poe-code 14.0.7 → 14.0.9

package/packages/safe-js/dist/interp/host-capabilities.js

@@ -1,4 +1,8 @@
 import { readDataRecord } from "../extensions.js";
+import { types } from "node:util";
+const MAX_INDEXED_LENGTH = 65_536;
+const MAX_NAMED_KEYS = 65_536;
+const MAX_NAMED_KEY_CODE_UNITS = 1_048_576;
 const hostObjects = new WeakMap();
 const guestObjects = new WeakMap();
 const guestCallbacks = new WeakMap();
@@ -27,8 +31,53 @@ export function revokeGuestReference(reference, owner) {
 }
 export function createLiveHostObject(definition, controller) {
     const input = readDataRecord(definition, "Host object definition");
-    if (Object.keys(input).some((key) => key !== "properties" && key !== "methods"))
+    if (Object.keys(input).some((key) => !["properties", "methods", "indexed", "named"].includes(key)))
         throw new TypeError("Unknown host object definition field.");
+    let indexed;
+    if (input.indexed !== undefined) {
+        const data = readDataRecord(input.indexed, "Indexed host capability");
+        if (Object.keys(data).some((key) => !["length", "get", "maxLength"].includes(key)))
+            throw new TypeError("Unknown indexed host capability field.");
+        if (typeof data.length !== "function" || typeof data.get !== "function")
+            throw new TypeError("Indexed length and get must be synchronous functions.");
+        if (typeof data.maxLength !== "number" ||
+            !Number.isInteger(data.maxLength) ||
+            data.maxLength < 1 ||
+            data.maxLength > MAX_INDEXED_LENGTH)
+            throw new RangeError(`Indexed maxLength must be an integer from 1 to ${MAX_INDEXED_LENGTH}.`);
+        indexed = {
+            length: data.length,
+            get: data.get,
+            maxLength: data.maxLength
+        };
+    }
+    let named;
+    if (input.named !== undefined) {
+        const data = readDataRecord(input.named, "Named host capability");
+        if (Object.keys(data).some((key) => !["keys", "get", "maxKeys", "maxKeyCodeUnits", "enumerable"].includes(key)))
+            throw new TypeError("Unknown named host capability field.");
+        if (typeof data.keys !== "function" || typeof data.get !== "function")
+            throw new TypeError("Named keys and get must be synchronous functions.");
+        if (typeof data.maxKeys !== "number" ||
+            !Number.isInteger(data.maxKeys) ||
+            data.maxKeys < 1 ||
+            data.maxKeys > MAX_NAMED_KEYS)
+            throw new RangeError(`Named maxKeys must be an integer from 1 to ${MAX_NAMED_KEYS}.`);
+        if (typeof data.maxKeyCodeUnits !== "number" ||
+            !Number.isInteger(data.maxKeyCodeUnits) ||
+            data.maxKeyCodeUnits < 1 ||
+            data.maxKeyCodeUnits > MAX_NAMED_KEY_CODE_UNITS)
+            throw new RangeError(`Named maxKeyCodeUnits must be an integer from 1 to ${MAX_NAMED_KEY_CODE_UNITS}.`);
+        if (data.enumerable !== undefined && typeof data.enumerable !== "boolean")
+            throw new TypeError("Named enumerable must be a boolean.");
+        named = {
+            keys: data.keys,
+            get: data.get,
+            maxKeys: data.maxKeys,
+            maxKeyCodeUnits: data.maxKeyCodeUnits,
+            enumerable: data.enumerable
+        };
+    }
     const properties = new Map();
     for (const [name, inputProperty] of Object.entries(readDataRecord(input.properties ?? {}, "Host properties"))) {
         const property = readDataRecord(inputProperty, `Host property '${name}'`);
@@ -49,6 +98,8 @@ export function createLiveHostObject(definition, controller) {
     for (const name of [...properties.keys(), ...Object.keys(operations)]) {
         if (["constructor", "prototype", "__proto__"].includes(name))
             throw new TypeError(`Reserved host member '${name}'.`);
+        if (indexed !== undefined && (name === "length" || canonicalIndex(name) !== undefined))
+            throw new TypeError(`Conflicting indexed host member '${name}'.`);
     }
     controller.assertActive();
     controller.chargeWork(properties.size + Object.keys(operations).length + 1);
@@ -58,7 +109,7 @@ export function createLiveHostObject(definition, controller) {
         name,
         controller.method(operation)
     ]));
-    const state = { host, guest, controller, properties, methods };
+    const state = { host, guest, controller, properties, methods, indexed, named };
     hostObjects.set(host, state);
     guestObjects.set(guest, state);
     return host;
@@ -125,15 +176,32 @@ export function revokeHostObject(value, owner) {
         throw new TypeError("Foreign host object.");
     state.properties.clear();
     state.methods.clear();
+    state.indexed = undefined;
+    state.named = undefined;
 }
 export function getHostObjectMember(value, key) {
     const state = guestObjects.get(value);
     state.controller.assertActive();
     state.controller.chargeWork();
+    if (state.indexed !== undefined) {
+        if (key === "length")
+            return indexedLength(state);
+        const index = canonicalIndex(key);
+        if (index !== undefined) {
+            if (index >= state.indexed.maxLength || index >= indexedLength(state))
+                return undefined;
+            return state.controller.read(() => state.indexed.get(index));
+        }
+    }
     const property = state.properties.get(key);
     if (property !== undefined)
         return property.get === undefined ? undefined : state.controller.read(property.get);
-    return state.methods.get(key);
+    const method = state.methods.get(key);
+    if (method !== undefined)
+        return method;
+    if (state.named !== undefined && namedKeys(state).includes(key))
+        return state.controller.read(() => state.named.get(key));
+    return undefined;
 }
 export function setHostObjectMember(value, key, entry) {
     const state = guestObjects.get(value);
@@ -147,5 +215,124 @@ export function setHostObjectMember(value, key, entry) {
 export function getHostObjectKeys(value) {
     const state = guestObjects.get(value);
     state.controller.assertActive();
-    return [...state.properties.keys(), ...state.methods.keys()];
+    const length = state.indexed === undefined ? 0 : indexedLength(state);
+    const names = state.named === undefined || state.named.enumerable === false
+        ? []
+        : namedKeys(state).filter((key) => !state.properties.has(key) &&
+            !state.methods.has(key) &&
+            !(state.indexed !== undefined &&
+                (key === "length" || canonicalIndex(key) !== undefined)));
+    const size = length + state.properties.size + state.methods.size + names.length;
+    state.controller.checkLength(size);
+    state.controller.chargeWork(size + 1);
+    return [
+        ...Array.from({ length }, (_entry, index) => String(index)),
+        ...state.properties.keys(),
+        ...state.methods.keys(),
+        ...names
+    ];
+}
+export function hasHostObjectMember(value, key, enumerableOnly = false) {
+    const state = guestObjects.get(value);
+    state.controller.assertActive();
+    state.controller.chargeWork();
+    if (state.indexed !== undefined) {
+        if (key === "length")
+            return !enumerableOnly;
+        const index = canonicalIndex(key);
+        if (index !== undefined)
+            return index < state.indexed.maxLength && index < indexedLength(state);
+    }
+    if (state.properties.has(key) || state.methods.has(key))
+        return true;
+    return (state.named !== undefined &&
+        !(enumerableOnly && state.named.enumerable === false) &&
+        namedKeys(state).includes(key));
+}
+export function measureHostObjectData(value) {
+    const state = guestObjects.get(value);
+    let size = state.indexed === undefined ? 0 : 16;
+    if (state.named !== undefined)
+        size += 24;
+    for (const key of state.properties.keys())
+        size += key.length + 1;
+    for (const key of state.methods.keys())
+        size += key.length + 1;
+    return size;
+}
+export function getHostObjectIterator(value) {
+    const state = guestObjects.get(value);
+    state.controller.assertActive();
+    if (state.indexed === undefined)
+        return undefined;
+    let index = 0;
+    let exhausted = false;
+    return {
+        next: () => {
+            state.controller.assertActive();
+            state.controller.chargeWork();
+            if (exhausted)
+                return { done: true, value: undefined };
+            if (index >= indexedLength(state)) {
+                exhausted = true;
+                return { done: true, value: undefined };
+            }
+            const position = index++;
+            return { done: false, value: state.controller.read(() => state.indexed.get(position)) };
+        }
+    };
+}
+function indexedLength(state) {
+    state.controller.chargeWork();
+    const length = state.controller.read(state.indexed.length);
+    if (typeof length !== "number" ||
+        !Number.isInteger(length) ||
+        length < 0 ||
+        length > state.indexed.maxLength)
+        throw new RangeError("Indexed length must be a non-negative integer within maxLength.");
+    state.controller.checkLength(length);
+    return length;
+}
+function canonicalIndex(key) {
+    const index = Number(key);
+    return Number.isInteger(index) && index >= 0 && index < 0xffffffff && String(index) === key
+        ? index
+        : undefined;
+}
+function namedKeys(state) {
+    const named = state.named;
+    return state.controller.read(named.keys, (value) => {
+        if (!Array.isArray(value) || types.isProxy(value))
+            throw new TypeError("Named keys must be a dense own-data array of strings, not a proxy.");
+        const length = Object.getOwnPropertyDescriptor(value, "length").value;
+        if (length > named.maxKeys)
+            throw new RangeError("Named keys exceed maxKeys.");
+        state.controller.checkLength(length);
+        state.controller.chargeWork(length + 1);
+        if (Reflect.ownKeys(value).length !== length + 1)
+            throw new TypeError("Named keys must contain only dense own-data indices and length.");
+        const result = [];
+        const seen = new Set();
+        let units = 0;
+        for (let index = 0; index < length; index++) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+            if (descriptor === undefined ||
+                !("value" in descriptor) ||
+                typeof descriptor.value !== "string")
+                throw new TypeError("Named keys require dense own string data, not accessors or sparse arrays.");
+            const key = descriptor.value;
+            units += key.length;
+            if (units > named.maxKeyCodeUnits)
+                throw new RangeError("Named keys exceed maximum UTF-16 code units.");
+            state.controller.chargeWork(key.length);
+            if (seen.has(key))
+                throw new TypeError("Named keys must be distinct.");
+            if (["constructor", "prototype", "__proto__"].includes(key))
+                throw new TypeError(`Reserved named host member '${key}'.`);
+            seen.add(key);
+            result.push(key);
+        }
+        state.controller.checkTemporaryDataSize(1 + length + units);
+        return result;
+    });
 }

package/packages/safe-js/dist/interp/interpreter.js

@@ -1,5 +1,6 @@
 import { promiseReplayContext } from "./promise-replay.js";
-import { getHostObjectKeys, getHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
+import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, isGuestHostObject, setHostObjectMember } from "./host-capabilities.js";
+import { sandboxString } from "./string-coercion.js";
 import { assertPromiseExecutionAllowed } from "./promise-tracker.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./jobs.js";
 import { withCancellationSignal } from "./cancel.js";
@@ -11,7 +12,7 @@ import { CompileScope, RegexCompileGuard } from "./regex/compile-guard.js";
 import { coerceThrownValue, createCapturedException, evaluateThrowStatement as evaluateThrowStatementResult, evaluateTryStatement as evaluateTryStatementResult, isCapturedException, surfaceThrownValue } from "./exceptions.js";
 import { callArrayMethod, getArrayMember, isArrayMethodName } from "./methods/array.js";
 import { getFunctionMember } from "./methods/function.js";
-import { getGuestFunctionProperty, getSandboxPrototype, isGuestClosure, materializeFunctionProperties } from "./object-model.js";
+import { getGuestFunctionProperty, getSandboxPrototype, isGuestClosure, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { callMapMethod, getMapMember, isMapMethodName } from "./methods/map.js";
 import { callNumberMethod, getNumberMember, isNumberMethodName } from "./methods/number.js";
@@ -325,6 +326,9 @@ async function evaluateObjectExpression(node, context) {
             return value;
         }
         if (isObjectPrototypeSetterProperty(property, key.value)) {
+            if (value.value === null || typeof value.value === "object") {
+                setSandboxPrototype(object, value.value, context.budget);
+            }
             continue;
         }
         defineSandboxProperty(object, String(key.value), value.value);
@@ -433,7 +437,13 @@ async function evaluateBinaryExpression(node, context) {
     if (right.kind !== "normal") {
         return right;
     }
-    const value = applyBinaryOperator(node, left.value, right.value, context);
+    const value = node.operator === "in" && isGuestHostObject(right.value)
+        ? hasHostObjectMember(right.value, await sandboxString(left.value, context.budget, {
+            stack: context.callStack,
+            thisValue: undefined,
+            invokeClosure: (closure, args, thisValue) => invokeSandboxClosure(closure, args, context, context.callStack, undefined, thisValue)
+        }))
+        : applyBinaryOperator(node, left.value, right.value, context);
     return {
         kind: "normal",
         hasValue: true,
@@ -1130,7 +1140,7 @@ function forInKeys(object, budget) {
     const keys = [];
     const seen = new Set();
     let depth = 0;
-    for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+    for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
         if (depth > 0)
             budget.visitNode();
         assertSandboxDataDepth(depth++);
@@ -1149,9 +1159,9 @@ function forInKeys(object, budget) {
 }
 function hasForInProperty(object, key, budget) {
     if (isGuestHostObject(object))
-        return getHostObjectKeys(object).includes(key);
+        return hasHostObjectMember(object, key, true);
     let depth = 0;
-    for (let current = object; current !== null; current = getSandboxPrototype(current)) {
+    for (let current = object; current !== null; current = getSandboxPrototype(current, budget)) {
         if (depth > 0)
             budget.visitNode();
         assertSandboxDataDepth(depth++);
@@ -2099,7 +2109,7 @@ function applyBinaryOperator(node, left, right, context) {
                     throw new TypeError("Function has a non-object prototype in instanceof check.");
                 }
                 let depth = 0;
-                for (let current = getSandboxPrototype(left); current !== null; current = getSandboxPrototype(current)) {
+                for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
                     context.budget.visitNode();
                     assertSandboxDataDepth(depth++);
                     if (current === prototype)
@@ -2323,7 +2333,7 @@ function getMemberValue(target, property, context) {
         }
         if (Object.hasOwn(current, String(property)))
             return current[String(property)];
-        current = getSandboxPrototype(current);
+        current = getSandboxPrototype(current, context.budget);
         if (current !== null) {
             context.budget.visitNode();
             assertSandboxDataDepth(++depth);
@@ -2376,7 +2386,7 @@ export function setSandboxProperty(target, property, value, budget) {
     else {
         if (typeof prototypeOwner === "object" && prototypeOwner !== null) {
             let depth = 0;
-            for (let prototype = getSandboxPrototype(prototypeOwner); prototype !== null; prototype = getSandboxPrototype(prototype)) {
+            for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
                 budget.visitNode();
                 assertSandboxDataDepth(depth++);
                 const properties = isSandboxClosure(prototype) ? prototype.properties : prototype;
@@ -2570,6 +2580,14 @@ async function evaluateObjectSpread(node, context) {
             value: []
         };
     }
+    if (isGuestHostObject(value.value)) {
+        const entries = [];
+        for (const key of getHostObjectKeys(value.value)) {
+            if (hasHostObjectMember(value.value, key, true))
+                entries.push([key, getHostObjectMember(value.value, key)]);
+        }
+        return { ok: true, value: entries };
+    }
     if ((isSandboxClosure(value.value) && !isGuestClosure(value.value)) || isSandboxPromise(value.value)) {
         throw new TypeError(`Cannot spread ${describeObjectSpreadValue(value.value)} into object literal.`);
     }

package/packages/safe-js/dist/interp/iteration.js

@@ -1,7 +1,10 @@
 import { isSandboxGenerator, isSandboxMap, isSandboxSet } from "./values.js";
 import { enterRunningState } from "./running-state.js";
 import { isFloat32Array } from "./float32.js";
+import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 export function getSandboxIterator(value) {
+    if (isGuestHostObject(value))
+        return getHostObjectIterator(value);
     if (isFloat32Array(value)) {
         return syncIterator(Float32Array.prototype.values.call(value));
     }

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -5,7 +5,9 @@ export declare function isGuestClosure(value: unknown): value is SandboxClosure;
 export declare function getGuestFunctionProperties(closure: SandboxClosure): SandboxObject | undefined;
 export declare function materializeFunctionProperties(closure: SandboxClosure): SandboxObject;
 export declare function getGuestFunctionProperty(closure: SandboxClosure, key: string): SandboxValue;
-export declare function getSandboxPrototype(value: object): object | null;
+export declare function installObjectPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
+export declare function releaseObjectPrototype(budget: Budget): void;
+export declare function getSandboxPrototype(value: object, budget?: Budget): object | null;
 export declare function getSandboxDataProperty(value: SandboxValue, key: string | number, budget?: Budget): SandboxValue;
 export declare function setSandboxPrototype(value: object, prototype: object | null, budget?: Budget): void;
 export declare function markDescriptorObject(value: object): void;

package/packages/safe-js/dist/interp/object-model.js

@@ -4,6 +4,8 @@ import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, i
 const guestClosures = new WeakSet();
 const functionProperties = new WeakMap();
 const prototypes = new WeakMap();
+const intrinsicPrototypes = new WeakMap();
+const intrinsicConstructors = new WeakMap();
 const descriptorObjects = new WeakSet();
 export function registerGuestClosure(closure) {
     guestClosures.add(closure);
@@ -56,8 +58,33 @@ export function getGuestFunctionProperty(closure, key) {
         ? undefined
         : Object.getOwnPropertyDescriptor(properties, key)?.value;
 }
-export function getSandboxPrototype(value) {
-    return prototypes.get(value) ?? null;
+export function installObjectPrototype(budget, prototype, constructor) {
+    prototypes.set(prototype, null);
+    intrinsicPrototypes.set(budget, prototype);
+    const records = [prototype, materializeFunctionProperties(constructor)].map(value => ({
+        value, descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+    }));
+    const unchanged = (before, after) => before !== undefined && after !== undefined && before.value === after.value &&
+        before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+    intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+        const current = Object.getOwnPropertyDescriptors(value);
+        return Object.keys(current).length === descriptors.size &&
+            Object.keys(current).every(key => unchanged(descriptors.get(key), current[key]));
+    }));
+    budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])));
+}
+export function releaseObjectPrototype(budget) {
+    const prototype = intrinsicPrototypes.get(budget);
+    if (prototype !== undefined)
+        budget.setRetainedValues(prototype, undefined);
+    intrinsicPrototypes.delete(budget);
+}
+export function getSandboxPrototype(value, budget) {
+    if (prototypes.has(value))
+        return prototypes.get(value) ?? null;
+    return budget !== undefined && isPrototypeRecord(value)
+        ? intrinsicPrototypes.get(budget) ?? null
+        : null;
 }
 export function getSandboxDataProperty(value, key, budget) {
     let current = value;
@@ -81,7 +108,7 @@ export function getSandboxDataProperty(value, key, budget) {
             return undefined;
         if (Object.hasOwn(current, String(key)))
             return current[String(key)];
-        current = getSandboxPrototype(current);
+        current = getSandboxPrototype(current, budget);
         if (current !== null) {
             budget?.visitNode();
             assertSandboxDataDepth(++depth);
@@ -90,25 +117,25 @@ export function getSandboxDataProperty(value, key, budget) {
     return undefined;
 }
 export function setSandboxPrototype(value, prototype, budget) {
+    if (budget !== undefined && intrinsicPrototypes.get(budget) === value && prototype !== null) {
+        throw new TypeError("Object.prototype has an immutable null prototype.");
+    }
     if (!isPrototypeRecord(value) || (prototype !== null && !isPrototypeRecord(prototype))) {
         throw new TypeError("Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported.");
     }
-    if (getSandboxPrototype(value) === prototype)
+    if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype)
         return;
     if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : value)) {
         throw new TypeError("Cannot change the prototype of a non-extensible object.");
     }
     let depth = 0;
-    for (let current = prototype; current !== null; current = getSandboxPrototype(current)) {
+    for (let current = prototype; current !== null; current = getSandboxPrototype(current, budget)) {
         budget?.visitNode();
         assertSandboxDataDepth(depth++);
         if (current === value)
             throw new TypeError("Cyclic prototype value.");
     }
-    if (prototype === null)
-        prototypes.delete(value);
-    else
-        prototypes.set(value, prototype);
+    prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
     if (isGuestHostObject(value))
@@ -130,6 +157,9 @@ export function hasManagedDescriptors(value) {
     return descriptorObjects.has(value);
 }
 export function hasGuestObjectState(value) {
+    const intrinsicUnchanged = intrinsicConstructors.get(value);
+    if (intrinsicUnchanged !== undefined)
+        return !intrinsicUnchanged();
     if (isLiveCapability(value))
         return true;
     if (functionProperties.has(value) || prototypes.has(value))

package/packages/safe-js/dist/interp/values.d.ts

@@ -55,6 +55,7 @@ export type SandboxCallContext = {
 };
 export type SandboxClosure = {
     readonly async?: true;
+    readonly generator?: true;
     readonly sandbox?: true;
     readonly boundTarget?: SandboxClosure;
     readonly cancellationSignal?: AbortSignal;
@@ -92,6 +93,7 @@ type CopyFromSandboxOptions = {
 export declare function createSandboxClosure(input: {
     guest?: boolean;
     async?: boolean;
+    generator?: boolean;
     sandbox?: boolean;
     boundTarget?: SandboxClosure;
     cancellationSignal?: AbortSignal;

package/packages/safe-js/dist/interp/values.js

@@ -1,6 +1,6 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { copyNativeDate, exportDate, isSandboxDate } from "./date.js";
-import { getHostObjectKeys, getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
+import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, measureHostObjectData, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { types as nodeTypes } from "node:util";
 import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
 import { copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
@@ -41,6 +41,8 @@ export function createSandboxClosure(input) {
     if (input.sandbox === true) {
         Object.defineProperty(closure, "sandbox", { value: true });
     }
+    if (input.generator === true)
+        Object.defineProperty(closure, "generator", { value: true });
     if (input.length !== undefined) {
         Object.defineProperty(closure, "length", { value: input.length });
     }
@@ -72,8 +74,14 @@ export function createSandboxClosure(input) {
     return Object.freeze(closure);
 }
 export function ownEnumerableSandboxEntries(value) {
-    if (isGuestHostObject(value))
-        return getHostObjectKeys(value).map(key => [key, getHostObjectMember(value, key)]);
+    if (isGuestHostObject(value)) {
+        const entries = [];
+        for (const key of getHostObjectKeys(value)) {
+            if (hasHostObjectMember(value, key, true))
+                entries.push([key, getHostObjectMember(value, key)]);
+        }
+        return entries;
+    }
     if (value === null || value === undefined)
         throw new TypeError("Cannot convert undefined or null to object.");
     if (isGuestClosure(value))
@@ -231,8 +239,7 @@ export function measureSandboxData(values, options = {}) {
             return;
         }
         if (isGuestHostObject(value)) {
-            for (const key of getHostObjectKeys(value))
-                usage += key.length + 1;
+            usage += measureHostObjectData(value);
             return;
         }
         const prototype = getSandboxPrototype(value);
@@ -346,7 +353,7 @@ export function reconcileCompiledValues(budget, values, compilation, parent, esc
     while (parent?.closed)
         parent = parent.parent;
     const included = new Set();
-    const usage = measureSandboxData(values, { compileTickets: included });
+    const usage = measureSandboxData([...values, ...budget.retainedValues()], { compileTickets: included });
     const kept = new Set();
     if (parent !== undefined)
         measureSandboxData(escaping, { compileTickets: kept });

package/packages/safe-js/dist/realm.js

@@ -3,6 +3,7 @@ import { types } from "node:util";
 import { Budget, SandboxError } from "./interp/budget.js";
 import { CompileScope } from "./interp/regex/compile-guard.js";
 import { createBuiltinBindings } from "./interp/globals.js";
+import { releaseObjectPrototype } from "./interp/object-model.js";
 import { interpret, Scope } from "./interp/interpreter.js";
 import { SandboxJobQueue, runAsyncPrefix, suspendJob } from "./interp/jobs.js";
 import { withCancellationSignal, awaitSandboxValue } from "./interp/cancel.js";
@@ -143,6 +144,7 @@ class RealmState {
             this.tracker.onFatalRejection((error) => this.poison(error));
         }
         catch (error) {
+            releaseObjectPrototype(this.budget);
             this.compilation.dispose();
             this.lease.release();
             throw error;
@@ -310,13 +312,23 @@ class RealmState {
             owner: this,
             assertActive: this.assertOpen,
             chargeWork: this.chargeWork,
-            read: (operation) => {
+            checkLength: (length) => this.budget.allocateArrayLength(length),
+            checkTemporaryDataSize: (size) => {
+                const temporary = {};
+                try {
+                    this.budget.setRetainedDataUsage(temporary, size);
+                }
+                finally {
+                    this.budget.setRetainedDataUsage(temporary, 0);
+                }
+            },
+            read: (operation, validate) => {
                 const value = this.invokeHost(operation, operation);
                 if (types.isPromise(value)) {
                     void Promise.resolve(value).catch(() => undefined);
                     throw new TypeError("Live property getters must be synchronous.");
                 }
-                return this.importValue(value);
+                return this.importValue(validate === undefined ? value : validate(value));
             },
             write: (operation, value) => {
                 const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
@@ -656,6 +668,7 @@ class RealmState {
             revokeGuestReference(reference, this);
         this.guestReferences.clear();
         this.budget.setRetainedValues(this, undefined);
+        releaseObjectPrototype(this.budget);
         this.disposal = (async () => {
             const errors = [];
             for (const cleanup of this.cleanups.splice(0).reverse()) {

package/packages/safe-js/dist/run.js

@@ -14,6 +14,7 @@ import { enterSnapshotRun } from "./interp/running-state.js";
 import { createSandboxPromiseRejectionTracker, observeSandboxPromise, withSandboxPromiseRejectionTracker } from "./interp/promise-tracker.js";
 import { HostCallJournal } from "./interp/host-call.js";
 import { createBuiltinBindings } from "./interp/globals.js";
+import { releaseObjectPrototype } from "./interp/object-model.js";
 import { declareHostOperation, wrapCallerInjectedBindings } from "./interp/host-bridge.js";
 import { interpret, Scope } from "./interp/interpreter.js";
 import { consumeSettledHostCall } from "./interp/promise.js";
@@ -349,6 +350,7 @@ export function run(source, options = {}) {
             });
         }
         finally {
+            releaseObjectPrototype(budget);
             compilation.dispose();
             operation.release();
         }