poe-code 14.0.61 → 14.0.63

package/packages/safe-js/dist/interp/host-bridge.js

@@ -1,5 +1,6 @@
 import { normalizeClosureResult } from "./async.js";
 import { copyNativeDate } from "./date.js";
+import { boxedDataProperties, createSandboxBox, nativeBoxedValue } from "./boxed.js";
 import { exportHostCapability, importHostCapability, isLiveCapability } from "./host-capabilities.js";
 import { attachErrorSpan, replaceErrorStack } from "../error/shape.js";
 import { SandboxError } from "./budget.js";
@@ -670,6 +671,27 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
                 : path
         }, state);
     }
+    const primitive = nativeBoxedValue(value);
+    if (primitive !== undefined) {
+        if (typeof primitive === "string")
+            budget.allocateString(primitive);
+        const original = value;
+        const existing = state.seen.get(original);
+        if (existing !== undefined)
+            return existing;
+        const copy = createSandboxBox(primitive);
+        state.seen.set(original, copy);
+        budget.chargeDataUsage(measureSandboxData([copy]));
+        for (const [key, descriptor] of boxedDataProperties(original)) {
+            if (!("value" in descriptor))
+                throw new TypeError(`Unsupported sandbox value at ${joinPath(path, key)}: accessor property`);
+            Object.defineProperty(copy, budget.allocateString(key), {
+                ...descriptor,
+                value: copyHostValueToSandbox(descriptor.value, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), key] }, state, joinPath(path, key))
+            });
+        }
+        return copy;
+    }
     const date = copyNativeDate(value);
     if (date !== undefined) {
         const existing = state.seen.get(value);

package/packages/safe-js/dist/interp/interpreter.js

@@ -14,7 +14,8 @@ import { CompileScope, RegexCompileGuard } from "./regex/compile-guard.js";
 import { createCapturedException, createThrowCompletion, evaluateThrowStatement as evaluateThrowStatementResult, evaluateTryStatement as evaluateTryStatementResult, isCapturedException, isInterpreterError, surfaceThrownValue } from "./exceptions.js";
 import { callArrayMethod, getArrayMember, isArrayMethodName } from "./methods/array.js";
 import { getFunctionMember } from "./methods/function.js";
-import { getGuestFunctionProperty, getSandboxPrototype, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { getBoxedPrototype, getGuestFunctionProperty, getSandboxPrototype, isDefaultBoxedMethod, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { getStringIndex } from "./methods/string.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { callMapMethod, getMapMember, isMapMethodName } from "./methods/map.js";
 import { callNumberMethod, getNumberMember, isNumberMethodName } from "./methods/number.js";
@@ -34,6 +35,7 @@ import { getCollectionIteratorMember } from "./methods/collection-iterator.js";
 import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
+import { isSandboxBox } from "./boxed.js";
 import { getDateMember, getDatePrototype, isDateConstructor } from "./globals/date.js";
 import { createSandboxRegex, allocateProducedSandboxValue, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, reconcileCompiledValues } from "./values.js";
 import { Scope } from "./scope.js";
@@ -466,22 +468,29 @@ async function evaluateBinaryExpression(node, context) {
     if (left.kind !== "normal") {
         return left;
     }
+    let leftValue = left.value;
     let rightValue;
-    const release = retainValues(context.budget, () => [left.value, rightValue]);
+    const release = retainValues(context.budget, () => [leftValue, rightValue]);
     try {
         const right = await evaluateNode(node.right, context);
         if (right.kind !== "normal") {
             return right;
         }
         rightValue = right.value;
-        let leftValue = left.value;
         if (node.operator === "in") {
             if (typeof right.value !== "object" || right.value === null) {
                 throw new TypeError("Right-hand side of 'in' must be an object.");
             }
             leftValue = await toPropertyKey(leftValue, context.budget, createCoercionContext(context));
         }
-        const value = applyBinaryOperator(node, leftValue, right.value, context);
+        if (!["in", "instanceof", "===", "!=="].includes(node.operator)) {
+            const equality = node.operator === "==" || node.operator === "!=";
+            if (isSandboxBox(leftValue) && (!equality || (rightValue !== null && rightValue !== undefined && typeof rightValue !== "object")))
+                leftValue = await toNumericPrimitive(leftValue, context);
+            if (isSandboxBox(rightValue) && (!equality || (left.value !== null && left.value !== undefined && typeof left.value !== "object")))
+                rightValue = await toNumericPrimitive(rightValue, context);
+        }
+        const value = applyBinaryOperator(node, leftValue, rightValue, context);
         return {
             kind: "normal",
             hasValue: true,
@@ -1079,62 +1088,68 @@ async function evaluateForOfStatement(node, context) {
     };
 }
 async function evaluateForOfIterator(node, value, context, restoredEntry) {
-    const iterator = getSandboxIterator(value, context.budget);
+    const iterator = getSandboxIterator(value, context.budget, createCoercionContext(context));
     if (iterator === undefined) {
         throw new TypeError(`${String(value)} is not a supported iterable`);
     }
-    const nodeId = node.nodeId ?? -1;
-    let index = consumeRestoredLoopIterationIndex(node, context);
-    for (let skipped = 0; skipped < index; skipped += 1) {
-        const skippedIteration = await iterator.next();
-        if (typeof skippedIteration !== "object" || skippedIteration === null) {
-            throw new TypeError("Iterator result must be an object.");
-        }
-        if (skippedIteration.done) {
-            return normalEmptyResult();
-        }
-    }
-    while (true) {
-        const iteration = restoredEntry ?? (await iterator.next());
-        restoredEntry = undefined;
-        if (typeof iteration !== "object" || iteration === null) {
-            throw new TypeError("Iterator result must be an object.");
-        }
-        if (iteration.done) {
-            context.activeLoopIterations.delete(nodeId);
-            return normalEmptyResult();
-        }
-        context.activeLoopIterations.set(nodeId, iterator.snapshotIndex === undefined
-            ? index
-            : {
-                get index() {
-                    return iterator.snapshotIndex();
-                },
-                values: [value, iteration.value]
-            });
-        const scope = context.scope.child();
-        const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
-        if (!binding.ok) {
-            return binding.result;
-        }
-        const iterationContext = createLoopIterationContext(context, scope);
-        emitLoopIterationBreakpoint(node, iterationContext);
-        const result = await evaluateNode(node.body, iterationContext);
-        if (isMatchingBreak(result, loopLabels(node))) {
-            context.activeLoopIterations.delete(nodeId);
-            await closeIterator(iterator);
-            return normalEmptyResult();
+    const releaseIterator = retainValues(context.budget, () => [value, iterator.retainedValue]);
+    try {
+        const nodeId = node.nodeId ?? -1;
+        let index = consumeRestoredLoopIterationIndex(node, context);
+        for (let skipped = 0; skipped < index; skipped += 1) {
+            const skippedIteration = await iterator.next();
+            if (typeof skippedIteration !== "object" || skippedIteration === null) {
+                throw new TypeError("Iterator result must be an object.");
+            }
+            if (skippedIteration.done) {
+                return normalEmptyResult();
+            }
         }
-        if (isMatchingContinue(result, loopLabels(node))) {
+        while (true) {
+            const iteration = restoredEntry ?? (await iterator.next());
+            restoredEntry = undefined;
+            if (typeof iteration !== "object" || iteration === null) {
+                throw new TypeError("Iterator result must be an object.");
+            }
+            if (iteration.done) {
+                context.activeLoopIterations.delete(nodeId);
+                return normalEmptyResult();
+            }
+            context.activeLoopIterations.set(nodeId, iterator.snapshotIndex === undefined
+                ? index
+                : {
+                    get index() {
+                        return iterator.snapshotIndex();
+                    },
+                    values: [value, iteration.value]
+                });
+            const scope = context.scope.child();
+            const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
+            if (!binding.ok) {
+                return binding.result;
+            }
+            const iterationContext = createLoopIterationContext(context, scope);
+            emitLoopIterationBreakpoint(node, iterationContext);
+            const result = await evaluateNode(node.body, iterationContext);
+            if (isMatchingBreak(result, loopLabels(node))) {
+                context.activeLoopIterations.delete(nodeId);
+                await closeIterator(iterator);
+                return normalEmptyResult();
+            }
+            if (isMatchingContinue(result, loopLabels(node))) {
+                index += 1;
+                continue;
+            }
+            if (result.kind !== "normal") {
+                context.activeLoopIterations.delete(nodeId);
+                await closeIterator(iterator);
+                return result;
+            }
             index += 1;
-            continue;
-        }
-        if (result.kind !== "normal") {
-            context.activeLoopIterations.delete(nodeId);
-            await closeIterator(iterator);
-            return result;
         }
-        index += 1;
+    }
+    finally {
+        releaseIterator();
     }
 }
 async function evaluateForInStatement(node, context) {
@@ -1523,49 +1538,58 @@ async function evaluateYieldDelegate(node, context) {
     if (argument.kind !== "normal") {
         return argument;
     }
-    const iterator = getSandboxIterator(argument.value, context.budget);
+    const iterator = getSandboxIterator(argument.value, context.budget, createCoercionContext(context));
     if (iterator === undefined) {
         throw new TypeError(`${String(argument.value)} is not a supported iterable`);
     }
-    let completion = {
-        type: "normal",
-        value: undefined
-    };
-    const replay = context.generatorResume?.sent ?? [];
-    let replayIndex = 0;
-    while (true) {
-        const method = completion.type === "normal" ? "next" : completion.type;
-        const iteratorMethod = iterator[method];
-        if (iteratorMethod === undefined) {
-            if (completion.type === "throw") {
-                throw completion.value;
+    const releaseIterator = retainValues(context.budget, () => [
+        argument.value,
+        iterator.retainedValue
+    ]);
+    try {
+        let completion = {
+            type: "normal",
+            value: undefined
+        };
+        const replay = context.generatorResume?.sent ?? [];
+        let replayIndex = 0;
+        while (true) {
+            const method = completion.type === "normal" ? "next" : completion.type;
+            const iteratorMethod = iterator[method];
+            if (iteratorMethod === undefined) {
+                if (completion.type === "throw") {
+                    throw completion.value;
+                }
+                return generatorCompletionResult(completion);
             }
-            return generatorCompletionResult(completion);
-        }
-        const result = await iteratorMethod(completion.value);
-        if (result.done) {
-            if (completion.type === "return") {
-                return generatorCompletionResult({ type: "return", value: result.value });
+            const result = await iteratorMethod(completion.value);
+            if (result.done) {
+                if (completion.type === "return") {
+                    return generatorCompletionResult({ type: "return", value: result.value });
+                }
+                return {
+                    kind: "normal",
+                    hasValue: true,
+                    value: result.value
+                };
             }
-            return {
-                kind: "normal",
-                hasValue: true,
-                value: result.value
-            };
-        }
-        if (replayIndex < replay.length - 1) {
-            completion = replay[replayIndex + 1];
-            replayIndex += 1;
-            continue;
+            if (replayIndex < replay.length - 1) {
+                completion = replay[replayIndex + 1];
+                replayIndex += 1;
+                continue;
+            }
+            const completionPromise = context.generatorYield(allocateProducedSandboxValue(result.value, context.budget), node.nodeId);
+            emitResumeBreakpoint(context, {
+                kind: "generator-yield",
+                nodeId: node.nodeId,
+                span: node.span
+            });
+            completion = (await completionPromise);
+            context.generatorResume = undefined;
         }
-        const completionPromise = context.generatorYield(allocateProducedSandboxValue(result.value, context.budget), node.nodeId);
-        emitResumeBreakpoint(context, {
-            kind: "generator-yield",
-            nodeId: node.nodeId,
-            span: node.span
-        });
-        completion = (await completionPromise);
-        context.generatorResume = undefined;
+    }
+    finally {
+        releaseIterator();
     }
 }
 function generatorCompletionResult(completion) {
@@ -1706,6 +1730,14 @@ async function evaluateMemberExpression(node, context) {
 function getPropertyValue(target, property, context) {
     if (isGuestHostObject(target))
         return getHostObjectMember(target, String(property));
+    if (typeof target === "string" || typeof target === "number" || typeof target === "boolean") {
+        const prototype = getBoxedPrototype(target, context.budget);
+        if (prototype !== undefined) {
+            if (typeof target === "string" && (property === "length" || getStringIndex(property) !== undefined))
+                return getStringMember(target, property, context.budget);
+            return getMemberValue(prototype, property, context);
+        }
+    }
     if (typeof target === "string")
         return getStringMember(target, property, context.budget);
     if (typeof target === "number")
@@ -1886,6 +1918,16 @@ async function evaluateMemberCallExpression(node, context) {
             ...reference,
             property: await toPropertyKey(reference.property, context.budget, createCoercionContext(context))
         };
+        if ((typeof member.object === "string" || typeof member.object === "number" || typeof member.object === "boolean") &&
+            getBoxedPrototype(member.object, context.budget) !== undefined) {
+            if (isDefaultBoxedMethod(member.object, member.property, context.budget)) {
+                if (typeof member.object === "string" && isStringMethodName(member.property))
+                    return evaluateStringMethodCall(node, member.object, member.property, context);
+                if (typeof member.object === "number" && isNumberMethodName(member.property))
+                    return evaluateNumberMethodCall(node, member.object, member.property, context);
+            }
+            return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.object);
+        }
         if (typeof member.object === "string" && isStringMethodName(member.property)) {
             return evaluateStringMethodCall(node, member.object, member.property, context);
         }
@@ -2190,33 +2232,43 @@ function hasSandboxProperty(value, key, context) {
     return false;
 }
 async function applyCompoundAssignmentOperator(operator, left, right, context) {
-    left = await toNumericPrimitive(left, context);
-    right = await toNumericPrimitive(right, context);
-    switch (operator) {
-        case "+=":
-            return applyAdditionOperator(left, right, context);
-        case "-=":
-            return toNumber(left) - toNumber(right);
-        case "*=":
-            return toNumber(left) * toNumber(right);
-        case "/=":
-            return toNumber(left) / toNumber(right);
-        case "%=":
-            return toNumber(left) % toNumber(right);
-        case "**=":
-            return toNumber(left) ** toNumber(right);
-        case "&=":
-            return toNumber(left) & toNumber(right);
-        case "|=":
-            return toNumber(left) | toNumber(right);
-        case "^=":
-            return toNumber(left) ^ toNumber(right);
-        case "<<=":
-            return toNumber(left) << toNumber(right);
-        case ">>=":
-            return toNumber(left) >> toNumber(right);
-        case ">>>=":
-            return toNumber(left) >>> toNumber(right);
+    const convertingObject = typeof left === "object" && left !== null;
+    let convertedLeft;
+    const release = retainValues(context.budget, () => [convertedLeft]);
+    try {
+        left = await toNumericPrimitive(left, context);
+        if (convertingObject)
+            convertedLeft = left;
+        right = await toNumericPrimitive(right, context);
+        switch (operator) {
+            case "+=":
+                return applyAdditionOperator(left, right, context);
+            case "-=":
+                return toNumber(left) - toNumber(right);
+            case "*=":
+                return toNumber(left) * toNumber(right);
+            case "/=":
+                return toNumber(left) / toNumber(right);
+            case "%=":
+                return toNumber(left) % toNumber(right);
+            case "**=":
+                return toNumber(left) ** toNumber(right);
+            case "&=":
+                return toNumber(left) & toNumber(right);
+            case "|=":
+                return toNumber(left) | toNumber(right);
+            case "^=":
+                return toNumber(left) ^ toNumber(right);
+            case "<<=":
+                return toNumber(left) << toNumber(right);
+            case ">>=":
+                return toNumber(left) >> toNumber(right);
+            case ">>>=":
+                return toNumber(left) >>> toNumber(right);
+        }
+    }
+    finally {
+        release();
     }
 }
 function applyAdditionOperator(left, right, context) {
@@ -2546,6 +2598,7 @@ function createSetMethodOptions(context) {
 }
 function createFunctionMethodOptions(context) {
     return {
+        budget: context.budget,
         callClosure: (closure, args, stack, thisValue, construct) => invokeSandboxClosure(closure, args, context, stack, undefined, thisValue, construct)
     };
 }
@@ -2625,12 +2678,12 @@ async function evaluateSpreadElement(node, context) {
             result: value
         };
     }
-    const iterator = getSandboxIterator(value.value, context.budget);
+    const iterator = getSandboxIterator(value.value, context.budget, createCoercionContext(context));
     if (iterator === undefined) {
         throw new TypeError("Spread arguments must evaluate to an iterable.");
     }
     const spreadValues = [];
-    const release = retainValues(context.budget, () => [value.value, ...spreadValues]);
+    const release = retainValues(context.budget, () => [value.value, iterator.retainedValue, ...spreadValues]);
     try {
         while (true) {
             const next = await iterator.next();

package/packages/safe-js/dist/interp/iteration.d.ts

@@ -1,10 +1,12 @@
-import { type SandboxValue } from "./values.js";
-import type { Budget } from "./budget.js";
+import { type SandboxCallContext, type SandboxValue } from "./values.js";
+import { Budget } from "./budget.js";
 export type SandboxIterator = {
     readonly generator?: true;
+    readonly asynchronous?: true;
+    readonly retainedValue?: SandboxValue;
     snapshotIndex?(): number;
     next(value?: SandboxValue): IteratorResult<SandboxValue> | Promise<IteratorResult<SandboxValue>>;
     return?(value?: SandboxValue): IteratorResult<SandboxValue> | Promise<IteratorResult<SandboxValue>>;
     throw?(error?: SandboxValue): IteratorResult<SandboxValue> | Promise<IteratorResult<SandboxValue>>;
 };
-export declare function getSandboxIterator(value: SandboxValue, budget?: Budget): SandboxIterator | undefined;
+export declare function getSandboxIterator(value: SandboxValue, budget?: Budget, context?: SandboxCallContext): SandboxIterator | undefined;

package/packages/safe-js/dist/interp/iteration.js

@@ -1,9 +1,30 @@
 import { isSandboxGenerator, isSandboxMap, isSandboxSet } from "./values.js";
 import { enterRunningState } from "./running-state.js";
 import { isFloat32Array } from "./float32.js";
+import { boxedValue, isSandboxBox } from "./boxed.js";
 import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
-export function getSandboxIterator(value, budget) {
+import { Budget } from "./budget.js";
+import { sandboxString } from "./string-coercion.js";
+export function getSandboxIterator(value, budget, context) {
+    if (isSandboxBox(value) && typeof boxedValue(value) === "string") {
+        const primitive = boxedValue(value);
+        let text;
+        let iterator;
+        let initialized;
+        return {
+            asynchronous: true,
+            get retainedValue() { return text === primitive ? undefined : text; },
+            next: async () => {
+                initialized ??= Promise.resolve(sandboxString(value, budget ?? new Budget(), context)).then(converted => {
+                    text = converted;
+                    iterator = syncIterator(converted[Symbol.iterator]());
+                });
+                await initialized;
+                return iterator.next();
+            }
+        };
+    }
     if (isSandboxCollectionIterator(value))
         return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
     if (isGuestHostObject(value))

package/packages/safe-js/dist/interp/methods/array.js

@@ -1,4 +1,5 @@
-import { createSandboxClosure, isSandboxClosure, isSandboxMap, isSandboxPromise, isSandboxSet } from "../values.js";
+import { createSandboxBox } from "../boxed.js";
+import { createSandboxClosure, isSandboxClosure, isSandboxMap, isSandboxPromise, isSandboxSet, measureSandboxData } from "../values.js";
 import { assertCollectionMutable, enterRunningState } from "../running-state.js";
 import { getSandboxDataProperty, getSandboxPrototype } from "../object-model.js";
 import { sandboxNumber } from "../string-coercion.js";
@@ -75,8 +76,10 @@ export function isArrayMethodName(property) {
 export async function callArrayMethod(receiver, methodName, args, options, stack = []) {
     if (receiver === null || receiver === undefined)
         throw new TypeError("Array method requires a receiver.");
-    if (typeof receiver !== "object")
-        throw new TypeError("Object primitive boxing is not supported.");
+    if (typeof receiver !== "object") {
+        receiver = createSandboxBox(receiver);
+        options.budget.chargeDataUsage(measureSandboxData([receiver]));
+    }
     const retainedReceiver = {};
     options.budget.setRetainedValues(retainedReceiver, () => [receiver]);
     try {

package/packages/safe-js/dist/interp/methods/function.d.ts

@@ -1,5 +1,7 @@
 import { type SandboxClosure, type SandboxValue } from "../values.js";
+import type { Budget } from "../budget.js";
 export type FunctionMethodOptions = {
+    budget?: Budget;
     callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue: SandboxValue, construct?: boolean) => Promise<SandboxValue> | SandboxValue;
 };
 export declare function getFunctionMember(target: SandboxClosure, property: string | number, options: FunctionMethodOptions): SandboxValue | undefined;

package/packages/safe-js/dist/interp/methods/function.js

@@ -1,6 +1,8 @@
 import { createSandboxClosure, isSandboxClosure } from "../values.js";
 import { getGuestFunctionProperty, isGuestClosure } from "../object-model.js";
-const functionMethodNames = new Set(["apply", "bind", "call"]);
+import { functionString } from "../function-string.js";
+import { runResources } from "../resources.js";
+const functionMethodNames = new Set(["apply", "bind", "call", "toString"]);
 export function getFunctionMember(target, property, options) {
     if (isGuestClosure(target)) {
         const value = getGuestFunctionProperty(target, String(property));
@@ -16,12 +18,15 @@ export function getFunctionMember(target, property, options) {
     if (property === "length") {
         return target.length;
     }
+    if (property === "toString" && runResources.getStore()?.functionSourceText === false)
+        return undefined;
     if (!isFunctionMethodName(property)) {
         return undefined;
     }
     return createSandboxClosure({
         sandbox: true,
         name: `Function#${property}`,
+        ...(property === "toString" ? { length: 0 } : {}),
         call: (args, context) => callFunctionMethod(context?.thisValue, property, args, options, context?.stack ?? [])
     });
 }
@@ -32,6 +37,10 @@ function callFunctionMethod(target, methodName, args, options, stack) {
     if (!isSandboxClosure(target)) {
         throw new TypeError(`Function#${methodName} requires a callable receiver.`);
     }
+    if (methodName === "toString") {
+        const text = functionString(target);
+        return options.budget?.allocateString(text) ?? text;
+    }
     const thisValue = args[0];
     if (methodName === "bind") {
         const boundArgs = args.slice(1);

package/packages/safe-js/dist/interp/methods/number.d.ts

@@ -1,6 +1,7 @@
 import { Budget } from "../budget.js";
 import { type SandboxCallContext, type SandboxValue } from "../values.js";
 export type NumberMethodName = "toExponential" | "toFixed" | "toPrecision" | "toString";
+export declare const numberMethodNames: Set<NumberMethodName>;
 export declare function getNumberMember(property: string | number, budget: Budget): SandboxValue | undefined;
 export declare function isNumberMethodName(property: string | number): property is NumberMethodName;
 export declare function callNumberMethod(value: SandboxValue, methodName: NumberMethodName, args: readonly SandboxValue[], budget: Budget, context?: SandboxCallContext): string | Promise<string>;

package/packages/safe-js/dist/interp/methods/number.js

@@ -1,6 +1,7 @@
 import { sandboxNumber } from "../string-coercion.js";
+import { isSandboxBox, boxedValue } from "../boxed.js";
 import { createSandboxClosure } from "../values.js";
-const numberMethodNames = new Set([
+export const numberMethodNames = new Set([
     "toExponential",
     "toFixed",
     "toPrecision",
@@ -20,6 +21,8 @@ export function isNumberMethodName(property) {
     return typeof property === "string" && numberMethodNames.has(property);
 }
 export function callNumberMethod(value, methodName, args, budget, context) {
+    if (isSandboxBox(value))
+        value = boxedValue(value);
     if (typeof value !== "number") {
         throw new TypeError(`Number#${methodName} requires a number receiver.`);
     }

package/packages/safe-js/dist/interp/methods/string.d.ts

@@ -3,7 +3,9 @@ import { Budget } from "../budget.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { type SandboxCallContext, type SandboxClosure, type SandboxValue } from "../values.js";
 type StringMethodName = "at" | "charAt" | "charCodeAt" | "codePointAt" | "concat" | "endsWith" | "includes" | "indexOf" | "isWellFormed" | "lastIndexOf" | "localeCompare" | "match" | "matchAll" | "normalize" | "padEnd" | "padStart" | "repeat" | "replace" | "replaceAll" | "slice" | "search" | "split" | "startsWith" | "substr" | "substring" | "toLowerCase" | "toUpperCase" | "toWellFormed" | "trim" | "trimEnd" | "trimStart";
+export declare const stringMethodNames: Set<StringMethodName>;
 export declare function getStringMember(value: string, property: string | number, budget: Budget): SandboxValue | undefined;
+export declare function getStringIndex(property: string | number): number | undefined;
 export declare function isStringMethodName(property: string | number): property is StringMethodName;
 export declare function validateStringMethodArguments(_methodName: StringMethodName, _args: readonly Expression[]): void;
 export declare function callStringMethod(value: string, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, parent?: CompileScope, context?: SandboxCallContext): SandboxValue | Promise<SandboxValue>;

package/packages/safe-js/dist/interp/methods/string.js

@@ -6,7 +6,7 @@ import { retainValues } from "../resources.js";
 import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { executeRegex, toMatchArray } from "./regex.js";
 const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
-const stringMethodNames = new Set([
+export const stringMethodNames = new Set([
     "at",
     "charAt",
     "charCodeAt",
@@ -72,7 +72,7 @@ export function getStringMember(value, property, budget) {
         }
     });
 }
-function getStringIndex(property) {
+export function getStringIndex(property) {
     const index = typeof property === "number" ? property : Number(property);
     if (!Number.isInteger(index) || index < 0 || String(index) !== String(property)) {
         return undefined;

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -1,4 +1,5 @@
 import type { Budget } from "./budget.js";
+import { type BoxedPrimitive } from "./boxed.js";
 import { type SandboxClosure, type SandboxObject, type SandboxValue } from "./values.js";
 export declare function registerGuestClosure(closure: SandboxClosure): void;
 export declare function isGuestClosure(value: unknown): value is SandboxClosure;
@@ -6,6 +7,10 @@ export declare function getGuestFunctionProperties(closure: SandboxClosure): San
 export declare function materializeFunctionProperties(closure: SandboxClosure): SandboxObject;
 export declare function getGuestFunctionProperty(closure: SandboxClosure, key: string): SandboxValue;
 export declare function installObjectPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
+export declare function installBoxedPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
+export declare function getBoxedPrototype(value: BoxedPrimitive, budget: Budget): SandboxObject | undefined;
+export declare function isDefaultBoxedMethod(value: BoxedPrimitive, key: string, budget: Budget): boolean;
+export declare function isIntrinsicConstructor(value: object): boolean;
 export declare function releaseObjectPrototype(budget: Budget): void;
 export declare function getSandboxPrototype(value: object, budget?: Budget): object | null;
 export declare function hasExplicitSandboxPrototype(value: object): boolean;