target))
+    return getDateMember(property, context.budget, context.compilation?.owner);
   if (isSandboxMap(target)) return getMapMember(target, property, createMapMethodOptions(context));
   if (isSandboxSet(target)) return getSetMember(target, property, createSetMethodOptions(context));
-  if (isSandboxCollectionIterator(target)) return getCollectionIteratorMember(target, property, context.budget);
+  if (isSandboxCollectionIterator(target))
+    return getCollectionIteratorMember(target, property, context.budget);
   if (isSandboxGenerator(target)) return getGeneratorMember(target, property, context.budget);
   if (isSandboxClosure(target)) return getClosureMemberValue(target, property, context);
   if (isSandboxPromise(target)) return getPromiseMember(property, context.budget);
@@ -29585,13 +30403,21 @@ function createPatternContext(context, scope = context.scope, evaluate = evaluat
     evaluate: (node, inferredName) => evaluate(node, { ...evaluationContext, inferredName }),
     toPropertyKey: (value) => toPropertyKey(value, context.budget, createCoercionContext(evaluationContext)),
     getProperty: (value, key) => getPropertyValue(value, key, evaluationContext),
-    setProperty: (target, key, value) => setSandboxProperty(target, key, value, context.budget)
+    setProperty: (target, key, value) => setSandboxProperty(
+      target,
+      key,
+      value,
+      context.budget,
+      true,
+      createCoercionContext(evaluationContext)
+    )
   };
 }
 async function evaluateCallExpression(node, context) {
   if (node.callee.type === "Super") {
     const construction = context.functionEnvironment?.construction;
-    if (construction === void 0) throw new ReferenceError("Super constructor binding is unavailable.");
+    if (construction === void 0)
+      throw new ReferenceError("Super constructor binding is unavailable.");
     const args = await evaluateCallArguments(node.arguments, context);
     if (!args.ok) return args.result;
     return { kind: "normal", hasValue: true, value: await construction.superCall(args.value) };
@@ -29746,7 +30572,7 @@ async function evaluateMemberCallExpression(node, context) {
       property: await toPropertyKey(reference.property, context.budget, createCoercionContext(context))
     };
     if (member.superReceiver !== void 0)
-      return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.superReceiver.value);
+      return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context, member.superReceiver.value), context, member.superReceiver.value);
     if ((typeof member.object === "string" || typeof member.object === "number" || typeof member.object === "boolean") && getBoxedPrototype(member.object, context.budget) !== void 0) {
       if (isDefaultBoxedMethod(member.object, member.property, context.budget)) {
         if (typeof member.object === "string" && isStringMethodName(member.property))
@@ -29754,7 +30580,7 @@ async function evaluateMemberCallExpression(node, context) {
         if (typeof member.object === "number" && isNumberMethodName(member.property))
           return evaluateNumberMethodCall(node, member.object, member.property, context);
       }
-      return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.object);
+      return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
     }
     if (typeof member.object === "string" && isStringMethodName(member.property)) {
       return evaluateStringMethodCall(node, member.object, member.property, context);
@@ -29835,7 +30661,7 @@ async function evaluateMemberCallExpression(node, context) {
       return evaluateResolvedCallExpression(node, memberValue, context, member.object);
     }
     if (isSandboxClosure(member.object)) {
-      const memberValue = getClosureMemberValue(member.object, member.property, context);
+      const memberValue = await getPropertyValue(member.object, member.property, context);
       if (memberValue === void 0) {
         throw new TypeError(`Function#${String(member.property)} is not a supported method.`);
       }
@@ -29862,7 +30688,7 @@ async function evaluateMemberCallExpression(node, context) {
     }
     return evaluateResolvedCallExpression(
       node,
-      getMemberValue(member.object, member.property, context),
+      await getPropertyValue(member.object, member.property, context),
       context,
       member.object
     );
@@ -30064,7 +30890,8 @@ function applyBinaryOperator(node, left, right, context) {
         return true;
       }
       if (isFloat32ArrayConstructor(right)) return isFloat32Array(left);
-      if (isDateConstructor(right)) return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
+      if (isDateConstructor(right))
+        return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
       if (isSandboxSetConstructor(right) && isSandboxSet(left)) {
         return true;
       }
@@ -30073,16 +30900,20 @@ function applyBinaryOperator(node, left, right, context) {
       }
       if (isGuestClosure(right)) {
         if (typeof left !== "object" || left === null) return false;
-        const prototype = getGuestFunctionProperty(right, "prototype");
-        if (typeof prototype !== "object" || prototype === null) {
-          throw new TypeError("Function has a non-object prototype in instanceof check.");
-        }
-        let depth = 0;
-        for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
-          context.budget.visitNode();
-          assertSandboxDataDepth(depth++);
-          if (current === prototype) return true;
-        }
+        const check = (prototype2) => {
+          if (typeof prototype2 !== "object" || prototype2 === null) {
+            throw new TypeError("Function has a non-object prototype in instanceof check.");
+          }
+          let depth = 0;
+          for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
+            context.budget.visitNode();
+            assertSandboxDataDepth(depth++);
+            if (current === prototype2) return true;
+          }
+          return false;
+        };
+        const prototype = getPropertyValue(right, "prototype", context);
+        return prototype instanceof Promise ? prototype.then(check) : check(prototype);
       }
       return false;
     case "in":
@@ -30253,7 +31084,7 @@ async function toNumericPrimitive(value, context) {
   }
   if (isIndexableSandboxValue(value)) {
     for (const methodName of ["valueOf", "toString"]) {
-      const method = getMemberValue(value, methodName, context);
+      const method = await getPropertyValue(value, methodName, context);
       if (methodName === "toString" && method === void 0 && !Object.hasOwn(value, methodName)) {
         return toString(value);
       }
@@ -30341,13 +31172,18 @@ function getArrayMemberValue(target, property, context) {
   }
   return getArrayMember(target, property, createArrayMethodOptions(context));
 }
-function setSandboxProperty(target, property, value, budget, checkInherited = true) {
+function setSandboxProperty(target, property, value, budget, checkInherited = true, context) {
   if (isSandboxDate(target)) throw new TypeError("Date own properties are not supported.");
   if (isGuestHostObject(target)) {
     setHostObjectMember(target, String(property), value);
     return;
   }
   const prototypeOwner = target;
+  if (checkInherited) {
+    const descriptor2 = getSandboxPropertyDescriptor(target, property, budget);
+    if (descriptor2 !== void 0 && !("value" in descriptor2))
+      return writePropertyDescriptor(descriptor2, target, value, context);
+  }
   if (isGuestClosure(target)) target = materializeFunctionProperties(target);
   if (isFloat32Array(target)) {
     setFloat32Member(target, property, value);
@@ -30383,15 +31219,18 @@ function setSandboxProperty(target, property, value, budget, checkInherited = tr
         const properties = isSandboxClosure(prototype) ? prototype.properties : prototype;
         const inherited = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key);
         if (inherited === void 0) continue;
-        if (inherited.writable !== true) throw new TypeError(`Cannot assign to read only property '${key}'.`);
+        if (inherited.writable !== true)
+          throw new TypeError(`Cannot assign to read only property '${key}'.`);
         break;
       }
     }
     defineSandboxProperty(target, key, value);
   }
 }
-function setSuperProperty(base, receiver, key, value, budget) {
-  if (typeof base !== "object" || base === null) throw new TypeError("Cannot assign a property of null.");
+function setSuperProperty(base, receiver, key, value, context) {
+  const budget = context.budget;
+  if (typeof base !== "object" || base === null)
+    throw new TypeError("Cannot assign a property of null.");
   let depth = 0;
   for (let current = base; current !== null; current = getSandboxPrototype(current, budget)) {
     budget.visitNode();
@@ -30399,11 +31238,15 @@ function setSuperProperty(base, receiver, key, value, budget) {
     const properties = isSandboxClosure(current) ? current.properties : current;
     const descriptor = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key);
     if (descriptor === void 0) continue;
-    if (descriptor.writable !== true) throw new TypeError(`Cannot assign to read only property '${key}'.`);
+    if (!("value" in descriptor))
+      return writePropertyDescriptor(descriptor, receiver, value, createCoercionContext(context));
+    if (descriptor.writable !== true)
+      throw new TypeError(`Cannot assign to read only property '${key}'.`);
     break;
   }
-  if (typeof receiver !== "object" || receiver === null) throw new TypeError("Super assignment requires an object receiver.");
-  setSandboxProperty(receiver, key, value, budget, false);
+  if (typeof receiver !== "object" || receiver === null)
+    throw new TypeError("Super assignment requires an object receiver.");
+  return setSandboxProperty(receiver, key, value, budget, false);
 }
 function deleteSandboxProperty(target, property) {
   if (isGuestHostObject(target)) return deleteHostObjectMember(target, String(property));
@@ -30467,7 +31310,7 @@ function createArrayMethodOptions(context) {
     budget: context.budget,
     context: createCoercionContext(context),
     hasProperty: (value, property) => hasSandboxProperty(value, property, context),
-    setProperty: (value, property, entry) => setSandboxProperty(value, property, entry, context.budget),
+    setProperty: (value, property, entry) => setSandboxProperty(value, property, entry, context.budget, true, createCoercionContext(context)),
     deleteProperty: deleteSandboxProperty,
     callClosure: (closure, args, stack, thisValue) => invokeSandboxClosure(closure, args, context, stack, void 0, thisValue)
   };
@@ -30605,11 +31448,12 @@ async function evaluateObjectSpread(node, context) {
     };
   }
   if (isGuestHostObject(value.value)) {
-    const entries = [];
+    const entries2 = [];
     for (const key of getHostObjectKeys(value.value)) {
-      if (hasHostObjectMember(value.value, key, true)) entries.push([key, getHostObjectMember(value.value, key)]);
+      if (hasHostObjectMember(value.value, key, true))
+        entries2.push([key, getHostObjectMember(value.value, key)]);
     }
-    return { ok: true, value: entries };
+    return { ok: true, value: entries2 };
   }
   if (isSandboxClosure(value.value) && !isGuestClosure(value.value) || isSandboxPromise(value.value)) {
     throw new TypeError(
@@ -30619,10 +31463,17 @@ async function evaluateObjectSpread(node, context) {
   const spreadValue = isGuestClosure(value.value) ? value.value.properties ?? {} : Object(value.value);
   const keys = Object.keys(spreadValue);
   context.budget.allocateArrayLength(keys.length);
-  return {
-    ok: true,
-    value: keys.map((key) => [key, spreadValue[key]])
-  };
+  const entries = [];
+  const release = retainValues(context.budget, () => [value.value, entries]);
+  try {
+    for (const key of keys) {
+      if (!hasOwnSandboxProperty(value.value, key, true)) continue;
+      entries.push([key, await getPropertyValue(value.value, key, context)]);
+    }
+    return { ok: true, value: entries };
+  } finally {
+    release();
+  }
 }
 function describeObjectSpreadValue(value) {
   if (value === null) {
@@ -30771,7 +31622,7 @@ function executeAsyncFunction(execute, budget, signal) {
       try {
         const value = await execute(completePrefix);
         resolve(
-          isSandboxPromise(value) || getThenable(value) !== void 0 ? awaitSandboxValue(
+          requiresPromiseResolution(value, budget) ? awaitSandboxValue(
             createSandboxPromise(resolveSandboxValue(value, { budget }), {
               trackReplay: false
             }),
@@ -32197,19 +33048,29 @@ async function stringifyJson(value, replacer, indent, budget, context) {
   return budget.allocateString(output);
 }
 async function stringifyProperty(key, holder, state, indent = "") {
-  let value = getOwnDataValue(holder, key);
-  if (isSandboxDate(value)) {
-    value = dateMethods.get("toJSON").invoke(value, []);
-  } else if (isStringifyContainer(value)) {
-    const toJSON = getOwnDataValue(value, "toJSON");
-    if (isSandboxClosure(toJSON)) {
-      value = await callStringifyClosure(toJSON, [key], value, state);
+  let value = await getStringifyProperty(holder, key, state);
+  const release = retainValues(state.budget, () => [holder, value]);
+  try {
+    if (isSandboxDate(value)) {
+      value = dateMethods.get("toJSON").invoke(value, []);
+    } else if (isStringifyContainer(value)) {
+      const toJSON = await getStringifyProperty(value, "toJSON", state);
+      if (isSandboxClosure(toJSON)) {
+        value = await callStringifyClosure(toJSON, [key], value, state);
+      }
+    }
+    if (state.replacer !== void 0) {
+      value = await callStringifyClosure(
+        state.replacer,
+        [key, toSandboxValue(value)],
+        holder,
+        state
+      );
     }
+    return await stringifyValue(value, state, indent);
+  } finally {
+    release();
   }
-  if (state.replacer !== void 0) {
-    value = await callStringifyClosure(state.replacer, [key, toSandboxValue(value)], holder, state);
-  }
-  return stringifyValue(value, state, indent);
 }
 async function stringifyValue(value, state, indent) {
   if (isSandboxBox(value)) {
@@ -32245,10 +33106,12 @@ async function stringifyValue(value, state, indent) {
 }
 async function stringifyArray(value, state, indent) {
   enterStringifyObject(value, state);
+  const entries = [];
+  const release = retainValues(state.budget, () => entries);
   try {
     const nextIndent = indent + state.gap;
-    const entries = [];
-    for (let index = 0; index < value.length; index += 1) {
+    const length = value.length;
+    for (let index = 0; index < length; index += 1) {
       entries.push(await stringifyProperty(String(index), value, state, nextIndent) ?? "null");
     }
     if (entries.length === 0) {
@@ -32262,14 +33125,16 @@ ${nextIndent}${entries.join(`,
 ${nextIndent}`)}
 ${indent}]`;
   } finally {
+    release();
     leaveStringifyObject(value, state);
   }
 }
 async function stringifyObject(value, state, indent) {
   enterStringifyObject(value, state);
+  const entries = [];
+  const release = retainValues(state.budget, () => entries);
   try {
     const nextIndent = indent + state.gap;
-    const entries = [];
     for (const key of Object.keys(value)) {
       const serialized = await stringifyProperty(key, value, state, nextIndent);
       if (serialized !== void 0) {
@@ -32287,6 +33152,7 @@ ${nextIndent}${entries.join(`,
 ${nextIndent}`)}
 ${indent}}`;
   } finally {
+    release();
     leaveStringifyObject(value, state);
   }
 }
@@ -32342,15 +33208,10 @@ function toSandboxValue(value) {
     `JSON.stringify(value) produced an unsupported value of type ${typeof value}.`
   );
 }
-function getOwnDataValue(target, key) {
-  const descriptor = Object.getOwnPropertyDescriptor(target, key);
-  if (descriptor === void 0) {
-    return void 0;
-  }
-  if ("get" in descriptor || "set" in descriptor) {
-    throw new TypeError(`JSON.stringify(value) cannot serialize accessor property ${key}.`);
-  }
-  return descriptor.value;
+function getStringifyProperty(target, key, state) {
+  if (state.context?.getProperty !== void 0) return state.context.getProperty(target, key);
+  const descriptor = getSandboxPropertyDescriptor(target, key, state.budget);
+  return descriptor === void 0 ? void 0 : readPropertyDescriptor(descriptor, target, state.context);
 }
 function copyJsonToSandbox(value, budget) {
   if (value === null || value === void 0 || typeof value === "boolean" || typeof value === "number") {
@@ -34608,4 +35469,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-WBWD7ZCM.js.map
+//# sourceMappingURL=chunk-EZAX76DY.js.map