poe-code 14.0.72 → 14.0.73

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-VYUHL33E.js";
+} from "./chunks/chunk-I2Z37MKZ.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-6UY4Z7WY.js";
+} from "./chunks/chunk-XKCTB5FR.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-6UY4Z7WY.js";
+} from "./chunks/chunk-XKCTB5FR.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/graph-depth.js

@@ -4,6 +4,7 @@ import { getSandboxArgumentEntries, isSandboxArguments } from "./interp/argument
 import { collectionIteratorState, isSandboxCollectionIterator } from "./interp/collection-iterator.js";
 import { isSandboxMap, isSandboxSet } from "./interp/collection-brands.js";
 import { boxedDataProperties, isSandboxBox } from "./interp/boxed.js";
+import { regexGuestProperties } from "./interp/regexp-properties.js";
 export const MAX_DATA_DEPTH = 1_024;
 export class SnapshotBudgetError extends Error {
     code = "budgetExceeded";
@@ -64,6 +65,12 @@ function walkGraphDepth(root, rootPath, assertDepth) {
     }
 }
 function graphEntries(value) {
+    const properties = regexGuestProperties.get(value);
+    if (properties !== undefined)
+        return Reflect.ownKeys(properties).flatMap(key => {
+            const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+            return "value" in descriptor ? [[`.${String(key)}`, descriptor.value]] : [];
+        });
     if (isSandboxBox(value))
         return boxedDataProperties(value).map(([key, descriptor]) => [`.${key}`, descriptor.value]);
     if (isSandboxArguments(value)) {

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-VYUHL33E.js";
+} from "./chunks/chunk-I2Z37MKZ.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-6UY4Z7WY.js";
+} from "./chunks/chunk-XKCTB5FR.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/globals/object-array.js

@@ -17,7 +17,7 @@ import { toPropertyKey } from "../property-key.js";
 import { createNumericParsers } from "./numeric-parsers.js";
 import { createPrimitiveConstructor } from "./primitives.js";
 import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
-import { allocateProducedSandboxValue, createSandboxClosure, deepCopyToSandbox, defineOwnDataProperty, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, measureSandboxData, ownEnumerableSandboxKeys as getOwnEnumerableKeys, ownSandboxSymbolKeys, ownEnumerableSandboxEntries as getDirectEntries } from "../values.js";
+import { allocateProducedSandboxValue, createSandboxClosure, deepCopyToSandbox, defineOwnDataProperty, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet, measureSandboxData, ownEnumerableSandboxKeys as getOwnEnumerableKeys, ownSandboxSymbolKeys, ownEnumerableSandboxEntries as getDirectEntries } from "../values.js";
 export function createObjectArrayGlobals(options) {
     return {
         Object: createObjectGlobal({
@@ -171,14 +171,14 @@ export function createObjectArrayGlobals(options) {
                 call: ([value]) => {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be made non-extensible.");
-                    Object.preventExtensions(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
+                    Object.preventExtensions(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value);
                     return value;
                 },
                 name: "preventExtensions"
             }),
             isExtensible: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : value),
+                call: ([value]) => Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value),
                 name: "isExtensible"
             }),
             seal: createSandboxClosure({
@@ -186,14 +186,14 @@ export function createObjectArrayGlobals(options) {
                 call: ([value]) => {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be sealed.");
-                    Object.seal(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
+                    Object.seal(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value);
                     return value;
                 },
                 name: "seal"
             }),
             isSealed: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isSealed(isGuestClosure(value) ? materializeFunctionProperties(value) : value),
+                call: ([value]) => Object.isSealed(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value),
                 name: "isSealed"
             }),
             freeze: createSandboxClosure({
@@ -202,7 +202,7 @@ export function createObjectArrayGlobals(options) {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be frozen.");
                     if (typeof value === "object" && value !== null) {
-                        Object.freeze(isGuestClosure(value) ? materializeFunctionProperties(value) : value);
+                        Object.freeze(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value);
                     }
                     return value;
                 },
@@ -210,7 +210,7 @@ export function createObjectArrayGlobals(options) {
             }),
             isFrozen: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isFrozen(isGuestClosure(value) ? materializeFunctionProperties(value) : value),
+                call: ([value]) => Object.isFrozen(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value),
                 name: "isFrozen"
             }),
             assign: createSandboxClosure({
@@ -425,6 +425,8 @@ function assignSandboxValues(target, sources, budget, context) {
     })();
 }
 function objectProperties(value, mutable = false) {
+    if (isSandboxRegex(value))
+        return getRegexProperties(value);
     if (isSandboxDate(value)) {
         return value;
     }

package/packages/safe-js/dist/interp/globals/object.js

@@ -9,7 +9,7 @@ import { hasHostObjectMember, isGuestHostObject } from "../host-capabilities.js"
 import { collectionIteratorState, isSandboxCollectionIterator } from "../collection-iterator.js";
 import { getSandboxPrototype, getSandboxPropertyDescriptor, hasExplicitSandboxPrototype, installObjectPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
 import { toPropertyKey } from "../property-key.js";
-import { createSandboxClosure, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "../values.js";
+import { createSandboxClosure, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet } from "../values.js";
 import { measureSandboxData } from "../values.js";
 export function createObjectGlobal(methods, budget) {
     const construct = ([value]) => {
@@ -138,7 +138,7 @@ export function hasOwnSandboxProperty(value, key, enumerable) {
         isSandboxGenerator(value))
         return false;
     else if (isSandboxRegex(value))
-        return key === "lastIndex" && !enumerable;
+        properties = getRegexProperties(value);
     else
         properties = Object(value);
     const descriptor = Object.getOwnPropertyDescriptor(properties, key);

package/packages/safe-js/dist/interp/interpreter.js

@@ -26,7 +26,7 @@ import { getPromiseMember, isSandboxPromiseConstructor } from "./promise.js";
 import { acquireSandboxIterator, closeIterator, readIteratorResult } from "./iteration.js";
 import { assertCollectionMutable } from "./running-state.js";
 import { getGeneratorMember } from "./methods/generator.js";
-import { getRegexMember, isRegexMethodName, setRegexMember } from "./methods/regex.js";
+import { getRegexMember, setRegexMember } from "./methods/regex.js";
 import { bindPattern } from "./patterns.js";
 import { callStringMethod, getStringMember, isStringMethodName, validateStringMethodArguments } from "./methods/string.js";
 import { callSetMethod, getSetMember, isSetMethodName } from "./methods/set.js";
@@ -39,7 +39,7 @@ import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from ".
 import { isFloat32Array } from "./float32.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
 import { getDateMember, getDatePrototype, isDateConstructor } from "./globals/date.js";
-import { createSandboxRegex, allocateProducedSandboxValue, ownEnumerableSandboxKeys, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet, reconcileCompiledValues } from "./values.js";
+import { createSandboxRegex, allocateProducedSandboxValue, ownEnumerableSandboxKeys, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet, reconcileCompiledValues } from "./values.js";
 import { Scope } from "./scope.js";
 import { hoistVarDeclarations } from "./var-hoist.js";
 const taggedTemplateRawArrays = new WeakMap();
@@ -1772,7 +1772,7 @@ async function evaluateDeleteExpression(node, context) {
             }
             throw new TypeError("Cannot delete properties of null or undefined.");
         }
-        if (!isIndexableSandboxValue(member.object)) {
+        if (!isIndexableSandboxValue(member.object) && !isSandboxRegex(member.object)) {
             throw new TypeError("Unary operator 'delete' requires a sandbox object property.");
         }
         const property = await toPropertyKey(member.property, context.budget, createCoercionContext(context));
@@ -2132,8 +2132,8 @@ async function evaluateMemberCallExpression(node, context) {
         if (isSandboxPromise(member.object)) {
             return evaluateResolvedCallExpression(node, getPromiseMember(member.property, context.budget), context, member.object);
         }
-        if (isSandboxRegex(member.object) && isRegexMethodName(member.property)) {
-            return evaluateResolvedCallExpression(node, getRegexMember(member.object, member.property, context.budget), context, member.object);
+        if (isSandboxRegex(member.object)) {
+            return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (!isIndexableSandboxValue(member.object)) {
             throw new TypeError("Attempted to read a property from a non-object value.");
@@ -2646,8 +2646,6 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
         return;
     }
     if (isSandboxRegex(target)) {
-        if (typeof property === "symbol")
-            throw new TypeError("RegExp symbol properties are not yet supported.");
         setRegexMember(target, property, value);
         return;
     }
@@ -2714,6 +2712,8 @@ function deleteSandboxProperty(target, property) {
         return deleteHostObjectMember(target, String(property));
     if (isGuestClosure(target))
         target = materializeFunctionProperties(target);
+    if (isSandboxRegex(target))
+        target = getRegexProperties(target);
     if (Array.isArray(target)) {
         assertCollectionMutable(target);
     }

package/packages/safe-js/dist/interp/methods/regex.d.ts

@@ -4,7 +4,7 @@ import type { Budget } from "../budget.js";
 export type RegexMethodName = "exec" | "test";
 export declare function isRegexMethodName(property: string | number): property is RegexMethodName;
 export declare function getRegexMember(target: SandboxRegex, property: string | number, budget: Budget): SandboxValue | undefined;
-export declare function setRegexMember(target: SandboxRegex, property: string | number, value: SandboxValue): void;
+export declare function setRegexMember(target: SandboxRegex, property: PropertyKey, value: SandboxValue): void;
 export declare function callRegexMethod(target: SandboxValue, methodName: RegexMethodName, args: readonly SandboxValue[], budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
 export declare function executeRegex(target: SandboxRegex, input: string, lastIndex: number): RegexMatch | null;
 export declare function toMatchArray(match: RegexMatch | null, input: string): SandboxValue;

package/packages/safe-js/dist/interp/methods/regex.js

@@ -1,4 +1,4 @@
-import { createSandboxClosure, getSandboxRegexPattern, isSandboxClosure, isSandboxRegex } from "../values.js";
+import { createSandboxClosure, getSandboxRegexPattern, getRegexProperties, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { matchRegex } from "../regex/engine.js";
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { getSandboxDataProperty } from "../object-model.js";
@@ -67,10 +67,13 @@ function escapeRegexSource(source, budget) {
     return budget === undefined ? text : budget.allocateString(text);
 }
 export function setRegexMember(target, property, value) {
-    if (property !== "lastIndex") {
+    const properties = getRegexProperties(target);
+    if (!Object.hasOwn(properties, property) &&
+        (property === "source" || property === "flags" || Object.hasOwn(regexFlagProperties, property))) {
         throw new TypeError(`RegExp#${String(property)} is not writable.`);
     }
-    target.lastIndex = value;
+    if (!Reflect.set(properties, property, value))
+        throw new TypeError(`RegExp#${String(property)} is not writable.`);
 }
 export async function callRegexMethod(target, methodName, args, budget, context) {
     if (target === null || typeof target !== "object" || (methodName === "exec" && !isSandboxRegex(target))) {

package/packages/safe-js/dist/interp/methods/string.js

@@ -1,9 +1,10 @@
+import { types } from "node:util";
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { normalizeLastIndex } from "../regex/engine.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { retainValues } from "../resources.js";
-import { getSandboxDataProperty } from "../object-model.js";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor } from "../object-model.js";
 import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { executeRegex, toMatchArray } from "./regex.js";
 const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
@@ -91,8 +92,12 @@ export function callStringMethod(value, methodName, args, budget, callClosure =
         : Promise.resolve(sandboxString(value, budget, context)).then(string => callStringMethodBody(string, methodName, args, budget, callClosure, parent, context));
     const symbol = methodName === "match" ? Symbol.match
         : methodName === "search" ? Symbol.search
-            : methodName === "split" ? Symbol.split : undefined;
+            : methodName === "matchAll" ? Symbol.matchAll
+                : methodName === "replace" || methodName === "replaceAll" ? Symbol.replace
+                    : methodName === "split" ? Symbol.split : undefined;
     const pattern = args[0];
+    if (symbol !== undefined && types.isRegExp(pattern))
+        throw new TypeError(`String#${methodName} does not accept unbranded host RegExp values.`);
     if (symbol === undefined || pattern === null || pattern === undefined)
         return fallback();
     const applyHook = (hook) => {
@@ -100,11 +105,37 @@ export function callStringMethod(value, methodName, args, budget, callClosure =
             return fallback();
         if (!isSandboxClosure(hook))
             throw new TypeError(`String#${methodName} symbol hook must be callable.`);
-        return invokeBuiltinClosure(hook, methodName === "split" ? [value, args[1]] : [value], budget, context, pattern);
+        return invokeBuiltinClosure(hook, symbol === Symbol.split || symbol === Symbol.replace ? [value, args[1]] : [value], budget, context, pattern);
     };
-    return context?.getProperty !== undefined
-        ? Promise.resolve(context.getProperty(pattern, symbol)).then(applyHook)
-        : applyHook(getSandboxDataProperty(pattern, symbol, budget));
+    const readProperty = (key) => context?.getProperty !== undefined
+        ? context.getProperty(pattern, key)
+        : key === "flags" && isSandboxRegex(pattern) && getSandboxPropertyDescriptor(pattern, key, budget) === undefined
+            ? pattern.flags : getSandboxDataProperty(pattern, key, budget);
+    const dispatch = () => {
+        const hook = readProperty(symbol);
+        return hook instanceof Promise ? hook.then(applyHook) : applyHook(hook);
+    };
+    if ((methodName === "replaceAll" || methodName === "matchAll") &&
+        (typeof pattern === "object" || typeof pattern === "function")) {
+        const checkFlags = (flags) => {
+            const checkText = (text) => {
+                if (!text.includes("g"))
+                    throw new TypeError(`String#${methodName} requires a global regex.`);
+                return dispatch();
+            };
+            const text = sandboxString(flags, budget, context);
+            return typeof text === "string" ? checkText(text) : text.then(checkText);
+        };
+        const checkMatch = (match) => {
+            if (!(match === undefined ? isSandboxRegex(pattern) : Boolean(match)))
+                return dispatch();
+            const flags = readProperty("flags");
+            return flags instanceof Promise ? flags.then(checkFlags) : checkFlags(flags);
+        };
+        const match = readProperty(Symbol.match);
+        return match instanceof Promise ? match.then(checkMatch) : checkMatch(match);
+    }
+    return dispatch();
 }
 function callStringMethodBody(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
     if (methodName === "concat" && args.some(argument => argument !== null && typeof argument === "object")) {
@@ -153,7 +184,7 @@ function callStringMethodBody(value, methodName, args, budget, callClosure = asy
     const regex = args[0];
     if (isSandboxRegex(regex) && regex.lastIndex !== null && typeof regex.lastIndex === "object" &&
         ((methodName === "match" && !regex.flags.includes("g")) ||
-            (methodName === "matchAll" && regex.flags.includes("g")))) {
+            methodName === "matchAll")) {
         return callStringRegexCursor(value, methodName, regex, budget, parent, context);
     }
     if ((methodName === "match" || methodName === "matchAll" || methodName === "search") && !isSandboxRegex(args[0])) {
@@ -283,15 +314,25 @@ async function callConcat(value, args, budget, context) {
 function callReplaceLikeMethod(value, methodName, args, budget, callClosure, context) {
     const search = args[0];
     const replacement = args[1];
-    if ((!isSandboxRegex(search) && typeof search !== "string") ||
+    const useRegex = isSandboxRegex(search) && getSandboxPropertyDescriptor(search, Symbol.replace, budget) === undefined;
+    if ((!useRegex && typeof search !== "string") ||
         (typeof replacement !== "string" && !isSandboxClosure(replacement))) {
-        throw new TypeError(`String#${methodName} only supports string or regex search values and string or function replacements.`);
+        return (async () => {
+            let normalizedSearch;
+            let normalizedReplacement;
+            const release = retainValues(budget, () => [normalizedSearch, normalizedReplacement]);
+            try {
+                normalizedSearch = useRegex ? search : await sandboxString(search, budget, context);
+                normalizedReplacement = isSandboxClosure(replacement) ? replacement : await sandboxString(replacement, budget, context);
+                return await callReplaceLikeMethod(value, methodName, [normalizedSearch, normalizedReplacement], budget, callClosure, context);
+            }
+            finally {
+                release();
+            }
+        })();
     }
     if (isSandboxRegex(search)) {
-        if (methodName === "replaceAll" && !search.flags.includes("g")) {
-            throw new TypeError("String#replaceAll requires a global regex.");
-        }
-        return replaceRegex(value, search, replacement, methodName === "replaceAll", budget, callClosure, context);
+        return replaceRegex(value, search, replacement, budget, callClosure, context);
     }
     if (typeof replacement === "string") {
         return budget.allocateString(methodName === "replace"
@@ -300,7 +341,7 @@ function callReplaceLikeMethod(value, methodName, args, budget, callClosure, con
     }
     return replaceWithClosure(value, search, replacement, methodName === "replaceAll", budget, callClosure);
 }
-async function replaceRegex(value, regex, replacement, replaceAll, budget, callClosure, context) {
+async function replaceRegex(value, regex, replacement, budget, callClosure, context) {
     if (regex.flags.includes("g"))
         regex.lastIndex = 0;
     const cursor = regex.lastIndex;
@@ -308,7 +349,7 @@ async function replaceRegex(value, regex, replacement, replaceAll, budget, callC
     budget.setRetainedValues(retained, () => [value, regex, cursor, replacement]);
     try {
         const lastIndex = await sandboxNumber(cursor, budget, context);
-        const matches = collectRegexMatches(regex, value, replaceAll || regex.flags.includes("g"), undefined, lastIndex);
+        const matches = collectRegexMatches(regex, value, regex.flags.includes("g"), undefined, lastIndex);
         let result = "";
         let copiedThrough = 0;
         for (const match of matches) {
@@ -484,8 +525,6 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
             regex.lastIndex = lastIndex;
         return match?.index ?? -1;
     }
-    if (methodName === "matchAll" && !regex.flags.includes("g"))
-        throw new TypeError("String#matchAll requires a global regex.");
     if (methodName === "match" && !regex.flags.includes("g"))
         return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value);
     if (methodName === "match")
@@ -493,7 +532,7 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
     const matcher = methodName === "matchAll"
         ? createSandboxRegex(regex.source, regex.flags, normalizeLastIndex(lastIndex ?? Number(regex.lastIndex)), compilation)
         : regex;
-    const matches = collectRegexMatches(matcher, value, true, compilation.owner?.budget, Number(matcher.lastIndex));
+    const matches = collectRegexMatches(matcher, value, matcher.flags.includes("g"), compilation.owner?.budget, Number(matcher.lastIndex));
     if (methodName === "match" && matches.length === 0)
         return null;
     return methodName === "match"

package/packages/safe-js/dist/interp/object-model.js

@@ -3,7 +3,7 @@ import { isSandboxDate } from "./date.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
-import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "./values.js";
+import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet } from "./values.js";
 const guestClosures = new WeakSet();
 const functionProperties = new WeakMap();
 const prototypes = new WeakMap();
@@ -160,8 +160,9 @@ export function getSandboxPropertyDescriptor(value, key, budget) {
     let depth = 0;
     while (typeof current === "object" &&
         current !== null &&
-        (Array.isArray(current) || isSandboxDate(current) || isPrototypeRecord(current))) {
-        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
+        (Array.isArray(current) || isSandboxDate(current) || isSandboxRegex(current) || isPrototypeRecord(current))) {
+        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current)
+            : isSandboxRegex(current) ? getRegexProperties(current) : current;
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
         if (descriptor !== undefined)
             return descriptor;
@@ -179,6 +180,8 @@ export function getSandboxDataProperty(value, key, budget) {
     while (typeof current === "object" && current !== null) {
         if (isGuestHostObject(current))
             return typeof key === "symbol" ? undefined : getHostObjectMember(current, String(key));
+        if (isSandboxRegex(current))
+            return Object.getOwnPropertyDescriptor(getRegexProperties(current), key)?.value;
         if (isGuestClosure(current)) {
             const entry = getGuestFunctionProperty(current, key);
             if (entry !== undefined || Object.hasOwn(current.properties ?? {}, key))

package/packages/safe-js/dist/interp/regexp-properties.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxObject, SandboxRegex } from "./values.js";
+export declare const regexGuestProperties: WeakMap<object, SandboxObject>;
+export declare function getRegexProperties(value: SandboxRegex): SandboxObject;

package/packages/safe-js/dist/interp/regexp-properties.js

@@ -0,0 +1,7 @@
+export const regexGuestProperties = new WeakMap();
+export function getRegexProperties(value) {
+    const properties = regexGuestProperties.get(value);
+    if (properties === undefined)
+        throw new TypeError("Invalid sandbox RegExp storage.");
+    return properties;
+}

package/packages/safe-js/dist/interp/values.d.ts

@@ -1,3 +1,4 @@
+export { getRegexProperties } from "./regexp-properties.js";
 import { sandboxMapBrand, sandboxSetBrand } from "./collection-brands.js";
 import { type SandboxCollectionIterator } from "./collection-iterator.js";
 import type { Budget, CompileTicket } from "./budget.js";

package/packages/safe-js/dist/interp/values.js

@@ -1,5 +1,7 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { internalSymbols } from "./internal-symbols.js";
+import { getRegexProperties, regexGuestProperties } from "./regexp-properties.js";
+export { getRegexProperties } from "./regexp-properties.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { isSandboxMap, isSandboxSet, sandboxMapBrand, sandboxSetBrand } from "./collection-brands.js";
 import { collectionIteratorState, isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshotCollectionIterator } from "./collection-iterator.js";
@@ -98,6 +100,8 @@ export function ownEnumerableSandboxEntries(value, excludedKeys) {
     let entries;
     if (isGuestClosure(value))
         entries = Object.entries(value.properties ?? {});
+    else if (isSandboxRegex(value))
+        entries = Object.entries(getRegexProperties(value));
     else if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     else
@@ -111,13 +115,15 @@ export function ownSandboxSymbolKeys(value) {
         return [];
     if (isSandboxClosure(value))
         value = value.properties ?? {};
+    else if (isSandboxRegex(value))
+        value = getRegexProperties(value);
     else if (isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     return Object.getOwnPropertySymbols(Object(value)).filter(key => !internalSymbols.has(key));
 }
 export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
     if (includeSymbols) {
-        const properties = isSandboxClosure(value) ? value.properties ?? {} : Object(value);
+        const properties = isSandboxClosure(value) ? value.properties ?? {} : isSandboxRegex(value) ? getRegexProperties(value) : Object(value);
         return [...ownEnumerableSandboxKeys(value), ...ownSandboxSymbolKeys(value).filter(key => Object.getOwnPropertyDescriptor(properties, key)?.enumerable === true)];
     }
     if (isGuestHostObject(value))
@@ -126,6 +132,8 @@ export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
         throw new TypeError("Cannot convert undefined or null to object.");
     if (isGuestClosure(value))
         return Object.keys(value.properties ?? {});
+    if (isSandboxRegex(value))
+        return Object.keys(getRegexProperties(value));
     if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     return Object.keys(Object(value));
@@ -218,6 +226,32 @@ export function createSandboxRegex(source, flags = "", lastIndex = 0, compilatio
     }
     const pattern = parseRegex(source, flags, compilation, 7 + source.length + flags.length);
     const regex = { kind: "regex", source, flags, lastIndex };
+    const storage = Object.create(null);
+    Object.defineProperty(storage, "lastIndex", { value: lastIndex, writable: true });
+    const syncCursor = () => {
+        const descriptor = Object.getOwnPropertyDescriptor(regex, "lastIndex");
+        Object.defineProperty(storage, "lastIndex", { value: descriptor.value, writable: descriptor.writable });
+    };
+    const properties = new Proxy(storage, {
+        get: (target, key, receiver) => key === "lastIndex" ? regex.lastIndex : Reflect.get(target, key, receiver),
+        set: (target, key, value, receiver) => key === "lastIndex"
+            ? Reflect.set(regex, key, value) : Reflect.set(target, key, value, receiver),
+        getOwnPropertyDescriptor(target, key) {
+            if (key === "lastIndex")
+                syncCursor();
+            return Object.getOwnPropertyDescriptor(target, key);
+        },
+        defineProperty(target, key, descriptor) {
+            if (key !== "lastIndex")
+                return Reflect.defineProperty(target, key, descriptor);
+            syncCursor();
+            if (!Reflect.defineProperty(target, key, descriptor))
+                return false;
+            const cursor = Object.getOwnPropertyDescriptor(target, key);
+            return Reflect.defineProperty(regex, key, { value: cursor.value, writable: cursor.writable });
+        }
+    });
+    regexGuestProperties.set(regex, properties);
     Object.defineProperties(regex, {
         [sandboxRegexBrand]: { value: true },
         [sandboxRegexPattern]: { value: pattern }
@@ -424,6 +458,19 @@ export function measureSandboxData(values, options = {}) {
             if (compiled.ticket !== undefined)
                 options.compileTickets?.add(compiled.ticket);
             visit(lastIndex, depth + 1);
+            for (const key of Reflect.ownKeys(getRegexProperties(value))) {
+                if (key === "lastIndex")
+                    continue;
+                const descriptor = Object.getOwnPropertyDescriptor(getRegexProperties(value), key);
+                usage += 1 + (typeof key === "string" ? key.length : 0);
+                if (typeof key === "symbol")
+                    visit(key, depth + 1);
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+                else
+                    for (const closure of retainedAccessorClosures(descriptor))
+                        visit(closure, depth + 1);
+            }
             return;
         }
         if (isSandboxArguments(value)) {
@@ -491,7 +538,7 @@ function captureRegexData(value) {
         typeof flags.value !== "string") {
         throw new TypeError("Invalid sandbox RegExp source or flags: expected own string data properties.");
     }
-    const cursor = Object.getOwnPropertyDescriptor(value, "lastIndex");
+    const cursor = Object.getOwnPropertyDescriptor(regexGuestProperties.get(value) ?? value, "lastIndex");
     if (cursor === undefined || !("value" in cursor)) {
         throw new TypeError("Invalid sandbox RegExp lastIndex: expected an own data property.");
     }
@@ -519,6 +566,21 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         state.seen.set(value, copy);
         if (!state.resetRegexLastIndex)
             copy.lastIndex = copyToSandbox(value.lastIndex, state, `${path}.lastIndex`, true, depth + 1);
+        if (!state.structuredClone) {
+            const properties = getRegexProperties(value);
+            for (const key of Reflect.ownKeys(properties)) {
+                const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+                if (!("value" in descriptor))
+                    throw new TypeError("RegExp accessor properties cannot be copied as data.");
+                Object.defineProperty(getRegexProperties(copy), key, {
+                    ...descriptor,
+                    value: key === "lastIndex" && state.resetRegexLastIndex ? 0
+                        : copyToSandbox(descriptor.value, state, `${path}.${String(key)}`, true, depth + 1)
+                });
+            }
+            if (!Object.isExtensible(properties))
+                Object.preventExtensions(getRegexProperties(copy));
+        }
         return copy;
     }
     if (isSandboxClosure(value) ||
@@ -745,6 +807,18 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             const regex = new RegExp(source, flags);
             state.seen.set(value, regex);
             Reflect.set(regex, "lastIndex", copyFromSandbox(lastIndex, state, `${path}.lastIndex`, options, depth + 1));
+            const properties = regexGuestProperties.get(value);
+            if (properties !== undefined) {
+                for (const key of Reflect.ownKeys(properties)) {
+                    const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+                    if (!("value" in descriptor))
+                        throw new TypeError("RegExp accessor properties cannot be copied as data.");
+                    Object.defineProperty(regex, key, { ...descriptor,
+                        value: copyFromSandbox(descriptor.value, state, `${path}.${String(key)}`, options, depth + 1) });
+                }
+                if (!Object.isExtensible(properties))
+                    Object.preventExtensions(regex);
+            }
             guard.retainScratch();
             return regex;
         }