poe-code 14.0.62 → 14.0.64

package/dist/index.js

@@ -50271,8 +50271,8 @@ function assertNonNegativeInteger3(value, keyword) {
 }
 function validateSchemaObject(schema, dialect) {
   if (schema.type !== void 0) {
-    const types6 = Array.isArray(schema.type) ? schema.type : [schema.type];
-    if (types6.length === 0 || !types6.every((type) => typeof type === "string" && draftTypeSet.has(type)) || new Set(types6).size !== types6.length) {
+    const types7 = Array.isArray(schema.type) ? schema.type : [schema.type];
+    if (types7.length === 0 || !types7.every((type) => typeof type === "string" && draftTypeSet.has(type)) || new Set(types7).size !== types7.length) {
       throw new Error("type must be a JSON Schema type or a unique array of JSON Schema types.");
     }
   }
@@ -50991,9 +50991,9 @@ function evaluateValidationKeywords(node, schema, value, path193) {
   if (schema.nullable === true && value === null) {
     return results;
   }
-  const types6 = typeof schema.type === "string" ? [schema.type] : Array.isArray(schema.type) ? schema.type : [];
-  if (types6.length > 0 && !types6.some((type) => typeof type === "string" && typeMatches(type, value))) {
-    results.push(invalidResult(issue(path193, types6.join(","), value, `must be ${types6.join(",")}`)));
+  const types7 = typeof schema.type === "string" ? [schema.type] : Array.isArray(schema.type) ? schema.type : [];
+  if (types7.length > 0 && !types7.some((type) => typeof type === "string" && typeMatches(type, value))) {
+    results.push(invalidResult(issue(path193, types7.join(","), value, `must be ${types7.join(",")}`)));
     return results;
   }
   if (schema.const !== void 0 && !deepEqual(schema.const, value)) {
@@ -80409,18 +80409,18 @@ function readNumber3(value, fallback, field) {
   return value;
 }
 function readPositiveInteger(value, fallback, field) {
-  const numberValue2 = readNumber3(value, fallback, field);
-  if (!Number.isInteger(numberValue2) || numberValue2 <= 0) {
+  const numberValue3 = readNumber3(value, fallback, field);
+  if (!Number.isInteger(numberValue3) || numberValue3 <= 0) {
     throw new Error(`Expected "${field}" to be a positive integer.`);
   }
-  return numberValue2;
+  return numberValue3;
 }
 function readNonNegativeInteger(value, fallback, field) {
-  const numberValue2 = readNumber3(value, fallback, field);
-  if (!Number.isInteger(numberValue2) || numberValue2 < 0) {
+  const numberValue3 = readNumber3(value, fallback, field);
+  if (!Number.isInteger(numberValue3) || numberValue3 < 0) {
     throw new Error(`Expected "${field}" to be a non-negative integer.`);
   }
-  return numberValue2;
+  return numberValue3;
 }
 function readOptionalString3(value, field) {
   if (value === void 0) {
@@ -125901,6 +125901,54 @@ var init_collection_brands = __esm({
   }
 });
 
+// packages/safe-js/src/interp/boxed.ts
+import { types } from "node:util";
+function nativeBoxedValue(value) {
+  if (types.isNumberObject(value)) return Reflect.apply(numberValue2, value, []);
+  if (types.isStringObject(value)) return Reflect.apply(stringValue2, value, []);
+  if (types.isBooleanObject(value)) return Reflect.apply(booleanValue, value, []);
+  return void 0;
+}
+function createSandboxBox(value) {
+  if (typeof value !== "number" && typeof value !== "string" && typeof value !== "boolean")
+    throw new TypeError("Invalid boxed primitive payload.");
+  const box = Object(value);
+  Object.setPrototypeOf(box, null);
+  boxes.add(box);
+  return box;
+}
+function isSandboxBox(value) {
+  return typeof value === "object" && value !== null && boxes.has(value);
+}
+function boxedValue(value) {
+  if (!boxes.has(value)) throw new TypeError("Expected a sandbox boxed primitive.");
+  return nativeBoxedValue(value);
+}
+function primitiveReceiver(value, kind) {
+  const primitive = isSandboxBox(value) ? boxedValue(value) : value;
+  if (typeof primitive !== kind) throw new TypeError(`${kind} method requires a ${kind} receiver.`);
+  return primitive;
+}
+function boxedDataProperties(value) {
+  const primitive = nativeBoxedValue(value);
+  return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key3]) => {
+    if (typeof primitive !== "string") return true;
+    if (key3 === "length") return false;
+    const index = Number(key3);
+    return !(Number.isInteger(index) && index >= 0 && index < primitive.length && String(index) === key3);
+  });
+}
+var boxes, numberValue2, stringValue2, booleanValue;
+var init_boxed = __esm({
+  "packages/safe-js/src/interp/boxed.ts"() {
+    "use strict";
+    boxes = /* @__PURE__ */ new WeakSet();
+    numberValue2 = Number.prototype.valueOf;
+    stringValue2 = String.prototype.valueOf;
+    booleanValue = Boolean.prototype.valueOf;
+  }
+});
+
 // packages/safe-js/src/graph-depth.ts
 function assertSandboxDataDepth(depth) {
   if (depth > MAX_DATA_DEPTH) {
@@ -125943,6 +125991,7 @@ function walkGraphDepth(root, rootPath, assertDepth) {
   }
 }
 function graphEntries(value) {
+  if (isSandboxBox(value)) return boxedDataProperties(value).map(([key3, descriptor]) => [`.${key3}`, descriptor.value]);
   if (isSandboxArguments(value)) {
     return getSandboxArgumentEntries(value).map(([key3, entry]) => [`.${key3}`, entry]);
   }
@@ -125975,6 +126024,7 @@ var init_graph_depth = __esm({
     init_arguments();
     init_collection_iterator();
     init_collection_brands();
+    init_boxed();
     MAX_DATA_DEPTH = 1024;
     SnapshotBudgetError = class extends Error {
       code = "budgetExceeded";
@@ -125995,9 +126045,9 @@ var init_graph_depth = __esm({
 });
 
 // packages/safe-js/src/extensions.ts
-import { types } from "node:util";
+import { types as types2 } from "node:util";
 function readDataRecord(value, label) {
-  if (typeof value !== "object" || value === null || types.isProxy(value)) {
+  if (typeof value !== "object" || value === null || types2.isProxy(value)) {
     throw new TypeError(`${label} must be a plain data record.`);
   }
   const prototype = Object.getPrototypeOf(value);
@@ -126017,7 +126067,7 @@ function readDataRecord(value, label) {
   return result;
 }
 function readStringList(value, label) {
-  if (!Array.isArray(value) || types.isProxy(value) || value.length > 4096) {
+  if (!Array.isArray(value) || types2.isProxy(value) || value.length > 4096) {
     throw new TypeError(`${label} must be a bounded string array.`);
   }
   const result = [];
@@ -126048,7 +126098,7 @@ var init_extensions = __esm({
 });
 
 // packages/safe-js/src/interp/host-capabilities.ts
-import { types as types2 } from "node:util";
+import { types as types3 } from "node:util";
 function createGuestReference(root, owner, assertActive) {
   const reference = Object.freeze(/* @__PURE__ */ Object.create(null));
   guestReferences.set(reference, { root, owner, assertActive });
@@ -126096,7 +126146,7 @@ function createLiveHostObject(definition, controller) {
     for (const name of ["keys", "get", "set", "delete"]) {
       const operation = data[name];
       if (operation === void 0 && (name === "set" || name === "delete")) continue;
-      if (typeof operation !== "function" || types2.isProxy(operation) || types2.isAsyncFunction(operation) || types2.isGeneratorFunction(operation))
+      if (typeof operation !== "function" || types3.isProxy(operation) || types3.isAsyncFunction(operation) || types3.isGeneratorFunction(operation))
         throw new TypeError(`Named ${name} must be a synchronous non-generator function, not a proxy.`);
     }
     if (typeof data.maxKeys !== "number" || !Number.isInteger(data.maxKeys) || data.maxKeys < 1 || data.maxKeys > MAX_NAMED_KEYS)
@@ -126351,7 +126401,7 @@ function namedMutationKeys(state, key3, create) {
 function namedKeys2(state) {
   const named = state.named;
   return state.controller.read(named.keys, (value) => {
-    if (!Array.isArray(value) || types2.isProxy(value))
+    if (!Array.isArray(value) || types3.isProxy(value))
       throw new TypeError("Named keys must be a dense own-data array of strings, not a proxy.");
     const length = Object.getOwnPropertyDescriptor(value, "length").value;
     if (length > named.maxKeys) throw new RangeError("Named keys exceed maxKeys.");
@@ -126492,7 +126542,7 @@ var init_otel2 = __esm({
 });
 
 // packages/safe-js/src/interp/date.ts
-import { types as types3 } from "node:util";
+import { types as types4 } from "node:util";
 function isSandboxDate(value) {
   return typeof value === "object" && value !== null && dates.has(value);
 }
@@ -126505,7 +126555,7 @@ function dateTime(value) {
   return Reflect.apply(readTime, value, []);
 }
 function copyNativeDate(value) {
-  if (!types3.isDate(value)) return void 0;
+  if (!types4.isDate(value)) return void 0;
   if (Object.getPrototypeOf(value) !== NativeDate.prototype || Reflect.ownKeys(value).length > 0)
     throw new TypeError("Date subclasses and own properties are not supported.");
   return createSandboxDate(dateTime(value));
@@ -127203,6 +127253,40 @@ var init_float32array = __esm({
   }
 });
 
+// packages/safe-js/src/snapshot/boxed.ts
+function encodeBoxedData(value, encode) {
+  const properties = /* @__PURE__ */ Object.create(null);
+  for (const [key3, descriptor] of boxedDataProperties(value)) {
+    if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+    properties[key3] = {
+      value: encode(descriptor.value, key3),
+      configurable: descriptor.configurable === true,
+      enumerable: descriptor.enumerable === true,
+      writable: descriptor.writable === true
+    };
+  }
+  return {
+    kind: "boxed",
+    value: encode(boxedValue(value), "<payload>"),
+    properties,
+    extensible: Object.isExtensible(value)
+  };
+}
+function validateBoxedProperties(data) {
+  if (!Object.hasOwn(data, "kind") || data.kind !== "boxed" || !Object.hasOwn(data, "value") || !Object.hasOwn(data, "extensible") || !Object.hasOwn(data, "properties") || Object.keys(data).length !== 4 || typeof data.extensible !== "boolean" || typeof data.properties !== "object" || data.properties === null || Array.isArray(data.properties))
+    throw new TypeError("Invalid boxed primitive properties.");
+  for (const descriptor of Object.values(data.properties)) {
+    if (typeof descriptor !== "object" || descriptor === null || !Object.hasOwn(descriptor, "value") || !Object.hasOwn(descriptor, "writable") || !Object.hasOwn(descriptor, "enumerable") || !Object.hasOwn(descriptor, "configurable") || typeof descriptor.writable !== "boolean" || typeof descriptor.enumerable !== "boolean" || typeof descriptor.configurable !== "boolean" || Object.keys(descriptor).length !== 4)
+      throw new TypeError("Invalid boxed primitive descriptor.");
+  }
+}
+var init_boxed2 = __esm({
+  "packages/safe-js/src/snapshot/boxed.ts"() {
+    "use strict";
+    init_boxed();
+  }
+});
+
 // packages/safe-js/src/snapshot/arguments.ts
 function serializeArguments(value, serializeValue) {
   const properties = /* @__PURE__ */ Object.create(null);
@@ -127289,6 +127373,13 @@ function encodeReplayData(value, options = {}) {
         id: capabilityId,
         properties: child(entry.properties, "properties")
       };
+    } else if (nativeBoxedValue(entry) !== void 0) {
+      const properties = /* @__PURE__ */ Object.create(null);
+      nodes[id] = { kind: "boxed", value: child(nativeBoxedValue(entry), "<payload>"), properties, extensible: Object.isExtensible(entry) };
+      for (const [key3, descriptor] of boxedDataProperties(entry)) {
+        if (!("value" in descriptor)) throw new TypeError(`Cannot record replay data accessor '${key3}'.`);
+        properties[key3] = { value: child(descriptor.value, JSON.stringify(["property", key3])), configurable: descriptor.configurable === true, enumerable: descriptor.enumerable === true, writable: descriptor.writable === true };
+      }
     } else if (isSandboxDate(entry)) {
       nodes[id] = { kind: "date", time: serializedDateTime(entry) };
     } else if (isFloat32Array(entry)) {
@@ -127450,6 +127541,17 @@ function decodeReplayData(input, options = {}, parent) {
         options.onCapabilityRestored?.(capability, copy);
         return copy;
       }
+      if (kind === "boxed") {
+        validateBoxedProperties(node);
+        const payload = own(node, "value");
+        if (typeof payload !== "number" && typeof payload !== "string" && typeof payload !== "boolean" && (payload === null || typeof payload !== "object" || own(record(payload), "tag") !== "number"))
+          throw new TypeError("Invalid boxed primitive payload.");
+        const result3 = createSandboxBox(child(payload));
+        restored.set(id, result3);
+        defineProperties(result3, record(own(node, "properties")), child);
+        if (!node.extensible) Object.preventExtensions(result3);
+        return result3;
+      }
       if (kind === "date") {
         if (Object.keys(node).length !== 2) throw new TypeError("Invalid serialized Date fields.");
         const result3 = restoreDateTime(own(node, "time"));
@@ -127588,6 +127690,8 @@ var init_replay_data = __esm({
     init_float32();
     init_float32array();
     init_date();
+    init_boxed();
+    init_boxed2();
     init_shape();
     init_values();
     init_arguments2();
@@ -128769,7 +128873,7 @@ async function objectToPrimitive(value, budget, context, joining, hint) {
       if (hook === defaultStringHook) {
         result = await defaultToString(value, budget, context, joining);
       } else if (hook === defaultValueHook) {
-        result = isSandboxDate(value) ? dateTime(value) : value;
+        result = isSandboxDate(value) ? dateTime(value) : isSandboxBox(value) ? boxedValue(value) : value;
       } else {
         if (!isSandboxClosure(hook)) continue;
         result = await invokeBuiltinClosure(hook, [], budget, context, value);
@@ -128809,6 +128913,7 @@ function conversionHook(value, name, budget) {
   return void 0;
 }
 async function defaultToString(value, budget, context, joining) {
+  if (isSandboxBox(value)) return budget.allocateString(String(boxedValue(value)));
   if (isSandboxClosure(value)) return budget.allocateString(functionString(value));
   if (isSandboxMap(value)) return "[object Map]";
   if (isSandboxSet(value)) return "[object Set]";
@@ -128881,6 +128986,7 @@ var init_string_coercion = __esm({
     init_regex();
     init_resources();
     init_function_string();
+    init_boxed();
     init_values();
     defaultStringHook = /* @__PURE__ */ Symbol("defaultStringHook");
     defaultValueHook = /* @__PURE__ */ Symbol("defaultValueHook");
@@ -129411,7 +129517,27 @@ var init_running_state = __esm({
 });
 
 // packages/safe-js/src/interp/iteration.ts
-function getSandboxIterator(value, budget) {
+function getSandboxIterator(value, budget, context) {
+  if (isSandboxBox(value) && typeof boxedValue(value) === "string") {
+    const primitive = boxedValue(value);
+    let text5;
+    let iterator;
+    let initialized;
+    return {
+      asynchronous: true,
+      get retainedValue() {
+        return text5 === primitive ? void 0 : text5;
+      },
+      next: async () => {
+        initialized ??= Promise.resolve(sandboxString(value, budget ?? new Budget(), context)).then((converted) => {
+          text5 = converted;
+          iterator = syncIterator(converted[Symbol.iterator]());
+        });
+        await initialized;
+        return iterator.next();
+      }
+    };
+  }
   if (isSandboxCollectionIterator(value)) return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
   if (isGuestHostObject(value)) return getHostObjectIterator(value);
   if (isFloat32Array(value)) {
@@ -129515,8 +129641,11 @@ var init_iteration = __esm({
     init_values();
     init_running_state();
     init_float32();
+    init_boxed();
     init_host_capabilities();
     init_collection_iterator();
+    init_budget2();
+    init_string_coercion();
   }
 });
 
@@ -129991,67 +130120,72 @@ async function settleIterable(iterable, method, budget, constructor, context) {
     const promiseResolve = readPromiseReceiverProperty(constructor, "resolve", prototype);
     if (!isSandboxClosure(promiseResolve))
       throw new TypeError("Promise constructor requires a callable resolve.");
-    const iterator = getSandboxIterator(iterable, budget);
+    const iterator = getSandboxIterator(iterable, budget, context);
     if (iterator === void 0) throw new TypeError("Promise helpers require an iterable.");
-    let index = 0;
-    while (true) {
-      budget.visitNode();
-      const next = iterator.generator ? await iterator.next() : iterator.next();
-      if (typeof next !== "object" || next === null)
-        throw new TypeError("Iterator result must be an object.");
-      if (next.done) break;
-      const value = next.value;
-      try {
-        budget.allocateArrayLength(index + 1);
-        const entryIndex = index++;
-        if (method !== "race") values.push(void 0);
-        const entry = await callPromiseClosure(
-          promiseResolve,
-          [value],
-          constructor,
-          budget,
-          context
-        );
-        let called = false;
-        const handlers = ["fulfilled", "rejected"].map((state) => {
-          if (method === "race" || method === "any" && state === "fulfilled")
-            return state === "fulfilled" ? capability.resolve : capability.reject;
-          if (method === "all" && state === "rejected") return capability.reject;
-          return createSandboxClosure({
-            sandbox: true,
-            retainedValues: () => [
-              capability.promise,
-              capability.resolve,
-              capability.reject,
-              values
-            ],
-            call: async ([settlement]) => {
-              if (called) return void 0;
-              called = true;
-              values[entryIndex] = method === "allSettled" ? state === "fulfilled" ? { status: state, value: settlement } : { status: state, reason: settlement } : settlement;
-              remaining--;
-              await complete();
-              return void 0;
-            }
-          });
-        });
-        remaining++;
-        const then = readPromiseReceiverProperty(entry, "then", prototype);
-        if (!isSandboxClosure(then))
-          throw new TypeError("Promise resolver result requires a callable then.");
-        await callPromiseClosure(then, handlers, entry, budget, context);
-      } catch (error3) {
+    const releaseIterator = retainValues(budget, () => [iterator.retainedValue]);
+    try {
+      let index = 0;
+      while (true) {
+        budget.visitNode();
+        const next = iterator.generator || iterator.asynchronous ? await iterator.next() : iterator.next();
+        if (typeof next !== "object" || next === null)
+          throw new TypeError("Iterator result must be an object.");
+        if (next.done) break;
+        const value = next.value;
         try {
-          const closed = iterator.return?.();
-          if (iterator.generator) await closed;
-        } catch {
+          budget.allocateArrayLength(index + 1);
+          const entryIndex = index++;
+          if (method !== "race") values.push(void 0);
+          const entry = await callPromiseClosure(
+            promiseResolve,
+            [value],
+            constructor,
+            budget,
+            context
+          );
+          let called = false;
+          const handlers = ["fulfilled", "rejected"].map((state) => {
+            if (method === "race" || method === "any" && state === "fulfilled")
+              return state === "fulfilled" ? capability.resolve : capability.reject;
+            if (method === "all" && state === "rejected") return capability.reject;
+            return createSandboxClosure({
+              sandbox: true,
+              retainedValues: () => [
+                capability.promise,
+                capability.resolve,
+                capability.reject,
+                values
+              ],
+              call: async ([settlement]) => {
+                if (called) return void 0;
+                called = true;
+                values[entryIndex] = method === "allSettled" ? state === "fulfilled" ? { status: state, value: settlement } : { status: state, reason: settlement } : settlement;
+                remaining--;
+                await complete();
+                return void 0;
+              }
+            });
+          });
+          remaining++;
+          const then = readPromiseReceiverProperty(entry, "then", prototype);
+          if (!isSandboxClosure(then))
+            throw new TypeError("Promise resolver result requires a callable then.");
+          await callPromiseClosure(then, handlers, entry, budget, context);
+        } catch (error3) {
+          try {
+            const closed = iterator.return?.();
+            if (iterator.generator || iterator.asynchronous) await closed;
+          } catch {
+            throw error3;
+          }
           throw error3;
         }
-        throw error3;
       }
+      remaining--;
+      await complete();
+    } finally {
+      releaseIterator();
     }
-    remaining--;
-    await complete();
   } catch (error3) {
     if (error3 instanceof SandboxError && (error3.code === "budgetExceeded" || error3.code === "reentry")) {
       if (isSandboxPromise(capability.promise)) observeSandboxPromise(capability.promise);
@@ -130359,6 +130493,7 @@ var init_promise = __esm({
     init_budget2();
     init_exceptions();
     init_iteration();
+    init_resources();
     init_jobs4();
     init_promise_tracker();
     init_values();
@@ -130776,6 +130911,17 @@ function measureSandboxData(values, options = {}) {
     assertSandboxDataDepth(depth);
     seen.add(value);
     usage += 1;
+    if (isSandboxBox(value)) {
+      const primitive = boxedValue(value);
+      usage += typeof primitive === "string" ? primitive.length : 8;
+      const prototype2 = getSandboxPrototype(value);
+      if (prototype2 !== null) visit(prototype2, depth + 1);
+      for (const [key3, descriptor] of boxedDataProperties(value)) {
+        usage += key3.length + 1;
+        if ("value" in descriptor) visit(descriptor.value, depth + 1);
+      }
+      return;
+    }
     if (isSandboxDate(value)) {
       usage += 8;
       return;
@@ -130837,7 +130983,15 @@ function measureSandboxData(values, options = {}) {
     }
     if (isSandboxClosure(value)) {
       if (options.ignoreClosures) return;
-      if (value.properties !== void 0) visit(value.properties, depth + 1);
+      if (value.properties !== void 0) {
+        if (isIntrinsicConstructor(value)) {
+          for (const [key3, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value.properties))) {
+            if (key3 === "prototype" || key3 === "name" || key3 === "length") continue;
+            usage += key3.length + 1;
+            if ("value" in descriptor) visit(descriptor.value, depth + 1);
+          }
+        } else visit(value.properties, depth + 1);
+      }
       if (!options.ignoreClosureCaptures)
         for (const retained of value[sandboxRetainedValues]?.() ?? []) visit(retained, depth + 1);
       return;
@@ -130969,6 +131123,24 @@ function copyToSandbox(value, state, path193 = "<root>", cloneSandboxCollections
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
   }
+  const primitive = nativeBoxedValue(value);
+  if (primitive !== void 0) {
+    const original = value;
+    const existing = state.seen.get(original);
+    if (existing !== void 0) return existing;
+    const copy = createSandboxBox(primitive);
+    state.seen.set(original, copy);
+    if (!state.structuredClone) {
+      for (const [key3, descriptor] of boxedDataProperties(original)) {
+        if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+        Object.defineProperty(copy, key3, {
+          ...descriptor,
+          value: copyToSandbox(descriptor.value, state, joinPath(path193, key3), cloneSandboxCollections, depth + 1)
+        });
+      }
+    }
+    return copy;
+  }
   if (isSandboxMap(value)) {
     if (!cloneSandboxCollections) return value;
     const existing = state.seen.get(value);
@@ -131141,6 +131313,20 @@ function copyFromSandbox(value, state, path193 = "<root>", options, depth = 0) {
   if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
   }
+  if (isSandboxBox(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = Object(boxedValue(value));
+    state.seen.set(value, copy);
+    for (const [key3, descriptor] of boxedDataProperties(value)) {
+      if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+      Object.defineProperty(copy, key3, {
+        ...descriptor,
+        value: copyFromSandbox(descriptor.value, state, joinPath(path193, key3), options, depth + 1)
+      });
+    }
+    return copy;
+  }
   const regexBrand = Object.getOwnPropertyDescriptor(value, sandboxRegexBrand);
   if (regexBrand !== void 0) {
     if (!("value" in regexBrand) || regexBrand.value !== true) {
@@ -131311,6 +131497,17 @@ function allocateSandboxValue2(value, budget, seen) {
     budget.allocateString(value);
     return;
   }
+  if (isSandboxBox(value)) {
+    if (seen.has(value)) return;
+    seen.add(value);
+    const primitive = boxedValue(value);
+    if (typeof primitive === "string") budget.allocateString(primitive);
+    for (const [key3, descriptor] of boxedDataProperties(value)) {
+      budget.allocateString(key3);
+      if ("value" in descriptor) allocateSandboxValue2(descriptor.value, budget, seen);
+    }
+    return;
+  }
   if (isFloat32Array(value)) {
     if (seen.has(value)) return;
     seen.add(value);
@@ -131457,6 +131654,7 @@ var init_values = __esm({
     init_collection_brands();
     init_collection_iterator();
     init_date();
+    init_boxed();
     init_host_capabilities();
     init_compile_guard();
     init_float32();
@@ -131527,25 +131725,61 @@ function getGuestFunctionProperty(closure, key3) {
 function installObjectPrototype(budget, prototype, constructor) {
   prototypes.set(prototype, null);
   intrinsicPrototypes.set(budget, prototype);
-  const records = [prototype, materializeFunctionProperties(constructor)].map((value) => ({
-    value,
-    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+  registerIntrinsicPrototype(budget, prototype, constructor);
+}
+function installBoxedPrototype(budget, prototype, constructor) {
+  let state = boxedPrototypes.get(budget);
+  if (state === void 0) boxedPrototypes.set(budget, state = /* @__PURE__ */ new Map());
+  state.set(typeof boxedValue(prototype), prototype);
+  initialBoxedMethods.set(prototype, new Map(Object.entries(Object.getOwnPropertyDescriptors(prototype)).map(([key3, descriptor]) => [key3, descriptor.value])));
+  registerIntrinsicPrototype(budget, prototype, constructor);
+}
+function getBoxedPrototype(value, budget) {
+  return boxedPrototypes.get(budget)?.get(typeof value);
+}
+function isDefaultBoxedMethod(value, key3, budget) {
+  const prototype = getBoxedPrototype(value, budget);
+  return prototype !== void 0 && initialBoxedMethods.get(prototype)?.has(key3) === true && Object.getOwnPropertyDescriptor(prototype, key3)?.value === initialBoxedMethods.get(prototype)?.get(key3);
+}
+function isIntrinsicConstructor(value) {
+  return intrinsicConstructors.has(value);
+}
+function registerIntrinsicPrototype(budget, prototype, constructor) {
+  let roots = intrinsicPrototypeRoots.get(budget);
+  if (roots === void 0) intrinsicPrototypeRoots.set(budget, roots = /* @__PURE__ */ new Set());
+  roots.add(prototype);
+  const records = [prototype, constructor].map((target) => ({
+    target,
+    value: isGuestClosure(target) ? materializeFunctionProperties(target) : target,
+    prototype: getSandboxPrototype(target),
+    explicit: hasExplicitSandboxPrototype(target)
+  })).map((record2) => ({
+    ...record2,
+    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record2.value)))
   }));
-  const unchanged = (before, after) => before !== void 0 && after !== void 0 && before.value === after.value && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
-  intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+  const unchanged = (before, after) => before !== void 0 && after !== void 0 && Object.is(before.value, after.value) && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+  intrinsicConstructors.set(constructor, () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
     const current = Object.getOwnPropertyDescriptors(value);
-    return Object.keys(current).length === descriptors.size && Object.keys(current).every((key3) => unchanged(descriptors.get(key3), current[key3]));
+    return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit && Object.keys(current).length === descriptors.size && Object.keys(current).every((key3) => unchanged(descriptors.get(key3), current[key3]));
   }));
-  budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key3, descriptor]) => unchanged(descriptors.get(key3), descriptor) ? [] : [key3, descriptor.value])));
+  budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
+    ...getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)],
+    ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key3, descriptor]) => unchanged(descriptors.get(key3), descriptor) ? [] : [key3, descriptor.value])
+  ]));
 }
 function releaseObjectPrototype(budget) {
-  const prototype = intrinsicPrototypes.get(budget);
-  if (prototype !== void 0) budget.setRetainedValues(prototype, void 0);
+  for (const prototype of intrinsicPrototypeRoots.get(budget) ?? []) budget.setRetainedValues(prototype, void 0);
+  intrinsicPrototypeRoots.delete(budget);
+  boxedPrototypes.delete(budget);
   intrinsicPrototypes.delete(budget);
 }
 function getSandboxPrototype(value, budget) {
   if (prototypes.has(value)) return prototypes.get(value) ?? null;
-  return budget !== void 0 && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
+  if (budget !== void 0 && isSandboxBox(value)) {
+    const prototype = getBoxedPrototype(boxedValue(value), budget);
+    if (prototype !== void 0 && prototype !== value) return prototype;
+  }
+  return budget !== void 0 && !isSandboxClosure(value) && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
 }
 function hasExplicitSandboxPrototype(value) {
   return prototypes.has(value);
@@ -131555,14 +131789,16 @@ function getSandboxDataProperty(value, key3, budget) {
   let depth = 0;
   while (typeof current === "object" && current !== null) {
     if (isGuestHostObject(current)) return getHostObjectMember(current, String(key3));
-    if (isGuestClosure(current)) return getGuestFunctionProperty(current, String(key3));
-    if (isSandboxClosure(current)) {
+    if (isGuestClosure(current)) {
+      const entry = getGuestFunctionProperty(current, String(key3));
+      if (entry !== void 0 || Object.hasOwn(current.properties ?? {}, String(key3))) return entry;
+    } else if (isSandboxClosure(current)) {
       const properties = current.properties;
       return properties !== void 0 && Object.hasOwn(properties, String(key3)) ? properties[String(key3)] : void 0;
     }
     if (isSandboxMap(current) || isSandboxSet(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxGenerator(current))
       return void 0;
-    if (Object.hasOwn(current, String(key3))) return current[String(key3)];
+    if (!isSandboxClosure(current) && Object.hasOwn(current, String(key3))) return current[String(key3)];
     current = getSandboxPrototype(current, budget);
     if (current !== null) {
       budget?.visitNode();
@@ -131577,7 +131813,7 @@ function setSandboxPrototype(value, prototype, budget) {
   }
   if (!isPrototypeRecord(value) || prototype !== null && !isPrototypeRecord(prototype)) {
     throw new TypeError(
-      "Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported."
+      "Prototype links require ordinary sandbox objects or guest functions."
     );
   }
   if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype) return;
@@ -131593,6 +131829,7 @@ function setSandboxPrototype(value, prototype, budget) {
   prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+  if (isGuestClosure(value)) return true;
   if (isGuestHostObject(value)) return false;
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxPromise(value) || isSandboxRegex(value) || isSandboxSet(value))
     return false;
@@ -131610,22 +131847,27 @@ function hasGuestObjectState(value) {
   if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
+  if (isSandboxBox(value)) return false;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
   );
 }
-var guestClosures, functionProperties, prototypes, intrinsicPrototypes, intrinsicConstructors, descriptorObjects;
+var guestClosures, functionProperties, prototypes, intrinsicPrototypes, boxedPrototypes, intrinsicPrototypeRoots, intrinsicConstructors, initialBoxedMethods, descriptorObjects;
 var init_object_model = __esm({
   "packages/safe-js/src/interp/object-model.ts"() {
     "use strict";
     init_graph_depth();
     init_host_capabilities();
+    init_boxed();
     init_values();
     guestClosures = /* @__PURE__ */ new WeakSet();
     functionProperties = /* @__PURE__ */ new WeakMap();
     prototypes = /* @__PURE__ */ new WeakMap();
     intrinsicPrototypes = /* @__PURE__ */ new WeakMap();
+    boxedPrototypes = /* @__PURE__ */ new WeakMap();
+    intrinsicPrototypeRoots = /* @__PURE__ */ new WeakMap();
     intrinsicConstructors = /* @__PURE__ */ new WeakMap();
+    initialBoxedMethods = /* @__PURE__ */ new WeakMap();
     descriptorObjects = /* @__PURE__ */ new WeakSet();
   }
 });
@@ -131722,7 +131964,7 @@ function serializeDumpValue(value, path193, state) {
   if (hasGuestObjectState(value)) {
     throw new TypeError("Guest function properties and prototype links cannot be serialized.");
   }
-  if (isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path193, state);
+  if (isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path193, state);
   if (Array.isArray(value)) {
     const reference2 = serializeHeapReference(value, path193, state);
     if (reference2 !== void 0) {
@@ -131746,7 +131988,13 @@ function serializeHeapReference(value, path193, state) {
   }
   if (!state.serializedHeapIds.has(id)) {
     state.serializedHeapIds.add(id);
-    if (isSandboxDate(value)) {
+    if (isSandboxBox(value)) {
+      state.heap[String(id)] = encodeBoxedData(value, (entry, key3) => {
+        if (Object.is(entry, -0)) return { kind: "number", value: "-0" };
+        const serialized = serializeDumpValue(entry, `${path193}.${key3}`, state);
+        return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+      });
+    } else if (isSandboxDate(value)) {
       state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
     } else if (isFloat32Array(value)) {
       const storage2 = encodeFloat32Storage(value, id, state.float32Buffers, (id2) => ({
@@ -131805,7 +132053,7 @@ function indexHeapContainers(snapshot2) {
   const heapIds = /* @__PURE__ */ new WeakMap();
   let nextId = 1;
   for (const [value, stat35] of stats2.entries()) {
-    if (stat35.count > 1 || stat35.cyclic || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat35.count > 1 || stat35.cyclic || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -131838,7 +132086,7 @@ function collectContainerStats(value, stats2, ancestors) {
   }
   stat35.expanded = true;
   ancestors.add(value);
-  const entries = isSandboxArguments(value) ? getSandboxArgumentEntries(value).map(([, entry]) => entry) : getEnumerableDataValues(value);
+  const entries = isSandboxBox(value) ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value) : isSandboxArguments(value) ? getSandboxArgumentEntries(value).map(([, entry]) => entry) : getEnumerableDataValues(value);
   for (const entry of entries) {
     collectContainerStats(entry, stats2, ancestors);
   }
@@ -131888,6 +132136,8 @@ var init_dump_format = __esm({
     init_float32();
     init_float32array();
     init_date();
+    init_boxed();
+    init_boxed2();
     DUMP_FORMAT_VERSION = 1;
     EXECUTION_SEMANTICS = "jobs-v8";
     SKIP_VALUE = /* @__PURE__ */ Symbol("SafeJS.skip-dump-value");
@@ -131895,7 +132145,7 @@ var init_dump_format = __esm({
 });
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types as types4 } from "node:util";
+import { types as types5 } from "node:util";
 function validateSnapshotData(value) {
   validateGenericValue(value, "$", 0, {
     allowFunctions: false,
@@ -131941,6 +132191,10 @@ function validateDumpHeap(root, state) {
     addUnique2(heapIds, id, path193);
     const entry = requireRecord3(value, path193);
     validateErrorType(entry, path193);
+    if (entry.kind === "boxed") {
+      validateBoxedRecord(entry, path193);
+      continue;
+    }
     if (entry.kind === "date") {
       validateDateRecord(entry, path193);
       continue;
@@ -132108,6 +132362,18 @@ function validateGeneratorShape(record2, path193, state) {
     }
   });
 }
+function validateBoxedRecord(record2, path193) {
+  try {
+    validateBoxedProperties(record2);
+  } catch {
+    fail2("invalidValue", path193, "invalid boxed primitive properties");
+  }
+  const value = record2.value;
+  if (typeof value === "number" || typeof value === "string" || typeof value === "boolean") return;
+  const number = requireRecord3(value, `${path193}.value`);
+  if (number.kind !== "number" || !["NaN", "Infinity", "-Infinity", "-0"].includes(String(number.value)))
+    fail2("invalidValue", `${path193}.value`, "invalid boxed primitive payload");
+}
 function validateDateRecord(record2, path193) {
   if (Object.keys(record2).length !== 2) fail2("invalidValue", path193, "invalid Date fields");
   try {
@@ -132199,7 +132465,7 @@ function validateGenericValue(value, path193, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail2("invalidState", path193, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types4.isProxy(value)) {
+  if (state.dataPropertiesOnly && types5.isProxy(value)) {
     fail2("invalidType", path193, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -132334,6 +132600,7 @@ var init_validation = __esm({
     init_graph_depth();
     init_float32array();
     init_date();
+    init_boxed2();
     init_object_model();
     DEFAULT_MAX_DEPTH = MAX_DATA_DEPTH;
     DEFAULT_MAX_ENTRIES = 1e5;
@@ -144275,7 +144542,10 @@ function isArrayMethodName(property) {
 }
 async function callArrayMethod(receiver, methodName, args, options, stack = []) {
   if (receiver === null || receiver === void 0) throw new TypeError("Array method requires a receiver.");
-  if (typeof receiver !== "object") throw new TypeError("Object primitive boxing is not supported.");
+  if (typeof receiver !== "object") {
+    receiver = createSandboxBox(receiver);
+    options.budget.chargeDataUsage(measureSandboxData([receiver]));
+  }
   const retainedReceiver = {};
   options.budget.setRetainedValues(retainedReceiver, () => [receiver]);
   try {
@@ -144985,6 +145255,7 @@ var arrayLikeSources, activeArrayCallbacks, arrayMethodNames;
 var init_array = __esm({
   "packages/safe-js/src/interp/methods/array.ts"() {
     "use strict";
+    init_boxed();
     init_values();
     init_running_state();
     init_object_model();
@@ -145031,18 +145302,27 @@ var init_array = __esm({
 
 // packages/safe-js/src/interp/methods/function.ts
 function getFunctionMember(target, property, options) {
-  if (isGuestClosure(target)) {
-    const value = getGuestFunctionProperty(target, String(property));
-    if (value !== void 0 || Object.hasOwn(target.properties ?? {}, String(property))) return value;
-    if (!isFunctionMethodName(property)) return void 0;
-  }
-  const properties = target.properties;
-  if (properties !== void 0 && Object.hasOwn(properties, String(property))) {
-    return properties[String(property)];
-  }
-  if (property === "length") {
-    return target.length;
+  let current = target;
+  let depth = 0;
+  while (current !== null) {
+    if (isGuestClosure(current)) {
+      const value = getGuestFunctionProperty(current, String(property));
+      if (value !== void 0 || Object.hasOwn(current.properties ?? {}, String(property))) return value;
+    } else if (isSandboxClosure(current)) {
+      if (current.properties !== void 0 && Object.hasOwn(current.properties, String(property)))
+        return current.properties[String(property)];
+      if (property === "length") return current.length;
+    } else if (Object.hasOwn(current, String(property))) {
+      return current[String(property)];
+    }
+    if (isSandboxClosure(current) && !hasExplicitSandboxPrototype(current)) break;
+    current = getSandboxPrototype(current, options.budget);
+    if (current !== null) {
+      options.budget?.visitNode();
+      assertSandboxDataDepth(++depth);
+    }
   }
+  if (current === null) return void 0;
   if (property === "toString" && runResources.getStore()?.functionSourceText === false) return void 0;
   if (!isFunctionMethodName(property)) {
     return void 0;
@@ -145068,7 +145348,7 @@ function callFunctionMethod(target, methodName, args, options, stack) {
   const thisValue = args[0];
   if (methodName === "bind") {
     const boundArgs = args.slice(1);
-    return createSandboxClosure({
+    const bound = createSandboxClosure({
       guest: true,
       sandbox: true,
       name: `bound ${target.name ?? ""}`,
@@ -145086,6 +145366,9 @@ function callFunctionMethod(target, methodName, args, options, stack) {
         )
       }
     });
+    if (hasExplicitSandboxPrototype(target))
+      setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+    return bound;
   }
   if (methodName === "call") {
     return options.callClosure(target, args.slice(1), stack, thisValue);
@@ -145105,260 +145388,13 @@ var init_function = __esm({
     "use strict";
     init_values();
     init_object_model();
+    init_graph_depth();
     init_function_string();
     init_resources();
     functionMethodNames = /* @__PURE__ */ new Set(["apply", "bind", "call", "toString"]);
   }
 });
 
-// packages/safe-js/src/interp/methods/collection-callback.ts
-function enterKeyedCollectionCallback(target, keys, budget) {
-  let state = activeCallbacks.get(target);
-  if (state === void 0) {
-    state = { cursors: /* @__PURE__ */ new Set(), leaveRunning: enterRunningState(target) };
-    activeCallbacks.set(target, state);
-  }
-  const cursor2 = { budget, pending: /* @__PURE__ */ new Set() };
-  state.cursors.add(cursor2);
-  const leave = () => {
-    if (!state.cursors.delete(cursor2)) return;
-    cursor2.pending.clear();
-    budget.setRetainedDataUsage(cursor2, 0);
-    budget.setRetainedValues(cursor2, void 0);
-    if (state.cursors.size === 0) {
-      activeCallbacks.delete(target);
-      state.leaveRunning();
-    }
-  };
-  try {
-    budget.setRetainedDataUsage(cursor2, 1);
-    budget.setRetainedValues(cursor2, () => cursor2.pending);
-    for (const key3 of keys) updatePendingKeys(cursor2, "add", key3);
-  } catch (error3) {
-    leave();
-    throw error3;
-  }
-  return {
-    next: () => {
-      budget.visitNode();
-      for (const key3 of cursor2.pending) {
-        cursor2.pending.delete(key3);
-        budget.setRetainedDataUsage(cursor2, 1 + cursor2.pending.size);
-        return { done: false, value: key3 };
-      }
-      return { done: true, value: void 0 };
-    },
-    leave
-  };
-}
-function updateKeyedCollectionCallbacks(target, mutation, key3) {
-  const state = activeCallbacks.get(target);
-  if (state === void 0) return;
-  for (const cursor2 of state.cursors) updatePendingKeys(cursor2, mutation, key3);
-}
-function updatePendingKeys(cursor2, mutation, key3) {
-  const { budget, pending } = cursor2;
-  budget.visitNode();
-  if (mutation === "add") {
-    const nextSize = pending.has(key3) ? pending.size : pending.size + 1;
-    budget.allocateCollectionEntries(nextSize);
-    budget.setRetainedDataUsage(cursor2, 1 + nextSize);
-    pending.add(key3);
-  } else {
-    if (mutation === "delete") pending.delete(key3);
-    else pending.clear();
-    budget.setRetainedDataUsage(cursor2, 1 + pending.size);
-  }
-}
-var activeCallbacks;
-var init_collection_callback = __esm({
-  "packages/safe-js/src/interp/methods/collection-callback.ts"() {
-    "use strict";
-    init_running_state();
-    activeCallbacks = /* @__PURE__ */ new WeakMap();
-  }
-});
-
-// packages/safe-js/src/interp/methods/map.ts
-function isMapMethodName(value) {
-  return typeof value === "string" && mapMethodNames.has(value);
-}
-function getMapMember(target, property, options) {
-  if (property === "size") {
-    return target.entries.size;
-  }
-  if (!isMapMethodName(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    call: (args, context) => {
-      const receiver = context?.thisValue;
-      if (!isSandboxMap(receiver)) throw new TypeError(`Map#${property} requires a Map receiver.`);
-      return callMapMethod(receiver, property, args, options, context?.stack ?? []);
-    },
-    name: property
-  });
-}
-async function callMapMethod(target, methodName, args, options, stack = []) {
-  switch (methodName) {
-    case "get":
-      return target.entries.get(args[0]);
-    case "set": {
-      assertCollectionMutable(target);
-      const exists4 = target.entries.has(args[0]);
-      const nextSize = exists4 ? target.entries.size : target.entries.size + 1;
-      options.budget.allocateCollectionEntries(nextSize);
-      if (!exists4) updateKeyedCollectionCallbacks(target, "add", args[0]);
-      target.entries.set(args[0], args[1]);
-      return target;
-    }
-    case "has":
-      return target.entries.has(args[0]);
-    case "delete": {
-      assertCollectionMutable(target);
-      const deleted = target.entries.delete(args[0]);
-      if (deleted) updateKeyedCollectionCallbacks(target, "delete", args[0]);
-      return deleted;
-    }
-    case "clear":
-      assertCollectionMutable(target);
-      target.entries.clear();
-      updateKeyedCollectionCallbacks(target, "clear");
-      return void 0;
-    case "forEach": {
-      const callback = args[0];
-      if (!isSandboxClosure(callback)) {
-        throw new TypeError("Map.prototype.forEach requires a callback function.");
-      }
-      const cursor2 = enterKeyedCollectionCallback(target, target.entries.keys(), options.budget);
-      try {
-        for (let entry = cursor2.next(); !entry.done; entry = cursor2.next()) {
-          const key3 = entry.value;
-          const value = target.entries.get(key3);
-          await options.callClosure(callback, [value, key3, target], stack, args[1]);
-        }
-      } finally {
-        cursor2.leave();
-      }
-      return void 0;
-    }
-    case "keys":
-    case "values":
-    case "entries":
-      return createSandboxCollectionIterator(target, methodName);
-  }
-}
-var mapMethodNames;
-var init_map = __esm({
-  "packages/safe-js/src/interp/methods/map.ts"() {
-    "use strict";
-    init_values();
-    init_running_state();
-    init_collection_callback();
-    init_collection_iterator();
-    mapMethodNames = /* @__PURE__ */ new Set([
-      "get",
-      "set",
-      "has",
-      "delete",
-      "clear",
-      "forEach",
-      "keys",
-      "values",
-      "entries"
-    ]);
-  }
-});
-
-// packages/safe-js/src/interp/methods/number.ts
-function getNumberMember(property, budget) {
-  if (!isNumberMethodName(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    name: `Number#${property}`,
-    call: (args, context) => callNumberMethod(context?.thisValue, property, args, budget, context)
-  });
-}
-function isNumberMethodName(property) {
-  return typeof property === "string" && numberMethodNames.has(property);
-}
-function callNumberMethod(value, methodName, args, budget, context) {
-  if (typeof value !== "number") {
-    throw new TypeError(`Number#${methodName} requires a number receiver.`);
-  }
-  const argument = args[0];
-  if (argument !== null && typeof argument === "object") {
-    return formatObjectArgument(value, methodName, argument, budget, context);
-  }
-  return formatNumber3(value, methodName, argument === void 0 ? void 0 : Number(argument), budget);
-}
-async function formatObjectArgument(value, methodName, argument, budget, context) {
-  const retainedArgument = {};
-  budget.setRetainedValues(retainedArgument, () => [argument]);
-  try {
-    const number = await sandboxNumber(argument, budget, context);
-    return formatNumber3(value, methodName, number, budget);
-  } finally {
-    budget.setRetainedValues(retainedArgument, void 0);
-  }
-}
-function formatNumber3(value, methodName, argument, budget) {
-  let result;
-  try {
-    result = value[methodName](argument);
-  } catch (error3) {
-    if (!(error3 instanceof RangeError)) throw error3;
-    const detail = methodName === "toString" ? "radix must be between 2 and 36." : methodName === "toPrecision" ? "precision must be between 1 and 100." : "digits must be between 0 and 100.";
-    throw new RangeError(`Number#${methodName} ${detail}`);
-  }
-  return budget.allocateString(result);
-}
-var numberMethodNames;
-var init_number = __esm({
-  "packages/safe-js/src/interp/methods/number.ts"() {
-    "use strict";
-    init_string_coercion();
-    init_values();
-    numberMethodNames = /* @__PURE__ */ new Set([
-      "toExponential",
-      "toFixed",
-      "toPrecision",
-      "toString"
-    ]);
-  }
-});
-
-// packages/safe-js/src/interp/methods/generator.ts
-function getGeneratorMember(target, property, budget) {
-  if (typeof property !== "string" || !generatorMethodNames.has(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    name: property,
-    call: async ([value]) => {
-      const iterator = getSandboxIterator(target);
-      const result = await iterator[property](value);
-      return allocateProducedSandboxValue(
-        { value: result.value, done: result.done === true },
-        budget
-      );
-    }
-  });
-}
-var generatorMethodNames;
-var init_generator2 = __esm({
-  "packages/safe-js/src/interp/methods/generator.ts"() {
-    "use strict";
-    init_iteration();
-    init_values();
-    generatorMethodNames = /* @__PURE__ */ new Set(["next", "return", "throw"]);
-  }
-});
-
 // packages/safe-js/src/interp/methods/string.ts
 function getStringMember(value, property, budget) {
   const index = getStringIndex(property);
@@ -145877,6 +145913,256 @@ var init_string = __esm({
   }
 });
 
+// packages/safe-js/src/interp/methods/collection-callback.ts
+function enterKeyedCollectionCallback(target, keys, budget) {
+  let state = activeCallbacks.get(target);
+  if (state === void 0) {
+    state = { cursors: /* @__PURE__ */ new Set(), leaveRunning: enterRunningState(target) };
+    activeCallbacks.set(target, state);
+  }
+  const cursor2 = { budget, pending: /* @__PURE__ */ new Set() };
+  state.cursors.add(cursor2);
+  const leave = () => {
+    if (!state.cursors.delete(cursor2)) return;
+    cursor2.pending.clear();
+    budget.setRetainedDataUsage(cursor2, 0);
+    budget.setRetainedValues(cursor2, void 0);
+    if (state.cursors.size === 0) {
+      activeCallbacks.delete(target);
+      state.leaveRunning();
+    }
+  };
+  try {
+    budget.setRetainedDataUsage(cursor2, 1);
+    budget.setRetainedValues(cursor2, () => cursor2.pending);
+    for (const key3 of keys) updatePendingKeys(cursor2, "add", key3);
+  } catch (error3) {
+    leave();
+    throw error3;
+  }
+  return {
+    next: () => {
+      budget.visitNode();
+      for (const key3 of cursor2.pending) {
+        cursor2.pending.delete(key3);
+        budget.setRetainedDataUsage(cursor2, 1 + cursor2.pending.size);
+        return { done: false, value: key3 };
+      }
+      return { done: true, value: void 0 };
+    },
+    leave
+  };
+}
+function updateKeyedCollectionCallbacks(target, mutation, key3) {
+  const state = activeCallbacks.get(target);
+  if (state === void 0) return;
+  for (const cursor2 of state.cursors) updatePendingKeys(cursor2, mutation, key3);
+}
+function updatePendingKeys(cursor2, mutation, key3) {
+  const { budget, pending } = cursor2;
+  budget.visitNode();
+  if (mutation === "add") {
+    const nextSize = pending.has(key3) ? pending.size : pending.size + 1;
+    budget.allocateCollectionEntries(nextSize);
+    budget.setRetainedDataUsage(cursor2, 1 + nextSize);
+    pending.add(key3);
+  } else {
+    if (mutation === "delete") pending.delete(key3);
+    else pending.clear();
+    budget.setRetainedDataUsage(cursor2, 1 + pending.size);
+  }
+}
+var activeCallbacks;
+var init_collection_callback = __esm({
+  "packages/safe-js/src/interp/methods/collection-callback.ts"() {
+    "use strict";
+    init_running_state();
+    activeCallbacks = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// packages/safe-js/src/interp/methods/map.ts
+function isMapMethodName(value) {
+  return typeof value === "string" && mapMethodNames.has(value);
+}
+function getMapMember(target, property, options) {
+  if (property === "size") {
+    return target.entries.size;
+  }
+  if (!isMapMethodName(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    call: (args, context) => {
+      const receiver = context?.thisValue;
+      if (!isSandboxMap(receiver)) throw new TypeError(`Map#${property} requires a Map receiver.`);
+      return callMapMethod(receiver, property, args, options, context?.stack ?? []);
+    },
+    name: property
+  });
+}
+async function callMapMethod(target, methodName, args, options, stack = []) {
+  switch (methodName) {
+    case "get":
+      return target.entries.get(args[0]);
+    case "set": {
+      assertCollectionMutable(target);
+      const exists4 = target.entries.has(args[0]);
+      const nextSize = exists4 ? target.entries.size : target.entries.size + 1;
+      options.budget.allocateCollectionEntries(nextSize);
+      if (!exists4) updateKeyedCollectionCallbacks(target, "add", args[0]);
+      target.entries.set(args[0], args[1]);
+      return target;
+    }
+    case "has":
+      return target.entries.has(args[0]);
+    case "delete": {
+      assertCollectionMutable(target);
+      const deleted = target.entries.delete(args[0]);
+      if (deleted) updateKeyedCollectionCallbacks(target, "delete", args[0]);
+      return deleted;
+    }
+    case "clear":
+      assertCollectionMutable(target);
+      target.entries.clear();
+      updateKeyedCollectionCallbacks(target, "clear");
+      return void 0;
+    case "forEach": {
+      const callback = args[0];
+      if (!isSandboxClosure(callback)) {
+        throw new TypeError("Map.prototype.forEach requires a callback function.");
+      }
+      const cursor2 = enterKeyedCollectionCallback(target, target.entries.keys(), options.budget);
+      try {
+        for (let entry = cursor2.next(); !entry.done; entry = cursor2.next()) {
+          const key3 = entry.value;
+          const value = target.entries.get(key3);
+          await options.callClosure(callback, [value, key3, target], stack, args[1]);
+        }
+      } finally {
+        cursor2.leave();
+      }
+      return void 0;
+    }
+    case "keys":
+    case "values":
+    case "entries":
+      return createSandboxCollectionIterator(target, methodName);
+  }
+}
+var mapMethodNames;
+var init_map = __esm({
+  "packages/safe-js/src/interp/methods/map.ts"() {
+    "use strict";
+    init_values();
+    init_running_state();
+    init_collection_callback();
+    init_collection_iterator();
+    mapMethodNames = /* @__PURE__ */ new Set([
+      "get",
+      "set",
+      "has",
+      "delete",
+      "clear",
+      "forEach",
+      "keys",
+      "values",
+      "entries"
+    ]);
+  }
+});
+
+// packages/safe-js/src/interp/methods/number.ts
+function getNumberMember(property, budget) {
+  if (!isNumberMethodName(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    name: `Number#${property}`,
+    call: (args, context) => callNumberMethod(context?.thisValue, property, args, budget, context)
+  });
+}
+function isNumberMethodName(property) {
+  return typeof property === "string" && numberMethodNames.has(property);
+}
+function callNumberMethod(value, methodName, args, budget, context) {
+  if (isSandboxBox(value)) value = boxedValue(value);
+  if (typeof value !== "number") {
+    throw new TypeError(`Number#${methodName} requires a number receiver.`);
+  }
+  const argument = args[0];
+  if (argument !== null && typeof argument === "object") {
+    return formatObjectArgument(value, methodName, argument, budget, context);
+  }
+  return formatNumber3(value, methodName, argument === void 0 ? void 0 : Number(argument), budget);
+}
+async function formatObjectArgument(value, methodName, argument, budget, context) {
+  const retainedArgument = {};
+  budget.setRetainedValues(retainedArgument, () => [argument]);
+  try {
+    const number = await sandboxNumber(argument, budget, context);
+    return formatNumber3(value, methodName, number, budget);
+  } finally {
+    budget.setRetainedValues(retainedArgument, void 0);
+  }
+}
+function formatNumber3(value, methodName, argument, budget) {
+  let result;
+  try {
+    result = value[methodName](argument);
+  } catch (error3) {
+    if (!(error3 instanceof RangeError)) throw error3;
+    const detail = methodName === "toString" ? "radix must be between 2 and 36." : methodName === "toPrecision" ? "precision must be between 1 and 100." : "digits must be between 0 and 100.";
+    throw new RangeError(`Number#${methodName} ${detail}`);
+  }
+  return budget.allocateString(result);
+}
+var numberMethodNames;
+var init_number = __esm({
+  "packages/safe-js/src/interp/methods/number.ts"() {
+    "use strict";
+    init_string_coercion();
+    init_boxed();
+    init_values();
+    numberMethodNames = /* @__PURE__ */ new Set([
+      "toExponential",
+      "toFixed",
+      "toPrecision",
+      "toString"
+    ]);
+  }
+});
+
+// packages/safe-js/src/interp/methods/generator.ts
+function getGeneratorMember(target, property, budget) {
+  if (typeof property !== "string" || !generatorMethodNames.has(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    name: property,
+    call: async ([value]) => {
+      const iterator = getSandboxIterator(target);
+      const result = await iterator[property](value);
+      return allocateProducedSandboxValue(
+        { value: result.value, done: result.done === true },
+        budget
+      );
+    }
+  });
+}
+var generatorMethodNames;
+var init_generator2 = __esm({
+  "packages/safe-js/src/interp/methods/generator.ts"() {
+    "use strict";
+    init_iteration();
+    init_values();
+    generatorMethodNames = /* @__PURE__ */ new Set(["next", "return", "throw"]);
+  }
+});
+
 // packages/safe-js/src/interp/methods/set.ts
 function isSetMethodName(value) {
   return typeof value === "string" && setMethodNames.has(value);
@@ -146029,7 +146315,11 @@ function createObjectGlobal(methods, budget) {
       budget.chargeDataUsage(1);
       return /* @__PURE__ */ Object.create(null);
     }
-    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
+    if (typeof value !== "object") {
+      const box = createSandboxBox(value);
+      budget.chargeDataUsage(measureSandboxData([box]));
+      return box;
+    }
     return value;
   };
   const constructor = createSandboxClosure({
@@ -146059,9 +146349,7 @@ function createObjectGlobal(methods, budget) {
       length: 0,
       call: (_args, context) => {
         const value = requireReceiver(context?.thisValue);
-        if (typeof value !== "object")
-          throw new TypeError("Object primitive boxing is not supported.");
-        return value;
+        return construct([value]);
       }
     }),
     hasOwnProperty: createSandboxClosure({
@@ -146129,6 +146417,7 @@ function hasOwnSandboxProperty(value, key3, enumerable) {
   return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
 }
 function typeTag(value) {
+  if (isSandboxBox(value)) value = boxedValue(value);
   if (value === void 0) return "Undefined";
   if (value === null) return "Null";
   if (typeof value === "string") return "String";
@@ -146155,6 +146444,7 @@ var init_object2 = __esm({
     "use strict";
     init_graph_depth();
     init_date();
+    init_boxed();
     init_exceptions();
     init_float32();
     init_host_capabilities();
@@ -146162,6 +146452,7 @@ var init_object2 = __esm({
     init_object_model();
     init_string_coercion();
     init_values();
+    init_values();
   }
 });
 
@@ -146251,12 +146542,12 @@ function isSandboxSetConstructor(value) {
 function populateCollection(source, collection, { name, budget, context, append, retainedValues }) {
   budget.allocateCollectionEntries(0);
   if (source === void 0 || source === null) return collection;
-  const iterator = getSandboxIterator(source, budget);
+  const iterator = getSandboxIterator(source, budget, context);
   if (iterator === void 0) throw new TypeError(`${name} constructor requires an iterable.`);
   let entry;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [source, collection, entry, failure, ...retainedValues?.() ?? []]);
+  budget.setRetainedValues(retained, () => [source, iterator.retainedValue, collection, entry, failure, ...retainedValues?.() ?? []]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = (error3) => {
     failure = isCapturedException(error3) ? error3.reason : error3;
@@ -146266,7 +146557,7 @@ function populateCollection(source, collection, { name, budget, context, append,
     };
     try {
       const closing = iterator.return?.();
-      if (iterator.generator) return Promise.resolve(closing).then(() => {
+      if (iterator.generator || iterator.asynchronous) return Promise.resolve(closing).then(() => {
         throw error3;
       }, rethrow);
     } catch (closeError) {
@@ -146288,7 +146579,7 @@ function populateCollection(source, collection, { name, budget, context, append,
     }
     return false;
   };
-  if (iterator.generator) {
+  if (iterator.generator || iterator.asynchronous) {
     return (async () => {
       try {
         checkData(collection, 0, true);
@@ -147238,22 +147529,29 @@ async function evaluateBinaryExpression(node, context) {
   if (left.kind !== "normal") {
     return left;
   }
+  let leftValue = left.value;
   let rightValue;
-  const release2 = retainValues(context.budget, () => [left.value, rightValue]);
+  const release2 = retainValues(context.budget, () => [leftValue, rightValue]);
   try {
     const right = await evaluateNode2(node.right, context);
     if (right.kind !== "normal") {
       return right;
     }
     rightValue = right.value;
-    let leftValue = left.value;
     if (node.operator === "in") {
       if (typeof right.value !== "object" || right.value === null) {
         throw new TypeError("Right-hand side of 'in' must be an object.");
       }
       leftValue = await toPropertyKey(leftValue, context.budget, createCoercionContext(context));
     }
-    const value = applyBinaryOperator(node, leftValue, right.value, context);
+    if (!["in", "instanceof", "===", "!=="].includes(node.operator)) {
+      const equality = node.operator === "==" || node.operator === "!=";
+      if (isSandboxBox(leftValue) && (!equality || rightValue !== null && rightValue !== void 0 && typeof rightValue !== "object"))
+        leftValue = await toNumericPrimitive(leftValue, context);
+      if (isSandboxBox(rightValue) && (!equality || left.value !== null && left.value !== void 0 && typeof left.value !== "object"))
+        rightValue = await toNumericPrimitive(rightValue, context);
+    }
+    const value = applyBinaryOperator(node, leftValue, rightValue, context);
     return {
       kind: "normal",
       hasValue: true,
@@ -147841,63 +148139,68 @@ async function evaluateForOfStatement(node, context) {
   };
 }
 async function evaluateForOfIterator(node, value, context, restoredEntry) {
-  const iterator = getSandboxIterator(value, context.budget);
+  const iterator = getSandboxIterator(value, context.budget, createCoercionContext(context));
   if (iterator === void 0) {
     throw new TypeError(`${String(value)} is not a supported iterable`);
   }
-  const nodeId = node.nodeId ?? -1;
-  let index = consumeRestoredLoopIterationIndex(node, context);
-  for (let skipped = 0; skipped < index; skipped += 1) {
-    const skippedIteration = await iterator.next();
-    if (typeof skippedIteration !== "object" || skippedIteration === null) {
-      throw new TypeError("Iterator result must be an object.");
-    }
-    if (skippedIteration.done) {
-      return normalEmptyResult();
-    }
-  }
-  while (true) {
-    const iteration = restoredEntry ?? await iterator.next();
-    restoredEntry = void 0;
-    if (typeof iteration !== "object" || iteration === null) {
-      throw new TypeError("Iterator result must be an object.");
-    }
-    if (iteration.done) {
-      context.activeLoopIterations.delete(nodeId);
-      return normalEmptyResult();
-    }
-    context.activeLoopIterations.set(
-      nodeId,
-      iterator.snapshotIndex === void 0 ? index : {
-        get index() {
-          return iterator.snapshotIndex();
-        },
-        values: [value, iteration.value]
+  const releaseIterator = retainValues(context.budget, () => [value, iterator.retainedValue]);
+  try {
+    const nodeId = node.nodeId ?? -1;
+    let index = consumeRestoredLoopIterationIndex(node, context);
+    for (let skipped = 0; skipped < index; skipped += 1) {
+      const skippedIteration = await iterator.next();
+      if (typeof skippedIteration !== "object" || skippedIteration === null) {
+        throw new TypeError("Iterator result must be an object.");
+      }
+      if (skippedIteration.done) {
+        return normalEmptyResult();
       }
-    );
-    const scope = context.scope.child();
-    const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
-    if (!binding.ok) {
-      return binding.result;
-    }
-    const iterationContext = createLoopIterationContext(context, scope);
-    emitLoopIterationBreakpoint(node, iterationContext);
-    const result = await evaluateNode2(node.body, iterationContext);
-    if (isMatchingBreak(result, loopLabels(node))) {
-      context.activeLoopIterations.delete(nodeId);
-      await closeIterator(iterator);
-      return normalEmptyResult();
     }
-    if (isMatchingContinue(result, loopLabels(node))) {
+    while (true) {
+      const iteration = restoredEntry ?? await iterator.next();
+      restoredEntry = void 0;
+      if (typeof iteration !== "object" || iteration === null) {
+        throw new TypeError("Iterator result must be an object.");
+      }
+      if (iteration.done) {
+        context.activeLoopIterations.delete(nodeId);
+        return normalEmptyResult();
+      }
+      context.activeLoopIterations.set(
+        nodeId,
+        iterator.snapshotIndex === void 0 ? index : {
+          get index() {
+            return iterator.snapshotIndex();
+          },
+          values: [value, iteration.value]
+        }
+      );
+      const scope = context.scope.child();
+      const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
+      if (!binding.ok) {
+        return binding.result;
+      }
+      const iterationContext = createLoopIterationContext(context, scope);
+      emitLoopIterationBreakpoint(node, iterationContext);
+      const result = await evaluateNode2(node.body, iterationContext);
+      if (isMatchingBreak(result, loopLabels(node))) {
+        context.activeLoopIterations.delete(nodeId);
+        await closeIterator(iterator);
+        return normalEmptyResult();
+      }
+      if (isMatchingContinue(result, loopLabels(node))) {
+        index += 1;
+        continue;
+      }
+      if (result.kind !== "normal") {
+        context.activeLoopIterations.delete(nodeId);
+        await closeIterator(iterator);
+        return result;
+      }
       index += 1;
-      continue;
-    }
-    if (result.kind !== "normal") {
-      context.activeLoopIterations.delete(nodeId);
-      await closeIterator(iterator);
-      return result;
     }
-    index += 1;
+  } finally {
+    releaseIterator();
   }
 }
 async function evaluateForInStatement(node, context) {
@@ -148267,52 +148570,64 @@ async function evaluateYieldDelegate(node, context) {
   if (argument.kind !== "normal") {
     return argument;
   }
-  const iterator = getSandboxIterator(argument.value, context.budget);
+  const iterator = getSandboxIterator(
+    argument.value,
+    context.budget,
+    createCoercionContext(context)
+  );
   if (iterator === void 0) {
     throw new TypeError(`${String(argument.value)} is not a supported iterable`);
   }
-  let completion = {
-    type: "normal",
-    value: void 0
-  };
-  const replay = context.generatorResume?.sent ?? [];
-  let replayIndex = 0;
-  while (true) {
-    const method = completion.type === "normal" ? "next" : completion.type;
-    const iteratorMethod = iterator[method];
-    if (iteratorMethod === void 0) {
-      if (completion.type === "throw") {
-        throw completion.value;
+  const releaseIterator = retainValues(context.budget, () => [
+    argument.value,
+    iterator.retainedValue
+  ]);
+  try {
+    let completion = {
+      type: "normal",
+      value: void 0
+    };
+    const replay = context.generatorResume?.sent ?? [];
+    let replayIndex = 0;
+    while (true) {
+      const method = completion.type === "normal" ? "next" : completion.type;
+      const iteratorMethod = iterator[method];
+      if (iteratorMethod === void 0) {
+        if (completion.type === "throw") {
+          throw completion.value;
+        }
+        return generatorCompletionResult(completion);
       }
-      return generatorCompletionResult(completion);
-    }
-    const result = await iteratorMethod(completion.value);
-    if (result.done) {
-      if (completion.type === "return") {
-        return generatorCompletionResult({ type: "return", value: result.value });
+      const result = await iteratorMethod(completion.value);
+      if (result.done) {
+        if (completion.type === "return") {
+          return generatorCompletionResult({ type: "return", value: result.value });
+        }
+        return {
+          kind: "normal",
+          hasValue: true,
+          value: result.value
+        };
       }
-      return {
-        kind: "normal",
-        hasValue: true,
-        value: result.value
-      };
-    }
-    if (replayIndex < replay.length - 1) {
-      completion = replay[replayIndex + 1];
-      replayIndex += 1;
-      continue;
+      if (replayIndex < replay.length - 1) {
+        completion = replay[replayIndex + 1];
+        replayIndex += 1;
+        continue;
+      }
+      const completionPromise = context.generatorYield(
+        allocateProducedSandboxValue(result.value, context.budget),
+        node.nodeId
+      );
+      emitResumeBreakpoint(context, {
+        kind: "generator-yield",
+        nodeId: node.nodeId,
+        span: node.span
+      });
+      completion = await completionPromise;
+      context.generatorResume = void 0;
     }
-    const completionPromise = context.generatorYield(
-      allocateProducedSandboxValue(result.value, context.budget),
-      node.nodeId
-    );
-    emitResumeBreakpoint(context, {
-      kind: "generator-yield",
-      nodeId: node.nodeId,
-      span: node.span
-    });
-    completion = await completionPromise;
-    context.generatorResume = void 0;
+  } finally {
+    releaseIterator();
   }
 }
 function generatorCompletionResult(completion) {
@@ -148459,6 +148774,14 @@ async function evaluateMemberExpression(node, context) {
 }
 function getPropertyValue(target, property, context) {
   if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
+  if (typeof target === "string" || typeof target === "number" || typeof target === "boolean") {
+    const prototype = getBoxedPrototype(target, context.budget);
+    if (prototype !== void 0) {
+      if (typeof target === "string" && (property === "length" || getStringIndex(property) !== void 0))
+        return getStringMember(target, property, context.budget);
+      return getMemberValue(prototype, property, context);
+    }
+  }
   if (typeof target === "string") return getStringMember(target, property, context.budget);
   if (typeof target === "number") return getNumberMember(property, context.budget);
   if (typeof target === "boolean") return void 0;
@@ -148630,6 +148953,15 @@ async function evaluateMemberCallExpression(node, context) {
       ...reference,
       property: await toPropertyKey(reference.property, context.budget, createCoercionContext(context))
     };
+    if ((typeof member.object === "string" || typeof member.object === "number" || typeof member.object === "boolean") && getBoxedPrototype(member.object, context.budget) !== void 0) {
+      if (isDefaultBoxedMethod(member.object, member.property, context.budget)) {
+        if (typeof member.object === "string" && isStringMethodName(member.property))
+          return evaluateStringMethodCall(node, member.object, member.property, context);
+        if (typeof member.object === "number" && isNumberMethodName(member.property))
+          return evaluateNumberMethodCall(node, member.object, member.property, context);
+      }
+      return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.object);
+    }
     if (typeof member.object === "string" && isStringMethodName(member.property)) {
       return evaluateStringMethodCall(node, member.object, member.property, context);
     }
@@ -148979,7 +149311,7 @@ function hasSandboxProperty(value, key3, context) {
   while (typeof current === "object" && current !== null) {
     if (isGuestHostObject(current)) return hasHostObjectMember(current, key3);
     if (hasOwnSandboxProperty(current, key3, false)) return true;
-    if (Array.isArray(current) || !isPlainSandboxObject(current) || isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current)) {
+    if (!(isGuestClosure(current) && hasExplicitSandboxPrototype(current)) && (Array.isArray(current) || !isPlainSandboxObject(current) || isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current))) {
       return getPropertyValue(current, key3, context) !== void 0;
     }
     current = getSandboxPrototype(current, context.budget);
@@ -148991,33 +149323,41 @@ function hasSandboxProperty(value, key3, context) {
   return false;
 }
 async function applyCompoundAssignmentOperator(operator, left, right, context) {
-  left = await toNumericPrimitive(left, context);
-  right = await toNumericPrimitive(right, context);
-  switch (operator) {
-    case "+=":
-      return applyAdditionOperator(left, right, context);
-    case "-=":
-      return toNumber(left) - toNumber(right);
-    case "*=":
-      return toNumber(left) * toNumber(right);
-    case "/=":
-      return toNumber(left) / toNumber(right);
-    case "%=":
-      return toNumber(left) % toNumber(right);
-    case "**=":
-      return toNumber(left) ** toNumber(right);
-    case "&=":
-      return toNumber(left) & toNumber(right);
-    case "|=":
-      return toNumber(left) | toNumber(right);
-    case "^=":
-      return toNumber(left) ^ toNumber(right);
-    case "<<=":
-      return toNumber(left) << toNumber(right);
-    case ">>=":
-      return toNumber(left) >> toNumber(right);
-    case ">>>=":
-      return toNumber(left) >>> toNumber(right);
+  const convertingObject = typeof left === "object" && left !== null;
+  let convertedLeft;
+  const release2 = retainValues(context.budget, () => [convertedLeft]);
+  try {
+    left = await toNumericPrimitive(left, context);
+    if (convertingObject) convertedLeft = left;
+    right = await toNumericPrimitive(right, context);
+    switch (operator) {
+      case "+=":
+        return applyAdditionOperator(left, right, context);
+      case "-=":
+        return toNumber(left) - toNumber(right);
+      case "*=":
+        return toNumber(left) * toNumber(right);
+      case "/=":
+        return toNumber(left) / toNumber(right);
+      case "%=":
+        return toNumber(left) % toNumber(right);
+      case "**=":
+        return toNumber(left) ** toNumber(right);
+      case "&=":
+        return toNumber(left) & toNumber(right);
+      case "|=":
+        return toNumber(left) | toNumber(right);
+      case "^=":
+        return toNumber(left) ^ toNumber(right);
+      case "<<=":
+        return toNumber(left) << toNumber(right);
+      case ">>=":
+        return toNumber(left) >> toNumber(right);
+      case ">>>=":
+        return toNumber(left) >>> toNumber(right);
+    }
+  } finally {
+    release2();
   }
 }
 function applyAdditionOperator(left, right, context) {
@@ -149414,12 +149754,12 @@ async function evaluateSpreadElement(node, context) {
       result: value
     };
   }
-  const iterator = getSandboxIterator(value.value, context.budget);
+  const iterator = getSandboxIterator(value.value, context.budget, createCoercionContext(context));
   if (iterator === void 0) {
     throw new TypeError("Spread arguments must evaluate to an iterable.");
   }
   const spreadValues = [];
-  const release2 = retainValues(context.budget, () => [value.value, ...spreadValues]);
+  const release2 = retainValues(context.budget, () => [value.value, iterator.retainedValue, ...spreadValues]);
   try {
     while (true) {
       const next = await iterator.next();
@@ -149540,6 +149880,7 @@ var init_interpreter = __esm({
     init_array();
     init_function();
     init_object_model();
+    init_string();
     init_graph_depth();
     init_map();
     init_number();
@@ -149559,6 +149900,7 @@ var init_interpreter = __esm({
     init_float32array2();
     init_float32();
     init_date();
+    init_boxed();
     init_date2();
     init_values();
     init_scope();
@@ -150603,6 +150945,30 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path193) {
       state
     );
   }
+  const primitive = nativeBoxedValue(value);
+  if (primitive !== void 0) {
+    if (typeof primitive === "string") budget.allocateString(primitive);
+    const original = value;
+    const existing = state.seen.get(original);
+    if (existing !== void 0) return existing;
+    const copy = createSandboxBox(primitive);
+    state.seen.set(original, copy);
+    budget.chargeDataUsage(measureSandboxData([copy]));
+    for (const [key3, descriptor] of boxedDataProperties(original)) {
+      if (!("value" in descriptor)) throw new TypeError(`Unsupported sandbox value at ${joinPath2(path193, key3)}: accessor property`);
+      Object.defineProperty(copy, budget.allocateString(key3), {
+        ...descriptor,
+        value: copyHostValueToSandbox(
+          descriptor.value,
+          stackFrames,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], key3] },
+          state,
+          joinPath2(path193, key3)
+        )
+      });
+    }
+    return copy;
+  }
   const date = copyNativeDate(value);
   if (date !== void 0) {
     const existing = state.seen.get(value);
@@ -150893,6 +151259,7 @@ var init_host_bridge = __esm({
     "use strict";
     init_async();
     init_date();
+    init_boxed();
     init_host_capabilities();
     init_shape();
     init_budget2();
@@ -150927,12 +151294,18 @@ function createConsoleJsonGlobals(options) {
     JSON: {
       parse: createSandboxClosure({
         sandbox: true,
-        call: async ([text5]) => parseJson4(text5, options.budget),
+        call: async ([text5], context) => {
+          const converted = sandboxString(text5, options.budget, context);
+          return copyJsonToSandbox(
+            JSON.parse(converted instanceof Promise ? await converted : converted),
+            options.budget
+          );
+        },
         name: "parse"
       }),
       stringify: createSandboxClosure({
         sandbox: true,
-        call: async ([value, replacer, indent]) => stringifyJson4(value, replacer, indent, options.budget),
+        call: async ([value, replacer, indent], context) => stringifyJson4(value, replacer, indent, options.budget, context),
         name: "stringify"
       })
     },
@@ -150993,11 +151366,7 @@ function createConsoleJsonGlobals(options) {
     )
   };
 }
-function parseJson4(input, budget) {
-  const text5 = budget.allocateString(toJsonParseText(input));
-  return copyJsonToSandbox(JSON.parse(text5), budget);
-}
-async function stringifyJson4(value, replacer, indent, budget) {
+async function stringifyJson4(value, replacer, indent, budget, context) {
   if (replacer !== void 0 && replacer !== null && !isSandboxClosure(replacer)) {
     throw new TypeError(
       "JSON.stringify(value, replacer, indent) only supports function, null, or undefined replacers."
@@ -151012,6 +151381,7 @@ async function stringifyJson4(value, replacer, indent, budget) {
   defineDataProperty8(holder, "", value);
   const output = await stringifyProperty("", holder, {
     budget,
+    context,
     gap: normalizeStringifyGap(indent),
     replacer: isSandboxClosure(replacer) ? replacer : void 0,
     stack: []
@@ -151021,15 +151391,6 @@ async function stringifyJson4(value, replacer, indent, budget) {
   }
   return budget.allocateString(output);
 }
-function toJsonParseText(input) {
-  if (Array.isArray(input)) {
-    return input.map((entry) => entry === null || entry === void 0 ? "" : toJsonParseText(entry)).join(",");
-  }
-  if (typeof input === "object" && input !== null) {
-    return "[object Object]";
-  }
-  return String(input);
-}
 async function stringifyProperty(key3, holder, state, indent = "") {
   let value = getOwnDataValue(holder, key3);
   if (isSandboxDate(value)) {
@@ -151046,6 +151407,10 @@ async function stringifyProperty(key3, holder, state, indent = "") {
   return stringifyValue3(value, state, indent);
 }
 async function stringifyValue3(value, state, indent) {
+  if (isSandboxBox(value)) {
+    const primitive = boxedValue(value);
+    value = typeof primitive === "number" ? await sandboxNumber(value, state.budget, state.context) : typeof primitive === "string" ? await sandboxString(value, state.budget, state.context) : primitive;
+  }
   if (value === null) {
     return "null";
   }
@@ -151221,6 +151586,8 @@ var init_console_json = __esm({
   "packages/safe-js/src/interp/globals/console-json.ts"() {
     "use strict";
     init_date();
+    init_boxed();
+    init_string_coercion();
     init_compile_guard();
     init_host_bridge();
     init_values();
@@ -151468,7 +151835,7 @@ function structuredCloneSandboxValue(value, budget, parent) {
   const operation = budget.acquireCompileOwner(false, parent?.owner);
   const compilation = parent?.owner === operation.owner ? parent : new CompileScope(operation.owner);
   try {
-    const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true });
+    const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true, structuredClone: true });
     assertSandboxGraphDepth(clone);
     assertStructuredCloneable(clone, /* @__PURE__ */ new WeakSet());
     allocateProducedSandboxValue(clone, budget);
@@ -151516,6 +151883,82 @@ var init_misc = __esm({
   }
 });
 
+// packages/safe-js/src/interp/globals/primitives.ts
+function createPrimitiveConstructor(options, budget) {
+  const initial = { Number: 0, String: "", Boolean: false }[options.name];
+  const kind = typeof initial;
+  const prototype = createSandboxBox(initial);
+  const allocate = (value) => {
+    const box = createSandboxBox(value);
+    budget.chargeDataUsage(measureSandboxData([box]));
+    return box;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: options.name,
+    length: 1,
+    call: options.call,
+    construct: (args, context) => {
+      const value = options.call(args, context);
+      return value instanceof Promise ? value.then(allocate) : allocate(value);
+    }
+  });
+  const properties = materializeFunctionProperties(constructor);
+  Object.defineProperty(properties, "prototype", { value: prototype, writable: false });
+  Object.defineProperty(prototype, "constructor", {
+    value: constructor,
+    writable: true,
+    configurable: true
+  });
+  for (const [name, value] of Object.entries(options.properties ?? {}))
+    Object.defineProperty(properties, name, {
+      value,
+      writable: isSandboxClosure(value),
+      configurable: isSandboxClosure(value)
+    });
+  const methods = /* @__PURE__ */ new Map([
+    [
+      "valueOf",
+      createSandboxClosure({
+        sandbox: true,
+        name: "valueOf",
+        length: 0,
+        call: (_args, context) => primitiveReceiver(context?.thisValue, kind)
+      })
+    ]
+  ]);
+  if (kind === "number") {
+    for (const name of numberMethodNames) methods.set(name, getNumberMember(name, budget));
+  } else {
+    methods.set(
+      "toString",
+      createSandboxClosure({
+        sandbox: true,
+        name: "toString",
+        length: 0,
+        call: (_args, context) => budget.allocateString(String(primitiveReceiver(context?.thisValue, kind)))
+      })
+    );
+    if (kind === "string")
+      for (const name of stringMethodNames) methods.set(name, getStringMember("", name, budget));
+  }
+  for (const [name, value] of methods)
+    Object.defineProperty(prototype, name, { value, writable: true, configurable: true });
+  installBoxedPrototype(budget, prototype, constructor);
+  return constructor;
+}
+var init_primitives = __esm({
+  "packages/safe-js/src/interp/globals/primitives.ts"() {
+    "use strict";
+    init_boxed();
+    init_object_model();
+    init_number();
+    init_string();
+    init_values();
+  }
+});
+
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
@@ -151581,6 +152024,7 @@ function createObjectArrayGlobals(options) {
         sandbox: true,
         call: ([value]) => {
           if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
+          if (value !== null && value !== void 0 && typeof value !== "object") value = createSandboxBox(value);
           objectProperties(value);
           return getSandboxPrototype(value, options.budget);
         },
@@ -151620,11 +152064,11 @@ function createObjectArrayGlobals(options) {
       fromEntries: createSandboxClosure({
         sandbox: true,
         call: ([value], context) => {
-          const iterator = getSandboxIterator(value, options.budget);
+          const iterator = getSandboxIterator(value, options.budget, context);
           if (iterator === void 0) {
             throw new TypeError("Object.fromEntries requires an iterable.");
           }
-          if (context === void 0 && !iterator.generator) {
+          if (context === void 0 && !iterator.generator && !iterator.asynchronous) {
             return allocateProducedSandboxValue(
               Object.setPrototypeOf(
                 Reflect.apply(Object.fromEntries, Object, [{ [Symbol.iterator]: () => iterator }]),
@@ -151682,8 +152126,7 @@ function createObjectArrayGlobals(options) {
         })
       }
     }),
-    String: createSandboxClosure({
-      sandbox: true,
+    String: createPrimitiveConstructor({
       call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
       name: "String",
       properties: {
@@ -151703,9 +152146,8 @@ function createObjectArrayGlobals(options) {
           name: "fromCodePoint"
         })
       }
-    }),
-    Number: createSandboxClosure({
-      sandbox: true,
+    }, options.budget),
+    Number: createPrimitiveConstructor({
       call: (args, context) => sandboxNumber(args.length === 0 ? 0 : args[0], options.budget, context),
       name: "Number",
       properties: {
@@ -151739,12 +152181,11 @@ function createObjectArrayGlobals(options) {
         NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
         POSITIVE_INFINITY: Number.POSITIVE_INFINITY
       }
-    }),
-    Boolean: createSandboxClosure({
-      sandbox: true,
+    }, options.budget),
+    Boolean: createPrimitiveConstructor({
       call: ([value]) => Boolean(value),
       name: "Boolean"
-    })
+    }, options.budget)
   };
 }
 async function objectFromSandboxEntries(items, iterator, budget, context) {
@@ -151754,7 +152195,7 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
   let value;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, object, entry, key3, value, failure]);
+  budget.setRetainedValues(retained, () => [items, iterator.retainedValue, object, entry, key3, value, failure]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error3) => {
     failure = isCapturedException(error3) ? error3.reason : error3;
@@ -151805,6 +152246,10 @@ function assignSandboxValues(target, sources, budget) {
   if (target === null || target === void 0) {
     throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
   }
+  if (typeof target !== "object") {
+    target = createSandboxBox(target);
+    budget.chargeDataUsage(measureSandboxData([target]));
+  }
   if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
     throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
   }
@@ -151874,13 +152319,13 @@ async function arrayFromSandboxValues(args, budget, context) {
     throw new TypeError("Array.from requires a non-null input.");
   }
   const read = (property) => context?.getProperty !== void 0 ? context.getProperty(items, property) : getSandboxDataProperty(items, property, budget);
-  const iterator = getSandboxIterator(items, budget);
+  const iterator = getSandboxIterator(items, budget, context);
   const constructor = context?.thisValue;
   let result;
   let currentValue;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, mapFn, constructor, result, currentValue, failure]);
+  budget.setRetainedValues(retained, () => [items, iterator?.retainedValue, mapFn, constructor, result, currentValue, failure]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error3) => {
     failure = isCapturedException(error3) ? error3.reason : error3;
@@ -151993,6 +152438,7 @@ var init_object_array = __esm({
     init_data_checkpoint();
     init_exceptions();
     init_date();
+    init_boxed();
     init_date2();
     init_object2();
     init_host_capabilities();
@@ -152001,6 +152447,7 @@ var init_object_array = __esm({
     init_iteration();
     init_string_coercion();
     init_numeric_parsers();
+    init_primitives();
     init_object_model();
     init_values();
   }
@@ -152188,10 +152635,10 @@ var init_random = __esm({
 
 // packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage9 } from "node:async_hooks";
-import { types as types5 } from "node:util";
+import { types as types6 } from "node:util";
 function readModules(input) {
   const entries = (value, label) => {
-    if (types5.isMap(value) && !types5.isProxy(value)) {
+    if (types6.isMap(value) && !types6.isProxy(value)) {
       const result = [...Map.prototype.entries.call(value)];
       if (result.length > 4096 || result.some(([key3]) => typeof key3 !== "string" || key3.length === 0))
         throw new TypeError(`${label} requires bounded string keys.`);
@@ -152305,7 +152752,7 @@ var init_realm = __esm({
             throw new TypeError("Realm limits must be positive safe integers with supported names.");
           this.limits[name] = Number(value);
         }
-        if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types5.isProxy(options.extensions)))
+        if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types6.isProxy(options.extensions)))
           throw new TypeError("Extensions must be a registration array.");
         const registrations = options.extensions ?? [];
         const extensions = [];
@@ -152540,7 +152987,7 @@ var init_realm = __esm({
         return this.phase.run(phase, () => {
           try {
             const result = call();
-            if (types5.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+            if (types6.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
               return Promise.resolve(result).then(
                 async (value) => {
                   await Promise.allSettled(phase.pending);
@@ -152609,7 +153056,7 @@ var init_realm = __esm({
           },
           read: (operation, validate2) => {
             const value = this.invokeHost(operation, operation);
-            if (types5.isPromise(value)) {
+            if (types6.isPromise(value)) {
               void Promise.resolve(value).catch(() => void 0);
               throw new TypeError("Live property operations must be synchronous.");
             }
@@ -152617,7 +153064,7 @@ var init_realm = __esm({
           },
           write: (operation, value) => {
             const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
-            if (types5.isPromise(result)) {
+            if (types6.isPromise(result)) {
               void Promise.resolve(result).catch(() => void 0);
               throw new TypeError("Live property setters must be synchronous.");
             }
@@ -152826,7 +153273,7 @@ var init_realm = __esm({
             }
           });
           const output = getExtensionSetup(extension)(context);
-          if (types5.isPromise(output)) {
+          if (types6.isPromise(output)) {
             void Promise.resolve(output).catch(() => void 0);
             throw new TypeError("Extension setup must be synchronous.");
           }
@@ -153455,6 +153902,8 @@ var init_serialize = __esm({
     init_float32();
     init_float32array();
     init_date();
+    init_boxed();
+    init_boxed2();
     init_values();
     UnsnapshotableValueError = class extends Error {
       path;