poe-code 14.0.74 → 14.0.76

package/packages/safe-js/dist/interp/string-coercion.d.ts

@@ -1,6 +1,6 @@
 import type { Budget } from "./budget.js";
 import { type SandboxCallContext, type SandboxPrimitive, type SandboxValue } from "./values.js";
-export declare function sandboxNumber(value: SandboxValue, budget: Budget, context?: SandboxCallContext): number | Promise<number>;
+export declare function sandboxNumber(value: SandboxValue, budget: Budget, context?: SandboxCallContext, allowBigInt?: boolean): number | Promise<number>;
 export declare function sandboxString(value: SandboxValue, budget: Budget, context?: SandboxCallContext, joining?: Set<object>): string | Promise<string>;
 export declare function joinSandboxArray(value: SandboxValue & object, length: number, separator: string, budget: Budget, context?: SandboxCallContext, joining?: Set<object>): Promise<string>;
 export declare function objectToPrimitive(value: SandboxValue & object, budget: Budget, context: SandboxCallContext | undefined, joining: Set<object>, hint: "string" | "number" | "default", ordinary?: boolean): Promise<SandboxPrimitive>;

package/packages/safe-js/dist/interp/string-coercion.js

@@ -17,13 +17,18 @@ import { isSandboxClosure, isSandboxPromise, isSandboxMap, isSandboxSet, isSandb
 const defaultStringHook = Symbol("defaultStringHook");
 const defaultValueHook = Symbol("defaultValueHook");
 const joiningArrays = new WeakSet();
-export function sandboxNumber(value, budget, context) {
+export function sandboxNumber(value, budget, context, allowBigInt = false) {
+    const convert = (primitive) => {
+        if (typeof primitive === "bigint" && !allowBigInt)
+            throw new TypeError("Cannot convert a BigInt value to a number");
+        return Number(primitive);
+    };
     if (value === null || typeof value !== "object") {
         if (typeof value === "function")
             throw new TypeError("Expected a sandbox value.");
-        return Number(value);
+        return convert(value);
     }
-    return objectToPrimitive(value, budget, context, new Set(), "number").then(Number);
+    return objectToPrimitive(value, budget, context, new Set(), "number").then(convert);
 }
 export function sandboxString(value, budget, context, joining = new Set()) {
     if (typeof value === "symbol")

package/packages/safe-js/dist/interp/values.d.ts

@@ -15,7 +15,7 @@ declare const sandboxPromiseBrand: unique symbol;
 declare const sandboxRegexBrand: unique symbol;
 declare const sandboxRegexPattern: unique symbol;
 declare const sandboxRetainedValues: unique symbol;
-export type SandboxPrimitive = string | number | boolean | symbol | null | undefined;
+export type SandboxPrimitive = string | number | bigint | boolean | symbol | null | undefined;
 export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
 export type SandboxObject = {
     [key: string]: SandboxValue;

package/packages/safe-js/dist/interp/values.js

@@ -19,7 +19,7 @@ import { invokeCancelableClosure, readPromiseCancellation, registerPromiseCancel
 import { parseRegex } from "./regex/parse.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { sandboxErrorTypes } from "../error/shape.js";
-import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, isGuestClosure, isIntrinsicConstructor, registerGuestClosure } from "./object-model.js";
+import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, hasNullObjectPrototype, isGuestClosure, isIntrinsicConstructor, registerGuestClosure, setSandboxPrototype } from "./object-model.js";
 import { copySandboxArgumentProperties, createSandboxArguments, getSandboxArgumentEntries, isSandboxArguments } from "./arguments.js";
 export { createSandboxArguments, isSandboxArguments } from "./arguments.js";
 export { isSandboxMap, isSandboxSet } from "./collection-brands.js";
@@ -299,6 +299,10 @@ export function measureSandboxData(values, options = {}) {
     const seenSymbols = new Set();
     let usage = 0;
     const visit = (value, depth = 0) => {
+        if (typeof value === "bigint") {
+            usage += value.toString(16).length;
+            return;
+        }
         if (typeof value === "symbol") {
             if (!seenSymbols.has(value)) {
                 seenSymbols.add(value);
@@ -612,7 +616,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         const copy = restoreSandboxRegExpIterator({ matcher: undefined, input: undefined, exhausted: true });
         state.seen.set(value, copy);
         const matcher = copyToSandbox(snapshot.matcher, state, `${path}.<matcher>`, true, depth + 1);
-        if (matcher !== undefined && !isSandboxRegex(matcher))
+        if (matcher !== undefined && (snapshot.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
             throw new TypeError("Invalid RegExp iterator matcher.");
         restoreSandboxRegExpIterator({ ...snapshot, matcher }, copy);
         for (const entry of getEnumerableObjectEntries(value, path)) {
@@ -781,6 +785,8 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
             return existing;
         }
         const copy = createPlainObject(!cloneSandboxCollections || Object.getPrototypeOf(value) === null);
+        if (!state.structuredClone && hasNullObjectPrototype(value))
+            setSandboxPrototype(copy, null);
         state.seen.set(value, copy);
         const errorType = sandboxErrorTypes.get(value);
         if (errorType !== undefined)
@@ -978,7 +984,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
         if (existing !== undefined) {
             return existing;
         }
-        const copy = createPlainObject(Object.getPrototypeOf(value) === null);
+        const copy = createPlainObject(hasNullObjectPrototype(value) || Object.getPrototypeOf(value) === null);
         state.seen.set(value, copy);
         for (const entry of getEnumerableObjectEntries(value, path)) {
             defineOwnDataProperty(copy, entry.key, copyFromSandbox(entry.value, state, joinPath(path, entry.key), options, depth + 1));
@@ -992,6 +998,7 @@ function isSandboxPrimitive(value) {
         value === undefined ||
         typeof value === "string" ||
         typeof value === "number" ||
+        typeof value === "bigint" ||
         typeof value === "boolean" ||
         typeof value === "symbol");
 }

package/packages/safe-js/dist/lint/rules/AS-async-not-needed.js

@@ -229,6 +229,7 @@ class ASAsyncNotNeededScanner {
             case "MetaProperty":
             case "NullLiteral":
             case "NumericLiteral":
+            case "BigIntLiteral":
             case "RegexLiteral":
             case "StringLiteral":
             case "UndefinedLiteral":
@@ -539,6 +540,7 @@ function expressionContainsAwait(node) {
         case "MetaProperty":
         case "NullLiteral":
         case "NumericLiteral":
+        case "BigIntLiteral":
         case "RegexLiteral":
         case "StringLiteral":
         case "ThisExpression":

package/packages/safe-js/dist/lint/rules/AS-missing-async.js

@@ -213,6 +213,7 @@ class ASMissingAsyncScanner {
             case "MetaProperty":
             case "NullLiteral":
             case "NumericLiteral":
+            case "BigIntLiteral":
             case "RegexLiteral":
             case "StringLiteral":
             case "UndefinedLiteral":
@@ -509,6 +510,7 @@ function expressionContainsAwait(node) {
         case "MetaProperty":
         case "NullLiteral":
         case "NumericLiteral":
+        case "BigIntLiteral":
         case "RegexLiteral":
         case "StringLiteral":
         case "ThisExpression":

package/packages/safe-js/dist/lint/rules/known-globals.d.ts

@@ -1 +1 @@
-export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "Date", "Error", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "console"];
+export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "BigInt", "Date", "Error", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "console"];

package/packages/safe-js/dist/lint/rules/known-globals.js

@@ -2,6 +2,7 @@ export const KNOWN_RUNTIME_GLOBALS = [
     "AggregateError",
     "Array",
     "Boolean",
+    "BigInt",
     "Date",
     "Error",
     "Infinity",

package/packages/safe-js/dist/parse/parser.d.ts

@@ -26,6 +26,11 @@ export type NumericLiteral = BaseNode & {
     raw: string;
     value: number;
 };
+export type BigIntLiteral = BaseNode & {
+    type: "BigIntLiteral";
+    raw: string;
+    value: string;
+};
 export type StringLiteral = BaseNode & {
     type: "StringLiteral";
     raw: string;
@@ -390,7 +395,7 @@ export type ArrowFunctionExpression = BaseNode & {
     params: Array<AssignmentPattern | ArrayPattern | Identifier | ObjectPattern | RestElement>;
 };
 export type FunctionNode = ArrowFunctionExpression | FunctionDeclaration | FunctionExpression;
-export type Expression = ArrowFunctionExpression | AssignmentExpression | ArrayExpression | AwaitExpression | BinaryExpression | BooleanLiteral | CallExpression | ConditionalExpression | ClassExpression | FunctionExpression | Identifier | LogicalExpression | MemberExpression | MetaProperty | NewExpression | NewTargetExpression | NullLiteral | NumericLiteral | ObjectExpression | RegexLiteral | SequenceExpression | StringLiteral | SuperExpression | TaggedTemplateExpression | TemplateLiteral | ThisExpression | UnaryExpression | UpdateExpression | UndefinedLiteral | YieldExpression;
+export type Expression = ArrowFunctionExpression | AssignmentExpression | ArrayExpression | AwaitExpression | BinaryExpression | BooleanLiteral | CallExpression | ConditionalExpression | ClassExpression | FunctionExpression | Identifier | LogicalExpression | MemberExpression | MetaProperty | NewExpression | NewTargetExpression | NullLiteral | NumericLiteral | BigIntLiteral | ObjectExpression | RegexLiteral | SequenceExpression | StringLiteral | SuperExpression | TaggedTemplateExpression | TemplateLiteral | ThisExpression | UnaryExpression | UpdateExpression | UndefinedLiteral | YieldExpression;
 export type ParseResult = Expression | Statement;
 export declare function parse(source: string, filename?: string, owner?: CompileOwner): ParseResult;
 export declare function parseModule(source: string, filename?: string, owner?: CompileOwner): Module;

package/packages/safe-js/dist/parse/parser.js

@@ -3082,6 +3082,7 @@ function findImportMetaAssignmentInNode(node) {
         case "BooleanLiteral":
         case "NullLiteral":
         case "NumericLiteral":
+        case "BigIntLiteral":
         case "StringLiteral":
         case "ThisExpression":
         case "RegexLiteral":
@@ -3159,6 +3160,13 @@ function isYieldArgumentTerminator(value) {
     return value === ";" || value === "}" || value === ")" || value === "]" || value === ",";
 }
 function createNumericLiteral(token) {
+    if (token.value.endsWith("n"))
+        return {
+            type: "BigIntLiteral",
+            raw: token.value,
+            value: token.value.slice(0, -1).replaceAll("_", ""),
+            span: createTokenSpan(token)
+        };
     return {
         type: "NumericLiteral",
         raw: token.value,

package/packages/safe-js/dist/parse/tokenizer.js

@@ -480,7 +480,8 @@ class Lexer {
                 this.advance();
                 this.advance();
                 this.consumeDigitsForBase(isHexDigit, "hexadecimal");
-                this.rejectBigIntSuffix();
+                if (this.currentChar() === "n")
+                    this.advance();
                 this.rejectInvalidNumericLiteralContinuation();
                 return this.source.slice(start.offset, this.index);
             }
@@ -488,7 +489,8 @@ class Lexer {
                 this.advance();
                 this.advance();
                 this.consumeDigitsForBase(isBinaryDigit, "binary");
-                this.rejectBigIntSuffix();
+                if (this.currentChar() === "n")
+                    this.advance();
                 this.rejectInvalidNumericLiteralContinuation();
                 return this.source.slice(start.offset, this.index);
             }
@@ -496,7 +498,8 @@ class Lexer {
                 this.advance();
                 this.advance();
                 this.consumeDigitsForBase(isOctalDigit, "octal");
-                this.rejectBigIntSuffix();
+                if (this.currentChar() === "n")
+                    this.advance();
                 this.rejectInvalidNumericLiteralContinuation();
                 return this.source.slice(start.offset, this.index);
             }
@@ -512,6 +515,11 @@ class Lexer {
             }
         }
         this.consumeDecimalDigits();
+        if (this.currentChar() === "n") {
+            this.advance();
+            this.rejectInvalidNumericLiteralContinuation();
+            return this.source.slice(start.offset, this.index);
+        }
         if (this.currentChar() === "." && (this.peekChar(1) !== "." || this.peekChar(2) !== ".")) {
             this.advance();
             this.consumeOptionalDecimalDigits();
@@ -610,7 +618,7 @@ class Lexer {
     }
     rejectBigIntSuffix() {
         if (this.currentChar() === "n") {
-            this.syntaxError("BigInt not supported", this.position());
+            this.syntaxError("BigInt literals cannot contain a fraction or exponent", this.position());
         }
     }
     rejectInvalidNumericLiteralContinuation() {

package/packages/safe-js/dist/parse.d.ts

@@ -1,4 +1,4 @@
 import { type ParseResult as ParsedNode } from "./parse/parser.js";
 export { DisallowedSyntaxError } from "./parse/parser.js";
 export declare const parse: (source: string, filename?: string) => ParsedNode;
-export type { ArrayPattern, ArrayExpression, ArrowFunctionExpression, AssignmentExpression, AssignmentPattern, AssignmentProperty, AwaitExpression, BinaryExpression, BlockStatement, BooleanLiteral, BreakStatement, CallExpression, CatchClause, ClassBody, ClassDeclaration, ClassElement, ClassExpression, ClassNode, ConditionalExpression, ContinueStatement, DoWhileStatement, EmptyStatement, Expression, ExpressionStatement, ExportDefaultDeclaration, ExportNamedDeclaration, ImportDeclaration, ImportDefaultSpecifier, ImportNamespaceSpecifier, ImportSpecifier, ForInStatement, ForOfStatement, ForStatement, FunctionDeclaration, FunctionExpression, Identifier, IfStatement, LogicalExpression, MemberExpression, MetaProperty, NewExpression, NewTargetExpression, NullLiteral, NumericLiteral, ObjectExpression, ObjectPattern, ParseResult, PatternTarget, Property, RegexLiteral, RestElement, ReturnStatement, SequenceExpression, SourceSpan, SpreadElement, Statement, StringLiteral, SuperExpression, SwitchCase, SwitchStatement, TaggedTemplateExpression, TemplateElement, TemplateLiteral, ThisExpression, ThrowStatement, TryStatement, UnaryExpression, UndefinedLiteral, UpdateExpression, UpdateTarget, VariableDeclaration, VariableDeclarationKind, VariableDeclarator, WhileStatement } from "./parse/parser.js";
+export type { ArrayPattern, ArrayExpression, ArrowFunctionExpression, AssignmentExpression, AssignmentPattern, AssignmentProperty, AwaitExpression, BinaryExpression, BigIntLiteral, BlockStatement, BooleanLiteral, BreakStatement, CallExpression, CatchClause, ClassBody, ClassDeclaration, ClassElement, ClassExpression, ClassNode, ConditionalExpression, ContinueStatement, DoWhileStatement, EmptyStatement, Expression, ExpressionStatement, ExportDefaultDeclaration, ExportNamedDeclaration, ImportDeclaration, ImportDefaultSpecifier, ImportNamespaceSpecifier, ImportSpecifier, ForInStatement, ForOfStatement, ForStatement, FunctionDeclaration, FunctionExpression, Identifier, IfStatement, LogicalExpression, MemberExpression, MetaProperty, NewExpression, NewTargetExpression, NullLiteral, NumericLiteral, ObjectExpression, ObjectPattern, ParseResult, PatternTarget, Property, RegexLiteral, RestElement, ReturnStatement, SequenceExpression, SourceSpan, SpreadElement, Statement, StringLiteral, SuperExpression, SwitchCase, SwitchStatement, TaggedTemplateExpression, TemplateElement, TemplateLiteral, ThisExpression, ThrowStatement, TryStatement, UnaryExpression, UndefinedLiteral, UpdateExpression, UpdateTarget, VariableDeclaration, VariableDeclarationKind, VariableDeclarator, WhileStatement } from "./parse/parser.js";

package/packages/safe-js/dist/snapshot/bigint.d.ts

@@ -0,0 +1 @@
+export declare function validateBigIntData(value: unknown): asserts value is string;

package/packages/safe-js/dist/snapshot/bigint.js

@@ -0,0 +1,14 @@
+export function validateBigIntData(value) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new TypeError("Invalid BigInt snapshot value.");
+    if (value === "0")
+        return;
+    const start = value[0] === "-" ? 1 : 0;
+    if (start === value.length || value[start] === "0")
+        throw new TypeError("Invalid BigInt snapshot value.");
+    for (let index = start; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code < 48 || code > 57)
+            throw new TypeError("Invalid BigInt snapshot value.");
+    }
+}

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -4,7 +4,7 @@ import { isSandboxRegExpIterator, regexpIteratorState } from "../interp/regexp-i
 import { hasCustomRegexProperties, serializeRegexProperties } from "./regexp-properties.js";
 export const EXECUTION_SEMANTICS = "jobs-v8";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype } from "../interp/object-model.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "../interp/arguments.js";
 import { serializeArguments } from "./arguments.js";
@@ -58,6 +58,8 @@ function createDumpFile(snapshot) {
     return dumped;
 }
 function serializeDumpValue(value, path, state) {
+    if (typeof value === "bigint")
+        return { kind: "bigint", value: String(value) };
     if (typeof value === "symbol")
         return serializeSymbol(value, state.heapIds, state.heap);
     if (value === null || typeof value === "string" || typeof value === "boolean") {
@@ -110,10 +112,16 @@ function serializeHeapReference(value, path, state) {
         if (isSandboxRegExpIterator(value)) {
             const snapshot = regexpIteratorState(value);
             const matcher = snapshot.matcher;
+            const serializedMatcher = snapshot.global === undefined && isSandboxRegex(matcher)
+                ? { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) }
+                : serializeDumpValue(matcher, `${path}.<matcher>`, state);
+            if (serializedMatcher === SKIP_VALUE)
+                throw new TypeError("Unsupported RegExp iterator matcher in public dump.");
             const entries = Object.create(null);
             state.heap[String(id)] = {
                 kind: "regexp-iterator", exhausted: snapshot.exhausted,
-                matcher: matcher === undefined ? { kind: "undefined" } : { kind: "regex", source: matcher.source, flags: matcher.flags, lastIndex: Number(matcher.lastIndex) },
+                matcher: serializedMatcher,
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }),
                 input: snapshot.input ?? { kind: "undefined" }, entries,
                 symbolEntries: serializeSymbolProperties(value, entry => {
                     const serialized = serializeDumpValue(entry, `${path}.[symbol]`, state);
@@ -192,6 +200,7 @@ function serializeHeapReference(value, path, state) {
             });
             state.heap[String(id)] = {
                 kind: "object",
+                ...(hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {}),
                 entries: serializeObjectEntries(value, path, state),
                 ...(symbolEntries.length === 0 ? {} : { symbolEntries }),
                 ...(errorType === undefined ? {} : { errorType })
@@ -227,6 +236,7 @@ function indexHeapContainers(snapshot) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            hasNullObjectPrototype(value) ||
             ownSerializableSymbolKeys(value).length > 0 ||
             isSandboxBox(value) ||
             isSandboxRegExpIterator(value) ||

package/packages/safe-js/dist/snapshot/replay-data.d.ts

@@ -8,6 +8,9 @@ import { type SandboxClosure, type SandboxPromise, type SandboxValue } from "../
 import { type SerializedArguments } from "./arguments.js";
 type Atom = boolean | null | number | string | {
     tag: "undefined";
+} | {
+    tag: "bigint";
+    value: string;
 } | {
     tag: "number";
     value: "NaN" | "Infinity" | "-Infinity" | "-0";
@@ -32,6 +35,8 @@ type DataNode = {
     matcher: Atom;
     input: Atom;
     exhausted: boolean;
+    global?: boolean;
+    unicode?: boolean;
     properties: Properties;
     extensible: boolean;
     symbolEntries?: Array<SerializedSymbolProperty<Atom>>;
@@ -69,6 +74,7 @@ type DataNode = {
     symbolProperties?: Array<SerializedSymbolProperty<Atom>>;
     extensible: boolean;
     nullPrototype: boolean;
+    sandboxNullPrototype?: true;
     errorType?: SandboxErrorName;
 } | {
     kind: "arguments";

package/packages/safe-js/dist/snapshot/replay-data.js

@@ -1,10 +1,11 @@
 import { MAX_DATA_DEPTH } from "../graph-depth.js";
+import { validateBigIntData } from "./bigint.js";
 import { serializeRegexProperties, restoreRegexProperties } from "./regexp-properties.js";
 import { wellKnownSymbols } from "../interp/symbols.js";
 import { symbolData, serializeSymbolProperties } from "./symbols.js";
 import { isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshotCollectionIterator } from "../interp/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState, restoreSandboxRegExpIterator } from "../interp/regexp-iterator.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype, setSandboxPrototype } from "../interp/object-model.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
 import { decodeFloat32Storage, encodeFloat32Storage } from "./float32array.js";
@@ -29,6 +30,8 @@ export function encodeReplayData(value, options = {}) {
             return entry;
         if (entry === undefined)
             return { tag: "undefined" };
+        if (typeof entry === "bigint")
+            return { tag: "bigint", value: String(entry) };
         if (typeof entry === "symbol") {
             let id = symbols.get(entry);
             if (id === undefined) {
@@ -134,7 +137,8 @@ export function encodeReplayData(value, options = {}) {
             }
             let symbolIndex = 0;
             const symbolEntries = serializeSymbolProperties(entry, value => encode(value, depth + 1, [...path, { symbol: Math.floor(symbolIndex++ / 2) }]));
-            nodes[id] = { kind: "regexp-iterator", matcher: child(snapshot.matcher, "<matcher>"), input: child(snapshot.input, "<input>"), exhausted: snapshot.exhausted, properties, extensible: Object.isExtensible(entry), symbolEntries };
+            nodes[id] = { kind: "regexp-iterator", matcher: child(snapshot.matcher, "<matcher>"), input: child(snapshot.input, "<input>"), exhausted: snapshot.exhausted, properties, extensible: Object.isExtensible(entry), symbolEntries,
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }) };
         }
         else if (isSandboxCollectionIterator(entry)) {
             const snapshot = snapshotCollectionIterator(entry);
@@ -195,6 +199,7 @@ export function encodeReplayData(value, options = {}) {
             nodes[id] = {
                 kind: Array.isArray(entry) ? "array" : "object",
                 nullPrototype: prototype === null,
+                ...(hasNullObjectPrototype(entry) ? { sandboxNullPrototype: true } : {}),
                 ...(errorType === undefined ? {} : { errorType }),
                 extensible: Object.isExtensible(entry),
                 properties,
@@ -241,6 +246,11 @@ export function decodeReplayData(input, options = {}, parent) {
             }
             if (own(atom, "tag") === "undefined")
                 return undefined;
+            if (own(atom, "tag") === "bigint") {
+                const value = own(atom, "value");
+                validateBigIntData(value);
+                return BigInt(value);
+            }
             if (atom.tag === "number") {
                 switch (own(atom, "value")) {
                     case "NaN":
@@ -326,7 +336,7 @@ export function decodeReplayData(input, options = {}, parent) {
                     own(record(nodes[Number(payloadRecord.id)]), "kind") === "symbol";
                 if (typeof payload !== "number" && typeof payload !== "string" && typeof payload !== "boolean" &&
                     !symbolReference &&
-                    (payload === null || typeof payload !== "object" || own(record(payload), "tag") !== "number"))
+                    (payload === null || typeof payload !== "object" || !["number", "bigint"].includes(String(own(record(payload), "tag")))))
                     throw new TypeError("Invalid boxed primitive payload.");
                 const result = createSandboxBox(child(payload));
                 restored.set(id, result);
@@ -365,11 +375,14 @@ export function decodeReplayData(input, options = {}, parent) {
                 restored.set(id, result);
                 const matcher = child(own(node, "matcher"));
                 const input = child(own(node, "input"));
-                if (matcher !== undefined && !isSandboxRegex(matcher))
+                if ((node.global !== undefined || node.unicode !== undefined) && (typeof node.global !== "boolean" || typeof node.unicode !== "boolean"))
+                    throw new TypeError("Invalid replay RegExp iterator modes.");
+                if (matcher !== undefined && (node.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
                     throw new TypeError("Invalid replay RegExp iterator matcher.");
                 if (input !== undefined && typeof input !== "string")
                     throw new TypeError("Invalid replay RegExp iterator input.");
-                restoreSandboxRegExpIterator({ matcher, input, exhausted }, result);
+                restoreSandboxRegExpIterator({ matcher, input, exhausted,
+                    ...(node.global === undefined ? {} : { global: node.global, unicode: node.unicode }) }, result);
                 defineProperties(result, record(own(node, "properties")), child, node.symbolEntries);
                 if (!node.extensible)
                     Object.preventExtensions(result);
@@ -450,6 +463,11 @@ export function decodeReplayData(input, options = {}, parent) {
                 throw new TypeError("Invalid replay object metadata.");
             }
             const result = kind === "array" ? [] : Object.create(node.nullPrototype ? null : Object.prototype);
+            if (Object.hasOwn(node, "sandboxNullPrototype")) {
+                if (kind !== "object" || node.sandboxNullPrototype !== true)
+                    throw new TypeError("Invalid replay object prototype.");
+                setSandboxPrototype(result, null);
+            }
             if (Object.hasOwn(node, "errorType")) {
                 sandboxErrorTypes.set(result, node.errorType);
             }

package/packages/safe-js/dist/snapshot/restore.js

@@ -234,6 +234,8 @@ function deserializeValue(value, state) {
     if (Array.isArray(value)) {
         return value.map((entry) => deserializeValue(entry, state));
     }
+    if (value.kind === "bigint" && typeof value.value === "string")
+        return BigInt(value.value);
     if (isSerializedUndefinedValue(value)) {
         return undefined;
     }
@@ -439,11 +441,12 @@ function restoreHeapValue(id, state) {
         state.heapValueById.set(id, iterator);
         const matcher = deserializeValue(serialized.matcher, state);
         const input = deserializeValue(serialized.input, state);
-        if (matcher !== undefined && !isSandboxRegex(matcher))
+        if (matcher !== undefined && (serialized.global === undefined ? !isSandboxRegex(matcher) : matcher === null || typeof matcher !== "object"))
             throw new TypeError("Invalid RegExp iterator matcher.");
         if (input !== undefined && typeof input !== "string")
             throw new TypeError("Invalid RegExp iterator input.");
-        restoreSandboxRegExpIterator({ matcher, input, exhausted: serialized.exhausted }, iterator);
+        restoreSandboxRegExpIterator({ matcher: matcher, input, exhausted: serialized.exhausted,
+            ...(serialized.global === undefined ? {} : { global: serialized.global, unicode: serialized.unicode }) }, iterator);
         for (const [key, entry] of Object.entries(serialized.entries))
             Object.defineProperty(iterator, key, { value: deserializeValue(entry, state), enumerable: true, configurable: true, writable: true });
         restoreSymbolProperties(iterator, serialized.symbolEntries, entry => deserializeValue(entry, state));
@@ -478,6 +481,11 @@ function restoreHeapValue(id, state) {
     }
     const object = Object.create(null);
     state.heapValueById.set(id, object);
+    if (Object.hasOwn(serialized, "sandboxNullPrototype")) {
+        if (serialized.sandboxNullPrototype !== true)
+            throw new TypeError("Invalid object prototype.");
+        setSandboxPrototype(object, null);
+    }
     if (serialized.errorType !== undefined)
         sandboxErrorTypes.set(object, serialized.errorType);
     for (const [key, entry] of Object.entries(serialized.entries)) {

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -54,6 +54,8 @@ export type SerializedHeapValue = {
     matcher: SerializedSnapshotValue;
     input: SerializedSnapshotValue;
     exhausted: boolean;
+    global?: boolean;
+    unicode?: boolean;
     entries: Record<string, SerializedSnapshotValue>;
     symbolEntries?: Array<SerializedSymbolProperty<SerializedSnapshotValue>>;
 } | SerializedSymbol | BoxedData<SerializedSnapshotValue> | ({
@@ -73,6 +75,7 @@ export type SerializedHeapValue = {
     entries: Record<string, SerializedSnapshotValue>;
 }) | SerializedArguments<SerializedSnapshotValue> | SerializedArray<SerializedSnapshotValue> | {
     kind: "object";
+    sandboxNullPrototype?: true;
     entries: Record<string, SerializedSnapshotValue>;
     symbolEntries?: Array<SerializedSymbolProperty<SerializedSnapshotValue>>;
     errorType?: SandboxErrorName;
@@ -102,7 +105,7 @@ export type RuntimePromiseValue = {
     id: SnapshotId;
     promise?: Promise<unknown>;
 };
-export type RuntimeSnapshotValue = symbol | SandboxBox | Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
+export type RuntimeSnapshotValue = bigint | symbol | SandboxBox | Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
     [key: string]: RuntimeSnapshotValue;
 };
 export type RuntimeScopeFrame = {

package/packages/safe-js/dist/snapshot/serialize.js

@@ -3,7 +3,7 @@ import { hasCustomRegexProperties, serializeRegexProperties } from "./regexp-pro
 import { ownSerializableSymbolKeys, serializeSymbol, serializeSymbolProperties } from "./symbols.js";
 import { collectionIteratorState, isSandboxCollectionIterator, snapshotCollectionIterator } from "../interp/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState } from "../interp/regexp-iterator.js";
-import { hasGuestObjectState } from "../interp/object-model.js";
+import { hasGuestObjectState, hasNullObjectPrototype } from "../interp/object-model.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { assertSnapshotGraphDepth } from "../graph-depth.js";
 import { serializeArguments } from "./arguments.js";
@@ -116,6 +116,8 @@ function serializeValue(value, path, state) {
                     : "-Infinity"
         };
     }
+    if (typeof value === "bigint")
+        return { kind: "bigint", value: String(value) };
     if (Array.isArray(value)) {
         const reference = serializeHeapReference(value, path, state);
         if (reference !== undefined) {
@@ -220,6 +222,7 @@ function serializeHeapReference(value, path, state) {
             const entries = Object.create(null);
             state.heap[String(id)] = {
                 kind: "regexp-iterator", matcher: serializeValue(snapshot.matcher, `${path}.<matcher>`, state),
+                ...(snapshot.global === undefined ? {} : { global: snapshot.global, unicode: snapshot.unicode }),
                 input: serializeValue(snapshot.input, `${path}.<input>`, state), exhausted: snapshot.exhausted, entries,
                 symbolEntries: serializeSymbolProperties(value, entry => serializeValue(entry, `${path}.[symbol]`, state))
             };
@@ -283,6 +286,7 @@ function serializeHeapReference(value, path, state) {
             const errorType = sandboxErrorTypes.get(value);
             const serializedObject = {
                 kind: "object",
+                ...(hasNullObjectPrototype(value) ? { sandboxNullPrototype: true } : {}),
                 entries,
                 ...(errorType === undefined ? {} : { errorType })
             };
@@ -359,6 +363,7 @@ function indexHeapContainers(input) {
     for (const [value, stat] of stats.entries()) {
         if (stat.count > 1 ||
             stat.cyclic ||
+            hasNullObjectPrototype(value) ||
             ownSerializableSymbolKeys(value).length > 0 ||
             (isSandboxRegex(value) && (hasCustomRegexProperties(value) || !Number.isSafeInteger(value.lastIndex) ||
                 (typeof value.lastIndex === "number" && value.lastIndex < 0) || Object.is(value.lastIndex, -0))) ||

package/packages/safe-js/dist/snapshot/validation.js

@@ -1,4 +1,5 @@
 import { replaceErrorStack, sandboxErrorNames } from "../error/shape.js";
+import { validateBigIntData } from "./bigint.js";
 import { validateRegexProperties } from "./regexp-properties.js";
 import { wellKnownSymbols } from "../interp/symbols.js";
 import { types } from "node:util";
@@ -115,6 +116,8 @@ function validateDumpHeap(root, state) {
             continue;
         }
         if (entry.kind === "object") {
+            if (Object.hasOwn(entry, "sandboxNullPrototype") && entry.sandboxNullPrototype !== true)
+                fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
             requireRecord(entry.entries, `${path}.entries`);
             continue;
         }
@@ -355,6 +358,15 @@ function validateValue(value, path, depth, state) {
 }
 function validateTaggedValue(record, path, state) {
     switch (record.kind) {
+        case "bigint":
+            requireString(record.value, `${path}.value`, state.limits);
+            try {
+                validateBigIntData(record.value);
+            }
+            catch {
+                fail("invalidValue", `${path}.value`, "invalid BigInt value");
+            }
+            return;
         case "undefined":
             return;
         case "number":
@@ -394,7 +406,11 @@ function validateTaggedValue(record, path, state) {
             return;
         case "array":
         case "arguments":
+            return;
         case "object":
+            if (Object.hasOwn(record, "sandboxNullPrototype") && record.sandboxNullPrototype !== true)
+                fail("invalidValue", `${path}.sandboxNullPrototype`, "invalid object prototype");
+            return;
         case "map":
         case "set":
         case "collection-iterator":
@@ -474,6 +490,8 @@ function validateHeapValue(value, path, state, heap) {
     if (record.kind === "set")
         requireArray(record.values, `${path}.values`, state);
     if (record.kind === "regexp-iterator") {
+        if ((record.global !== undefined || record.unicode !== undefined) && (typeof record.global !== "boolean" || typeof record.unicode !== "boolean"))
+            fail("invalidValue", path, "invalid RegExp iterator modes");
         if (typeof record.exhausted !== "boolean")
             fail("invalidValue", `${path}.exhausted`, "invalid iterator exhaustion");
         if (!Object.hasOwn(record, "matcher") || !Object.hasOwn(record, "input"))
@@ -539,6 +557,15 @@ function validateBoxedRecord(record, path, heap) {
     if (typeof value === "number" || typeof value === "string" || typeof value === "boolean")
         return;
     const number = requireRecord(value, `${path}.value`);
+    if (number.kind === "bigint") {
+        try {
+            validateBigIntData(number.value);
+        }
+        catch {
+            fail("invalidValue", `${path}.value`, "invalid boxed BigInt payload");
+        }
+        return;
+    }
     if (number.kind === "ref") {
         const id = requireSafeInteger(number.id, `${path}.value.id`, 1);
         const target = requireRecord(heap[String(id)], `${path}.value`);