poe-code 14.0.72 → 14.0.74

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -9,6 +9,8 @@ export declare function getGuestFunctionProperty(closure: SandboxClosure, key: P
 export declare function installObjectPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
 export declare function installBoxedPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure, kind?: BoxedKind): void;
 export declare function getBoxedPrototype(value: BoxedPrimitive, budget: Budget): SandboxObject | undefined;
+export declare function installRegexPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
+export declare function hasRegexPropertyOverride(value: SandboxValue, keys: readonly string[], budget: Budget): boolean;
 export declare function isDefaultBoxedMethod(value: BoxedPrimitive, key: string, budget: Budget): boolean;
 export declare function isIntrinsicConstructor(value: object): boolean;
 export declare function releaseObjectPrototype(budget: Budget): void;

package/packages/safe-js/dist/interp/object-model.js

@@ -3,12 +3,14 @@ import { isSandboxDate } from "./date.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
-import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, isSandboxSet } from "./values.js";
+import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet } from "./values.js";
 const guestClosures = new WeakSet();
 const functionProperties = new WeakMap();
 const prototypes = new WeakMap();
 const intrinsicPrototypes = new WeakMap();
 const boxedPrototypes = new WeakMap();
+const regexPrototypes = new WeakMap();
+const initialRegexDescriptors = new WeakMap();
 const intrinsicPrototypeRoots = new WeakMap();
 const intrinsicConstructors = new WeakMap();
 const initialBoxedMethods = new WeakMap();
@@ -80,6 +82,24 @@ export function installBoxedPrototype(budget, prototype, constructor, kind = typ
 export function getBoxedPrototype(value, budget) {
     return boxedPrototypes.get(budget)?.get(typeof value);
 }
+export function installRegexPrototype(budget, prototype, constructor) {
+    regexPrototypes.set(budget, prototype);
+    initialRegexDescriptors.set(budget, Object.getOwnPropertyDescriptors(prototype));
+    registerIntrinsicPrototype(budget, prototype, constructor);
+}
+export function hasRegexPropertyOverride(value, keys, budget) {
+    const initial = initialRegexDescriptors.get(budget);
+    const prototype = regexPrototypes.get(budget);
+    const defaultPrototype = isSandboxRegex(value) && prototype !== undefined && getSandboxPrototype(value, budget) === prototype;
+    return keys.some(key => {
+        const current = defaultPrototype
+            ? Object.getOwnPropertyDescriptor(getRegexProperties(value), key) ?? Object.getOwnPropertyDescriptor(prototype, key)
+            : getSandboxPropertyDescriptor(value, key, budget);
+        const expected = initial?.[key];
+        return expected === undefined ? current !== undefined : current === undefined ||
+            current.value !== expected.value || current.get !== expected.get || current.set !== expected.set;
+    });
+}
 export function isDefaultBoxedMethod(value, key, budget) {
     const prototype = getBoxedPrototype(value, budget);
     return prototype !== undefined && initialBoxedMethods.get(prototype)?.has(key) === true &&
@@ -93,7 +113,10 @@ function registerIntrinsicPrototype(budget, prototype, constructor) {
     if (roots === undefined)
         intrinsicPrototypeRoots.set(budget, (roots = new Set()));
     roots.add(prototype);
-    const records = [prototype, constructor]
+    const methods = Reflect.ownKeys(prototype)
+        .map(key => Object.getOwnPropertyDescriptor(prototype, key)?.value)
+        .filter(isGuestClosure);
+    const records = [...new Set([prototype, constructor, ...methods])]
         .map((target) => ({
         target,
         value: isGuestClosure(target) ? materializeFunctionProperties(target) : target,
@@ -102,7 +125,7 @@ function registerIntrinsicPrototype(budget, prototype, constructor) {
     }))
         .map((record) => ({
         ...record,
-        descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record.value)))
+        descriptors: new Map(Reflect.ownKeys(record.value).map(key => [key, Object.getOwnPropertyDescriptor(record.value, key)]))
     }));
     const unchanged = (before, after) => before !== undefined &&
         after !== undefined &&
@@ -116,16 +139,19 @@ function registerIntrinsicPrototype(budget, prototype, constructor) {
         const current = Object.getOwnPropertyDescriptors(value);
         return (getSandboxPrototype(target) === parent &&
             hasExplicitSandboxPrototype(target) === explicit &&
-            Object.keys(current).length === descriptors.size &&
-            Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key])));
+            Reflect.ownKeys(current).length === descriptors.size &&
+            Reflect.ownKeys(value).every((key) => unchanged(descriptors.get(key), Object.getOwnPropertyDescriptor(value, key))));
     }));
     budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
         ...(getSandboxPrototype(target) === parent
             ? []
             : [getSandboxPrototype(target)]),
-        ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor)
-            ? []
-            : [key, descriptor.value, ...retainedAccessorClosures(descriptor)])
+        ...Reflect.ownKeys(value).flatMap(key => {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            return unchanged(descriptors.get(key), descriptor)
+                ? []
+                : [key, descriptor.value, ...retainedAccessorClosures(descriptor)];
+        })
     ]));
 }
 export function releaseObjectPrototype(budget) {
@@ -133,11 +159,15 @@ export function releaseObjectPrototype(budget) {
         budget.setRetainedValues(prototype, undefined);
     intrinsicPrototypeRoots.delete(budget);
     boxedPrototypes.delete(budget);
+    regexPrototypes.delete(budget);
+    initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }
 export function getSandboxPrototype(value, budget) {
     if (prototypes.has(value))
         return prototypes.get(value) ?? null;
+    if (budget !== undefined && isSandboxRegex(value))
+        return regexPrototypes.get(budget) ?? null;
     if (budget !== undefined && isSandboxBox(value)) {
         const prototype = getBoxedPrototype(boxedValue(value), budget);
         if (prototype !== undefined && prototype !== value)
@@ -160,8 +190,9 @@ export function getSandboxPropertyDescriptor(value, key, budget) {
     let depth = 0;
     while (typeof current === "object" &&
         current !== null &&
-        (Array.isArray(current) || isSandboxDate(current) || isPrototypeRecord(current))) {
-        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
+        (Array.isArray(current) || isSandboxDate(current) || isSandboxRegex(current) || isPrototypeRecord(current))) {
+        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current)
+            : isSandboxRegex(current) ? getRegexProperties(current) : current;
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
         if (descriptor !== undefined)
             return descriptor;
@@ -179,6 +210,8 @@ export function getSandboxDataProperty(value, key, budget) {
     while (typeof current === "object" && current !== null) {
         if (isGuestHostObject(current))
             return typeof key === "symbol" ? undefined : getHostObjectMember(current, String(key));
+        if (isSandboxRegex(current))
+            return Object.getOwnPropertyDescriptor(getRegexProperties(current), key)?.value;
         if (isGuestClosure(current)) {
             const entry = getGuestFunctionProperty(current, key);
             if (entry !== undefined || Object.hasOwn(current.properties ?? {}, key))
@@ -210,13 +243,13 @@ export function setSandboxPrototype(value, prototype, budget) {
     if (budget !== undefined && intrinsicPrototypes.get(budget) === value && prototype !== null) {
         throw new TypeError("Object.prototype has an immutable null prototype.");
     }
-    if ((!Array.isArray(value) && !isPrototypeRecord(value)) ||
+    if ((!Array.isArray(value) && !isSandboxRegex(value) && !isPrototypeRecord(value)) ||
         (prototype !== null && !Array.isArray(prototype) && !isPrototypeRecord(prototype))) {
         throw new TypeError("Prototype links require ordinary sandbox objects, arrays, or guest functions.");
     }
     if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype)
         return;
-    if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : value)) {
+    if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : value)) {
         throw new TypeError("Cannot change the prototype of a non-extensible object.");
     }
     let depth = 0;

package/packages/safe-js/dist/interp/regexp-iterator.d.ts

@@ -0,0 +1,14 @@
+import type { SandboxRegex } from "./values.js";
+declare const regexpIteratorBrand: unique symbol;
+export type SandboxRegExpIterator = {
+    readonly [regexpIteratorBrand]: true;
+};
+export type RegExpIteratorState = {
+    matcher: SandboxRegex | undefined;
+    input: string | undefined;
+    exhausted: boolean;
+};
+export declare function isSandboxRegExpIterator(value: unknown): value is SandboxRegExpIterator;
+export declare function restoreSandboxRegExpIterator(state: RegExpIteratorState, target?: SandboxRegExpIterator): SandboxRegExpIterator;
+export declare function regexpIteratorState(value: SandboxRegExpIterator): RegExpIteratorState;
+export {};

package/packages/safe-js/dist/interp/regexp-iterator.js

@@ -0,0 +1,18 @@
+const states = new WeakMap();
+export function isSandboxRegExpIterator(value) {
+    return typeof value === "object" && value !== null && states.has(value);
+}
+export function restoreSandboxRegExpIterator(state, target = Object.create(null)) {
+    if (!state.exhausted && (state.matcher === undefined || state.input === undefined))
+        throw new TypeError("A live RegExp iterator requires its matcher and input.");
+    states.set(target, state.exhausted
+        ? { matcher: undefined, input: undefined, exhausted: true }
+        : { ...state });
+    return target;
+}
+export function regexpIteratorState(value) {
+    const state = states.get(value);
+    if (state === undefined)
+        throw new TypeError("Expected a RegExp string iterator.");
+    return state;
+}

package/packages/safe-js/dist/interp/regexp-properties.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxObject, SandboxRegex } from "./values.js";
+export declare const regexGuestProperties: WeakMap<object, SandboxObject>;
+export declare function getRegexProperties(value: SandboxRegex): SandboxObject;

package/packages/safe-js/dist/interp/regexp-properties.js

@@ -0,0 +1,7 @@
+export const regexGuestProperties = new WeakMap();
+export function getRegexProperties(value) {
+    const properties = regexGuestProperties.get(value);
+    if (properties === undefined)
+        throw new TypeError("Invalid sandbox RegExp storage.");
+    return properties;
+}

package/packages/safe-js/dist/interp/string-coercion.js

@@ -7,12 +7,13 @@ import { float32Storage, isFloat32Array } from "./float32.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { isGuestHostObject } from "./host-capabilities.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
+import { isSandboxRegExpIterator } from "./regexp-iterator.js";
 import { getGuestFunctionProperties, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure } from "./object-model.js";
-import { getRegexMember } from "./methods/regex.js";
+import { regexToString } from "./methods/regex.js";
 import { retainValues } from "./resources.js";
 import { functionString } from "./function-string.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
-import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandboxRegex, isSandboxGenerator } from "./values.js";
+import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandboxRegex, getRegexProperties, isSandboxGenerator } from "./values.js";
 const defaultStringHook = Symbol("defaultStringHook");
 const defaultValueHook = Symbol("defaultValueHook");
 const joiningArrays = new WeakSet();
@@ -115,14 +116,16 @@ function conversionHook(value, name, budget, context) {
             isSandboxMap(value) ||
             isSandboxSet(value) ||
             isSandboxCollectionIterator(value) ||
+            isSandboxRegExpIterator(value) ||
             isSandboxPromise(value) ||
-            isSandboxRegex(value) ||
+            (isSandboxRegex(value) && getSandboxPrototype(value, budget) === null) ||
             isSandboxGenerator(value) ||
             isGuestHostObject(value));
     let current = value;
     let depth = 0;
     while (current !== null) {
-        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current) : current;
+        const properties = isGuestClosure(current) ? getGuestFunctionProperties(current)
+            : isSandboxRegex(current) ? getRegexProperties(current) : current;
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, name);
         if (descriptor !== undefined) {
             return readPropertyDescriptor(descriptor, value, context);
@@ -154,15 +157,16 @@ async function defaultToString(value, budget, context, joining) {
         return "[object Map]";
     if (isSandboxSet(value))
         return "[object Set]";
+    if (isSandboxRegExpIterator(value))
+        return "[object RegExp String Iterator]";
     if (isSandboxCollectionIterator(value))
         return collectionIteratorState(value).collectionKind === "map"
             ? "[object Map Iterator]"
             : "[object Set Iterator]";
     if (isSandboxGenerator(value))
         return "[object Generator]";
-    if (isSandboxRegex(value)) {
-        return budget.allocateString(`/${String(getRegexMember(value, "source", budget))}/${String(getRegexMember(value, "flags", budget))}`);
-    }
+    if (isSandboxRegex(value))
+        return regexToString(value, budget, context);
     if (isSandboxDate(value))
         return budget.allocateString(dateString(value));
     if (Array.isArray(value) || isFloat32Array(value)) {

package/packages/safe-js/dist/interp/values.d.ts

@@ -1,5 +1,7 @@
+export { getRegexProperties } from "./regexp-properties.js";
 import { sandboxMapBrand, sandboxSetBrand } from "./collection-brands.js";
 import { type SandboxCollectionIterator } from "./collection-iterator.js";
+import { type SandboxRegExpIterator } from "./regexp-iterator.js";
 import type { Budget, CompileTicket } from "./budget.js";
 import { CompileScope } from "./regex/compile-guard.js";
 import type { GeneratorChannel } from "./generator.js";
@@ -14,7 +16,7 @@ declare const sandboxRegexBrand: unique symbol;
 declare const sandboxRegexPattern: unique symbol;
 declare const sandboxRetainedValues: unique symbol;
 export type SandboxPrimitive = string | number | boolean | symbol | null | undefined;
-export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
+export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
 export type SandboxObject = {
     [key: string]: SandboxValue;
     [key: symbol]: SandboxValue;

package/packages/safe-js/dist/interp/values.js

@@ -1,8 +1,11 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { internalSymbols } from "./internal-symbols.js";
+import { getRegexProperties, regexGuestProperties } from "./regexp-properties.js";
+export { getRegexProperties } from "./regexp-properties.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { isSandboxMap, isSandboxSet, sandboxMapBrand, sandboxSetBrand } from "./collection-brands.js";
 import { collectionIteratorState, isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshotCollectionIterator } from "./collection-iterator.js";
+import { regexpIteratorState, isSandboxRegExpIterator, restoreSandboxRegExpIterator } from "./regexp-iterator.js";
 import { copyNativeDate, dateDataProperties, exportDate, isSandboxDate } from "./date.js";
 import { boxedDataProperties, boxedValue, createSandboxBox, isSandboxBox, nativeBoxedValue } from "./boxed.js";
 import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, measureHostObjectData, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
@@ -98,6 +101,8 @@ export function ownEnumerableSandboxEntries(value, excludedKeys) {
     let entries;
     if (isGuestClosure(value))
         entries = Object.entries(value.properties ?? {});
+    else if (isSandboxRegex(value))
+        entries = Object.entries(getRegexProperties(value));
     else if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     else
@@ -111,13 +116,15 @@ export function ownSandboxSymbolKeys(value) {
         return [];
     if (isSandboxClosure(value))
         value = value.properties ?? {};
+    else if (isSandboxRegex(value))
+        value = getRegexProperties(value);
     else if (isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     return Object.getOwnPropertySymbols(Object(value)).filter(key => !internalSymbols.has(key));
 }
 export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
     if (includeSymbols) {
-        const properties = isSandboxClosure(value) ? value.properties ?? {} : Object(value);
+        const properties = isSandboxClosure(value) ? value.properties ?? {} : isSandboxRegex(value) ? getRegexProperties(value) : Object(value);
         return [...ownEnumerableSandboxKeys(value), ...ownSandboxSymbolKeys(value).filter(key => Object.getOwnPropertyDescriptor(properties, key)?.enumerable === true)];
     }
     if (isGuestHostObject(value))
@@ -126,6 +133,8 @@ export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
         throw new TypeError("Cannot convert undefined or null to object.");
     if (isGuestClosure(value))
         return Object.keys(value.properties ?? {});
+    if (isSandboxRegex(value))
+        return Object.keys(getRegexProperties(value));
     if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
         return [];
     return Object.keys(Object(value));
@@ -218,6 +227,32 @@ export function createSandboxRegex(source, flags = "", lastIndex = 0, compilatio
     }
     const pattern = parseRegex(source, flags, compilation, 7 + source.length + flags.length);
     const regex = { kind: "regex", source, flags, lastIndex };
+    const storage = Object.create(null);
+    Object.defineProperty(storage, "lastIndex", { value: lastIndex, writable: true });
+    const syncCursor = () => {
+        const descriptor = Object.getOwnPropertyDescriptor(regex, "lastIndex");
+        Object.defineProperty(storage, "lastIndex", { value: descriptor.value, writable: descriptor.writable });
+    };
+    const properties = new Proxy(storage, {
+        get: (target, key, receiver) => key === "lastIndex" ? regex.lastIndex : Reflect.get(target, key, receiver),
+        set: (target, key, value, receiver) => key === "lastIndex"
+            ? Reflect.set(regex, key, value) : Reflect.set(target, key, value, receiver),
+        getOwnPropertyDescriptor(target, key) {
+            if (key === "lastIndex")
+                syncCursor();
+            return Object.getOwnPropertyDescriptor(target, key);
+        },
+        defineProperty(target, key, descriptor) {
+            if (key !== "lastIndex")
+                return Reflect.defineProperty(target, key, descriptor);
+            syncCursor();
+            if (!Reflect.defineProperty(target, key, descriptor))
+                return false;
+            const cursor = Object.getOwnPropertyDescriptor(target, key);
+            return Reflect.defineProperty(regex, key, { value: cursor.value, writable: cursor.writable });
+        }
+    });
+    regexGuestProperties.set(regex, properties);
     Object.defineProperties(regex, {
         [sandboxRegexBrand]: { value: true },
         [sandboxRegexPattern]: { value: pattern }
@@ -366,6 +401,17 @@ export function measureSandboxData(values, options = {}) {
             }
             return;
         }
+        if (isSandboxRegExpIterator(value)) {
+            const state = regexpIteratorState(value);
+            visit(state.matcher, depth + 1);
+            visit(state.input, depth + 1);
+            for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+                usage += key.length + 1;
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+            }
+            return;
+        }
         if (isSandboxCollectionIterator(value)) {
             visit(collectionIteratorState(value).collection, depth + 1);
             for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
@@ -424,6 +470,19 @@ export function measureSandboxData(values, options = {}) {
             if (compiled.ticket !== undefined)
                 options.compileTickets?.add(compiled.ticket);
             visit(lastIndex, depth + 1);
+            for (const key of Reflect.ownKeys(getRegexProperties(value))) {
+                if (key === "lastIndex")
+                    continue;
+                const descriptor = Object.getOwnPropertyDescriptor(getRegexProperties(value), key);
+                usage += 1 + (typeof key === "string" ? key.length : 0);
+                if (typeof key === "symbol")
+                    visit(key, depth + 1);
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+                else
+                    for (const closure of retainedAccessorClosures(descriptor))
+                        visit(closure, depth + 1);
+            }
             return;
         }
         if (isSandboxArguments(value)) {
@@ -491,7 +550,7 @@ function captureRegexData(value) {
         typeof flags.value !== "string") {
         throw new TypeError("Invalid sandbox RegExp source or flags: expected own string data properties.");
     }
-    const cursor = Object.getOwnPropertyDescriptor(value, "lastIndex");
+    const cursor = Object.getOwnPropertyDescriptor(regexGuestProperties.get(value) ?? value, "lastIndex");
     if (cursor === undefined || !("value" in cursor)) {
         throw new TypeError("Invalid sandbox RegExp lastIndex: expected an own data property.");
     }
@@ -519,6 +578,21 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         state.seen.set(value, copy);
         if (!state.resetRegexLastIndex)
             copy.lastIndex = copyToSandbox(value.lastIndex, state, `${path}.lastIndex`, true, depth + 1);
+        if (!state.structuredClone) {
+            const properties = getRegexProperties(value);
+            for (const key of Reflect.ownKeys(properties)) {
+                const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+                if (!("value" in descriptor))
+                    throw new TypeError("RegExp accessor properties cannot be copied as data.");
+                Object.defineProperty(getRegexProperties(copy), key, {
+                    ...descriptor,
+                    value: key === "lastIndex" && state.resetRegexLastIndex ? 0
+                        : copyToSandbox(descriptor.value, state, `${path}.${String(key)}`, true, depth + 1)
+                });
+            }
+            if (!Object.isExtensible(properties))
+                Object.preventExtensions(getRegexProperties(copy));
+        }
         return copy;
     }
     if (isSandboxClosure(value) ||
@@ -526,6 +600,26 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         isSandboxPromise(value)) {
         return value;
     }
+    if (isSandboxRegExpIterator(value)) {
+        if (hasGuestObjectState(value))
+            throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
+        if (!cloneSandboxCollections)
+            return value;
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const snapshot = regexpIteratorState(value);
+        const copy = restoreSandboxRegExpIterator({ matcher: undefined, input: undefined, exhausted: true });
+        state.seen.set(value, copy);
+        const matcher = copyToSandbox(snapshot.matcher, state, `${path}.<matcher>`, true, depth + 1);
+        if (matcher !== undefined && !isSandboxRegex(matcher))
+            throw new TypeError("Invalid RegExp iterator matcher.");
+        restoreSandboxRegExpIterator({ ...snapshot, matcher }, copy);
+        for (const entry of getEnumerableObjectEntries(value, path)) {
+            defineOwnDataProperty(copy, entry.key, copyToSandbox(entry.value, state, joinPath(path, entry.key), true, depth + 1));
+        }
+        return copy;
+    }
     if (isSandboxCollectionIterator(value)) {
         if (hasGuestObjectState(value))
             throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
@@ -745,6 +839,18 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             const regex = new RegExp(source, flags);
             state.seen.set(value, regex);
             Reflect.set(regex, "lastIndex", copyFromSandbox(lastIndex, state, `${path}.lastIndex`, options, depth + 1));
+            const properties = regexGuestProperties.get(value);
+            if (properties !== undefined) {
+                for (const key of Reflect.ownKeys(properties)) {
+                    const descriptor = Object.getOwnPropertyDescriptor(properties, key);
+                    if (!("value" in descriptor))
+                        throw new TypeError("RegExp accessor properties cannot be copied as data.");
+                    Object.defineProperty(regex, key, { ...descriptor,
+                        value: copyFromSandbox(descriptor.value, state, `${path}.${String(key)}`, options, depth + 1) });
+                }
+                if (!Object.isExtensible(properties))
+                    Object.preventExtensions(regex);
+            }
             guard.retainScratch();
             return regex;
         }
@@ -816,6 +922,9 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (isSandboxCollectionIterator(value)) {
         throw new TypeError("Sandbox collection iterators cannot cross into host values.");
     }
+    if (isSandboxRegExpIterator(value)) {
+        throw new TypeError("Sandbox RegExp iterators cannot cross into host values.");
+    }
     if (isSandboxRegex(value)) {
         throw new TypeError("Invalid sandbox RegExp brand.");
     }

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -1,4 +1,7 @@
 export const DUMP_FORMAT_VERSION = 1;
+import { getRegexProperties, isSandboxRegex } from "../interp/values.js";
+import { isSandboxRegExpIterator, regexpIteratorState } from "../interp/regexp-iterator.js";
+import { hasCustomRegexProperties, serializeRegexProperties } from "./regexp-properties.js";
 export const EXECUTION_SEMANTICS = "jobs-v8";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { hasGuestObjectState } from "../interp/object-model.js";
@@ -79,7 +82,7 @@ function serializeDumpValue(value, path, state) {
     if (hasGuestObjectState(value)) {
         throw new TypeError("Guest function properties and prototype links cannot be serialized.");
     }
-    if (isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
+    if (isSandboxRegExpIterator(value) || (isSandboxRegex(value) && hasCustomRegexProperties(value)) || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
         return serializeHeapReference(value, path, state);
     if (Array.isArray(value)) {
         const reference = serializeHeapReference(value, path, state);
@@ -104,7 +107,39 @@ function serializeHeapReference(value, path, state) {
     }
     if (!state.serializedHeapIds.has(id)) {
         state.serializedHeapIds.add(id);
-        if (isSandboxBox(value)) {
+        if (isSandboxRegExpIterator(value)) {
+            const snapshot = regexpIteratorState(value);
+            const matcher = snapshot.matcher;
+            const entries = Object.create(null);
+            state.heap[String(id)] = {
+                kind: "regexp-iterator", exhausted: snapshot.exhausted,
+                matcher: matcher === undefined ? { kind: "undefined" } : { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) },
+                input: snapshot.input ?? { kind: "undefined" }, entries,
+                symbolEntries: serializeSymbolProperties(value, entry => {
+                    const serialized = serializeDumpValue(entry, `${path}.[symbol]`, state);
+                    if (serialized === SKIP_VALUE)
+                        throw new TypeError("Unsupported RegExp iterator symbol property in public dump.");
+                    return serialized;
+                })
+            };
+            for (const [key, entry] of getEnumerableDataEntries(value)) {
+                const serialized = serializeDumpValue(entry, `${path}.${key}`, state);
+                if (serialized === SKIP_VALUE)
+                    throw new TypeError("Unsupported RegExp iterator property in public dump.");
+                entries[key] = serialized;
+            }
+        }
+        else if (isSandboxRegex(value) && hasCustomRegexProperties(value)) {
+            const encode = (entry) => {
+                const serialized = serializeDumpValue(entry, `${path}.<regex-property>`, state);
+                if (serialized === SKIP_VALUE)
+                    throw new TypeError("Unsupported RegExp property in public dump.");
+                return serialized;
+            };
+            state.heap[String(id)] = { kind: "regex-object", source: value.source, flags: value.flags,
+                lastIndex: encode(value.lastIndex), ...serializeRegexProperties(value, encode) };
+        }
+        else if (isSandboxBox(value)) {
             state.heap[String(id)] = encodeBoxedData(value, (entry, key) => {
                 if (Object.is(entry, -0))
                     return { kind: "number", value: "-0" };
@@ -194,6 +229,8 @@ function indexHeapContainers(snapshot) {
             stat.cyclic ||
             ownSerializableSymbolKeys(value).length > 0 ||
             isSandboxBox(value) ||
+            isSandboxRegExpIterator(value) ||
+            (isSandboxRegex(value) && hasCustomRegexProperties(value)) ||
             isSandboxDate(value) ||
             isFloat32Array(value) ||
             (Array.isArray(value) && requiresArrayEntries(value)) ||
@@ -231,13 +268,18 @@ function collectContainerStats(value, stats, ancestors) {
     }
     stat.expanded = true;
     ancestors.add(value);
-    const entries = isSandboxDate(value)
-        ? dateDataProperties(value).flatMap(([key, descriptor]) => typeof key === "string" ? [descriptor.value] : [])
-        : isSandboxBox(value)
-            ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value)
-            : isSandboxArguments(value)
-                ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
-                : getEnumerableDataValues(value);
+    const entries = isSandboxRegex(value)
+        ? Reflect.ownKeys(getRegexProperties(value)).flatMap(key => {
+            const descriptor = Object.getOwnPropertyDescriptor(getRegexProperties(value), key);
+            return "value" in descriptor ? [descriptor.value] : [];
+        })
+        : isSandboxDate(value)
+            ? dateDataProperties(value).flatMap(([key, descriptor]) => typeof key === "string" ? [descriptor.value] : [])
+            : isSandboxBox(value)
+                ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value)
+                : isSandboxArguments(value)
+                    ? getSandboxArgumentEntries(value).map(([, entry]) => entry)
+                    : getEnumerableDataValues(value);
     for (const entry of entries) {
         collectContainerStats(entry, stats, ancestors);
     }

package/packages/safe-js/dist/snapshot/regexp-properties.d.ts

@@ -0,0 +1,18 @@
+import { type SandboxRegex } from "../interp/values.js";
+import { type SerializedSymbolProperty } from "./symbols.js";
+type DataProperty<T> = {
+    value: T;
+    enumerable: boolean;
+    writable: boolean;
+    configurable: boolean;
+};
+export type RegexPropertyData<T> = {
+    properties?: Record<string, DataProperty<T>>;
+    symbolEntries?: Array<SerializedSymbolProperty<T>>;
+    extensible?: boolean;
+};
+export declare function hasCustomRegexProperties(value: SandboxRegex): boolean;
+export declare function serializeRegexProperties<T>(value: SandboxRegex, encode: (entry: unknown) => T): RegexPropertyData<T>;
+export declare function validateRegexProperties(data: RegexPropertyData<unknown>): void;
+export declare function restoreRegexProperties<T>(value: SandboxRegex, data: RegexPropertyData<T>, decode: (entry: T) => unknown): void;
+export {};

package/packages/safe-js/dist/snapshot/regexp-properties.js

@@ -0,0 +1,58 @@
+import { getRegexProperties } from "../interp/values.js";
+import { restoreSymbolProperties, serializeSymbolProperties } from "./symbols.js";
+export function hasCustomRegexProperties(value) {
+    const properties = getRegexProperties(value);
+    return Reflect.ownKeys(properties).length !== 1 || !Object.isExtensible(properties) ||
+        Object.getOwnPropertyDescriptor(properties, "lastIndex")?.writable !== true;
+}
+export function serializeRegexProperties(value, encode) {
+    if (!hasCustomRegexProperties(value))
+        return {};
+    const source = getRegexProperties(value);
+    const properties = Object.create(null);
+    for (const key of Object.getOwnPropertyNames(source)) {
+        const descriptor = Object.getOwnPropertyDescriptor(source, key);
+        if (!("value" in descriptor))
+            throw new TypeError("RegExp accessor properties cannot be serialized as data.");
+        properties[key] = { value: encode(descriptor.value), enumerable: descriptor.enumerable === true,
+            configurable: descriptor.configurable === true, writable: descriptor.writable === true };
+    }
+    const symbolEntries = serializeSymbolProperties(source, encode);
+    return { properties, ...(symbolEntries.length === 0 ? {} : { symbolEntries }),
+        ...(Object.isExtensible(source) ? {} : { extensible: false }) };
+}
+export function validateRegexProperties(data) {
+    const descriptor = (value) => {
+        if (typeof value !== "object" || value === null || Array.isArray(value) ||
+            !Object.hasOwn(value, "value") ||
+            !["enumerable", "configurable", "writable"].every(key => Object.hasOwn(value, key) && typeof value[key] === "boolean") ||
+            Object.keys(value).some(key => !["value", "enumerable", "configurable", "writable"].includes(key)))
+            throw new TypeError("Invalid RegExp data property descriptor.");
+    };
+    if (data.extensible !== undefined && typeof data.extensible !== "boolean")
+        throw new TypeError("Invalid RegExp extensibility.");
+    if (data.properties !== undefined) {
+        if (typeof data.properties !== "object" || data.properties === null || Array.isArray(data.properties))
+            throw new TypeError("Invalid RegExp property data.");
+        for (const entry of Object.values(data.properties))
+            descriptor(entry);
+    }
+    if (data.symbolEntries !== undefined) {
+        if (!Array.isArray(data.symbolEntries))
+            throw new TypeError("Invalid RegExp symbol properties.");
+        for (const entry of data.symbolEntries) {
+            if (!Array.isArray(entry) || entry.length !== 2)
+                throw new TypeError("Invalid RegExp symbol property.");
+            descriptor(entry[1]);
+        }
+    }
+}
+export function restoreRegexProperties(value, data, decode) {
+    validateRegexProperties(data);
+    const properties = getRegexProperties(value);
+    for (const [key, descriptor] of Object.entries(data.properties ?? {}))
+        Object.defineProperty(properties, key, { ...descriptor, value: decode(descriptor.value) });
+    restoreSymbolProperties(properties, data.symbolEntries, decode);
+    if (data.extensible === false)
+        Object.preventExtensions(properties);
+}