poe-code 14.0.61 → 14.0.63

package/packages/safe-js/dist/parse/parser.js

@@ -1,6 +1,7 @@
 import { boundIdentifiers } from "./bindings.js";
 import { tokenize } from "./tokenizer.js";
 import { assignIds } from "./assign-ids.js";
+import { functionSources } from "./function-source.js";
 import { formatParseError } from "./format-error.js";
 import { createExportDefaultDeclaration, createExportNamedDeclaration } from "./parse-export.js";
 import { createImportMeta, isImportMetaTokenSequence } from "./parse-import-meta.js";
@@ -42,7 +43,7 @@ const TOP_LEVEL_STATEMENT_KEYWORDS = new Set([
 export function parse(source, filename = "<input>", owner) {
     const compilation = new CompileScope(owner);
     try {
-        const result = assignIds(parseTokens(tokenize(source, { allowRegexLiterals: true, compilation }), compilation));
+        const result = assignIds(new Parser(tokenize(source, { allowRegexLiterals: true, compilation }), source, compilation).parseTopLevel());
         const regexLiteral = findRegexLiteral(result);
         if (regexLiteral !== undefined) {
             throw new Error(`Regular expression literals are not supported at line ${regexLiteral.span.start.line}, column ${regexLiteral.span.start.column}.`);
@@ -66,7 +67,7 @@ export function parse(source, filename = "<input>", owner) {
 export function parseModule(source, filename = "<input>", owner) {
     const compilation = new CompileScope(owner);
     try {
-        return assignIds(parseModuleTokens(tokenize(source, { allowRegexLiterals: true, compilation }), compilation));
+        return assignIds(new Parser(tokenize(source, { allowRegexLiterals: true, compilation }), source, compilation).parseModule());
     }
     catch (error) {
         if (error instanceof DisallowedSyntaxError || error instanceof SandboxError) {
@@ -84,7 +85,7 @@ export function parseModule(source, filename = "<input>", owner) {
 export function parseExecutableModule(source, filename = "<input>", owner) {
     const compilation = new CompileScope(owner);
     try {
-        const result = assignIds(parseModuleTokens(tokenize(source, { allowRegexLiterals: true, compilation }), compilation));
+        const result = assignIds(new Parser(tokenize(source, { allowRegexLiterals: true, compilation }), source, compilation).parseModule());
         throwIfImportMetaAssignment(result);
         return result;
     }
@@ -101,14 +102,9 @@ export function parseExecutableModule(source, filename = "<input>", owner) {
         compilation.dispose();
     }
 }
-function parseTokens(tokens, compilation) {
-    return new Parser(tokens, compilation).parseTopLevel();
-}
-function parseModuleTokens(tokens, compilation) {
-    return new Parser(tokens, compilation).parseModule();
-}
 class Parser {
     tokens;
+    source;
     compilation;
     functionContext;
     index = 0;
@@ -119,12 +115,21 @@ class Parser {
     scopes = [new Map()];
     functionScopes = new WeakSet();
     varNames = new WeakMap();
-    constructor(tokens, compilation, functionContext = "normal") {
+    constructor(tokens, source, compilation, functionContext = "normal") {
         this.tokens = tokens;
+        this.source = source;
         this.compilation = compilation;
         this.functionContext = functionContext;
         this.functionScopes.add(this.scopes[0]);
     }
+    withFunctionSource(node) {
+        functionSources.set(node, {
+            text: this.source,
+            start: node.span.start.offset,
+            end: node.span.end.offset
+        });
+        return node;
+    }
     parseTopLevel() {
         if (this.isExportToken(this.currentToken())) {
             throw new DisallowedSyntaxError("export", this.currentToken().start);
@@ -270,14 +275,14 @@ class Parser {
         });
         this.expectPunctuator("=>");
         const body = this.parseArrowFunctionBody(params);
-        return {
+        return this.withFunctionSource({
             type: "ArrowFunctionExpression",
             async: isAsync,
             body,
             expression: body.type !== "BlockStatement",
             params,
             span: createSpan(start, body.span.end)
-        };
+        });
     }
     parseConditionalExpression() {
         if (this.conditionalExpressionDepth >= MAX_CONDITIONAL_EXPRESSION_DEPTH) {
@@ -920,7 +925,7 @@ class Parser {
         });
         const generator = generatorToken !== undefined;
         const body = this.withFunctionContext(generator ? "generator" : "normal", () => this.parseBlockStatement(params));
-        return {
+        return this.withFunctionSource({
             type: "FunctionDeclaration",
             async: asyncToken !== undefined,
             body,
@@ -928,7 +933,7 @@ class Parser {
             id,
             params,
             span: createSpan(asyncToken?.start ?? functionToken.start, body.span.end)
-        };
+        });
     }
     parseVariableDeclarator(kind) {
         const id = this.parseBindingTarget();
@@ -1669,7 +1674,11 @@ class Parser {
                 continue;
             }
             if (this.currentToken().type === "template") {
-                const quasi = createTemplateLiteral(this.currentToken(), { allowMalformedEscapes: true, functionContext: this.functionContext }, this.compilation);
+                const quasi = createTemplateLiteral(this.currentToken(), {
+                    allowMalformedEscapes: true,
+                    functionContext: this.functionContext,
+                    source: this.source
+                }, this.compilation);
                 this.index += 1;
                 expression = {
                     node: {
@@ -1757,7 +1766,11 @@ class Parser {
         if (token.type === "template") {
             this.index += 1;
             return {
-                node: createTemplateLiteral(token, { allowMalformedEscapes: false, functionContext: this.functionContext }, this.compilation),
+                node: createTemplateLiteral(token, {
+                    allowMalformedEscapes: false,
+                    functionContext: this.functionContext,
+                    source: this.source
+                }, this.compilation),
                 parenthesized: false
             };
         }
@@ -1875,7 +1888,7 @@ class Parser {
         });
         const generator = generatorToken !== undefined;
         const body = this.withFunctionContext(generator ? "generator" : "normal", () => this.parseBlockStatement(params));
-        return {
+        return this.withFunctionSource({
             type: "FunctionExpression",
             async: asyncToken !== undefined,
             body,
@@ -1883,7 +1896,7 @@ class Parser {
             id,
             params,
             span: createSpan(asyncToken?.start ?? functionToken.start, body.span.end)
-        };
+        });
     }
     parseArrayExpression() {
         const start = this.expectPunctuator("[");
@@ -2139,7 +2152,7 @@ class Parser {
             return parsedParams;
         });
         const body = this.withFunctionContext("normal", () => this.parseBlockStatement(params));
-        return {
+        return this.withFunctionSource({
             type: "FunctionExpression",
             async: asyncToken !== undefined,
             body,
@@ -2148,7 +2161,7 @@ class Parser {
             method: true,
             params,
             span: createSpan(asyncToken?.start ?? methodStart, body.span.end)
-        };
+        });
     }
     parseIdentifierName() {
         const token = this.currentToken();
@@ -3033,7 +3046,7 @@ function createTemplateLiteral(token, options, compilation) {
             quasis.push(createTemplateElement(token.start, raw, quasiStart, cursor, false, options));
             const expressionStart = cursor + 2;
             const expressionEnd = findTemplateExpressionEnd(raw, expressionStart);
-            expressions.push(parseEmbeddedExpression(raw.slice(expressionStart, expressionEnd), positionWithinRaw(token.start, raw, expressionStart), options.functionContext, compilation));
+            expressions.push(parseEmbeddedExpression(raw.slice(expressionStart, expressionEnd), positionWithinRaw(token.start, raw, expressionStart), options.functionContext, options.source, compilation));
             quasiStart = expressionEnd + 1;
             cursor = expressionEnd + 1;
             continue;
@@ -3394,13 +3407,13 @@ function decodeHexEscape(value, start) {
         end: index + 2
     };
 }
-function parseEmbeddedExpression(source, base, functionContext, compilation) {
+function parseEmbeddedExpression(source, base, functionContext, fullSource, compilation) {
     const tokens = tokenize(source, { allowRegexLiterals: true, compilation }).map((token) => ({
         ...token,
         start: rebasePosition(token.start, base),
         end: rebasePosition(token.end, base)
     }));
-    return new Parser(tokens, compilation, functionContext).parseExpressionOnly();
+    return new Parser(tokens, fullSource, compilation, functionContext).parseExpressionOnly();
 }
 export function findRegexLiteral(node) {
     if (node === null || node === undefined) {

package/packages/safe-js/dist/restore.js

@@ -21,13 +21,14 @@ export function restore(snapshot, options, owner) {
     validateSnapshotMigration(snapshot.migration, snapshot.sourceHash, owner);
     if (snapshot.executionSemantics !== EXECUTION_SEMANTICS &&
         snapshot.executionSemantics !== "jobs-v6" &&
+        snapshot.executionSemantics !== "jobs-v7" &&
         (snapshot.executionSemantics !== undefined ||
             snapshot.promiseReplay !== undefined ||
             snapshot.replay !== undefined ||
             snapshot.initialInputs !== undefined)) {
         throw new SnapshotValidationError("unsupportedVersion", "$.executionSemantics", "incompatible execution semantics; resume with the SafeJS version that created this snapshot. Migration requires explicit reconciliation, not changing its version marker.");
     }
-    const currentSourceHash = hashSource(options.source, owner);
+    const currentSourceHash = hashSource(options.source, owner, snapshot.executionSemantics !== "jobs-v6" && snapshot.executionSemantics !== "jobs-v7");
     if (snapshot.sourceHash !== currentSourceHash) {
         throw new SnapshotMismatchError(snapshot.sourceHash, currentSourceHash);
     }

package/packages/safe-js/dist/run.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { runWithExtensions } from "./realm.js";
 import { hashParsedAst, hashSource } from "./parse/hash.js";
-import { withRunResources } from "./interp/resources.js";
+import { runResources, withRunResources } from "./interp/resources.js";
 import { createReplayableRandom } from "./random.js";
 import { attachErrorSpan, describeThrownValue, materializeWrappedErrorCause, replaceErrorStack } from "./error/shape.js";
 import { findRegexLiteral, parseExecutableModule } from "./parse/parser.js";
@@ -76,7 +76,11 @@ export function run(source, options = {}) {
                     const restoredSnapshot = options.snapshot === undefined
                         ? undefined
                         : restore(options.snapshot, { source }, operation.owner);
-                    const executionSemantics = restoredSnapshot?.executionSemantics === "jobs-v6" ? "jobs-v6" : EXECUTION_SEMANTICS;
+                    const executionSemantics = restoredSnapshot?.executionSemantics === "jobs-v6" ||
+                        restoredSnapshot?.executionSemantics === "jobs-v7"
+                        ? restoredSnapshot.executionSemantics
+                        : EXECUTION_SEMANTICS;
+                    runResources.getStore().functionSourceText = executionSemantics === EXECUTION_SEMANTICS;
                     const convertInitialInput = (convert) => executionSemantics === "jobs-v6" ? convert() : promiseReplayContext.exit(convert);
                     if (restoredSnapshot !== undefined) {
                         leaveSnapshotRun = enterSnapshotRun(restoredSnapshot);
@@ -86,8 +90,8 @@ export function run(source, options = {}) {
                     const module = parseExecutableModule(source, filename, operation.owner);
                     promiseReplay.validateNodes(module);
                     const sourceHash = findRegexLiteral(module) === undefined
-                        ? hashSource(source, operation.owner)
-                        : hashParsedAst(module);
+                        ? hashSource(source, operation.owner, executionSemantics === EXECUTION_SEMANTICS)
+                        : hashParsedAst(module, executionSemantics === EXECUTION_SEMANTICS);
                     const hostCalls = new HostCallJournal(sourceHash, readHostCallSnapshot(restoredSnapshot), options.hostCallResumeProvider, restoredSnapshot?.replay, budget, operation.owner);
                     leaveHostReplay = hostCalls.dispose.bind(hostCalls);
                     promiseReplay.validateCallbacks(hostCalls.callbackPositions());
@@ -110,7 +114,14 @@ export function run(source, options = {}) {
                             signal: options.signal,
                             lifecycle
                         }));
-                    const builtinBindings = createBuiltinBindings({ compileOwner: operation.owner, budget, hostCalls, sink: options.sink, random: random?.generator.next, clock: options.clock });
+                    const builtinBindings = createBuiltinBindings({
+                        compileOwner: operation.owner,
+                        budget,
+                        hostCalls,
+                        sink: options.sink,
+                        random: random?.generator.next,
+                        clock: options.clock
+                    });
                     const importMeta = convertInitialInput(() => deepCopyToSandbox(options.importMeta ?? {}));
                     if (restoredSnapshot?.migration !== undefined) {
                         if (Object.hasOwn(importMeta, "migration"))

package/packages/safe-js/dist/snapshot/boxed.d.ts

@@ -0,0 +1,16 @@
+import { type SandboxBox } from "../interp/boxed.js";
+import type { SandboxValue } from "../interp/values.js";
+export type BoxedData<T> = {
+    kind: "boxed";
+    value: T;
+    properties: Record<string, {
+        value: T;
+        configurable: boolean;
+        enumerable: boolean;
+        writable: boolean;
+    }>;
+    extensible: boolean;
+};
+export declare function encodeBoxedData<T>(value: SandboxBox, encode: (value: SandboxValue, key: string) => T): BoxedData<T>;
+export declare function restoreBoxedProperties<T>(value: SandboxBox, data: BoxedData<T>, decode: (value: T) => unknown): void;
+export declare function validateBoxedProperties(data: Record<string, unknown>): void;

package/packages/safe-js/dist/snapshot/boxed.js

@@ -0,0 +1,52 @@
+import { boxedDataProperties, boxedValue } from "../interp/boxed.js";
+export function encodeBoxedData(value, encode) {
+    const properties = Object.create(null);
+    for (const [key, descriptor] of boxedDataProperties(value)) {
+        if (!("value" in descriptor))
+            throw new TypeError("Boxed data cannot contain accessors.");
+        properties[key] = {
+            value: encode(descriptor.value, key),
+            configurable: descriptor.configurable === true,
+            enumerable: descriptor.enumerable === true,
+            writable: descriptor.writable === true
+        };
+    }
+    return {
+        kind: "boxed",
+        value: encode(boxedValue(value), "<payload>"),
+        properties,
+        extensible: Object.isExtensible(value)
+    };
+}
+export function restoreBoxedProperties(value, data, decode) {
+    for (const [key, descriptor] of Object.entries(data.properties))
+        Object.defineProperty(value, key, { ...descriptor, value: decode(descriptor.value) });
+    if (!data.extensible)
+        Object.preventExtensions(value);
+}
+export function validateBoxedProperties(data) {
+    if (!Object.hasOwn(data, "kind") ||
+        data.kind !== "boxed" ||
+        !Object.hasOwn(data, "value") ||
+        !Object.hasOwn(data, "extensible") ||
+        !Object.hasOwn(data, "properties") ||
+        Object.keys(data).length !== 4 ||
+        typeof data.extensible !== "boolean" ||
+        typeof data.properties !== "object" ||
+        data.properties === null ||
+        Array.isArray(data.properties))
+        throw new TypeError("Invalid boxed primitive properties.");
+    for (const descriptor of Object.values(data.properties)) {
+        if (typeof descriptor !== "object" ||
+            descriptor === null ||
+            !Object.hasOwn(descriptor, "value") ||
+            !Object.hasOwn(descriptor, "writable") ||
+            !Object.hasOwn(descriptor, "enumerable") ||
+            !Object.hasOwn(descriptor, "configurable") ||
+            typeof descriptor.writable !== "boolean" ||
+            typeof descriptor.enumerable !== "boolean" ||
+            typeof descriptor.configurable !== "boolean" ||
+            Object.keys(descriptor).length !== 4)
+            throw new TypeError("Invalid boxed primitive descriptor.");
+    }
+}

package/packages/safe-js/dist/snapshot/dump-format.d.ts

@@ -1,5 +1,5 @@
 export declare const DUMP_FORMAT_VERSION = 1;
-export declare const EXECUTION_SEMANTICS = "jobs-v7";
+export declare const EXECUTION_SEMANTICS = "jobs-v8";
 export type DumpableSnapshot = {
     sourceHash: string;
     [key: string]: unknown;

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -1,5 +1,5 @@
 export const DUMP_FORMAT_VERSION = 1;
-export const EXECUTION_SEMANTICS = "jobs-v7";
+export const EXECUTION_SEMANTICS = "jobs-v8";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { hasGuestObjectState } from "../interp/object-model.js";
 import { sandboxErrorTypes } from "../error/shape.js";
@@ -9,6 +9,8 @@ import { requiresArrayEntries, serializeArray } from "./arrays.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { encodeFloat32Storage } from "./float32array.js";
 import { isSandboxDate, serializedDateTime } from "../interp/date.js";
+import { boxedDataProperties, isSandboxBox } from "../interp/boxed.js";
+import { encodeBoxedData } from "./boxed.js";
 const SKIP_VALUE = Symbol("SafeJS.skip-dump-value");
 export function serializeSafeJSSnapshot(snapshot) {
     const replayError = Object.getOwnPropertyDescriptor(snapshot, "replayError");
@@ -73,7 +75,7 @@ function serializeDumpValue(value, path, state) {
     if (hasGuestObjectState(value)) {
         throw new TypeError("Guest function properties and prototype links cannot be serialized.");
     }
-    if (isSandboxDate(value) || isFloat32Array(value))
+    if (isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
         return serializeHeapReference(value, path, state);
     if (Array.isArray(value)) {
         const reference = serializeHeapReference(value, path, state);
@@ -98,7 +100,15 @@ function serializeHeapReference(value, path, state) {
     }
     if (!state.serializedHeapIds.has(id)) {
         state.serializedHeapIds.add(id);
-        if (isSandboxDate(value)) {
+        if (isSandboxBox(value)) {
+            state.heap[String(id)] = encodeBoxedData(value, (entry, key) => {
+                if (Object.is(entry, -0))
+                    return { kind: "number", value: "-0" };
+                const serialized = serializeDumpValue(entry, `${path}.${key}`, state);
+                return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+            });
+        }
+        else if (isSandboxDate(value)) {
             state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
         }
         else if (isFloat32Array(value)) {
@@ -163,6 +173,7 @@ function indexHeapContainers(snapshot) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            isSandboxBox(value) ||
             isSandboxDate(value) ||
             isFloat32Array(value) ||
             (Array.isArray(value) && requiresArrayEntries(value)) ||
@@ -200,9 +211,11 @@ function collectContainerStats(value, stats, ancestors) {
     }
     stat.expanded = true;
     ancestors.add(value);
-    const entries = isSandboxArguments(value)
-        ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
-        : getEnumerableDataValues(value);
+    const entries = isSandboxBox(value)
+        ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value)
+        : isSandboxArguments(value)
+            ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
+            : getEnumerableDataValues(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safe-js/dist/snapshot/migration.js

@@ -3,8 +3,8 @@ import { decodeReplayData } from "./replay-data.js";
 import { validateSnapshotData } from "./validation.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 export function validateMigrationSemantics(value) {
-    if (!["jobs-v1", "jobs-v2", "jobs-v3", "jobs-v4", "jobs-v5", "jobs-v6", "jobs-v7"].includes(value))
-        throw new TypeError("Migration requires a supported execution-semantics marker (jobs-v1 through jobs-v7).");
+    if (!["jobs-v1", "jobs-v2", "jobs-v3", "jobs-v4", "jobs-v5", "jobs-v6", "jobs-v7", "jobs-v8"].includes(value))
+        throw new TypeError("Migration requires a supported execution-semantics marker (jobs-v1 through jobs-v8).");
 }
 export function validateMigrationJournal(sourceHash, replay, hostCalls = [], owner) {
     if (replay === undefined)

package/packages/safe-js/dist/snapshot/replay-data.d.ts

@@ -26,6 +26,11 @@ type Properties = Record<string, {
     writable: boolean;
 }>;
 type DataNode = {
+    kind: "boxed";
+    value: Atom;
+    properties: Properties;
+    extensible: boolean;
+} | {
     kind: "collection-iterator";
     collectionKind: "map" | "set";
     method: CollectionIterationMethod;

package/packages/safe-js/dist/snapshot/replay-data.js

@@ -5,6 +5,8 @@ import { CompileScope } from "../interp/regex/compile-guard.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { decodeFloat32Storage, encodeFloat32Storage } from "./float32array.js";
 import { isSandboxDate, restoreDateTime, serializedDateTime } from "../interp/date.js";
+import { boxedDataProperties, createSandboxBox, nativeBoxedValue } from "../interp/boxed.js";
+import { validateBoxedProperties } from "./boxed.js";
 import { sandboxErrorNames, sandboxErrorTypes } from "../error/shape.js";
 import { createSandboxArguments, createSandboxClosure, createSandboxMap, createSandboxRegex, createSandboxSet, isSandboxArguments, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "../interp/values.js";
 import { serializeArguments } from "./arguments.js";
@@ -65,6 +67,15 @@ export function encodeReplayData(value, options = {}) {
                 properties: child(entry.properties, "properties")
             };
         }
+        else if (nativeBoxedValue(entry) !== undefined) {
+            const properties = Object.create(null);
+            nodes[id] = { kind: "boxed", value: child(nativeBoxedValue(entry), "<payload>"), properties, extensible: Object.isExtensible(entry) };
+            for (const [key, descriptor] of boxedDataProperties(entry)) {
+                if (!("value" in descriptor))
+                    throw new TypeError(`Cannot record replay data accessor '${key}'.`);
+                properties[key] = { value: child(descriptor.value, JSON.stringify(["property", key])), configurable: descriptor.configurable === true, enumerable: descriptor.enumerable === true, writable: descriptor.writable === true };
+            }
+        }
         else if (isSandboxDate(entry)) {
             nodes[id] = { kind: "date", time: serializedDateTime(entry) };
         }
@@ -247,6 +258,19 @@ export function decodeReplayData(input, options = {}, parent) {
                 options.onCapabilityRestored?.(capability, copy);
                 return copy;
             }
+            if (kind === "boxed") {
+                validateBoxedProperties(node);
+                const payload = own(node, "value");
+                if (typeof payload !== "number" && typeof payload !== "string" && typeof payload !== "boolean" &&
+                    (payload === null || typeof payload !== "object" || own(record(payload), "tag") !== "number"))
+                    throw new TypeError("Invalid boxed primitive payload.");
+                const result = createSandboxBox(child(payload));
+                restored.set(id, result);
+                defineProperties(result, record(own(node, "properties")), child);
+                if (!node.extensible)
+                    Object.preventExtensions(result);
+                return result;
+            }
             if (kind === "date") {
                 if (Object.keys(node).length !== 2)
                     throw new TypeError("Invalid serialized Date fields.");

package/packages/safe-js/dist/snapshot/restore.js

@@ -4,10 +4,13 @@ import { toPropertyKey } from "../interp/property-key.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { decodeFloat32Storage } from "./float32array.js";
 import { restoreDateTime } from "../interp/date.js";
+import { createSandboxBox } from "../interp/boxed.js";
+import { restoreBoxedProperties } from "./boxed.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { SnapshotMismatchError } from "../restore.js";
 import { Scope, setSandboxProperty } from "../interp/interpreter.js";
 import { getGuestFunctionProperties, getGuestFunctionProperty, getSandboxDataProperty, registerGuestClosure, setSandboxPrototype } from "../interp/object-model.js";
+import { functionSources } from "../parse/function-source.js";
 import { wrapCallerInjectedBindings } from "../interp/host-bridge.js";
 import { restoreSandboxCollectionIterator } from "../interp/collection-iterator.js";
 import { isSandboxMap, isSandboxSet } from "../interp/values.js";
@@ -348,6 +351,12 @@ function restoreHeapValue(id, state) {
     if (serialized === undefined) {
         throw new Error(`Snapshot references unknown heap value ${id}.`);
     }
+    if (serialized.kind === "boxed") {
+        const value = createSandboxBox(deserializeValue(serialized.value, state));
+        state.heapValueById.set(id, value);
+        restoreBoxedProperties(value, serialized, entry => deserializeValue(entry, state));
+        return value;
+    }
     if (serialized.kind === "date") {
         const value = restoreDateTime(serialized.time);
         state.heapValueById.set(id, value);
@@ -454,6 +463,7 @@ function restoreClosureValue(astNodeId, capturedScopeId, state) {
         throw new Error(`Snapshot references unknown closure AST node ${astNodeId}.`);
     }
     const baseClosure = createSandboxClosure({
+        sourceRange: functionSources.get(node),
         async: node.async,
         sandbox: true,
         length: getFunctionLength(node.params),

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -3,6 +3,8 @@ import { type SandboxErrorName } from "../error/shape.js";
 import { type SerializedArguments } from "./arguments.js";
 import { type SerializedArray } from "./arrays.js";
 import { type Float32Data } from "./float32array.js";
+import { type SandboxBox } from "../interp/boxed.js";
+import { type BoxedData } from "./boxed.js";
 import { type SandboxMap, type SandboxGenerator, type SandboxRegex, type SandboxSet } from "../interp/values.js";
 type SnapshotId = number | string;
 type SerializedUndefinedValue = {
@@ -41,7 +43,7 @@ export type SerializedReferenceValue = {
     kind: "ref";
     id: number;
 };
-export type SerializedHeapValue = {
+export type SerializedHeapValue = BoxedData<SerializedSnapshotValue> | {
     kind: "regex-object";
     source: string;
     flags: string;
@@ -89,7 +91,7 @@ export type RuntimePromiseValue = {
     id: SnapshotId;
     promise?: Promise<unknown>;
 };
-export type RuntimeSnapshotValue = Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
+export type RuntimeSnapshotValue = SandboxBox | Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
     [key: string]: RuntimeSnapshotValue;
 };
 export type RuntimeScopeFrame = {

package/packages/safe-js/dist/snapshot/serialize.js

@@ -8,6 +8,8 @@ import { requiresArrayEntries, serializeArray } from "./arrays.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { encodeFloat32Storage } from "./float32array.js";
 import { isSandboxDate, serializedDateTime } from "../interp/date.js";
+import { boxedDataProperties, isSandboxBox } from "../interp/boxed.js";
+import { encodeBoxedData } from "./boxed.js";
 import { isSandboxArguments, isSandboxGenerator, isSandboxMap, isSandboxRegex, isSandboxSet } from "../interp/values.js";
 export class UnsnapshotableValueError extends Error {
     path;
@@ -170,7 +172,7 @@ function serializeValue(value, path, state) {
             throw new TypeError(`Missing regex heap reference at ${path}.`);
         return { kind: "regex", source: value.source, flags: value.flags, lastIndex: value.lastIndex };
     }
-    if (isSandboxDate(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxCollectionIterator(value) || isFloat32Array(value)) {
+    if (isSandboxBox(value) || isSandboxDate(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxCollectionIterator(value) || isFloat32Array(value)) {
         const reference = serializeHeapReference(value, path, state);
         if (reference === undefined) {
             throw new TypeError(`Cannot serialize collection without a heap reference at ${path}.`);
@@ -214,6 +216,9 @@ function serializeHeapReference(value, path, state) {
             for (const [key, entry] of Object.entries(value))
                 entries[key] = serializeValue(entry, `${path}.${key}`, state);
         }
+        else if (isSandboxBox(value)) {
+            state.heap[String(id)] = encodeBoxedData(value, (entry, key) => serializeValue(entry, `${path}.${key}`, state));
+        }
         else if (isSandboxDate(value)) {
             state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
         }
@@ -326,6 +331,7 @@ function indexHeapContainers(input) {
             stat.cyclic ||
             (isSandboxRegex(value) && (!Number.isSafeInteger(value.lastIndex) ||
                 (typeof value.lastIndex === "number" && value.lastIndex < 0) || Object.is(value.lastIndex, -0))) ||
+            isSandboxBox(value) ||
             isSandboxDate(value) ||
             isFloat32Array(value) ||
             (Array.isArray(value) && requiresArrayEntries(value)) ||
@@ -376,15 +382,17 @@ function collectContainerStats(value, stats, ancestors) {
     }
     stat.expanded = true;
     ancestors.add(value);
-    const entries = isSandboxCollectionIterator(value)
-        ? [collectionIteratorState(value).collection, ...Object.values(value)]
-        : isSandboxArguments(value)
-            ? Object.values(Object.getOwnPropertyDescriptors(value)).flatMap((descriptor) => "value" in descriptor ? [descriptor.value] : [])
-            : isSandboxMap(value)
-                ? [...value.entries].flatMap(([key, entry]) => [key, entry])
-                : isSandboxSet(value)
-                    ? [...value.values]
-                    : Object.values(value);
+    const entries = isSandboxBox(value)
+        ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value)
+        : isSandboxCollectionIterator(value)
+            ? [collectionIteratorState(value).collection, ...Object.values(value)]
+            : isSandboxArguments(value)
+                ? Object.values(Object.getOwnPropertyDescriptors(value)).flatMap((descriptor) => "value" in descriptor ? [descriptor.value] : [])
+                : isSandboxMap(value)
+                    ? [...value.entries].flatMap(([key, entry]) => [key, entry])
+                    : isSandboxSet(value)
+                        ? [...value.values]
+                        : Object.values(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safe-js/dist/snapshot/validation.js

@@ -4,6 +4,7 @@ import { DUMP_FORMAT_VERSION } from "./dump-format.js";
 import { MAX_DATA_DEPTH } from "../graph-depth.js";
 import { validateFloat32Storage } from "./float32array.js";
 import { restoreDateTime } from "../interp/date.js";
+import { validateBoxedProperties } from "./boxed.js";
 import { hasGuestObjectState } from "../interp/object-model.js";
 const DEFAULT_MAX_DEPTH = MAX_DATA_DEPTH;
 const DEFAULT_MAX_ENTRIES = 100_000;
@@ -81,6 +82,10 @@ function validateDumpHeap(root, state) {
         addUnique(heapIds, id, path);
         const entry = requireRecord(value, path);
         validateErrorType(entry, path);
+        if (entry.kind === "boxed") {
+            validateBoxedRecord(entry, path);
+            continue;
+        }
         if (entry.kind === "date") {
             validateDateRecord(entry, path);
             continue;
@@ -414,7 +419,7 @@ function validateGeneratorShape(record, path, state) {
 function validateHeapValue(value, path, state) {
     const record = requireRecord(value, path);
     validateErrorType(record, path);
-    if (!["arguments", "array", "object", "map", "set", "float32array", "date", "collection-iterator", "regex-object"].includes(String(record.kind)))
+    if (!["arguments", "array", "object", "map", "set", "float32array", "date", "boxed", "collection-iterator", "regex-object"].includes(String(record.kind)))
         fail("unknownTag", `${path}.kind`, "unknown heap tag");
     validateValue(record, path, 1, state);
     if (record.kind === "arguments")
@@ -423,6 +428,8 @@ function validateHeapValue(value, path, state) {
         validateArrayHeap(record, path, state);
     if (record.kind === "object")
         requireRecord(record.entries, `${path}.entries`);
+    if (record.kind === "boxed")
+        validateBoxedRecord(record, path);
     if (record.kind === "date")
         validateDateRecord(record, path);
     if (record.kind === "float32array") {
@@ -451,6 +458,20 @@ function validateHeapValue(value, path, state) {
         requireRecord(record.entries, `${path}.entries`);
     }
 }
+function validateBoxedRecord(record, path) {
+    try {
+        validateBoxedProperties(record);
+    }
+    catch {
+        fail("invalidValue", path, "invalid boxed primitive properties");
+    }
+    const value = record.value;
+    if (typeof value === "number" || typeof value === "string" || typeof value === "boolean")
+        return;
+    const number = requireRecord(value, `${path}.value`);
+    if (number.kind !== "number" || !["NaN", "Infinity", "-Infinity", "-0"].includes(String(number.value)))
+        fail("invalidValue", `${path}.value`, "invalid boxed primitive payload");
+}
 function validateDateRecord(record, path) {
     if (Object.keys(record).length !== 2)
         fail("invalidValue", path, "invalid Date fields");