poe-code 14.0.5 → 14.0.7

package/packages/safe-js/dist/chunks/{chunk-B7H4ZL65.js → chunk-BWVASPJX.js}

@@ -4263,8 +4263,9 @@ var Parser = class {
       }
       break;
     }
-    this.expectPunctuator("(");
-    const args = this.parseArguments();
+    const optional = this.consumePunctuator("?.");
+    if (optional !== void 0) throw new DisallowedSyntaxError("new optional chain", optional.start);
+    const args = this.consumePunctuator("(") === void 0 ? [] : this.parseArguments();
     const end = this.previousToken();
     return {
       node: {
@@ -5922,6 +5923,87 @@ function matchingOpeningPunctuator(value) {
   return "{";
 }
 
+// packages/safe-js/src/extensions.ts
+import { types } from "node:util";
+var definitions = /* @__PURE__ */ new WeakMap();
+function readDataRecord(value, label) {
+  if (typeof value !== "object" || value === null || types.isProxy(value)) {
+    throw new TypeError(`${label} must be a plain data record.`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new TypeError(`${label} must be a plain data record.`);
+  }
+  const keys = Reflect.ownKeys(value);
+  if (keys.length > 4096) throw new RangeError(`${label} has too many fields.`);
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const key of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (typeof key !== "string" || !("value" in descriptor)) {
+      throw new TypeError(`${label} requires string-keyed data properties, not accessors.`);
+    }
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function readStringList(value, label) {
+  if (!Array.isArray(value) || types.isProxy(value) || value.length > 4096) {
+    throw new TypeError(`${label} must be a bounded string array.`);
+  }
+  const result = [];
+  for (let index = 0; index < value.length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (descriptor === void 0 || !("value" in descriptor) || typeof descriptor.value !== "string" || descriptor.value.length === 0) {
+      throw new TypeError(`${label} requires nonempty string data properties.`);
+    }
+    if (result.includes(descriptor.value))
+      throw new TypeError(`${label} contains a duplicate name.`);
+    result.push(descriptor.value);
+  }
+  if (Reflect.ownKeys(value).length !== result.length + 1)
+    throw new TypeError(`${label} has unexpected fields.`);
+  return Object.freeze(result);
+}
+function defineExtension(definition) {
+  const input = readDataRecord(definition, "Extension definition");
+  if (Object.keys(input).some((key) => key !== "manifest" && key !== "setup"))
+    throw new TypeError("Unknown extension definition field.");
+  if (typeof input.setup !== "function") throw new TypeError("Extension setup must be a function.");
+  if (types.isAsyncFunction(input.setup))
+    throw new TypeError("Extension setup must be synchronous.");
+  const manifest = readDataRecord(input.manifest, "Extension manifest");
+  if (Object.keys(manifest).some(
+    (key) => !["version", "name", "capabilities", "globals", "modules"].includes(key)
+  ))
+    throw new TypeError("Unknown extension manifest field.");
+  if (manifest.version !== 1) throw new TypeError("Unsupported extension manifest version.");
+  if (typeof manifest.name !== "string" || manifest.name.length === 0 || manifest.name.length > 256)
+    throw new TypeError("Extension name must be a nonempty bounded string.");
+  const modules = /* @__PURE__ */ Object.create(null);
+  for (const [name, exports] of Object.entries(
+    readDataRecord(manifest.modules ?? {}, "Extension modules")
+  )) {
+    if (name.length === 0) throw new TypeError("Module names must be nonempty.");
+    modules[name] = readStringList(exports, `Module '${name}' exports`);
+  }
+  const extension = Object.freeze({
+    manifest: Object.freeze({
+      version: 1,
+      name: manifest.name,
+      capabilities: readStringList(manifest.capabilities ?? [], "Extension capabilities"),
+      globals: readStringList(manifest.globals ?? [], "Extension globals"),
+      modules: Object.freeze(modules)
+    })
+  });
+  definitions.set(extension, input.setup);
+  return extension;
+}
+function getExtensionSetup(extension) {
+  const setup = definitions.get(extension);
+  if (setup === void 0) throw new TypeError("Extensions must be created by defineExtension.");
+  return setup;
+}
+
 // packages/safe-js/src/observability/otel.ts
 var noopOtelSink = {
   startSpan: () => noopOtelSpan,
@@ -6126,6 +6208,266 @@ function copyFloat32Storage(value, state) {
   return new Float32Array(buffer, storage.byteOffset, storage.length);
 }
 
+// packages/safe-js/src/interp/date.ts
+import { types as types2 } from "node:util";
+var NativeDate = Date;
+var readTime = NativeDate.prototype.getTime;
+var writeTime = NativeDate.prototype.setTime;
+var dates = /* @__PURE__ */ new WeakSet();
+function isSandboxDate(value) {
+  return typeof value === "object" && value !== null && dates.has(value);
+}
+function createSandboxDate(time) {
+  const value = new NativeDate(time);
+  dates.add(value);
+  return Object.freeze(value);
+}
+function dateTime(value) {
+  return Reflect.apply(readTime, value, []);
+}
+function copyNativeDate(value) {
+  if (!types2.isDate(value)) return void 0;
+  if (Object.getPrototypeOf(value) !== NativeDate.prototype || Reflect.ownKeys(value).length > 0)
+    throw new TypeError("Date subclasses and own properties are not supported.");
+  return createSandboxDate(dateTime(value));
+}
+function exportDate(value) {
+  return new NativeDate(dateTime(value));
+}
+function dateNumber(value) {
+  if (isSandboxDate(value)) return dateTime(value);
+  if (typeof value === "object" && value !== null || typeof value === "function" || typeof value === "symbol" || typeof value === "bigint")
+    throw new TypeError("Date arguments require primitive values; custom coercion is unsupported.");
+  return Number(value);
+}
+function parseDate(value, budget) {
+  if (typeof value === "object" && value !== null || typeof value === "function")
+    throw new TypeError("Date parsing requires a primitive value.");
+  const text = String(value);
+  if (text.length > 4096) throw new RangeError("Date input exceeds the 4096 character limit.");
+  budget.allocateString(text);
+  for (let index = 0; index < text.length; index++) budget.visitNode();
+  return NativeDate.parse(text);
+}
+function dateFromParts(args, utc) {
+  const parts = args.slice(0, 7).map(dateNumber);
+  return utc ? Reflect.apply(NativeDate.UTC, NativeDate, parts) : dateTime(Reflect.construct(NativeDate, parts));
+}
+var methodNames = [
+  "getTime",
+  "valueOf",
+  "getDate",
+  "getDay",
+  "getFullYear",
+  "getHours",
+  "getMilliseconds",
+  "getMinutes",
+  "getMonth",
+  "getSeconds",
+  "getTimezoneOffset",
+  "getUTCDate",
+  "getUTCDay",
+  "getUTCFullYear",
+  "getUTCHours",
+  "getUTCMilliseconds",
+  "getUTCMinutes",
+  "getUTCMonth",
+  "getUTCSeconds",
+  "setTime",
+  "setDate",
+  "setFullYear",
+  "setHours",
+  "setMilliseconds",
+  "setMinutes",
+  "setMonth",
+  "setSeconds",
+  "setUTCDate",
+  "setUTCFullYear",
+  "setUTCHours",
+  "setUTCMilliseconds",
+  "setUTCMinutes",
+  "setUTCMonth",
+  "setUTCSeconds",
+  "toDateString",
+  "toISOString",
+  "toString",
+  "toTimeString",
+  "toUTCString",
+  "toJSON"
+];
+var dateMethods = new Map(
+  methodNames.map((name) => {
+    const native = NativeDate.prototype[name];
+    return [
+      name,
+      {
+        length: native.length,
+        invoke: (date, args) => {
+          if (name === "toJSON")
+            return Number.isNaN(dateTime(date)) ? null : Reflect.apply(NativeDate.prototype.toISOString, date, []);
+          return Reflect.apply(
+            native,
+            date,
+            name.startsWith("set") ? args.slice(0, native.length).map(dateNumber) : []
+          );
+        }
+      }
+    ];
+  })
+);
+function dateString(value) {
+  return dateMethods.get("toString").invoke(value, []);
+}
+function restoreDateTime(value) {
+  if (value !== null && (typeof value !== "number" || !Number.isInteger(value) || Math.abs(value) > 864e13 || Object.is(value, -0)))
+    throw new TypeError("Invalid serialized Date epoch.");
+  const date = createSandboxDate(0);
+  Reflect.apply(writeTime, date, [value === null ? NaN : value]);
+  return date;
+}
+function serializedDateTime(value) {
+  const time = dateTime(value);
+  return Number.isNaN(time) ? null : time;
+}
+
+// packages/safe-js/src/interp/host-capabilities.ts
+var hostObjects = /* @__PURE__ */ new WeakMap();
+var guestObjects = /* @__PURE__ */ new WeakMap();
+var guestCallbacks = /* @__PURE__ */ new WeakMap();
+var guestReferences = /* @__PURE__ */ new WeakMap();
+function createGuestReference(root, owner, assertActive) {
+  const reference = Object.freeze(/* @__PURE__ */ Object.create(null));
+  guestReferences.set(reference, { root, owner, assertActive });
+  return reference;
+}
+function readGuestReference(reference, owner) {
+  const state = typeof reference === "object" && reference !== null ? guestReferences.get(reference) : void 0;
+  if (state === void 0 || state.owner !== owner)
+    throw new TypeError("Foreign or invalid guest reference.");
+  state.assertActive();
+  if (state.root === void 0) throw new TypeError("Guest reference is revoked.");
+  return state.root[0];
+}
+function revokeGuestReference(reference, owner) {
+  const state = guestReferences.get(reference);
+  if (state === void 0 || state.owner !== owner) throw new TypeError("Foreign guest reference.");
+  state.root = void 0;
+}
+function createLiveHostObject(definition, controller) {
+  const input = readDataRecord(definition, "Host object definition");
+  if (Object.keys(input).some((key) => key !== "properties" && key !== "methods"))
+    throw new TypeError("Unknown host object definition field.");
+  const properties = /* @__PURE__ */ new Map();
+  for (const [name, inputProperty] of Object.entries(
+    readDataRecord(input.properties ?? {}, "Host properties")
+  )) {
+    const property = readDataRecord(inputProperty, `Host property '${name}'`);
+    if (Object.keys(property).some((key) => key !== "get" && key !== "set"))
+      throw new TypeError("Unknown host property field.");
+    if (property.get !== void 0 && typeof property.get !== "function" || property.set !== void 0 && typeof property.set !== "function")
+      throw new TypeError("Host property operations must be functions.");
+    properties.set(name, property);
+  }
+  const operations = readDataRecord(input.methods ?? {}, "Host methods");
+  for (const [name, operation] of Object.entries(operations)) {
+    if (typeof operation !== "function") throw new TypeError("Host methods must be functions.");
+    if (properties.has(name)) throw new TypeError(`Conflicting host member '${name}'.`);
+  }
+  for (const name of [...properties.keys(), ...Object.keys(operations)]) {
+    if (["constructor", "prototype", "__proto__"].includes(name))
+      throw new TypeError(`Reserved host member '${name}'.`);
+  }
+  controller.assertActive();
+  controller.chargeWork(properties.size + Object.keys(operations).length + 1);
+  const host = Object.freeze(/* @__PURE__ */ Object.create(null));
+  const guest = Object.freeze(/* @__PURE__ */ Object.create(null));
+  const methods = new Map(
+    Object.entries(operations).map(([name, operation]) => [
+      name,
+      controller.method(operation)
+    ])
+  );
+  const state = { host, guest, controller, properties, methods };
+  hostObjects.set(host, state);
+  guestObjects.set(guest, state);
+  return host;
+}
+function isGuestHostObject(value) {
+  return typeof value === "object" && value !== null && guestObjects.has(value);
+}
+function isLiveCapability(value) {
+  return (typeof value === "object" && value !== null || typeof value === "function") && (hostObjects.has(value) || guestObjects.has(value) || guestCallbacks.has(value) || guestReferences.has(value));
+}
+function importHostCapability(value, owner) {
+  if (guestReferences.has(value)) return readGuestReference(value, owner);
+  const object = hostObjects.get(value);
+  if (object !== void 0) {
+    if (object.controller.owner !== owner) throw new TypeError("Foreign realm host capability.");
+    object.controller.assertActive();
+    return object.guest;
+  }
+  const callback = guestCallbacks.get(value);
+  if (callback !== void 0) {
+    if (callback.owner !== owner) throw new TypeError("Foreign realm guest callback.");
+    callback.assertActive();
+    if (callback.closure === void 0) throw new TypeError("Guest callback is revoked.");
+    return callback.closure;
+  }
+  throw new TypeError("Unsupported live capability conversion.");
+}
+function exportHostCapability(value, owner) {
+  const state = guestObjects.get(value);
+  if (state === void 0 || state.controller.owner !== owner)
+    throw new TypeError("Foreign realm host capability.");
+  state.controller.assertActive();
+  return state.host;
+}
+function registerGuestCallback(callback, state) {
+  guestCallbacks.set(callback, state);
+}
+function readGuestCallback(callback, owner) {
+  const state = typeof callback === "function" ? guestCallbacks.get(callback) : void 0;
+  if (state === void 0 || state.owner !== owner)
+    throw new TypeError("Foreign or invalid guest callback.");
+  state.assertActive();
+  if (state.closure === void 0) throw new TypeError("Guest callback is revoked.");
+  return state.closure;
+}
+function revokeGuestCallback(callback, owner) {
+  const state = guestCallbacks.get(callback);
+  if (state === void 0 || state.owner !== owner) throw new TypeError("Foreign guest callback.");
+  state.closure = void 0;
+}
+function revokeHostObject(value, owner) {
+  const state = hostObjects.get(value);
+  if (state === void 0 || state.controller.owner !== owner)
+    throw new TypeError("Foreign host object.");
+  state.properties.clear();
+  state.methods.clear();
+}
+function getHostObjectMember(value, key) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  state.controller.chargeWork();
+  const property = state.properties.get(key);
+  if (property !== void 0)
+    return property.get === void 0 ? void 0 : state.controller.read(property.get);
+  return state.methods.get(key);
+}
+function setHostObjectMember(value, key, entry) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  state.controller.chargeWork();
+  const property = state.properties.get(key);
+  if (property?.set === void 0) throw new TypeError(`Host property '${key}' is not writable.`);
+  state.controller.write(property.set, entry);
+}
+function getHostObjectKeys(value) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  return [...state.properties.keys(), ...state.methods.keys()];
+}
+
 // packages/safe-js/src/interp/values.ts
 import { types as nodeTypes } from "node:util";
 
@@ -6246,7 +6588,7 @@ async function flushPromiseJobs() {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types } from "node:util";
+import { types as types3 } from "node:util";
 
 // packages/safe-js/src/interp/arguments.ts
 var sandboxArgumentsBrand = /* @__PURE__ */ Symbol("SandboxArguments");
@@ -6443,6 +6785,7 @@ function setSandboxPrototype(value, prototype, budget) {
   else prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+  if (isGuestHostObject(value)) return false;
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxPromise(value) || isSandboxRegex(value) || isSandboxSet(value))
     return false;
   const prototype = Object.getPrototypeOf(value);
@@ -6455,6 +6798,7 @@ function hasManagedDescriptors(value) {
   return descriptorObjects.has(value);
 }
 function hasGuestObjectState(value) {
+  if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
@@ -6620,7 +6964,7 @@ function serializeDumpValue(value, path, state) {
   if (hasGuestObjectState(value)) {
     throw new TypeError("Guest function properties and prototype links cannot be serialized.");
   }
-  if (isFloat32Array(value)) return serializeHeapReference(value, path, state);
+  if (isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path, state);
   if (Array.isArray(value)) {
     const reference2 = serializeHeapReference(value, path, state);
     if (reference2 !== void 0) {
@@ -6644,7 +6988,9 @@ function serializeHeapReference(value, path, state) {
   }
   if (!state.serializedHeapIds.has(id)) {
     state.serializedHeapIds.add(id);
-    if (isFloat32Array(value)) {
+    if (isSandboxDate(value)) {
+      state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
+    } else if (isFloat32Array(value)) {
       const storage = encodeFloat32Storage(value, id, state.float32Buffers, (id2) => ({
         kind: "ref",
         id: id2
@@ -6701,7 +7047,7 @@ function indexHeapContainers(snapshot) {
   const heapIds = /* @__PURE__ */ new WeakMap();
   let nextId = 1;
   for (const [value, stat2] of stats.entries()) {
-    if (stat2.count > 1 || stat2.cyclic || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat2.count > 1 || stat2.cyclic || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -6712,7 +7058,7 @@ function collectContainerStats(value, stats, ancestors) {
   if (value === null || typeof value !== "object") {
     return;
   }
-  if (!Array.isArray(value) && !isPlainObject(value) && !isFloat32Array(value)) {
+  if (!Array.isArray(value) && !isPlainObject(value) && !isFloat32Array(value) && !isSandboxDate(value)) {
     return;
   }
   let stat2 = stats.get(value);
@@ -6848,6 +7194,10 @@ function validateDumpHeap(root, state) {
     addUnique(heapIds, id, path);
     const entry = requireRecord(value, path);
     validateErrorType(entry, path);
+    if (entry.kind === "date") {
+      validateDateRecord(entry, path);
+      continue;
+    }
     if (entry.kind === "float32array") {
       validateFloat32Storage(entry);
       requireRecord(entry.entries, `${path}.entries`);
@@ -7005,6 +7355,14 @@ function validateGeneratorShape(record2, path, state) {
     }
   });
 }
+function validateDateRecord(record2, path) {
+  if (Object.keys(record2).length !== 2) fail("invalidValue", path, "invalid Date fields");
+  try {
+    restoreDateTime(record2.time);
+  } catch {
+    fail("invalidValue", `${path}.time`, "invalid Date epoch");
+  }
+}
 function validateArrayHeap(record2, path, state) {
   if (Object.hasOwn(record2, "items")) {
     requireArray(record2.items, `${path}.items`, state);
@@ -7088,7 +7446,7 @@ function validateGenericValue(value, path, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail("invalidState", path, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types.isProxy(value)) {
+  if (state.dataPropertiesOnly && types3.isProxy(value)) {
     fail("invalidType", path, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -9178,6 +9536,7 @@ function createSandboxClosure(input) {
   return Object.freeze(closure);
 }
 function ownEnumerableSandboxEntries(value) {
+  if (isGuestHostObject(value)) return getHostObjectKeys(value).map((key) => [key, getHostObjectMember(value, key)]);
   if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
   if (isGuestClosure(value)) return Object.entries(value.properties ?? {});
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value)) return [];
@@ -9330,6 +9689,14 @@ function measureSandboxData(values, options = {}) {
     assertSandboxDataDepth(depth);
     seen.add(value);
     usage += 1;
+    if (isSandboxDate(value)) {
+      usage += 8;
+      return;
+    }
+    if (isGuestHostObject(value)) {
+      for (const key of getHostObjectKeys(value)) usage += key.length + 1;
+      return;
+    }
     const prototype = getSandboxPrototype(value);
     if (prototype !== null) visit(prototype, depth + 1);
     if (isFloat32Array(value)) {
@@ -9472,6 +9839,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
   if (isSandboxPrimitive(value)) {
     return value;
   }
+  if (isLiveCapability(value)) throw new TypeError("Live capabilities require their owning realm bridge.");
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxRegex(value) || isSandboxPromise(value)) {
     return value;
   }
@@ -9519,6 +9887,13 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     }
     return sandboxPromise;
   }
+  if (nodeTypes.isDate(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = copyNativeDate(value);
+    state.seen.set(value, copy);
+    return copy;
+  }
   if (isFloat32Array(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -9635,6 +10010,10 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
   if (isSandboxPrimitive(value)) {
     return value;
   }
+  if (isGuestHostObject(value)) {
+    if (options.unwrapHostObject === void 0) throw new TypeError("Live capabilities require their owning realm bridge.");
+    return options.unwrapHostObject(value);
+  }
   if (nodeTypes.isProxy(value)) throw new TypeError("Unsupported proxy sandbox value.");
   if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
@@ -9674,6 +10053,13 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (!Object.isExtensible(value)) Object.preventExtensions(copy);
     return copy;
   }
+  if (isSandboxDate(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = exportDate(value);
+    state.seen.set(value, copy);
+    return copy;
+  }
   if (isSandboxClosure(value)) {
     if (options.wrapClosure === void 0) {
       throw new TypeError(
@@ -9988,6 +10374,8 @@ function encodeReplayData(value, options = {}) {
         id: capabilityId,
         properties: child(entry.properties, "properties")
       };
+    } else if (isSandboxDate(entry)) {
+      nodes[id] = { kind: "date", time: serializedDateTime(entry) };
     } else if (isFloat32Array(entry)) {
       const storage = encodeFloat32Storage(entry, id, float32Buffers, (id2) => ({
         tag: "ref",
@@ -10138,6 +10526,12 @@ function decodeReplayData(input, options = {}, parent) {
         options.onCapabilityRestored?.(capability, copy);
         return copy;
       }
+      if (kind === "date") {
+        if (Object.keys(node).length !== 2) throw new TypeError("Invalid serialized Date fields.");
+        const result3 = restoreDateTime(own(node, "time"));
+        restored.set(id, result3);
+        return result3;
+      }
       if (kind === "float32array") {
         if (typeof node.extensible !== "boolean")
           throw new TypeError("Invalid Float32Array extensibility.");
@@ -10828,6 +11222,8 @@ function normalize(value, seen) {
   if (seen.has(value)) throw new TypeError("Host call arguments cannot contain cycles.");
   seen.add(value);
   try {
+    const date = copyNativeDate(value);
+    if (date !== void 0) return Object.assign(/* @__PURE__ */ Object.create(null), { $type: "date", time: serializedDateTime(date) });
     if (isFloat32Array(value)) {
       const storage = float32Storage(value);
       const properties = /* @__PURE__ */ Object.create(null);
@@ -11783,6 +12179,7 @@ var KNOWN_RUNTIME_GLOBALS = [
   "AggregateError",
   "Array",
   "Boolean",
+  "Date",
   "Error",
   "Infinity",
   "isFinite",
@@ -16947,9 +17344,9 @@ var ASFloatingPromiseScanner = class {
   isPromiseFactoryCall(node) {
     return this.isPromiseStaticMethodCall(node, PROMISE_FACTORIES);
   }
-  isPromiseStaticMethodCall(node, methodNames) {
+  isPromiseStaticMethodCall(node, methodNames2) {
     const member = node.callee.type === "MemberExpression" ? node.callee : void 0;
-    return member !== void 0 && !member.computed && member.object.type === "Identifier" && member.object.name === "Promise" && member.property.type === "Identifier" && methodNames.has(member.property.name);
+    return member !== void 0 && !member.computed && member.object.type === "Identifier" && member.object.name === "Promise" && member.property.type === "Identifier" && methodNames2.has(member.property.name);
   }
   isPromiseChainCall(node) {
     const member = node.callee.type === "MemberExpression" ? node.callee : void 0;
@@ -22240,128 +22637,6 @@ function hasOnlyRegexLiteralDiagnostics(diagnostics) {
   );
 }
 
-// packages/safe-js/src/random.ts
-import { randomInt } from "node:crypto";
-
-// packages/safe-js/src/interp/globals/math.ts
-var mathMethods = {
-  abs: Math.abs,
-  acos: Math.acos,
-  acosh: Math.acosh,
-  asin: Math.asin,
-  asinh: Math.asinh,
-  atan: Math.atan,
-  atan2: Math.atan2,
-  atanh: Math.atanh,
-  ceil: Math.ceil,
-  cbrt: Math.cbrt,
-  clz32: Math.clz32,
-  cos: Math.cos,
-  cosh: Math.cosh,
-  exp: Math.exp,
-  expm1: Math.expm1,
-  floor: Math.floor,
-  f16round,
-  fround: Math.fround,
-  hypot: Math.hypot,
-  imul: Math.imul,
-  log: Math.log,
-  log1p: Math.log1p,
-  log10: Math.log10,
-  log2: Math.log2,
-  max: Math.max,
-  min: Math.min,
-  pow: Math.pow,
-  round: Math.round,
-  sign: Math.sign,
-  sin: Math.sin,
-  sinh: Math.sinh,
-  sqrt: Math.sqrt,
-  tan: Math.tan,
-  tanh: Math.tanh,
-  trunc: Math.trunc
-};
-function f16round(value) {
-  const number = +value;
-  if (!Number.isFinite(number) || number === 0) {
-    return number;
-  }
-  const magnitude = Math.abs(number);
-  if (magnitude >= 65520) {
-    return number < 0 ? -Infinity : Infinity;
-  }
-  let quantum = 2 ** -24;
-  let boundary = 2 ** -13;
-  for (let exponent = -13; exponent <= 15 && magnitude >= boundary; exponent += 1) {
-    quantum *= 2;
-    boundary *= 2;
-  }
-  const scaled = magnitude / quantum;
-  const lower = Math.floor(scaled);
-  const remainder = scaled - lower;
-  const rounded = (remainder > 0.5 || remainder === 0.5 && lower % 2 !== 0 ? lower + 1 : lower) * quantum;
-  return number < 0 ? -rounded : rounded;
-}
-function createMathGlobals(options = {}) {
-  const random = options.random ?? Math.random;
-  const mathObject = {
-    E: Math.E,
-    LN2: Math.LN2,
-    LN10: Math.LN10,
-    LOG2E: Math.LOG2E,
-    LOG10E: Math.LOG10E,
-    PI: Math.PI,
-    SQRT1_2: Math.SQRT1_2,
-    SQRT2: Math.SQRT2,
-    random: createSandboxClosure({ sandbox: true, call: () => random(), name: "random" })
-  };
-  for (const [name, method] of Object.entries(mathMethods)) {
-    mathObject[name] = createSandboxClosure({
-      sandbox: true,
-      call: (args) => Reflect.apply(method, Math, args),
-      name
-    });
-  }
-  return {
-    Infinity: Infinity,
-    Math: mathObject,
-    NaN: Number.NaN
-  };
-}
-function createSeededRandom(seed) {
-  let state = normalizeSeed(seed);
-  return {
-    next: () => {
-      state = Math.imul(state, 1664525) + 1013904223 >>> 0;
-      return state / 4294967296;
-    },
-    snapshot: () => state,
-    restore: (nextState) => {
-      state = normalizeSeed(nextState);
-    }
-  };
-}
-function normalizeSeed(seed) {
-  if (!Number.isFinite(seed)) {
-    throw new TypeError("Seeded random requires a finite numeric seed.");
-  }
-  return Math.trunc(seed) >>> 0;
-}
-
-// packages/safe-js/src/random.ts
-function createReplayableRandom(options = {}) {
-  const snapshot = options.snapshot;
-  const saved = snapshot?.random;
-  let initialState = options.seed;
-  if (saved !== void 0) {
-    const hasLoopState = typeof snapshot?.loopIterations === "object" && snapshot.loopIterations !== null && Object.keys(snapshot.loopIterations).length > 0;
-    const replaysFromStart = snapshot?.replay !== void 0 || Array.isArray(snapshot?.pendingAwaits) && snapshot.pendingAwaits.length > 0 && !hasLoopState;
-    initialState = replaysFromStart ? saved.initialState ?? saved.seed : saved.resumeState ?? saved.state;
-  }
-  const generator = createSeededRandom(initialState ?? randomInt(4294967296));
-  return { seed: saved?.seed ?? generator.snapshot(), ...generator };
-}
-
 // packages/safe-js/src/interp/generator.ts
 function createGeneratorChannel(body) {
   let state = "unstarted";
@@ -24709,6 +24984,101 @@ function relativeIndex(value, length, fallback) {
   return integer < 0 ? Math.max(length + integer, 0) : Math.min(integer, length);
 }
 
+// packages/safe-js/src/interp/globals/date.ts
+var intrinsics = /* @__PURE__ */ new WeakMap();
+var constructors2 = /* @__PURE__ */ new WeakSet();
+function createDateGlobal(options) {
+  const validateClockTime = (value) => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || Math.abs(value) > 864e13)
+      throw new TypeError("Date clock must return a finite integer epoch within the Date range.");
+    return value;
+  };
+  const readNow = declareHostOperation(
+    () => {
+      options.budget.visitNode();
+      const value = options.clock?.now === void 0 ? Date.now() : options.clock.now();
+      return validateClockTime(value);
+    },
+    "re-issue",
+    {
+      onReplay: (_args, outcome) => {
+        if (outcome.status === "fulfilled") {
+          const time = validateClockTime(outcome.value);
+          options.clock?.restore?.({ next: time + 1 });
+        }
+      }
+    }
+  );
+  const now = wrapCallerInjectedBindings({ now: readNow }, { ...options, moduleId: "<Date>" }).now;
+  const prototype = createSandboxDate(NaN);
+  const constructor = createSandboxClosure({
+    sandbox: true,
+    name: "Date",
+    length: 7,
+    call: async (_args, context) => options.budget.allocateString(
+      dateString(createSandboxDate(Number(await now.call([], context))))
+    ),
+    construct: async (args, context) => {
+      let time;
+      if (args.length === 0) time = Number(await now.call([], context));
+      else if (args.length > 1) time = dateFromParts(args, false);
+      else if (isSandboxDate(args[0])) time = dateTime(args[0]);
+      else if (typeof args[0] === "string") time = parseDate(args[0], options.budget);
+      else time = dateNumber(args[0]);
+      options.budget.chargeDataUsage(9);
+      return createSandboxDate(time);
+    },
+    properties: {
+      now,
+      prototype,
+      parse: createSandboxClosure({
+        sandbox: true,
+        name: "parse",
+        length: 1,
+        call: ([value]) => parseDate(value, options.budget)
+      }),
+      UTC: createSandboxClosure({
+        sandbox: true,
+        name: "UTC",
+        length: 7,
+        call: (args) => dateFromParts(args, true)
+      })
+    }
+  });
+  const methods = /* @__PURE__ */ new Map();
+  for (const [name, method] of dateMethods)
+    methods.set(
+      name,
+      createSandboxClosure({
+        sandbox: true,
+        name,
+        length: method.length,
+        call: (args, context) => {
+          const receiver = context?.thisValue;
+          if (!isSandboxDate(receiver))
+            throw new TypeError(`Date#${name} requires a Date receiver.`);
+          options.budget.visitNode();
+          const value = method.invoke(receiver, args);
+          return typeof value === "string" ? options.budget.allocateString(value) : value;
+        }
+      })
+    );
+  constructors2.add(constructor);
+  intrinsics.set(options.compileOwner ?? options.budget, { constructor, prototype, methods });
+  return constructor;
+}
+function isDateConstructor(value) {
+  return typeof value === "object" && value !== null && constructors2.has(value);
+}
+function getDateMember(property, budget, owner) {
+  const state = intrinsics.get(owner ?? budget);
+  return property === "constructor" ? state?.constructor : state?.methods.get(String(property));
+}
+function getDatePrototype(value, budget, owner) {
+  const prototype = intrinsics.get(owner ?? budget)?.prototype;
+  return prototype === value ? null : prototype ?? null;
+}
+
 // packages/safe-js/src/interp/scope.ts
 var uninitialized = /* @__PURE__ */ Symbol("uninitialized");
 var Scope = class _Scope {
@@ -25003,9 +25373,10 @@ async function interpret(node, options = {}) {
       peakDataSize: { enumerable: false, value: 0, writable: true }
     });
     const activeLoopIterations = /* @__PURE__ */ new Map();
-    const jobs = new SandboxJobQueue();
+    const jobs = options.jobs ?? new SandboxJobQueue();
     hoistVarDeclarations(node, scope);
     const context = {
+      assertActive: options.assertActive,
       compilation,
       budget,
       callStack: [],
@@ -25028,9 +25399,9 @@ async function interpret(node, options = {}) {
     };
     const evaluation = await withCancellationSignal(
       options.signal,
-      () => jobs.run(() => evaluateNode(node, context))
+      () => options.nested ? runAsyncPrefix(() => evaluateNode(node, context)) : jobs.run(() => evaluateNode(node, context))
     );
-    await jobs.drain();
+    if (!options.nested) await jobs.drain();
     const snapshot = scope.snapshot();
     reconcileDataBudget(
       budget,
@@ -25085,6 +25456,7 @@ async function interpret(node, options = {}) {
   }
 }
 async function evaluateNode(node, context) {
+  context.assertActive?.();
   const replayWait = promiseReplayContext.getStore()?.beforeNode(node.nodeId);
   if (replayWait !== void 0) await suspendJob(replayWait);
   assertPromiseExecutionAllowed();
@@ -26056,6 +26428,7 @@ function forInObject(value) {
   return void 0;
 }
 function forInKeys(object, budget) {
+  if (isGuestHostObject(object)) return getHostObjectKeys(object);
   const keys = [];
   const seen = /* @__PURE__ */ new Set();
   let depth = 0;
@@ -26073,6 +26446,7 @@ function forInKeys(object, budget) {
   return keys;
 }
 function hasForInProperty(object, key, budget) {
+  if (isGuestHostObject(object)) return getHostObjectKeys(object).includes(key);
   let depth = 0;
   for (let current = object; current !== null; current = getSandboxPrototype(current)) {
     if (depth > 0) budget.visitNode();
@@ -26564,10 +26938,12 @@ async function evaluateMemberExpression(node, context) {
   };
 }
 function getPropertyValue(target, property, context) {
+  if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
   if (typeof target === "string") return getStringMember(target, property, context.budget);
   if (typeof target === "number") return getNumberMember(target, property, context.budget);
   if (typeof target === "boolean") return void 0;
   if (isFloat32Array(target)) return getFloat32Member(target, property, context.budget);
+  if (isSandboxDate(target)) return getDateMember(property, context.budget, context.compilation?.owner);
   if (isSandboxMap(target)) return getMapMember(target, property, createMapMethodOptions(context));
   if (isSandboxSet(target)) return getSetMember(target, property, createSetMethodOptions(context));
   if (isSandboxGenerator(target)) return getGeneratorMember(target, property, context.budget);
@@ -26804,6 +27180,9 @@ async function evaluateMemberCallExpression(node, context) {
       context
     );
   }
+  if (isSandboxDate(member.object)) {
+    return evaluateResolvedCallExpression(node, getDateMember(member.property, context.budget, context.compilation?.owner), context, member.object);
+  }
   if (isFloat32Array(member.object)) {
     return evaluateResolvedCallExpression(
       node,
@@ -27056,6 +27435,7 @@ function applyBinaryOperator(node, left, right, context) {
         return true;
       }
       if (isFloat32ArrayConstructor(right)) return isFloat32Array(left);
+      if (isDateConstructor(right)) return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
       if (isSandboxSetConstructor(right) && isSandboxSet(left)) {
         return true;
       }
@@ -27119,8 +27499,8 @@ function applyAdditionOperator(left, right, context) {
   return toNumber(leftPrimitive) + toNumber(rightPrimitive);
 }
 function compareRelational(left, right, operator) {
-  const leftPrimitive = toPrimitive(left);
-  const rightPrimitive = toPrimitive(right);
+  const leftPrimitive = isSandboxDate(left) ? dateTime(left) : toPrimitive(left);
+  const rightPrimitive = isSandboxDate(right) ? dateTime(right) : toPrimitive(right);
   if (typeof leftPrimitive === "string" && typeof rightPrimitive === "string") {
     switch (operator) {
       case "<":
@@ -27203,6 +27583,7 @@ function toPrimitive(value) {
   return toString(value);
 }
 async function toNumericPrimitive(value, context) {
+  if (isSandboxDate(value)) return dateTime(value);
   if (isPrimitiveCoercionType(getCoercionType(value))) {
     return value;
   }
@@ -27232,6 +27613,7 @@ async function toNumericPrimitive(value, context) {
   return toString(value);
 }
 function toNumber(value) {
+  if (isSandboxDate(value)) return dateTime(value);
   if (typeof value === "number") {
     return value;
   }
@@ -27250,6 +27632,7 @@ function toNumber(value) {
   return toNumber(toPrimitive(value));
 }
 function toString(value) {
+  if (isSandboxDate(value)) return dateString(value);
   if (Array.isArray(value)) {
     return value.map((entry) => entry === null || entry === void 0 ? "" : toString(entry)).join(",");
   }
@@ -27270,6 +27653,7 @@ function isPlainSandboxObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && !isSandboxClosure(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isSandboxPromise(value) && !isSandboxRegex(value);
 }
 function getMemberValue(target, property, context) {
+  if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
   let current = target;
   let depth = 0;
   while (typeof current === "object" && current !== null) {
@@ -27294,6 +27678,11 @@ function getArrayMemberValue(target, property, context) {
   return getArrayMember(target, property, createArrayMethodOptions(context));
 }
 function setSandboxProperty(target, property, value, budget) {
+  if (isSandboxDate(target)) throw new TypeError("Date own properties are not supported.");
+  if (isGuestHostObject(target)) {
+    setHostObjectMember(target, String(property), value);
+    return;
+  }
   const prototypeOwner = target;
   if (isGuestClosure(target)) target = materializeFunctionProperties(target);
   if (isFloat32Array(target)) {
@@ -27338,6 +27727,7 @@ function setSandboxProperty(target, property, value, budget) {
   }
 }
 function deleteSandboxProperty(target, property) {
+  if (isGuestHostObject(target)) throw new TypeError("Live host properties cannot be deleted.");
   if (isGuestClosure(target)) target = materializeFunctionProperties(target);
   if (Array.isArray(target)) {
     assertCollectionMutable(target);
@@ -27903,7 +28293,7 @@ function wrapCallerInjectedBindings(bindings, options) {
     const copied = Object.fromEntries(
       Object.entries(bindings).map(([name, value]) => [
         name,
-        typeof value === "function" ? wrapCallerInjectedFunction(name, value, { ...options, capabilityPath: [name] }, state) : copyHostValueToSandbox(
+        typeof value === "function" && !isLiveCapability(value) ? wrapCallerInjectedFunction(name, value, { ...options, capabilityPath: [name] }, state) : copyHostValueToSandbox(
           value,
           [],
           { ...options, operation: name, capabilityPath: [name] },
@@ -27924,9 +28314,10 @@ function wrapCallerInjectedFunction(name, value, options, state) {
   const bindingName = name === "default" && value.name.length > 0 ? value.name : name;
   const callable = value;
   return createSandboxClosure({
-    ...isAsyncFunction(callable) ? { async: true } : {},
+    ...isAsyncFunction(callable) && !options.realm?.awaitResult(callable) ? { async: true } : {},
     cancellationSignal: options.signal,
     call: (args, context) => {
+      options.realm?.assertActive();
       const operationLease = options.budget.acquireCompileOwner(false, options.compileOwner);
       const compilation = new CompileScope(operationLease.owner);
       try {
@@ -27942,9 +28333,10 @@ function wrapCallerInjectedFunction(name, value, options, state) {
           seen: /* @__PURE__ */ new WeakMap(),
           restored: []
         };
-        const hostArgs = deepCopyFromSandbox([...args], {
+        const copyArguments = (values) => deepCopyFromSandbox([...values], {
           compilation,
-          wrapClosure: (closure) => wrapSandboxClosureForHost(
+          unwrapHostObject: options.realm === void 0 ? void 0 : (object) => exportHostCapability(object, options.realm.owner),
+          wrapClosure: (closure) => options.realm?.wrapCallback(closure) ?? wrapSandboxClosureForHost(
             closure,
             stackFrames,
             options.budget,
@@ -27952,11 +28344,26 @@ function wrapCallerInjectedFunction(name, value, options, state) {
             callbacks
           )
         });
+        const captured = options.realm?.captureArguments(callable, args, copyArguments);
+        const hostArgs = captured?.args ?? copyArguments(args);
         const hostCalls = options.hostCalls;
         const operation = options.operation ?? bindingName;
         const moduleId = options.moduleId ?? "<bindings>";
         const policy = readHostOperationPolicy(value) ?? readRegisteredPendingHostCallPolicy(moduleId, operation) ?? "re-issue";
         if (hostCalls === void 0) {
+          if (options.realm !== void 0) {
+            let result;
+            try {
+              result = options.realm.invoke(callable, () => Reflect.apply(callable, void 0, hostArgs));
+            } catch (error) {
+              captured.rollback();
+              throw error;
+            }
+            if (options.realm.awaitResult(callable)) {
+              return Promise.resolve(result).then((value2) => copyHostResultToSandbox(value2, stackFrames, options));
+            }
+            return copyHostResultToSandbox(result, stackFrames, options);
+          }
           return copyHostResultToSandbox(
             invokeHostCallback(() => Reflect.apply(callable, void 0, hostArgs), options),
             stackFrames,
@@ -28494,6 +28901,10 @@ function wrapHostPromiseWithSignal(promise, signal) {
 }
 function copyHostValueToSandbox(value, stackFrames, options, state, path) {
   const { budget } = options;
+  if (isLiveCapability(value)) {
+    if (options.realm === void 0 || options.errorData || options.hostCalls !== void 0) throw new TypeError("Live capabilities are not portable replay or error data.");
+    return importHostCapability(value, options.realm.owner);
+  }
   if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean") {
     return value;
   }
@@ -28535,6 +28946,14 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
       state
     );
   }
+  const date = copyNativeDate(value);
+  if (date !== void 0) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    budget.chargeDataUsage(9);
+    state.seen.set(value, date);
+    return date;
+  }
   if (isFloat32Array(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -28812,386 +29231,131 @@ function describeValue2(value) {
   return typeof value;
 }
 
-// packages/safe-js/src/snapshot/dump.ts
-var RUN_DUMP_CONTROLLER = /* @__PURE__ */ Symbol("SafeJS.run-dump-controller");
-function attachDumpController(result, controller) {
-  Object.defineProperty(result, RUN_DUMP_CONTROLLER, {
-    configurable: false,
-    enumerable: false,
-    value: controller,
-    writable: false
-  });
-  return result;
-}
-function createDumpController(lifecycle) {
-  let finished = false;
-  let failed;
-  let finalSnapshot;
-  let latestSnapshot;
-  let latestSnapshotFactory;
-  let pendingRequest;
-  return {
-    fail(error) {
-      finished = true;
-      failed = {
-        error
-      };
-      if (pendingRequest === void 0) {
-        return;
-      }
-      pendingRequest.reject(error);
-      pendingRequest = void 0;
-    },
-    finalize(snapshot) {
-      finished = true;
-      finalSnapshot = snapshot;
-      latestSnapshot = snapshot;
-      latestSnapshotFactory = void 0;
-      if (pendingRequest !== void 0) {
-        settlePendingSnapshot(snapshot);
-      }
-    },
-    onYield(createSnapshot) {
-      latestSnapshot = void 0;
-      latestSnapshotFactory = createSnapshot;
-      if (pendingRequest === void 0) {
-        return;
-      }
-      settlePendingSnapshot(createSnapshot());
-    },
-    requestCurrentSnapshot(options = {}) {
-      assertDumpAllowed(options);
-      if (failed !== void 0) {
-        return Promise.reject(failed.error);
-      }
-      if (latestSnapshot !== void 0 || latestSnapshotFactory !== void 0) {
-        try {
-          return Promise.resolve(serializeRunSnapshot(latestSnapshot ?? latestSnapshotFactory()));
-        } catch (error) {
-          return Promise.reject(error);
-        }
-      }
-      return this.requestSnapshot(options);
-    },
-    requestSnapshot(options = {}) {
-      assertDumpAllowed(options);
-      if (failed !== void 0) {
-        if ((options.onFailure === "checkpoint" || options.onFailure === void 0 && isDataBudgetError(failed.error)) && finalSnapshot !== void 0) {
-          try {
-            return Promise.resolve(serializeRunSnapshot(finalSnapshot));
-          } catch (error) {
-            return Promise.reject(error);
-          }
-        }
-        return Promise.reject(failed.error);
-      }
-      if (finished) {
-        if (finalSnapshot === void 0) {
-          throw new Error("Run completed without producing a snapshot.");
-        }
-        try {
-          const serializedSnapshot = serializeRunSnapshot(finalSnapshot);
-          return Promise.resolve(serializedSnapshot);
-        } catch (error) {
-          return Promise.reject(error);
-        }
-      }
-      if (options.mode === "replay" && (latestSnapshot !== void 0 || latestSnapshotFactory !== void 0)) {
-        return this.requestCurrentSnapshot(options);
-      }
-      if (pendingRequest !== void 0) {
-        return pendingRequest.promise;
-      }
-      let resolveSnapshot = () => void 0;
-      let rejectSnapshot = () => void 0;
-      const promise = new Promise((resolve, reject) => {
-        resolveSnapshot = resolve;
-        rejectSnapshot = reject;
-      });
-      pendingRequest = {
-        promise,
-        reject: rejectSnapshot,
-        resolve: resolveSnapshot
-      };
-      return promise;
-    }
-  };
-  function assertDumpAllowed(options) {
-    if ((lifecycle?.hostCallbackDepth ?? 0) > 0 && (options.mode !== "replay" || lifecycle?.hostCallbackContext.getStore() === true)) {
-      throw new SandboxError("reentry");
-    }
-  }
-  function settlePendingSnapshot(snapshot) {
-    try {
-      settlePendingRequest(serializeRunSnapshot(snapshot));
-    } catch (error) {
-      pendingRequest?.reject(error);
-      pendingRequest = void 0;
-    }
-  }
-  function settlePendingRequest(snapshot) {
-    if (pendingRequest === void 0) {
-      return;
-    }
-    pendingRequest.resolve(snapshot);
-    pendingRequest = void 0;
+// packages/safe-js/src/random.ts
+import { randomInt } from "node:crypto";
+
+// packages/safe-js/src/interp/globals/math.ts
+var mathMethods = {
+  abs: Math.abs,
+  acos: Math.acos,
+  acosh: Math.acosh,
+  asin: Math.asin,
+  asinh: Math.asinh,
+  atan: Math.atan,
+  atan2: Math.atan2,
+  atanh: Math.atanh,
+  ceil: Math.ceil,
+  cbrt: Math.cbrt,
+  clz32: Math.clz32,
+  cos: Math.cos,
+  cosh: Math.cosh,
+  exp: Math.exp,
+  expm1: Math.expm1,
+  floor: Math.floor,
+  f16round,
+  fround: Math.fround,
+  hypot: Math.hypot,
+  imul: Math.imul,
+  log: Math.log,
+  log1p: Math.log1p,
+  log10: Math.log10,
+  log2: Math.log2,
+  max: Math.max,
+  min: Math.min,
+  pow: Math.pow,
+  round: Math.round,
+  sign: Math.sign,
+  sin: Math.sin,
+  sinh: Math.sinh,
+  sqrt: Math.sqrt,
+  tan: Math.tan,
+  tanh: Math.tanh,
+  trunc: Math.trunc
+};
+function f16round(value) {
+  const number = +value;
+  if (!Number.isFinite(number) || number === 0) {
+    return number;
   }
-}
-function isDataBudgetError(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "budgetExceeded" && "budget" in error && error.budget === "dataSize";
-}
-function dump(result, options = {}) {
-  const controller = readDumpController(result);
-  if (controller !== void 0) {
-    return controller.requestSnapshot(options);
+  const magnitude = Math.abs(number);
+  if (magnitude >= 65520) {
+    return number < 0 ? -Infinity : Infinity;
   }
-  if (hasSnapshot(result)) {
-    try {
-      return Promise.resolve(serializeRunSnapshot(result.snapshot));
-    } catch (error) {
-      return Promise.reject(error);
-    }
+  let quantum = 2 ** -24;
+  let boundary = 2 ** -13;
+  for (let exponent = -13; exponent <= 15 && magnitude >= boundary; exponent += 1) {
+    quantum *= 2;
+    boundary *= 2;
   }
-  return Promise.resolve(result).then((resolved) => {
-    if (!hasSnapshot(resolved)) {
-      throw new Error("Run completed without producing a snapshot.");
-    }
-    return serializeRunSnapshot(resolved.snapshot);
-  });
+  const scaled = magnitude / quantum;
+  const lower = Math.floor(scaled);
+  const remainder = scaled - lower;
+  const rounded = (remainder > 0.5 || remainder === 0.5 && lower % 2 !== 0 ? lower + 1 : lower) * quantum;
+  return number < 0 ? -rounded : rounded;
 }
-function dumpCurrent(result) {
-  const controller = readDumpController(result);
-  if (controller !== void 0) {
-    return controller.requestCurrentSnapshot();
+function createMathGlobals(options = {}) {
+  const random = options.random ?? Math.random;
+  const mathObject = {
+    E: Math.E,
+    LN2: Math.LN2,
+    LN10: Math.LN10,
+    LOG2E: Math.LOG2E,
+    LOG10E: Math.LOG10E,
+    PI: Math.PI,
+    SQRT1_2: Math.SQRT1_2,
+    SQRT2: Math.SQRT2,
+    random: createSandboxClosure({ sandbox: true, call: () => random(), name: "random" })
+  };
+  for (const [name, method] of Object.entries(mathMethods)) {
+    mathObject[name] = createSandboxClosure({
+      sandbox: true,
+      call: (args) => Reflect.apply(method, Math, args),
+      name
+    });
   }
-  return dump(result);
-}
-function serializeRunSnapshot(snapshot) {
-  return serializeSafeJSSnapshot(snapshot);
+  return {
+    Infinity: Infinity,
+    Math: mathObject,
+    NaN: Number.NaN
+  };
 }
-function hasSnapshot(value) {
-  return typeof value === "object" && value !== null && Object.prototype.hasOwnProperty.call(value, "snapshot");
+function createSeededRandom(seed) {
+  let state = normalizeSeed(seed);
+  return {
+    next: () => {
+      state = Math.imul(state, 1664525) + 1013904223 >>> 0;
+      return state / 4294967296;
+    },
+    snapshot: () => state,
+    restore: (nextState) => {
+      state = normalizeSeed(nextState);
+    }
+  };
 }
-function readDumpController(value) {
-  if (typeof value !== "object" || value === null) {
-    return void 0;
+function normalizeSeed(seed) {
+  if (!Number.isFinite(seed)) {
+    throw new TypeError("Seeded random requires a finite numeric seed.");
   }
-  return value[RUN_DUMP_CONTROLLER];
+  return Math.trunc(seed) >>> 0;
 }
 
-// packages/safe-js/src/error-codes.ts
-function getOwnErrorCode(error) {
-  if (typeof error !== "object" || error === null || !Object.prototype.hasOwnProperty.call(error, "code")) {
-    return void 0;
+// packages/safe-js/src/random.ts
+function createReplayableRandom(options = {}) {
+  const snapshot = options.snapshot;
+  const saved = snapshot?.random;
+  let initialState = options.seed;
+  if (saved !== void 0) {
+    const hasLoopState = typeof snapshot?.loopIterations === "object" && snapshot.loopIterations !== null && Object.keys(snapshot.loopIterations).length > 0;
+    const replaysFromStart = snapshot?.replay !== void 0 || Array.isArray(snapshot?.pendingAwaits) && snapshot.pendingAwaits.length > 0 && !hasLoopState;
+    initialState = replaysFromStart ? saved.initialState ?? saved.seed : saved.resumeState ?? saved.state;
   }
-  const code = error.code;
-  return typeof code === "string" ? code : void 0;
-}
-function hasOwnErrorCode(error, code) {
-  return getOwnErrorCode(error) === code;
+  const generator = createSeededRandom(initialState ?? randomInt(4294967296));
+  return { seed: saved?.seed ?? generator.snapshot(), ...generator };
 }
 
-// packages/safe-js/src/snapshot/backend.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-var DEFAULT_WRITE_MAX_ATTEMPTS = 3;
-var DEFAULT_WRITE_RETRY_DELAY_MS = 100;
-var LOCKED_FILE_ERROR_CODES = /* @__PURE__ */ new Set(["EACCES", "EBUSY", "EPERM"]);
-var pendingOperations = /* @__PURE__ */ new Map();
-var FileSnapshotBackend = class {
-  constructor(path, options = {}) {
-    this.path = path;
-    this.#writeMaxAttempts = options.writeMaxAttempts ?? DEFAULT_WRITE_MAX_ATTEMPTS;
-    this.#writeRetryDelayMs = options.writeRetryDelayMs ?? DEFAULT_WRITE_RETRY_DELAY_MS;
-  }
-  path;
-  #writeMaxAttempts;
-  #writeRetryDelayMs;
-  async read() {
-    try {
-      return JSON.parse(await readFile(this.path, "utf8"));
-    } catch (error) {
-      if (hasErrorCode(error, "ENOENT")) {
-        return void 0;
-      }
-      if (error instanceof SyntaxError) {
-        throw new Error(`Failed to parse snapshot at ${this.path}: ${error.message}`);
-      }
-      throw error;
-    }
-  }
-  async write(snapshot) {
-    await enqueueOperation(
-      this.path,
-      () => writeSnapshotAtomically(this.path, snapshot, {
-        maxAttempts: this.#writeMaxAttempts,
-        retryDelayMs: this.#writeRetryDelayMs
-      })
-    );
-  }
-  async remove() {
-    await enqueueOperation(this.path, async () => {
-      try {
-        await unlink(this.path);
-      } catch (error) {
-        if (!hasErrorCode(error, "ENOENT")) {
-          throw error;
-        }
-      }
-    });
-  }
-};
-async function writeSnapshotAtomically(snapshotPath, snapshot, options) {
-  const parentPath = dirname(snapshotPath);
-  const contents = serializeSafeJSSnapshot(snapshot);
-  await assertParentDirectoryExists(snapshotPath, parentPath);
-  for (let attempt = 1; attempt <= options.maxAttempts; attempt += 1) {
-    try {
-      const temporaryPath = `${snapshotPath}.${randomUUID2()}.tmp`;
-      await writeSnapshotOnce(temporaryPath, snapshotPath, contents);
-      return;
-    } catch (error) {
-      if (hasErrorCode(error, "EEXIST")) {
-        if (attempt === options.maxAttempts) {
-          throw new Error(
-            `Failed to write snapshot at ${snapshotPath} after ${options.maxAttempts} attempts: temporary path already exists`,
-            {
-              cause: error
-            }
-          );
-        }
-        continue;
-      }
-      if (!isLockedFileError(error)) {
-        throw error;
-      }
-      if (attempt === options.maxAttempts) {
-        throw new Error(
-          `Failed to write snapshot at ${snapshotPath} after ${options.maxAttempts} attempts: file is locked (${getOwnErrorCode(error)})`,
-          {
-            cause: error
-          }
-        );
-      }
-      await delay(options.retryDelayMs);
-    }
-  }
-}
-async function assertParentDirectoryExists(snapshotPath, parentPath) {
-  try {
-    const parent = await stat(parentPath);
-    if (!parent.isDirectory()) {
-      throw new Error(
-        `Cannot write snapshot at ${snapshotPath}: parent path ${parentPath} is not a directory`
-      );
-    }
-  } catch (error) {
-    if (hasErrorCode(error, "ENOENT")) {
-      throw new Error(
-        `Cannot write snapshot at ${snapshotPath}: parent directory ${parentPath} does not exist`,
-        {
-          cause: error
-        }
-      );
-    }
-    throw error;
-  }
-}
-async function writeSnapshotOnce(temporaryPath, snapshotPath, contents) {
-  let temporaryCreated = false;
-  let renamed = false;
-  try {
-    try {
-      await writeFile(temporaryPath, contents, { encoding: "utf8", flag: "wx" });
-      temporaryCreated = true;
-    } catch (error) {
-      if (!hasErrorCode(error, "EEXIST")) {
-        await removeTemporarySnapshot(temporaryPath).catch(() => void 0);
-      }
-      throw error;
-    }
-    await rename(temporaryPath, snapshotPath);
-    renamed = true;
-  } finally {
-    if (temporaryCreated && !renamed) {
-      await removeTemporarySnapshot(temporaryPath).catch(() => void 0);
-    }
-  }
-}
-async function enqueueOperation(path, operation) {
-  const previous = pendingOperations.get(path) ?? Promise.resolve();
-  const pending = previous.catch(() => void 0).then(operation);
-  const queued = pending.catch(() => void 0);
-  pendingOperations.set(path, queued);
-  try {
-    await pending;
-  } finally {
-    if (pendingOperations.get(path) === queued) {
-      pendingOperations.delete(path);
-    }
-  }
-}
-async function removeTemporarySnapshot(temporaryPath) {
-  try {
-    await unlink(temporaryPath);
-  } catch (error) {
-    if (!hasErrorCode(error, "ENOENT")) {
-      throw error;
-    }
-  }
-}
-async function delay(ms) {
-  if (ms === 0) {
-    return;
-  }
-  await new Promise((resolve) => setTimeout(resolve, ms));
-}
-function hasErrorCode(error, code) {
-  return hasOwnErrorCode(error, code);
-}
-function isLockedFileError(error) {
-  const code = getOwnErrorCode(error);
-  return code !== void 0 && LOCKED_FILE_ERROR_CODES.has(code);
-}
-
-// packages/safe-js/src/run.ts
+// packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-
-// packages/safe-js/src/interp/resources.ts
-import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
-var runResources = new AsyncLocalStorage5();
-async function withRunResources(signal, execute) {
-  const controller = new AbortController();
-  const cancel = () => controller.abort(signal?.reason);
-  const cleanups = /* @__PURE__ */ new Set();
-  const resources = {
-    signal: controller.signal,
-    add(close) {
-      cleanups.add(close);
-    }
-  };
-  signal?.addEventListener("abort", cancel, { once: true });
-  if (signal?.aborted) cancel();
-  let result;
-  let failure;
-  let errors = [];
-  try {
-    result = await runResources.run(resources, execute);
-  } catch (error) {
-    failure = { reason: error };
-  } finally {
-    signal?.removeEventListener("abort", cancel);
-    controller.abort(new Error("SafeJS run finished."));
-    const outcomes = await Promise.allSettled(
-      [...cleanups].map((close) => Promise.resolve().then(close))
-    );
-    errors = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
-  }
-  if (failure !== void 0) throw failure.reason;
-  if (errors.length > 0) throw new AggregateError(errors, "SafeJS resource cleanup failed.");
-  return result;
-}
+import { types as types4 } from "node:util";
 
 // packages/safe-js/src/interp/globals/console-json.ts
 function createConsoleJsonGlobals(options) {
@@ -29305,7 +29469,9 @@ function toJsonParseText(input) {
 }
 async function stringifyProperty(key, holder, state, indent = "") {
   let value = getOwnDataValue(holder, key);
-  if (isStringifyContainer(value)) {
+  if (isSandboxDate(value)) {
+    value = dateMethods.get("toJSON").invoke(value, []);
+  } else if (isStringifyContainer(value)) {
     const toJSON = getOwnDataValue(value, "toJSON");
     if (isSandboxClosure(toJSON)) {
       value = await callStringifyClosure(toJSON, [key], value, state);
@@ -29617,6 +29783,7 @@ async function stringifyObject2(value, budget, context, joining) {
   }
 }
 async function defaultToString(value, budget, context, joining) {
+  if (isSandboxDate(value)) return budget.allocateString(dateString(value));
   if (Array.isArray(value) || isFloat32Array(value)) {
     if (Object.hasOwn(value, "join")) {
       const join = ownDataValue(value, "join");
@@ -29720,6 +29887,7 @@ function createObjectArrayGlobals(options) {
       getPrototypeOf: createSandboxClosure({
         sandbox: true,
         call: ([value]) => {
+          if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
           objectProperties(value);
           return getSandboxPrototype(value);
         },
@@ -29844,7 +30012,7 @@ function createObjectArrayGlobals(options) {
     }),
     Number: createSandboxClosure({
       sandbox: true,
-      call: ([value]) => Number(value),
+      call: ([value]) => isSandboxDate(value) ? dateTime(value) : Number(value),
       name: "Number",
       properties: {
         isFinite: createSandboxClosure({
@@ -29886,295 +30054,1465 @@ function createObjectArrayGlobals(options) {
         NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
         POSITIVE_INFINITY: Number.POSITIVE_INFINITY
       }
-    }),
-    Boolean: createSandboxClosure({
-      sandbox: true,
-      call: ([value]) => Boolean(value),
-      name: "Boolean"
-    })
-  };
-}
-async function objectFromSandboxEntries(iterator, budget) {
-  const object = /* @__PURE__ */ Object.create(null);
-  try {
-    while (true) {
-      const result = await iterator.next();
-      if (typeof result !== "object" && typeof result !== "function" || result === null) {
-        throw new TypeError("Iterator result must be an object.");
+    }),
+    Boolean: createSandboxClosure({
+      sandbox: true,
+      call: ([value]) => Boolean(value),
+      name: "Boolean"
+    })
+  };
+}
+async function objectFromSandboxEntries(iterator, budget) {
+  const object = /* @__PURE__ */ Object.create(null);
+  try {
+    while (true) {
+      const result = await iterator.next();
+      if (typeof result !== "object" && typeof result !== "function" || result === null) {
+        throw new TypeError("Iterator result must be an object.");
+      }
+      if (result.done) break;
+      const entry = result.value;
+      if (typeof entry !== "object" && typeof entry !== "function" || entry === null) {
+        throw new TypeError("Object.fromEntries requires entry objects.");
+      }
+      const key = entry[0];
+      const value = entry[1];
+      Object.defineProperty(object, key, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+      });
+    }
+  } catch (error) {
+    try {
+      await iterator.return?.();
+    } catch {
+      throw error;
+    }
+    throw error;
+  }
+  return allocateProducedSandboxValue(object, budget);
+}
+function assignSandboxValues(target, sources, budget) {
+  if (target === null || target === void 0) {
+    throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
+  }
+  if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
+    throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
+  }
+  for (const source of sources) {
+    if (source === null || source === void 0) {
+      continue;
+    }
+    for (const [key, value] of ownEnumerableSandboxEntries(source)) {
+      setSandboxProperty(target, key, value, budget);
+    }
+  }
+  return target;
+}
+function objectProperties(value, mutable = false) {
+  if (isSandboxDate(value)) {
+    if (mutable) throw new TypeError("Date own properties and prototypes are not supported.");
+    return value;
+  }
+  if (isGuestHostObject(value)) throw new TypeError("Live host object descriptors are not supported.");
+  if (isGuestClosure(value)) return materializeFunctionProperties(value);
+  if (isSandboxClosure(value)) {
+    if (mutable) throw new TypeError("Host function properties are read only.");
+    return value.properties ?? /* @__PURE__ */ Object.create(null);
+  }
+  if (!isAssignableSandboxTarget(value)) throw new TypeError("Expected a sandbox object or function.");
+  return value;
+}
+function dataDescriptor(input) {
+  const source = objectProperties(input);
+  const descriptor = {};
+  for (const field of ["get", "set", "value", "writable", "enumerable", "configurable"]) {
+    const entry = Object.getOwnPropertyDescriptor(source, field);
+    if (entry === void 0) continue;
+    if (!("value" in entry) || field === "get" || field === "set") {
+      throw new TypeError("Only data property descriptors are supported.");
+    }
+    if (field === "value") descriptor.value = entry.value;
+    else descriptor[field] = Boolean(entry.value);
+  }
+  return descriptor;
+}
+function defineDataProperty2(target, key, descriptor, budget) {
+  budget.visitNode();
+  if (isFloat32Array(target)) throw new TypeError("Typed array property descriptors are not supported.");
+  const properties = objectProperties(target, true);
+  if (Array.isArray(properties)) {
+    if (key === "length" && "value" in descriptor) budget.allocateArrayLength(Number(descriptor.value));
+    else {
+      const index = Number(key);
+      if (Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key) {
+        budget.allocateArrayLength(index + 1);
+      }
+    }
+  }
+  Object.defineProperty(properties, key, descriptor);
+  markDescriptorObject(properties);
+}
+function isAssignableSandboxTarget(value) {
+  return typeof value === "object" && value !== null && !isSandboxClosure(value) && !isSandboxGenerator(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isSandboxPromise(value) && !isSandboxRegex(value);
+}
+async function arrayFromSandboxValues(args, budget) {
+  const [items, mapFn, thisValue] = args;
+  const iterator = getSandboxIterator(items);
+  const values = iterator === void 0 ? Reflect.apply(Array.from, Array, [items]) : await collectIteratorValues(iterator);
+  if (mapFn === void 0 || !isSandboxClosure(mapFn)) {
+    if (mapFn !== void 0) {
+      throw new TypeError("Array.from mapping callback must be a function.");
+    }
+    return budgetSandboxValue2(values, budget);
+  }
+  const mappedValues = [];
+  for (const [index, value] of values.entries()) {
+    const result = await mapFn.call([value, index], { stack: [], thisValue });
+    if (isSandboxPromise(result) && result.synchronousPrefix !== void 0) {
+      await result.synchronousPrefix;
+    }
+    mappedValues.push(result);
+  }
+  return budgetSandboxValue2(mappedValues, budget);
+}
+function createArrayFromConstructorArgs(args, budget) {
+  if (args.length !== 1) {
+    return budgetSandboxValue2(Reflect.apply(Array, Array, [...args]), budget);
+  }
+  const [lengthOrValue] = args;
+  if (typeof lengthOrValue !== "number") {
+    return budgetSandboxValue2([lengthOrValue], budget);
+  }
+  if (!Number.isInteger(lengthOrValue) || lengthOrValue < 0 || lengthOrValue > 4294967295) {
+    throw new RangeError("Invalid array length.");
+  }
+  budget.allocateArrayLength(lengthOrValue);
+  return new Array(lengthOrValue);
+}
+async function collectIteratorValues(iterator) {
+  const values = [];
+  while (true) {
+    const result = await iterator.next();
+    if (result.done) return values;
+    values.push(result.value);
+  }
+}
+function getOwnEnumerableKeys(value) {
+  if (isGuestHostObject(value)) return getHostObjectKeys(value);
+  return ownEnumerableSandboxEntries(value).map(([key]) => key);
+}
+function getOwnEnumerableValues(value) {
+  return ownEnumerableSandboxEntries(value).map(([, entryValue]) => entryValue);
+}
+function budgetSandboxValue2(value, budget) {
+  const sandboxValue = deepCopyToSandbox(value);
+  return allocateProducedSandboxValue(sandboxValue, budget);
+}
+function stringRaw(args, budget) {
+  const [template, ...substitutions] = args;
+  const raw = getTemplateRawParts(template);
+  let result = "";
+  for (let index = 0; index < raw.length; index += 1) {
+    result += String(raw[index]);
+    if (index < raw.length - 1 && index < substitutions.length) {
+      result += String(substitutions[index]);
+    }
+  }
+  return budget.allocateString(result);
+}
+function getTemplateRawParts(template) {
+  const raw = typeof template === "object" && template !== null ? template.raw : void 0;
+  if (typeof template !== "object" || template === null || isSandboxClosure(template) || isSandboxPromise(template) || !Array.isArray(raw)) {
+    throw new TypeError("String.raw requires a raw strings array.");
+  }
+  return raw;
+}
+
+// packages/safe-js/src/interp/globals.ts
+function createBuiltinBindings(options) {
+  return {
+    ...createConsoleJsonGlobals(options),
+    ...createCollectionGlobals(options),
+    Float32Array: createFloat32ArrayGlobal(options.budget),
+    Date: createDateGlobal(options),
+    ...createErrorGlobals(options),
+    ...createMathGlobals({ random: options.random }),
+    ...createObjectArrayGlobals(options),
+    ...createMiscGlobals(options),
+    ...createPromiseGlobals(options),
+    ...createRegexGlobals(options.compileOwner)
+  };
+}
+
+// packages/safe-js/src/interp/resources.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "node:async_hooks";
+var runResources = new AsyncLocalStorage5();
+async function withRunResources(signal, execute) {
+  const controller = new AbortController();
+  const cancel = () => controller.abort(signal?.reason);
+  const cleanups = /* @__PURE__ */ new Set();
+  const resources = {
+    signal: controller.signal,
+    add(close) {
+      cleanups.add(close);
+    }
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  let result;
+  let failure;
+  let errors = [];
+  try {
+    result = await runResources.run(resources, execute);
+  } catch (error) {
+    failure = { reason: error };
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+    controller.abort(new Error("SafeJS run finished."));
+    const outcomes = await Promise.allSettled(
+      [...cleanups].map((close) => Promise.resolve().then(close))
+    );
+    errors = outcomes.flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
+  }
+  if (failure !== void 0) throw failure.reason;
+  if (errors.length > 0) throw new AggregateError(errors, "SafeJS resource cleanup failed.");
+  return result;
+}
+
+// packages/safe-js/src/modules/registry.ts
+function createUnknownModuleMessage2(moduleName, moduleNames) {
+  if (moduleNames.length === 0) {
+    return `Unknown module '${moduleName}'. No modules are registered.`;
+  }
+  return `Unknown module '${moduleName}'. Available modules: ${moduleNames.join(", ")}.`;
+}
+function createUnknownExportMessage2(moduleName, exportName, availableExports) {
+  if (availableExports.length === 0) {
+    return `Module '${moduleName}' does not export '${exportName}'. The module exports nothing.`;
+  }
+  return `Module '${moduleName}' does not export '${exportName}'. Available exports: ${availableExports.join(", ")}.`;
+}
+function resolveModuleImports(module, modules, options) {
+  const registry = normalizeModuleRegistry(modules);
+  const bindings = createBindingRecord();
+  const wrappedModules = options.wrappedModules ?? /* @__PURE__ */ new Map();
+  for (const statement of module.body) {
+    if (statement.type !== "ImportDeclaration") {
+      continue;
+    }
+    bindImportDeclaration(statement, registry, wrappedModules, bindings, options);
+  }
+  return bindings;
+}
+function bindImportDeclaration(declaration, registry, wrappedModules, bindings, options) {
+  const moduleName = declaration.source.value;
+  const moduleExports = registry.get(moduleName);
+  if (moduleExports === void 0) {
+    if (options.allowMissing) return;
+    throw createModuleImportError(
+      createUnknownModuleMessage2(moduleName, [...registry.keys()]),
+      declaration.source.span
+    );
+  }
+  const wrappedExports = wrappedModules.get(moduleName) ?? createBindingRecord(
+    wrapCancelableBindings(
+      wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
+        realm: options.realm,
+        budget: options.budget,
+        compileOwner: options.compileOwner,
+        hostCalls: options.hostCalls,
+        moduleId: moduleName,
+        signal: options.signal
+      }),
+      options.signal
+    )
+  );
+  wrappedModules.set(moduleName, wrappedExports);
+  for (const specifier of declaration.specifiers) {
+    const localName = specifier.local.name;
+    if (Object.hasOwn(bindings, localName)) {
+      throw createModuleImportError(
+        `Cannot redeclare imported binding '${localName}'.`,
+        specifier.local.span
+      );
+    }
+    if (options.allowMissing && specifier.type !== "ImportNamespaceSpecifier") {
+      const exportName = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.imported.name;
+      if (!Object.hasOwn(wrappedExports, exportName)) continue;
+    }
+    bindings[localName] = resolveImportSpecifier(moduleName, specifier, wrappedExports);
+  }
+}
+function resolveImportSpecifier(moduleName, specifier, wrappedExports) {
+  if (specifier.type === "ImportNamespaceSpecifier") {
+    return wrappedExports;
+  }
+  const exportName = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.imported.name;
+  const exportedValue = wrappedExports[exportName];
+  if (exportedValue !== void 0 || Object.hasOwn(wrappedExports, exportName)) {
+    return exportedValue;
+  }
+  throw createModuleImportError(
+    createUnknownExportMessage2(moduleName, exportName, Object.keys(wrappedExports).sort()),
+    specifier.span
+  );
+}
+function createModuleImportError(message, span) {
+  const error = new Error(message);
+  attachErrorSpan(error, span);
+  return error;
+}
+function normalizeModuleRegistry(modules) {
+  if (modules === void 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  const entries = modules instanceof Map ? [...modules.entries()] : Object.entries(modules);
+  const registry = new Map(
+    entries.map(
+      ([moduleName, moduleExports]) => [moduleName, normalizeModuleExports(moduleExports)]
+    ).sort(([left], [right]) => left.localeCompare(right))
+  );
+  registerModuleHostOperationPolicies(registry);
+  return registry;
+}
+function registerModuleHostOperationPolicies(registry) {
+  for (const [moduleId, moduleExports] of registry) {
+    for (const [operation, value] of moduleExports) {
+      if (typeof value !== "function") {
+        continue;
+      }
+      const policy = readHostOperationPolicy(value);
+      if (policy !== void 0) {
+        registerPendingHostCallPolicy({ moduleId, operation, policy });
+      }
+    }
+  }
+}
+function normalizeModuleExports(moduleExports) {
+  const entries = moduleExports instanceof Map ? [...moduleExports.entries()] : Object.entries(moduleExports);
+  return new Map(
+    entries.filter(([exportName]) => exportName.length > 0).sort(([left], [right]) => left.localeCompare(right))
+  );
+}
+function createBindingRecord(entries) {
+  return Object.assign(/* @__PURE__ */ Object.create(null), entries);
+}
+
+// packages/safe-js/src/realm.ts
+var RealmState = class {
+  constructor(options) {
+    this.options = options;
+    const limitInput = readDataRecord(options.limits ?? {}, "Realm limits");
+    this.limits = {
+      extensions: 32,
+      hostObjects: 1024,
+      callbacks: 1024,
+      guestReferences: 1024,
+      cleanups: 1024,
+      nestedEvaluations: 16
+    };
+    for (const [name, value] of Object.entries(limitInput)) {
+      if (!Object.hasOwn(this.limits, name) || !Number.isSafeInteger(value) || Number(value) < 1)
+        throw new TypeError("Realm limits must be positive safe integers with supported names.");
+      this.limits[name] = Number(value);
+    }
+    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types4.isProxy(options.extensions)))
+      throw new TypeError("Extensions must be a registration array.");
+    const registrations = options.extensions ?? [];
+    const extensions = [];
+    if (registrations.length > this.limits.extensions)
+      throw new RangeError("Realm extension limit exceeded.");
+    for (let index = 0; index < registrations.length; index++) {
+      const descriptor = Object.getOwnPropertyDescriptor(registrations, String(index));
+      if (descriptor === void 0 || !("value" in descriptor))
+        throw new TypeError("Extension registrations require data properties, not accessors.");
+      extensions.push(descriptor.value);
+    }
+    if (Reflect.ownKeys(registrations).length !== extensions.length + 1)
+      throw new TypeError("Extension registrations have unsupported fields.");
+    this.extensions = Object.freeze(extensions);
+    if (this.extensions.length > this.limits.extensions)
+      throw new RangeError("Realm extension limit exceeded.");
+    this.globals = readDataRecord(options.bindings ?? {}, "Realm bindings");
+    this.modules = readModules(options.modules);
+    const grants = new Set(readStringList(options.grants ?? [], "Realm grants"));
+    for (const extension of this.extensions) getExtensionSetup(extension);
+    this.budget = options.budget ?? new Budget({ maxCallDepth: 1e3 });
+    this.lease = this.budget.acquireCompileOwner(true);
+    this.compilation = new CompileScope(this.lease.owner);
+    this.bridge = {
+      owner: this,
+      assertActive: this.assertOpen,
+      wrapCallback: this.wrapCallback,
+      captureArguments: this.captureArguments,
+      invoke: this.invokeHost,
+      awaitResult: (operation) => this.nestedOperations.has(operation)
+    };
+    try {
+      this.builtinBindings = createBuiltinBindings({
+        budget: this.budget,
+        compileOwner: this.lease.owner,
+        sink: options.sink,
+        clock: options.clock,
+        random: createReplayableRandom({ seed: options.randomSeed }).next
+      });
+      const names = /* @__PURE__ */ new Set();
+      const globals = /* @__PURE__ */ new Set([...Object.keys(this.builtinBindings), ...Object.keys(this.globals)]);
+      const modules = new Map(
+        Object.entries(this.modules).map(([name, exports]) => [name, new Set(Object.keys(exports))])
+      );
+      for (const extension of this.extensions) {
+        const manifest = extension.manifest;
+        if (names.has(manifest.name))
+          throw new TypeError(`Duplicate extension '${manifest.name}'.`);
+        names.add(manifest.name);
+        for (const capability of manifest.capabilities ?? []) {
+          if (!grants.has(capability))
+            throw new TypeError(`Missing grant '${capability}' for extension '${manifest.name}'.`);
+        }
+        for (const name of manifest.globals ?? []) {
+          if (globals.has(name)) throw new TypeError(`Conflicting global '${name}'.`);
+          globals.add(name);
+        }
+        for (const [name, exports] of Object.entries(manifest.modules ?? {})) {
+          const occupied = modules.get(name) ?? /* @__PURE__ */ new Set();
+          for (const key of exports) {
+            if (occupied.has(key)) throw new TypeError(`Conflicting export '${name}.${key}'.`);
+            occupied.add(key);
+          }
+          modules.set(name, occupied);
+        }
+      }
+      options.signal?.addEventListener("abort", this.abort, { once: true });
+      if (options.signal?.aborted) this.abort();
+      this.budget.setRetainedValues(this, this.retainedRoots);
+      this.tracker.onFatalRejection((error) => this.poison(error));
+    } catch (error) {
+      this.compilation.dispose();
+      this.lease.release();
+      throw error;
+    }
+  }
+  options;
+  budget;
+  lease;
+  compilation;
+  controller = new AbortController();
+  phase = new AsyncLocalStorage6();
+  queue = new SandboxJobQueue();
+  tracker = createSandboxPromiseRejectionTracker();
+  bridge;
+  limits;
+  extensions;
+  cleanups = [];
+  callbacks = /* @__PURE__ */ new Map();
+  pendingCallbacks = /* @__PURE__ */ new Set();
+  callbackCache = /* @__PURE__ */ new WeakMap();
+  hostObjects = /* @__PURE__ */ new Set();
+  guestReferences = /* @__PURE__ */ new Map();
+  retainedOperations = /* @__PURE__ */ new WeakMap();
+  nestedOperations = /* @__PURE__ */ new WeakMap();
+  convertedModules = /* @__PURE__ */ new Map();
+  nativeConversions = { seen: /* @__PURE__ */ new WeakMap() };
+  modules;
+  globals;
+  builtinBindings;
+  scope;
+  active;
+  disposal;
+  closed = false;
+  initialized = false;
+  nestedDepth = 0;
+  failure;
+  bridgeOptions = () => ({
+    budget: this.budget,
+    compileOwner: this.lease.owner,
+    signal: this.controller.signal,
+    realm: this.bridge
+  });
+  retainedRoots = () => [
+    ...this.callbacks.values(),
+    ...Array.from(this.pendingCallbacks, (pending) => pending.closure),
+    ...this.guestReferences.values()
+  ];
+  captureArguments = (operation, args, copy) => {
+    const from = this.retainedOperations.get(operation)?.from ?? args.length;
+    const values = copy(args.slice(0, from));
+    const captured = [];
+    const rollback = () => {
+      for (const reference of captured) {
+        revokeGuestReference(reference, this);
+        this.guestReferences.delete(reference);
+      }
+    };
+    try {
+      for (const value of args.slice(from)) {
+        this.checkCollection(
+          this.guestReferences.size + 1,
+          this.limits.guestReferences,
+          "guest reference"
+        );
+        const root = [value];
+        const reference = createGuestReference(root, this, this.assertOpen);
+        this.guestReferences.set(reference, root);
+        captured.push(reference);
+        values.push(reference);
+      }
+      if (captured.length > 0)
+        this.budget.reconcileDataUsage(
+          measureSandboxData([...this.scope?.retainedValues() ?? [], ...this.retainedRoots()])
+        );
+      return { args: values, rollback };
+    } catch (error) {
+      rollback();
+      if (error instanceof SandboxError) this.poison(error);
+      throw error;
+    }
+  };
+  releaseGuestReference = (reference) => {
+    readGuestReference(reference, this);
+    revokeGuestReference(reference, this);
+    this.guestReferences.delete(reference);
+    if (this.active === void 0)
+      reconcileCompiledValues(
+        this.budget,
+        [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+        this.compilation
+      );
+  };
+  assertOpen = () => {
+    if (this.failure !== void 0) throw this.failure.reason;
+    if (this.closed) throw new Error("SafeJS realm is closed; capabilities are revoked.");
+    this.controller.signal.throwIfAborted();
+  };
+  abort = () => {
+    this.poison(this.options.signal?.reason ?? new SandboxError("aborted"));
+    void this.close().catch(() => void 0);
+  };
+  poison(reason) {
+    this.failure ??= { reason };
+    this.controller.abort(reason);
+    if (this.active === void 0)
+      queueMicrotask(() => {
+        void this.dispose().catch(() => void 0);
+      });
+  }
+  chargeWork = (units = 1) => {
+    this.assertOpen();
+    if (!Number.isSafeInteger(units) || units < 0)
+      throw new TypeError("Work charges must be non-negative safe integers.");
+    try {
+      for (let index = 0; index < units; index++) this.budget.visitNode();
+    } catch (error) {
+      this.poison(error);
+      throw error;
+    }
+  };
+  onCleanup = (cleanup) => {
+    this.assertOpen();
+    if (typeof cleanup !== "function") throw new TypeError("Cleanup must be a function.");
+    this.checkCollection(this.cleanups.length + 1, this.limits.cleanups, "cleanup");
+    this.cleanups.push(cleanup);
+  };
+  checkCollection(count, limit, name) {
+    this.assertOpen();
+    try {
+      this.budget.allocateCollectionEntries(count);
+    } catch (error) {
+      this.poison(error);
+      throw error;
+    }
+    if (count > limit) throw new RangeError(`Realm ${name} limit exceeded.`);
+  }
+  invokeHost = (operation, call) => {
+    this.assertOpen();
+    const phase = {
+      active: true,
+      extension: this.nestedOperations.get(operation),
+      evaluating: false,
+      pending: /* @__PURE__ */ new Set()
+    };
+    return this.phase.run(phase, () => {
+      try {
+        const result = call();
+        if (types4.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+          return Promise.resolve(result).then(
+            async (value) => {
+              await Promise.allSettled(phase.pending);
+              if (phase.failure !== void 0) throw phase.failure.reason;
+              this.assertOpen();
+              return value;
+            },
+            async (error) => {
+              if (error instanceof SandboxError || phase.pending.size > 0) this.poison(error);
+              await Promise.allSettled(phase.pending);
+              throw error;
+            }
+          ).finally(() => {
+            phase.active = false;
+          });
+        }
+        this.assertOpen();
+        phase.active = false;
+        return result;
+      } catch (error) {
+        phase.active = false;
+        if (error instanceof SandboxError) this.poison(error);
+        if (phase.pending.size > 0) {
+          this.poison(error);
+          return Promise.allSettled(phase.pending).then(() => {
+            throw error;
+          });
+        }
+        throw error;
+      }
+    });
+  };
+  importValue(value) {
+    return copyHostValueToSandbox(
+      value,
+      [],
+      this.bridgeOptions(),
+      { seen: /* @__PURE__ */ new WeakMap() },
+      "<realm>"
+    );
+  }
+  exportValue(value) {
+    return deepCopyFromSandbox(value, {
+      compilation: this.compilation,
+      wrapClosure: this.wrapCallback,
+      unwrapHostObject: (object) => exportHostCapability(object, this)
+    });
+  }
+  createHostObject = (definition) => {
+    this.checkCollection(this.hostObjects.size + 1, this.limits.hostObjects, "host object");
+    const object = createLiveHostObject(definition, {
+      owner: this,
+      assertActive: this.assertOpen,
+      chargeWork: this.chargeWork,
+      read: (operation) => {
+        const value = this.invokeHost(operation, operation);
+        if (types4.isPromise(value)) {
+          void Promise.resolve(value).catch(() => void 0);
+          throw new TypeError("Live property getters must be synchronous.");
+        }
+        return this.importValue(value);
+      },
+      write: (operation, value) => {
+        const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
+        if (types4.isPromise(result)) {
+          void Promise.resolve(result).catch(() => void 0);
+          throw new TypeError("Live property setters must be synchronous.");
+        }
+      },
+      method: (operation) => {
+        const value = copyHostValueToSandbox(
+          operation,
+          [],
+          this.bridgeOptions(),
+          this.nativeConversions,
+          "<host-method>"
+        );
+        if (!isSandboxClosure(value)) throw new TypeError("Invalid host method.");
+        return value;
+      }
+    });
+    this.hostObjects.add(object);
+    try {
+      this.budget.chargeDataUsage(1);
+    } catch (error) {
+      this.poison(error);
+      throw error;
+    }
+    return object;
+  };
+  wrapCallback = (closure) => {
+    this.assertOpen();
+    const existing = this.callbackCache.get(closure);
+    if (existing !== void 0 && this.callbacks.has(existing)) return existing;
+    this.checkCollection(this.callbacks.size + 1, this.limits.callbacks, "callback");
+    const invokeCallback = this.invokeCallback;
+    const callback = function(...args) {
+      return invokeCallback(callback, { args, thisValue: this });
+    };
+    this.callbacks.set(callback, closure);
+    this.callbackCache.set(closure, callback);
+    registerGuestCallback(callback, {
+      owner: this,
+      closure,
+      assertActive: () => {
+        this.assertOpen();
+        if (!this.callbacks.has(callback)) throw new TypeError("Guest callback is revoked.");
+      }
+    });
+    try {
+      this.budget.reconcileDataUsage(
+        measureSandboxData([...this.scope?.retainedValues() ?? [], ...this.retainedRoots()])
+      );
+    } catch (error) {
+      this.poison(error);
+      throw error;
+    }
+    return callback;
+  };
+  releaseCallback = (callback) => {
+    readGuestCallback(callback, this);
+    revokeGuestCallback(callback, this);
+    this.callbacks.delete(callback);
+    if (this.active === void 0)
+      reconcileCompiledValues(
+        this.budget,
+        [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+        this.compilation
+      );
+  };
+  invokeCallback = async (callback, options = {}) => {
+    if (this.closed || this.failure !== void 0) await this.dispose();
+    this.assertOpen();
+    const closure = readGuestCallback(callback, this);
+    this.checkCollection(this.pendingCallbacks.size + 1, this.limits.callbacks, "pending callback");
+    const record2 = { closure };
+    this.pendingCallbacks.add(record2);
+    const invoke = async () => {
+      this.assertOpen();
+      readGuestCallback(callback, this);
+      const leave = enterRunningState(closure);
+      const leaveCall = this.budget.enterCall();
+      try {
+        const values = this.importValue([
+          options.thisValue,
+          [...options.args ?? []]
+        ]);
+        const value = await closure.call(values[1], {
+          thisValue: values[0],
+          compilation: this.compilation,
+          stack: []
+        });
+        const settled = await suspendJob(
+          awaitSandboxValue(value, this.controller.signal, this.budget)
+        );
+        return this.exportValue(settled);
+      } finally {
+        leaveCall();
+        leave();
+      }
+    };
+    try {
+      if (this.active !== void 0) {
+        record2.promise = withSandboxPromiseRejectionTracker(
+          this.tracker,
+          () => runResources.run(
+            { signal: this.controller.signal, add: this.onCleanup },
+            () => withCancellationSignal(
+              this.controller.signal,
+              () => this.phase.getStore()?.active ? runAsyncPrefix(invoke) : this.queue.run(invoke)
+            )
+          )
+        );
+      } else {
+        record2.promise = this.perform(() => this.queue.run(invoke));
+      }
+      return await record2.promise;
+    } catch (error) {
+      if (error instanceof SandboxError) this.poison(error);
+      throw error;
+    } finally {
+      this.pendingCallbacks.delete(record2);
+      if (!this.closed && this.active === void 0)
+        reconcileCompiledValues(
+          this.budget,
+          [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+          this.compilation
+        );
+    }
+  };
+  initialize() {
+    if (this.initialized) return;
+    this.assertOpen();
+    this.initialized = true;
+    for (const extension of this.extensions) {
+      const context = Object.freeze({
+        signal: this.controller.signal,
+        onCleanup: this.onCleanup,
+        chargeWork: this.chargeWork,
+        createHostObject: this.createHostObject,
+        invokeCallback: this.invokeCallback,
+        releaseCallback: this.releaseCallback,
+        releaseGuestReference: this.releaseGuestReference,
+        retainGuestArguments: (operation, from) => {
+          this.assertOpen();
+          if (!extension.manifest.capabilities?.includes("guest:retain"))
+            throw new TypeError("Retaining arguments requires the guest:retain grant.");
+          if (typeof operation !== "function")
+            throw new TypeError("Retained operation must be a function.");
+          if (!Number.isSafeInteger(from) || from < 0)
+            throw new TypeError("Argument index must be a non-negative safe integer.");
+          if (this.scope !== void 0)
+            throw new TypeError("Retained operations must be registered during setup.");
+          const previous = this.retainedOperations.get(operation);
+          if (previous !== void 0 && (previous.extension !== extension || previous.from !== from))
+            throw new TypeError("Conflicting retained operation declaration.");
+          this.retainedOperations.set(operation, { extension, from });
+          return operation;
+        },
+        nestedOperation: (operation) => {
+          this.assertOpen();
+          if (!extension.manifest.capabilities?.includes("source:nested"))
+            throw new TypeError("Nested source requires the source:nested grant.");
+          if (typeof operation !== "function")
+            throw new TypeError("Nested operation must be a function.");
+          if (this.scope !== void 0)
+            throw new TypeError("Nested operations must be registered during setup.");
+          const owner = this.nestedOperations.get(operation);
+          if (owner !== void 0 && owner !== extension)
+            throw new TypeError("Nested operation already belongs to another extension.");
+          this.nestedOperations.set(operation, extension);
+          return operation;
+        },
+        evaluateNested: (source) => {
+          const phase = this.phase.getStore();
+          if (!extension.manifest.capabilities?.includes("source:nested") || !phase?.active || phase.extension !== extension || phase.evaluating) {
+            const error = new SandboxError("reentry");
+            this.poison(error);
+            const rejected = Promise.reject(error);
+            void rejected.catch(() => void 0);
+            return rejected;
+          }
+          const pending = this.evaluateNested(source, extension);
+          phase.pending.add(pending);
+          void pending.then(
+            () => {
+              phase.pending.delete(pending);
+            },
+            (reason) => {
+              phase.pending.delete(pending);
+              phase.failure ??= { reason };
+            }
+          );
+          return pending;
+        }
+      });
+      const output = getExtensionSetup(extension)(context);
+      if (types4.isPromise(output)) {
+        void Promise.resolve(output).catch(() => void 0);
+        throw new TypeError("Extension setup must be synchronous.");
+      }
+      const exports = readDataRecord(output, "Extension exports");
+      if (Object.keys(exports).some((key) => key !== "globals" && key !== "modules"))
+        throw new TypeError("Unknown extension export field.");
+      const globals = readDataRecord(
+        exports.globals ?? {},
+        "Extension globals"
+      );
+      const modules = readModules(exports.modules);
+      assertNames(Object.keys(globals), extension.manifest.globals ?? [], "global");
+      assertNames(Object.keys(modules), Object.keys(extension.manifest.modules ?? {}), "module");
+      for (const [name, values] of Object.entries(modules)) {
+        assertNames(Object.keys(values), extension.manifest.modules?.[name] ?? [], "module export");
+        this.modules[name] ??= /* @__PURE__ */ Object.create(null);
+        Object.assign(this.modules[name], values);
+      }
+      Object.assign(this.globals, globals);
+    }
+    const bindings = wrapCallerInjectedBindings(this.globals, this.bridgeOptions());
+    this.scope = new Scope(this.builtinBindings, void 0, void 0, { chargeData: false }).child(
+      bindings,
+      { functionBoundary: true }
+    );
+  }
+  async evaluateRaw(source, filename = "<realm>", nested = false) {
+    this.assertOpen();
+    if (typeof source !== "string") throw new TypeError("Realm source must be a string.");
+    const module = parseExecutableModule(source, filename, this.lease.owner);
+    this.initialize();
+    const imports = resolveModuleImports(module, this.modules, {
+      ...this.bridgeOptions(),
+      wrappedModules: this.convertedModules
+    });
+    for (const [name, value] of Object.entries(imports)) {
+      const binding = this.scope.lookup(name);
+      if (!binding.found) this.scope.declare(name, "const", value);
+      else if (binding.value !== value) throw new TypeError(`Conflicting import '${name}'.`);
+    }
+    const result = await interpret(
+      {
+        type: "BlockStatement",
+        body: module.body.filter((statement) => statement.type !== "ImportDeclaration"),
+        span: module.span
+      },
+      {
+        scope: this.scope,
+        useScopeDirectly: true,
+        budget: this.budget,
+        compilation: this.compilation,
+        signal: this.controller.signal,
+        surfaceUnhandledThrows: true,
+        jobs: this.queue,
+        nested,
+        assertActive: this.assertOpen
+      }
+    );
+    this.assertOpen();
+    return result;
+  }
+  evaluateNested = async (source, extension) => {
+    this.assertOpen();
+    const phase = this.phase.getStore();
+    if (!phase?.active || phase.extension !== extension || phase.evaluating || this.active === void 0)
+      throw new SandboxError("reentry");
+    const leave = this.budget.enterCall();
+    phase.evaluating = true;
+    try {
+      if (++this.nestedDepth > this.limits.nestedEvaluations) {
+        const error = new SandboxError({
+          budget: "callDepth",
+          current: this.nestedDepth,
+          limit: this.limits.nestedEvaluations
+        });
+        this.poison(error);
+        throw error;
+      }
+      const result = await this.evaluateRaw(source, "<nested>", true);
+      if (!result.ok) throw new Error(result.error.message);
+    } finally {
+      this.nestedDepth--;
+      phase.evaluating = false;
+      leave();
+    }
+  };
+  evaluate = async (source, options = {}) => this.perform(async () => {
+    const result = await this.evaluateRaw(source, options.filename);
+    if (!result.ok) {
+      await this.dispose();
+      return { ok: false, error: result.error, stats: result.stats };
+    }
+    return { ok: true, returnValue: this.exportValue(result.returnValue), stats: result.stats };
+  });
+  async perform(task) {
+    if (this.closed || this.failure !== void 0) await this.dispose();
+    this.assertOpen();
+    if (this.active !== void 0) throw new SandboxError("reentry");
+    const pending = Promise.resolve().then(
+      () => withSandboxPromiseRejectionTracker(
+        this.tracker,
+        () => runResources.run(
+          { signal: this.controller.signal, add: this.onCleanup },
+          () => withCancellationSignal(this.controller.signal, task)
+        )
+      )
+    );
+    this.active = pending;
+    try {
+      const result = await pending;
+      await this.queue.drain();
+      const unhandled = await this.tracker.findUnhandledRejection();
+      if (unhandled !== void 0) {
+        const error = new Error(
+          `Unhandled guest promise rejection: ${describeThrownValue(unhandled.reason)}`
+        );
+        error.name = "UnhandledRejectionError";
+        throw error;
+      }
+      if (this.failure !== void 0) throw this.failure.reason;
+      if (!this.closed)
+        reconcileCompiledValues(
+          this.budget,
+          [...this.scope?.retainedValues() ?? [], ...this.retainedRoots()],
+          this.compilation
+        );
+      return result;
+    } catch (error) {
+      this.poison(error);
+      try {
+        await this.dispose();
+      } catch (cleanup) {
+        throw new AggregateError([error, cleanup], "Realm execution and cleanup failed.");
+      }
+      throw error;
+    } finally {
+      this.active = void 0;
+    }
+  }
+  close = () => {
+    this.closed = true;
+    this.controller.abort(new Error("SafeJS realm is closed."));
+    if (this.phase.getStore()?.active) return this.dispose();
+    return Promise.allSettled([
+      this.active,
+      ...Array.from(this.pendingCallbacks, (pending) => pending.promise)
+    ]).then(() => this.dispose());
+  };
+  dispose() {
+    if (this.disposal !== void 0) return this.disposal;
+    this.closed = true;
+    this.controller.abort(new Error("SafeJS realm is closed."));
+    this.options.signal?.removeEventListener("abort", this.abort);
+    for (const callback of this.callbacks.keys()) revokeGuestCallback(callback, this);
+    this.callbacks.clear();
+    for (const object of this.hostObjects) revokeHostObject(object, this);
+    this.hostObjects.clear();
+    for (const reference of this.guestReferences.keys()) revokeGuestReference(reference, this);
+    this.guestReferences.clear();
+    this.budget.setRetainedValues(this, void 0);
+    this.disposal = (async () => {
+      const errors = [];
+      for (const cleanup of this.cleanups.splice(0).reverse()) {
+        try {
+          await cleanup();
+        } catch (error) {
+          errors.push(error);
+        }
+      }
+      this.scope = void 0;
+      this.convertedModules.clear();
+      for (const key of Object.keys(this.globals)) delete this.globals[key];
+      for (const key of Object.keys(this.modules)) delete this.modules[key];
+      for (const key of Object.keys(this.builtinBindings))
+        Reflect.deleteProperty(this.builtinBindings, key);
+      this.nativeConversions.seen = /* @__PURE__ */ new WeakMap();
+      reconcileCompiledValues(this.budget, [], this.compilation);
+      this.compilation.dispose();
+      this.lease.release();
+      if (errors.length > 0) throw new AggregateError(errors, "Realm cleanup failed.");
+    })();
+    return this.disposal;
+  }
+};
+function readModules(input) {
+  const entries = (value, label) => {
+    if (types4.isMap(value) && !types4.isProxy(value)) {
+      const result = [...Map.prototype.entries.call(value)];
+      if (result.length > 4096 || result.some(([key]) => typeof key !== "string" || key.length === 0))
+        throw new TypeError(`${label} requires bounded string keys.`);
+      return result;
+    }
+    return Object.entries(readDataRecord(value, label));
+  };
+  const modules = /* @__PURE__ */ Object.create(null);
+  for (const [name, exports] of entries(input ?? {}, "Module registry")) {
+    const exported = /* @__PURE__ */ Object.create(null);
+    for (const [key, value] of entries(exports, "Module exports"))
+      exported[key] = value;
+    modules[name] = exported;
+  }
+  return modules;
+}
+function assertNames(actual, expected, label) {
+  if (actual.length !== expected.length || actual.some((name) => !expected.includes(name)))
+    throw new TypeError(`Extension ${label} names do not match its manifest.`);
+}
+function createRealm(options = {}) {
+  const state = new RealmState(readRealmOptions(options));
+  return Object.freeze({
+    extensions: Object.freeze(state.extensions.map((extension) => extension.manifest)),
+    evaluate: state.evaluate,
+    invokeCallback: state.invokeCallback,
+    releaseCallback: state.releaseCallback,
+    releaseGuestReference: state.releaseGuestReference,
+    close: state.close
+  });
+}
+async function runWithExtensions(source, options) {
+  if (options.snapshot !== void 0 || options.snapshotBackend !== void 0 || options.snapshotPath !== void 0 || options.entryPointArgs !== void 0)
+    throw new TypeError(
+      "Live extension runs do not support snapshots or entryPointArgs; use a persistent realm."
+    );
+  const state = new RealmState(readRealmOptions(options, true));
+  try {
+    const result = await state.perform(() => state.evaluateRaw(source, options.filename));
+    if (result.ok) encodeReplayData(result.returnValue);
+    return {
+      ...result,
+      snapshot: {
+        version: 1,
+        sourceHash: hashSource(source),
+        bindings: {},
+        replayError: "Live realm state cannot be serialized or replayed."
+      }
+    };
+  } catch (error) {
+    if (state.disposal === void 0) {
+      try {
+        await state.close();
+      } catch (cleanupError) {
+        throw new AggregateError([error, cleanupError], "Realm execution and cleanup failed.");
+      }
+    }
+    throw error;
+  } finally {
+    if (state.disposal === void 0) await state.close();
+  }
+}
+function readRealmOptions(value, oneShot = false) {
+  const options = readDataRecord(value, "Realm options");
+  const supported = /* @__PURE__ */ new Set([
+    "bindings",
+    "modules",
+    "extensions",
+    "grants",
+    "budget",
+    "signal",
+    "sink",
+    "randomSeed",
+    "clock",
+    "limits"
+  ]);
+  for (const [key, entry] of Object.entries(options)) {
+    if (supported.has(key) || oneShot && (key === "filename" || entry === void 0)) continue;
+    throw new TypeError(`Unsupported ${oneShot ? "extension-run" : "realm"} option '${key}'.`);
+  }
+  return options;
+}
+
+// packages/safe-js/src/snapshot/dump.ts
+var RUN_DUMP_CONTROLLER = /* @__PURE__ */ Symbol("SafeJS.run-dump-controller");
+function attachDumpController(result, controller) {
+  Object.defineProperty(result, RUN_DUMP_CONTROLLER, {
+    configurable: false,
+    enumerable: false,
+    value: controller,
+    writable: false
+  });
+  return result;
+}
+function createDumpController(lifecycle) {
+  let finished = false;
+  let failed;
+  let finalSnapshot;
+  let latestSnapshot;
+  let latestSnapshotFactory;
+  let pendingRequest;
+  return {
+    fail(error) {
+      finished = true;
+      failed = {
+        error
+      };
+      if (pendingRequest === void 0) {
+        return;
+      }
+      pendingRequest.reject(error);
+      pendingRequest = void 0;
+    },
+    finalize(snapshot) {
+      finished = true;
+      finalSnapshot = snapshot;
+      latestSnapshot = snapshot;
+      latestSnapshotFactory = void 0;
+      if (pendingRequest !== void 0) {
+        settlePendingSnapshot(snapshot);
+      }
+    },
+    onYield(createSnapshot) {
+      latestSnapshot = void 0;
+      latestSnapshotFactory = createSnapshot;
+      if (pendingRequest === void 0) {
+        return;
+      }
+      settlePendingSnapshot(createSnapshot());
+    },
+    requestCurrentSnapshot(options = {}) {
+      assertDumpAllowed(options);
+      if (failed !== void 0) {
+        return Promise.reject(failed.error);
       }
-      if (result.done) break;
-      const entry = result.value;
-      if (typeof entry !== "object" && typeof entry !== "function" || entry === null) {
-        throw new TypeError("Object.fromEntries requires entry objects.");
+      if (latestSnapshot !== void 0 || latestSnapshotFactory !== void 0) {
+        try {
+          return Promise.resolve(serializeRunSnapshot(latestSnapshot ?? latestSnapshotFactory()));
+        } catch (error) {
+          return Promise.reject(error);
+        }
       }
-      const key = entry[0];
-      const value = entry[1];
-      Object.defineProperty(object, key, {
-        configurable: true,
-        enumerable: true,
-        value,
-        writable: true
+      return this.requestSnapshot(options);
+    },
+    requestSnapshot(options = {}) {
+      assertDumpAllowed(options);
+      if (failed !== void 0) {
+        if ((options.onFailure === "checkpoint" || options.onFailure === void 0 && isDataBudgetError(failed.error)) && finalSnapshot !== void 0) {
+          try {
+            return Promise.resolve(serializeRunSnapshot(finalSnapshot));
+          } catch (error) {
+            return Promise.reject(error);
+          }
+        }
+        return Promise.reject(failed.error);
+      }
+      if (finished) {
+        if (finalSnapshot === void 0) {
+          throw new Error("Run completed without producing a snapshot.");
+        }
+        try {
+          const serializedSnapshot = serializeRunSnapshot(finalSnapshot);
+          return Promise.resolve(serializedSnapshot);
+        } catch (error) {
+          return Promise.reject(error);
+        }
+      }
+      if (options.mode === "replay" && (latestSnapshot !== void 0 || latestSnapshotFactory !== void 0)) {
+        return this.requestCurrentSnapshot(options);
+      }
+      if (pendingRequest !== void 0) {
+        return pendingRequest.promise;
+      }
+      let resolveSnapshot = () => void 0;
+      let rejectSnapshot = () => void 0;
+      const promise = new Promise((resolve, reject) => {
+        resolveSnapshot = resolve;
+        rejectSnapshot = reject;
       });
+      pendingRequest = {
+        promise,
+        reject: rejectSnapshot,
+        resolve: resolveSnapshot
+      };
+      return promise;
     }
-  } catch (error) {
-    try {
-      await iterator.return?.();
-    } catch {
-      throw error;
+  };
+  function assertDumpAllowed(options) {
+    if ((lifecycle?.hostCallbackDepth ?? 0) > 0 && (options.mode !== "replay" || lifecycle?.hostCallbackContext.getStore() === true)) {
+      throw new SandboxError("reentry");
     }
-    throw error;
-  }
-  return allocateProducedSandboxValue(object, budget);
-}
-function assignSandboxValues(target, sources, budget) {
-  if (target === null || target === void 0) {
-    throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
   }
-  if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
-    throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
-  }
-  for (const source of sources) {
-    if (source === null || source === void 0) {
-      continue;
+  function settlePendingSnapshot(snapshot) {
+    try {
+      settlePendingRequest(serializeRunSnapshot(snapshot));
+    } catch (error) {
+      pendingRequest?.reject(error);
+      pendingRequest = void 0;
     }
-    for (const [key, value] of ownEnumerableSandboxEntries(source)) {
-      setSandboxProperty(target, key, value, budget);
+  }
+  function settlePendingRequest(snapshot) {
+    if (pendingRequest === void 0) {
+      return;
     }
+    pendingRequest.resolve(snapshot);
+    pendingRequest = void 0;
   }
-  return target;
 }
-function objectProperties(value, mutable = false) {
-  if (isGuestClosure(value)) return materializeFunctionProperties(value);
-  if (isSandboxClosure(value)) {
-    if (mutable) throw new TypeError("Host function properties are read only.");
-    return value.properties ?? /* @__PURE__ */ Object.create(null);
-  }
-  if (!isAssignableSandboxTarget(value)) throw new TypeError("Expected a sandbox object or function.");
-  return value;
+function isDataBudgetError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "budgetExceeded" && "budget" in error && error.budget === "dataSize";
 }
-function dataDescriptor(input) {
-  const source = objectProperties(input);
-  const descriptor = {};
-  for (const field of ["get", "set", "value", "writable", "enumerable", "configurable"]) {
-    const entry = Object.getOwnPropertyDescriptor(source, field);
-    if (entry === void 0) continue;
-    if (!("value" in entry) || field === "get" || field === "set") {
-      throw new TypeError("Only data property descriptors are supported.");
+function dump(result, options = {}) {
+  const controller = readDumpController(result);
+  if (controller !== void 0) {
+    return controller.requestSnapshot(options);
+  }
+  if (hasSnapshot(result)) {
+    try {
+      return Promise.resolve(serializeRunSnapshot(result.snapshot));
+    } catch (error) {
+      return Promise.reject(error);
     }
-    if (field === "value") descriptor.value = entry.value;
-    else descriptor[field] = Boolean(entry.value);
   }
-  return descriptor;
-}
-function defineDataProperty2(target, key, descriptor, budget) {
-  budget.visitNode();
-  if (isFloat32Array(target)) throw new TypeError("Typed array property descriptors are not supported.");
-  const properties = objectProperties(target, true);
-  if (Array.isArray(properties)) {
-    if (key === "length" && "value" in descriptor) budget.allocateArrayLength(Number(descriptor.value));
-    else {
-      const index = Number(key);
-      if (Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key) {
-        budget.allocateArrayLength(index + 1);
-      }
+  return Promise.resolve(result).then((resolved) => {
+    if (!hasSnapshot(resolved)) {
+      throw new Error("Run completed without producing a snapshot.");
     }
+    return serializeRunSnapshot(resolved.snapshot);
+  });
+}
+function dumpCurrent(result) {
+  const controller = readDumpController(result);
+  if (controller !== void 0) {
+    return controller.requestCurrentSnapshot();
   }
-  Object.defineProperty(properties, key, descriptor);
-  markDescriptorObject(properties);
+  return dump(result);
 }
-function isAssignableSandboxTarget(value) {
-  return typeof value === "object" && value !== null && !isSandboxClosure(value) && !isSandboxGenerator(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isSandboxPromise(value) && !isSandboxRegex(value);
+function serializeRunSnapshot(snapshot) {
+  return serializeSafeJSSnapshot(snapshot);
 }
-async function arrayFromSandboxValues(args, budget) {
-  const [items, mapFn, thisValue] = args;
-  const iterator = getSandboxIterator(items);
-  const values = iterator === void 0 ? Reflect.apply(Array.from, Array, [items]) : await collectIteratorValues(iterator);
-  if (mapFn === void 0 || !isSandboxClosure(mapFn)) {
-    if (mapFn !== void 0) {
-      throw new TypeError("Array.from mapping callback must be a function.");
-    }
-    return budgetSandboxValue2(values, budget);
-  }
-  const mappedValues = [];
-  for (const [index, value] of values.entries()) {
-    const result = await mapFn.call([value, index], { stack: [], thisValue });
-    if (isSandboxPromise(result) && result.synchronousPrefix !== void 0) {
-      await result.synchronousPrefix;
-    }
-    mappedValues.push(result);
-  }
-  return budgetSandboxValue2(mappedValues, budget);
+function hasSnapshot(value) {
+  return typeof value === "object" && value !== null && Object.prototype.hasOwnProperty.call(value, "snapshot");
 }
-function createArrayFromConstructorArgs(args, budget) {
-  if (args.length !== 1) {
-    return budgetSandboxValue2(Reflect.apply(Array, Array, [...args]), budget);
-  }
-  const [lengthOrValue] = args;
-  if (typeof lengthOrValue !== "number") {
-    return budgetSandboxValue2([lengthOrValue], budget);
-  }
-  if (!Number.isInteger(lengthOrValue) || lengthOrValue < 0 || lengthOrValue > 4294967295) {
-    throw new RangeError("Invalid array length.");
+function readDumpController(value) {
+  if (typeof value !== "object" || value === null) {
+    return void 0;
   }
-  budget.allocateArrayLength(lengthOrValue);
-  return new Array(lengthOrValue);
+  return value[RUN_DUMP_CONTROLLER];
 }
-async function collectIteratorValues(iterator) {
-  const values = [];
-  while (true) {
-    const result = await iterator.next();
-    if (result.done) return values;
-    values.push(result.value);
+
+// packages/safe-js/src/error-codes.ts
+function getOwnErrorCode(error) {
+  if (typeof error !== "object" || error === null || !Object.prototype.hasOwnProperty.call(error, "code")) {
+    return void 0;
   }
+  const code = error.code;
+  return typeof code === "string" ? code : void 0;
 }
-function getOwnEnumerableKeys(value) {
-  return ownEnumerableSandboxEntries(value).map(([key]) => key);
-}
-function getOwnEnumerableValues(value) {
-  return ownEnumerableSandboxEntries(value).map(([, entryValue]) => entryValue);
-}
-function budgetSandboxValue2(value, budget) {
-  const sandboxValue = deepCopyToSandbox(value);
-  return allocateProducedSandboxValue(sandboxValue, budget);
+function hasOwnErrorCode(error, code) {
+  return getOwnErrorCode(error) === code;
 }
-function stringRaw(args, budget) {
-  const [template, ...substitutions] = args;
-  const raw = getTemplateRawParts(template);
-  let result = "";
-  for (let index = 0; index < raw.length; index += 1) {
-    result += String(raw[index]);
-    if (index < raw.length - 1 && index < substitutions.length) {
-      result += String(substitutions[index]);
-    }
+
+// packages/safe-js/src/snapshot/backend.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+var DEFAULT_WRITE_MAX_ATTEMPTS = 3;
+var DEFAULT_WRITE_RETRY_DELAY_MS = 100;
+var LOCKED_FILE_ERROR_CODES = /* @__PURE__ */ new Set(["EACCES", "EBUSY", "EPERM"]);
+var pendingOperations = /* @__PURE__ */ new Map();
+var FileSnapshotBackend = class {
+  constructor(path, options = {}) {
+    this.path = path;
+    this.#writeMaxAttempts = options.writeMaxAttempts ?? DEFAULT_WRITE_MAX_ATTEMPTS;
+    this.#writeRetryDelayMs = options.writeRetryDelayMs ?? DEFAULT_WRITE_RETRY_DELAY_MS;
   }
-  return budget.allocateString(result);
-}
-function getTemplateRawParts(template) {
-  const raw = typeof template === "object" && template !== null ? template.raw : void 0;
-  if (typeof template !== "object" || template === null || isSandboxClosure(template) || isSandboxPromise(template) || !Array.isArray(raw)) {
-    throw new TypeError("String.raw requires a raw strings array.");
+  path;
+  #writeMaxAttempts;
+  #writeRetryDelayMs;
+  async read() {
+    try {
+      return JSON.parse(await readFile(this.path, "utf8"));
+    } catch (error) {
+      if (hasErrorCode(error, "ENOENT")) {
+        return void 0;
+      }
+      if (error instanceof SyntaxError) {
+        throw new Error(`Failed to parse snapshot at ${this.path}: ${error.message}`);
+      }
+      throw error;
+    }
   }
-  return raw;
-}
-
-// packages/safe-js/src/modules/registry.ts
-function createUnknownModuleMessage2(moduleName, moduleNames) {
-  if (moduleNames.length === 0) {
-    return `Unknown module '${moduleName}'. No modules are registered.`;
+  async write(snapshot) {
+    await enqueueOperation(
+      this.path,
+      () => writeSnapshotAtomically(this.path, snapshot, {
+        maxAttempts: this.#writeMaxAttempts,
+        retryDelayMs: this.#writeRetryDelayMs
+      })
+    );
   }
-  return `Unknown module '${moduleName}'. Available modules: ${moduleNames.join(", ")}.`;
-}
-function createUnknownExportMessage2(moduleName, exportName, availableExports) {
-  if (availableExports.length === 0) {
-    return `Module '${moduleName}' does not export '${exportName}'. The module exports nothing.`;
+  async remove() {
+    await enqueueOperation(this.path, async () => {
+      try {
+        await unlink(this.path);
+      } catch (error) {
+        if (!hasErrorCode(error, "ENOENT")) {
+          throw error;
+        }
+      }
+    });
   }
-  return `Module '${moduleName}' does not export '${exportName}'. Available exports: ${availableExports.join(", ")}.`;
-}
-function resolveModuleImports(module, modules, options) {
-  const registry = normalizeModuleRegistry(modules);
-  const bindings = createBindingRecord();
-  const wrappedModules = /* @__PURE__ */ new Map();
-  for (const statement of module.body) {
-    if (statement.type !== "ImportDeclaration") {
-      continue;
+};
+async function writeSnapshotAtomically(snapshotPath, snapshot, options) {
+  const parentPath = dirname(snapshotPath);
+  const contents = serializeSafeJSSnapshot(snapshot);
+  await assertParentDirectoryExists(snapshotPath, parentPath);
+  for (let attempt = 1; attempt <= options.maxAttempts; attempt += 1) {
+    try {
+      const temporaryPath = `${snapshotPath}.${randomUUID2()}.tmp`;
+      await writeSnapshotOnce(temporaryPath, snapshotPath, contents);
+      return;
+    } catch (error) {
+      if (hasErrorCode(error, "EEXIST")) {
+        if (attempt === options.maxAttempts) {
+          throw new Error(
+            `Failed to write snapshot at ${snapshotPath} after ${options.maxAttempts} attempts: temporary path already exists`,
+            {
+              cause: error
+            }
+          );
+        }
+        continue;
+      }
+      if (!isLockedFileError(error)) {
+        throw error;
+      }
+      if (attempt === options.maxAttempts) {
+        throw new Error(
+          `Failed to write snapshot at ${snapshotPath} after ${options.maxAttempts} attempts: file is locked (${getOwnErrorCode(error)})`,
+          {
+            cause: error
+          }
+        );
+      }
+      await delay(options.retryDelayMs);
     }
-    bindImportDeclaration(statement, registry, wrappedModules, bindings, options);
   }
-  return bindings;
 }
-function bindImportDeclaration(declaration, registry, wrappedModules, bindings, options) {
-  const moduleName = declaration.source.value;
-  const moduleExports = registry.get(moduleName);
-  if (moduleExports === void 0) {
-    if (options.allowMissing) return;
-    throw createModuleImportError(
-      createUnknownModuleMessage2(moduleName, [...registry.keys()]),
-      declaration.source.span
-    );
-  }
-  const wrappedExports = wrappedModules.get(moduleName) ?? createBindingRecord(
-    wrapCancelableBindings(
-      wrapCallerInjectedBindings(Object.fromEntries(moduleExports), {
-        budget: options.budget,
-        compileOwner: options.compileOwner,
-        hostCalls: options.hostCalls,
-        moduleId: moduleName,
-        signal: options.signal
-      }),
-      options.signal
-    )
-  );
-  wrappedModules.set(moduleName, wrappedExports);
-  for (const specifier of declaration.specifiers) {
-    const localName = specifier.local.name;
-    if (Object.hasOwn(bindings, localName)) {
-      throw createModuleImportError(
-        `Cannot redeclare imported binding '${localName}'.`,
-        specifier.local.span
+async function assertParentDirectoryExists(snapshotPath, parentPath) {
+  try {
+    const parent = await stat(parentPath);
+    if (!parent.isDirectory()) {
+      throw new Error(
+        `Cannot write snapshot at ${snapshotPath}: parent path ${parentPath} is not a directory`
       );
     }
-    if (options.allowMissing && specifier.type !== "ImportNamespaceSpecifier") {
-      const exportName = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.imported.name;
-      if (!Object.hasOwn(wrappedExports, exportName)) continue;
+  } catch (error) {
+    if (hasErrorCode(error, "ENOENT")) {
+      throw new Error(
+        `Cannot write snapshot at ${snapshotPath}: parent directory ${parentPath} does not exist`,
+        {
+          cause: error
+        }
+      );
     }
-    bindings[localName] = resolveImportSpecifier(moduleName, specifier, wrappedExports);
+    throw error;
   }
 }
-function resolveImportSpecifier(moduleName, specifier, wrappedExports) {
-  if (specifier.type === "ImportNamespaceSpecifier") {
-    return wrappedExports;
-  }
-  const exportName = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.imported.name;
-  const exportedValue = wrappedExports[exportName];
-  if (exportedValue !== void 0 || Object.hasOwn(wrappedExports, exportName)) {
-    return exportedValue;
+async function writeSnapshotOnce(temporaryPath, snapshotPath, contents) {
+  let temporaryCreated = false;
+  let renamed = false;
+  try {
+    try {
+      await writeFile(temporaryPath, contents, { encoding: "utf8", flag: "wx" });
+      temporaryCreated = true;
+    } catch (error) {
+      if (!hasErrorCode(error, "EEXIST")) {
+        await removeTemporarySnapshot(temporaryPath).catch(() => void 0);
+      }
+      throw error;
+    }
+    await rename(temporaryPath, snapshotPath);
+    renamed = true;
+  } finally {
+    if (temporaryCreated && !renamed) {
+      await removeTemporarySnapshot(temporaryPath).catch(() => void 0);
+    }
   }
-  throw createModuleImportError(
-    createUnknownExportMessage2(moduleName, exportName, Object.keys(wrappedExports).sort()),
-    specifier.span
-  );
-}
-function createModuleImportError(message, span) {
-  const error = new Error(message);
-  attachErrorSpan(error, span);
-  return error;
 }
-function normalizeModuleRegistry(modules) {
-  if (modules === void 0) {
-    return /* @__PURE__ */ new Map();
+async function enqueueOperation(path, operation) {
+  const previous = pendingOperations.get(path) ?? Promise.resolve();
+  const pending = previous.catch(() => void 0).then(operation);
+  const queued = pending.catch(() => void 0);
+  pendingOperations.set(path, queued);
+  try {
+    await pending;
+  } finally {
+    if (pendingOperations.get(path) === queued) {
+      pendingOperations.delete(path);
+    }
   }
-  const entries = modules instanceof Map ? [...modules.entries()] : Object.entries(modules);
-  const registry = new Map(
-    entries.map(
-      ([moduleName, moduleExports]) => [moduleName, normalizeModuleExports(moduleExports)]
-    ).sort(([left], [right]) => left.localeCompare(right))
-  );
-  registerModuleHostOperationPolicies(registry);
-  return registry;
 }
-function registerModuleHostOperationPolicies(registry) {
-  for (const [moduleId, moduleExports] of registry) {
-    for (const [operation, value] of moduleExports) {
-      if (typeof value !== "function") {
-        continue;
-      }
-      const policy = readHostOperationPolicy(value);
-      if (policy !== void 0) {
-        registerPendingHostCallPolicy({ moduleId, operation, policy });
-      }
+async function removeTemporarySnapshot(temporaryPath) {
+  try {
+    await unlink(temporaryPath);
+  } catch (error) {
+    if (!hasErrorCode(error, "ENOENT")) {
+      throw error;
     }
   }
 }
-function normalizeModuleExports(moduleExports) {
-  const entries = moduleExports instanceof Map ? [...moduleExports.entries()] : Object.entries(moduleExports);
-  return new Map(
-    entries.filter(([exportName]) => exportName.length > 0).sort(([left], [right]) => left.localeCompare(right))
-  );
+async function delay(ms) {
+  if (ms === 0) {
+    return;
+  }
+  await new Promise((resolve) => setTimeout(resolve, ms));
 }
-function createBindingRecord(entries) {
-  return Object.assign(/* @__PURE__ */ Object.create(null), entries);
+function hasErrorCode(error, code) {
+  return hasOwnErrorCode(error, code);
+}
+function isLockedFileError(error) {
+  const code = getOwnErrorCode(error);
+  return code !== void 0 && LOCKED_FILE_ERROR_CODES.has(code);
 }
 
+// packages/safe-js/src/run.ts
+import { AsyncLocalStorage as AsyncLocalStorage7 } from "node:async_hooks";
+
 // packages/safe-js/src/snapshot/scheduler.ts
 var DEFAULT_SNAPSHOT_INTERVAL_MS = 3e4;
 function createSnapshotScheduler(options) {
@@ -30397,9 +31735,10 @@ var UnhandledRejectionError = class extends Error {
 };
 var DEFAULT_MAX_CALL_DEPTH = 1e3;
 function run(source, options = {}) {
+  if (options.extensions !== void 0) return runWithExtensions(source, options);
   const lifecycle = {
     hostCallbackDepth: 0,
-    hostCallbackContext: new AsyncLocalStorage6()
+    hostCallbackContext: new AsyncLocalStorage7()
   };
   const dumpController = createDumpController(lifecycle);
   const promiseTracker = createSandboxPromiseRejectionTracker();
@@ -30465,32 +31804,7 @@ function run(source, options = {}) {
               lifecycle
             })
           );
-          const builtinBindings = {
-            ...createConsoleJsonGlobals({
-              compileOwner: operation.owner,
-              budget,
-              hostCalls,
-              sink: options.sink
-            }),
-            ...createCollectionGlobals({ budget }),
-            Float32Array: createFloat32ArrayGlobal(budget),
-            ...createErrorGlobals({
-              budget
-            }),
-            ...createMathGlobals({
-              random: random?.generator.next
-            }),
-            ...createObjectArrayGlobals({
-              budget
-            }),
-            ...createMiscGlobals({
-              budget
-            }),
-            ...createPromiseGlobals({
-              budget
-            }),
-            ...createRegexGlobals(operation.owner)
-          };
+          const builtinBindings = createBuiltinBindings({ compileOwner: operation.owner, budget, hostCalls, sink: options.sink, random: random?.generator.next, clock: options.clock });
           const importMeta = convertInitialInput(
             () => deepCopyToSandbox(options.importMeta ?? {})
           );
@@ -30952,6 +32266,7 @@ export {
   parse,
   parseModule,
   hashSource,
+  defineExtension,
   noopOtelSink,
   bindOtelSpan,
   activateOtelSpan,
@@ -30980,10 +32295,11 @@ export {
   validateSnapshotMigration,
   restore,
   lint,
-  runResources,
+  declareHostOperation,
   createSeededRandom,
+  runResources,
   createReplayableRandom,
-  declareHostOperation,
+  createRealm,
   dump,
   dumpCurrent,
   getOwnErrorCode,
@@ -30991,4 +32307,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-B7H4ZL65.js.map
+//# sourceMappingURL=chunk-BWVASPJX.js.map