poe-code 14.0.5 → 14.0.7

package/dist/index.js

@@ -7179,24 +7179,24 @@ function renderReferencedFootnotes(context) {
   return items.length === 0 ? "" : `<section class="footnotes"><ol>${items}</ol></section>`;
 }
 function createFootnoteState(children2) {
-  const definitions = /* @__PURE__ */ new Map();
+  const definitions2 = /* @__PURE__ */ new Map();
   for (const child of children2) {
-    collectFootnoteDefinitions(child, definitions);
+    collectFootnoteDefinitions(child, definitions2);
   }
   return {
-    definitions,
+    definitions: definitions2,
     labelsInOrder: [],
     numbers: /* @__PURE__ */ new Map()
   };
 }
-function collectFootnoteDefinitions(node, definitions) {
+function collectFootnoteDefinitions(node, definitions2) {
   if (node.type === "footnoteDefinition") {
-    definitions.set(node.label, node);
+    definitions2.set(node.label, node);
     return;
   }
   if ("children" in node) {
     for (const child of node.children) {
-      collectFootnoteDefinitions(child, definitions);
+      collectFootnoteDefinitions(child, definitions2);
     }
   }
 }
@@ -12159,19 +12159,19 @@ function selectedRows(state, fallback) {
   return source.filter((row) => state.selected.has(row.id));
 }
 function runtimePanes(state) {
-  const definitions = state.paneDefinitions;
+  const definitions2 = state.paneDefinitions;
   return [
     {
-      id: definitions[0]?.id ?? "list",
-      title: definitions[0]?.title ?? state.title,
+      id: definitions2[0]?.id ?? "list",
+      title: definitions2[0]?.title ?? state.title,
       rows: state.rows,
       cursor: state.cursor,
       selected: state.selected,
       filter: state.filter
     },
     {
-      id: definitions[1]?.id ?? "detail",
-      title: definitions[1]?.title ?? "Preview",
+      id: definitions2[1]?.id ?? "detail",
+      title: definitions2[1]?.title ?? "Preview",
       rows: (state.detail.items ?? []).map((item) => ({
         id: item.id,
         title: item.title ?? item.id,
@@ -49222,9 +49222,9 @@ function buildSkillGuidance(activeDefinitions, activeTools) {
   ];
   return lines.join("\n");
 }
-function normalizeDefinitions(definitions) {
+function normalizeDefinitions(definitions2) {
   const normalized = /* @__PURE__ */ new Map();
-  for (const [rawName, rawDefinition] of Object.entries(definitions)) {
+  for (const [rawName, rawDefinition] of Object.entries(definitions2)) {
     const name = rawName.trim();
     if (name.length === 0 || normalized.has(name)) {
       continue;
@@ -49259,14 +49259,14 @@ var init_poe_agent_plugin_skills = __esm({
   "packages/poe-agent/src/plugins/poe-agent-plugin-skills.ts"() {
     "use strict";
     skills = (options) => {
-      const definitions = normalizeDefinitions(options.definitions);
+      const definitions2 = normalizeDefinitions(options.definitions);
       return {
         name: "skills",
         prompt(ctx) {
           const activeSkills = normalizeStringList(
             typeof options.skills === "function" ? options.skills() : options.skills
           );
-          const activeDefinitions = activeSkills.map((skillName) => definitions.get(skillName)).filter((definition) => definition !== void 0);
+          const activeDefinitions = activeSkills.map((skillName) => definitions2.get(skillName)).filter((definition) => definition !== void 0);
           const activeTools = options.toolRegistry?.getActiveTools(activeSkills).map((tool) => tool.name) ?? [];
           const guidance = buildSkillGuidance(activeDefinitions, activeTools);
           return {
@@ -50271,8 +50271,8 @@ function assertNonNegativeInteger3(value, keyword) {
 }
 function validateSchemaObject(schema, dialect) {
   if (schema.type !== void 0) {
-    const types2 = Array.isArray(schema.type) ? schema.type : [schema.type];
-    if (types2.length === 0 || !types2.every((type) => typeof type === "string" && draftTypeSet.has(type)) || new Set(types2).size !== types2.length) {
+    const types5 = Array.isArray(schema.type) ? schema.type : [schema.type];
+    if (types5.length === 0 || !types5.every((type) => typeof type === "string" && draftTypeSet.has(type)) || new Set(types5).size !== types5.length) {
       throw new Error("type must be a JSON Schema type or a unique array of JSON Schema types.");
     }
   }
@@ -50991,9 +50991,9 @@ function evaluateValidationKeywords(node, schema, value, path193) {
   if (schema.nullable === true && value === null) {
     return results;
   }
-  const types2 = typeof schema.type === "string" ? [schema.type] : Array.isArray(schema.type) ? schema.type : [];
-  if (types2.length > 0 && !types2.some((type) => typeof type === "string" && typeMatches(type, value))) {
-    results.push(invalidResult(issue(path193, types2.join(","), value, `must be ${types2.join(",")}`)));
+  const types5 = typeof schema.type === "string" ? [schema.type] : Array.isArray(schema.type) ? schema.type : [];
+  if (types5.length > 0 && !types5.some((type) => typeof type === "string" && typeMatches(type, value))) {
+    results.push(invalidResult(issue(path193, types5.join(","), value, `must be ${types5.join(",")}`)));
     return results;
   }
   if (schema.const !== void 0 && !deepEqual(schema.const, value)) {
@@ -124460,8 +124460,9 @@ var init_parser3 = __esm({
           }
           break;
         }
-        this.expectPunctuator("(");
-        const args = this.parseArguments();
+        const optional = this.consumePunctuator("?.");
+        if (optional !== void 0) throw new DisallowedSyntaxError("new optional chain", optional.start);
+        const args = this.consumePunctuator("(") === void 0 ? [] : this.parseArguments();
         const end = this.previousToken();
         return {
           node: {
@@ -125538,6 +125539,204 @@ var init_graph_depth = __esm({
   }
 });
 
+// packages/safe-js/src/extensions.ts
+import { types } from "node:util";
+function readDataRecord(value, label) {
+  if (typeof value !== "object" || value === null || types.isProxy(value)) {
+    throw new TypeError(`${label} must be a plain data record.`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError(`${label} must be a plain data record.`);
+  }
+  const keys = Reflect.ownKeys(value);
+  if (keys.length > 4096) throw new RangeError(`${label} has too many fields.`);
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const key3 of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key3);
+    if (typeof key3 !== "string" || !("value" in descriptor)) {
+      throw new TypeError(`${label} requires string-keyed data properties, not accessors.`);
+    }
+    result[key3] = descriptor.value;
+  }
+  return result;
+}
+function readStringList(value, label) {
+  if (!Array.isArray(value) || types.isProxy(value) || value.length > 4096) {
+    throw new TypeError(`${label} must be a bounded string array.`);
+  }
+  const result = [];
+  for (let index = 0; index < value.length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (descriptor === void 0 || !("value" in descriptor) || typeof descriptor.value !== "string" || descriptor.value.length === 0) {
+      throw new TypeError(`${label} requires nonempty string data properties.`);
+    }
+    if (result.includes(descriptor.value))
+      throw new TypeError(`${label} contains a duplicate name.`);
+    result.push(descriptor.value);
+  }
+  if (Reflect.ownKeys(value).length !== result.length + 1)
+    throw new TypeError(`${label} has unexpected fields.`);
+  return Object.freeze(result);
+}
+function getExtensionSetup(extension) {
+  const setup = definitions.get(extension);
+  if (setup === void 0) throw new TypeError("Extensions must be created by defineExtension.");
+  return setup;
+}
+var definitions;
+var init_extensions = __esm({
+  "packages/safe-js/src/extensions.ts"() {
+    "use strict";
+    definitions = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// packages/safe-js/src/interp/host-capabilities.ts
+function createGuestReference(root, owner, assertActive) {
+  const reference = Object.freeze(/* @__PURE__ */ Object.create(null));
+  guestReferences.set(reference, { root, owner, assertActive });
+  return reference;
+}
+function readGuestReference(reference, owner) {
+  const state = typeof reference === "object" && reference !== null ? guestReferences.get(reference) : void 0;
+  if (state === void 0 || state.owner !== owner)
+    throw new TypeError("Foreign or invalid guest reference.");
+  state.assertActive();
+  if (state.root === void 0) throw new TypeError("Guest reference is revoked.");
+  return state.root[0];
+}
+function revokeGuestReference(reference, owner) {
+  const state = guestReferences.get(reference);
+  if (state === void 0 || state.owner !== owner) throw new TypeError("Foreign guest reference.");
+  state.root = void 0;
+}
+function createLiveHostObject(definition, controller) {
+  const input = readDataRecord(definition, "Host object definition");
+  if (Object.keys(input).some((key3) => key3 !== "properties" && key3 !== "methods"))
+    throw new TypeError("Unknown host object definition field.");
+  const properties = /* @__PURE__ */ new Map();
+  for (const [name, inputProperty] of Object.entries(
+    readDataRecord(input.properties ?? {}, "Host properties")
+  )) {
+    const property = readDataRecord(inputProperty, `Host property '${name}'`);
+    if (Object.keys(property).some((key3) => key3 !== "get" && key3 !== "set"))
+      throw new TypeError("Unknown host property field.");
+    if (property.get !== void 0 && typeof property.get !== "function" || property.set !== void 0 && typeof property.set !== "function")
+      throw new TypeError("Host property operations must be functions.");
+    properties.set(name, property);
+  }
+  const operations = readDataRecord(input.methods ?? {}, "Host methods");
+  for (const [name, operation] of Object.entries(operations)) {
+    if (typeof operation !== "function") throw new TypeError("Host methods must be functions.");
+    if (properties.has(name)) throw new TypeError(`Conflicting host member '${name}'.`);
+  }
+  for (const name of [...properties.keys(), ...Object.keys(operations)]) {
+    if (["constructor", "prototype", "__proto__"].includes(name))
+      throw new TypeError(`Reserved host member '${name}'.`);
+  }
+  controller.assertActive();
+  controller.chargeWork(properties.size + Object.keys(operations).length + 1);
+  const host = Object.freeze(/* @__PURE__ */ Object.create(null));
+  const guest = Object.freeze(/* @__PURE__ */ Object.create(null));
+  const methods = new Map(
+    Object.entries(operations).map(([name, operation]) => [
+      name,
+      controller.method(operation)
+    ])
+  );
+  const state = { host, guest, controller, properties, methods };
+  hostObjects.set(host, state);
+  guestObjects.set(guest, state);
+  return host;
+}
+function isGuestHostObject(value) {
+  return typeof value === "object" && value !== null && guestObjects.has(value);
+}
+function isLiveCapability(value) {
+  return (typeof value === "object" && value !== null || typeof value === "function") && (hostObjects.has(value) || guestObjects.has(value) || guestCallbacks.has(value) || guestReferences.has(value));
+}
+function importHostCapability(value, owner) {
+  if (guestReferences.has(value)) return readGuestReference(value, owner);
+  const object = hostObjects.get(value);
+  if (object !== void 0) {
+    if (object.controller.owner !== owner) throw new TypeError("Foreign realm host capability.");
+    object.controller.assertActive();
+    return object.guest;
+  }
+  const callback = guestCallbacks.get(value);
+  if (callback !== void 0) {
+    if (callback.owner !== owner) throw new TypeError("Foreign realm guest callback.");
+    callback.assertActive();
+    if (callback.closure === void 0) throw new TypeError("Guest callback is revoked.");
+    return callback.closure;
+  }
+  throw new TypeError("Unsupported live capability conversion.");
+}
+function exportHostCapability(value, owner) {
+  const state = guestObjects.get(value);
+  if (state === void 0 || state.controller.owner !== owner)
+    throw new TypeError("Foreign realm host capability.");
+  state.controller.assertActive();
+  return state.host;
+}
+function registerGuestCallback(callback, state) {
+  guestCallbacks.set(callback, state);
+}
+function readGuestCallback(callback, owner) {
+  const state = typeof callback === "function" ? guestCallbacks.get(callback) : void 0;
+  if (state === void 0 || state.owner !== owner)
+    throw new TypeError("Foreign or invalid guest callback.");
+  state.assertActive();
+  if (state.closure === void 0) throw new TypeError("Guest callback is revoked.");
+  return state.closure;
+}
+function revokeGuestCallback(callback, owner) {
+  const state = guestCallbacks.get(callback);
+  if (state === void 0 || state.owner !== owner) throw new TypeError("Foreign guest callback.");
+  state.closure = void 0;
+}
+function revokeHostObject(value, owner) {
+  const state = hostObjects.get(value);
+  if (state === void 0 || state.controller.owner !== owner)
+    throw new TypeError("Foreign host object.");
+  state.properties.clear();
+  state.methods.clear();
+}
+function getHostObjectMember(value, key3) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  state.controller.chargeWork();
+  const property = state.properties.get(key3);
+  if (property !== void 0)
+    return property.get === void 0 ? void 0 : state.controller.read(property.get);
+  return state.methods.get(key3);
+}
+function setHostObjectMember(value, key3, entry) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  state.controller.chargeWork();
+  const property = state.properties.get(key3);
+  if (property?.set === void 0) throw new TypeError(`Host property '${key3}' is not writable.`);
+  state.controller.write(property.set, entry);
+}
+function getHostObjectKeys(value) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  return [...state.properties.keys(), ...state.methods.keys()];
+}
+var hostObjects, guestObjects, guestCallbacks, guestReferences;
+var init_host_capabilities = __esm({
+  "packages/safe-js/src/interp/host-capabilities.ts"() {
+    "use strict";
+    init_extensions();
+    hostObjects = /* @__PURE__ */ new WeakMap();
+    guestObjects = /* @__PURE__ */ new WeakMap();
+    guestCallbacks = /* @__PURE__ */ new WeakMap();
+    guestReferences = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // packages/safe-js/src/observability/otel.ts
 function bindOtelSpan(value, span) {
   spanByAsyncValue.set(value, span);
@@ -125631,6 +125830,134 @@ var init_otel2 = __esm({
   }
 });
 
+// packages/safe-js/src/interp/date.ts
+import { types as types2 } from "node:util";
+function isSandboxDate(value) {
+  return typeof value === "object" && value !== null && dates.has(value);
+}
+function createSandboxDate(time) {
+  const value = new NativeDate(time);
+  dates.add(value);
+  return Object.freeze(value);
+}
+function dateTime(value) {
+  return Reflect.apply(readTime, value, []);
+}
+function copyNativeDate(value) {
+  if (!types2.isDate(value)) return void 0;
+  if (Object.getPrototypeOf(value) !== NativeDate.prototype || Reflect.ownKeys(value).length > 0)
+    throw new TypeError("Date subclasses and own properties are not supported.");
+  return createSandboxDate(dateTime(value));
+}
+function exportDate(value) {
+  return new NativeDate(dateTime(value));
+}
+function dateNumber(value) {
+  if (isSandboxDate(value)) return dateTime(value);
+  if (typeof value === "object" && value !== null || typeof value === "function" || typeof value === "symbol" || typeof value === "bigint")
+    throw new TypeError("Date arguments require primitive values; custom coercion is unsupported.");
+  return Number(value);
+}
+function parseDate2(value, budget) {
+  if (typeof value === "object" && value !== null || typeof value === "function")
+    throw new TypeError("Date parsing requires a primitive value.");
+  const text5 = String(value);
+  if (text5.length > 4096) throw new RangeError("Date input exceeds the 4096 character limit.");
+  budget.allocateString(text5);
+  for (let index = 0; index < text5.length; index++) budget.visitNode();
+  return NativeDate.parse(text5);
+}
+function dateFromParts(args, utc) {
+  const parts = args.slice(0, 7).map(dateNumber);
+  return utc ? Reflect.apply(NativeDate.UTC, NativeDate, parts) : dateTime(Reflect.construct(NativeDate, parts));
+}
+function dateString(value) {
+  return dateMethods.get("toString").invoke(value, []);
+}
+function restoreDateTime(value) {
+  if (value !== null && (typeof value !== "number" || !Number.isInteger(value) || Math.abs(value) > 864e13 || Object.is(value, -0)))
+    throw new TypeError("Invalid serialized Date epoch.");
+  const date = createSandboxDate(0);
+  Reflect.apply(writeTime, date, [value === null ? NaN : value]);
+  return date;
+}
+function serializedDateTime(value) {
+  const time = dateTime(value);
+  return Number.isNaN(time) ? null : time;
+}
+var NativeDate, readTime, writeTime, dates, methodNames, dateMethods;
+var init_date = __esm({
+  "packages/safe-js/src/interp/date.ts"() {
+    "use strict";
+    NativeDate = Date;
+    readTime = NativeDate.prototype.getTime;
+    writeTime = NativeDate.prototype.setTime;
+    dates = /* @__PURE__ */ new WeakSet();
+    methodNames = [
+      "getTime",
+      "valueOf",
+      "getDate",
+      "getDay",
+      "getFullYear",
+      "getHours",
+      "getMilliseconds",
+      "getMinutes",
+      "getMonth",
+      "getSeconds",
+      "getTimezoneOffset",
+      "getUTCDate",
+      "getUTCDay",
+      "getUTCFullYear",
+      "getUTCHours",
+      "getUTCMilliseconds",
+      "getUTCMinutes",
+      "getUTCMonth",
+      "getUTCSeconds",
+      "setTime",
+      "setDate",
+      "setFullYear",
+      "setHours",
+      "setMilliseconds",
+      "setMinutes",
+      "setMonth",
+      "setSeconds",
+      "setUTCDate",
+      "setUTCFullYear",
+      "setUTCHours",
+      "setUTCMilliseconds",
+      "setUTCMinutes",
+      "setUTCMonth",
+      "setUTCSeconds",
+      "toDateString",
+      "toISOString",
+      "toString",
+      "toTimeString",
+      "toUTCString",
+      "toJSON"
+    ];
+    dateMethods = new Map(
+      methodNames.map((name) => {
+        const native = NativeDate.prototype[name];
+        return [
+          name,
+          {
+            length: native.length,
+            invoke: (date, args) => {
+              if (name === "toJSON")
+                return Number.isNaN(dateTime(date)) ? null : Reflect.apply(NativeDate.prototype.toISOString, date, []);
+              return Reflect.apply(
+                native,
+                date,
+                name.startsWith("set") ? args.slice(0, native.length).map(dateNumber) : []
+              );
+            }
+          }
+        ];
+      })
+    );
+  }
+});
+
 // packages/safe-js/src/interp/float32.ts
 function isFloat32Array(value) {
   return ArrayBuffer.isView(value) && Object.getPrototypeOf(value) === Float32Array.prototype && Reflect.apply(readTag, value, []) === "Float32Array";
@@ -126301,6 +126628,8 @@ function encodeReplayData(value, options = {}) {
         id: capabilityId,
         properties: child(entry.properties, "properties")
       };
+    } else if (isSandboxDate(entry)) {
+      nodes[id] = { kind: "date", time: serializedDateTime(entry) };
     } else if (isFloat32Array(entry)) {
       const storage2 = encodeFloat32Storage(entry, id, float32Buffers, (id2) => ({
         tag: "ref",
@@ -126451,6 +126780,12 @@ function decodeReplayData(input, options = {}, parent) {
         options.onCapabilityRestored?.(capability, copy);
         return copy;
       }
+      if (kind === "date") {
+        if (Object.keys(node).length !== 2) throw new TypeError("Invalid serialized Date fields.");
+        const result3 = restoreDateTime(own(node, "time"));
+        restored.set(id, result3);
+        return result3;
+      }
       if (kind === "float32array") {
         if (typeof node.extensible !== "boolean")
           throw new TypeError("Invalid Float32Array extensibility.");
@@ -126562,6 +126897,7 @@ var init_replay_data = __esm({
     init_compile_guard();
     init_float32();
     init_float32array();
+    init_date();
     init_shape();
     init_values();
     init_arguments2();
@@ -126791,6 +127127,8 @@ function normalize2(value, seen) {
   if (seen.has(value)) throw new TypeError("Host call arguments cannot contain cycles.");
   seen.add(value);
   try {
+    const date = copyNativeDate(value);
+    if (date !== void 0) return Object.assign(/* @__PURE__ */ Object.create(null), { $type: "date", time: serializedDateTime(date) });
     if (isFloat32Array(value)) {
       const storage2 = float32Storage(value);
       const properties = /* @__PURE__ */ Object.create(null);
@@ -126839,6 +127177,7 @@ var init_host_call = __esm({
   "packages/safe-js/src/interp/host-call.ts"() {
     "use strict";
     init_float32();
+    init_date();
     init_values();
     init_compile_guard();
     init_replay_data();
@@ -128921,6 +129260,7 @@ function createSandboxClosure(input) {
   return Object.freeze(closure);
 }
 function ownEnumerableSandboxEntries(value) {
+  if (isGuestHostObject(value)) return getHostObjectKeys(value).map((key3) => [key3, getHostObjectMember(value, key3)]);
   if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
   if (isGuestClosure(value)) return Object.entries(value.properties ?? {});
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value)) return [];
@@ -129073,6 +129413,14 @@ function measureSandboxData(values, options = {}) {
     assertSandboxDataDepth(depth);
     seen.add(value);
     usage += 1;
+    if (isSandboxDate(value)) {
+      usage += 8;
+      return;
+    }
+    if (isGuestHostObject(value)) {
+      for (const key3 of getHostObjectKeys(value)) usage += key3.length + 1;
+      return;
+    }
     const prototype = getSandboxPrototype(value);
     if (prototype !== null) visit(prototype, depth + 1);
     if (isFloat32Array(value)) {
@@ -129215,6 +129563,7 @@ function copyToSandbox(value, state, path193 = "<root>", cloneSandboxCollections
   if (isSandboxPrimitive(value)) {
     return value;
   }
+  if (isLiveCapability(value)) throw new TypeError("Live capabilities require their owning realm bridge.");
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxRegex(value) || isSandboxPromise(value)) {
     return value;
   }
@@ -129262,6 +129611,13 @@ function copyToSandbox(value, state, path193 = "<root>", cloneSandboxCollections
     }
     return sandboxPromise;
   }
+  if (nodeTypes.isDate(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = copyNativeDate(value);
+    state.seen.set(value, copy);
+    return copy;
+  }
   if (isFloat32Array(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -129378,6 +129734,10 @@ function copyFromSandbox(value, state, path193 = "<root>", options, depth = 0) {
   if (isSandboxPrimitive(value)) {
     return value;
   }
+  if (isGuestHostObject(value)) {
+    if (options.unwrapHostObject === void 0) throw new TypeError("Live capabilities require their owning realm bridge.");
+    return options.unwrapHostObject(value);
+  }
   if (nodeTypes.isProxy(value)) throw new TypeError("Unsupported proxy sandbox value.");
   if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
@@ -129417,6 +129777,13 @@ function copyFromSandbox(value, state, path193 = "<root>", options, depth = 0) {
     if (!Object.isExtensible(value)) Object.preventExtensions(copy);
     return copy;
   }
+  if (isSandboxDate(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = exportDate(value);
+    state.seen.set(value, copy);
+    return copy;
+  }
   if (isSandboxClosure(value)) {
     if (options.wrapClosure === void 0) {
       throw new TypeError(
@@ -129685,6 +130052,8 @@ var init_values = __esm({
   "packages/safe-js/src/interp/values.ts"() {
     "use strict";
     init_otel2();
+    init_date();
+    init_host_capabilities();
     init_compile_guard();
     init_float32();
     init_budget2();
@@ -129775,6 +130144,7 @@ function setSandboxPrototype(value, prototype, budget) {
   else prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+  if (isGuestHostObject(value)) return false;
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxPromise(value) || isSandboxRegex(value) || isSandboxSet(value))
     return false;
   const prototype = Object.getPrototypeOf(value);
@@ -129787,6 +130157,7 @@ function hasManagedDescriptors(value) {
   return descriptorObjects.has(value);
 }
 function hasGuestObjectState(value) {
+  if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
@@ -129797,6 +130168,7 @@ var init_object_model = __esm({
   "packages/safe-js/src/interp/object-model.ts"() {
     "use strict";
     init_graph_depth();
+    init_host_capabilities();
     init_values();
     guestClosures = /* @__PURE__ */ new WeakSet();
     functionProperties = /* @__PURE__ */ new WeakMap();
@@ -129897,7 +130269,7 @@ function serializeDumpValue(value, path193, state) {
   if (hasGuestObjectState(value)) {
     throw new TypeError("Guest function properties and prototype links cannot be serialized.");
   }
-  if (isFloat32Array(value)) return serializeHeapReference(value, path193, state);
+  if (isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path193, state);
   if (Array.isArray(value)) {
     const reference2 = serializeHeapReference(value, path193, state);
     if (reference2 !== void 0) {
@@ -129921,7 +130293,9 @@ function serializeHeapReference(value, path193, state) {
   }
   if (!state.serializedHeapIds.has(id)) {
     state.serializedHeapIds.add(id);
-    if (isFloat32Array(value)) {
+    if (isSandboxDate(value)) {
+      state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
+    } else if (isFloat32Array(value)) {
       const storage2 = encodeFloat32Storage(value, id, state.float32Buffers, (id2) => ({
         kind: "ref",
         id: id2
@@ -129978,7 +130352,7 @@ function indexHeapContainers(snapshot2) {
   const heapIds = /* @__PURE__ */ new WeakMap();
   let nextId = 1;
   for (const [value, stat35] of stats2.entries()) {
-    if (stat35.count > 1 || stat35.cyclic || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat35.count > 1 || stat35.cyclic || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -129989,7 +130363,7 @@ function collectContainerStats(value, stats2, ancestors) {
   if (value === null || typeof value !== "object") {
     return;
   }
-  if (!Array.isArray(value) && !isPlainObject10(value) && !isFloat32Array(value)) {
+  if (!Array.isArray(value) && !isPlainObject10(value) && !isFloat32Array(value) && !isSandboxDate(value)) {
     return;
   }
   let stat35 = stats2.get(value);
@@ -130060,6 +130434,7 @@ var init_dump_format = __esm({
     init_arrays();
     init_float32();
     init_float32array();
+    init_date();
     DUMP_FORMAT_VERSION = 1;
     EXECUTION_SEMANTICS = "jobs-v7";
     SKIP_VALUE = /* @__PURE__ */ Symbol("SafeJS.skip-dump-value");
@@ -130067,7 +130442,7 @@ var init_dump_format = __esm({
 });
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types } from "node:util";
+import { types as types3 } from "node:util";
 function validateSnapshotData(value) {
   validateGenericValue(value, "$", 0, {
     allowFunctions: false,
@@ -130113,6 +130488,10 @@ function validateDumpHeap(root, state) {
     addUnique2(heapIds, id, path193);
     const entry = requireRecord3(value, path193);
     validateErrorType(entry, path193);
+    if (entry.kind === "date") {
+      validateDateRecord(entry, path193);
+      continue;
+    }
     if (entry.kind === "float32array") {
       validateFloat32Storage(entry);
       requireRecord3(entry.entries, `${path193}.entries`);
@@ -130270,6 +130649,14 @@ function validateGeneratorShape(record2, path193, state) {
     }
   });
 }
+function validateDateRecord(record2, path193) {
+  if (Object.keys(record2).length !== 2) fail2("invalidValue", path193, "invalid Date fields");
+  try {
+    restoreDateTime(record2.time);
+  } catch {
+    fail2("invalidValue", `${path193}.time`, "invalid Date epoch");
+  }
+}
 function validateArrayHeap(record2, path193, state) {
   if (Object.hasOwn(record2, "items")) {
     requireArray(record2.items, `${path193}.items`, state);
@@ -130353,7 +130740,7 @@ function validateGenericValue(value, path193, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail2("invalidState", path193, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types.isProxy(value)) {
+  if (state.dataPropertiesOnly && types3.isProxy(value)) {
     fail2("invalidType", path193, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -130487,6 +130874,7 @@ var init_validation = __esm({
     init_dump_format();
     init_graph_depth();
     init_float32array();
+    init_date();
     init_object_model();
     DEFAULT_MAX_DEPTH = MAX_DATA_DEPTH;
     DEFAULT_MAX_ENTRIES = 1e5;
@@ -131385,6 +131773,7 @@ var init_known_globals = __esm({
       "AggregateError",
       "Array",
       "Boolean",
+      "Date",
       "Error",
       "Infinity",
       "isFinite",
@@ -136648,9 +137037,9 @@ var init_AS_floating_promise = __esm({
       isPromiseFactoryCall(node) {
         return this.isPromiseStaticMethodCall(node, PROMISE_FACTORIES);
       }
-      isPromiseStaticMethodCall(node, methodNames) {
+      isPromiseStaticMethodCall(node, methodNames2) {
         const member = node.callee.type === "MemberExpression" ? node.callee : void 0;
-        return member !== void 0 && !member.computed && member.object.type === "Identifier" && member.object.name === "Promise" && member.property.type === "Identifier" && methodNames.has(member.property.name);
+        return member !== void 0 && !member.computed && member.object.type === "Identifier" && member.object.name === "Promise" && member.property.type === "Identifier" && methodNames2.has(member.property.name);
       }
       isPromiseChainCall(node) {
         const member = node.callee.type === "MemberExpression" ? node.callee : void 0;
@@ -142064,180 +142453,6 @@ var init_lint4 = __esm({
   }
 });
 
-// packages/safe-js/src/interp/resources.ts
-import { AsyncLocalStorage as AsyncLocalStorage8 } from "node:async_hooks";
-async function withRunResources(signal, execute2) {
-  const controller = new AbortController();
-  const cancel2 = () => controller.abort(signal?.reason);
-  const cleanups = /* @__PURE__ */ new Set();
-  const resources = {
-    signal: controller.signal,
-    add(close) {
-      cleanups.add(close);
-    }
-  };
-  signal?.addEventListener("abort", cancel2, { once: true });
-  if (signal?.aborted) cancel2();
-  let result;
-  let failure;
-  let errors2 = [];
-  try {
-    result = await runResources.run(resources, execute2);
-  } catch (error3) {
-    failure = { reason: error3 };
-  } finally {
-    signal?.removeEventListener("abort", cancel2);
-    controller.abort(new Error("SafeJS run finished."));
-    const outcomes = await Promise.allSettled(
-      [...cleanups].map((close) => Promise.resolve().then(close))
-    );
-    errors2 = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
-  }
-  if (failure !== void 0) throw failure.reason;
-  if (errors2.length > 0) throw new AggregateError(errors2, "SafeJS resource cleanup failed.");
-  return result;
-}
-var runResources;
-var init_resources = __esm({
-  "packages/safe-js/src/interp/resources.ts"() {
-    "use strict";
-    runResources = new AsyncLocalStorage8();
-  }
-});
-
-// packages/safe-js/src/interp/globals/math.ts
-function f16round(value) {
-  const number = +value;
-  if (!Number.isFinite(number) || number === 0) {
-    return number;
-  }
-  const magnitude = Math.abs(number);
-  if (magnitude >= 65520) {
-    return number < 0 ? -Infinity : Infinity;
-  }
-  let quantum = 2 ** -24;
-  let boundary = 2 ** -13;
-  for (let exponent = -13; exponent <= 15 && magnitude >= boundary; exponent += 1) {
-    quantum *= 2;
-    boundary *= 2;
-  }
-  const scaled = magnitude / quantum;
-  const lower = Math.floor(scaled);
-  const remainder = scaled - lower;
-  const rounded = (remainder > 0.5 || remainder === 0.5 && lower % 2 !== 0 ? lower + 1 : lower) * quantum;
-  return number < 0 ? -rounded : rounded;
-}
-function createMathGlobals(options = {}) {
-  const random = options.random ?? Math.random;
-  const mathObject = {
-    E: Math.E,
-    LN2: Math.LN2,
-    LN10: Math.LN10,
-    LOG2E: Math.LOG2E,
-    LOG10E: Math.LOG10E,
-    PI: Math.PI,
-    SQRT1_2: Math.SQRT1_2,
-    SQRT2: Math.SQRT2,
-    random: createSandboxClosure({ sandbox: true, call: () => random(), name: "random" })
-  };
-  for (const [name, method] of Object.entries(mathMethods)) {
-    mathObject[name] = createSandboxClosure({
-      sandbox: true,
-      call: (args) => Reflect.apply(method, Math, args),
-      name
-    });
-  }
-  return {
-    Infinity: Infinity,
-    Math: mathObject,
-    NaN: Number.NaN
-  };
-}
-function createSeededRandom(seed) {
-  let state = normalizeSeed(seed);
-  return {
-    next: () => {
-      state = Math.imul(state, 1664525) + 1013904223 >>> 0;
-      return state / 4294967296;
-    },
-    snapshot: () => state,
-    restore: (nextState) => {
-      state = normalizeSeed(nextState);
-    }
-  };
-}
-function normalizeSeed(seed) {
-  if (!Number.isFinite(seed)) {
-    throw new TypeError("Seeded random requires a finite numeric seed.");
-  }
-  return Math.trunc(seed) >>> 0;
-}
-var mathMethods;
-var init_math = __esm({
-  "packages/safe-js/src/interp/globals/math.ts"() {
-    "use strict";
-    init_values();
-    mathMethods = {
-      abs: Math.abs,
-      acos: Math.acos,
-      acosh: Math.acosh,
-      asin: Math.asin,
-      asinh: Math.asinh,
-      atan: Math.atan,
-      atan2: Math.atan2,
-      atanh: Math.atanh,
-      ceil: Math.ceil,
-      cbrt: Math.cbrt,
-      clz32: Math.clz32,
-      cos: Math.cos,
-      cosh: Math.cosh,
-      exp: Math.exp,
-      expm1: Math.expm1,
-      floor: Math.floor,
-      f16round,
-      fround: Math.fround,
-      hypot: Math.hypot,
-      imul: Math.imul,
-      log: Math.log,
-      log1p: Math.log1p,
-      log10: Math.log10,
-      log2: Math.log2,
-      max: Math.max,
-      min: Math.min,
-      pow: Math.pow,
-      round: Math.round,
-      sign: Math.sign,
-      sin: Math.sin,
-      sinh: Math.sinh,
-      sqrt: Math.sqrt,
-      tan: Math.tan,
-      tanh: Math.tanh,
-      trunc: Math.trunc
-    };
-  }
-});
-
-// packages/safe-js/src/random.ts
-import { randomInt } from "node:crypto";
-function createReplayableRandom(options = {}) {
-  const snapshot2 = options.snapshot;
-  const saved = snapshot2?.random;
-  let initialState = options.seed;
-  if (saved !== void 0) {
-    const hasLoopState = typeof snapshot2?.loopIterations === "object" && snapshot2.loopIterations !== null && Object.keys(snapshot2.loopIterations).length > 0;
-    const replaysFromStart = snapshot2?.replay !== void 0 || Array.isArray(snapshot2?.pendingAwaits) && snapshot2.pendingAwaits.length > 0 && !hasLoopState;
-    initialState = replaysFromStart ? saved.initialState ?? saved.seed : saved.resumeState ?? saved.state;
-  }
-  const generator = createSeededRandom(initialState ?? randomInt(4294967296));
-  return { seed: saved?.seed ?? generator.snapshot(), ...generator };
-}
-var init_random = __esm({
-  "packages/safe-js/src/random.ts"() {
-    "use strict";
-    init_math();
-  }
-});
-
 // packages/safe-js/src/interp/generator.ts
 function createGeneratorChannel(body) {
   let state = "unstarted";
@@ -144706,6 +144921,110 @@ var init_float32array2 = __esm({
   }
 });
 
+// packages/safe-js/src/interp/globals/date.ts
+function createDateGlobal(options) {
+  const validateClockTime = (value) => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || Math.abs(value) > 864e13)
+      throw new TypeError("Date clock must return a finite integer epoch within the Date range.");
+    return value;
+  };
+  const readNow = declareHostOperation(
+    () => {
+      options.budget.visitNode();
+      const value = options.clock?.now === void 0 ? Date.now() : options.clock.now();
+      return validateClockTime(value);
+    },
+    "re-issue",
+    {
+      onReplay: (_args, outcome) => {
+        if (outcome.status === "fulfilled") {
+          const time = validateClockTime(outcome.value);
+          options.clock?.restore?.({ next: time + 1 });
+        }
+      }
+    }
+  );
+  const now = wrapCallerInjectedBindings({ now: readNow }, { ...options, moduleId: "<Date>" }).now;
+  const prototype = createSandboxDate(NaN);
+  const constructor = createSandboxClosure({
+    sandbox: true,
+    name: "Date",
+    length: 7,
+    call: async (_args, context) => options.budget.allocateString(
+      dateString(createSandboxDate(Number(await now.call([], context))))
+    ),
+    construct: async (args, context) => {
+      let time;
+      if (args.length === 0) time = Number(await now.call([], context));
+      else if (args.length > 1) time = dateFromParts(args, false);
+      else if (isSandboxDate(args[0])) time = dateTime(args[0]);
+      else if (typeof args[0] === "string") time = parseDate2(args[0], options.budget);
+      else time = dateNumber(args[0]);
+      options.budget.chargeDataUsage(9);
+      return createSandboxDate(time);
+    },
+    properties: {
+      now,
+      prototype,
+      parse: createSandboxClosure({
+        sandbox: true,
+        name: "parse",
+        length: 1,
+        call: ([value]) => parseDate2(value, options.budget)
+      }),
+      UTC: createSandboxClosure({
+        sandbox: true,
+        name: "UTC",
+        length: 7,
+        call: (args) => dateFromParts(args, true)
+      })
+    }
+  });
+  const methods = /* @__PURE__ */ new Map();
+  for (const [name, method] of dateMethods)
+    methods.set(
+      name,
+      createSandboxClosure({
+        sandbox: true,
+        name,
+        length: method.length,
+        call: (args, context) => {
+          const receiver = context?.thisValue;
+          if (!isSandboxDate(receiver))
+            throw new TypeError(`Date#${name} requires a Date receiver.`);
+          options.budget.visitNode();
+          const value = method.invoke(receiver, args);
+          return typeof value === "string" ? options.budget.allocateString(value) : value;
+        }
+      })
+    );
+  constructors2.add(constructor);
+  intrinsics.set(options.compileOwner ?? options.budget, { constructor, prototype, methods });
+  return constructor;
+}
+function isDateConstructor(value) {
+  return typeof value === "object" && value !== null && constructors2.has(value);
+}
+function getDateMember(property, budget, owner) {
+  const state = intrinsics.get(owner ?? budget);
+  return property === "constructor" ? state?.constructor : state?.methods.get(String(property));
+}
+function getDatePrototype(value, budget, owner) {
+  const prototype = intrinsics.get(owner ?? budget)?.prototype;
+  return prototype === value ? null : prototype ?? null;
+}
+var intrinsics, constructors2;
+var init_date2 = __esm({
+  "packages/safe-js/src/interp/globals/date.ts"() {
+    "use strict";
+    init_date();
+    init_host_bridge();
+    init_values();
+    intrinsics = /* @__PURE__ */ new WeakMap();
+    constructors2 = /* @__PURE__ */ new WeakSet();
+  }
+});
+
 // packages/safe-js/src/interp/scope.ts
 function defineSnapshotBinding(target, name, value) {
   Object.defineProperty(target, name, {
@@ -144957,9 +145276,10 @@ async function interpret(node, options = {}) {
       peakDataSize: { enumerable: false, value: 0, writable: true }
     });
     const activeLoopIterations = /* @__PURE__ */ new Map();
-    const jobs = new SandboxJobQueue();
+    const jobs = options.jobs ?? new SandboxJobQueue();
     hoistVarDeclarations(node, scope);
     const context = {
+      assertActive: options.assertActive,
       compilation,
       budget,
       callStack: [],
@@ -144982,9 +145302,9 @@ async function interpret(node, options = {}) {
     };
     const evaluation = await withCancellationSignal(
       options.signal,
-      () => jobs.run(() => evaluateNode2(node, context))
+      () => options.nested ? runAsyncPrefix(() => evaluateNode2(node, context)) : jobs.run(() => evaluateNode2(node, context))
     );
-    await jobs.drain();
+    if (!options.nested) await jobs.drain();
     const snapshot2 = scope.snapshot();
     reconcileDataBudget(
       budget,
@@ -145039,6 +145359,7 @@ async function interpret(node, options = {}) {
   }
 }
 async function evaluateNode2(node, context) {
+  context.assertActive?.();
   const replayWait = promiseReplayContext.getStore()?.beforeNode(node.nodeId);
   if (replayWait !== void 0) await suspendJob(replayWait);
   assertPromiseExecutionAllowed();
@@ -146010,6 +146331,7 @@ function forInObject(value) {
   return void 0;
 }
 function forInKeys(object, budget) {
+  if (isGuestHostObject(object)) return getHostObjectKeys(object);
   const keys = [];
   const seen = /* @__PURE__ */ new Set();
   let depth = 0;
@@ -146027,6 +146349,7 @@ function forInKeys(object, budget) {
   return keys;
 }
 function hasForInProperty(object, key3, budget) {
+  if (isGuestHostObject(object)) return getHostObjectKeys(object).includes(key3);
   let depth = 0;
   for (let current = object; current !== null; current = getSandboxPrototype(current)) {
     if (depth > 0) budget.visitNode();
@@ -146518,10 +146841,12 @@ async function evaluateMemberExpression(node, context) {
   };
 }
 function getPropertyValue(target, property, context) {
+  if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
   if (typeof target === "string") return getStringMember(target, property, context.budget);
   if (typeof target === "number") return getNumberMember(target, property, context.budget);
   if (typeof target === "boolean") return void 0;
   if (isFloat32Array(target)) return getFloat32Member(target, property, context.budget);
+  if (isSandboxDate(target)) return getDateMember(property, context.budget, context.compilation?.owner);
   if (isSandboxMap(target)) return getMapMember(target, property, createMapMethodOptions(context));
   if (isSandboxSet(target)) return getSetMember(target, property, createSetMethodOptions(context));
   if (isSandboxGenerator(target)) return getGeneratorMember(target, property, context.budget);
@@ -146758,6 +147083,9 @@ async function evaluateMemberCallExpression(node, context) {
       context
     );
   }
+  if (isSandboxDate(member.object)) {
+    return evaluateResolvedCallExpression(node, getDateMember(member.property, context.budget, context.compilation?.owner), context, member.object);
+  }
   if (isFloat32Array(member.object)) {
     return evaluateResolvedCallExpression(
       node,
@@ -147010,6 +147338,7 @@ function applyBinaryOperator(node, left, right, context) {
         return true;
       }
       if (isFloat32ArrayConstructor(right)) return isFloat32Array(left);
+      if (isDateConstructor(right)) return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
       if (isSandboxSetConstructor(right) && isSandboxSet(left)) {
         return true;
       }
@@ -147073,8 +147402,8 @@ function applyAdditionOperator(left, right, context) {
   return toNumber(leftPrimitive) + toNumber(rightPrimitive);
 }
 function compareRelational(left, right, operator) {
-  const leftPrimitive = toPrimitive(left);
-  const rightPrimitive = toPrimitive(right);
+  const leftPrimitive = isSandboxDate(left) ? dateTime(left) : toPrimitive(left);
+  const rightPrimitive = isSandboxDate(right) ? dateTime(right) : toPrimitive(right);
   if (typeof leftPrimitive === "string" && typeof rightPrimitive === "string") {
     switch (operator) {
       case "<":
@@ -147157,6 +147486,7 @@ function toPrimitive(value) {
   return toString(value);
 }
 async function toNumericPrimitive(value, context) {
+  if (isSandboxDate(value)) return dateTime(value);
   if (isPrimitiveCoercionType(getCoercionType(value))) {
     return value;
   }
@@ -147186,6 +147516,7 @@ async function toNumericPrimitive(value, context) {
   return toString(value);
 }
 function toNumber(value) {
+  if (isSandboxDate(value)) return dateTime(value);
   if (typeof value === "number") {
     return value;
   }
@@ -147204,6 +147535,7 @@ function toNumber(value) {
   return toNumber(toPrimitive(value));
 }
 function toString(value) {
+  if (isSandboxDate(value)) return dateString(value);
   if (Array.isArray(value)) {
     return value.map((entry) => entry === null || entry === void 0 ? "" : toString(entry)).join(",");
   }
@@ -147224,6 +147556,7 @@ function isPlainSandboxObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !isSandboxClosure(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isSandboxPromise(value) && !isSandboxRegex(value);
 }
 function getMemberValue(target, property, context) {
+  if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
   let current = target;
   let depth = 0;
   while (typeof current === "object" && current !== null) {
@@ -147248,6 +147581,11 @@ function getArrayMemberValue(target, property, context) {
   return getArrayMember(target, property, createArrayMethodOptions(context));
 }
 function setSandboxProperty(target, property, value, budget) {
+  if (isSandboxDate(target)) throw new TypeError("Date own properties are not supported.");
+  if (isGuestHostObject(target)) {
+    setHostObjectMember(target, String(property), value);
+    return;
+  }
   const prototypeOwner = target;
   if (isGuestClosure(target)) target = materializeFunctionProperties(target);
   if (isFloat32Array(target)) {
@@ -147292,6 +147630,7 @@ function setSandboxProperty(target, property, value, budget) {
   }
 }
 function deleteSandboxProperty(target, property) {
+  if (isGuestHostObject(target)) throw new TypeError("Live host properties cannot be deleted.");
   if (isGuestClosure(target)) target = materializeFunctionProperties(target);
   if (Array.isArray(target)) {
     assertCollectionMutable(target);
@@ -147546,6 +147885,7 @@ var init_interpreter = __esm({
   "packages/safe-js/src/interp/interpreter.ts"() {
     "use strict";
     init_promise_replay();
+    init_host_capabilities();
     init_promise_tracker();
     init_jobs4();
     init_cancel2();
@@ -147573,6 +147913,8 @@ var init_interpreter = __esm({
     init_collections();
     init_float32array2();
     init_float32();
+    init_date();
+    init_date2();
     init_values();
     init_scope();
     init_var_hoist();
@@ -147951,7 +148293,7 @@ function wrapCallerInjectedBindings(bindings, options) {
     const copied = Object.fromEntries(
       Object.entries(bindings).map(([name, value]) => [
         name,
-        typeof value === "function" ? wrapCallerInjectedFunction(name, value, { ...options, capabilityPath: [name] }, state) : copyHostValueToSandbox(
+        typeof value === "function" && !isLiveCapability(value) ? wrapCallerInjectedFunction(name, value, { ...options, capabilityPath: [name] }, state) : copyHostValueToSandbox(
           value,
           [],
           { ...options, operation: name, capabilityPath: [name] },
@@ -147972,9 +148314,10 @@ function wrapCallerInjectedFunction(name, value, options, state) {
   const bindingName = name === "default" && value.name.length > 0 ? value.name : name;
   const callable = value;
   return createSandboxClosure({
-    ...isAsyncFunction(callable) ? { async: true } : {},
+    ...isAsyncFunction(callable) && !options.realm?.awaitResult(callable) ? { async: true } : {},
     cancellationSignal: options.signal,
     call: (args, context) => {
+      options.realm?.assertActive();
       const operationLease = options.budget.acquireCompileOwner(false, options.compileOwner);
       const compilation = new CompileScope(operationLease.owner);
       try {
@@ -147990,9 +148333,10 @@ function wrapCallerInjectedFunction(name, value, options, state) {
           seen: /* @__PURE__ */ new WeakMap(),
           restored: []
         };
-        const hostArgs = deepCopyFromSandbox([...args], {
+        const copyArguments = (values) => deepCopyFromSandbox([...values], {
           compilation,
-          wrapClosure: (closure) => wrapSandboxClosureForHost(
+          unwrapHostObject: options.realm === void 0 ? void 0 : (object) => exportHostCapability(object, options.realm.owner),
+          wrapClosure: (closure) => options.realm?.wrapCallback(closure) ?? wrapSandboxClosureForHost(
             closure,
             stackFrames,
             options.budget,
@@ -148000,11 +148344,26 @@ function wrapCallerInjectedFunction(name, value, options, state) {
             callbacks
           )
         });
+        const captured = options.realm?.captureArguments(callable, args, copyArguments);
+        const hostArgs = captured?.args ?? copyArguments(args);
         const hostCalls = options.hostCalls;
         const operation = options.operation ?? bindingName;
         const moduleId = options.moduleId ?? "<bindings>";
         const policy = readHostOperationPolicy(value) ?? readRegisteredPendingHostCallPolicy(moduleId, operation) ?? "re-issue";
         if (hostCalls === void 0) {
+          if (options.realm !== void 0) {
+            let result;
+            try {
+              result = options.realm.invoke(callable, () => Reflect.apply(callable, void 0, hostArgs));
+            } catch (error3) {
+              captured.rollback();
+              throw error3;
+            }
+            if (options.realm.awaitResult(callable)) {
+              return Promise.resolve(result).then((value2) => copyHostResultToSandbox(value2, stackFrames, options));
+            }
+            return copyHostResultToSandbox(result, stackFrames, options);
+          }
           return copyHostResultToSandbox(
             invokeHostCallback(() => Reflect.apply(callable, void 0, hostArgs), options),
             stackFrames,
@@ -148542,6 +148901,10 @@ function wrapHostPromiseWithSignal(promise, signal) {
 }
 function copyHostValueToSandbox(value, stackFrames, options, state, path193) {
   const { budget } = options;
+  if (isLiveCapability(value)) {
+    if (options.realm === void 0 || options.errorData || options.hostCalls !== void 0) throw new TypeError("Live capabilities are not portable replay or error data.");
+    return importHostCapability(value, options.realm.owner);
+  }
   if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean") {
     return value;
   }
@@ -148583,6 +148946,14 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path193) {
       state
     );
   }
+  const date = copyNativeDate(value);
+  if (date !== void 0) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    budget.chargeDataUsage(9);
+    state.seen.set(value, date);
+    return date;
+  }
   if (isFloat32Array(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -148864,6 +149235,8 @@ var init_host_bridge = __esm({
   "packages/safe-js/src/interp/host-bridge.ts"() {
     "use strict";
     init_async();
+    init_date();
+    init_host_capabilities();
     init_shape();
     init_budget2();
     init_compile_guard();
@@ -149002,7 +149375,9 @@ function toJsonParseText(input) {
 }
 async function stringifyProperty(key3, holder, state, indent = "") {
   let value = getOwnDataValue(holder, key3);
-  if (isStringifyContainer(value)) {
+  if (isSandboxDate(value)) {
+    value = dateMethods.get("toJSON").invoke(value, []);
+  } else if (isStringifyContainer(value)) {
     const toJSON = getOwnDataValue(value, "toJSON");
     if (isSandboxClosure(toJSON)) {
       value = await callStringifyClosure(toJSON, [key3], value, state);
@@ -149188,12 +149563,125 @@ function defineDataProperty8(target, key3, value) {
 var init_console_json = __esm({
   "packages/safe-js/src/interp/globals/console-json.ts"() {
     "use strict";
+    init_date();
     init_compile_guard();
     init_host_bridge();
     init_values();
   }
 });
 
+// packages/safe-js/src/interp/globals/math.ts
+function f16round(value) {
+  const number = +value;
+  if (!Number.isFinite(number) || number === 0) {
+    return number;
+  }
+  const magnitude = Math.abs(number);
+  if (magnitude >= 65520) {
+    return number < 0 ? -Infinity : Infinity;
+  }
+  let quantum = 2 ** -24;
+  let boundary = 2 ** -13;
+  for (let exponent = -13; exponent <= 15 && magnitude >= boundary; exponent += 1) {
+    quantum *= 2;
+    boundary *= 2;
+  }
+  const scaled = magnitude / quantum;
+  const lower = Math.floor(scaled);
+  const remainder = scaled - lower;
+  const rounded = (remainder > 0.5 || remainder === 0.5 && lower % 2 !== 0 ? lower + 1 : lower) * quantum;
+  return number < 0 ? -rounded : rounded;
+}
+function createMathGlobals(options = {}) {
+  const random = options.random ?? Math.random;
+  const mathObject = {
+    E: Math.E,
+    LN2: Math.LN2,
+    LN10: Math.LN10,
+    LOG2E: Math.LOG2E,
+    LOG10E: Math.LOG10E,
+    PI: Math.PI,
+    SQRT1_2: Math.SQRT1_2,
+    SQRT2: Math.SQRT2,
+    random: createSandboxClosure({ sandbox: true, call: () => random(), name: "random" })
+  };
+  for (const [name, method] of Object.entries(mathMethods)) {
+    mathObject[name] = createSandboxClosure({
+      sandbox: true,
+      call: (args) => Reflect.apply(method, Math, args),
+      name
+    });
+  }
+  return {
+    Infinity: Infinity,
+    Math: mathObject,
+    NaN: Number.NaN
+  };
+}
+function createSeededRandom(seed) {
+  let state = normalizeSeed(seed);
+  return {
+    next: () => {
+      state = Math.imul(state, 1664525) + 1013904223 >>> 0;
+      return state / 4294967296;
+    },
+    snapshot: () => state,
+    restore: (nextState) => {
+      state = normalizeSeed(nextState);
+    }
+  };
+}
+function normalizeSeed(seed) {
+  if (!Number.isFinite(seed)) {
+    throw new TypeError("Seeded random requires a finite numeric seed.");
+  }
+  return Math.trunc(seed) >>> 0;
+}
+var mathMethods;
+var init_math = __esm({
+  "packages/safe-js/src/interp/globals/math.ts"() {
+    "use strict";
+    init_values();
+    mathMethods = {
+      abs: Math.abs,
+      acos: Math.acos,
+      acosh: Math.acosh,
+      asin: Math.asin,
+      asinh: Math.asinh,
+      atan: Math.atan,
+      atan2: Math.atan2,
+      atanh: Math.atanh,
+      ceil: Math.ceil,
+      cbrt: Math.cbrt,
+      clz32: Math.clz32,
+      cos: Math.cos,
+      cosh: Math.cosh,
+      exp: Math.exp,
+      expm1: Math.expm1,
+      floor: Math.floor,
+      f16round,
+      fround: Math.fround,
+      hypot: Math.hypot,
+      imul: Math.imul,
+      log: Math.log,
+      log1p: Math.log1p,
+      log10: Math.log10,
+      log2: Math.log2,
+      max: Math.max,
+      min: Math.min,
+      pow: Math.pow,
+      round: Math.round,
+      sign: Math.sign,
+      sin: Math.sin,
+      sinh: Math.sinh,
+      sqrt: Math.sqrt,
+      tan: Math.tan,
+      tanh: Math.tanh,
+      trunc: Math.trunc
+    };
+  }
+});
+
 // packages/safe-js/src/interp/globals/regex.ts
 function createRegexGlobals(owner) {
   const construct = (args, context) => {
@@ -149337,6 +149825,7 @@ async function stringifyObject2(value, budget, context, joining) {
   }
 }
 async function defaultToString(value, budget, context, joining) {
+  if (isSandboxDate(value)) return budget.allocateString(dateString(value));
   if (Array.isArray(value) || isFloat32Array(value)) {
     if (Object.hasOwn(value, "join")) {
       const join21 = ownDataValue(value, "join");
@@ -149383,6 +149872,7 @@ var init_string_coercion = __esm({
   "packages/safe-js/src/interp/string-coercion.ts"() {
     "use strict";
     init_shape();
+    init_date();
     init_float32();
     init_values();
   }
@@ -149448,6 +149938,7 @@ function createObjectArrayGlobals(options) {
       getPrototypeOf: createSandboxClosure({
         sandbox: true,
         call: ([value]) => {
+          if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
           objectProperties(value);
           return getSandboxPrototype(value);
         },
@@ -149572,7 +150063,7 @@ function createObjectArrayGlobals(options) {
     }),
     Number: createSandboxClosure({
       sandbox: true,
-      call: ([value]) => Number(value),
+      call: ([value]) => isSandboxDate(value) ? dateTime(value) : Number(value),
       name: "Number",
       properties: {
         isFinite: createSandboxClosure({
@@ -149672,6 +150163,11 @@ function assignSandboxValues(target, sources, budget) {
   return target;
 }
 function objectProperties(value, mutable = false) {
+  if (isSandboxDate(value)) {
+    if (mutable) throw new TypeError("Date own properties and prototypes are not supported.");
+    return value;
+  }
+  if (isGuestHostObject(value)) throw new TypeError("Live host object descriptors are not supported.");
   if (isGuestClosure(value)) return materializeFunctionProperties(value);
   if (isSandboxClosure(value)) {
     if (mutable) throw new TypeError("Host function properties are read only.");
@@ -149756,6 +150252,7 @@ async function collectIteratorValues(iterator) {
   }
 }
 function getOwnEnumerableKeys(value) {
+  if (isGuestHostObject(value)) return getHostObjectKeys(value);
   return ownEnumerableSandboxEntries(value).map(([key3]) => key3);
 }
 function getOwnEnumerableValues(value) {
@@ -149787,6 +150284,9 @@ function getTemplateRawParts(template2) {
 var init_object_array = __esm({
   "packages/safe-js/src/interp/globals/object-array.ts"() {
     "use strict";
+    init_date();
+    init_date2();
+    init_host_capabilities();
     init_float32();
     init_interpreter();
     init_iteration();
@@ -149796,6 +150296,78 @@ var init_object_array = __esm({
   }
 });
 
+// packages/safe-js/src/interp/globals.ts
+function createBuiltinBindings(options) {
+  return {
+    ...createConsoleJsonGlobals(options),
+    ...createCollectionGlobals(options),
+    Float32Array: createFloat32ArrayGlobal(options.budget),
+    Date: createDateGlobal(options),
+    ...createErrorGlobals(options),
+    ...createMathGlobals({ random: options.random }),
+    ...createObjectArrayGlobals(options),
+    ...createMiscGlobals(options),
+    ...createPromiseGlobals(options),
+    ...createRegexGlobals(options.compileOwner)
+  };
+}
+var init_globals = __esm({
+  "packages/safe-js/src/interp/globals.ts"() {
+    "use strict";
+    init_console_json();
+    init_collections();
+    init_float32array2();
+    init_error();
+    init_math();
+    init_regex2();
+    init_misc();
+    init_object_array();
+    init_promise();
+    init_date2();
+  }
+});
+
+// packages/safe-js/src/interp/resources.ts
+import { AsyncLocalStorage as AsyncLocalStorage8 } from "node:async_hooks";
+async function withRunResources(signal, execute2) {
+  const controller = new AbortController();
+  const cancel2 = () => controller.abort(signal?.reason);
+  const cleanups = /* @__PURE__ */ new Set();
+  const resources = {
+    signal: controller.signal,
+    add(close) {
+      cleanups.add(close);
+    }
+  };
+  signal?.addEventListener("abort", cancel2, { once: true });
+  if (signal?.aborted) cancel2();
+  let result;
+  let failure;
+  let errors2 = [];
+  try {
+    result = await runResources.run(resources, execute2);
+  } catch (error3) {
+    failure = { reason: error3 };
+  } finally {
+    signal?.removeEventListener("abort", cancel2);
+    controller.abort(new Error("SafeJS run finished."));
+    const outcomes = await Promise.allSettled(
+      [...cleanups].map((close) => Promise.resolve().then(close))
+    );
+    errors2 = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
+  }
+  if (failure !== void 0) throw failure.reason;
+  if (errors2.length > 0) throw new AggregateError(errors2, "SafeJS resource cleanup failed.");
+  return result;
+}
+var runResources;
+var init_resources = __esm({
+  "packages/safe-js/src/interp/resources.ts"() {
+    "use strict";
+    runResources = new AsyncLocalStorage8();
+  }
+});
+
 // packages/safe-js/src/modules/registry.ts
 function createUnknownModuleMessage2(moduleName, moduleNames) {
   if (moduleNames.length === 0) {
@@ -149812,7 +150384,7 @@ function createUnknownExportMessage2(moduleName, exportName, availableExports) {
 function resolveModuleImports(module, modules, options) {
   const registry = normalizeModuleRegistry(modules);
   const bindings = createBindingRecord();
-  const wrappedModules = /* @__PURE__ */ new Map();
+  const wrappedModules = options.wrappedModules ?? /* @__PURE__ */ new Map();
   for (const statement of module.body) {
     if (statement.type !== "ImportDeclaration") {
       continue;
@@ -149834,6 +150406,7 @@ function bindImportDeclaration(declaration, registry, wrappedModules, bindings,
   const wrappedExports = wrappedModules.get(moduleName) ?? createBindingRecord(
     wrapCancelableBindings(
       wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
+        realm: options.realm,
         budget: options.budget,
         compileOwner: options.compileOwner,
         hostCalls: options.hostCalls,
@@ -149923,6 +150496,809 @@ var init_registry7 = __esm({
   }
 });
 
+// packages/safe-js/src/random.ts
+import { randomInt } from "node:crypto";
+function createReplayableRandom(options = {}) {
+  const snapshot2 = options.snapshot;
+  const saved = snapshot2?.random;
+  let initialState = options.seed;
+  if (saved !== void 0) {
+    const hasLoopState = typeof snapshot2?.loopIterations === "object" && snapshot2.loopIterations !== null && Object.keys(snapshot2.loopIterations).length > 0;
+    const replaysFromStart = snapshot2?.replay !== void 0 || Array.isArray(snapshot2?.pendingAwaits) && snapshot2.pendingAwaits.length > 0 && !hasLoopState;
+    initialState = replaysFromStart ? saved.initialState ?? saved.seed : saved.resumeState ?? saved.state;
+  }
+  const generator = createSeededRandom(initialState ?? randomInt(4294967296));
+  return { seed: saved?.seed ?? generator.snapshot(), ...generator };
+}
+var init_random = __esm({
+  "packages/safe-js/src/random.ts"() {
+    "use strict";
+    init_math();
+  }
+});
+
+// packages/safe-js/src/realm.ts
+import { AsyncLocalStorage as AsyncLocalStorage9 } from "node:async_hooks";
+import { types as types4 } from "node:util";
+function readModules(input) {
+  const entries = (value, label) => {
+    if (types4.isMap(value) && !types4.isProxy(value)) {
+      const result = [...Map.prototype.entries.call(value)];
+      if (result.length > 4096 || result.some(([key3]) => typeof key3 !== "string" || key3.length === 0))
+        throw new TypeError(`${label} requires bounded string keys.`);
+      return result;
+    }
+    return Object.entries(readDataRecord(value, label));
+  };
+  const modules = /* @__PURE__ */ Object.create(null);
+  for (const [name, exports] of entries(input ?? {}, "Module registry")) {
+    const exported = /* @__PURE__ */ Object.create(null);
+    for (const [key3, value] of entries(exports, "Module exports"))
+      exported[key3] = value;
+    modules[name] = exported;
+  }
+  return modules;
+}
+function assertNames(actual, expected, label) {
+  if (actual.length !== expected.length || actual.some((name) => !expected.includes(name)))
+    throw new TypeError(`Extension ${label} names do not match its manifest.`);
+}
+async function runWithExtensions(source, options) {
+  if (options.snapshot !== void 0 || options.snapshotBackend !== void 0 || options.snapshotPath !== void 0 || options.entryPointArgs !== void 0)
+    throw new TypeError(
+      "Live extension runs do not support snapshots or entryPointArgs; use a persistent realm."
+    );
+  const state = new RealmState(readRealmOptions(options, true));
+  try {
+    const result = await state.perform(() => state.evaluateRaw(source, options.filename));
+    if (result.ok) encodeReplayData(result.returnValue);
+    return {
+      ...result,
+      snapshot: {
+        version: 1,
+        sourceHash: hashSource(source),
+        bindings: {},
+        replayError: "Live realm state cannot be serialized or replayed."
+      }
+    };
+  } catch (error3) {
+    if (state.disposal === void 0) {
+      try {
+        await state.close();
+      } catch (cleanupError) {
+        throw new AggregateError([error3, cleanupError], "Realm execution and cleanup failed.");
+      }
+    }
+    throw error3;
+  } finally {
+    if (state.disposal === void 0) await state.close();
+  }
+}
+function readRealmOptions(value, oneShot = false) {
+  const options = readDataRecord(value, "Realm options");
+  const supported = /* @__PURE__ */ new Set([
+    "bindings",
+    "modules",
+    "extensions",
+    "grants",
+    "budget",
+    "signal",
+    "sink",
+    "randomSeed",
+    "clock",
+    "limits"
+  ]);
+  for (const [key3, entry] of Object.entries(options)) {
+    if (supported.has(key3) || oneShot && (key3 === "filename" || entry === void 0)) continue;
+    throw new TypeError(`Unsupported ${oneShot ? "extension-run" : "realm"} option '${key3}'.`);
+  }
+  return options;
+}
+var RealmState;
+var init_realm = __esm({
+  "packages/safe-js/src/realm.ts"() {
+    "use strict";
+    init_budget2();
+    init_compile_guard();
+    init_globals();
+    init_interpreter();
+    init_jobs4();
+    init_cancel2();
+    init_running_state();
+    init_resources();
+    init_promise_tracker();
+    init_host_bridge();
+    init_host_capabilities();
+    init_values();
+    init_extensions();
+    init_registry7();
+    init_parser3();
+    init_random();
+    init_hash();
+    init_shape();
+    init_replay_data();
+    RealmState = class {
+      constructor(options) {
+        this.options = options;
+        const limitInput = readDataRecord(options.limits ?? {}, "Realm limits");
+        this.limits = {
+          extensions: 32,
+          hostObjects: 1024,
+          callbacks: 1024,
+          guestReferences: 1024,
+          cleanups: 1024,
+          nestedEvaluations: 16
+        };
+        for (const [name, value] of Object.entries(limitInput)) {
+          if (!Object.hasOwn(this.limits, name) || !Number.isSafeInteger(value) || Number(value) < 1)
+            throw new TypeError("Realm limits must be positive safe integers with supported names.");
+          this.limits[name] = Number(value);
+        }
+        if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types4.isProxy(options.extensions)))
+          throw new TypeError("Extensions must be a registration array.");
+        const registrations = options.extensions ?? [];
+        const extensions = [];
+        if (registrations.length > this.limits.extensions)
+          throw new RangeError("Realm extension limit exceeded.");
+        for (let index = 0; index < registrations.length; index++) {
+          const descriptor = Object.getOwnPropertyDescriptor(registrations, String(index));
+          if (descriptor === void 0 || !("value" in descriptor))
+            throw new TypeError("Extension registrations require data properties, not accessors.");
+          extensions.push(descriptor.value);
+        }
+        if (Reflect.ownKeys(registrations).length !== extensions.length + 1)
+          throw new TypeError("Extension registrations have unsupported fields.");
+        this.extensions = Object.freeze(extensions);
+        if (this.extensions.length > this.limits.extensions)
+          throw new RangeError("Realm extension limit exceeded.");
+        this.globals = readDataRecord(options.bindings ?? {}, "Realm bindings");
+        this.modules = readModules(options.modules);
+        const grants = new Set(readStringList(options.grants ?? [], "Realm grants"));
+        for (const extension of this.extensions) getExtensionSetup(extension);
+        this.budget = options.budget ?? new Budget({ maxCallDepth: 1e3 });
+        this.lease = this.budget.acquireCompileOwner(true);
+        this.compilation = new CompileScope(this.lease.owner);
+        this.bridge = {
+          owner: this,
+          assertActive: this.assertOpen,
+          wrapCallback: this.wrapCallback,
+          captureArguments: this.captureArguments,
+          invoke: this.invokeHost,
+          awaitResult: (operation) => this.nestedOperations.has(operation)
+        };
+        try {
+          this.builtinBindings = createBuiltinBindings({
+            budget: this.budget,
+            compileOwner: this.lease.owner,
+            sink: options.sink,
+            clock: options.clock,
+            random: createReplayableRandom({ seed: options.randomSeed }).next
+          });
+          const names = /* @__PURE__ */ new Set();
+          const globals = /* @__PURE__ */ new Set([...Object.keys(this.builtinBindings), ...Object.keys(this.globals)]);
+          const modules = new Map(
+            Object.entries(this.modules).map(([name, exports]) => [name, new Set(Object.keys(exports))])
+          );
+          for (const extension of this.extensions) {
+            const manifest = extension.manifest;
+            if (names.has(manifest.name))
+              throw new TypeError(`Duplicate extension '${manifest.name}'.`);
+            names.add(manifest.name);
+            for (const capability of manifest.capabilities ?? []) {
+              if (!grants.has(capability))
+                throw new TypeError(`Missing grant '${capability}' for extension '${manifest.name}'.`);
+            }
+            for (const name of manifest.globals ?? []) {
+              if (globals.has(name)) throw new TypeError(`Conflicting global '${name}'.`);
+              globals.add(name);
+            }
+            for (const [name, exports] of Object.entries(manifest.modules ?? {})) {
+              const occupied = modules.get(name) ?? /* @__PURE__ */ new Set();
+              for (const key3 of exports) {
+                if (occupied.has(key3)) throw new TypeError(`Conflicting export '${name}.${key3}'.`);
+                occupied.add(key3);
+              }
+              modules.set(name, occupied);
+            }
+          }
+          options.signal?.addEventListener("abort", this.abort, { once: true });
+          if (options.signal?.aborted) this.abort();
+          this.budget.setRetainedValues(this, this.retainedRoots);
+          this.tracker.onFatalRejection((error3) => this.poison(error3));
+        } catch (error3) {
+          this.compilation.dispose();
+          this.lease.release();
+          throw error3;
+        }
+      }
+      options;
+      budget;
+      lease;
+      compilation;
+      controller = new AbortController();
+      phase = new AsyncLocalStorage9();
+      queue = new SandboxJobQueue();
+      tracker = createSandboxPromiseRejectionTracker();
+      bridge;
+      limits;
+      extensions;
+      cleanups = [];
+      callbacks = /* @__PURE__ */ new Map();
+      pendingCallbacks = /* @__PURE__ */ new Set();
+      callbackCache = /* @__PURE__ */ new WeakMap();
+      hostObjects = /* @__PURE__ */ new Set();
+      guestReferences = /* @__PURE__ */ new Map();
+      retainedOperations = /* @__PURE__ */ new WeakMap();
+      nestedOperations = /* @__PURE__ */ new WeakMap();
+      convertedModules = /* @__PURE__ */ new Map();
+      nativeConversions = { seen: /* @__PURE__ */ new WeakMap() };
+      modules;
+      globals;
+      builtinBindings;
+      scope;
+      active;
+      disposal;
+      closed = false;
+      initialized = false;
+      nestedDepth = 0;
+      failure;
+      bridgeOptions = () => ({
+        budget: this.budget,
+        compileOwner: this.lease.owner,
+        signal: this.controller.signal,
+        realm: this.bridge
+      });
+      retainedRoots = () => [
+        ...this.callbacks.values(),
+        ...Array.from(this.pendingCallbacks, (pending) => pending.closure),
+        ...this.guestReferences.values()
+      ];
+      captureArguments = (operation, args, copy) => {
+        const from = this.retainedOperations.get(operation)?.from ?? args.length;
+        const values = copy(args.slice(0, from));
+        const captured = [];
+        const rollback = () => {
+          for (const reference of captured) {
+            revokeGuestReference(reference, this);
+            this.guestReferences.delete(reference);
+          }
+        };
+        try {
+          for (const value of args.slice(from)) {
+            this.checkCollection(
+              this.guestReferences.size + 1,
+              this.limits.guestReferences,
+              "guest reference"
+            );
+            const root = [value];
+            const reference = createGuestReference(root, this, this.assertOpen);
+            this.guestReferences.set(reference, root);
+            captured.push(reference);
+            values.push(reference);
+          }
+          if (captured.length > 0)
+            this.budget.reconcileDataUsage(
+              measureSandboxData([...this.scope?.retainedValues() ?? [], ...this.retainedRoots()])
+            );
+          return { args: values, rollback };
+        } catch (error3) {
+          rollback();
+          if (error3 instanceof SandboxError) this.poison(error3);
+          throw error3;
+        }
+      };
+      releaseGuestReference = (reference) => {
+        readGuestReference(reference, this);
+        revokeGuestReference(reference, this);
+        this.guestReferences.delete(reference);
+        if (this.active === void 0)
+          reconcileCompiledValues(
+            this.budget,
+            [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+            this.compilation
+          );
+      };
+      assertOpen = () => {
+        if (this.failure !== void 0) throw this.failure.reason;
+        if (this.closed) throw new Error("SafeJS realm is closed; capabilities are revoked.");
+        this.controller.signal.throwIfAborted();
+      };
+      abort = () => {
+        this.poison(this.options.signal?.reason ?? new SandboxError("aborted"));
+        void this.close().catch(() => void 0);
+      };
+      poison(reason) {
+        this.failure ??= { reason };
+        this.controller.abort(reason);
+        if (this.active === void 0)
+          queueMicrotask(() => {
+            void this.dispose().catch(() => void 0);
+          });
+      }
+      chargeWork = (units = 1) => {
+        this.assertOpen();
+        if (!Number.isSafeInteger(units) || units < 0)
+          throw new TypeError("Work charges must be non-negative safe integers.");
+        try {
+          for (let index = 0; index < units; index++) this.budget.visitNode();
+        } catch (error3) {
+          this.poison(error3);
+          throw error3;
+        }
+      };
+      onCleanup = (cleanup) => {
+        this.assertOpen();
+        if (typeof cleanup !== "function") throw new TypeError("Cleanup must be a function.");
+        this.checkCollection(this.cleanups.length + 1, this.limits.cleanups, "cleanup");
+        this.cleanups.push(cleanup);
+      };
+      checkCollection(count, limit, name) {
+        this.assertOpen();
+        try {
+          this.budget.allocateCollectionEntries(count);
+        } catch (error3) {
+          this.poison(error3);
+          throw error3;
+        }
+        if (count > limit) throw new RangeError(`Realm ${name} limit exceeded.`);
+      }
+      invokeHost = (operation, call) => {
+        this.assertOpen();
+        const phase = {
+          active: true,
+          extension: this.nestedOperations.get(operation),
+          evaluating: false,
+          pending: /* @__PURE__ */ new Set()
+        };
+        return this.phase.run(phase, () => {
+          try {
+            const result = call();
+            if (types4.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+              return Promise.resolve(result).then(
+                async (value) => {
+                  await Promise.allSettled(phase.pending);
+                  if (phase.failure !== void 0) throw phase.failure.reason;
+                  this.assertOpen();
+                  return value;
+                },
+                async (error3) => {
+                  if (error3 instanceof SandboxError || phase.pending.size > 0) this.poison(error3);
+                  await Promise.allSettled(phase.pending);
+                  throw error3;
+                }
+              ).finally(() => {
+                phase.active = false;
+              });
+            }
+            this.assertOpen();
+            phase.active = false;
+            return result;
+          } catch (error3) {
+            phase.active = false;
+            if (error3 instanceof SandboxError) this.poison(error3);
+            if (phase.pending.size > 0) {
+              this.poison(error3);
+              return Promise.allSettled(phase.pending).then(() => {
+                throw error3;
+              });
+            }
+            throw error3;
+          }
+        });
+      };
+      importValue(value) {
+        return copyHostValueToSandbox(
+          value,
+          [],
+          this.bridgeOptions(),
+          { seen: /* @__PURE__ */ new WeakMap() },
+          "<realm>"
+        );
+      }
+      exportValue(value) {
+        return deepCopyFromSandbox(value, {
+          compilation: this.compilation,
+          wrapClosure: this.wrapCallback,
+          unwrapHostObject: (object) => exportHostCapability(object, this)
+        });
+      }
+      createHostObject = (definition) => {
+        this.checkCollection(this.hostObjects.size + 1, this.limits.hostObjects, "host object");
+        const object = createLiveHostObject(definition, {
+          owner: this,
+          assertActive: this.assertOpen,
+          chargeWork: this.chargeWork,
+          read: (operation) => {
+            const value = this.invokeHost(operation, operation);
+            if (types4.isPromise(value)) {
+              void Promise.resolve(value).catch(() => void 0);
+              throw new TypeError("Live property getters must be synchronous.");
+            }
+            return this.importValue(value);
+          },
+          write: (operation, value) => {
+            const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
+            if (types4.isPromise(result)) {
+              void Promise.resolve(result).catch(() => void 0);
+              throw new TypeError("Live property setters must be synchronous.");
+            }
+          },
+          method: (operation) => {
+            const value = copyHostValueToSandbox(
+              operation,
+              [],
+              this.bridgeOptions(),
+              this.nativeConversions,
+              "<host-method>"
+            );
+            if (!isSandboxClosure(value)) throw new TypeError("Invalid host method.");
+            return value;
+          }
+        });
+        this.hostObjects.add(object);
+        try {
+          this.budget.chargeDataUsage(1);
+        } catch (error3) {
+          this.poison(error3);
+          throw error3;
+        }
+        return object;
+      };
+      wrapCallback = (closure) => {
+        this.assertOpen();
+        const existing = this.callbackCache.get(closure);
+        if (existing !== void 0 && this.callbacks.has(existing)) return existing;
+        this.checkCollection(this.callbacks.size + 1, this.limits.callbacks, "callback");
+        const invokeCallback = this.invokeCallback;
+        const callback = function(...args) {
+          return invokeCallback(callback, { args, thisValue: this });
+        };
+        this.callbacks.set(callback, closure);
+        this.callbackCache.set(closure, callback);
+        registerGuestCallback(callback, {
+          owner: this,
+          closure,
+          assertActive: () => {
+            this.assertOpen();
+            if (!this.callbacks.has(callback)) throw new TypeError("Guest callback is revoked.");
+          }
+        });
+        try {
+          this.budget.reconcileDataUsage(
+            measureSandboxData([...this.scope?.retainedValues() ?? [], ...this.retainedRoots()])
+          );
+        } catch (error3) {
+          this.poison(error3);
+          throw error3;
+        }
+        return callback;
+      };
+      releaseCallback = (callback) => {
+        readGuestCallback(callback, this);
+        revokeGuestCallback(callback, this);
+        this.callbacks.delete(callback);
+        if (this.active === void 0)
+          reconcileCompiledValues(
+            this.budget,
+            [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+            this.compilation
+          );
+      };
+      invokeCallback = async (callback, options = {}) => {
+        if (this.closed || this.failure !== void 0) await this.dispose();
+        this.assertOpen();
+        const closure = readGuestCallback(callback, this);
+        this.checkCollection(this.pendingCallbacks.size + 1, this.limits.callbacks, "pending callback");
+        const record2 = { closure };
+        this.pendingCallbacks.add(record2);
+        const invoke2 = async () => {
+          this.assertOpen();
+          readGuestCallback(callback, this);
+          const leave = enterRunningState(closure);
+          const leaveCall = this.budget.enterCall();
+          try {
+            const values = this.importValue([
+              options.thisValue,
+              [...options.args ?? []]
+            ]);
+            const value = await closure.call(values[1], {
+              thisValue: values[0],
+              compilation: this.compilation,
+              stack: []
+            });
+            const settled = await suspendJob(
+              awaitSandboxValue(value, this.controller.signal, this.budget)
+            );
+            return this.exportValue(settled);
+          } finally {
+            leaveCall();
+            leave();
+          }
+        };
+        try {
+          if (this.active !== void 0) {
+            record2.promise = withSandboxPromiseRejectionTracker(
+              this.tracker,
+              () => runResources.run(
+                { signal: this.controller.signal, add: this.onCleanup },
+                () => withCancellationSignal(
+                  this.controller.signal,
+                  () => this.phase.getStore()?.active ? runAsyncPrefix(invoke2) : this.queue.run(invoke2)
+                )
+              )
+            );
+          } else {
+            record2.promise = this.perform(() => this.queue.run(invoke2));
+          }
+          return await record2.promise;
+        } catch (error3) {
+          if (error3 instanceof SandboxError) this.poison(error3);
+          throw error3;
+        } finally {
+          this.pendingCallbacks.delete(record2);
+          if (!this.closed && this.active === void 0)
+            reconcileCompiledValues(
+              this.budget,
+              [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+              this.compilation
+            );
+        }
+      };
+      initialize() {
+        if (this.initialized) return;
+        this.assertOpen();
+        this.initialized = true;
+        for (const extension of this.extensions) {
+          const context = Object.freeze({
+            signal: this.controller.signal,
+            onCleanup: this.onCleanup,
+            chargeWork: this.chargeWork,
+            createHostObject: this.createHostObject,
+            invokeCallback: this.invokeCallback,
+            releaseCallback: this.releaseCallback,
+            releaseGuestReference: this.releaseGuestReference,
+            retainGuestArguments: (operation, from) => {
+              this.assertOpen();
+              if (!extension.manifest.capabilities?.includes("guest:retain"))
+                throw new TypeError("Retaining arguments requires the guest:retain grant.");
+              if (typeof operation !== "function")
+                throw new TypeError("Retained operation must be a function.");
+              if (!Number.isSafeInteger(from) || from < 0)
+                throw new TypeError("Argument index must be a non-negative safe integer.");
+              if (this.scope !== void 0)
+                throw new TypeError("Retained operations must be registered during setup.");
+              const previous = this.retainedOperations.get(operation);
+              if (previous !== void 0 && (previous.extension !== extension || previous.from !== from))
+                throw new TypeError("Conflicting retained operation declaration.");
+              this.retainedOperations.set(operation, { extension, from });
+              return operation;
+            },
+            nestedOperation: (operation) => {
+              this.assertOpen();
+              if (!extension.manifest.capabilities?.includes("source:nested"))
+                throw new TypeError("Nested source requires the source:nested grant.");
+              if (typeof operation !== "function")
+                throw new TypeError("Nested operation must be a function.");
+              if (this.scope !== void 0)
+                throw new TypeError("Nested operations must be registered during setup.");
+              const owner = this.nestedOperations.get(operation);
+              if (owner !== void 0 && owner !== extension)
+                throw new TypeError("Nested operation already belongs to another extension.");
+              this.nestedOperations.set(operation, extension);
+              return operation;
+            },
+            evaluateNested: (source) => {
+              const phase = this.phase.getStore();
+              if (!extension.manifest.capabilities?.includes("source:nested") || !phase?.active || phase.extension !== extension || phase.evaluating) {
+                const error3 = new SandboxError("reentry");
+                this.poison(error3);
+                const rejected = Promise.reject(error3);
+                void rejected.catch(() => void 0);
+                return rejected;
+              }
+              const pending = this.evaluateNested(source, extension);
+              phase.pending.add(pending);
+              void pending.then(
+                () => {
+                  phase.pending.delete(pending);
+                },
+                (reason) => {
+                  phase.pending.delete(pending);
+                  phase.failure ??= { reason };
+                }
+              );
+              return pending;
+            }
+          });
+          const output = getExtensionSetup(extension)(context);
+          if (types4.isPromise(output)) {
+            void Promise.resolve(output).catch(() => void 0);
+            throw new TypeError("Extension setup must be synchronous.");
+          }
+          const exports = readDataRecord(output, "Extension exports");
+          if (Object.keys(exports).some((key3) => key3 !== "globals" && key3 !== "modules"))
+            throw new TypeError("Unknown extension export field.");
+          const globals = readDataRecord(
+            exports.globals ?? {},
+            "Extension globals"
+          );
+          const modules = readModules(exports.modules);
+          assertNames(Object.keys(globals), extension.manifest.globals ?? [], "global");
+          assertNames(Object.keys(modules), Object.keys(extension.manifest.modules ?? {}), "module");
+          for (const [name, values] of Object.entries(modules)) {
+            assertNames(Object.keys(values), extension.manifest.modules?.[name] ?? [], "module export");
+            this.modules[name] ??= /* @__PURE__ */ Object.create(null);
+            Object.assign(this.modules[name], values);
+          }
+          Object.assign(this.globals, globals);
+        }
+        const bindings = wrapCallerInjectedBindings(this.globals, this.bridgeOptions());
+        this.scope = new Scope(this.builtinBindings, void 0, void 0, { chargeData: false }).child(
+          bindings,
+          { functionBoundary: true }
+        );
+      }
+      async evaluateRaw(source, filename = "<realm>", nested = false) {
+        this.assertOpen();
+        if (typeof source !== "string") throw new TypeError("Realm source must be a string.");
+        const module = parseExecutableModule(source, filename, this.lease.owner);
+        this.initialize();
+        const imports = resolveModuleImports(module, this.modules, {
+          ...this.bridgeOptions(),
+          wrappedModules: this.convertedModules
+        });
+        for (const [name, value] of Object.entries(imports)) {
+          const binding = this.scope.lookup(name);
+          if (!binding.found) this.scope.declare(name, "const", value);
+          else if (binding.value !== value) throw new TypeError(`Conflicting import '${name}'.`);
+        }
+        const result = await interpret(
+          {
+            type: "BlockStatement",
+            body: module.body.filter((statement) => statement.type !== "ImportDeclaration"),
+            span: module.span
+          },
+          {
+            scope: this.scope,
+            useScopeDirectly: true,
+            budget: this.budget,
+            compilation: this.compilation,
+            signal: this.controller.signal,
+            surfaceUnhandledThrows: true,
+            jobs: this.queue,
+            nested,
+            assertActive: this.assertOpen
+          }
+        );
+        this.assertOpen();
+        return result;
+      }
+      evaluateNested = async (source, extension) => {
+        this.assertOpen();
+        const phase = this.phase.getStore();
+        if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0)
+          throw new SandboxError("reentry");
+        const leave = this.budget.enterCall();
+        phase.evaluating = true;
+        try {
+          if (++this.nestedDepth > this.limits.nestedEvaluations) {
+            const error3 = new SandboxError({
+              budget: "callDepth",
+              current: this.nestedDepth,
+              limit: this.limits.nestedEvaluations
+            });
+            this.poison(error3);
+            throw error3;
+          }
+          const result = await this.evaluateRaw(source, "<nested>", true);
+          if (!result.ok) throw new Error(result.error.message);
+        } finally {
+          this.nestedDepth--;
+          phase.evaluating = false;
+          leave();
+        }
+      };
+      evaluate = async (source, options = {}) => this.perform(async () => {
+        const result = await this.evaluateRaw(source, options.filename);
+        if (!result.ok) {
+          await this.dispose();
+          return { ok: false, error: result.error, stats: result.stats };
+        }
+        return { ok: true, returnValue: this.exportValue(result.returnValue), stats: result.stats };
+      });
+      async perform(task) {
+        if (this.closed || this.failure !== void 0) await this.dispose();
+        this.assertOpen();
+        if (this.active !== void 0) throw new SandboxError("reentry");
+        const pending = Promise.resolve().then(
+          () => withSandboxPromiseRejectionTracker(
+            this.tracker,
+            () => runResources.run(
+              { signal: this.controller.signal, add: this.onCleanup },
+              () => withCancellationSignal(this.controller.signal, task)
+            )
+          )
+        );
+        this.active = pending;
+        try {
+          const result = await pending;
+          await this.queue.drain();
+          const unhandled = await this.tracker.findUnhandledRejection();
+          if (unhandled !== void 0) {
+            const error3 = new Error(
+              `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
+            );
+            error3.name = "UnhandledRejectionError";
+            throw error3;
+          }
+          if (this.failure !== void 0) throw this.failure.reason;
+          if (!this.closed)
+            reconcileCompiledValues(
+              this.budget,
+              [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+              this.compilation
+            );
+          return result;
+        } catch (error3) {
+          this.poison(error3);
+          try {
+            await this.dispose();
+          } catch (cleanup) {
+            throw new AggregateError([error3, cleanup], "Realm execution and cleanup failed.");
+          }
+          throw error3;
+        } finally {
+          this.active = void 0;
+        }
+      }
+      close = () => {
+        this.closed = true;
+        this.controller.abort(new Error("SafeJS realm is closed."));
+        if (this.phase.getStore()?.active) return this.dispose();
+        return Promise.allSettled([
+          this.active,
+          ...Array.from(this.pendingCallbacks, (pending) => pending.promise)
+        ]).then(() => this.dispose());
+      };
+      dispose() {
+        if (this.disposal !== void 0) return this.disposal;
+        this.closed = true;
+        this.controller.abort(new Error("SafeJS realm is closed."));
+        this.options.signal?.removeEventListener("abort", this.abort);
+        for (const callback of this.callbacks.keys()) revokeGuestCallback(callback, this);
+        this.callbacks.clear();
+        for (const object of this.hostObjects) revokeHostObject(object, this);
+        this.hostObjects.clear();
+        for (const reference of this.guestReferences.keys()) revokeGuestReference(reference, this);
+        this.guestReferences.clear();
+        this.budget.setRetainedValues(this, void 0);
+        this.disposal = (async () => {
+          const errors2 = [];
+          for (const cleanup of this.cleanups.splice(0).reverse()) {
+            try {
+              await cleanup();
+            } catch (error3) {
+              errors2.push(error3);
+            }
+          }
+          this.scope = void 0;
+          this.convertedModules.clear();
+          for (const key3 of Object.keys(this.globals)) delete this.globals[key3];
+          for (const key3 of Object.keys(this.modules)) delete this.modules[key3];
+          for (const key3 of Object.keys(this.builtinBindings))
+            Reflect.deleteProperty(this.builtinBindings, key3);
+          this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
+          reconcileCompiledValues(this.budget, [], this.compilation);
+          this.compilation.dispose();
+          this.lease.release();
+          if (errors2.length > 0) throw new AggregateError(errors2, "Realm cleanup failed.");
+        })();
+        return this.disposal;
+      }
+    };
+  }
+});
+
 // packages/safe-js/src/snapshot/dump.ts
 function attachDumpController(result, controller) {
   Object.defineProperty(result, RUN_DUMP_CONTROLLER, {
@@ -150357,6 +151733,7 @@ var init_serialize = __esm({
     init_arrays();
     init_float32();
     init_float32array();
+    init_date();
     init_values();
     UnsnapshotableValueError = class extends Error {
       path;
@@ -150493,11 +151870,12 @@ var init_replay_inputs = __esm({
 });
 
 // packages/safe-js/src/run.ts
-import { AsyncLocalStorage as AsyncLocalStorage9 } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage10 } from "node:async_hooks";
 function run(source, options = {}) {
+  if (options.extensions !== void 0) return runWithExtensions(source, options);
   const lifecycle = {
     hostCallbackDepth: 0,
-    hostCallbackContext: new AsyncLocalStorage9()
+    hostCallbackContext: new AsyncLocalStorage10()
   };
   const dumpController = createDumpController(lifecycle);
   const promiseTracker = createSandboxPromiseRejectionTracker();
@@ -150563,32 +151941,7 @@ function run(source, options = {}) {
               lifecycle
             })
           );
-          const builtinBindings = {
-            ...createConsoleJsonGlobals({
-              compileOwner: operation.owner,
-              budget,
-              hostCalls,
-              sink: options.sink
-            }),
-            ...createCollectionGlobals({ budget }),
-            Float32Array: createFloat32ArrayGlobal(budget),
-            ...createErrorGlobals({
-              budget
-            }),
-            ...createMathGlobals({
-              random: random?.generator.next
-            }),
-            ...createObjectArrayGlobals({
-              budget
-            }),
-            ...createMiscGlobals({
-              budget
-            }),
-            ...createPromiseGlobals({
-              budget
-            }),
-            ...createRegexGlobals(operation.owner)
-          };
+          const builtinBindings = createBuiltinBindings({ compileOwner: operation.owner, budget, hostCalls, sink: options.sink, random: random?.generator.next, clock: options.clock });
           const importMeta = convertInitialInput(
             () => deepCopyToSandbox(options.importMeta ?? {})
           );
@@ -151045,6 +152398,7 @@ var UnhandledRejectionError, DEFAULT_MAX_CALL_DEPTH;
 var init_run7 = __esm({
   "packages/safe-js/src/run.ts"() {
     "use strict";
+    init_realm();
     init_hash();
     init_resources();
     init_random();
@@ -151058,14 +152412,7 @@ var init_run7 = __esm({
     init_running_state();
     init_promise_tracker();
     init_host_call();
-    init_console_json();
-    init_collections();
-    init_float32array2();
-    init_error();
-    init_math();
-    init_regex2();
-    init_misc();
-    init_object_array();
+    init_globals();
     init_host_bridge();
     init_interpreter();
     init_promise();
@@ -151414,7 +152761,7 @@ var init_find_exported = __esm({
 });
 
 // packages/safe-js/src/modules/agent.ts
-import { AsyncLocalStorage as AsyncLocalStorage10 } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage11 } from "node:async_hooks";
 function createSpawnUsageAccumulator() {
   let inputTokens = 0;
   let outputTokens = 0;
@@ -152317,7 +153664,7 @@ var init_agent3 = __esm({
         hostErrorData.set(this, { result });
       }
     };
-    activeUsageAccumulator = new AsyncLocalStorage10();
+    activeUsageAccumulator = new AsyncLocalStorage11();
     oneAttemptRetryOptions = {
       maxAttempts: 1,
       backoffMs: 0,
@@ -154176,6 +155523,8 @@ var init_src48 = __esm({
     init_parse6();
     init_lint4();
     init_run7();
+    init_realm();
+    init_extensions();
     init_random();
     init_otel2();
     init_backend();
@@ -157943,7 +159292,7 @@ var init_package2 = __esm({
   "package.json"() {
     package_default2 = {
       name: "poe-code",
-      version: "14.0.5",
+      version: "14.0.7",
       description: "CLI tool to configure Poe API for developer workflows.",
       license: "MIT",
       type: "module",