poe-code 14.0.7 → 14.0.9

package/packages/safe-js/dist/chunks/{chunk-BWVASPJX.js → chunk-MO3YD4ID.js}

@@ -6331,6 +6331,10 @@ function serializedDateTime(value) {
 }
 
 // packages/safe-js/src/interp/host-capabilities.ts
+import { types as types3 } from "node:util";
+var MAX_INDEXED_LENGTH = 65536;
+var MAX_NAMED_KEYS = 65536;
+var MAX_NAMED_KEY_CODE_UNITS = 1048576;
 var hostObjects = /* @__PURE__ */ new WeakMap();
 var guestObjects = /* @__PURE__ */ new WeakMap();
 var guestCallbacks = /* @__PURE__ */ new WeakMap();
@@ -6355,8 +6359,48 @@ function revokeGuestReference(reference, owner) {
 }
 function createLiveHostObject(definition, controller) {
   const input = readDataRecord(definition, "Host object definition");
-  if (Object.keys(input).some((key) => key !== "properties" && key !== "methods"))
+  if (Object.keys(input).some((key) => !["properties", "methods", "indexed", "named"].includes(key)))
     throw new TypeError("Unknown host object definition field.");
+  let indexed;
+  if (input.indexed !== void 0) {
+    const data = readDataRecord(input.indexed, "Indexed host capability");
+    if (Object.keys(data).some((key) => !["length", "get", "maxLength"].includes(key)))
+      throw new TypeError("Unknown indexed host capability field.");
+    if (typeof data.length !== "function" || typeof data.get !== "function")
+      throw new TypeError("Indexed length and get must be synchronous functions.");
+    if (typeof data.maxLength !== "number" || !Number.isInteger(data.maxLength) || data.maxLength < 1 || data.maxLength > MAX_INDEXED_LENGTH)
+      throw new RangeError(`Indexed maxLength must be an integer from 1 to ${MAX_INDEXED_LENGTH}.`);
+    indexed = {
+      length: data.length,
+      get: data.get,
+      maxLength: data.maxLength
+    };
+  }
+  let named;
+  if (input.named !== void 0) {
+    const data = readDataRecord(input.named, "Named host capability");
+    if (Object.keys(data).some(
+      (key) => !["keys", "get", "maxKeys", "maxKeyCodeUnits", "enumerable"].includes(key)
+    ))
+      throw new TypeError("Unknown named host capability field.");
+    if (typeof data.keys !== "function" || typeof data.get !== "function")
+      throw new TypeError("Named keys and get must be synchronous functions.");
+    if (typeof data.maxKeys !== "number" || !Number.isInteger(data.maxKeys) || data.maxKeys < 1 || data.maxKeys > MAX_NAMED_KEYS)
+      throw new RangeError(`Named maxKeys must be an integer from 1 to ${MAX_NAMED_KEYS}.`);
+    if (typeof data.maxKeyCodeUnits !== "number" || !Number.isInteger(data.maxKeyCodeUnits) || data.maxKeyCodeUnits < 1 || data.maxKeyCodeUnits > MAX_NAMED_KEY_CODE_UNITS)
+      throw new RangeError(
+        `Named maxKeyCodeUnits must be an integer from 1 to ${MAX_NAMED_KEY_CODE_UNITS}.`
+      );
+    if (data.enumerable !== void 0 && typeof data.enumerable !== "boolean")
+      throw new TypeError("Named enumerable must be a boolean.");
+    named = {
+      keys: data.keys,
+      get: data.get,
+      maxKeys: data.maxKeys,
+      maxKeyCodeUnits: data.maxKeyCodeUnits,
+      enumerable: data.enumerable
+    };
+  }
   const properties = /* @__PURE__ */ new Map();
   for (const [name, inputProperty] of Object.entries(
     readDataRecord(input.properties ?? {}, "Host properties")
@@ -6376,6 +6420,8 @@ function createLiveHostObject(definition, controller) {
   for (const name of [...properties.keys(), ...Object.keys(operations)]) {
     if (["constructor", "prototype", "__proto__"].includes(name))
       throw new TypeError(`Reserved host member '${name}'.`);
+    if (indexed !== void 0 && (name === "length" || canonicalIndex(name) !== void 0))
+      throw new TypeError(`Conflicting indexed host member '${name}'.`);
   }
   controller.assertActive();
   controller.chargeWork(properties.size + Object.keys(operations).length + 1);
@@ -6387,7 +6433,7 @@ function createLiveHostObject(definition, controller) {
       controller.method(operation)
     ])
   );
-  const state = { host, guest, controller, properties, methods };
+  const state = { host, guest, controller, properties, methods, indexed, named };
   hostObjects.set(host, state);
   guestObjects.set(guest, state);
   return host;
@@ -6444,15 +6490,29 @@ function revokeHostObject(value, owner) {
     throw new TypeError("Foreign host object.");
   state.properties.clear();
   state.methods.clear();
+  state.indexed = void 0;
+  state.named = void 0;
 }
 function getHostObjectMember(value, key) {
   const state = guestObjects.get(value);
   state.controller.assertActive();
   state.controller.chargeWork();
+  if (state.indexed !== void 0) {
+    if (key === "length") return indexedLength(state);
+    const index = canonicalIndex(key);
+    if (index !== void 0) {
+      if (index >= state.indexed.maxLength || index >= indexedLength(state)) return void 0;
+      return state.controller.read(() => state.indexed.get(index));
+    }
+  }
   const property = state.properties.get(key);
   if (property !== void 0)
     return property.get === void 0 ? void 0 : state.controller.read(property.get);
-  return state.methods.get(key);
+  const method = state.methods.get(key);
+  if (method !== void 0) return method;
+  if (state.named !== void 0 && namedKeys(state).includes(key))
+    return state.controller.read(() => state.named.get(key));
+  return void 0;
 }
 function setHostObjectMember(value, key, entry) {
   const state = guestObjects.get(value);
@@ -6465,7 +6525,106 @@ function setHostObjectMember(value, key, entry) {
 function getHostObjectKeys(value) {
   const state = guestObjects.get(value);
   state.controller.assertActive();
-  return [...state.properties.keys(), ...state.methods.keys()];
+  const length = state.indexed === void 0 ? 0 : indexedLength(state);
+  const names = state.named === void 0 || state.named.enumerable === false ? [] : namedKeys(state).filter(
+    (key) => !state.properties.has(key) && !state.methods.has(key) && !(state.indexed !== void 0 && (key === "length" || canonicalIndex(key) !== void 0))
+  );
+  const size = length + state.properties.size + state.methods.size + names.length;
+  state.controller.checkLength(size);
+  state.controller.chargeWork(size + 1);
+  return [
+    ...Array.from({ length }, (_entry, index) => String(index)),
+    ...state.properties.keys(),
+    ...state.methods.keys(),
+    ...names
+  ];
+}
+function hasHostObjectMember(value, key, enumerableOnly = false) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  state.controller.chargeWork();
+  if (state.indexed !== void 0) {
+    if (key === "length") return !enumerableOnly;
+    const index = canonicalIndex(key);
+    if (index !== void 0) return index < state.indexed.maxLength && index < indexedLength(state);
+  }
+  if (state.properties.has(key) || state.methods.has(key)) return true;
+  return state.named !== void 0 && !(enumerableOnly && state.named.enumerable === false) && namedKeys(state).includes(key);
+}
+function measureHostObjectData(value) {
+  const state = guestObjects.get(value);
+  let size = state.indexed === void 0 ? 0 : 16;
+  if (state.named !== void 0) size += 24;
+  for (const key of state.properties.keys()) size += key.length + 1;
+  for (const key of state.methods.keys()) size += key.length + 1;
+  return size;
+}
+function getHostObjectIterator(value) {
+  const state = guestObjects.get(value);
+  state.controller.assertActive();
+  if (state.indexed === void 0) return void 0;
+  let index = 0;
+  let exhausted = false;
+  return {
+    next: () => {
+      state.controller.assertActive();
+      state.controller.chargeWork();
+      if (exhausted) return { done: true, value: void 0 };
+      if (index >= indexedLength(state)) {
+        exhausted = true;
+        return { done: true, value: void 0 };
+      }
+      const position = index++;
+      return { done: false, value: state.controller.read(() => state.indexed.get(position)) };
+    }
+  };
+}
+function indexedLength(state) {
+  state.controller.chargeWork();
+  const length = state.controller.read(state.indexed.length);
+  if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > state.indexed.maxLength)
+    throw new RangeError("Indexed length must be a non-negative integer within maxLength.");
+  state.controller.checkLength(length);
+  return length;
+}
+function canonicalIndex(key) {
+  const index = Number(key);
+  return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : void 0;
+}
+function namedKeys(state) {
+  const named = state.named;
+  return state.controller.read(named.keys, (value) => {
+    if (!Array.isArray(value) || types3.isProxy(value))
+      throw new TypeError("Named keys must be a dense own-data array of strings, not a proxy.");
+    const length = Object.getOwnPropertyDescriptor(value, "length").value;
+    if (length > named.maxKeys) throw new RangeError("Named keys exceed maxKeys.");
+    state.controller.checkLength(length);
+    state.controller.chargeWork(length + 1);
+    if (Reflect.ownKeys(value).length !== length + 1)
+      throw new TypeError("Named keys must contain only dense own-data indices and length.");
+    const result = [];
+    const seen = /* @__PURE__ */ new Set();
+    let units = 0;
+    for (let index = 0; index < length; index++) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (descriptor === void 0 || !("value" in descriptor) || typeof descriptor.value !== "string")
+        throw new TypeError(
+          "Named keys require dense own string data, not accessors or sparse arrays."
+        );
+      const key = descriptor.value;
+      units += key.length;
+      if (units > named.maxKeyCodeUnits)
+        throw new RangeError("Named keys exceed maximum UTF-16 code units.");
+      state.controller.chargeWork(key.length);
+      if (seen.has(key)) throw new TypeError("Named keys must be distinct.");
+      if (["constructor", "prototype", "__proto__"].includes(key))
+        throw new TypeError(`Reserved named host member '${key}'.`);
+      seen.add(key);
+      result.push(key);
+    }
+    state.controller.checkTemporaryDataSize(1 + length + units);
+    return result;
+  });
 }
 
 // packages/safe-js/src/interp/values.ts
@@ -6588,7 +6747,7 @@ async function flushPromiseJobs() {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types as types3 } from "node:util";
+import { types as types4 } from "node:util";
 
 // packages/safe-js/src/interp/arguments.ts
 var sandboxArgumentsBrand = /* @__PURE__ */ Symbol("SandboxArguments");
@@ -6718,6 +6877,8 @@ function graphEntries(value) {
 var guestClosures = /* @__PURE__ */ new WeakSet();
 var functionProperties = /* @__PURE__ */ new WeakMap();
 var prototypes = /* @__PURE__ */ new WeakMap();
+var intrinsicPrototypes = /* @__PURE__ */ new WeakMap();
+var intrinsicConstructors = /* @__PURE__ */ new WeakMap();
 var descriptorObjects = /* @__PURE__ */ new WeakSet();
 function registerGuestClosure(closure) {
   guestClosures.add(closure);
@@ -6762,27 +6923,49 @@ function getGuestFunctionProperty(closure, key) {
   }
   return properties === void 0 ? void 0 : Object.getOwnPropertyDescriptor(properties, key)?.value;
 }
-function getSandboxPrototype(value) {
-  return prototypes.get(value) ?? null;
+function installObjectPrototype(budget, prototype, constructor) {
+  prototypes.set(prototype, null);
+  intrinsicPrototypes.set(budget, prototype);
+  const records = [prototype, materializeFunctionProperties(constructor)].map((value) => ({
+    value,
+    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+  }));
+  const unchanged = (before, after) => before !== void 0 && after !== void 0 && before.value === after.value && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+  intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+    const current = Object.getOwnPropertyDescriptors(value);
+    return Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
+  }));
+  budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])));
+}
+function releaseObjectPrototype(budget) {
+  const prototype = intrinsicPrototypes.get(budget);
+  if (prototype !== void 0) budget.setRetainedValues(prototype, void 0);
+  intrinsicPrototypes.delete(budget);
+}
+function getSandboxPrototype(value, budget) {
+  if (prototypes.has(value)) return prototypes.get(value) ?? null;
+  return budget !== void 0 && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
 }
 function setSandboxPrototype(value, prototype, budget) {
+  if (budget !== void 0 && intrinsicPrototypes.get(budget) === value && prototype !== null) {
+    throw new TypeError("Object.prototype has an immutable null prototype.");
+  }
   if (!isPrototypeRecord(value) || prototype !== null && !isPrototypeRecord(prototype)) {
     throw new TypeError(
       "Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported."
     );
   }
-  if (getSandboxPrototype(value) === prototype) return;
+  if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype) return;
   if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : value)) {
     throw new TypeError("Cannot change the prototype of a non-extensible object.");
   }
   let depth = 0;
-  for (let current = prototype; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = prototype; current !== null; current = getSandboxPrototype(current, budget)) {
     budget?.visitNode();
     assertSandboxDataDepth(depth++);
     if (current === value) throw new TypeError("Cyclic prototype value.");
   }
-  if (prototype === null) prototypes.delete(value);
-  else prototypes.set(value, prototype);
+  prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
   if (isGuestHostObject(value)) return false;
@@ -6798,6 +6981,8 @@ function hasManagedDescriptors(value) {
   return descriptorObjects.has(value);
 }
 function hasGuestObjectState(value) {
+  const intrinsicUnchanged = intrinsicConstructors.get(value);
+  if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
@@ -7446,7 +7631,7 @@ function validateGenericValue(value, path, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail("invalidState", path, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types3.isProxy(value)) {
+  if (state.dataPropertiesOnly && types4.isProxy(value)) {
     fail("invalidType", path, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -8380,6 +8565,7 @@ function assertSnapshotInactive(snapshot) {
 
 // packages/safe-js/src/interp/iteration.ts
 function getSandboxIterator(value) {
+  if (isGuestHostObject(value)) return getHostObjectIterator(value);
   if (isFloat32Array(value)) {
     return syncIterator(Float32Array.prototype.values.call(value));
   }
@@ -9504,6 +9690,7 @@ function createSandboxClosure(input) {
   if (input.sandbox === true) {
     Object.defineProperty(closure, "sandbox", { value: true });
   }
+  if (input.generator === true) Object.defineProperty(closure, "generator", { value: true });
   if (input.length !== void 0) {
     Object.defineProperty(closure, "length", { value: input.length });
   }
@@ -9536,7 +9723,13 @@ function createSandboxClosure(input) {
   return Object.freeze(closure);
 }
 function ownEnumerableSandboxEntries(value) {
-  if (isGuestHostObject(value)) return getHostObjectKeys(value).map((key) => [key, getHostObjectMember(value, key)]);
+  if (isGuestHostObject(value)) {
+    const entries = [];
+    for (const key of getHostObjectKeys(value)) {
+      if (hasHostObjectMember(value, key, true)) entries.push([key, getHostObjectMember(value, key)]);
+    }
+    return entries;
+  }
   if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
   if (isGuestClosure(value)) return Object.entries(value.properties ?? {});
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value)) return [];
@@ -9694,7 +9887,7 @@ function measureSandboxData(values, options = {}) {
       return;
     }
     if (isGuestHostObject(value)) {
-      for (const key of getHostObjectKeys(value)) usage += key.length + 1;
+      usage += measureHostObjectData(value);
       return;
     }
     const prototype = getSandboxPrototype(value);
@@ -9791,7 +9984,7 @@ function measureSandboxData(values, options = {}) {
 function reconcileCompiledValues(budget, values, compilation, parent, escaping = []) {
   while (parent?.closed) parent = parent.parent;
   const included = /* @__PURE__ */ new Set();
-  const usage = measureSandboxData(values, { compileTickets: included });
+  const usage = measureSandboxData([...values, ...budget.retainedValues()], { compileTickets: included });
   const kept = /* @__PURE__ */ new Set();
   if (parent !== void 0) measureSandboxData(escaping, { compileTickets: kept });
   const transferred = /* @__PURE__ */ new Set();
@@ -22935,6 +23128,86 @@ function hoistVarDeclarations(node, scope) {
   }
 }
 
+// packages/safe-js/src/interp/string-coercion.ts
+function sandboxString(value, budget, context, joining = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "function") throw new TypeError("Expected a sandbox value.");
+    return budget.allocateString(String(value));
+  }
+  return stringifyObject(value, budget, context, joining);
+}
+async function stringifyObject(value, budget, context, joining) {
+  const leaveCall = budget.enterCall();
+  try {
+    budget.visitNode();
+    for (const name of ["toString", "valueOf"]) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, name);
+      let result;
+      if (descriptor === void 0) {
+        if (name === "valueOf") continue;
+        result = await defaultToString(value, budget, context, joining);
+      } else {
+        const hook = ownDataValue(value, name);
+        if (!isSandboxClosure(hook)) continue;
+        if (context?.invokeClosure === void 0) {
+          throw new TypeError("String hooks require a sandbox call context.");
+        }
+        result = await context.invokeClosure(hook, [], value);
+      }
+      if (result === null || typeof result !== "object") {
+        return sandboxString(result, budget, context, joining);
+      }
+    }
+    throw new TypeError("Cannot convert object to primitive value");
+  } finally {
+    leaveCall();
+  }
+}
+async function defaultToString(value, budget, context, joining) {
+  if (isSandboxDate(value)) return budget.allocateString(dateString(value));
+  if (Array.isArray(value) || isFloat32Array(value)) {
+    if (Object.hasOwn(value, "join")) {
+      const join = ownDataValue(value, "join");
+      if (!isSandboxClosure(join))
+        return isFloat32Array(value) ? "[object Float32Array]" : "[object Array]";
+      if (context?.invokeClosure === void 0) {
+        throw new TypeError("String hooks require a sandbox call context.");
+      }
+      return context.invokeClosure(join, [], value);
+    }
+    if (joining.has(value)) return "";
+    joining.add(value);
+    try {
+      const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
+      let text = "";
+      for (let index = 0; index < length; index++) {
+        budget.visitNode();
+        const element = ownDataValue(value, String(index));
+        const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
+        text = budget.allocateString(text + (index === 0 ? "" : ",") + part);
+      }
+      return text;
+    } finally {
+      joining.delete(value);
+    }
+  }
+  if (sandboxErrorTypes.has(value)) {
+    const nameValue = ownDataValue(value, "name");
+    const name = nameValue === void 0 ? "Error" : await sandboxString(nameValue, budget, context, joining);
+    const messageValue = ownDataValue(value, "message");
+    const message = messageValue === void 0 ? "" : await sandboxString(messageValue, budget, context, joining);
+    return name === "" ? message : message === "" ? name : `${name}: ${message}`;
+  }
+  return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
+}
+function ownDataValue(value, name) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, name);
+  if (descriptor !== void 0 && !Object.hasOwn(descriptor, "value")) {
+    throw new TypeError("String conversion requires sandbox data properties.");
+  }
+  return descriptor?.value;
+}
+
 // packages/safe-js/src/interp/methods/array.ts
 var activeArrayCallbacks = /* @__PURE__ */ new WeakMap();
 var arrayMethodNames = /* @__PURE__ */ new Set([
@@ -25628,6 +25901,9 @@ async function evaluateObjectExpression(node, context) {
       return value;
     }
     if (isObjectPrototypeSetterProperty(property, key.value)) {
+      if (value.value === null || typeof value.value === "object") {
+        setSandboxPrototype(object, value.value, context.budget);
+      }
       continue;
     }
     defineSandboxProperty(object, String(key.value), value.value);
@@ -25749,7 +26025,11 @@ async function evaluateBinaryExpression(node, context) {
   if (right.kind !== "normal") {
     return right;
   }
-  const value = applyBinaryOperator(node, left.value, right.value, context);
+  const value = node.operator === "in" && isGuestHostObject(right.value) ? hasHostObjectMember(right.value, await sandboxString(left.value, context.budget, {
+    stack: context.callStack,
+    thisValue: void 0,
+    invokeClosure: (closure, args, thisValue) => invokeSandboxClosure(closure, args, context, context.callStack, void 0, thisValue)
+  })) : applyBinaryOperator(node, left.value, right.value, context);
   return {
     kind: "normal",
     hasValue: true,
@@ -26432,7 +26712,7 @@ function forInKeys(object, budget) {
   const keys = [];
   const seen = /* @__PURE__ */ new Set();
   let depth = 0;
-  for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
     if (depth > 0) budget.visitNode();
     assertSandboxDataDepth(depth++);
     const properties = isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : current;
@@ -26446,9 +26726,9 @@ function forInKeys(object, budget) {
   return keys;
 }
 function hasForInProperty(object, key, budget) {
-  if (isGuestHostObject(object)) return getHostObjectKeys(object).includes(key);
+  if (isGuestHostObject(object)) return hasHostObjectMember(object, key, true);
   let depth = 0;
-  for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+  for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
     if (depth > 0) budget.visitNode();
     assertSandboxDataDepth(depth++);
     const properties = isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : current;
@@ -27449,7 +27729,7 @@ function applyBinaryOperator(node, left, right, context) {
           throw new TypeError("Function has a non-object prototype in instanceof check.");
         }
         let depth = 0;
-        for (let current = getSandboxPrototype(left); current !== null; current = getSandboxPrototype(current)) {
+        for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
           context.budget.visitNode();
           assertSandboxDataDepth(depth++);
           if (current === prototype) return true;
@@ -27663,7 +27943,7 @@ function getMemberValue(target, property, context) {
       return getPropertyValue(current, property, context);
     }
     if (Object.hasOwn(current, String(property))) return current[String(property)];
-    current = getSandboxPrototype(current);
+    current = getSandboxPrototype(current, context.budget);
     if (current !== null) {
       context.budget.visitNode();
       assertSandboxDataDepth(++depth);
@@ -27713,7 +27993,7 @@ function setSandboxProperty(target, property, value, budget) {
   } else {
     if (typeof prototypeOwner === "object" && prototypeOwner !== null) {
       let depth = 0;
-      for (let prototype = getSandboxPrototype(prototypeOwner); prototype !== null; prototype = getSandboxPrototype(prototype)) {
+      for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
         budget.visitNode();
         assertSandboxDataDepth(depth++);
         const properties = isSandboxClosure(prototype) ? prototype.properties : prototype;
@@ -27907,6 +28187,13 @@ async function evaluateObjectSpread(node, context) {
       value: []
     };
   }
+  if (isGuestHostObject(value.value)) {
+    const entries = [];
+    for (const key of getHostObjectKeys(value.value)) {
+      if (hasHostObjectMember(value.value, key, true)) entries.push([key, getHostObjectMember(value.value, key)]);
+    }
+    return { ok: true, value: entries };
+  }
   if (isSandboxClosure(value.value) && !isGuestClosure(value.value) || isSandboxPromise(value.value)) {
     throw new TypeError(
       `Cannot spread ${describeObjectSpreadValue(value.value)} into object literal.`
@@ -28089,6 +28376,7 @@ function createInterpretedClosure(node, context, evaluateNode2) {
 function createGeneratorClosure(node, context, evaluateNode2) {
   return createSandboxClosure({
     guest: true,
+    generator: true,
     sandbox: true,
     length: getFunctionLength(node.params),
     ...node.id === void 0 ? {} : { name: node.id.name },
@@ -29355,7 +29643,7 @@ function createReplayableRandom(options = {}) {
 
 // packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-import { types as types4 } from "node:util";
+import { types as types5 } from "node:util";
 
 // packages/safe-js/src/interp/globals/console-json.ts
 function createConsoleJsonGlobals(options) {
@@ -29506,7 +29794,7 @@ async function stringifyValue(value, state, indent) {
     return stringifyArray(value, state, indent);
   }
   if (isStringifyObject(value)) {
-    return stringifyObject(value, state, indent);
+    return stringifyObject2(value, state, indent);
   }
   return void 0;
 }
@@ -29532,7 +29820,7 @@ ${indent}]`;
     leaveStringifyObject(value, state);
   }
 }
-async function stringifyObject(value, state, indent) {
+async function stringifyObject2(value, state, indent) {
   enterStringifyObject(value, state);
   try {
     const nextIndent = indent + state.gap;
@@ -29747,90 +30035,138 @@ function assertStructuredCloneable(value, seen) {
   }
 }
 
-// packages/safe-js/src/interp/string-coercion.ts
-function sandboxString(value, budget, context, joining = /* @__PURE__ */ new Set()) {
-  if (value === null || typeof value !== "object") {
-    if (typeof value === "function") throw new TypeError("Expected a sandbox value.");
-    return budget.allocateString(String(value));
-  }
-  return stringifyObject2(value, budget, context, joining);
-}
-async function stringifyObject2(value, budget, context, joining) {
-  const leaveCall = budget.enterCall();
-  try {
-    budget.visitNode();
-    for (const name of ["toString", "valueOf"]) {
-      const descriptor = Object.getOwnPropertyDescriptor(value, name);
-      let result;
-      if (descriptor === void 0) {
-        if (name === "valueOf") continue;
-        result = await defaultToString(value, budget, context, joining);
-      } else {
-        const hook = ownDataValue(value, name);
-        if (!isSandboxClosure(hook)) continue;
-        if (context?.invokeClosure === void 0) {
-          throw new TypeError("String hooks require a sandbox call context.");
-        }
-        result = await context.invokeClosure(hook, [], value);
+// packages/safe-js/src/interp/globals/object.ts
+function createObjectGlobal(methods, budget) {
+  const construct = ([value]) => {
+    if (value === null || value === void 0) {
+      budget.chargeDataUsage(1);
+      return /* @__PURE__ */ Object.create(null);
+    }
+    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
+    return value;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "Object",
+    length: 1,
+    call: construct,
+    construct
+  });
+  const properties = materializeFunctionProperties(constructor);
+  const prototype = properties.prototype;
+  Object.defineProperty(properties, "prototype", { writable: false });
+  for (const [name, method] of Object.entries(methods)) {
+    Object.defineProperty(properties, name, { value: method, writable: true, configurable: true });
+  }
+  const prototypeMethods = {
+    toString: createSandboxClosure({
+      sandbox: true,
+      name: "toString",
+      length: 0,
+      call: (_args, context) => budget.allocateString(`[object ${typeTag(context?.thisValue)}]`)
+    }),
+    valueOf: createSandboxClosure({
+      sandbox: true,
+      name: "valueOf",
+      length: 0,
+      call: (_args, context) => {
+        const value = requireReceiver(context?.thisValue);
+        if (typeof value !== "object")
+          throw new TypeError("Object primitive boxing is not supported.");
+        return value;
       }
-      if (result === null || typeof result !== "object") {
-        return sandboxString(result, budget, context, joining);
+    }),
+    hasOwnProperty: createSandboxClosure({
+      sandbox: true,
+      name: "hasOwnProperty",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        false
+      )
+    }),
+    propertyIsEnumerable: createSandboxClosure({
+      sandbox: true,
+      name: "propertyIsEnumerable",
+      length: 1,
+      call: async ([key], context) => hasOwnSandboxProperty(
+        requireReceiver(context?.thisValue),
+        await sandboxString(key, budget, context),
+        true
+      )
+    }),
+    isPrototypeOf: createSandboxClosure({
+      sandbox: true,
+      name: "isPrototypeOf",
+      length: 1,
+      call: ([value], context) => {
+        if (typeof value !== "object" || value === null) return false;
+        const receiver = requireReceiver(context?.thisValue);
+        let depth = 0;
+        for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+          budget.visitNode();
+          assertSandboxDataDepth(depth++);
+          if (current === receiver) return true;
+        }
+        return false;
       }
-    }
-    throw new TypeError("Cannot convert object to primitive value");
-  } finally {
-    leaveCall();
+    })
+  };
+  for (const [name, method] of Object.entries(prototypeMethods)) {
+    Object.defineProperty(prototype, name, { value: method, writable: true, configurable: true });
   }
+  markDescriptorObject(prototype);
+  installObjectPrototype(budget, prototype, constructor);
+  return constructor;
 }
-async function defaultToString(value, budget, context, joining) {
-  if (isSandboxDate(value)) return budget.allocateString(dateString(value));
-  if (Array.isArray(value) || isFloat32Array(value)) {
-    if (Object.hasOwn(value, "join")) {
-      const join = ownDataValue(value, "join");
-      if (!isSandboxClosure(join))
-        return isFloat32Array(value) ? "[object Float32Array]" : "[object Array]";
-      if (context?.invokeClosure === void 0) {
-        throw new TypeError("String hooks require a sandbox call context.");
-      }
-      return context.invokeClosure(join, [], value);
-    }
-    if (joining.has(value)) return "";
-    joining.add(value);
-    try {
-      const length = isFloat32Array(value) ? float32Storage(value).length : value.length;
-      let text = "";
-      for (let index = 0; index < length; index++) {
-        budget.visitNode();
-        const element = ownDataValue(value, String(index));
-        const part = element === null || element === void 0 ? "" : await sandboxString(element, budget, context, joining);
-        text = budget.allocateString(text + (index === 0 ? "" : ",") + part);
-      }
-      return text;
-    } finally {
-      joining.delete(value);
-    }
-  }
-  if (sandboxErrorTypes.has(value)) {
-    const nameValue = ownDataValue(value, "name");
-    const name = nameValue === void 0 ? "Error" : await sandboxString(nameValue, budget, context, joining);
-    const messageValue = ownDataValue(value, "message");
-    const message = messageValue === void 0 ? "" : await sandboxString(messageValue, budget, context, joining);
-    return name === "" ? message : message === "" ? name : `${name}: ${message}`;
-  }
-  return isSandboxPromise(value) ? "[object Promise]" : "[object Object]";
+function requireReceiver(value) {
+  if (value === null || value === void 0)
+    throw new TypeError("Object method requires a non-null receiver.");
+  return value;
 }
-function ownDataValue(value, name) {
-  const descriptor = Object.getOwnPropertyDescriptor(value, name);
-  if (descriptor !== void 0 && !Object.hasOwn(descriptor, "value")) {
-    throw new TypeError("String conversion requires sandbox data properties.");
-  }
-  return descriptor?.value;
+function hasOwnSandboxProperty(value, key, enumerable) {
+  requireReceiver(value);
+  if (isGuestHostObject(value)) return hasHostObjectMember(value, key, enumerable);
+  let properties;
+  if (isGuestClosure(value)) properties = materializeFunctionProperties(value);
+  else if (isSandboxClosure(value)) {
+    if (key === "length" || key === "name") return !enumerable;
+    properties = value.properties ?? /* @__PURE__ */ Object.create(null);
+  } else if (isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxGenerator(value))
+    return false;
+  else if (isSandboxRegex(value)) return key === "lastIndex" && !enumerable;
+  else properties = Object(value);
+  const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+  return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
+}
+function typeTag(value) {
+  if (value === void 0) return "Undefined";
+  if (value === null) return "Null";
+  if (typeof value === "string") return "String";
+  if (typeof value === "number") return "Number";
+  if (typeof value === "boolean") return "Boolean";
+  if (isSandboxClosure(value)) {
+    while (value.boundTarget !== void 0) value = value.boundTarget;
+    return value.generator ? "GeneratorFunction" : value.async ? "AsyncFunction" : "Function";
+  }
+  if (Array.isArray(value)) return "Array";
+  if (isSandboxDate(value)) return "Date";
+  if (isSandboxErrorConstructorInstance(value, "Error")) return "Error";
+  if (isSandboxRegex(value)) return "RegExp";
+  if (isSandboxMap(value)) return "Map";
+  if (isSandboxSet(value)) return "Set";
+  if (isSandboxPromise(value)) return "Promise";
+  if (isSandboxGenerator(value)) return "Generator";
+  if (isFloat32Array(value)) return "Float32Array";
+  return "Object";
 }
 
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
-    Object: {
+    Object: createObjectGlobal({
       keys: createSandboxClosure({
         sandbox: true,
         call: ([value]) => budgetSandboxValue2(getOwnEnumerableKeys(value), options.budget),
@@ -29848,7 +30184,11 @@ function createObjectArrayGlobals(options) {
       }),
       hasOwn: createSandboxClosure({
         sandbox: true,
-        call: ([value, key]) => Reflect.apply(Object.hasOwn, Object, [isSandboxClosure(value) ? objectProperties(value) : value, key]),
+        call: ([value, key], context) => {
+          if (value === null || value === void 0) throw new TypeError("Cannot convert undefined or null to object.");
+          const name = sandboxString(key, options.budget, context);
+          return typeof name === "string" ? hasOwnSandboxProperty(value, name, false) : name.then((property) => hasOwnSandboxProperty(value, property, false));
+        },
         name: "hasOwn"
       }),
       getOwnPropertyDescriptor: createSandboxClosure({
@@ -29889,7 +30229,7 @@ function createObjectArrayGlobals(options) {
         call: ([value]) => {
           if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
           objectProperties(value);
-          return getSandboxPrototype(value);
+          return getSandboxPrototype(value, options.budget);
         },
         name: "getPrototypeOf"
       }),
@@ -29947,6 +30287,7 @@ function createObjectArrayGlobals(options) {
       freeze: createSandboxClosure({
         sandbox: true,
         call: ([value]) => {
+          if (isGuestHostObject(value)) throw new TypeError("Live host objects cannot be frozen.");
           if (typeof value === "object" && value !== null) {
             Object.freeze(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
           }
@@ -29964,7 +30305,7 @@ function createObjectArrayGlobals(options) {
         call: ([target, ...sources]) => assignSandboxValues(target, sources, options.budget),
         name: "assign"
       })
-    },
+    }, options.budget),
     Array: createSandboxClosure({
       sandbox: true,
       call: (args) => createArrayFromConstructorArgs(args, options.budget),
@@ -30161,6 +30502,21 @@ function isAssignableSandboxTarget(value) {
 async function arrayFromSandboxValues(args, budget) {
   const [items, mapFn, thisValue] = args;
   const iterator = getSandboxIterator(items);
+  if (isGuestHostObject(items) && iterator !== void 0) {
+    if (mapFn !== void 0 && !isSandboxClosure(mapFn))
+      throw new TypeError("Array.from mapping callback must be a function.");
+    const values2 = [];
+    while (true) {
+      const next = await iterator.next();
+      if (next.done) break;
+      budget.allocateArrayLength(values2.length + 1);
+      const value = mapFn === void 0 ? next.value : await mapFn.call([next.value, values2.length], { stack: [], thisValue });
+      if (isSandboxPromise(value) && value.synchronousPrefix !== void 0)
+        await value.synchronousPrefix;
+      values2.push(value);
+    }
+    return allocateProducedSandboxValue(values2, budget);
+  }
   const values = iterator === void 0 ? Reflect.apply(Array.from, Array, [items]) : await collectIteratorValues(iterator);
   if (mapFn === void 0 || !isSandboxClosure(mapFn)) {
     if (mapFn !== void 0) {
@@ -30419,7 +30775,7 @@ var RealmState = class {
         throw new TypeError("Realm limits must be positive safe integers with supported names.");
       this.limits[name] = Number(value);
     }
-    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types4.isProxy(options.extensions)))
+    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types5.isProxy(options.extensions)))
       throw new TypeError("Extensions must be a registration array.");
     const registrations = options.extensions ?? [];
     const extensions = [];
@@ -30491,6 +30847,7 @@ var RealmState = class {
       this.budget.setRetainedValues(this, this.retainedRoots);
       this.tracker.onFatalRejection((error) => this.poison(error));
     } catch (error) {
+      releaseObjectPrototype(this.budget);
       this.compilation.dispose();
       this.lease.release();
       throw error;
@@ -30638,7 +30995,7 @@ var RealmState = class {
     return this.phase.run(phase, () => {
       try {
         const result = call();
-        if (types4.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+        if (types5.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
           return Promise.resolve(result).then(
             async (value) => {
               await Promise.allSettled(phase.pending);
@@ -30693,17 +31050,26 @@ var RealmState = class {
       owner: this,
       assertActive: this.assertOpen,
       chargeWork: this.chargeWork,
-      read: (operation) => {
+      checkLength: (length) => this.budget.allocateArrayLength(length),
+      checkTemporaryDataSize: (size) => {
+        const temporary = {};
+        try {
+          this.budget.setRetainedDataUsage(temporary, size);
+        } finally {
+          this.budget.setRetainedDataUsage(temporary, 0);
+        }
+      },
+      read: (operation, validate) => {
         const value = this.invokeHost(operation, operation);
-        if (types4.isPromise(value)) {
+        if (types5.isPromise(value)) {
           void Promise.resolve(value).catch(() => void 0);
           throw new TypeError("Live property getters must be synchronous.");
         }
-        return this.importValue(value);
+        return this.importValue(validate === void 0 ? value : validate(value));
       },
       write: (operation, value) => {
         const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
-        if (types4.isPromise(result)) {
+        if (types5.isPromise(result)) {
           void Promise.resolve(result).catch(() => void 0);
           throw new TypeError("Live property setters must be synchronous.");
         }
@@ -30896,7 +31262,7 @@ var RealmState = class {
         }
       });
       const output = getExtensionSetup(extension)(context);
-      if (types4.isPromise(output)) {
+      if (types5.isPromise(output)) {
         void Promise.resolve(output).catch(() => void 0);
         throw new TypeError("Extension setup must be synchronous.");
       }
@@ -31057,6 +31423,7 @@ var RealmState = class {
     for (const reference of this.guestReferences.keys()) revokeGuestReference(reference, this);
     this.guestReferences.clear();
     this.budget.setRetainedValues(this, void 0);
+    releaseObjectPrototype(this.budget);
     this.disposal = (async () => {
       const errors = [];
       for (const cleanup of this.cleanups.splice(0).reverse()) {
@@ -31083,7 +31450,7 @@ var RealmState = class {
 };
 function readModules(input) {
   const entries = (value, label) => {
-    if (types4.isMap(value) && !types4.isProxy(value)) {
+    if (types5.isMap(value) && !types5.isProxy(value)) {
       const result = [...Map.prototype.entries.call(value)];
       if (result.length > 4096 || result.some(([key]) => typeof key !== "string" || key.length === 0))
         throw new TypeError(`${label} requires bounded string keys.`);
@@ -32065,6 +32432,7 @@ function run(source, options = {}) {
         }
       });
     } finally {
+      releaseObjectPrototype(budget);
       compilation.dispose();
       operation.release();
     }
@@ -32307,4 +32675,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-BWVASPJX.js.map
+//# sourceMappingURL=chunk-MO3YD4ID.js.map