@poe-platform/safe-js 0.1.376 → 0.1.378

package/dist/safe-js/chunks/{chunk-7UITTELW.js → chunk-RECEBNHR.js}

@@ -7225,230 +7225,50 @@ function serializedDateTime(value) {
 // packages/safe-js/src/interp/internal-symbols.ts
 var internalSymbols = /* @__PURE__ */ new Set();
 
-// packages/safe-js/src/interp/accessors.ts
-var accessorClosures = /* @__PURE__ */ new WeakMap();
-var getterAdapters = /* @__PURE__ */ new WeakMap();
-var setterAdapters = /* @__PURE__ */ new WeakMap();
-function accessorAdapter(closure, kind) {
-  if (kind === "get") {
-    let adapter2 = getterAdapters.get(closure);
-    if (adapter2 === void 0) {
-      adapter2 = () => void 0;
-      getterAdapters.set(closure, adapter2);
-      accessorClosures.set(adapter2, closure);
-    }
-    return adapter2;
-  }
-  let adapter = setterAdapters.get(closure);
-  if (adapter === void 0) {
-    adapter = () => {
-      throw new TypeError("Accessor writes require sandbox execution.");
-    };
-    setterAdapters.set(closure, adapter);
-    accessorClosures.set(adapter, closure);
+// packages/safe-js/src/interp/arguments.ts
+var sandboxArgumentsBrand = /* @__PURE__ */ Symbol("SandboxArguments");
+internalSymbols.add(sandboxArgumentsBrand);
+function createSandboxArguments(values) {
+  const result = /* @__PURE__ */ (function() {
+    return arguments;
+  })();
+  for (let index = 0; index < values.length; index += 1) {
+    result[index] = values[index];
   }
-  return adapter;
+  result.length = values.length;
+  Object.defineProperty(result, sandboxArgumentsBrand, { value: true });
+  return result;
 }
-function accessorClosure(adapter) {
-  if (adapter === void 0) return void 0;
-  const closure = accessorClosures.get(adapter);
-  if (closure === void 0) throw new TypeError("Native accessors cannot execute in the sandbox.");
-  return closure;
+function isSandboxArguments(value) {
+  return typeof value === "object" && value !== null && Object.hasOwn(value, sandboxArgumentsBrand);
 }
-function retainedAccessorClosures(descriptor) {
-  const closures = [];
-  for (const adapter of [descriptor.get, descriptor.set]) {
-    const closure = adapter === void 0 ? void 0 : accessorClosures.get(adapter);
-    if (closure !== void 0) closures.push(closure);
-  }
-  return closures;
+function getSandboxArgumentEntries(value) {
+  return Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(
+    ([key, descriptor]) => "value" in descriptor ? [[key, descriptor.value]] : []
+  );
 }
-function readPropertyDescriptor(descriptor, receiver, context, allowNativeGetter = false) {
-  if ("value" in descriptor) return descriptor.value;
-  if (descriptor.get === void 0) return void 0;
-  const getter = accessorClosures.get(descriptor.get);
-  if (getter === void 0) {
-    if (!allowNativeGetter) throw new TypeError("Native accessors cannot execute in the sandbox.");
-    return Reflect.apply(descriptor.get, receiver, []);
+function copySandboxArgumentProperties(source, target, copyValue) {
+  const names = Object.getOwnPropertyNames(source);
+  if (!names.includes("length") || names.indexOf("length") > names.indexOf("callee")) {
+    Reflect.deleteProperty(target, "length");
   }
-  if (context?.invokeClosure === void 0)
-    throw new TypeError("Accessor reads require sandbox execution.");
-  return context.invokeClosure(getter, [], receiver);
-}
-function writePropertyDescriptor(descriptor, receiver, value, context) {
-  const setter = accessorClosure(descriptor.set);
-  if (setter === void 0) throw new TypeError("Cannot assign to a getter-only property.");
-  if (context?.invokeClosure === void 0)
-    throw new TypeError("Accessor writes require sandbox execution.");
-  return context.invokeClosure(setter, [value], receiver).then(() => void 0);
-}
-
-// packages/safe-js/src/interp/symbols.ts
-var wellKnownSymbols = Object.freeze({
-  iterator: Symbol.iterator,
-  asyncIterator: Symbol.asyncIterator,
-  hasInstance: Symbol.hasInstance,
-  isConcatSpreadable: Symbol.isConcatSpreadable,
-  match: Symbol.match,
-  matchAll: Symbol.matchAll,
-  replace: Symbol.replace,
-  search: Symbol.search,
-  species: Symbol.species,
-  split: Symbol.split,
-  toPrimitive: Symbol.toPrimitive,
-  toStringTag: Symbol.toStringTag,
-  unscopables: Symbol.unscopables
-});
-
-// packages/safe-js/src/interp/intrinsics.ts
-var identities = /* @__PURE__ */ new WeakMap();
-var realms2 = /* @__PURE__ */ new WeakMap();
-function registerBuiltinIdentities(budget, bindings) {
-  let realm = realms2.get(budget);
-  if (realm === void 0) realms2.set(budget, realm = /* @__PURE__ */ new Map());
-  const pending = Object.entries(bindings).map(([name, value]) => [[name], value]);
-  const visited = /* @__PURE__ */ new WeakSet();
-  for (let index = 0; index < pending.length; index++) {
-    const [path, value] = pending[index];
-    if (value === null || typeof value !== "object") continue;
-    const id = JSON.stringify(path);
-    const previous = realm.get(id);
-    if (previous !== void 0 && previous !== value)
-      throw new TypeError(`Duplicate intrinsic identity: ${id}`);
-    realm.set(id, value);
-    if (!identities.has(value)) identities.set(value, id);
-    if (visited.has(value)) continue;
-    visited.add(value);
-    const owner = isSandboxClosure(value) ? value.properties : value;
-    if (owner === void 0) continue;
-    for (const key of Reflect.ownKeys(owner)) {
-      if (typeof key === "symbol" && internalSymbols.has(key)) continue;
-      const descriptor = Object.getOwnPropertyDescriptor(owner, key);
-      const symbolName = typeof key === "symbol" ? Object.entries(wellKnownSymbols).find(([, symbol]) => symbol === key)?.[0] : void 0;
-      if (typeof key === "symbol" && symbolName === void 0)
-        throw new TypeError("Intrinsic symbol keys must be well-known symbols.");
-      const member = [...path, typeof key === "string" ? key : { symbol: symbolName }];
-      if ("value" in descriptor) pending.push([member, descriptor.value]);
-      for (const kind of ["get", "set"]) {
-        const closure = accessorClosure(descriptor[kind]);
-        if (closure !== void 0) pending.push([[...member, kind], closure]);
-      }
+  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(source))) {
+    if (!("value" in descriptor)) {
+      if (key !== "callee") throw new TypeError(`Cannot copy arguments accessor '${key}'.`);
+      continue;
     }
+    Object.defineProperty(target, key, { ...descriptor, value: copyValue(descriptor.value, key) });
   }
-}
-function getIntrinsicIdentity(value) {
-  return identities.get(value);
-}
-function resolveIntrinsicIdentity(budget, id) {
-  const value = realms2.get(budget)?.get(id);
-  if (value === void 0) throw new TypeError(`Unknown intrinsic identity: ${id}`);
-  return value;
-}
-function listIntrinsicIdentities(budget) {
-  return [...realms2.get(budget)?.keys() ?? []];
-}
-function releaseIntrinsicIdentities(budget) {
-  realms2.delete(budget);
-}
-
-// packages/safe-js/src/interp/generator-properties.ts
-var generatorGuestProperties = /* @__PURE__ */ new WeakMap();
-function getGeneratorProperties(value) {
-  let properties = generatorGuestProperties.get(value);
-  if (properties === void 0) {
-    properties = /* @__PURE__ */ Object.create(null);
-    generatorGuestProperties.set(value, properties);
-  }
-  return properties;
-}
-
-// packages/safe-js/src/interp/regexp-properties.ts
-var regexGuestProperties = /* @__PURE__ */ new WeakMap();
-function getRegexProperties(value) {
-  const properties = regexGuestProperties.get(value);
-  if (properties === void 0) throw new TypeError("Invalid sandbox RegExp storage.");
-  return properties;
-}
-
-// packages/safe-js/src/interp/collection-properties.ts
-var collectionGuestProperties = /* @__PURE__ */ new WeakMap();
-function getCollectionProperties(value) {
-  const properties = collectionGuestProperties.get(value);
-  if (properties === void 0) throw new TypeError("Invalid sandbox collection storage.");
-  return properties;
-}
-function copyCollectionProperties(source, target, encode) {
-  const properties = collectionGuestProperties.get(source) ?? source;
-  for (const key of Reflect.ownKeys(properties)) {
-    const descriptor = Object.getOwnPropertyDescriptor(properties, key);
-    if (!("value" in descriptor)) throw new TypeError("Collection accessor properties cannot be copied as data.");
-    Object.defineProperty(target, key, { ...descriptor, value: encode(descriptor.value) });
-  }
-  if (!Object.isExtensible(properties)) Object.preventExtensions(target);
-}
-
-// packages/safe-js/src/interp/resources.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-var runResources = new AsyncLocalStorage();
-function retainValues(budget, values) {
-  const retained = {};
-  budget.setRetainedValues(retained, values);
-  const pending = runResources.getStore()?.referenceReleases;
-  const release = () => {
-    budget.setRetainedValues(retained, void 0);
-    pending?.delete(release);
-  };
-  pending?.add(release);
-  return release;
-}
-async function withRunResources(signal, execute) {
-  const controller = new AbortController();
-  const cancel = () => controller.abort(signal?.reason);
-  const cleanups = /* @__PURE__ */ new Set();
-  const resources = {
-    signal: controller.signal,
-    referenceReleases: /* @__PURE__ */ new Set(),
-    add(close) {
-      cleanups.add(close);
+  const iterator = Object.getOwnPropertyDescriptor(source, Symbol.iterator);
+  if (iterator === void 0) {
+    Reflect.deleteProperty(target, Symbol.iterator);
+  } else {
+    if (iterator.value !== Array.prototype.values) {
+      throw new TypeError("Cannot copy a replaced arguments iterator.");
     }
-  };
-  signal?.addEventListener("abort", cancel, { once: true });
-  if (signal?.aborted) cancel();
-  let result;
-  let failure;
-  let errors = [];
-  try {
-    result = await runResources.run(resources, execute);
-  } catch (error) {
-    failure = { reason: error };
-  } finally {
-    signal?.removeEventListener("abort", cancel);
-    controller.abort(new Error("SafeJS run finished."));
-    for (const release of resources.referenceReleases) release();
-    resources.referenceReleases.clear();
-    const outcomes = await Promise.allSettled(
-      [...cleanups].map((close) => Promise.resolve().then(close))
-    );
-    errors = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
+    Object.defineProperty(target, Symbol.iterator, iterator);
   }
-  if (failure !== void 0) throw failure.reason;
-  if (errors.length > 0) throw new AggregateError(errors, "SafeJS resource cleanup failed.");
-  return result;
-}
-
-// packages/safe-js/src/interp/error-prototypes.ts
-var errorPrototypes = /* @__PURE__ */ new WeakMap();
-
-// packages/safe-js/src/interp/collection-brands.ts
-var sandboxMapBrand = /* @__PURE__ */ Symbol("SandboxMap");
-var sandboxSetBrand = /* @__PURE__ */ Symbol("SandboxSet");
-internalSymbols.add(sandboxMapBrand);
-internalSymbols.add(sandboxSetBrand);
-function isSandboxMap(value) {
-  return typeof value === "object" && value !== null && sandboxMapBrand in value;
-}
-function isSandboxSet(value) {
-  return typeof value === "object" && value !== null && sandboxSetBrand in value;
+  if (!Object.isExtensible(source)) Object.preventExtensions(target);
 }
 
 // packages/safe-js/src/interp/collection-iterator.ts
@@ -7545,50 +7365,16 @@ function regexpIteratorState(value) {
   return state;
 }
 
-// packages/safe-js/src/interp/arguments.ts
-var sandboxArgumentsBrand = /* @__PURE__ */ Symbol("SandboxArguments");
-internalSymbols.add(sandboxArgumentsBrand);
-function createSandboxArguments(values) {
-  const result = /* @__PURE__ */ (function() {
-    return arguments;
-  })();
-  for (let index = 0; index < values.length; index += 1) {
-    result[index] = values[index];
-  }
-  result.length = values.length;
-  Object.defineProperty(result, sandboxArgumentsBrand, { value: true });
-  return result;
-}
-function isSandboxArguments(value) {
-  return typeof value === "object" && value !== null && Object.hasOwn(value, sandboxArgumentsBrand);
-}
-function getSandboxArgumentEntries(value) {
-  return Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(
-    ([key, descriptor]) => "value" in descriptor ? [[key, descriptor.value]] : []
-  );
+// packages/safe-js/src/interp/collection-brands.ts
+var sandboxMapBrand = /* @__PURE__ */ Symbol("SandboxMap");
+var sandboxSetBrand = /* @__PURE__ */ Symbol("SandboxSet");
+internalSymbols.add(sandboxMapBrand);
+internalSymbols.add(sandboxSetBrand);
+function isSandboxMap(value) {
+  return typeof value === "object" && value !== null && sandboxMapBrand in value;
 }
-function copySandboxArgumentProperties(source, target, copyValue) {
-  const names = Object.getOwnPropertyNames(source);
-  if (!names.includes("length") || names.indexOf("length") > names.indexOf("callee")) {
-    Reflect.deleteProperty(target, "length");
-  }
-  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(source))) {
-    if (!("value" in descriptor)) {
-      if (key !== "callee") throw new TypeError(`Cannot copy arguments accessor '${key}'.`);
-      continue;
-    }
-    Object.defineProperty(target, key, { ...descriptor, value: copyValue(descriptor.value, key) });
-  }
-  const iterator = Object.getOwnPropertyDescriptor(source, Symbol.iterator);
-  if (iterator === void 0) {
-    Reflect.deleteProperty(target, Symbol.iterator);
-  } else {
-    if (iterator.value !== Array.prototype.values) {
-      throw new TypeError("Cannot copy a replaced arguments iterator.");
-    }
-    Object.defineProperty(target, Symbol.iterator, iterator);
-  }
-  if (!Object.isExtensible(source)) Object.preventExtensions(target);
+function isSandboxSet(value) {
+  return typeof value === "object" && value !== null && sandboxSetBrand in value;
 }
 
 // packages/safe-js/src/interp/boxed.ts
@@ -7640,6 +7426,25 @@ function boxedDataProperties(value, includeSymbols = false) {
   });
 }
 
+// packages/safe-js/src/interp/regexp-properties.ts
+var regexGuestProperties = /* @__PURE__ */ new WeakMap();
+function getRegexProperties(value) {
+  const properties = regexGuestProperties.get(value);
+  if (properties === void 0) throw new TypeError("Invalid sandbox RegExp storage.");
+  return properties;
+}
+
+// packages/safe-js/src/interp/generator-properties.ts
+var generatorGuestProperties = /* @__PURE__ */ new WeakMap();
+function getGeneratorProperties(value) {
+  let properties = generatorGuestProperties.get(value);
+  if (properties === void 0) {
+    properties = /* @__PURE__ */ Object.create(null);
+    generatorGuestProperties.set(value, properties);
+  }
+  return properties;
+}
+
 // packages/safe-js/src/graph-depth.ts
 var MAX_DATA_DEPTH = 1024;
 var SnapshotBudgetError = class extends Error {
@@ -7733,6 +7538,181 @@ function graphEntries(value) {
 // packages/safe-js/src/interp/generator-prototypes.ts
 var generatorPrototypes = /* @__PURE__ */ new WeakMap();
 
+// packages/safe-js/src/interp/resources.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var runResources = new AsyncLocalStorage();
+function retainValues(budget, values) {
+  const retained = {};
+  budget.setRetainedValues(retained, values);
+  const pending = runResources.getStore()?.referenceReleases;
+  const release = () => {
+    budget.setRetainedValues(retained, void 0);
+    pending?.delete(release);
+  };
+  pending?.add(release);
+  return release;
+}
+async function withRunResources(signal, execute) {
+  const controller = new AbortController();
+  const cancel = () => controller.abort(signal?.reason);
+  const cleanups = /* @__PURE__ */ new Set();
+  const resources = {
+    signal: controller.signal,
+    referenceReleases: /* @__PURE__ */ new Set(),
+    add(close) {
+      cleanups.add(close);
+    }
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  let result;
+  let failure;
+  let errors = [];
+  try {
+    result = await runResources.run(resources, execute);
+  } catch (error) {
+    failure = { reason: error };
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+    controller.abort(new Error("SafeJS run finished."));
+    for (const release of resources.referenceReleases) release();
+    resources.referenceReleases.clear();
+    const outcomes = await Promise.allSettled(
+      [...cleanups].map((close) => Promise.resolve().then(close))
+    );
+    errors = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
+  }
+  if (failure !== void 0) throw failure.reason;
+  if (errors.length > 0) throw new AggregateError(errors, "SafeJS resource cleanup failed.");
+  return result;
+}
+
+// packages/safe-js/src/interp/accessors.ts
+var accessorClosures = /* @__PURE__ */ new WeakMap();
+var getterAdapters = /* @__PURE__ */ new WeakMap();
+var setterAdapters = /* @__PURE__ */ new WeakMap();
+function accessorAdapter(closure, kind) {
+  if (kind === "get") {
+    let adapter2 = getterAdapters.get(closure);
+    if (adapter2 === void 0) {
+      adapter2 = () => void 0;
+      getterAdapters.set(closure, adapter2);
+      accessorClosures.set(adapter2, closure);
+    }
+    return adapter2;
+  }
+  let adapter = setterAdapters.get(closure);
+  if (adapter === void 0) {
+    adapter = () => {
+      throw new TypeError("Accessor writes require sandbox execution.");
+    };
+    setterAdapters.set(closure, adapter);
+    accessorClosures.set(adapter, closure);
+  }
+  return adapter;
+}
+function accessorClosure(adapter) {
+  if (adapter === void 0) return void 0;
+  const closure = accessorClosures.get(adapter);
+  if (closure === void 0) throw new TypeError("Native accessors cannot execute in the sandbox.");
+  return closure;
+}
+function retainedAccessorClosures(descriptor) {
+  const closures = [];
+  for (const adapter of [descriptor.get, descriptor.set]) {
+    const closure = adapter === void 0 ? void 0 : accessorClosures.get(adapter);
+    if (closure !== void 0) closures.push(closure);
+  }
+  return closures;
+}
+function readPropertyDescriptor(descriptor, receiver, context, allowNativeGetter = false) {
+  if ("value" in descriptor) return descriptor.value;
+  if (descriptor.get === void 0) return void 0;
+  const getter = accessorClosures.get(descriptor.get);
+  if (getter === void 0) {
+    if (!allowNativeGetter) throw new TypeError("Native accessors cannot execute in the sandbox.");
+    return Reflect.apply(descriptor.get, receiver, []);
+  }
+  if (context?.invokeClosure === void 0)
+    throw new TypeError("Accessor reads require sandbox execution.");
+  return context.invokeClosure(getter, [], receiver);
+}
+function writePropertyDescriptor(descriptor, receiver, value, context) {
+  const setter = accessorClosure(descriptor.set);
+  if (setter === void 0) throw new TypeError("Cannot assign to a getter-only property.");
+  if (context?.invokeClosure === void 0)
+    throw new TypeError("Accessor writes require sandbox execution.");
+  return context.invokeClosure(setter, [value], receiver).then(() => void 0);
+}
+
+// packages/safe-js/src/interp/symbols.ts
+var wellKnownSymbols = Object.freeze({
+  iterator: Symbol.iterator,
+  asyncIterator: Symbol.asyncIterator,
+  hasInstance: Symbol.hasInstance,
+  isConcatSpreadable: Symbol.isConcatSpreadable,
+  match: Symbol.match,
+  matchAll: Symbol.matchAll,
+  replace: Symbol.replace,
+  search: Symbol.search,
+  species: Symbol.species,
+  split: Symbol.split,
+  toPrimitive: Symbol.toPrimitive,
+  toStringTag: Symbol.toStringTag,
+  unscopables: Symbol.unscopables
+});
+
+// packages/safe-js/src/interp/intrinsics.ts
+var identities = /* @__PURE__ */ new WeakMap();
+var realms2 = /* @__PURE__ */ new WeakMap();
+function registerBuiltinIdentities(budget, bindings) {
+  let realm = realms2.get(budget);
+  if (realm === void 0) realms2.set(budget, realm = /* @__PURE__ */ new Map());
+  const pending = Object.entries(bindings).map(([name, value]) => [[name], value]);
+  const visited = /* @__PURE__ */ new WeakSet();
+  for (let index = 0; index < pending.length; index++) {
+    const [path, value] = pending[index];
+    if (value === null || typeof value !== "object") continue;
+    const id = JSON.stringify(path);
+    const previous = realm.get(id);
+    if (previous !== void 0 && previous !== value)
+      throw new TypeError(`Duplicate intrinsic identity: ${id}`);
+    realm.set(id, value);
+    if (!identities.has(value)) identities.set(value, id);
+    if (visited.has(value)) continue;
+    visited.add(value);
+    const owner = isSandboxClosure(value) ? value.properties : value;
+    if (owner === void 0) continue;
+    for (const key of Reflect.ownKeys(owner)) {
+      if (typeof key === "symbol" && internalSymbols.has(key)) continue;
+      const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+      const symbolName = typeof key === "symbol" ? Object.entries(wellKnownSymbols).find(([, symbol]) => symbol === key)?.[0] : void 0;
+      if (typeof key === "symbol" && symbolName === void 0)
+        throw new TypeError("Intrinsic symbol keys must be well-known symbols.");
+      const member = [...path, typeof key === "string" ? key : { symbol: symbolName }];
+      if ("value" in descriptor) pending.push([member, descriptor.value]);
+      for (const kind of ["get", "set"]) {
+        const closure = accessorClosure(descriptor[kind]);
+        if (closure !== void 0) pending.push([[...member, kind], closure]);
+      }
+    }
+  }
+}
+function getIntrinsicIdentity(value) {
+  return identities.get(value);
+}
+function resolveIntrinsicIdentity(budget, id) {
+  const value = realms2.get(budget)?.get(id);
+  if (value === void 0) throw new TypeError(`Unknown intrinsic identity: ${id}`);
+  return value;
+}
+function listIntrinsicIdentities(budget) {
+  return [...realms2.get(budget)?.keys() ?? []];
+}
+function releaseIntrinsicIdentities(budget) {
+  realms2.delete(budget);
+}
+
 // packages/safe-js/src/interp/host-capabilities.ts
 import { types as types6 } from "node:util";
 var MAX_INDEXED_LENGTH = 65536;
@@ -8077,6 +8057,9 @@ function namedKeys(state) {
   });
 }
 
+// packages/safe-js/src/interp/error-prototypes.ts
+var errorPrototypes = /* @__PURE__ */ new WeakMap();
+
 // packages/safe-js/src/interp/typed-array-prototypes.ts
 var typedArrayPrototypes = /* @__PURE__ */ new WeakMap();
 
@@ -8475,6 +8458,51 @@ function hasGuestObjectState(value) {
   );
 }
 
+// packages/safe-js/src/interp/module-namespace.ts
+var namespaces = /* @__PURE__ */ new WeakSet();
+function isSandboxModuleNamespace(value) {
+  return value !== null && typeof value === "object" && namespaces.has(value);
+}
+function createModuleNamespace(bindings) {
+  const target = /* @__PURE__ */ Object.create(null);
+  const namespace = new Proxy(target, {
+    ownKeys: (owner) => [...Object.getOwnPropertyNames(owner).sort(), ...Object.getOwnPropertySymbols(owner)],
+    set: () => false,
+    defineProperty(owner, key, descriptor) {
+      if (typeof key === "symbol") return Reflect.defineProperty(owner, key, descriptor);
+      const current = Object.getOwnPropertyDescriptor(owner, key);
+      if (current === void 0 || descriptor.configurable === true || descriptor.enumerable === false || "get" in descriptor || "set" in descriptor || descriptor.writable === false) return false;
+      return !("value" in descriptor) || Object.is(descriptor.value, current.value);
+    }
+  });
+  namespaces.add(namespace);
+  const entries = typeof bindings === "function" ? bindings(namespace) : bindings;
+  for (const key of Object.keys(entries).sort())
+    Object.defineProperty(target, key, { value: entries[key], writable: true, enumerable: true });
+  Object.defineProperty(target, Symbol.toStringTag, { value: "Module" });
+  Object.preventExtensions(target);
+  markDescriptorObject(namespace);
+  setSandboxPrototype(namespace, null);
+  return namespace;
+}
+
+// packages/safe-js/src/interp/collection-properties.ts
+var collectionGuestProperties = /* @__PURE__ */ new WeakMap();
+function getCollectionProperties(value) {
+  const properties = collectionGuestProperties.get(value);
+  if (properties === void 0) throw new TypeError("Invalid sandbox collection storage.");
+  return properties;
+}
+function copyCollectionProperties(source, target, encode) {
+  const properties = collectionGuestProperties.get(source) ?? source;
+  for (const key of Reflect.ownKeys(properties)) {
+    const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+    if (!("value" in descriptor)) throw new TypeError("Collection accessor properties cannot be copied as data.");
+    Object.defineProperty(target, key, { ...descriptor, value: encode(descriptor.value) });
+  }
+  if (!Object.isExtensible(properties)) Object.preventExtensions(target);
+}
+
 // packages/safe-js/src/interp/raw-json.ts
 var rawJsonValues = /* @__PURE__ */ new WeakSet();
 function createRawJson(text) {
@@ -19383,6 +19411,7 @@ function setSandboxProperty(target, property, value, budget, checkInherited = tr
     return;
   }
   const prototypeOwner = target;
+  if (isSandboxModuleNamespace(target)) throw new TypeError("Cannot assign to a module namespace.");
   if (checkInherited) {
     const descriptor2 = getSandboxPropertyDescriptor(target, property, budget);
     if (descriptor2 !== void 0 && !("value" in descriptor2))
@@ -19422,6 +19451,7 @@ function setSandboxProperty(target, property, value, budget, checkInherited = tr
       for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
         budget.visitNode();
         assertSandboxDataDepth(depth++);
+        if (isSandboxModuleNamespace(prototype)) throw new TypeError("Cannot assign through a module namespace.");
         const properties = isSandboxGenerator(prototype) ? getGeneratorProperties(prototype) : isSandboxClosure(prototype) ? prototype.properties : prototype;
         const inherited = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key);
         if (inherited === void 0) continue;
@@ -19441,6 +19471,7 @@ function setSuperProperty(base, receiver, key, value, context) {
   for (let current = base; current !== null; current = getSandboxPrototype(current, budget)) {
     budget.visitNode();
     assertSandboxDataDepth(depth++);
+    if (isSandboxModuleNamespace(current)) throw new TypeError("Cannot assign through a module namespace.");
     const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxClosure(current) ? current.properties : current;
     const descriptor = properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key);
     if (descriptor === void 0) continue;
@@ -21879,6 +21910,8 @@ function serializeCollectionProperties(value, encode, dataOnly = false) {
 
 // packages/safe-js/src/snapshot/guest-heap.ts
 function captureGuestHeapNode(value, encode) {
+  if (isSandboxModuleNamespace(value))
+    return { kind: "module-namespace", entries: Object.keys(value).map((key) => [key, encode(value[key])]) };
   if (isRawJson(value)) return { kind: "raw-json", text: value.rawJSON };
   const intrinsic = getIntrinsicIdentity(value);
   if (intrinsic !== void 0) {
@@ -22896,7 +22929,7 @@ function encodeReplayData(value, options = {}) {
       const id2 = options.identifyPromise?.(entry, path);
       if (typeof id2 === "string" && id2.length > 0) return { tag: "promise-capability", id: id2 };
     }
-    if (typeof entry === "object" && entry !== null && hasGuestObjectState(entry)) {
+    if (typeof entry === "object" && entry !== null && hasGuestObjectState(entry) && !isSandboxModuleNamespace(entry)) {
       throw new MissingReplayCapabilityError("Guest function properties and prototype links cannot be serialized.");
     }
     let capabilityId;
@@ -22917,7 +22950,9 @@ function encodeReplayData(value, options = {}) {
     seen.set(entry, id);
     nodes.push(void 0);
     const child = (value2, key) => encode(value2, depth + 1, [...path, key]);
-    if (isSandboxClosure(entry)) {
+    if (isSandboxModuleNamespace(entry)) {
+      nodes[id] = { kind: "module-namespace", entries: Object.keys(entry).map((key) => [key, child(entry[key], key)]) };
+    } else if (isSandboxClosure(entry)) {
       nodes[id] = {
         kind: "capability",
         id: capabilityId,
@@ -23126,6 +23161,20 @@ function decodeReplayData(input, options = {}, parent) {
         throw new TypeError("Invalid replay error metadata.");
       }
       const child = (value) => decode(value, depth + 1);
+      if (kind === "module-namespace") {
+        const entries = list(own(node, "entries"));
+        const names = /* @__PURE__ */ new Set();
+        return createModuleNamespace((namespace) => {
+          restored.set(id, namespace);
+          return Object.fromEntries(entries.map((raw) => {
+            const entry2 = list(raw);
+            if (entry2.length !== 2 || typeof entry2[0] !== "string" || names.has(entry2[0]))
+              throw new TypeError("Invalid module namespace export.");
+            names.add(entry2[0]);
+            return [entry2[0], child(entry2[1])];
+          }));
+        });
+      }
       if (kind === "symbol") {
         if (node.description !== void 0 && typeof node.description !== "string") throw new TypeError("Invalid replay symbol description.");
         let symbol;
@@ -26629,6 +26678,7 @@ function createReflectGlobal(budget) {
       for (let current = target; current !== null; current = getSandboxPrototype(current, budget)) {
         budget.visitNode();
         assertSandboxDataDepth(depth++);
+        if (isSandboxModuleNamespace(current)) return false;
         if (isNumericTypedArray(current) && typeof property === "string" && isTypedArrayIndex(property)) {
           if (current === receiver) {
             await setTypedArrayMember(current, property, value, budget, context);
@@ -26773,6 +26823,19 @@ function absent(value) {
 }
 function validateGuestHeapNode(raw, heap, maxArrayLength = 4294967295) {
   const node = record3(raw);
+  if (node.kind === "module-namespace") {
+    fields(node, ["kind", "entries"]);
+    const entries = array(node.entries);
+    if (entries.length > maxArrayLength) throw new TypeError("Module namespace exceeds allocation limit.");
+    const names = /* @__PURE__ */ new Set();
+    for (const rawEntry of entries) {
+      const entry = array(rawEntry);
+      if (entry.length !== 2 || typeof entry[0] !== "string" || names.has(entry[0]))
+        throw new TypeError("Invalid module namespace export.");
+      names.add(entry[0]);
+    }
+    return true;
+  }
   if (node.kind === "raw-json") {
     fields(node, ["kind", "text"]);
     if (typeof node.text !== "string") throw new TypeError("Invalid raw JSON source.");
@@ -28643,7 +28706,7 @@ var structuredCloneErrorNames = ["Error", "EvalError", "RangeError", "ReferenceE
 function* cloneStructuredGraph(value, state, budget, depth = 0) {
   assertSandboxDataDepth(depth);
   budget.visitNode();
-  if (typeof value === "symbol" || isSandboxClosure(value) || isSandboxPromise(value) || isSandboxGenerator(value) || isSandboxCollectionIterator(value) || isSandboxRegExpIterator(value) || isSandboxArrayIterator(value) || isSandboxArguments(value))
+  if (typeof value === "symbol" || isSandboxModuleNamespace(value) || isSandboxClosure(value) || isSandboxPromise(value) || isSandboxGenerator(value) || isSandboxCollectionIterator(value) || isSandboxRegExpIterator(value) || isSandboxArrayIterator(value) || isSandboxArguments(value))
     throw new DOMException("Value cannot be structured cloned.", "DataCloneError");
   if (typeof value !== "object" || value === null) return allocateProducedSandboxValue(value, budget);
   if (isLiveCapability(value)) throw new DOMException("Capabilities cannot be structured cloned.", "DataCloneError");
@@ -28747,8 +28810,8 @@ function measureSandboxData(values, options = {}) {
     usage += 1;
     if (!isGuestHostObject(value)) {
       const symbols = Object.getOwnPropertySymbols(value);
-      const descriptors3 = symbols.length === 0 ? [] : symbols.filter((key) => !internalSymbols.has(key)).map((key) => [key, Object.getOwnPropertyDescriptor(value, key)]);
-      for (const [key, descriptor] of descriptors3) {
+      const descriptors2 = symbols.length === 0 ? [] : symbols.filter((key) => !internalSymbols.has(key)).map((key) => [key, Object.getOwnPropertyDescriptor(value, key)]);
+      for (const [key, descriptor] of descriptors2) {
         usage += 1;
         visit(key, depth + 1);
         if ("value" in descriptor) visit(descriptor.value, depth + 1);
@@ -28792,13 +28855,13 @@ function measureSandboxData(values, options = {}) {
     if (Array.isArray(value)) {
       usage += value.length;
       if (hasManagedDescriptors(value)) {
-        const descriptors3 = [];
+        const descriptors2 = [];
         for (const key of Object.getOwnPropertyNames(value)) {
           if (key === "length") continue;
           const descriptor = Object.getOwnPropertyDescriptor(value, key);
-          if (descriptor !== void 0) descriptors3.push([key, descriptor]);
+          if (descriptor !== void 0) descriptors2.push([key, descriptor]);
         }
-        for (const [key, descriptor] of descriptors3) {
+        for (const [key, descriptor] of descriptors2) {
           usage += key.length + 1;
           if ("value" in descriptor) visit(descriptor.value, depth + 1);
           else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
@@ -28865,13 +28928,13 @@ function measureSandboxData(values, options = {}) {
         } else visit(value.properties, depth + 1);
       }
       if (!options.ignoreClosureCaptures)
-        for (const retained of value[sandboxRetainedValues]?.() ?? []) visit(retained, depth + 1);
+        for (const retained2 of value[sandboxRetainedValues]?.() ?? []) visit(retained2, depth + 1);
       return;
     }
     if (isSandboxGenerator(value)) {
-      const descriptors3 = Object.getOwnPropertyDescriptors(getGeneratorProperties(value));
-      for (const key of Reflect.ownKeys(descriptors3)) {
-        const descriptor = descriptors3[key];
+      const descriptors2 = Object.getOwnPropertyDescriptors(getGeneratorProperties(value));
+      for (const key of Reflect.ownKeys(descriptors2)) {
+        const descriptor = descriptors2[key];
         usage += typeof key === "string" ? key.length + 1 : 1;
         if (typeof key === "symbol") visit(key, depth + 1);
         if ("value" in descriptor) visit(descriptor.value, depth + 1);
@@ -28912,27 +28975,30 @@ function measureSandboxData(values, options = {}) {
       const entries = [];
       for (const key of Object.getOwnPropertyNames(value)) {
         const descriptor = Object.getOwnPropertyDescriptor(value, key);
-        const retained = "value" in descriptor ? [descriptor.value] : retainedAccessorClosures(descriptor);
-        if (retained.length > 0) entries.push([key, retained]);
+        const retained2 = "value" in descriptor ? [descriptor.value] : retainedAccessorClosures(descriptor);
+        if (retained2.length > 0) entries.push([key, retained2]);
       }
-      for (const [key, retained] of entries) {
+      for (const [key, retained2] of entries) {
         usage += 1 + key.length;
-        for (const entry of retained) visit(entry, depth + 1);
+        for (const entry of retained2) visit(entry, depth + 1);
       }
       return;
     }
-    const descriptors2 = [];
-    for (const key of Object.getOwnPropertyNames(value)) {
-      const descriptor = Object.getOwnPropertyDescriptor(value, key);
-      if (descriptor !== void 0) descriptors2.push([key, descriptor]);
-    }
+    const proxyKeys = nodeTypes.isProxy(value) ? Object.getOwnPropertyNames(value) : void 0;
+    const proxyDescriptors = proxyKeys?.map((key) => Object.getOwnPropertyDescriptor(value, key));
     const includeNonEnumerable = isSandboxDate(value) || isSandboxArrayBuffer(value) || isSandboxDataView(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
-    for (const [key, descriptor] of descriptors2) {
+    const keys = proxyKeys ?? (includeNonEnumerable ? Object.getOwnPropertyNames(value) : Object.keys(value));
+    const retained = [];
+    for (let index = 0; index < keys.length; index++) {
+      const key = keys[index];
+      const descriptor = proxyDescriptors === void 0 ? Object.getOwnPropertyDescriptor(value, key) : proxyDescriptors[index];
+      if (descriptor === void 0) continue;
       if (!descriptor.enumerable && !includeNonEnumerable) continue;
       usage += 1 + key.length;
-      if ("value" in descriptor) visit(descriptor.value, depth + 1);
-      else for (const closure of retainedAccessorClosures(descriptor)) visit(closure, depth + 1);
+      if ("value" in descriptor) retained.push(descriptor.value);
+      else for (const closure of retainedAccessorClosures(descriptor)) retained.push(closure);
     }
+    for (const entry of retained) visit(entry, depth + 1);
   };
   for (const value of values) visit(value);
   return usage;
@@ -28990,6 +29056,8 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
   }
   if (state.structuredClone && nodeTypes.isSymbolObject(value))
     throw new DOMException("Cannot clone a boxed symbol.", "DataCloneError");
+  if (state.structuredClone && isSandboxModuleNamespace(value))
+    throw new DOMException("Cannot clone a module namespace.", "DataCloneError");
   if (isLiveCapability(value)) throw new TypeError("Live capabilities require their owning realm bridge.");
   if (isRawJson(value)) {
     const existing = state.seen.get(value);
@@ -41804,7 +41872,7 @@ function bindImportDeclaration(declaration, registry, wrappedModules, bindings,
       declaration.source.span
     );
   }
-  const wrappedExports = wrappedModules.get(moduleName) ?? createBindingRecord(
+  const wrappedExports = wrappedModules.get(moduleName) ?? createModuleNamespace(
     wrapCancelableBindings(
       wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
         realm: options.realm,
@@ -41881,7 +41949,7 @@ function registerModuleHostOperationPolicies(registry) {
 function normalizeModuleExports(moduleExports) {
   const entries = moduleExports instanceof Map ? [...moduleExports.entries()] : Object.entries(moduleExports);
   return new Map(
-    entries.filter(([exportName]) => exportName.length > 0).sort(([left], [right]) => left.localeCompare(right))
+    entries.sort(([left], [right]) => left.localeCompare(right))
   );
 }
 function createBindingRecord(entries) {
@@ -43888,4 +43956,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-7UITTELW.js.map
+//# sourceMappingURL=chunk-RECEBNHR.js.map