poe-code 14.0.64 → 14.0.66

package/packages/safe-js/dist/interp/interpreter.js

@@ -1,10 +1,12 @@
 import { promiseReplayContext } from "./promise-replay.js";
+import { readPropertyDescriptor, writePropertyDescriptor } from "./accessors.js";
 import { deleteHostObjectMember, getHostObjectKeys, getHostObjectMember, hasHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
 import { toPropertyKey } from "./property-key.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
 import { withCancellationSignal } from "./cancel.js";
 import { retainValues } from "./resources.js";
+import { evaluateClass } from "./classes.js";
 import { sandboxString } from "./string-coercion.js";
 import { attachErrorSpan, formatErrorStack, replaceErrorStack } from "../error/shape.js";
 import { evaluateArrowFunctionExpression, evaluateFunctionExpression, evaluateAwaitExpression, emitResumeBreakpoint, createInterpretedClosure, normalizeClosureResult } from "./async.js";
@@ -14,7 +16,7 @@ import { CompileScope, RegexCompileGuard } from "./regex/compile-guard.js";
 import { createCapturedException, createThrowCompletion, evaluateThrowStatement as evaluateThrowStatementResult, evaluateTryStatement as evaluateTryStatementResult, isCapturedException, isInterpreterError, surfaceThrownValue } from "./exceptions.js";
 import { callArrayMethod, getArrayMember, isArrayMethodName } from "./methods/array.js";
 import { getFunctionMember } from "./methods/function.js";
-import { getBoxedPrototype, getGuestFunctionProperty, getSandboxPrototype, hasExplicitSandboxPrototype, isDefaultBoxedMethod, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { getBoxedPrototype, getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype, isDefaultBoxedMethod, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
 import { getStringIndex } from "./methods/string.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { callMapMethod, getMapMember, isMapMethodName } from "./methods/map.js";
@@ -50,6 +52,15 @@ const dispatchTable = {
     BlockStatement: evaluateBlockStatement,
     BooleanLiteral: evaluatePrimitiveLiteral,
     CallExpression: evaluateCallExpression,
+    ClassDeclaration: (node, context) => evaluateClass(node, context, evaluateNode, createCoercionContext(context)),
+    ClassExpression: (node, context) => evaluateClass(node, context, evaluateNode, createCoercionContext(context)),
+    NewTargetExpression: async (_node, context) => ({ kind: "normal", hasValue: true, value: context.functionEnvironment?.newTarget }),
+    Super: async (_node, context) => {
+        const home = context.functionEnvironment?.homeObject;
+        if (home === undefined)
+            throw new ReferenceError("Super binding is unavailable.");
+        return { kind: "normal", hasValue: true, value: getSandboxPrototype(home, context.budget) };
+    },
     ConditionalExpression: evaluateConditionalExpression,
     ContinueStatement: evaluateContinueStatement,
     DoWhileStatement: evaluateDoWhileStatement,
@@ -182,6 +193,8 @@ export async function interpret(node, options = {}) {
 export { Scope } from "./scope.js";
 async function evaluateNode(node, context) {
     context.assertActive?.();
+    if (context.inferredName !== undefined && node.type !== "ClassExpression")
+        context = { ...context, inferredName: undefined };
     const replayWait = promiseReplayContext.getStore()?.beforeNode(node.nodeId);
     if (replayWait !== undefined)
         await suspendJob(replayWait);
@@ -332,7 +345,13 @@ async function evaluateObjectExpression(node, context) {
             const releaseKey = retainValues(context.budget, () => [key.value]);
             let value;
             try {
-                value = await evaluateNode(property.value, context);
+                value = await evaluateNode(property.value, {
+                    ...context,
+                    inferredName: String(key.value),
+                    ...(property.value.type === "FunctionExpression" && property.value.method === true
+                        ? { functionEnvironment: { homeObject: object } }
+                        : {})
+                });
             }
             finally {
                 releaseKey();
@@ -359,7 +378,8 @@ async function evaluateObjectExpression(node, context) {
     }
 }
 function isObjectPrototypeSetterProperty(property, key) {
-    return !property.computed && !property.shorthand && key === "__proto__";
+    return !property.computed && !property.shorthand && key === "__proto__" &&
+        !(property.value.type === "FunctionExpression" && property.value.method === true);
 }
 async function evaluateTemplateLiteral(node, context) {
     let value = context.budget.allocateString(node.quasis[0]?.value.cooked ?? "");
@@ -390,22 +410,33 @@ async function evaluateTemplateLiteral(node, context) {
     }
 }
 async function evaluateTaggedTemplateExpression(node, context) {
-    const tag = await evaluateNode(node.tag, context);
-    if (tag.kind !== "normal") {
-        return tag;
-    }
-    if (!isSandboxClosure(tag.value)) {
-        throw new TypeError("Tagged template tag must be a function.");
-    }
-    const values = await evaluateTemplateExpressionValues(node.quasi, context);
-    if (!values.ok) {
-        return values.result;
-    }
-    return {
-        kind: "normal",
-        hasValue: true,
-        value: await invokeSandboxClosure(tag.value, [createTaggedTemplateStrings(node.quasi, context), ...values.value], context, [...context.callStack, formatStackFrame(node, tag.value.name)])
+    const invokeTag = async (tag, receiver) => {
+        if (!isSandboxClosure(tag))
+            throw new TypeError("Tagged template tag must be a function.");
+        const release = retainValues(context.budget, () => [tag, receiver]);
+        try {
+            const values = await evaluateTemplateExpressionValues(node.quasi, context);
+            if (!values.ok)
+                return values.result;
+            return {
+                kind: "normal", hasValue: true,
+                value: await invokeSandboxClosure(tag, [createTaggedTemplateStrings(node.quasi, context), ...values.value], context, [...context.callStack, formatStackFrame(node, tag.name)], node.span, receiver)
+            };
+        }
+        finally {
+            release();
+        }
     };
+    if (node.tag.type === "MemberExpression")
+        return evaluateMemberAccess(node.tag, context, async (member) => {
+            if (member.kind === "nullish")
+                throw new TypeError("Tagged template tag must be a function.");
+            const key = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
+            const receiver = member.superReceiver === undefined ? member.object : member.superReceiver.value;
+            return invokeTag(await getPropertyValue(member.object, key, context, receiver), receiver);
+        });
+    const tag = await evaluateNode(node.tag, context);
+    return tag.kind === "normal" ? invokeTag(tag.value, undefined) : tag;
 }
 async function evaluateTemplateExpressionValues(node, context) {
     const values = [];
@@ -490,7 +521,8 @@ async function evaluateBinaryExpression(node, context) {
             if (isSandboxBox(rightValue) && (!equality || (left.value !== null && left.value !== undefined && typeof left.value !== "object")))
                 rightValue = await toNumericPrimitive(rightValue, context);
         }
-        const value = applyBinaryOperator(node, leftValue, rightValue, context);
+        const operation = applyBinaryOperator(node, leftValue, rightValue, context);
+        const value = operation instanceof Promise ? await operation : operation;
         return {
             kind: "normal",
             hasValue: true,
@@ -552,7 +584,7 @@ async function evaluateAssignmentExpression(node, context) {
             value: current
         };
     }
-    const right = await evaluateNode(node.right, context);
+    const right = await evaluateNode(node.right, { ...context, inferredName: node.left.type === "Identifier" ? node.left.name : undefined });
     if (right.kind !== "normal") {
         return right;
     }
@@ -584,7 +616,7 @@ async function evaluateMemberAssignmentExpression(node, context) {
                 throw new TypeError("Cannot assign properties of null or undefined.");
             }
             property = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-            current = getPropertyValue(member.object, property, context);
+            current = await getPropertyValue(member.object, property, context, member.superReceiver === undefined ? member.object : member.superReceiver.value);
         }
         if (node.operator === "&&=" && !isTruthy(current)) {
             return {
@@ -626,7 +658,10 @@ async function evaluateMemberAssignmentExpression(node, context) {
             }
             operands = [value];
             property ??= await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-            setSandboxProperty(member.object, property, value, context.budget);
+            if (member.superReceiver === undefined)
+                await setSandboxProperty(member.object, property, value, context.budget, true, createCoercionContext(context));
+            else
+                await setSuperProperty(member.object, member.superReceiver.value, property, value, context);
             return {
                 kind: "normal",
                 hasValue: true,
@@ -772,7 +807,7 @@ async function evaluateVariableDeclaration(node, context) {
                     hasValue: true,
                     value: undefined
                 }
-                : await evaluateNode(declarator.init, context);
+                : await evaluateNode(declarator.init, { ...context, inferredName: declarator.id.type === "Identifier" ? declarator.id.name : undefined });
         if (value.kind !== "normal") {
             return value;
         }
@@ -946,6 +981,11 @@ function predeclareStatementListBindings(statements, context, functionBody = fal
     const { scope } = context;
     const names = new Set();
     for (const statement of statements) {
+        if (statement.type === "ClassDeclaration") {
+            scope.predeclare(statement.id.name, "let");
+            names.add(statement.id.name);
+            continue;
+        }
         if (statement.type === "FunctionDeclaration") {
             const name = statement.id.name;
             if (names.has(name) && !(functionBody && scope.getOwnBindingKind(name) === "var")) {
@@ -1646,6 +1686,8 @@ async function evaluateDeleteExpression(node, context) {
         throw createError("UNSUPPORTED_NODE", node, "Unary operator 'delete' requires a member target.");
     }
     return evaluateMemberAccess(node.argument, context, async (member) => {
+        if (member.kind === "resolved" && member.superReceiver !== undefined)
+            throw new ReferenceError("Cannot delete a super property.");
         if (member.kind === "nullish" || member.object === null || member.object === undefined) {
             if (member.kind === "nullish") {
                 return {
@@ -1703,9 +1745,12 @@ async function evaluateMemberUpdateExpression(node, context) {
             throw new TypeError("Cannot update properties of null or undefined.");
         }
         const property = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
-        const current = toNumber(await toNumericPrimitive(getPropertyValue(member.object, property, context), context));
+        const current = toNumber(await toNumericPrimitive(await getPropertyValue(member.object, property, context, member.superReceiver === undefined ? member.object : member.superReceiver.value), context));
         const next = node.operator === "++" ? current + 1 : current - 1;
-        setSandboxProperty(member.object, property, next, context.budget);
+        if (member.superReceiver === undefined)
+            await setSandboxProperty(member.object, property, next, context.budget, true, createCoercionContext(context));
+        else
+            await setSuperProperty(member.object, member.superReceiver.value, property, next, context);
         return {
             kind: "normal",
             hasValue: true,
@@ -1723,19 +1768,23 @@ async function evaluateMemberExpression(node, context) {
         return {
             kind: "normal",
             hasValue: true,
-            value: getPropertyValue(member.object, await toPropertyKey(member.property, context.budget, createCoercionContext(context)), context)
+            value: await getPropertyValue(member.object, await toPropertyKey(member.property, context.budget, createCoercionContext(context)), context, member.superReceiver === undefined ? member.object : member.superReceiver.value)
         };
     });
 }
-function getPropertyValue(target, property, context) {
+function getPropertyValue(target, property, context, receiver = target) {
     if (isGuestHostObject(target))
         return getHostObjectMember(target, String(property));
+    const descriptor = getSandboxPropertyDescriptor(target, property, context.budget);
+    if (descriptor !== undefined)
+        return readPropertyDescriptor(descriptor, receiver, createCoercionContext(context), true);
     if (typeof target === "string" || typeof target === "number" || typeof target === "boolean") {
         const prototype = getBoxedPrototype(target, context.budget);
         if (prototype !== undefined) {
-            if (typeof target === "string" && (property === "length" || getStringIndex(property) !== undefined))
+            if (typeof target === "string" &&
+                (property === "length" || getStringIndex(property) !== undefined))
                 return getStringMember(target, property, context.budget);
-            return getMemberValue(prototype, property, context);
+            return getPropertyValue(prototype, property, context, receiver);
         }
     }
     if (typeof target === "string")
@@ -1771,13 +1820,22 @@ export function createPatternContext(context, scope = context.scope, evaluate =
     const evaluationContext = { ...context, scope };
     return {
         budget: context.budget,
-        evaluate: node => evaluate(node, evaluationContext),
-        toPropertyKey: value => toPropertyKey(value, context.budget, createCoercionContext(evaluationContext)),
+        evaluate: (node, inferredName) => evaluate(node, { ...evaluationContext, inferredName }),
+        toPropertyKey: (value) => toPropertyKey(value, context.budget, createCoercionContext(evaluationContext)),
         getProperty: (value, key) => getPropertyValue(value, key, evaluationContext),
-        setProperty: (target, key, value) => setSandboxProperty(target, key, value, context.budget)
+        setProperty: (target, key, value) => setSandboxProperty(target, key, value, context.budget, true, createCoercionContext(evaluationContext))
     };
 }
 async function evaluateCallExpression(node, context) {
+    if (node.callee.type === "Super") {
+        const construction = context.functionEnvironment?.construction;
+        if (construction === undefined)
+            throw new ReferenceError("Super constructor binding is unavailable.");
+        const args = await evaluateCallArguments(node.arguments, context);
+        if (!args.ok)
+            return args.result;
+        return { kind: "normal", hasValue: true, value: await construction.superCall(args.value) };
+    }
     if (node.callee.type === "MemberExpression") {
         context.budget.visitNode();
         context.stats.nodeVisits += 1;
@@ -1847,6 +1905,7 @@ function attachFatalSandboxErrorContext(error, node, stackFrames) {
     replaceErrorStack(error, stackFrames);
 }
 async function evaluateMemberAccess(node, context, consume) {
+    const superReceiver = node.object.type === "Super" ? { value: context.scope.lookup("this") } : undefined;
     const object = await evaluateNode(node.object, context);
     if (object.kind !== "normal")
         return object;
@@ -1862,7 +1921,8 @@ async function evaluateMemberAccess(node, context, consume) {
         if (result.kind !== "normal")
             return result;
         property = result.value;
-        return await consume({ kind: "resolved", object: object.value, property });
+        return await consume({ kind: "resolved", object: object.value, property,
+            ...(superReceiver === undefined ? {} : { superReceiver: { value: superReceiver.value.found ? superReceiver.value.value : undefined } }) });
     }
     finally {
         release();
@@ -1918,6 +1978,8 @@ async function evaluateMemberCallExpression(node, context) {
             ...reference,
             property: await toPropertyKey(reference.property, context.budget, createCoercionContext(context))
         };
+        if (member.superReceiver !== undefined)
+            return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context, member.superReceiver.value), context, member.superReceiver.value);
         if ((typeof member.object === "string" || typeof member.object === "number" || typeof member.object === "boolean") &&
             getBoxedPrototype(member.object, context.budget) !== undefined) {
             if (isDefaultBoxedMethod(member.object, member.property, context.budget)) {
@@ -1926,7 +1988,7 @@ async function evaluateMemberCallExpression(node, context) {
                 if (typeof member.object === "number" && isNumberMethodName(member.property))
                     return evaluateNumberMethodCall(node, member.object, member.property, context);
             }
-            return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.object);
+            return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (typeof member.object === "string" && isStringMethodName(member.property)) {
             return evaluateStringMethodCall(node, member.object, member.property, context);
@@ -1974,7 +2036,7 @@ async function evaluateMemberCallExpression(node, context) {
             return evaluateResolvedCallExpression(node, memberValue, context, member.object);
         }
         if (isSandboxClosure(member.object)) {
-            const memberValue = getClosureMemberValue(member.object, member.property, context);
+            const memberValue = await getPropertyValue(member.object, member.property, context);
             if (memberValue === undefined) {
                 throw new TypeError(`Function#${String(member.property)} is not a supported method.`);
             }
@@ -1989,7 +2051,7 @@ async function evaluateMemberCallExpression(node, context) {
         if (!isIndexableSandboxValue(member.object)) {
             throw new TypeError("Attempted to read a property from a non-object value.");
         }
-        return evaluateResolvedCallExpression(node, getMemberValue(member.object, member.property, context), context, member.object);
+        return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
     });
 }
 function evaluatePrimitiveMemberCall(node, receiverType, property, value, context) {
@@ -2174,7 +2236,8 @@ function applyBinaryOperator(node, left, right, context) {
             if (isFloat32ArrayConstructor(right))
                 return isFloat32Array(left);
             if (isDateConstructor(right))
-                return isSandboxDate(left) && getDatePrototype(left, context.budget, context.compilation?.owner) !== null;
+                return (isSandboxDate(left) &&
+                    getDatePrototype(left, context.budget, context.compilation?.owner) !== null);
             if (isSandboxSetConstructor(right) && isSandboxSet(left)) {
                 return true;
             }
@@ -2184,17 +2247,21 @@ function applyBinaryOperator(node, left, right, context) {
             if (isGuestClosure(right)) {
                 if (typeof left !== "object" || left === null)
                     return false;
-                const prototype = getGuestFunctionProperty(right, "prototype");
-                if (typeof prototype !== "object" || prototype === null) {
-                    throw new TypeError("Function has a non-object prototype in instanceof check.");
-                }
-                let depth = 0;
-                for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
-                    context.budget.visitNode();
-                    assertSandboxDataDepth(depth++);
-                    if (current === prototype)
-                        return true;
-                }
+                const check = (prototype) => {
+                    if (typeof prototype !== "object" || prototype === null) {
+                        throw new TypeError("Function has a non-object prototype in instanceof check.");
+                    }
+                    let depth = 0;
+                    for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
+                        context.budget.visitNode();
+                        assertSandboxDataDepth(depth++);
+                        if (current === prototype)
+                            return true;
+                    }
+                    return false;
+                };
+                const prototype = getPropertyValue(right, "prototype", context);
+                return prototype instanceof Promise ? prototype.then(check) : check(prototype);
             }
             return false;
         case "in":
@@ -2372,7 +2439,7 @@ async function toNumericPrimitive(value, context) {
     }
     if (isIndexableSandboxValue(value)) {
         for (const methodName of ["valueOf", "toString"]) {
-            const method = getMemberValue(value, methodName, context);
+            const method = await getPropertyValue(value, methodName, context);
             if (methodName === "toString" && method === undefined && !Object.hasOwn(value, methodName)) {
                 return toString(value);
             }
@@ -2468,7 +2535,7 @@ function getArrayMemberValue(target, property, context) {
     }
     return getArrayMember(target, property, createArrayMethodOptions(context));
 }
-export function setSandboxProperty(target, property, value, budget) {
+export function setSandboxProperty(target, property, value, budget, checkInherited = true, context) {
     if (isSandboxDate(target))
         throw new TypeError("Date own properties are not supported.");
     if (isGuestHostObject(target)) {
@@ -2476,6 +2543,11 @@ export function setSandboxProperty(target, property, value, budget) {
         return;
     }
     const prototypeOwner = target;
+    if (checkInherited) {
+        const descriptor = getSandboxPropertyDescriptor(target, property, budget);
+        if (descriptor !== undefined && !("value" in descriptor))
+            return writePropertyDescriptor(descriptor, target, value, context);
+    }
     if (isGuestClosure(target))
         target = materializeFunctionProperties(target);
     if (isFloat32Array(target)) {
@@ -2505,7 +2577,7 @@ export function setSandboxProperty(target, property, value, budget) {
         Object.defineProperty(target, key, { value });
     }
     else {
-        if (typeof prototypeOwner === "object" && prototypeOwner !== null) {
+        if (checkInherited && typeof prototypeOwner === "object" && prototypeOwner !== null) {
             let depth = 0;
             for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
                 budget.visitNode();
@@ -2522,6 +2594,28 @@ export function setSandboxProperty(target, property, value, budget) {
         defineSandboxProperty(target, key, value);
     }
 }
+function setSuperProperty(base, receiver, key, value, context) {
+    const budget = context.budget;
+    if (typeof base !== "object" || base === null)
+        throw new TypeError("Cannot assign a property of null.");
+    let depth = 0;
+    for (let current = base; current !== null; current = getSandboxPrototype(current, budget)) {
+        budget.visitNode();
+        assertSandboxDataDepth(depth++);
+        const properties = isSandboxClosure(current) ? current.properties : current;
+        const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
+        if (descriptor === undefined)
+            continue;
+        if (!("value" in descriptor))
+            return writePropertyDescriptor(descriptor, receiver, value, createCoercionContext(context));
+        if (descriptor.writable !== true)
+            throw new TypeError(`Cannot assign to read only property '${key}'.`);
+        break;
+    }
+    if (typeof receiver !== "object" || receiver === null)
+        throw new TypeError("Super assignment requires an object receiver.");
+    return setSandboxProperty(receiver, key, value, budget, false);
+}
 function deleteSandboxProperty(target, property) {
     if (isGuestHostObject(target))
         return deleteHostObjectMember(target, String(property));
@@ -2580,7 +2674,7 @@ function createArrayMethodOptions(context) {
         budget: context.budget,
         context: createCoercionContext(context),
         hasProperty: (value, property) => hasSandboxProperty(value, property, context),
-        setProperty: (value, property, entry) => setSandboxProperty(value, property, entry, context.budget),
+        setProperty: (value, property, entry) => setSandboxProperty(value, property, entry, context.budget, true, createCoercionContext(context)),
         deleteProperty: deleteSandboxProperty,
         callClosure: (closure, args, stack, thisValue) => invokeSandboxClosure(closure, args, context, stack, undefined, thisValue)
     };
@@ -2600,10 +2694,10 @@ function createSetMethodOptions(context) {
 function createFunctionMethodOptions(context) {
     return {
         budget: context.budget,
-        callClosure: (closure, args, stack, thisValue, construct) => invokeSandboxClosure(closure, args, context, stack, undefined, thisValue, construct)
+        callClosure: (closure, args, stack, thisValue, construct, newTarget) => invokeSandboxClosure(closure, args, context, stack, undefined, thisValue, construct, newTarget)
     };
 }
-async function invokeSandboxClosure(callee, args, context, stack, span, thisValue = undefined, construct = false) {
+async function invokeSandboxClosure(callee, args, context, stack, span, thisValue = undefined, construct = false, newTarget) {
     const leaveCall = context.budget.enterCall();
     try {
         const invoke = construct ? callee.construct : callee.call;
@@ -2614,10 +2708,11 @@ async function invokeSandboxClosure(callee, args, context, stack, span, thisValu
             {
                 stack,
                 thisValue,
+                newTarget: construct ? newTarget ?? callee : undefined,
                 compilation: context.compilation,
                 getProperty: (value, property) => getPropertyValue(value, property, context),
                 reconcileData: (value) => reconcileDataBudget(context.budget, context.stats, context.scope, value, context.compilation, context.compilation?.parent),
-                invokeClosure: (closure, argumentsList, receiver, asConstructor) => invokeSandboxClosure(closure, argumentsList, context, stack, span, receiver, asConstructor),
+                invokeClosure: (closure, argumentsList, receiver, asConstructor, target) => invokeSandboxClosure(closure, argumentsList, context, stack, span, receiver, asConstructor, target),
                 ...(span === undefined ? {} : { span })
             }
         ]);
@@ -2728,16 +2823,28 @@ async function evaluateObjectSpread(node, context) {
         }
         return { ok: true, value: entries };
     }
-    if ((isSandboxClosure(value.value) && !isGuestClosure(value.value)) || isSandboxPromise(value.value)) {
+    if ((isSandboxClosure(value.value) && !isGuestClosure(value.value)) ||
+        isSandboxPromise(value.value)) {
         throw new TypeError(`Cannot spread ${describeObjectSpreadValue(value.value)} into object literal.`);
     }
-    const spreadValue = isGuestClosure(value.value) ? value.value.properties ?? {} : Object(value.value);
+    const spreadValue = isGuestClosure(value.value)
+        ? (value.value.properties ?? {})
+        : Object(value.value);
     const keys = Object.keys(spreadValue);
     context.budget.allocateArrayLength(keys.length);
-    return {
-        ok: true,
-        value: keys.map((key) => [key, spreadValue[key]])
-    };
+    const entries = [];
+    const release = retainValues(context.budget, () => [value.value, entries]);
+    try {
+        for (const key of keys) {
+            if (!hasOwnSandboxProperty(value.value, key, true))
+                continue;
+            entries.push([key, await getPropertyValue(value.value, key, context)]);
+        }
+        return { ok: true, value: entries };
+    }
+    finally {
+        release();
+    }
 }
 function describeObjectSpreadValue(value) {
     if (value === null) {

package/packages/safe-js/dist/interp/iteration.js

@@ -44,6 +44,19 @@ export function getSandboxIterator(value, budget, context) {
     if (isSandboxSet(value)) {
         return collectionIterator(value.values);
     }
+    if (Array.isArray(value) && context?.getProperty !== undefined) {
+        let index = 0;
+        return {
+            asynchronous: true,
+            snapshotIndex: () => index,
+            next: async () => {
+                if (index >= value.length)
+                    return { done: true, value: undefined };
+                budget?.visitNode();
+                return { done: false, value: await context.getProperty(value, index++) };
+            }
+        };
+    }
     if ((typeof value !== "object" && typeof value !== "function") || value === null) {
         return undefined;
     }

package/packages/safe-js/dist/interp/methods/array.d.ts

@@ -9,7 +9,7 @@ export type ArrayMethodOptions = {
     budget: Budget;
     context?: SandboxCallContext;
     hasProperty?: (value: SandboxValue, property: string) => boolean;
-    setProperty?: (value: SandboxValue, property: string, entry: SandboxValue) => void;
+    setProperty?: (value: SandboxValue, property: string, entry: SandboxValue) => void | Promise<void>;
     deleteProperty?: (value: SandboxValue, property: string | number) => boolean;
     callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue?: SandboxValue) => Promise<SandboxValue>;
 };