poe-code 14.0.74 → 14.0.75

package/packages/safe-js/dist/chunks/{chunk-YEZOXLY4.js → chunk-EOTY4PCT.js}

@@ -711,7 +711,7 @@ var RegexCompileGuard = class {
     this.work(flags.length);
   }
   retain(pattern, valueUnits = 0) {
-    const units = 10 + pattern.source.length + measureNode(pattern.body);
+    const units = measurePattern(pattern);
     if (this.ticket !== void 0) {
       this.ticket.owner.budget.resizeCompileTicket(this.ticket, units + valueUnits);
     }
@@ -728,7 +728,15 @@ var RegexCompileGuard = class {
   }
 };
 function regexCompiledData(pattern) {
-  return compiledData.get(pattern) ?? { units: 10 + pattern.source.length + measureNode(pattern.body) };
+  return compiledData.get(pattern) ?? { units: measurePattern(pattern) };
+}
+function measurePattern(pattern) {
+  let units = 10 + pattern.source.length + measureNode(pattern.body);
+  if (pattern.groups !== void 0) {
+    units += 1;
+    for (const [name, indices] of Object.entries(pattern.groups)) units += name.length + 2 + indices.length;
+  }
+  return units;
 }
 function measureNode(node) {
   switch (node.type) {
@@ -737,13 +745,18 @@ function measureNode(node) {
       return 2;
     case "literal":
       return 3 + node.value.length;
+    case "namedBackreference":
+      return 3 + node.name.length;
     case "anchor":
     case "wordBoundary":
+    case "backreference":
       return 3;
     case "characterClass": {
       let usage = 5 + node.items.length;
+      if (node.operation !== void 0) usage += 1 + node.operation.length;
+      if (node.strings !== void 0) usage += 1;
       for (const item of node.items) {
-        usage += item.type === "character" ? 3 + item.value.length : item.type === "range" ? 4 + item.from.length + item.to.length : 4;
+        usage += item.type === "character" ? 3 + item.value.length : item.type === "range" ? 4 + item.from.length + item.to.length : item.type === "property" ? 4 + item.value.length + (item.strings === void 0 ? 0 : 1) : item.type === "set" ? 3 + measureNode({ type: "characterClass", ...item.value }) : item.type === "strings" ? 4 + item.values.reduce((total, value) => total + 1 + value.length, 0) : 4;
       }
       return usage;
     }
@@ -755,7 +768,10 @@ function measureNode(node) {
       return usage;
     }
     case "group":
-      return 5 + measureNode(node.body);
+      return 5 + measureNode(node.body) + (node.name === void 0 ? 0 : 1 + node.name.length) + (node.modifiers === void 0 ? 0 : 2 + Object.keys(node.modifiers).length);
+    case "lookahead":
+    case "lookbehind":
+      return 4 + measureNode(node.body);
     case "quantifier":
       return (Object.hasOwn(node, "max") ? 6 : 5) + measureNode(node.body);
   }
@@ -2045,6 +2061,8 @@ function createIdentifier(token, name) {
 }
 
 // packages/safe-js/src/interp/regex/parse.ts
+var groupNameStart = /^[$_\p{ID_Start}]$/u;
+var groupNamePart = /^[$\u200c\u200d\p{ID_Continue}]$/u;
 function parseRegex(source, flags = "", compilation, valueUnits = 0) {
   const guard = new RegexCompileGuard(compilation);
   try {
@@ -2052,10 +2070,11 @@ function parseRegex(source, flags = "", compilation, valueUnits = 0) {
     guard.checkLength(flags.length, true);
     guard.allocate(5 + valueUnits);
     const parsedFlags = parseFlags(flags, guard);
-    const parser = new RegexParser(source, guard);
+    const parser = new RegexParser(source, guard, parsedFlags.unicode || parsedFlags.unicodeSets, parsedFlags.unicodeSets);
     const body = parser.parse();
     guard.allocate(5 + source.length);
     const pattern = { source, flags: parsedFlags, captureCount: parser.captureCount, body };
+    if (Object.keys(parser.namedGroups).length > 0) pattern.groups = parser.namedGroups;
     guard.retain(pattern, valueUnits);
     return pattern;
   } finally {
@@ -2063,14 +2082,21 @@ function parseRegex(source, flags = "", compilation, valueUnits = 0) {
   }
 }
 var RegexParser = class {
-  constructor(source, guard) {
+  constructor(source, guard, unicode, unicodeSets) {
     this.source = source;
     this.guard = guard;
+    this.unicode = unicode;
+    this.unicodeSets = unicodeSets;
   }
   source;
   guard;
+  unicode;
+  unicodeSets;
   captureCount = 0;
   cursor = 0;
+  totalCaptureCount;
+  hasNamedCaptures = false;
+  namedGroups = /* @__PURE__ */ Object.create(null);
   get position() {
     return this.cursor;
   }
@@ -2086,6 +2112,7 @@ var RegexParser = class {
       }
       this.fail(`Unexpected character '${this.peek()}'`);
     }
+    if (this.unicode || Object.keys(this.namedGroups).length > 0) this.validateNamedGroups(body);
     return body;
   }
   parseAlternation() {
@@ -2119,15 +2146,20 @@ var RegexParser = class {
   parseQuantifiedAtom() {
     const quantifierStart = this.position;
     const current = this.peek();
-    if (current === "*" || current === "+" || current === "?" || current === "{") {
+    if (current === "*" || current === "+" || current === "?" || current === "{" && this.unicode) {
       this.fail("Nothing to repeat", quantifierStart);
     }
+    if (current === "{") {
+      const quantifier2 = this.parseQuantifier();
+      this.position = quantifierStart;
+      if (quantifier2 !== void 0) this.fail("Nothing to repeat", quantifierStart);
+    }
     const body = this.parseAtom();
     const quantifier = this.parseQuantifier();
     if (quantifier === void 0) {
       return body;
     }
-    if (body.type === "anchor" || body.type === "wordBoundary") {
+    if (body.type === "anchor" || body.type === "wordBoundary" || body.type === "lookbehind" || this.unicode && body.type === "lookahead") {
       this.fail("Invalid quantifier target", quantifierStart);
     }
     const greedy = this.peek() !== "?";
@@ -2138,7 +2170,7 @@ var RegexParser = class {
     return { type: "quantifier", body, ...quantifier, greedy };
   }
   parseAtom() {
-    const character = this.take();
+    const character = this.takeCharacter();
     switch (character) {
       case ".":
         this.guard.allocate(2);
@@ -2156,12 +2188,17 @@ var RegexParser = class {
       case "\\":
         return this.parseEscape(false, this.position - 1);
       default:
+        if (this.unicode && (character === "]" || character === "}")) this.fail("Invalid Unicode pattern character");
         this.guard.allocate(3 + character.length);
         return { type: "literal", value: character };
     }
   }
   parseGroup(start) {
     let capturing = true;
+    let name;
+    let modifiers;
+    let assertionNegated;
+    let lookbehind = false;
     if (this.peek() === "?") {
       this.guard.allocate(Math.min(3, this.source.length - this.position));
       this.guard.work(Math.min(3, this.source.length - this.position));
@@ -2170,17 +2207,33 @@ var RegexParser = class {
         capturing = false;
         this.position += 2;
       } else if (extension.startsWith("?=") || extension.startsWith("?!")) {
-        this.fail("Lookahead is not supported", start);
+        capturing = false;
+        assertionNegated = extension.startsWith("?!");
+        this.position += 2;
       } else if (extension.startsWith("?<=") || extension.startsWith("?<!")) {
-        this.fail("Lookbehind is not supported", start);
+        capturing = false;
+        assertionNegated = extension.startsWith("?<!");
+        lookbehind = true;
+        this.position += 3;
       } else if (extension.startsWith("?<")) {
-        this.fail("Named groups are not supported", start);
+        this.position += 2;
+        name = this.parseGroupName(start);
+      } else if ("ims-".includes(extension[1] ?? "") && extension.length > 1) {
+        capturing = false;
+        this.position++;
+        modifiers = this.parseModifiers(start);
       } else {
         this.fail("Unsupported group construct", start);
       }
     }
     if (capturing) this.guard.allocate(1);
     const index = capturing ? ++this.captureCount : void 0;
+    if (name !== void 0) {
+      this.guard.allocate(name.length + 2);
+      const indices = this.namedGroups[name] ??= [];
+      this.guard.array(indices.length + 1);
+      indices.push(index);
+    }
     this.guard.enterGroup();
     let body;
     try {
@@ -2192,10 +2245,40 @@ var RegexParser = class {
       this.fail("Unterminated group", start);
     }
     this.position += 1;
+    if (assertionNegated !== void 0) {
+      this.guard.allocate(4);
+      return { type: lookbehind ? "lookbehind" : "lookahead", negated: assertionNegated, body };
+    }
     this.guard.allocate(5);
-    return { type: "group", capturing, index, body };
+    return {
+      type: "group",
+      capturing,
+      index,
+      body,
+      ...name === void 0 ? {} : { name },
+      ...modifiers === void 0 ? {} : { modifiers }
+    };
+  }
+  parseModifiers(start) {
+    this.guard.allocate(2);
+    const modifiers = {};
+    let enabled = true;
+    while (!this.atEnd() && this.peek() !== ":") {
+      const flag = this.take();
+      if (flag === "-" && enabled) {
+        enabled = false;
+        continue;
+      }
+      const name = flag === "i" ? "ignoreCase" : flag === "m" ? "multiline" : flag === "s" ? "dotAll" : void 0;
+      if (name === void 0 || Object.hasOwn(modifiers, name)) this.fail("Invalid regex modifiers", start);
+      this.guard.allocate(1);
+      modifiers[name] = enabled;
+    }
+    if (this.take() !== ":" || Object.keys(modifiers).length === 0) this.fail("Invalid regex modifiers", start);
+    return modifiers;
   }
   parseCharacterClass(start) {
+    if (this.unicodeSets) return { type: "characterClass", ...this.parseUnicodeSet(start) };
     const negated = this.peek() === "^";
     if (negated) {
       this.position += 1;
@@ -2215,9 +2298,13 @@ var RegexParser = class {
         this.position += 1;
         const right = this.parseClassItem(start);
         if (left.type !== "character" || right.type !== "character") {
-          this.fail("Character class ranges require literal endpoints", rangePosition);
+          if (this.unicode) this.fail("Character class ranges require literal endpoints", rangePosition);
+          this.guard.array(items.length + 3);
+          this.guard.allocate(4);
+          items.push(left, { type: "character", value: "-" }, right);
+          continue;
         }
-        if (left.value.charCodeAt(0) > right.value.charCodeAt(0)) {
+        if (left.value.codePointAt(0) > right.value.codePointAt(0)) {
           this.fail("Character class range is out of order", rangePosition);
         }
         this.guard.allocate(4 + left.value.length + right.value.length);
@@ -2246,26 +2333,193 @@ var RegexParser = class {
       this.fail("Unsupported character class escape", escapeStart);
     }
     this.guard.allocate(4);
-    return { type: "character", value: this.take() };
+    return { type: "character", value: this.takeCharacter() };
+  }
+  parseUnicodeSet(start) {
+    this.guard.enterGroup();
+    try {
+      const negated = this.peek() === "^";
+      if (negated) this.position++;
+      this.guard.allocate(5);
+      const items = [];
+      let operation;
+      while (!this.atEnd() && this.peek() !== "]") {
+        this.guard.array(items.length + 1);
+        let item = this.parseUnicodeSetItem(start);
+        if (this.peek() === "-" && this.source[this.position + 1] !== "-") {
+          this.position++;
+          const right = this.parseUnicodeSetItem(start);
+          if (item.type !== "character" || right.type !== "character") this.fail("Invalid set range", start);
+          if (item.value.codePointAt(0) > right.value.codePointAt(0)) this.fail("Set range is out of order", start);
+          this.guard.allocate(4 + item.value.length + right.value.length);
+          item = { type: "range", from: item.value, to: right.value };
+        }
+        if (operation !== void 0 && item.type === "range") this.fail("Set operations require nested ranges", start);
+        items.push(item);
+        const operator = this.source.slice(this.position, this.position + 2);
+        if (operator === "&&" || operator === "--") {
+          const next = operator === "&&" ? "intersection" : "subtraction";
+          if (operation === void 0 && (items.length !== 1 || item.type === "range") || operation !== void 0 && operation !== next) this.fail("Mixed set operations", start);
+          if (operation === void 0) this.guard.allocate(1 + next.length);
+          operation = next;
+          this.position += 2;
+          if (this.peek() === "]" || this.atEnd()) this.fail("Missing set operand", start);
+        } else if (operation !== void 0 && this.peek() !== "]") this.fail("Missing set operator", start);
+      }
+      if (this.take() !== "]") this.fail("Unterminated character set", start);
+      const mayContainStrings = (item) => {
+        if (item.type === "set") return item.value.strings === true;
+        if (item.type === "property") return item.strings === true;
+        if (item.type === "strings") return item.values.some((value) => value.length !== ((value.codePointAt(0) ?? 0) > 65535 ? 2 : 1));
+        return false;
+      };
+      const strings = operation === "intersection" ? items.every(mayContainStrings) : operation === "subtraction" ? mayContainStrings(items[0]) : items.some(mayContainStrings);
+      if (negated && strings) this.fail("Cannot complement a set containing strings", start);
+      if (strings) this.guard.allocate(1);
+      return { negated, items, ...operation === void 0 ? {} : { operation }, ...strings ? { strings: true } : {} };
+    } finally {
+      this.guard.leaveGroup();
+    }
+  }
+  parseUnicodeSetItem(start) {
+    if (this.peek() === "[") {
+      this.position++;
+      this.guard.allocate(3);
+      return { type: "set", value: this.parseUnicodeSet(start) };
+    }
+    if (this.source.startsWith("\\q{", this.position)) {
+      this.position += 3;
+      this.guard.allocate(4);
+      const values = [];
+      let value2 = "";
+      while (!this.atEnd()) {
+        if (this.peek() === "|" || this.peek() === "}") {
+          this.guard.array(values.length + 1);
+          this.guard.allocate(1);
+          values.push(value2);
+          value2 = "";
+          if (this.take() === "}") return { type: "strings", values };
+        } else {
+          const item = this.parseSetCharacter(start);
+          this.guard.allocate(item.length);
+          value2 += item;
+        }
+      }
+      this.fail("Unterminated class string", start);
+    }
+    if (this.peek() === "\\") return this.parseClassItem(start);
+    const value = this.parseSetCharacter(start);
+    this.guard.allocate(3 + value.length);
+    return { type: "character", value };
+  }
+  parseSetCharacter(start) {
+    if (this.peek() === "\\") {
+      this.position++;
+      const node = this.parseEscape(true, start);
+      if (node.type !== "literal") this.fail("Class strings require literal characters", start);
+      return node.value;
+    }
+    const character = this.takeCharacter();
+    if (!character || "()[]{}/-|".includes(character) || "!#$%&*+,.:;<=>?@^`~".includes(character) && this.peek() === character)
+      this.fail("Invalid character in Unicode set", start);
+    return character;
   }
   parseEscape(inCharacterClass, start) {
     if (this.atEnd()) {
       this.fail("Trailing escape", start);
     }
     const escaped = this.take();
-    if (escaped >= "1" && escaped <= "9") {
-      this.fail("Backreferences are not supported", start);
-    }
-    if (escaped === "p" || escaped === "P") {
-      this.fail("Unicode property escapes are not supported", start);
+    if (escaped === "k") {
+      this.totalCaptureCount ??= this.countAllCaptures();
+      if (this.unicode || this.hasNamedCaptures) {
+        if (inCharacterClass || this.take() !== "<") this.fail("Invalid named backreference", start);
+        const name = this.parseGroupName(start);
+        this.guard.allocate(3 + name.length);
+        return { type: "namedBackreference", name };
+      }
+    }
+    if (isDecimalDigit2(escaped)) {
+      if (!inCharacterClass && escaped !== "0") {
+        let end = this.position;
+        let index = Number(escaped);
+        while (isDecimalDigit2(this.source[end] ?? "")) {
+          this.guard.work(1);
+          index = index * 10 + Number(this.source[end++]);
+        }
+        this.totalCaptureCount ??= this.countAllCaptures();
+        if (index <= this.totalCaptureCount) {
+          this.position = end;
+          this.guard.allocate(3);
+          return { type: "backreference", index };
+        }
+      }
+      if (this.unicode && (escaped !== "0" || isDecimalDigit2(this.peek())))
+        this.fail("Invalid decimal escape", start);
+      this.guard.allocate(4);
+      if (escaped === "8" || escaped === "9") return { type: "literal", value: escaped };
+      let code = Number(escaped);
+      const maximum = escaped <= "3" ? 3 : 2;
+      for (let digits = 1; digits < maximum && this.peek() >= "0" && this.peek() <= "7"; digits++) {
+        code = code * 8 + Number(this.take());
+      }
+      return { type: "literal", value: String.fromCharCode(code) };
+    }
+    if (this.unicode && (escaped === "p" || escaped === "P")) {
+      if (this.take() !== "{") this.fail("Invalid Unicode property escape", start);
+      const begin = this.position;
+      while (!this.atEnd() && this.peek() !== "}") {
+        const character = this.take();
+        if (!isDecimalDigit2(character) && !(character >= "a" && character <= "z") && !(character >= "A" && character <= "Z") && character !== "_" && character !== "=")
+          this.fail("Invalid Unicode property escape", start);
+      }
+      this.guard.allocate(this.position - begin + 9);
+      const value = this.source.slice(begin, this.position);
+      if (this.take() !== "}") this.fail("Unterminated Unicode property escape", start);
+      try {
+        new RegExp(`\\${escaped}{${value}}`, this.unicodeSets ? "v" : "u");
+      } catch {
+        this.fail("Unknown Unicode property", start);
+      }
+      let strings = false;
+      if (this.unicodeSets) {
+        try {
+          new RegExp(`\\p{${value}}`, "u");
+        } catch {
+          strings = true;
+        }
+      }
+      this.guard.array(1);
+      return { type: "characterClass", negated: false, items: [{ type: "property", value, negated: escaped === "P", ...strings ? { strings: true } : {} }] };
     }
     if (escaped === "x") {
       this.guard.allocate(4);
-      return { type: "literal", value: this.parseHexEscape(2, "hexadecimal", start) };
+      return { type: "literal", value: this.parseHexEscape(2, "hexadecimal", start, this.unicode ? void 0 : "x") };
     }
     if (escaped === "u") {
       this.guard.allocate(4);
-      return { type: "literal", value: this.parseHexEscape(4, "Unicode", start) };
+      if (this.unicode && this.peek() === "{") {
+        this.position++;
+        const begin = this.position;
+        while (!this.atEnd() && this.peek() !== "}") this.position++;
+        this.guard.allocate(this.position - begin);
+        const digits = this.source.slice(begin, this.position);
+        const point = Number.parseInt(digits, 16);
+        if (this.take() !== "}" || digits.length === 0 || !allHexDigits(digits) || point > 1114111)
+          this.fail("Invalid Unicode escape", start);
+        return { type: "literal", value: String.fromCodePoint(point) };
+      }
+      let value = this.parseHexEscape(4, "Unicode", start, this.unicode ? void 0 : "u");
+      if (this.unicode && value.charCodeAt(0) >= 55296 && value.charCodeAt(0) <= 56319 && this.source.startsWith("\\u", this.position)) {
+        const digits = this.source.slice(this.position + 2, this.position + 6);
+        const point = Number.parseInt(digits, 16);
+        this.guard.work(digits.length);
+        this.guard.allocate(digits.length);
+        if (digits.length === 4 && allHexDigits(digits) && point >= 56320 && point <= 57343) {
+          value += String.fromCharCode(point);
+          this.position += 6;
+        }
+      }
+      return { type: "literal", value };
     }
     this.guard.allocate(25);
     const kinds = {
@@ -2296,20 +2550,101 @@ var RegexParser = class {
       v: "\v",
       "0": "\0"
     };
+    if (escaped === "c") {
+      const letter = this.peek();
+      this.guard.allocate(4);
+      if (letter >= "a" && letter <= "z" || letter >= "A" && letter <= "Z" || !this.unicode && inCharacterClass && (isDecimalDigit2(letter) || letter === "_")) {
+        this.position++;
+        return { type: "literal", value: String.fromCharCode(letter.charCodeAt(0) % 32) };
+      }
+      if (this.unicode) this.fail("Invalid control escape", start);
+      this.position--;
+      return { type: "literal", value: "\\" };
+    }
+    if (this.unicode && controls[escaped] === void 0 && !"^$\\.*+?()[]{}|/".includes(escaped) && !(inCharacterClass && (escaped === "-" || this.unicodeSets && "!#$%&+,.:;<=>?@`~".includes(escaped))))
+      this.fail("Invalid identity escape", start);
     this.guard.allocate(4);
     return { type: "literal", value: controls[escaped] ?? escaped };
   }
-  parseHexEscape(length, name, start) {
+  parseHexEscape(length, name, start, identity) {
     const end = this.position + length;
     this.guard.allocate(Math.min(length, this.source.length - this.position));
     this.guard.work(Math.min(length, this.source.length - this.position));
     const digits = this.source.slice(this.position, end);
     if (digits.length !== length || !allHexDigits(digits)) {
+      if (identity !== void 0) return identity;
       this.fail(`Invalid ${name} escape`, start);
     }
     this.position = end;
     return String.fromCharCode(Number.parseInt(digits, 16));
   }
+  countAllCaptures() {
+    let count = 0;
+    let escaped = false;
+    let characterClass = false;
+    for (let index = 0; index < this.source.length; index++) {
+      this.guard.work(1);
+      const character = this.source[index];
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === "[") characterClass = true;
+      else if (character === "]") characterClass = false;
+      else if (!characterClass && character === "(") {
+        const named = this.source[index + 1] === "?" && this.source[index + 2] === "<" && this.source[index + 3] !== "=" && this.source[index + 3] !== "!";
+        if (named) this.hasNamedCaptures = true;
+        if (named || this.source[index + 1] !== "?") count++;
+      }
+    }
+    return count;
+  }
+  parseGroupName(start) {
+    let name = "";
+    while (!this.atEnd() && this.peek() !== ">") {
+      let character = this.take();
+      if (character === "\\") {
+        if (this.take() !== "u") this.fail("Invalid group name escape", start);
+        if (this.peek() === "{") {
+          this.position++;
+          const begin = this.position;
+          while (!this.atEnd() && this.peek() !== "}") this.position++;
+          this.guard.allocate(this.position - begin);
+          const digits = this.source.slice(begin, this.position);
+          const point = Number.parseInt(digits, 16);
+          if (this.take() !== "}" || digits.length === 0 || !allHexDigits(digits) || point > 1114111)
+            this.fail("Invalid group name escape", start);
+          character = String.fromCodePoint(point);
+        } else character = this.parseHexEscape(4, "Unicode", start);
+      }
+      this.guard.allocate(character.length);
+      name += character;
+    }
+    if (this.take() !== ">" || name.length === 0) this.fail("Invalid group name", start);
+    let first = true;
+    for (const character of name) {
+      this.guard.work(1);
+      if (!(first ? groupNameStart : groupNamePart).test(character)) this.fail("Invalid group name", start);
+      first = false;
+    }
+    return name;
+  }
+  validateNamedGroups(node) {
+    this.guard.work(1);
+    this.guard.allocate(1);
+    const names = /* @__PURE__ */ new Set();
+    if (node.type === "namedBackreference" && !Object.hasOwn(this.namedGroups, node.name))
+      this.fail("Unknown named backreference");
+    if (node.type === "group" && node.name !== void 0) names.add(node.name);
+    const children = node.type === "sequence" ? node.elements : node.type === "alternation" ? node.alternatives : node.type === "group" || node.type === "quantifier" || node.type === "lookahead" || node.type === "lookbehind" ? [node.body] : [];
+    for (const child of children) {
+      for (const name of this.validateNamedGroups(child)) {
+        this.guard.work(1);
+        if (names.has(name) && node.type !== "alternation") this.fail("Duplicate capture group name");
+        this.guard.allocate(1);
+        names.add(name);
+      }
+    }
+    return names;
+  }
   parseQuantifier() {
     const character = this.peek();
     if (character === "*") {
@@ -2339,18 +2674,29 @@ var RegexParser = class {
     }
     if (this.peek() === "}") {
       this.position += 1;
+      if (!Number.isSafeInteger(min)) this.fail("Quantifier is too large", start);
       this.guard.allocate(3);
       return { min, max: min };
     }
     if (this.peek() !== ",") {
+      if (!this.unicode) {
+        this.position = start;
+        return void 0;
+      }
       this.fail("Invalid quantifier", start);
     }
     this.position += 1;
     const max = this.parseDecimal();
     if (this.peek() !== "}") {
+      if (!this.unicode) {
+        this.position = start;
+        return void 0;
+      }
       this.fail("Unterminated quantifier", start);
     }
     this.position += 1;
+    if (!Number.isSafeInteger(min) || max !== void 0 && !Number.isSafeInteger(max))
+      this.fail("Quantifier is too large", start);
     if (max !== void 0 && min > max) {
       this.fail("Quantifier range is out of order", start);
     }
@@ -2367,11 +2713,7 @@ var RegexParser = class {
     }
     this.guard.allocate(this.position - start);
     this.guard.work(this.position - start);
-    const value = Number(this.source.slice(start, this.position));
-    if (!Number.isSafeInteger(value)) {
-      this.fail("Quantifier is too large", start);
-    }
-    return value;
+    return Number(this.source.slice(start, this.position));
   }
   peek() {
     return this.source[this.position] ?? "";
@@ -2381,6 +2723,12 @@ var RegexParser = class {
     this.position += 1;
     return character;
   }
+  takeCharacter() {
+    if (!this.unicode || this.atEnd()) return this.take();
+    const character = String.fromCodePoint(this.source.codePointAt(this.position));
+    this.position += character.length;
+    return character;
+  }
   atEnd() {
     return this.position >= this.source.length;
   }
@@ -2391,16 +2739,24 @@ var RegexParser = class {
 function parseFlags(flags, guard) {
   guard.allocate(10);
   const parsed = {
+    hasIndices: false,
     global: false,
+    sticky: false,
+    unicode: false,
+    unicodeSets: false,
     ignoreCase: false,
     multiline: false,
     dotAll: false
   };
   const names = {
+    d: "hasIndices",
     g: "global",
     i: "ignoreCase",
     m: "multiline",
-    s: "dotAll"
+    s: "dotAll",
+    y: "sticky",
+    u: "unicode",
+    v: "unicodeSets"
   };
   for (let position = 0; position < flags.length; position += 1) {
     guard.work(1);
@@ -2414,6 +2770,7 @@ function parseFlags(flags, guard) {
     }
     parsed[name] = true;
   }
+  if (parsed.unicode && parsed.unicodeSets) throw new SyntaxError("Unicode flags u and v cannot be combined");
   return parsed;
 }
 function isDecimalDigit2(character) {
@@ -6723,9 +7080,13 @@ function isSandboxRegExpIterator(value) {
   return typeof value === "object" && value !== null && states2.has(value);
 }
 function restoreSandboxRegExpIterator(state, target = /* @__PURE__ */ Object.create(null)) {
+  if ((state.global !== void 0 || state.unicode !== void 0) && (typeof state.global !== "boolean" || typeof state.unicode !== "boolean"))
+    throw new TypeError("Invalid RegExp iterator modes.");
+  if (state.matcher !== void 0 && (state.matcher === null || typeof state.matcher !== "object"))
+    throw new TypeError("Invalid RegExp iterator matcher.");
   if (!state.exhausted && (state.matcher === void 0 || state.input === void 0))
     throw new TypeError("A live RegExp iterator requires its matcher and input.");
-  states2.set(target, state.exhausted ? { matcher: void 0, input: void 0, exhausted: true } : { ...state });
+  states2.set(target, state.exhausted ? { ...state, matcher: void 0, input: void 0, exhausted: true } : { ...state });
   return target;
 }
 function regexpIteratorState(value) {
@@ -7634,6 +7995,9 @@ function getSandboxPrototype(value, budget) {
 function hasExplicitSandboxPrototype(value) {
   return prototypes.has(value);
 }
+function hasNullObjectPrototype(value) {
+  return prototypes.get(value) === null && !Array.isArray(value) && !isSandboxClosure(value) && !isSandboxRegex(value);
+}
 function getSandboxPropertyDescriptor(value, key, budget) {
   const hostProperties = isSandboxClosure(value) ? value.properties : void 0;
   if (isSandboxClosure(value) && !isGuestClosure(value))
@@ -7715,7 +8079,7 @@ function hasGuestObjectState(value) {
   const intrinsicUnchanged = intrinsicConstructors.get(value);
   if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
-  if (functionProperties.has(value) || prototypes.has(value)) return true;
+  if (functionProperties.has(value) || prototypes.has(value) && !hasNullObjectPrototype(value)) return true;
   if (isSandboxBox(value) || isSandboxDate(value)) return false;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
@@ -7956,11 +8320,14 @@ function serializeHeapReference(value, path, state) {
     if (isSandboxRegExpIterator(value)) {
       const snapshot = regexpIteratorState(value);
       const matcher = snapshot.matcher;
+      const serializedMatcher = snapshot.global === void 0 && isSandboxRegex(matcher) ? { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) } : serializeDumpValue(matcher, `${path}.<matcher>`, state);
+      if (serializedMatcher === SKIP_VALUE) throw new TypeError("Unsupported RegExp iterator matcher in public dump.");
       const entries = /* @__PURE__ */ Object.create(null);
       state.heap[String(id)] = {
         kind: "regexp-iterator",
         exhausted: snapshot.exhausted,
-        matcher: matcher === void 0 ? { kind: "undefined" } : { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) },
+        matcher: serializedMatcher,
+        ...snapshot.global === void 0 ? {} : { global: snapshot.global, unicode: snapshot.unicode },
         input: snapshot.input ?? { kind: "undefined" },
         entries,
         symbolEntries: serializeSymbolProperties(value, (entry) => {
@@ -8033,6 +8400,7 @@ function serializeHeapReference(value, path, state) {
       });
       state.heap[String(id)] = {
         kind: "object",
+        ...hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {},
         entries: serializeObjectEntries(value, path, state),
         ...symbolEntries.length === 0 ? {} : { symbolEntries },
         ...errorType === void 0 ? {} : { errorType }
@@ -8066,7 +8434,7 @@ function indexHeapContainers(snapshot) {
   const heapIds = /* @__PURE__ */ new Map();
   let nextId = 1;
   for (const [value, stat2] of stats.entries()) {
-    if (stat2.count > 1 || stat2.cyclic || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat2.count > 1 || stat2.cyclic || hasNullObjectPrototype(value) || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -8252,6 +8620,8 @@ function validateDumpHeap(root, state) {
       continue;
     }
     if (entry.kind === "object") {
+      if (Object.hasOwn(entry, "sandboxNullPrototype") && entry.sandboxNullPrototype !== true)
+        fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
       requireRecord(entry.entries, `${path}.entries`);
       continue;
     }
@@ -8372,7 +8742,11 @@ function validateTaggedValue(record2, path, state) {
       return;
     case "array":
     case "arguments":
+      return;
     case "object":
+      if (Object.hasOwn(record2, "sandboxNullPrototype") && record2.sandboxNullPrototype !== true)
+        fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
+      return;
     case "map":
     case "set":
     case "collection-iterator":
@@ -8442,6 +8816,8 @@ function validateHeapValue(value, path, state, heap) {
   }
   if (record2.kind === "set") requireArray(record2.values, `${path}.values`, state);
   if (record2.kind === "regexp-iterator") {
+    if ((record2.global !== void 0 || record2.unicode !== void 0) && (typeof record2.global !== "boolean" || typeof record2.unicode !== "boolean"))
+      fail("invalidValue", path, "invalid RegExp iterator modes");
     if (typeof record2.exhausted !== "boolean") fail("invalidValue", `${path}.exhausted`, "invalid iterator exhaustion");
     if (!Object.hasOwn(record2, "matcher") || !Object.hasOwn(record2, "input")) fail("invalidValue", path, "missing RegExp iterator state");
     requireRecord(record2.entries, `${path}.entries`);
@@ -9290,15 +9666,17 @@ async function withRunResources(signal, execute) {
 
 // packages/safe-js/src/interp/regex/engine.ts
 function matchRegex(pattern, input, lastIndex = 0) {
-  const startIndex = pattern.flags.global ? normalizeLastIndex(lastIndex) : 0;
+  const startIndex = pattern.flags.global || pattern.flags.sticky ? normalizeLastIndex(lastIndex) : 0;
   return matchRegexFrom(pattern, input, startIndex);
 }
 function matchRegexFrom(pattern, input, startIndex) {
   if (startIndex > input.length) {
     return null;
   }
-  for (let attempt = startIndex; attempt <= input.length; attempt += 1) {
-    const context = { input, flags: pattern.flags, steps: 0 };
+  const unicode = pattern.flags.unicode || pattern.flags.unicodeSets;
+  if (unicode && startIndex > 0 && startIndex < input.length && input.charCodeAt(startIndex) >= 56320 && input.charCodeAt(startIndex) <= 57343 && input.charCodeAt(startIndex - 1) >= 55296 && input.charCodeAt(startIndex - 1) <= 56319) startIndex--;
+  for (let attempt = startIndex; attempt <= input.length; attempt = advanceStringIndex(input, attempt, unicode)) {
+    const context = { input, flags: pattern.flags, groups: pattern.groups, direction: 1, work: { steps: 0 } };
     charge(context);
     const initialState = {
       position: attempt,
@@ -9306,25 +9684,59 @@ function matchRegexFrom(pattern, input, startIndex) {
     };
     const result = matchNode(pattern.body, initialState, context).next();
     if (!result.done) {
-      return toRegexMatch(input, attempt, result.value);
+      return toRegexMatch(input, attempt, result.value, pattern.flags.hasIndices, pattern.groups);
     }
+    if (pattern.flags.sticky) break;
   }
   return null;
 }
 function* matchNode(node, state, context) {
   charge(context);
+  const unicode = context.flags.unicode || context.flags.unicodeSets;
+  const character = readCharacter(context.input, state.position, context.direction, unicode);
   switch (node.type) {
     case "empty":
       yield state;
       return;
     case "literal":
-      if (charactersEqual(context.input[state.position], node.value, context.flags.ignoreCase)) {
-        yield { ...state, position: state.position + 1 };
+      if (charactersEqual(character, node.value, context.flags.ignoreCase, unicode)) {
+        yield { ...state, position: state.position + context.direction * character.length };
+      }
+      return;
+    case "backreference":
+    case "namedBackreference": {
+      let capture;
+      if (node.type === "backreference") capture = state.captures[node.index - 1];
+      else {
+        for (const index of context.groups?.[node.name] ?? []) {
+          charge(context);
+          if (state.captures[index - 1] !== void 0) {
+            capture = state.captures[index - 1];
+            break;
+          }
+        }
+      }
+      if (capture === void 0) {
+        yield state;
+        return;
+      }
+      let position = state.position;
+      let reference = context.direction === 1 ? capture.start : capture.end;
+      const end = context.direction === 1 ? capture.end : capture.start;
+      while (reference !== end) {
+        charge(context);
+        const expected = readCharacter(context.input, reference, context.direction, unicode);
+        const actual = readCharacter(context.input, position, context.direction, unicode);
+        if (!charactersEqual(actual, expected, context.flags.ignoreCase, unicode)) return;
+        reference += context.direction * expected.length;
+        position += context.direction * actual.length;
       }
+      yield { ...state, position };
       return;
+    }
     case "dot":
-      if (state.position < context.input.length && (context.flags.dotAll || !isLineTerminator(context.input[state.position]))) {
-        yield { ...state, position: state.position + 1 };
+      if (character !== void 0 && (context.flags.dotAll || !isLineTerminator(character))) {
+        yield { ...state, position: state.position + context.direction * character.length };
       }
       return;
     case "anchor":
@@ -9333,17 +9745,24 @@ function* matchNode(node, state, context) {
       }
       return;
     case "wordBoundary": {
-      const previousWord = state.position > 0 && isWordCharacter(context.input[state.position - 1]);
-      const nextWord = state.position < context.input.length && isWordCharacter(context.input[state.position]);
+      const previousWord = state.position > 0 && matchesCharacterClassItem(context.input[state.position - 1], { type: "kind", kind: "word", negated: false }, context.flags.ignoreCase, unicode);
+      const nextWord = state.position < context.input.length && matchesCharacterClassItem(context.input[state.position], { type: "kind", kind: "word", negated: false }, context.flags.ignoreCase, unicode);
       if (previousWord !== nextWord !== node.negated) {
         yield state;
       }
       return;
     }
     case "characterClass": {
-      const character = context.input[state.position];
-      if (character !== void 0 && matchesCharacterClass(character, node.items, node.negated, context.flags.ignoreCase)) {
-        yield { ...state, position: state.position + 1 };
+      if (context.flags.unicodeSets) {
+        const lengths = [...matchUnicodeSet(node, state.position, context)].sort((a, b) => b - a);
+        for (const length of lengths) {
+          charge(context);
+          yield { ...state, position: state.position + context.direction * length };
+        }
+        return;
+      }
+      if (character !== void 0 && matchesCharacterClass(character, node.items, node.negated, context)) {
+        yield { ...state, position: state.position + context.direction * character.length };
       }
       return;
     }
@@ -9355,14 +9774,30 @@ function* matchNode(node, state, context) {
         yield* matchNode(alternative, cloneState(state), context);
       }
       return;
+    case "lookahead":
+    case "lookbehind": {
+      const result = matchNode(node.body, cloneState(state), {
+        ...context,
+        direction: node.type === "lookbehind" ? -1 : 1
+      }).next();
+      if (node.negated) {
+        if (result.done) yield state;
+      } else if (!result.done) {
+        yield { position: state.position, captures: result.value.captures };
+      }
+      return;
+    }
     case "group":
-      for (const result of matchNode(node.body, cloneState(state), context)) {
+      for (const result of matchNode(node.body, cloneState(state), node.modifiers === void 0 ? context : {
+        ...context,
+        flags: { ...context.flags, ...node.modifiers }
+      })) {
         if (!node.capturing || node.index === void 0) {
           yield result;
           continue;
         }
         const captures = result.captures.slice();
-        captures[node.index - 1] = { start: state.position, end: result.position };
+        captures[node.index - 1] = { start: Math.min(state.position, result.position), end: Math.max(state.position, result.position) };
         yield { position: result.position, captures };
       }
       return;
@@ -9376,7 +9811,8 @@ function* matchSequence(elements, index, state, context) {
     yield state;
     return;
   }
-  for (const result of matchNode(elements[index], state, context)) {
+  const element = elements[context.direction === 1 ? index : elements.length - 1 - index];
+  for (const result of matchNode(element, state, context)) {
     yield* matchSequence(elements, index + 1, result, context);
   }
 }
@@ -9412,11 +9848,28 @@ function matchesAnchor(kind, position, context) {
   }
   return position === context.input.length || context.flags.multiline && position < context.input.length && isLineTerminator(context.input[position]);
 }
-function matchesCharacterClass(character, items, negated, ignoreCase) {
-  const matched = items.some((item) => matchesCharacterClassItem(character, item, ignoreCase));
+function matchesCharacterClass(character, items, negated, context) {
+  const matched = items.some((item) => {
+    if (context.flags.unicode) charge(context);
+    return matchesCharacterClassItem(character, item, context.flags.ignoreCase, context.flags.unicode);
+  });
   return negated ? !matched : matched;
 }
-function matchesCharacterClassItem(character, item, ignoreCase) {
+function matchesCharacterClassItem(character, item, ignoreCase, unicode, unicodeSets = false) {
+  if (item.type === "strings" || item.type === "set") return false;
+  if (unicode) {
+    const hex = (value) => `\\u{${value.codePointAt(0).toString(16)}}`;
+    let atom;
+    if (item.type === "character") atom = hex(item.value);
+    else if (item.type === "range") atom = `[${hex(item.from)}-${hex(item.to)}]`;
+    else if (item.type === "property") atom = `\\${item.negated ? "P" : "p"}{${item.value}}`;
+    else {
+      const kind = item.kind === "digit" ? "d" : item.kind === "word" ? "w" : "s";
+      atom = `\\${item.negated ? kind.toUpperCase() : kind}`;
+    }
+    return new RegExp(`^(?:${atom})$`, (ignoreCase ? "i" : "") + (unicodeSets ? "v" : "u")).test(character);
+  }
+  if (item.type === "property") return false;
   if (item.type === "character") {
     return charactersEqual(character, item.value, ignoreCase);
   }
@@ -9430,22 +9883,102 @@ function matchesCharacterClassItem(character, item, ignoreCase) {
     if (!ignoreCase) {
       return false;
     }
-    const foldedCandidate = foldCharacter(character, true).charCodeAt(0);
-    const foldedFrom = foldCharacter(item.from, true).charCodeAt(0);
-    const foldedTo = foldCharacter(item.to, true).charCodeAt(0);
-    return foldedCandidate >= foldedFrom && foldedCandidate <= foldedTo;
+    return new RegExp(`^[\\u${from.toString(16).padStart(4, "0")}-\\u${to.toString(16).padStart(4, "0")}]$`, "i").test(character);
   }
   const matched = item.kind === "digit" ? isDigit(character) : item.kind === "word" ? isWordCharacter(character) : isSpaceCharacter(character);
   return item.negated ? !matched : matched;
 }
-function toRegexMatch(input, start, state) {
-  return {
+function matchUnicodeSet(set, position, context) {
+  charge(context);
+  let lengths = /* @__PURE__ */ new Set();
+  for (let index = 0; index < set.items.length; index++) {
+    const next = matchUnicodeSetItem(set.items[index], position, context);
+    if (index === 0) lengths = next;
+    else if (set.operation === void 0) {
+      for (const length of next) {
+        charge(context);
+        lengths.add(length);
+      }
+    } else {
+      for (const length of lengths) {
+        charge(context);
+        if (set.operation === "intersection" ? !next.has(length) : next.has(length)) lengths.delete(length);
+      }
+    }
+  }
+  if (set.negated) {
+    const character = readCharacter(context.input, position, context.direction, true);
+    return new Set(character !== void 0 && !lengths.has(character.length) ? [character.length] : []);
+  }
+  return lengths;
+}
+function matchUnicodeSetItem(item, position, context) {
+  charge(context);
+  if (item.type === "set") return matchUnicodeSet(item.value, position, context);
+  const lengths = /* @__PURE__ */ new Set();
+  if (item.type === "strings") {
+    for (const value of item.values) {
+      charge(context);
+      let reference = context.direction === 1 ? 0 : value.length;
+      let cursor = position;
+      const end = context.direction === 1 ? value.length : 0;
+      while (reference !== end) {
+        charge(context);
+        const expected = readCharacter(value, reference, context.direction, true);
+        const actual = readCharacter(context.input, cursor, context.direction, true);
+        if (!charactersEqual(actual, expected, context.flags.ignoreCase, true)) break;
+        reference += context.direction * expected.length;
+        cursor += context.direction * actual.length;
+      }
+      if (reference === end) lengths.add(Math.abs(cursor - position));
+    }
+    return lengths;
+  }
+  if (item.type === "property" && item.strings) {
+    const atom = `\\p{${item.value}}`;
+    const flags = (context.flags.ignoreCase ? "i" : "") + "v";
+    const matcher = new RegExp(context.direction === 1 ? atom : `(?<=(${atom}))`, flags + "y");
+    matcher.lastIndex = position;
+    const match = matcher.exec(context.input);
+    if (match === null) return lengths;
+    const longest = context.direction === 1 ? match[0] : match[1];
+    const member = new RegExp(`^(?:${atom})$`, flags);
+    let consumed = 0;
+    while (consumed < longest.length) {
+      charge(context);
+      const cursor = context.direction === 1 ? consumed : longest.length - consumed;
+      consumed += readCharacter(longest, cursor, context.direction, true).length;
+      const candidate = context.direction === 1 ? longest.slice(0, consumed) : longest.slice(longest.length - consumed);
+      if (member.test(candidate)) lengths.add(consumed);
+    }
+    return lengths;
+  }
+  const character = readCharacter(context.input, position, context.direction, true);
+  if (character !== void 0 && matchesCharacterClassItem(character, item, context.flags.ignoreCase, true, true))
+    lengths.add(character.length);
+  return lengths;
+}
+function toRegexMatch(input, start, state, hasIndices, groups) {
+  const match = {
     index: start,
     text: input.slice(start, state.position),
     captures: state.captures.map(
       (capture) => capture === void 0 ? void 0 : input.slice(capture.start, capture.end)
     )
   };
+  if (hasIndices) {
+    match.indices = [[start, state.position], ...state.captures.map((capture) => capture === void 0 ? void 0 : [capture.start, capture.end])];
+  }
+  if (groups !== void 0) {
+    match.groups = /* @__PURE__ */ Object.create(null);
+    if (hasIndices) match.indicesGroups = /* @__PURE__ */ Object.create(null);
+    for (const [name, indices] of Object.entries(groups)) {
+      const index = indices.find((index2) => state.captures[index2 - 1] !== void 0);
+      match.groups[name] = index === void 0 ? void 0 : match.captures[index - 1];
+      if (match.indicesGroups !== void 0) match.indicesGroups[name] = index === void 0 ? void 0 : match.indices[index];
+    }
+  }
+  return match;
 }
 function cloneState(state) {
   return { position: state.position, captures: state.captures.slice() };
@@ -9475,13 +10008,13 @@ function clearNodeCaptures(node, captures) {
     }
     return;
   }
-  if (node.type === "quantifier") {
+  if (node.type === "quantifier" || node.type === "lookahead" || node.type === "lookbehind") {
     clearNodeCaptures(node.body, captures);
   }
 }
 function charge(context) {
-  context.steps += 1;
-  allocateRegexSteps(context.steps);
+  context.work.steps += 1;
+  allocateRegexSteps(context.work.steps);
 }
 function normalizeLastIndex(lastIndex) {
   if (Number.isNaN(lastIndex) || lastIndex <= 0) {
@@ -9489,9 +10022,20 @@ function normalizeLastIndex(lastIndex) {
   }
   return Math.min(Math.floor(lastIndex), Number.MAX_SAFE_INTEGER);
 }
-function charactersEqual(left, right, ignoreCase) {
+function charactersEqual(left, right, ignoreCase, unicode = false) {
+  if (unicode && ignoreCase && left !== void 0)
+    return new RegExp(`^\\u{${right.codePointAt(0).toString(16)}}$`, "iu").test(left);
   return left !== void 0 && foldCharacter(left, ignoreCase) === foldCharacter(right, ignoreCase);
 }
+function advanceStringIndex(input, index, unicode) {
+  return index + (unicode && (input.codePointAt(index) ?? 0) > 65535 ? 2 : 1);
+}
+function readCharacter(input, position, direction, unicode) {
+  let index = direction === 1 ? position : position - 1;
+  if (index < 0 || index >= input.length) return void 0;
+  if (unicode && direction === -1 && index > 0 && input.charCodeAt(index) >= 56320 && input.charCodeAt(index) <= 57343 && input.charCodeAt(index - 1) >= 55296 && input.charCodeAt(index - 1) <= 56319) index--;
+  return unicode ? String.fromCodePoint(input.codePointAt(index)) : input[index];
+}
 function foldCharacter(character, ignoreCase) {
   if (!ignoreCase) {
     return character;
@@ -10067,7 +10611,7 @@ function callReplaceLikeMethod(value, methodName, args, budget, callClosure, use
   );
 }
 async function replaceRegex(value, regex, replacement, budget, callClosure, context) {
-  if (hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
+  if (getSandboxRegexPattern(regex).groups !== void 0 || hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
     return regexReplace(value, regex, replacement, budget, callClosure, context);
   if (regex.flags.includes("g")) regex.lastIndex = 0;
   const cursor = regex.lastIndex;
@@ -10117,7 +10661,7 @@ async function regexReplace(input, regex, replacementInput, budget, callClosure,
     input = void 0;
     replacement = isSandboxClosure(replacementInput) ? replacementInput : await sandboxString(replacementInput, budget, context);
     replacementInput = void 0;
-    if (isSandboxRegex(regex) && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
+    if (isSandboxRegex(regex) && getSandboxRegexPattern(regex).groups === void 0 && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
       release();
       return await replaceRegex(value, regex, replacement, budget, callClosure, context);
     }
@@ -10332,7 +10876,7 @@ function splitNormalized(value, separator, limit, budget, parent) {
       while (result2.length < limit) {
         const match = executeRegex(splitter, value, Number(splitter.lastIndex));
         if (match === null) break;
-        if (match.text.length === 0) splitter.lastIndex = match.index + 1;
+        if (match.text.length === 0) splitter.lastIndex = advanceStringIndex(value, match.index, splitter.flags.includes("u") || splitter.flags.includes("v"));
         endedWithZeroWidthMatch = match.text.length === 0 && match.index === value.length;
         if (match.text.length === 0 && (match.index === copiedThrough || match.index === value.length))
           continue;
@@ -10491,7 +11035,7 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
     return match?.index ?? -1;
   }
   if (methodName === "match" && !regex.flags.includes("g"))
-    return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value);
+    return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value, compilation.owner?.budget);
   if (methodName === "match") regex.lastIndex = 0;
   const matcher = methodName === "matchAll" ? createSandboxRegex(regex.source, regex.flags, normalizeLastIndex(lastIndex ?? Number(regex.lastIndex)), compilation) : regex;
   if (methodName === "matchAll")
@@ -10507,7 +11051,7 @@ function collectRegexMatches(regex, value, all, budget, lastIndex = 0) {
     budget?.allocateArrayLength(matches.length + 1);
     matches.push(match);
     lastIndex = match.index + match.text.length;
-    if (all && match.text.length === 0) regex.lastIndex = ++lastIndex;
+    if (all && match.text.length === 0) regex.lastIndex = lastIndex = advanceStringIndex(value, lastIndex, regex.flags.includes("u") || regex.flags.includes("v"));
   } while (all);
   return matches;
 }
@@ -16656,7 +17200,7 @@ async function callRegexMethod(target, methodName, args, budget, context) {
     cursor = target.lastIndex;
     const lastIndex = await sandboxNumber(cursor, budget, context);
     const match = executeRegex(target, input, lastIndex);
-    return toMatchArray(match, input);
+    return toMatchArray(match, input, budget);
   } finally {
     budget.setRetainedValues(retained, void 0);
   }
@@ -16707,17 +17251,26 @@ async function regexToString(target, budget, context) {
 function executeRegex(target, input, lastIndex) {
   const pattern = getSandboxRegexPattern(target);
   const match = matchRegex(pattern, input, lastIndex);
-  if (pattern.flags.global) {
+  if (pattern.flags.global || pattern.flags.sticky) {
     target.lastIndex = match === null ? 0 : match.index + match.text.length;
   }
   return match;
 }
-function toMatchArray(match, input) {
+function toMatchArray(match, input, budget) {
   if (match === null) {
     return null;
   }
+  budget?.allocateArrayLength(match.captures.length + 1);
   const result = [match.text, ...match.captures];
-  Object.assign(result, { index: match.index, input, groups: void 0 });
+  if (match.groups !== void 0) setSandboxPrototype(match.groups, null, budget);
+  if (match.indicesGroups !== void 0) setSandboxPrototype(match.indicesGroups, null, budget);
+  Object.assign(result, { index: match.index, input, groups: match.groups });
+  if (match.indices !== void 0) {
+    budget?.allocateArrayLength(match.indices.length);
+    budget?.allocateArrayLength(2);
+    Object.assign(match.indices, { groups: match.indicesGroups });
+    Object.assign(result, { indices: match.indices });
+  }
   return result;
 }
 
@@ -16727,9 +17280,10 @@ function nextRegExpIterator(iterator, budget) {
   budget?.visitNode();
   if (state.exhausted) return { value: void 0, done: true };
   const matcher = state.matcher;
+  if (!isSandboxRegex(matcher)) throw new TypeError("Custom RegExp iterator execution requires a sandbox context.");
   const input = state.input;
   const match = executeRegex(matcher, input, Number(matcher.lastIndex));
-  if (match === null || !matcher.flags.includes("g")) {
+  if (match === null || !(state.global ?? matcher.flags.includes("g"))) {
     state.exhausted = true;
     state.matcher = void 0;
     state.input = void 0;
@@ -16737,12 +17291,52 @@ function nextRegExpIterator(iterator, budget) {
   if (match === null) return { value: void 0, done: true };
   if (!state.exhausted && match.text.length === 0) {
     const index = Number(matcher.lastIndex);
-    const unicode = matcher.flags.includes("u") || matcher.flags.includes("v");
+    const unicode = state.unicode ?? (matcher.flags.includes("u") || matcher.flags.includes("v"));
     const codePoint = input.codePointAt(index);
     matcher.lastIndex = index + (unicode && codePoint !== void 0 && codePoint > 65535 ? 2 : 1);
   }
-  budget?.allocateArrayLength(match.captures.length + 1);
-  return { value: toMatchArray(match, input), done: false };
+  return { value: toMatchArray(match, input, budget), done: false };
+}
+async function nextObservableRegExpIterator(iterator, budget, context) {
+  const state = regexpIteratorState(iterator);
+  if (state.exhausted) return { value: void 0, done: true };
+  const matcher = state.matcher;
+  if (isSandboxRegex(matcher) && !hasRegexPropertyOverride(matcher, ["exec"], budget) && (matcher.lastIndex === null || typeof matcher.lastIndex !== "object"))
+    return nextRegExpIterator(iterator, budget);
+  const input = state.input;
+  let result;
+  let field;
+  const release = retainValues(budget, () => [iterator, matcher, input, result, field]);
+  const read = (value, key) => {
+    if (context.getProperty !== void 0) return context.getProperty(value, key);
+    const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+    return descriptor === void 0 ? void 0 : readPropertyDescriptor(descriptor, value, context);
+  };
+  try {
+    budget.visitNode();
+    result = await regexExec(matcher, input, budget, context);
+    const global = state.global ?? (isSandboxRegex(matcher) && matcher.flags.includes("g"));
+    if (result === null || !global) {
+      state.exhausted = true;
+      state.matcher = void 0;
+      state.input = void 0;
+      return result === null ? { value: void 0, done: true } : { value: result, done: false };
+    }
+    field = await read(result, "0");
+    const text = await sandboxString(field, budget, context);
+    field = void 0;
+    if (text.length === 0) {
+      field = await read(matcher, "lastIndex");
+      const index = normalizeLastIndex(await sandboxNumber(field, budget, context));
+      field = void 0;
+      const unicode = state.unicode ?? (isSandboxRegex(matcher) && (matcher.flags.includes("u") || matcher.flags.includes("v")));
+      const point = input.codePointAt(index);
+      await setSandboxProperty(matcher, "lastIndex", index + (unicode && point !== void 0 && point > 65535 ? 2 : 1), budget, true, context);
+    }
+    return { value: result, done: false };
+  } finally {
+    release();
+  }
 }
 function getRegExpIteratorMember(property, budget) {
   if (property === Symbol.toStringTag) return "RegExp String Iterator";
@@ -16759,7 +17353,7 @@ function getRegExpIteratorMember(property, budget) {
       const receiver = context?.thisValue;
       if (!isSandboxRegExpIterator(receiver))
         throw new TypeError("RegExp string iterator next requires a matching receiver.");
-      return nextRegExpIterator(receiver, budget);
+      return context === void 0 ? nextRegExpIterator(receiver, budget) : nextObservableRegExpIterator(receiver, budget, context);
     }
   });
 }
@@ -16947,8 +17541,11 @@ function getSandboxIterator(value, budget, context) {
   }
   if (isSandboxCollectionIterator(value))
     return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
-  if (isSandboxRegExpIterator(value))
+  if (isSandboxRegExpIterator(value)) {
+    if (context !== void 0 && budget !== void 0)
+      return { asynchronous: true, next: () => nextObservableRegExpIterator(value, budget, context), snapshotIndex: () => 0 };
     return { next: () => nextRegExpIterator(value, budget), snapshotIndex: () => 0 };
+  }
   if (isGuestHostObject(value)) return getHostObjectIterator(value);
   if (isFloat32Array(value)) {
     return syncIterator(Float32Array.prototype.values.call(value));
@@ -17755,7 +18352,16 @@ function encodeReplayData(value, options = {}) {
       }
       let symbolIndex = 0;
       const symbolEntries = serializeSymbolProperties(entry, (value2) => encode(value2, depth + 1, [...path, { symbol: Math.floor(symbolIndex++ / 2) }]));
-      nodes[id] = { kind: "regexp-iterator", matcher: child(snapshot.matcher, "<matcher>"), input: child(snapshot.input, "<input>"), exhausted: snapshot.exhausted, properties, extensible: Object.isExtensible(entry), symbolEntries };
+      nodes[id] = {
+        kind: "regexp-iterator",
+        matcher: child(snapshot.matcher, "<matcher>"),
+        input: child(snapshot.input, "<input>"),
+        exhausted: snapshot.exhausted,
+        properties,
+        extensible: Object.isExtensible(entry),
+        symbolEntries,
+        ...snapshot.global === void 0 ? {} : { global: snapshot.global, unicode: snapshot.unicode }
+      };
     } else if (isSandboxCollectionIterator(entry)) {
       const snapshot = snapshotCollectionIterator(entry);
       const properties = /* @__PURE__ */ Object.create(null);
@@ -17809,6 +18415,7 @@ function encodeReplayData(value, options = {}) {
       nodes[id] = {
         kind: Array.isArray(entry) ? "array" : "object",
         nullPrototype: prototype === null,
+        ...hasNullObjectPrototype(entry) ? { sandboxNullPrototype: true } : {},
         ...errorType === void 0 ? {} : { errorType },
         extensible: Object.isExtensible(entry),
         properties,
@@ -17953,9 +18560,15 @@ function decodeReplayData(input, options = {}, parent) {
         restored.set(id, result3);
         const matcher = child(own(node, "matcher"));
         const input2 = child(own(node, "input"));
-        if (matcher !== void 0 && !isSandboxRegex(matcher)) throw new TypeError("Invalid replay RegExp iterator matcher.");
+        if ((node.global !== void 0 || node.unicode !== void 0) && (typeof node.global !== "boolean" || typeof node.unicode !== "boolean")) throw new TypeError("Invalid replay RegExp iterator modes.");
+        if (matcher !== void 0 && (node.global === void 0 ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object")) throw new TypeError("Invalid replay RegExp iterator matcher.");
         if (input2 !== void 0 && typeof input2 !== "string") throw new TypeError("Invalid replay RegExp iterator input.");
-        restoreSandboxRegExpIterator({ matcher, input: input2, exhausted }, result3);
+        restoreSandboxRegExpIterator({
+          matcher,
+          input: input2,
+          exhausted,
+          ...node.global === void 0 ? {} : { global: node.global, unicode: node.unicode }
+        }, result3);
         defineProperties(result3, record(own(node, "properties")), child, node.symbolEntries);
         if (!node.extensible) Object.preventExtensions(result3);
         return result3;
@@ -18025,6 +18638,10 @@ function decodeReplayData(input, options = {}, parent) {
         throw new TypeError("Invalid replay object metadata.");
       }
       const result2 = kind === "array" ? [] : Object.create(node.nullPrototype ? null : Object.prototype);
+      if (Object.hasOwn(node, "sandboxNullPrototype")) {
+        if (kind !== "object" || node.sandboxNullPrototype !== true) throw new TypeError("Invalid replay object prototype.");
+        setSandboxPrototype(result2, null);
+      }
       if (Object.hasOwn(node, "errorType")) {
         sandboxErrorTypes.set(result2, node.errorType);
       }
@@ -21472,7 +22089,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     const copy = restoreSandboxRegExpIterator({ matcher: void 0, input: void 0, exhausted: true });
     state.seen.set(value, copy);
     const matcher = copyToSandbox(snapshot.matcher, state, `${path}.<matcher>`, true, depth + 1);
-    if (matcher !== void 0 && !isSandboxRegex(matcher)) throw new TypeError("Invalid RegExp iterator matcher.");
+    if (matcher !== void 0 && (snapshot.global === void 0 ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object")) throw new TypeError("Invalid RegExp iterator matcher.");
     restoreSandboxRegExpIterator({ ...snapshot, matcher }, copy);
     for (const entry of getEnumerableObjectEntries(value, path)) {
       defineOwnDataProperty(copy, entry.key, copyToSandbox(entry.value, state, joinPath2(path, entry.key), true, depth + 1));
@@ -21660,6 +22277,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     const copy = createPlainObject(
       !cloneSandboxCollections || Object.getPrototypeOf(value) === null
     );
+    if (!state.structuredClone && hasNullObjectPrototype(value)) setSandboxPrototype(copy, null);
     state.seen.set(value, copy);
     const errorType = sandboxErrorTypes.get(value);
     if (errorType !== void 0) sandboxErrorTypes.set(copy, errorType);
@@ -21871,7 +22489,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (existing !== void 0) {
       return existing;
     }
-    const copy = createPlainObject(Object.getPrototypeOf(value) === null);
+    const copy = createPlainObject(hasNullObjectPrototype(value) || Object.getPrototypeOf(value) === null);
     state.seen.set(value, copy);
     for (const entry of getEnumerableObjectEntries(value, path)) {
       defineOwnDataProperty(
@@ -34388,6 +35006,90 @@ function defineDataProperty2(target, key, value) {
   });
 }
 
+// packages/safe-js/src/interp/methods/regex-split.ts
+async function regexSplit(target, input, limit, constructor, budget, context) {
+  if (target === null || typeof target !== "object") throw new TypeError("RegExp split requires an object receiver.");
+  let string;
+  let species;
+  let field;
+  let flags;
+  let matcher;
+  let match;
+  const result = [];
+  const release = retainValues(budget, () => [target, input, limit, string, species, field, flags, matcher, match, result]);
+  const read = (value, key) => {
+    if (context?.getProperty !== void 0) return context.getProperty(value, key);
+    const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+    return descriptor === void 0 ? void 0 : readPropertyDescriptor(descriptor, value, context);
+  };
+  const append = (value) => {
+    budget.allocateArrayLength(result.length + 1);
+    result.push(value);
+  };
+  try {
+    string = await sandboxString(input, budget, context);
+    input = void 0;
+    field = await read(target, "constructor");
+    species = constructor;
+    if (field !== void 0) {
+      if (field === null || typeof field !== "object") throw new TypeError("Invalid RegExp species constructor.");
+      species = await read(field, Symbol.species);
+      if (species === null || species === void 0) species = constructor;
+    }
+    field = void 0;
+    if (!isSandboxClosure(species) || species.construct === void 0) throw new TypeError("RegExp species must be a constructor.");
+    field = await read(target, "flags");
+    flags = await sandboxString(field, budget, context);
+    field = void 0;
+    const unicode = flags.includes("u") || flags.includes("v");
+    if (!flags.includes("y")) flags = budget.allocateString(flags + "y");
+    matcher = await invokeBuiltinClosure(species, [target, flags], budget, context, void 0, true);
+    const maximum = limit === void 0 ? 2 ** 32 - 1 : await sandboxNumber(limit, budget, context) >>> 0;
+    limit = void 0;
+    if (maximum === 0) return result;
+    if (string.length === 0) {
+      match = await regexExec(matcher, string, budget, context);
+      if (match === null) append(string);
+      return result;
+    }
+    let end = 0;
+    let index = 0;
+    while (index < string.length) {
+      budget.visitNode();
+      match = void 0;
+      await setSandboxProperty(matcher, "lastIndex", index, budget, true, context);
+      match = await regexExec(matcher, string, budget, context);
+      if (match !== null) {
+        field = await read(matcher, "lastIndex");
+        const next = Math.min(normalizeLastIndex(await sandboxNumber(field, budget, context)), string.length);
+        field = void 0;
+        if (next !== end) {
+          append(budget.allocateString(string.slice(end, index)));
+          if (result.length === maximum) return result;
+          end = next;
+          field = await read(match, "length");
+          const length = normalizeLastIndex(await sandboxNumber(field, budget, context));
+          field = void 0;
+          for (let capture = 1; capture < length; capture++) {
+            budget.visitNode();
+            field = await read(match, String(capture));
+            append(field);
+            field = void 0;
+            if (result.length === maximum) return result;
+          }
+          index = end;
+          continue;
+        }
+      }
+      index += unicode && (string.codePointAt(index) ?? 0) > 65535 ? 2 : 1;
+    }
+    append(budget.allocateString(string.slice(end)));
+    return result;
+  } finally {
+    release();
+  }
+}
+
 // packages/safe-js/src/interp/globals/regex.ts
 function createRegexGlobals(options) {
   const invoke = (construct) => async (args, context) => {
@@ -34452,7 +35154,55 @@ function createRegexGlobals(options) {
     }
   };
   const constructor = createSandboxClosure({ guest: true, sandbox: true, name: "RegExp", length: 2, call: invoke(false), construct: invoke(true) });
+  Object.defineProperty(materializeFunctionProperties(constructor), "escape", {
+    value: createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: "escape",
+      length: 1,
+      call: (args) => {
+        const input = args[0];
+        if (typeof input !== "string") throw new TypeError("RegExp.escape requires a string.");
+        const allocation = {};
+        let escaped = "";
+        try {
+          for (const character of input) {
+            options.budget.visitNode();
+            const point = character.codePointAt(0);
+            let part = character;
+            if (escaped.length === 0 && (point >= 48 && point <= 57 || point >= 65 && point <= 90 || point >= 97 && point <= 122)) {
+              part = `\\x${point.toString(16)}`;
+            } else if ("^$\\.*+?()[]{}|/".includes(character)) {
+              part = "\\" + character;
+            } else {
+              const control = "\f\n\r	\v".indexOf(character);
+              if (control !== -1) part = "\\" + "fnrtv"[control];
+              else if (",-=<>#&!%:;@~'`\"".includes(character) || character.trim() === "" || point >= 55296 && point <= 57343) {
+                part = point <= 255 ? `\\x${point.toString(16).padStart(2, "0")}` : `\\u${point.toString(16).padStart(4, "0")}`;
+              }
+            }
+            options.budget.setRetainedDataUsage(allocation, escaped.length + part.length);
+            escaped = options.budget.allocateString(escaped + part);
+          }
+          return escaped;
+        } finally {
+          options.budget.setRetainedDataUsage(allocation, 0);
+        }
+      }
+    }),
+    writable: true,
+    configurable: true
+  });
   const prototype = /* @__PURE__ */ Object.create(null);
+  Object.defineProperty(materializeFunctionProperties(constructor), Symbol.species, {
+    get: accessorAdapter(createSandboxClosure({
+      sandbox: true,
+      name: "get [Symbol.species]",
+      length: 0,
+      call: (_args, context) => context?.thisValue
+    }), "get"),
+    configurable: true
+  });
   Object.defineProperty(materializeFunctionProperties(constructor), "prototype", { value: prototype, writable: false });
   Object.defineProperty(prototype, "constructor", { value: constructor, writable: true, configurable: true });
   Object.defineProperty(prototype, Symbol.search, {
@@ -34495,6 +35245,73 @@ function createRegexGlobals(options) {
     writable: true,
     configurable: true
   });
+  Object.defineProperty(prototype, Symbol.matchAll, {
+    value: createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: "[Symbol.matchAll]",
+      length: 1,
+      call: async (args, context) => {
+        const target = context?.thisValue;
+        if (target === null || typeof target !== "object") throw new TypeError("RegExp matchAll requires an object receiver.");
+        let input = args[0];
+        let string;
+        let species;
+        let field;
+        let flags;
+        let matcher;
+        const release = retainValues(options.budget, () => [target, input, string, species, field, flags, matcher]);
+        const read = (value, key) => {
+          if (context?.getProperty !== void 0) return context.getProperty(value, key);
+          const descriptor = getSandboxPropertyDescriptor(value, key, options.budget);
+          return descriptor === void 0 ? void 0 : readPropertyDescriptor(descriptor, value, context);
+        };
+        try {
+          string = await sandboxString(input, options.budget, context);
+          input = void 0;
+          field = await read(target, "constructor");
+          species = constructor;
+          if (field !== void 0) {
+            if (field === null || typeof field !== "object") throw new TypeError("Invalid RegExp species constructor.");
+            species = await read(field, Symbol.species);
+            if (species === null || species === void 0) species = constructor;
+          }
+          field = void 0;
+          if (!isSandboxClosure(species) || species.construct === void 0) throw new TypeError("RegExp species must be a constructor.");
+          field = await read(target, "flags");
+          flags = await sandboxString(field, options.budget, context);
+          field = void 0;
+          matcher = await invokeBuiltinClosure(species, [target, flags], options.budget, context, void 0, true);
+          field = await read(target, "lastIndex");
+          const cursor = normalizeLastIndex(await sandboxNumber(field, options.budget, context));
+          field = void 0;
+          await setSandboxProperty(matcher, "lastIndex", cursor, options.budget, true, context);
+          return restoreSandboxRegExpIterator({
+            matcher,
+            input: string,
+            exhausted: false,
+            global: flags.includes("g"),
+            unicode: flags.includes("u") || flags.includes("v")
+          });
+        } finally {
+          release();
+        }
+      }
+    }),
+    writable: true,
+    configurable: true
+  });
+  Object.defineProperty(prototype, Symbol.split, {
+    value: createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: "[Symbol.split]",
+      length: 2,
+      call: (args, context) => regexSplit(context?.thisValue, args[0], args[1], constructor, options.budget, context)
+    }),
+    writable: true,
+    configurable: true
+  });
   for (const name of ["exec", "test", "toString"]) {
     Object.defineProperty(prototype, name, {
       value: createSandboxClosure({
@@ -36839,4 +37656,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-YEZOXLY4.js.map
+//# sourceMappingURL=chunk-EOTY4PCT.js.map