poe-code 14.0.73 → 14.0.74

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-I2Z37MKZ.js";
+} from "./chunks/chunk-2J6W3YGB.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-XKCTB5FR.js";
+} from "./chunks/chunk-YEZOXLY4.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-XKCTB5FR.js";
+} from "./chunks/chunk-YEZOXLY4.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/graph-depth.js

@@ -2,6 +2,7 @@ import { replaceErrorStack } from "./error/shape.js";
 import { SandboxError } from "./interp/budget.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "./interp/arguments.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./interp/collection-iterator.js";
+import { regexpIteratorState, isSandboxRegExpIterator } from "./interp/regexp-iterator.js";
 import { isSandboxMap, isSandboxSet } from "./interp/collection-brands.js";
 import { boxedDataProperties, isSandboxBox } from "./interp/boxed.js";
 import { regexGuestProperties } from "./interp/regexp-properties.js";
@@ -90,6 +91,8 @@ function graphEntries(value) {
     const entries = [];
     if (isSandboxCollectionIterator(value))
         entries.push([".<collection>", collectionIteratorState(value).collection]);
+    if (isSandboxRegExpIterator(value))
+        entries.push([".<matcher>", regexpIteratorState(value).matcher]);
     for (const key of Object.keys(value)) {
         const descriptor = Object.getOwnPropertyDescriptor(value, key);
         if (descriptor !== undefined && "value" in descriptor)

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-I2Z37MKZ.js";
+} from "./chunks/chunk-2J6W3YGB.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-XKCTB5FR.js";
+} from "./chunks/chunk-YEZOXLY4.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/cancel.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
+import { regexpIteratorState, isSandboxRegExpIterator } from "./regexp-iterator.js";
 import { getSandboxPrototype } from "./object-model.js";
 import { createSandboxPromise, isSandboxClosure, isSandboxMap, isSandboxPromise, isSandboxSet } from "./values.js";
 import { assertPromiseExecutionAllowed, interruptOnFatalPromiseRejection, onFatalPromiseRejection, observeSandboxPromise, trackSandboxPromise } from "./promise-tracker.js";
@@ -100,6 +101,8 @@ function registerCancelablePromises(value, signal) {
         else {
             if (isSandboxCollectionIterator(current))
                 pending.push(collectionIteratorState(current).collection);
+            if (isSandboxRegExpIterator(current))
+                pending.push(regexpIteratorState(current).matcher);
             for (const descriptor of Object.values(Object.getOwnPropertyDescriptors(current))) {
                 if ("value" in descriptor)
                     pending.push(descriptor.value);

package/packages/safe-js/dist/interp/globals/misc.js

@@ -1,4 +1,5 @@
 import { isSandboxCollectionIterator } from "../collection-iterator.js";
+import { isSandboxRegExpIterator } from "../regexp-iterator.js";
 import { assertSandboxGraphDepth } from "../../graph-depth.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { createNumericParsers } from "./numeric-parsers.js";
@@ -49,7 +50,7 @@ function structuredCloneSandboxValue(value, budget, parent) {
     }
 }
 function assertStructuredCloneable(value, seen) {
-    if (isSandboxClosure(value) || isSandboxPromise(value) || isSandboxCollectionIterator(value)) {
+    if (isSandboxClosure(value) || isSandboxPromise(value) || isSandboxCollectionIterator(value) || isSandboxRegExpIterator(value)) {
         throw new TypeError("structuredClone() cannot clone closures, promises, or collection iterators.");
     }
     if (typeof value !== "object" || value === null || seen.has(value)) {

package/packages/safe-js/dist/interp/globals/object.js

@@ -7,6 +7,7 @@ import { isSandboxErrorConstructorInstance } from "../exceptions.js";
 import { isFloat32Array } from "../float32.js";
 import { hasHostObjectMember, isGuestHostObject } from "../host-capabilities.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "../collection-iterator.js";
+import { isSandboxRegExpIterator } from "../regexp-iterator.js";
 import { getSandboxPrototype, getSandboxPropertyDescriptor, hasExplicitSandboxPrototype, installObjectPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
 import { toPropertyKey } from "../property-key.js";
 import { createSandboxClosure, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, isSandboxRegex, getRegexProperties, isSandboxSet } from "../values.js";
@@ -180,6 +181,8 @@ function typeTag(value, builtinOnly = false) {
         return "Map";
     if (isSandboxSet(value))
         return "Set";
+    if (isSandboxRegExpIterator(value))
+        return "RegExp String Iterator";
     if (isSandboxCollectionIterator(value))
         return collectionIteratorState(value).collectionKind === "map" ? "Map Iterator" : "Set Iterator";
     if (isSandboxPromise(value))

package/packages/safe-js/dist/interp/globals/regex.js

@@ -2,6 +2,11 @@ import { createSandboxClosure, createSandboxRegex, isSandboxRegex, reconcileComp
 import { CompileScope } from "../regex/compile-guard.js";
 import { SandboxError } from "../budget.js";
 import { sandboxString } from "../string-coercion.js";
+import { getSandboxPropertyDescriptor, installRegexPrototype, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
+import { accessorAdapter, readPropertyDescriptor } from "../accessors.js";
+import { callRegexMethod, getRegexMember, regexFlagProperties, regexSearch } from "../methods/regex.js";
+import { regexMatch, regexReplace } from "../methods/string.js";
+import { invokeBuiltinClosure } from "../builtin-call.js";
 export function createRegexGlobals(options) {
     const invoke = (construct) => async (args, context) => {
         const selected = options.compileOwner ?? context?.compilation?.owner;
@@ -12,18 +17,51 @@ export function createRegexGlobals(options) {
         const compilation = context?.compilation?.owner === operation.owner
             ? context.compilation : new CompileScope(operation.owner);
         let source = "";
+        let retainedSource;
+        let retainedFlags;
+        let retainedPrototype;
         const retained = {};
-        options.budget.setRetainedValues(retained, () => [...args, source]);
+        options.budget.setRetainedValues(retained, () => [...args, source, retainedSource, retainedFlags, retainedPrototype]);
         try {
             const pattern = args[0];
             const flags = args[1];
-            if (!construct && isSandboxRegex(pattern) && flags === undefined)
+            const read = (key) => {
+                const descriptor = getSandboxPropertyDescriptor(pattern, key, options.budget);
+                if (context?.getProperty !== undefined)
+                    return context.getProperty(pattern, key);
+                return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, pattern, context);
+            };
+            let regexLike = false;
+            if (pattern !== null && typeof pattern === "object") {
+                const match = await read(Symbol.match);
+                regexLike = match === undefined ? isSandboxRegex(pattern) : Boolean(match);
+            }
+            if (!construct && regexLike && flags === undefined && await read("constructor") === constructor)
                 return pattern;
-            const sourceValue = isSandboxRegex(pattern) ? pattern.source : pattern;
-            const flagsValue = isSandboxRegex(pattern) && flags === undefined ? pattern.flags : flags;
+            let sourceValue = pattern;
+            let flagsValue = flags;
+            if (isSandboxRegex(pattern)) {
+                sourceValue = pattern.source;
+                if (flags === undefined)
+                    flagsValue = pattern.flags;
+            }
+            else if (regexLike) {
+                sourceValue = retainedSource = await read("source");
+                if (flags === undefined)
+                    flagsValue = retainedFlags = await read("flags");
+            }
+            if (construct && context?.newTarget !== undefined && context.newTarget !== constructor) {
+                retainedPrototype = context.getProperty !== undefined
+                    ? await context.getProperty(context.newTarget, "prototype")
+                    : await readPropertyDescriptor(getSandboxPropertyDescriptor(context.newTarget, "prototype", options.budget) ?? { value: undefined }, context.newTarget, context);
+            }
             source = sourceValue === undefined ? "" : await sandboxString(sourceValue, options.budget, context);
+            retainedSource = undefined;
             const flagText = flagsValue === undefined ? "" : await sandboxString(flagsValue, options.budget, context);
+            retainedFlags = undefined;
             const regex = createSandboxRegex(source, flagText, 0, compilation);
+            if (typeof retainedPrototype === "object" && retainedPrototype !== null)
+                setSandboxPrototype(regex, retainedPrototype, options.budget);
             if (compilation !== context?.compilation) {
                 reconcileCompiledValues(options.budget, [regex], compilation);
             }
@@ -36,7 +74,50 @@ export function createRegexGlobals(options) {
             operation.release();
         }
     };
-    return {
-        RegExp: createSandboxClosure({ sandbox: true, name: "RegExp", call: invoke(false), construct: invoke(true) })
-    };
+    const constructor = createSandboxClosure({ guest: true, sandbox: true, name: "RegExp", length: 2, call: invoke(false), construct: invoke(true) });
+    const prototype = Object.create(null);
+    Object.defineProperty(materializeFunctionProperties(constructor), "prototype", { value: prototype, writable: false });
+    Object.defineProperty(prototype, "constructor", { value: constructor, writable: true, configurable: true });
+    Object.defineProperty(prototype, Symbol.search, {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.search]", length: 1,
+            call: (args, context) => regexSearch(context?.thisValue, args[0], options.budget, context) }),
+        writable: true, configurable: true
+    });
+    Object.defineProperty(prototype, Symbol.match, {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.match]", length: 1,
+            call: (args, context) => regexMatch(args[0], context?.thisValue, options.budget, context) }),
+        writable: true, configurable: true
+    });
+    Object.defineProperty(prototype, Symbol.replace, {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.replace]", length: 2,
+            call: (args, context) => regexReplace(args[0], context?.thisValue, args[1], options.budget, (closure, values) => invokeBuiltinClosure(closure, values, options.budget, context, undefined), context) }),
+        writable: true, configurable: true
+    });
+    for (const name of ["exec", "test", "toString"]) {
+        Object.defineProperty(prototype, name, {
+            value: createSandboxClosure({ sandbox: true, name, length: name === "toString" ? 0 : 1,
+                call: (args, context) => callRegexMethod(context?.thisValue, name, args, options.budget, context) }),
+            writable: true, configurable: true
+        });
+    }
+    for (const name of ["source", "flags", ...Object.keys(regexFlagProperties)]) {
+        const getter = createSandboxClosure({ sandbox: true, name: `get ${name}`, length: 0,
+            call: (_args, context) => {
+                const receiver = context?.thisValue;
+                if (name === "flags") {
+                    if (receiver === null || typeof receiver !== "object")
+                        throw new TypeError("RegExp flags requires an object receiver.");
+                    return getRegexMember(receiver, name, options.budget, context);
+                }
+                if (receiver === prototype)
+                    return name === "source" ? "(?:)" : undefined;
+                if (!isSandboxRegex(receiver))
+                    throw new TypeError("RegExp accessor requires a regex receiver.");
+                return getRegexMember(receiver, name, options.budget, context);
+            }
+        });
+        Object.defineProperty(prototype, name, { get: accessorAdapter(getter, "get"), configurable: true });
+    }
+    installRegexPrototype(options.budget, prototype, constructor);
+    return { RegExp: constructor };
 }

package/packages/safe-js/dist/interp/interpreter.js

@@ -35,6 +35,8 @@ import { hasOwnSandboxProperty } from "./globals/object.js";
 import { isSandboxMapConstructor, isSandboxSetConstructor } from "./globals/collections.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
 import { getCollectionIteratorMember } from "./methods/collection-iterator.js";
+import { isSandboxRegExpIterator, regexpIteratorState } from "./regexp-iterator.js";
+import { getRegExpIteratorMember } from "./methods/regexp-iterator.js";
 import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
@@ -857,6 +859,8 @@ function isRestorableBindingValue(value, seen = new WeakSet()) {
     if (seen.has(value))
         return true;
     seen.add(value);
+    if (isSandboxRegExpIterator(value))
+        return isRestorableBindingValue(regexpIteratorState(value).matcher, seen);
     if (isSandboxCollectionIterator(value)) {
         return isRestorableBindingValue(collectionIteratorState(value).collection, seen);
     }
@@ -1116,7 +1120,7 @@ async function evaluateForOfStatement(node, context) {
         const restored = context.scope.consumeRestoredBinding(restoredIteration.values[0]);
         if (restored.found && Array.isArray(restored.value)) {
             restoredEntry = { done: false, value: restored.value[1] };
-            if (Array.isArray(restored.value[0]) || isSandboxMap(restored.value[0]) || isSandboxSet(restored.value[0]) || isSandboxCollectionIterator(restored.value[0])) {
+            if (Array.isArray(restored.value[0]) || isSandboxMap(restored.value[0]) || isSandboxSet(restored.value[0]) || isSandboxCollectionIterator(restored.value[0]) || isSandboxRegExpIterator(restored.value[0])) {
                 return evaluateForOfIterator(node, restored.value[0], context, restoredEntry);
             }
         }
@@ -1510,7 +1514,7 @@ function createLoopIterationContext(context, scope) {
             snapshot.loopIterations = {};
             for (const [nodeId, iteration] of context.activeLoopIterations) {
                 if (typeof iteration !== "number" &&
-                    (Array.isArray(iteration.values[0]) || isSandboxMap(iteration.values[0]) || isSandboxSet(iteration.values[0]) || isSandboxCollectionIterator(iteration.values[0]))) {
+                    (Array.isArray(iteration.values[0]) || isSandboxMap(iteration.values[0]) || isSandboxSet(iteration.values[0]) || isSandboxCollectionIterator(iteration.values[0]) || isSandboxRegExpIterator(iteration.values[0]))) {
                     const bindingName = `#for-of:${nodeId}`;
                     snapshot.bindings[bindingName] = iteration.values;
                     snapshot.loopIterations[nodeId] = { index: iteration.index, values: [bindingName] };
@@ -1852,6 +1856,8 @@ function getPropertyValue(target, property, context, receiver = target) {
     const descriptor = getSandboxPropertyDescriptor(target, property, context.budget);
     if (descriptor !== undefined)
         return readPropertyDescriptor(descriptor, receiver, createCoercionContext(context), true);
+    if (isSandboxRegExpIterator(target))
+        return getRegExpIteratorMember(property, context.budget);
     if (typeof target === "symbol") {
         const prototype = getBoxedPrototype(target, context.budget);
         return prototype === undefined ? undefined : getPropertyValue(prototype, property, context, receiver);
@@ -1892,7 +1898,8 @@ function getPropertyValue(target, property, context, receiver = target) {
     if (isSandboxPromise(target))
         return getPromiseMember(property, context.budget);
     if (isSandboxRegex(target))
-        return getRegexMember(target, property, context.budget);
+        return hasExplicitSandboxPrototype(target) || getSandboxPrototype(target, context.budget) !== null
+            ? undefined : getRegexMember(target, property, context.budget, createCoercionContext(context));
     if (!isIndexableSandboxValue(target)) {
         throw new TypeError("Attempted to read a property from a non-object value.");
     }
@@ -2381,9 +2388,9 @@ function hasSandboxProperty(value, key, context) {
             return typeof key === "symbol" ? false : hasHostObjectMember(current, String(key));
         if (hasOwnSandboxProperty(current, key, false))
             return true;
-        if (!((isGuestClosure(current) || Array.isArray(current)) && hasExplicitSandboxPrototype(current)) &&
+        if (!isSandboxRegex(current) && !((isGuestClosure(current) || Array.isArray(current)) && hasExplicitSandboxPrototype(current)) &&
             (Array.isArray(current) || !isPlainSandboxObject(current) ||
-                isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current))) {
+                isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current) || isSandboxRegExpIterator(current))) {
             return getPropertyValue(current, key, context) !== undefined;
         }
         current = getSandboxPrototype(current, context.budget);
@@ -2603,7 +2610,7 @@ function getMemberValue(target, property, context) {
             return getClosureMemberValue(current, property, context);
         if (Array.isArray(current))
             return getArrayMemberValue(current, property, context);
-        if (!isPlainSandboxObject(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current) || isFloat32Array(current)) {
+        if (!isPlainSandboxObject(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current) || isSandboxRegExpIterator(current) || isFloat32Array(current)) {
             return getPropertyValue(current, property, context);
         }
         if (Object.hasOwn(current, String(property)))
@@ -2646,7 +2653,7 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
         return;
     }
     if (isSandboxRegex(target)) {
-        setRegexMember(target, property, value);
+        setRegexMember(target, property, value, budget);
         return;
     }
     if (!isIndexableSandboxValue(target)) {

package/packages/safe-js/dist/interp/iteration.js

@@ -4,6 +4,8 @@ import { isFloat32Array } from "./float32.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
+import { isSandboxRegExpIterator } from "./regexp-iterator.js";
+import { nextRegExpIterator } from "./methods/regexp-iterator.js";
 import { Budget, isFatalSandboxError } from "./budget.js";
 import { sandboxString } from "./string-coercion.js";
 import { awaitSandboxValue, awaitWithSignal } from "./cancel.js";
@@ -17,7 +19,8 @@ export async function acquireSandboxIterator(value, budget, context, asyncProtoc
         return asyncProtocol
             ? getSandboxAsyncIterator(value, budget, context, signal)
             : getSandboxIterator(value, budget, context);
-    if (getSandboxPropertyDescriptor(value, key, budget) === undefined) {
+    if (getSandboxPropertyDescriptor(value, key, budget) === undefined &&
+        !(isSandboxRegExpIterator(value) && !asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)) {
         if (!asyncProtocol)
             return getSandboxIterator(value, budget, context);
         if (isSandboxGenerator(value) && value.async)
@@ -222,6 +225,8 @@ export function getSandboxIterator(value, budget, context) {
     }
     if (isSandboxCollectionIterator(value))
         return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
+    if (isSandboxRegExpIterator(value))
+        return { next: () => nextRegExpIterator(value, budget), snapshotIndex: () => 0 };
     if (isGuestHostObject(value))
         return getHostObjectIterator(value);
     if (isFloat32Array(value)) {

package/packages/safe-js/dist/interp/methods/regex.d.ts

@@ -1,10 +1,14 @@
 import { type SandboxCallContext, type SandboxRegex, type SandboxValue } from "../values.js";
 import { type RegexMatch } from "../regex/engine.js";
 import type { Budget } from "../budget.js";
-export type RegexMethodName = "exec" | "test";
+export declare function regexSearch(target: SandboxValue, input: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
+export type RegexMethodName = "exec" | "test" | "toString";
+export declare const regexFlagProperties: Readonly<Record<string, string>>;
 export declare function isRegexMethodName(property: string | number): property is RegexMethodName;
-export declare function getRegexMember(target: SandboxRegex, property: string | number, budget: Budget): SandboxValue | undefined;
-export declare function setRegexMember(target: SandboxRegex, property: PropertyKey, value: SandboxValue): void;
+export declare function getRegexMember(target: SandboxRegex, property: string | number, budget: Budget, context?: SandboxCallContext): SandboxValue | Promise<SandboxValue>;
+export declare function setRegexMember(target: SandboxRegex, property: PropertyKey, value: SandboxValue, budget?: Budget): void;
 export declare function callRegexMethod(target: SandboxValue, methodName: RegexMethodName, args: readonly SandboxValue[], budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
+export declare function regexExec(target: SandboxValue, input: string, budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
+export declare function regexToString(target: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<string>;
 export declare function executeRegex(target: SandboxRegex, input: string, lastIndex: number): RegexMatch | null;
 export declare function toMatchArray(match: RegexMatch | null, input: string): SandboxValue;

package/packages/safe-js/dist/interp/methods/regex.js

@@ -1,22 +1,84 @@
 import { createSandboxClosure, getSandboxRegexPattern, getRegexProperties, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { matchRegex } from "../regex/engine.js";
 import { invokeBuiltinClosure } from "../builtin-call.js";
-import { getSandboxDataProperty } from "../object-model.js";
+import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype } from "../object-model.js";
+import { readPropertyDescriptor } from "../accessors.js";
+import { retainValues } from "../resources.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
-const regexMethodNames = new Set(["exec", "test"]);
-const regexFlagProperties = {
+import { setSandboxProperty } from "../interpreter.js";
+export async function regexSearch(target, input, budget, context) {
+    if (target === null || typeof target !== "object")
+        throw new TypeError("RegExp search requires an object receiver.");
+    let string;
+    let previous;
+    let result;
+    const release = retainValues(budget, () => [target, input, string, previous, result]);
+    const read = (value, key) => {
+        if (context?.getProperty !== undefined)
+            return context.getProperty(value, key);
+        const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+        return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, context);
+    };
+    try {
+        string = await sandboxString(input, budget, context);
+        input = undefined;
+        previous = await read(target, "lastIndex");
+        if (!Object.is(previous, 0))
+            await setSandboxProperty(target, "lastIndex", 0, budget, true, context);
+        result = await regexExec(target, string, budget, context);
+        if (!Object.is(await read(target, "lastIndex"), previous))
+            await setSandboxProperty(target, "lastIndex", previous, budget, true, context);
+        return result === null ? -1 : await read(result, "index");
+    }
+    finally {
+        release();
+    }
+}
+const regexMethodNames = new Set(["exec", "test", "toString"]);
+export const regexFlagProperties = {
     hasIndices: "d", global: "g", ignoreCase: "i", multiline: "m",
     dotAll: "s", unicode: "u", unicodeSets: "v", sticky: "y"
 };
 export function isRegexMethodName(property) {
     return typeof property === "string" && regexMethodNames.has(property);
 }
-export function getRegexMember(target, property, budget) {
+export function getRegexMember(target, property, budget, context) {
     if (property === "source")
         return escapeRegexSource(target.source, budget);
     if (property === "flags") {
-        const flags = [..."gims"].filter((flag) => target.flags.includes(flag)).join("");
-        return budget === undefined ? flags : budget.allocateString(flags);
+        let flags = "";
+        const entries = Object.entries(regexFlagProperties);
+        const release = retainValues(budget, () => [target, flags]);
+        const read = (index) => {
+            if (index === entries.length)
+                return budget.allocateString(flags);
+            budget.visitNode();
+            const [key, flag] = entries[index];
+            const descriptor = context?.getProperty === undefined
+                ? getSandboxPropertyDescriptor(target, key, budget) : undefined;
+            const value = context?.getProperty !== undefined
+                ? context.getProperty(target, key)
+                : descriptor !== undefined
+                    ? readPropertyDescriptor(descriptor, target, context)
+                    : target.flags.includes(flag);
+            const append = (value) => {
+                if (value)
+                    flags += flag;
+                return read(index + 1);
+            };
+            return value instanceof Promise ? value.then(append) : append(value);
+        };
+        try {
+            const result = read(0);
+            if (result instanceof Promise)
+                return result.finally(release);
+            release();
+            return result;
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
     }
     if (property === "lastIndex")
         return target.lastIndex;
@@ -27,7 +89,7 @@ export function getRegexMember(target, property, budget) {
     }
     return createSandboxClosure({
         sandbox: true,
-        name: `RegExp#${property}`,
+        name: property === "toString" ? "toString" : `RegExp#${property}`,
         call: (args, context) => callRegexMethod(context?.thisValue, property, args, budget, context)
     });
 }
@@ -66,9 +128,9 @@ function escapeRegexSource(source, budget) {
     text = text === "" ? "(?:)" : text;
     return budget === undefined ? text : budget.allocateString(text);
 }
-export function setRegexMember(target, property, value) {
+export function setRegexMember(target, property, value, budget) {
     const properties = getRegexProperties(target);
-    if (!Object.hasOwn(properties, property) &&
+    if (!hasExplicitSandboxPrototype(target) && getSandboxPrototype(target, budget) === null && !Object.hasOwn(properties, property) &&
         (property === "source" || property === "flags" || Object.hasOwn(regexFlagProperties, property))) {
         throw new TypeError(`RegExp#${String(property)} is not writable.`);
     }
@@ -76,6 +138,8 @@ export function setRegexMember(target, property, value) {
         throw new TypeError(`RegExp#${String(property)} is not writable.`);
 }
 export async function callRegexMethod(target, methodName, args, budget, context) {
+    if (methodName === "toString")
+        return regexToString(target, budget, context);
     if (target === null || typeof target !== "object" || (methodName === "exec" && !isSandboxRegex(target))) {
         throw new TypeError(`RegExp#${methodName} requires ${methodName === "exec" ? "a regex" : "an object"} receiver.`);
     }
@@ -86,29 +150,71 @@ export async function callRegexMethod(target, methodName, args, budget, context)
     try {
         const input = await sandboxString(args[0], budget, context);
         if (methodName === "test") {
-            const exec = context?.getProperty === undefined
-                ? getSandboxDataProperty(target, "exec", budget) : await context.getProperty(target, "exec");
-            if (isSandboxClosure(exec)) {
-                const result = await invokeBuiltinClosure(exec, [input], budget, context, target);
-                if (result !== null && typeof result !== "object") {
-                    throw new TypeError("RegExp#test exec must return an object or null.");
-                }
-                return result !== null;
-            }
+            budget.setRetainedValues(retained, undefined);
+            return await regexExec(target, input, budget, context) !== null;
         }
-        if (!isSandboxRegex(target))
-            throw new TypeError("RegExp execution requires a regex receiver.");
         if (typeof args[0] !== "string")
             convertedInput = input;
+        if (!isSandboxRegex(target))
+            throw new TypeError("RegExp execution requires a regex receiver.");
         cursor = target.lastIndex;
         const lastIndex = await sandboxNumber(cursor, budget, context);
         const match = executeRegex(target, input, lastIndex);
-        return methodName === "test" ? match !== null : toMatchArray(match, input);
+        return toMatchArray(match, input);
     }
     finally {
         budget.setRetainedValues(retained, undefined);
     }
 }
+export async function regexExec(target, input, budget, context) {
+    let exec;
+    const release = retainValues(budget, () => [target, input, exec]);
+    try {
+        const descriptor = context?.getProperty === undefined
+            ? getSandboxPropertyDescriptor(target, "exec", budget) : undefined;
+        exec = await (context?.getProperty !== undefined ? context.getProperty(target, "exec")
+            : descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, target, context));
+        if (isSandboxClosure(exec)) {
+            const result = await invokeBuiltinClosure(exec, [input], budget, context, target);
+            if (result !== null && typeof result !== "object")
+                throw new TypeError("RegExp exec must return an object or null.");
+            return result;
+        }
+        return await callRegexMethod(target, "exec", [input], budget, context);
+    }
+    finally {
+        release();
+    }
+}
+export async function regexToString(target, budget, context) {
+    if (target === null || typeof target !== "object")
+        throw new TypeError("RegExp#toString requires an object receiver.");
+    const read = (key) => {
+        if (context?.getProperty !== undefined)
+            return context.getProperty(target, key);
+        const descriptor = getSandboxPropertyDescriptor(target, key, budget);
+        if (descriptor !== undefined)
+            return readPropertyDescriptor(descriptor, target, context);
+        return isSandboxRegex(target) ? getRegexMember(target, key, budget, context) : undefined;
+    };
+    let sourceValue;
+    let flagsValue;
+    let source;
+    let flags;
+    const release = retainValues(budget, () => [target, sourceValue, flagsValue, source, flags]);
+    try {
+        sourceValue = await read("source");
+        source = await sandboxString(sourceValue, budget, context);
+        sourceValue = undefined;
+        flagsValue = await read("flags");
+        flags = await sandboxString(flagsValue, budget, context);
+        flagsValue = undefined;
+        return budget.allocateString(`/${source}/${flags}`);
+    }
+    finally {
+        release();
+    }
+}
 export function executeRegex(target, input, lastIndex) {
     const pattern = getSandboxRegexPattern(target);
     const match = matchRegex(pattern, input, lastIndex);

package/packages/safe-js/dist/interp/methods/regexp-iterator.d.ts

@@ -0,0 +1,8 @@
+import type { Budget } from "../budget.js";
+import { type SandboxRegExpIterator } from "../regexp-iterator.js";
+import { type SandboxValue } from "../values.js";
+export declare function nextRegExpIterator(iterator: SandboxRegExpIterator, budget?: Budget): {
+    value: SandboxValue;
+    done: boolean;
+};
+export declare function getRegExpIteratorMember(property: PropertyKey, budget: Budget): SandboxValue;

package/packages/safe-js/dist/interp/methods/regexp-iterator.js

@@ -0,0 +1,49 @@
+import { isSandboxRegExpIterator, regexpIteratorState } from "../regexp-iterator.js";
+import { createSandboxClosure } from "../values.js";
+import { executeRegex, toMatchArray } from "./regex.js";
+export function nextRegExpIterator(iterator, budget) {
+    const state = regexpIteratorState(iterator);
+    budget?.visitNode();
+    if (state.exhausted)
+        return { value: undefined, done: true };
+    const matcher = state.matcher;
+    const input = state.input;
+    const match = executeRegex(matcher, input, Number(matcher.lastIndex));
+    if (match === null || !matcher.flags.includes("g")) {
+        state.exhausted = true;
+        state.matcher = undefined;
+        state.input = undefined;
+    }
+    if (match === null)
+        return { value: undefined, done: true };
+    if (!state.exhausted && match.text.length === 0) {
+        const index = Number(matcher.lastIndex);
+        const unicode = matcher.flags.includes("u") || matcher.flags.includes("v");
+        const codePoint = input.codePointAt(index);
+        matcher.lastIndex = index + (unicode && codePoint !== undefined && codePoint > 0xffff ? 2 : 1);
+    }
+    budget?.allocateArrayLength(match.captures.length + 1);
+    return { value: toMatchArray(match, input), done: false };
+}
+export function getRegExpIteratorMember(property, budget) {
+    if (property === Symbol.toStringTag)
+        return "RegExp String Iterator";
+    if (property === Symbol.iterator)
+        return createSandboxClosure({
+            sandbox: true,
+            name: "[Symbol.iterator]",
+            call: (_args, context) => context?.thisValue
+        });
+    if (property !== "next")
+        return undefined;
+    return createSandboxClosure({
+        sandbox: true,
+        name: "next",
+        call: (_args, context) => {
+            const receiver = context?.thisValue;
+            if (!isSandboxRegExpIterator(receiver))
+                throw new TypeError("RegExp string iterator next requires a matching receiver.");
+            return nextRegExpIterator(receiver, budget);
+        }
+    });
+}

package/packages/safe-js/dist/interp/methods/string.d.ts

@@ -9,4 +9,6 @@ export declare function getStringIndex(property: string | number): number | unde
 export declare function isStringMethodName(property: string | number): property is StringMethodName;
 export declare function validateStringMethodArguments(_methodName: StringMethodName, _args: readonly Expression[]): void;
 export declare function callStringMethod(value: SandboxValue, methodName: StringMethodName, args: readonly SandboxValue[], budget: Budget, callClosure?: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, parent?: CompileScope, context?: SandboxCallContext): SandboxValue | Promise<SandboxValue>;
+export declare function regexReplace(input: SandboxValue, regex: SandboxValue, replacementInput: SandboxValue, budget: Budget, callClosure: (closure: SandboxClosure, args: readonly SandboxValue[]) => Promise<SandboxValue>, context?: SandboxCallContext): Promise<string>;
+export declare function regexMatch(input: SandboxValue, regex: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
 export {};