poe-code 14.0.62 → 14.0.63

package/packages/safe-js/dist/interp/promise.js

@@ -1,6 +1,7 @@
 import { SandboxError } from "./budget.js";
 import { coerceThrownValue, createSubsetErrorValue } from "./exceptions.js";
 import { getSandboxIterator } from "./iteration.js";
+import { retainValues } from "./resources.js";
 import { runPromiseJob } from "./jobs.js";
 import { observeSandboxPromise } from "./promise-tracker.js";
 import { createSandboxClosure, createSandboxPromise, isSandboxClosure, isSandboxPromise } from "./values.js";
@@ -337,76 +338,82 @@ async function settleIterable(iterable, method, budget, constructor, context) {
         const promiseResolve = readPromiseReceiverProperty(constructor, "resolve", prototype);
         if (!isSandboxClosure(promiseResolve))
             throw new TypeError("Promise constructor requires a callable resolve.");
-        const iterator = getSandboxIterator(iterable, budget);
+        const iterator = getSandboxIterator(iterable, budget, context);
         if (iterator === undefined)
             throw new TypeError("Promise helpers require an iterable.");
-        let index = 0;
-        while (true) {
-            budget.visitNode();
-            const next = iterator.generator
-                ? await iterator.next()
-                : iterator.next();
-            if (typeof next !== "object" || next === null)
-                throw new TypeError("Iterator result must be an object.");
-            if (next.done)
-                break;
-            const value = next.value;
-            try {
-                budget.allocateArrayLength(index + 1);
-                const entryIndex = index++;
-                if (method !== "race")
-                    values.push(undefined);
-                const entry = await callPromiseClosure(promiseResolve, [value], constructor, budget, context);
-                let called = false;
-                const handlers = ["fulfilled", "rejected"].map((state) => {
-                    if (method === "race" || (method === "any" && state === "fulfilled"))
-                        return state === "fulfilled" ? capability.resolve : capability.reject;
-                    if (method === "all" && state === "rejected")
-                        return capability.reject;
-                    return createSandboxClosure({
-                        sandbox: true,
-                        retainedValues: () => [
-                            capability.promise,
-                            capability.resolve,
-                            capability.reject,
-                            values
-                        ],
-                        call: async ([settlement]) => {
-                            if (called)
+        const releaseIterator = retainValues(budget, () => [iterator.retainedValue]);
+        try {
+            let index = 0;
+            while (true) {
+                budget.visitNode();
+                const next = iterator.generator || iterator.asynchronous
+                    ? await iterator.next()
+                    : iterator.next();
+                if (typeof next !== "object" || next === null)
+                    throw new TypeError("Iterator result must be an object.");
+                if (next.done)
+                    break;
+                const value = next.value;
+                try {
+                    budget.allocateArrayLength(index + 1);
+                    const entryIndex = index++;
+                    if (method !== "race")
+                        values.push(undefined);
+                    const entry = await callPromiseClosure(promiseResolve, [value], constructor, budget, context);
+                    let called = false;
+                    const handlers = ["fulfilled", "rejected"].map((state) => {
+                        if (method === "race" || (method === "any" && state === "fulfilled"))
+                            return state === "fulfilled" ? capability.resolve : capability.reject;
+                        if (method === "all" && state === "rejected")
+                            return capability.reject;
+                        return createSandboxClosure({
+                            sandbox: true,
+                            retainedValues: () => [
+                                capability.promise,
+                                capability.resolve,
+                                capability.reject,
+                                values
+                            ],
+                            call: async ([settlement]) => {
+                                if (called)
+                                    return undefined;
+                                called = true;
+                                values[entryIndex] =
+                                    method === "allSettled"
+                                        ? state === "fulfilled"
+                                            ? { status: state, value: settlement }
+                                            : { status: state, reason: settlement }
+                                        : settlement;
+                                remaining--;
+                                await complete();
                                 return undefined;
-                            called = true;
-                            values[entryIndex] =
-                                method === "allSettled"
-                                    ? state === "fulfilled"
-                                        ? { status: state, value: settlement }
-                                        : { status: state, reason: settlement }
-                                    : settlement;
-                            remaining--;
-                            await complete();
-                            return undefined;
-                        }
+                            }
+                        });
                     });
-                });
-                remaining++;
-                const then = readPromiseReceiverProperty(entry, "then", prototype);
-                if (!isSandboxClosure(then))
-                    throw new TypeError("Promise resolver result requires a callable then.");
-                await callPromiseClosure(then, handlers, entry, budget, context);
-            }
-            catch (error) {
-                try {
-                    const closed = iterator.return?.();
-                    if (iterator.generator)
-                        await closed;
+                    remaining++;
+                    const then = readPromiseReceiverProperty(entry, "then", prototype);
+                    if (!isSandboxClosure(then))
+                        throw new TypeError("Promise resolver result requires a callable then.");
+                    await callPromiseClosure(then, handlers, entry, budget, context);
                 }
-                catch {
+                catch (error) {
+                    try {
+                        const closed = iterator.return?.();
+                        if (iterator.generator || iterator.asynchronous)
+                            await closed;
+                    }
+                    catch {
+                        throw error;
+                    }
                     throw error;
                 }
-                throw error;
             }
+            remaining--;
+            await complete();
+        }
+        finally {
+            releaseIterator();
         }
-        remaining--;
-        await complete();
     }
     catch (error) {
         if (error instanceof SandboxError &&

package/packages/safe-js/dist/interp/string-coercion.js

@@ -9,6 +9,7 @@ import { getGuestFunctionProperties, getSandboxPrototype, hasExplicitSandboxProt
 import { getRegexMember } from "./methods/regex.js";
 import { retainValues } from "./resources.js";
 import { functionString } from "./function-string.js";
+import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandboxRegex, isSandboxGenerator } from "./values.js";
 const defaultStringHook = Symbol("defaultStringHook");
 const defaultValueHook = Symbol("defaultValueHook");
@@ -40,7 +41,7 @@ async function objectToPrimitive(value, budget, context, joining, hint) {
                 result = await defaultToString(value, budget, context, joining);
             }
             else if (hook === defaultValueHook) {
-                result = isSandboxDate(value) ? dateTime(value) : value;
+                result = isSandboxDate(value) ? dateTime(value) : isSandboxBox(value) ? boxedValue(value) : value;
             }
             else {
                 if (!isSandboxClosure(hook))
@@ -97,6 +98,8 @@ function conversionHook(value, name, budget) {
     return undefined;
 }
 async function defaultToString(value, budget, context, joining) {
+    if (isSandboxBox(value))
+        return budget.allocateString(String(boxedValue(value)));
     if (isSandboxClosure(value))
         return budget.allocateString(functionString(value));
     if (isSandboxMap(value))

package/packages/safe-js/dist/interp/values.d.ts

@@ -134,6 +134,7 @@ export declare function deepCopyToSandbox(value: unknown): SandboxValue;
 export declare function cloneSandboxValue(value: SandboxValue, options?: {
     compilation?: CompileScope;
     resetRegexLastIndex?: boolean;
+    structuredClone?: boolean;
 }): SandboxValue;
 export declare function allocateProducedSandboxValue(value: SandboxValue, budget: Budget): SandboxValue;
 export declare function measureSandboxData(values: Iterable<unknown>, options?: {

package/packages/safe-js/dist/interp/values.js

@@ -2,6 +2,7 @@ import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { isSandboxMap, isSandboxSet, sandboxMapBrand, sandboxSetBrand } from "./collection-brands.js";
 import { collectionIteratorState, isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshotCollectionIterator } from "./collection-iterator.js";
 import { copyNativeDate, exportDate, isSandboxDate } from "./date.js";
+import { boxedDataProperties, boxedValue, createSandboxBox, isSandboxBox, nativeBoxedValue } from "./boxed.js";
 import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, measureHostObjectData, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { types as nodeTypes } from "node:util";
 import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
@@ -13,7 +14,7 @@ import { invokeCancelableClosure, readPromiseCancellation, registerPromiseCancel
 import { parseRegex } from "./regex/parse.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { sandboxErrorTypes } from "../error/shape.js";
-import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, isGuestClosure, registerGuestClosure } from "./object-model.js";
+import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, isGuestClosure, isIntrinsicConstructor, registerGuestClosure } from "./object-model.js";
 import { copySandboxArgumentProperties, createSandboxArguments, getSandboxArgumentEntries, isSandboxArguments } from "./arguments.js";
 export { createSandboxArguments, isSandboxArguments } from "./arguments.js";
 export { isSandboxMap, isSandboxSet } from "./collection-brands.js";
@@ -243,6 +244,19 @@ export function measureSandboxData(values, options = {}) {
         assertSandboxDataDepth(depth);
         seen.add(value);
         usage += 1;
+        if (isSandboxBox(value)) {
+            const primitive = boxedValue(value);
+            usage += typeof primitive === "string" ? primitive.length : 8;
+            const prototype = getSandboxPrototype(value);
+            if (prototype !== null)
+                visit(prototype, depth + 1);
+            for (const [key, descriptor] of boxedDataProperties(value)) {
+                usage += key.length + 1;
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+            }
+            return;
+        }
         if (isSandboxDate(value)) {
             usage += 8;
             return;
@@ -311,8 +325,19 @@ export function measureSandboxData(values, options = {}) {
         if (isSandboxClosure(value)) {
             if (options.ignoreClosures)
                 return;
-            if (value.properties !== undefined)
-                visit(value.properties, depth + 1);
+            if (value.properties !== undefined) {
+                if (isIntrinsicConstructor(value)) {
+                    for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value.properties))) {
+                        if (key === "prototype" || key === "name" || key === "length")
+                            continue;
+                        usage += key.length + 1;
+                        if ("value" in descriptor)
+                            visit(descriptor.value, depth + 1);
+                    }
+                }
+                else
+                    visit(value.properties, depth + 1);
+            }
             if (!options.ignoreClosureCaptures)
                 for (const retained of value[sandboxRetainedValues]?.() ?? [])
                     visit(retained, depth + 1);
@@ -457,6 +482,26 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
         throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
     }
+    const primitive = nativeBoxedValue(value);
+    if (primitive !== undefined) {
+        const original = value;
+        const existing = state.seen.get(original);
+        if (existing !== undefined)
+            return existing;
+        const copy = createSandboxBox(primitive);
+        state.seen.set(original, copy);
+        if (!state.structuredClone) {
+            for (const [key, descriptor] of boxedDataProperties(original)) {
+                if (!("value" in descriptor))
+                    throw new TypeError("Boxed data cannot contain accessors.");
+                Object.defineProperty(copy, key, {
+                    ...descriptor,
+                    value: copyToSandbox(descriptor.value, state, joinPath(path, key), cloneSandboxCollections, depth + 1)
+                });
+            }
+        }
+        return copy;
+    }
     if (isSandboxMap(value)) {
         if (!cloneSandboxCollections)
             return value;
@@ -598,6 +643,22 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
         throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
     }
+    if (isSandboxBox(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = Object(boxedValue(value));
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of boxedDataProperties(value)) {
+            if (!("value" in descriptor))
+                throw new TypeError("Boxed data cannot contain accessors.");
+            Object.defineProperty(copy, key, {
+                ...descriptor,
+                value: copyFromSandbox(descriptor.value, state, joinPath(path, key), options, depth + 1)
+            });
+        }
+        return copy;
+    }
     const regexBrand = Object.getOwnPropertyDescriptor(value, sandboxRegexBrand);
     if (regexBrand !== undefined) {
         if (!("value" in regexBrand) || regexBrand.value !== true) {
@@ -759,6 +820,20 @@ function allocateSandboxValue(value, budget, seen) {
         budget.allocateString(value);
         return;
     }
+    if (isSandboxBox(value)) {
+        if (seen.has(value))
+            return;
+        seen.add(value);
+        const primitive = boxedValue(value);
+        if (typeof primitive === "string")
+            budget.allocateString(primitive);
+        for (const [key, descriptor] of boxedDataProperties(value)) {
+            budget.allocateString(key);
+            if ("value" in descriptor)
+                allocateSandboxValue(descriptor.value, budget, seen);
+        }
+        return;
+    }
     if (isFloat32Array(value)) {
         if (seen.has(value))
             return;

package/packages/safe-js/dist/migrate.d.ts

@@ -13,14 +13,14 @@ export declare function inspectSnapshotMigration(snapshot: SafeJSSnapshot, optio
     checkpointDigest: string;
     sourceHash: string;
     executionSemantics: string;
-    calls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+    calls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
         asynchronous: boolean;
         outcome?: {
             status: "fulfilled" | "rejected";
             data: import("./snapshot/replay-data.js").ReplayData;
         };
     })[];
-    unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+    unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
         asynchronous: boolean;
         outcome?: {
             status: "fulfilled" | "rejected";

package/packages/safe-js/dist/migration-file.d.ts

@@ -13,14 +13,14 @@ export declare function migrateSnapshotFile(options: SnapshotMigrationFileOption
         checkpointDigest: string;
         sourceHash: string;
         executionSemantics: string;
-        calls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+        calls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
             asynchronous: boolean;
             outcome?: {
                 status: "fulfilled" | "rejected";
                 data: import("./snapshot/replay-data.js").ReplayData;
             };
         })[];
-        unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+        unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
             asynchronous: boolean;
             outcome?: {
                 status: "fulfilled" | "rejected";
@@ -35,14 +35,14 @@ export declare function migrateSnapshotFile(options: SnapshotMigrationFileOption
         checkpointDigest: string;
         sourceHash: string;
         executionSemantics: string;
-        calls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+        calls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
             asynchronous: boolean;
             outcome?: {
                 status: "fulfilled" | "rejected";
                 data: import("./snapshot/replay-data.js").ReplayData;
             };
         })[];
-        unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "outcome" | "asynchronous"> & {
+        unresolvedCalls: (Omit<import("./index.js").HostCallRecord, "asynchronous" | "outcome"> & {
             asynchronous: boolean;
             outcome?: {
                 status: "fulfilled" | "rejected";

package/packages/safe-js/dist/snapshot/boxed.d.ts

@@ -0,0 +1,16 @@
+import { type SandboxBox } from "../interp/boxed.js";
+import type { SandboxValue } from "../interp/values.js";
+export type BoxedData<T> = {
+    kind: "boxed";
+    value: T;
+    properties: Record<string, {
+        value: T;
+        configurable: boolean;
+        enumerable: boolean;
+        writable: boolean;
+    }>;
+    extensible: boolean;
+};
+export declare function encodeBoxedData<T>(value: SandboxBox, encode: (value: SandboxValue, key: string) => T): BoxedData<T>;
+export declare function restoreBoxedProperties<T>(value: SandboxBox, data: BoxedData<T>, decode: (value: T) => unknown): void;
+export declare function validateBoxedProperties(data: Record<string, unknown>): void;

package/packages/safe-js/dist/snapshot/boxed.js

@@ -0,0 +1,52 @@
+import { boxedDataProperties, boxedValue } from "../interp/boxed.js";
+export function encodeBoxedData(value, encode) {
+    const properties = Object.create(null);
+    for (const [key, descriptor] of boxedDataProperties(value)) {
+        if (!("value" in descriptor))
+            throw new TypeError("Boxed data cannot contain accessors.");
+        properties[key] = {
+            value: encode(descriptor.value, key),
+            configurable: descriptor.configurable === true,
+            enumerable: descriptor.enumerable === true,
+            writable: descriptor.writable === true
+        };
+    }
+    return {
+        kind: "boxed",
+        value: encode(boxedValue(value), "<payload>"),
+        properties,
+        extensible: Object.isExtensible(value)
+    };
+}
+export function restoreBoxedProperties(value, data, decode) {
+    for (const [key, descriptor] of Object.entries(data.properties))
+        Object.defineProperty(value, key, { ...descriptor, value: decode(descriptor.value) });
+    if (!data.extensible)
+        Object.preventExtensions(value);
+}
+export function validateBoxedProperties(data) {
+    if (!Object.hasOwn(data, "kind") ||
+        data.kind !== "boxed" ||
+        !Object.hasOwn(data, "value") ||
+        !Object.hasOwn(data, "extensible") ||
+        !Object.hasOwn(data, "properties") ||
+        Object.keys(data).length !== 4 ||
+        typeof data.extensible !== "boolean" ||
+        typeof data.properties !== "object" ||
+        data.properties === null ||
+        Array.isArray(data.properties))
+        throw new TypeError("Invalid boxed primitive properties.");
+    for (const descriptor of Object.values(data.properties)) {
+        if (typeof descriptor !== "object" ||
+            descriptor === null ||
+            !Object.hasOwn(descriptor, "value") ||
+            !Object.hasOwn(descriptor, "writable") ||
+            !Object.hasOwn(descriptor, "enumerable") ||
+            !Object.hasOwn(descriptor, "configurable") ||
+            typeof descriptor.writable !== "boolean" ||
+            typeof descriptor.enumerable !== "boolean" ||
+            typeof descriptor.configurable !== "boolean" ||
+            Object.keys(descriptor).length !== 4)
+            throw new TypeError("Invalid boxed primitive descriptor.");
+    }
+}

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -9,6 +9,8 @@ import { requiresArrayEntries, serializeArray } from "./arrays.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { encodeFloat32Storage } from "./float32array.js";
 import { isSandboxDate, serializedDateTime } from "../interp/date.js";
+import { boxedDataProperties, isSandboxBox } from "../interp/boxed.js";
+import { encodeBoxedData } from "./boxed.js";
 const SKIP_VALUE = Symbol("SafeJS.skip-dump-value");
 export function serializeSafeJSSnapshot(snapshot) {
     const replayError = Object.getOwnPropertyDescriptor(snapshot, "replayError");
@@ -73,7 +75,7 @@ function serializeDumpValue(value, path, state) {
     if (hasGuestObjectState(value)) {
         throw new TypeError("Guest function properties and prototype links cannot be serialized.");
     }
-    if (isSandboxDate(value) || isFloat32Array(value))
+    if (isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
         return serializeHeapReference(value, path, state);
     if (Array.isArray(value)) {
         const reference = serializeHeapReference(value, path, state);
@@ -98,7 +100,15 @@ function serializeHeapReference(value, path, state) {
     }
     if (!state.serializedHeapIds.has(id)) {
         state.serializedHeapIds.add(id);
-        if (isSandboxDate(value)) {
+        if (isSandboxBox(value)) {
+            state.heap[String(id)] = encodeBoxedData(value, (entry, key) => {
+                if (Object.is(entry, -0))
+                    return { kind: "number", value: "-0" };
+                const serialized = serializeDumpValue(entry, `${path}.${key}`, state);
+                return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+            });
+        }
+        else if (isSandboxDate(value)) {
             state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
         }
         else if (isFloat32Array(value)) {
@@ -163,6 +173,7 @@ function indexHeapContainers(snapshot) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            isSandboxBox(value) ||
             isSandboxDate(value) ||
             isFloat32Array(value) ||
             (Array.isArray(value) && requiresArrayEntries(value)) ||
@@ -200,9 +211,11 @@ function collectContainerStats(value, stats, ancestors) {
     }
     stat.expanded = true;
     ancestors.add(value);
-    const entries = isSandboxArguments(value)
-        ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
-        : getEnumerableDataValues(value);
+    const entries = isSandboxBox(value)
+        ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value)
+        : isSandboxArguments(value)
+            ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
+            : getEnumerableDataValues(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safe-js/dist/snapshot/replay-data.d.ts

@@ -26,6 +26,11 @@ type Properties = Record<string, {
     writable: boolean;
 }>;
 type DataNode = {
+    kind: "boxed";
+    value: Atom;
+    properties: Properties;
+    extensible: boolean;
+} | {
     kind: "collection-iterator";
     collectionKind: "map" | "set";
     method: CollectionIterationMethod;

package/packages/safe-js/dist/snapshot/replay-data.js

@@ -5,6 +5,8 @@ import { CompileScope } from "../interp/regex/compile-guard.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { decodeFloat32Storage, encodeFloat32Storage } from "./float32array.js";
 import { isSandboxDate, restoreDateTime, serializedDateTime } from "../interp/date.js";
+import { boxedDataProperties, createSandboxBox, nativeBoxedValue } from "../interp/boxed.js";
+import { validateBoxedProperties } from "./boxed.js";
 import { sandboxErrorNames, sandboxErrorTypes } from "../error/shape.js";
 import { createSandboxArguments, createSandboxClosure, createSandboxMap, createSandboxRegex, createSandboxSet, isSandboxArguments, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "../interp/values.js";
 import { serializeArguments } from "./arguments.js";
@@ -65,6 +67,15 @@ export function encodeReplayData(value, options = {}) {
                 properties: child(entry.properties, "properties")
             };
         }
+        else if (nativeBoxedValue(entry) !== undefined) {
+            const properties = Object.create(null);
+            nodes[id] = { kind: "boxed", value: child(nativeBoxedValue(entry), "<payload>"), properties, extensible: Object.isExtensible(entry) };
+            for (const [key, descriptor] of boxedDataProperties(entry)) {
+                if (!("value" in descriptor))
+                    throw new TypeError(`Cannot record replay data accessor '${key}'.`);
+                properties[key] = { value: child(descriptor.value, JSON.stringify(["property", key])), configurable: descriptor.configurable === true, enumerable: descriptor.enumerable === true, writable: descriptor.writable === true };
+            }
+        }
         else if (isSandboxDate(entry)) {
             nodes[id] = { kind: "date", time: serializedDateTime(entry) };
         }
@@ -247,6 +258,19 @@ export function decodeReplayData(input, options = {}, parent) {
                 options.onCapabilityRestored?.(capability, copy);
                 return copy;
             }
+            if (kind === "boxed") {
+                validateBoxedProperties(node);
+                const payload = own(node, "value");
+                if (typeof payload !== "number" && typeof payload !== "string" && typeof payload !== "boolean" &&
+                    (payload === null || typeof payload !== "object" || own(record(payload), "tag") !== "number"))
+                    throw new TypeError("Invalid boxed primitive payload.");
+                const result = createSandboxBox(child(payload));
+                restored.set(id, result);
+                defineProperties(result, record(own(node, "properties")), child);
+                if (!node.extensible)
+                    Object.preventExtensions(result);
+                return result;
+            }
             if (kind === "date") {
                 if (Object.keys(node).length !== 2)
                     throw new TypeError("Invalid serialized Date fields.");

package/packages/safe-js/dist/snapshot/restore.js

@@ -4,6 +4,8 @@ import { toPropertyKey } from "../interp/property-key.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { decodeFloat32Storage } from "./float32array.js";
 import { restoreDateTime } from "../interp/date.js";
+import { createSandboxBox } from "../interp/boxed.js";
+import { restoreBoxedProperties } from "./boxed.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { SnapshotMismatchError } from "../restore.js";
 import { Scope, setSandboxProperty } from "../interp/interpreter.js";
@@ -349,6 +351,12 @@ function restoreHeapValue(id, state) {
     if (serialized === undefined) {
         throw new Error(`Snapshot references unknown heap value ${id}.`);
     }
+    if (serialized.kind === "boxed") {
+        const value = createSandboxBox(deserializeValue(serialized.value, state));
+        state.heapValueById.set(id, value);
+        restoreBoxedProperties(value, serialized, entry => deserializeValue(entry, state));
+        return value;
+    }
     if (serialized.kind === "date") {
         const value = restoreDateTime(serialized.time);
         state.heapValueById.set(id, value);

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -3,6 +3,8 @@ import { type SandboxErrorName } from "../error/shape.js";
 import { type SerializedArguments } from "./arguments.js";
 import { type SerializedArray } from "./arrays.js";
 import { type Float32Data } from "./float32array.js";
+import { type SandboxBox } from "../interp/boxed.js";
+import { type BoxedData } from "./boxed.js";
 import { type SandboxMap, type SandboxGenerator, type SandboxRegex, type SandboxSet } from "../interp/values.js";
 type SnapshotId = number | string;
 type SerializedUndefinedValue = {
@@ -41,7 +43,7 @@ export type SerializedReferenceValue = {
     kind: "ref";
     id: number;
 };
-export type SerializedHeapValue = {
+export type SerializedHeapValue = BoxedData<SerializedSnapshotValue> | {
     kind: "regex-object";
     source: string;
     flags: string;
@@ -89,7 +91,7 @@ export type RuntimePromiseValue = {
     id: SnapshotId;
     promise?: Promise<unknown>;
 };
-export type RuntimeSnapshotValue = Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
+export type RuntimeSnapshotValue = SandboxBox | Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
     [key: string]: RuntimeSnapshotValue;
 };
 export type RuntimeScopeFrame = {