poe-code 14.0.79 → 14.0.81

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-B3AL4KJ3.js";
+} from "./chunks/chunk-2LNBLFJ3.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-BGSPSHLP.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-BGSPSHLP.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/graph-depth.js

@@ -7,6 +7,7 @@ import { regexpIteratorState, isSandboxRegExpIterator } from "./interp/regexp-it
 import { isSandboxMap, isSandboxSet } from "./interp/collection-brands.js";
 import { boxedDataProperties, isSandboxBox } from "./interp/boxed.js";
 import { regexGuestProperties } from "./interp/regexp-properties.js";
+import { generatorGuestProperties } from "./interp/generator-properties.js";
 export const MAX_DATA_DEPTH = 1_024;
 export class SnapshotBudgetError extends Error {
     code = "budgetExceeded";
@@ -67,7 +68,7 @@ function walkGraphDepth(root, rootPath, assertDepth) {
     }
 }
 function graphEntries(value) {
-    const properties = regexGuestProperties.get(value);
+    const properties = regexGuestProperties.get(value) ?? generatorGuestProperties.get(value);
     if (properties !== undefined)
         return Reflect.ownKeys(properties).flatMap(key => {
             const descriptor = Object.getOwnPropertyDescriptor(properties, key);

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-B3AL4KJ3.js";
+} from "./chunks/chunk-2LNBLFJ3.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-BGSPSHLP.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/async.d.ts

@@ -70,7 +70,7 @@ export type EvaluateAsyncNode = (node: ParseResult, context: AsyncEvaluationCont
 export declare function emitResumeBreakpoint(context: AsyncEvaluationContext, breakpoint: ResumeBreakpoint): void;
 export declare function evaluateArrowFunctionExpression(node: ArrowFunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
 export declare function evaluateFunctionExpression(node: FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
-export declare function createInterpretedClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode, homeObject?: SandboxObject | SandboxClosure): SandboxClosure;
+export declare function createInterpretedClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode, homeObject?: SandboxObject | SandboxClosure, initializeGeneratorPrototype?: boolean): SandboxClosure;
 export declare function executeAsyncFunction(execute: (onSuspend: () => void) => Promise<SandboxValue>, budget: Budget, signal?: AbortSignal, callContext?: SandboxCallContext): import("./values.js").SandboxPromise;
 export declare function evaluateAwaitExpression(node: AwaitExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
 export declare function executeClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, args: readonly SandboxValue[], thisValue: SandboxValue, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<SandboxValue>;

package/packages/safe-js/dist/interp/async.js

@@ -7,7 +7,9 @@ import { CompileScope } from "./regex/compile-guard.js";
 import { awaitSandboxValue } from "./cancel.js";
 import { hoistVarDeclarations } from "./var-hoist.js";
 import { createCoercionContext, createPatternContext } from "./interpreter.js";
-import { getGuestFunctionProperty, setSandboxPrototype } from "./object-model.js";
+import { getGuestFunctionProperty, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { generatorPrototypes } from "./generator-prototypes.js";
+import { retainValues, runResources } from "./resources.js";
 import { functionSources } from "../parse/function-source.js";
 import { registerClosureOrigin, registerGeneratorOrigin } from "./closure-origin.js";
 import { boundIdentifiers, containsParameterExpression, getFunctionLength, hoistedVarDeclarations } from "../parse/bindings.js";
@@ -42,12 +44,12 @@ export async function evaluateFunctionExpression(node, context, evaluateNode) {
         value: closure
     };
 }
-export function createInterpretedClosure(node, context, evaluateNode, homeObject) {
+export function createInterpretedClosure(node, context, evaluateNode, homeObject, initializeGeneratorPrototype = true) {
     if (node.type !== "ArrowFunctionExpression") {
         context = { ...context, functionEnvironment: { homeObject } };
     }
     if (node.type !== "ArrowFunctionExpression" && node.generator) {
-        return createGeneratorClosure(node, context, evaluateNode);
+        return createGeneratorClosure(node, context, evaluateNode, initializeGeneratorPrototype);
     }
     const construct = node.type !== "ArrowFunctionExpression" &&
         !(node.type === "FunctionExpression" && node.method === true) &&
@@ -123,7 +125,9 @@ export function executeAsyncFunction(execute, budget, signal, callContext) {
     });
     return createSandboxPromise(promise, { synchronousPrefix });
 }
-function createGeneratorClosure(node, context, evaluateNode) {
+function createGeneratorClosure(node, context, evaluateNode, initializePrototype) {
+    const prototypes = !initializePrototype || runResources.getStore()?.functionSourceText === false ? undefined
+        : generatorPrototypes.get(context.budget)?.get(node.async === true);
     const closure = createSandboxClosure({
         sourceRange: functionSources.get(node),
         guest: true,
@@ -133,48 +137,66 @@ function createGeneratorClosure(node, context, evaluateNode) {
         ...(node.id === undefined ? { name: context.inferredName } : { name: node.id.name }),
         retainedValues: () => [...context.scope.retainedValues(), context.functionEnvironment?.homeObject, context.functionEnvironment?.newTarget],
         call: async (args, callContext) => {
-            const closureContext = {
-                ...context,
-                compilation: callContext?.compilation ?? context.compilation,
-                callStack: [...(callContext?.stack ?? context.callStack)]
-            };
-            const scope = await createClosureScope(node, args, callContext?.thisValue, closureContext, evaluateNode);
-            const channel = createGeneratorChannel((generatorYield) => {
-                const execute = async () => {
-                    const result = await evaluateNode(node.body, {
-                        ...closureContext,
-                        functionBody: node.body,
-                        asyncGenerator: node.async,
-                        generatorBlockScopes: new Map(),
-                        generatorExpressionStates: new Map(),
-                        captureGeneratorScope: (suspendedScope, blocks, completions, expressions) => {
-                            origin.suspendedScope = suspendedScope;
-                            origin.blockScopes = blocks;
-                            origin.finallyCompletions = completions;
-                            origin.expressionStates = expressions;
-                        },
-                        generatorYield: (value, yieldNodeId) => {
-                            generator.state = "suspended";
-                            return generatorYield(value, yieldNodeId);
-                        },
-                        scope
-                    });
-                    if (result.kind === "error") {
-                        throw result.error;
-                    }
-                    if (result.kind === "throw") {
-                        throw result.value;
-                    }
-                    const value = result.hasValue ? result.value : undefined;
-                    return node.async ? awaitSandboxValue(value, context.signal, context.budget, createCoercionContext(context)) : value;
+            // Native generators select their instance prototype before initializing parameters.
+            const candidate = prototypes === undefined ? undefined : getGuestFunctionProperty(closure, "prototype");
+            const prototype = typeof candidate === "object" && candidate !== null ? candidate : prototypes?.instancePrototype;
+            const releasePrototype = prototype === undefined ? undefined : retainValues(context.budget, () => [prototype]);
+            try {
+                const closureContext = {
+                    ...context,
+                    compilation: callContext?.compilation ?? context.compilation,
+                    callStack: [...(callContext?.stack ?? context.callStack)]
                 };
-                return node.async ? runAsyncPrefix(execute) : execute();
-            });
-            const generator = createSandboxGenerator(channel, { async: node.async });
-            const origin = registerGeneratorOrigin(generator, node, scope, closureContext);
-            return generator;
+                const scope = await createClosureScope(node, args, callContext?.thisValue, closureContext, evaluateNode);
+                const channel = createGeneratorChannel((generatorYield) => {
+                    const execute = async () => {
+                        const result = await evaluateNode(node.body, {
+                            ...closureContext,
+                            functionBody: node.body,
+                            asyncGenerator: node.async,
+                            generatorBlockScopes: new Map(),
+                            generatorExpressionStates: new Map(),
+                            captureGeneratorScope: (suspendedScope, blocks, completions, expressions) => {
+                                origin.suspendedScope = suspendedScope;
+                                origin.blockScopes = blocks;
+                                origin.finallyCompletions = completions;
+                                origin.expressionStates = expressions;
+                            },
+                            generatorYield: (value, yieldNodeId) => {
+                                generator.state = "suspended";
+                                return generatorYield(value, yieldNodeId);
+                            },
+                            scope
+                        });
+                        if (result.kind === "error") {
+                            throw result.error;
+                        }
+                        if (result.kind === "throw") {
+                            throw result.value;
+                        }
+                        const value = result.hasValue ? result.value : undefined;
+                        return node.async ? awaitSandboxValue(value, context.signal, context.budget, createCoercionContext(context)) : value;
+                    };
+                    return node.async ? runAsyncPrefix(execute) : execute();
+                });
+                const generator = createSandboxGenerator(channel, { async: node.async });
+                if (prototype !== undefined)
+                    setSandboxPrototype(generator, prototype, context.budget);
+                const origin = registerGeneratorOrigin(generator, node, scope, closureContext);
+                return generator;
+            }
+            finally {
+                releasePrototype?.();
+            }
         }
     });
+    if (prototypes !== undefined) {
+        const prototype = Object.create(null);
+        markDescriptorObject(prototype);
+        setSandboxPrototype(prototype, prototypes.instancePrototype);
+        Object.defineProperty(materializeFunctionProperties(closure), "prototype", { value: prototype, writable: true });
+        setSandboxPrototype(closure, prototypes.functionPrototype);
+    }
     registerClosureOrigin(closure, node, context);
     return closure;
 }

package/packages/safe-js/dist/interp/bound-function-state.d.ts

@@ -0,0 +1,7 @@
+import type { SandboxClosure, SandboxValue } from "./values.js";
+export type BoundFunctionState = {
+    target: SandboxClosure;
+    thisValue: SandboxValue;
+    args: SandboxValue[];
+};
+export declare const boundFunctionStates: WeakMap<object, BoundFunctionState>;

package/packages/safe-js/dist/interp/bound-function-state.js

@@ -0,0 +1 @@
+export const boundFunctionStates = new WeakMap();

package/packages/safe-js/dist/interp/bound-function.d.ts

@@ -0,0 +1,4 @@
+import { type SandboxClosure } from "./values.js";
+import { type BoundFunctionState } from "./bound-function-state.js";
+import type { FunctionMethodOptions } from "./methods/function.js";
+export declare function createBoundFunction(state: BoundFunctionState, name: string | undefined, length: number | undefined, callClosure: FunctionMethodOptions["callClosure"]): SandboxClosure;

package/packages/safe-js/dist/interp/bound-function.js

@@ -0,0 +1,18 @@
+import { createSandboxClosure } from "./values.js";
+import { boundFunctionStates } from "./bound-function-state.js";
+export function createBoundFunction(state, name, length, callClosure) {
+    const bound = createSandboxClosure({
+        guest: true,
+        sandbox: true,
+        name,
+        length,
+        boundTarget: state.target,
+        retainedValues: () => [state.target, state.thisValue, ...state.args, bound.name],
+        call: (args, context) => callClosure(state.target, [...state.args, ...args], context?.stack ?? [], state.thisValue),
+        ...(state.target.construct === undefined ? {} : {
+            construct: (args, context) => callClosure(state.target, [...state.args, ...args], context?.stack ?? [], undefined, true, context?.newTarget === bound ? state.target : context?.newTarget)
+        })
+    });
+    boundFunctionStates.set(bound, state);
+    return bound;
+}

package/packages/safe-js/dist/interp/generator-properties.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxGenerator, SandboxObject } from "./values.js";
+export declare const generatorGuestProperties: WeakMap<object, SandboxObject>;
+export declare function getGeneratorProperties(value: SandboxGenerator): SandboxObject;

package/packages/safe-js/dist/interp/generator-properties.js

@@ -0,0 +1,9 @@
+export const generatorGuestProperties = new WeakMap();
+export function getGeneratorProperties(value) {
+    let properties = generatorGuestProperties.get(value);
+    if (properties === undefined) {
+        properties = Object.create(null);
+        generatorGuestProperties.set(value, properties);
+    }
+    return properties;
+}

package/packages/safe-js/dist/interp/generator-prototypes.d.ts

@@ -0,0 +1,6 @@
+import type { Budget } from "./budget.js";
+import type { SandboxObject } from "./values.js";
+export declare const generatorPrototypes: WeakMap<Budget, Map<boolean, {
+    functionPrototype: SandboxObject;
+    instancePrototype: SandboxObject;
+}>>;

package/packages/safe-js/dist/interp/generator-prototypes.js

@@ -0,0 +1 @@
+export const generatorPrototypes = new WeakMap();

package/packages/safe-js/dist/interp/globals/function.d.ts

@@ -0,0 +1,2 @@
+import type { Budget } from "../budget.js";
+export declare function createFunctionPrototype(budget: Budget, installHasInstance?: boolean): void;

package/packages/safe-js/dist/interp/globals/function.js

@@ -0,0 +1,32 @@
+import { invokeBuiltinClosure } from "../builtin-call.js";
+import { callFunctionMethod } from "../methods/function.js";
+import { getSandboxPrototype, installFunctionPrototype, materializeFunctionProperties, registerIntrinsicFunction, setSandboxPrototype } from "../object-model.js";
+import { createSandboxClosure } from "../values.js";
+import { ordinaryHasInstance } from "../instanceof.js";
+export function createFunctionPrototype(budget, installHasInstance = true) {
+    const prototype = createSandboxClosure({ guest: true, sandbox: true, name: "", length: 0, call: () => undefined });
+    const properties = materializeFunctionProperties(prototype);
+    // Invocation support does not grant the host's dynamic source constructor.
+    Object.defineProperty(properties, "constructor", { value: undefined, writable: true, configurable: true });
+    for (const [name, length] of [["call", 1], ["apply", 2], ["bind", 1], ["toString", 0]]) {
+        Object.defineProperty(properties, name, { writable: true, configurable: true,
+            value: createSandboxClosure({ guest: true, sandbox: true, name, length,
+                call: (args, context) => callFunctionMethod(context?.thisValue, name, args, {
+                    budget,
+                    callClosure: (target, values, stack, thisValue, construct, newTarget) => context?.invokeClosure !== undefined
+                        ? context.invokeClosure(target, values, thisValue, construct, newTarget)
+                        : invokeBuiltinClosure(target, values, budget, { ...context, stack, thisValue, newTarget }, thisValue, construct)
+                }, context?.stack ?? [], context)
+            })
+        });
+    }
+    const hasInstance = installHasInstance ? createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.hasInstance]", length: 1,
+        call: ([value], context) => ordinaryHasInstance(value, context?.thisValue, budget, context)
+    }) : undefined;
+    if (hasInstance !== undefined)
+        Object.defineProperty(properties, Symbol.hasInstance, { value: hasInstance });
+    setSandboxPrototype(prototype, getSandboxPrototype(Object.create(null), budget));
+    installFunctionPrototype(budget, prototype);
+    if (hasInstance !== undefined)
+        registerIntrinsicFunction(budget, hasInstance);
+}

package/packages/safe-js/dist/interp/globals/generator.d.ts

@@ -0,0 +1,2 @@
+import type { Budget } from "../budget.js";
+export declare function createGeneratorPrototypes(budget: Budget): void;

package/packages/safe-js/dist/interp/globals/generator.js

@@ -0,0 +1,51 @@
+import { generatorPrototypes } from "../generator-prototypes.js";
+import { registerBuiltinIdentities, resolveIntrinsicIdentity } from "../intrinsics.js";
+import { callGeneratorMethod } from "../methods/generator.js";
+import { getSandboxPrototype, registerIntrinsicFunction, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { createSandboxClosure } from "../values.js";
+export function createGeneratorPrototypes(budget) {
+    const asyncIteratorPrototype = Object.create(null);
+    const asyncIterator = createSandboxClosure({ guest: true, sandbox: true,
+        name: "[Symbol.asyncIterator]", length: 0, call: (_args, context) => context?.thisValue });
+    Object.defineProperty(asyncIteratorPrototype, Symbol.asyncIterator, {
+        value: asyncIterator, writable: true, configurable: true
+    });
+    setSandboxPrototype(asyncIteratorPrototype, getSandboxPrototype(Object.create(null), budget));
+    registerBuiltinIdentities(budget, { "%AsyncIteratorPrototype%": asyncIteratorPrototype });
+    registerIntrinsicObject(budget, asyncIteratorPrototype);
+    registerIntrinsicFunction(budget, asyncIterator);
+    const state = new Map();
+    for (const async of [false, true]) {
+        const tag = async ? "AsyncGenerator" : "Generator";
+        const functionPrototype = Object.create(null);
+        const instancePrototype = Object.create(null);
+        setSandboxPrototype(functionPrototype, resolveIntrinsicIdentity(budget, JSON.stringify(["%FunctionPrototype%"])));
+        setSandboxPrototype(instancePrototype, async ? asyncIteratorPrototype
+            : resolveIntrinsicIdentity(budget, JSON.stringify(["%IteratorPrototype%"])));
+        Object.defineProperties(functionPrototype, {
+            prototype: { value: instancePrototype, configurable: true },
+            // Do not expose native dynamic-source constructors through this graph.
+            constructor: { value: undefined, configurable: true },
+            [Symbol.toStringTag]: { value: `${tag}Function`, configurable: true }
+        });
+        Object.defineProperties(instancePrototype, {
+            constructor: { value: functionPrototype, configurable: true },
+            [Symbol.toStringTag]: { value: tag, configurable: true }
+        });
+        for (const method of ["next", "return", "throw"]) {
+            Object.defineProperty(instancePrototype, method, { writable: true, configurable: true,
+                value: createSandboxClosure({ guest: true, sandbox: true, name: method, length: 1,
+                    call: ([value], context) => callGeneratorMethod(context?.thisValue, method, value, budget, context, async)
+                })
+            });
+        }
+        registerBuiltinIdentities(budget, {
+            [`%${tag}Prototype%`]: instancePrototype,
+            [`%${tag}FunctionPrototype%`]: functionPrototype
+        });
+        registerIntrinsicObject(budget, functionPrototype);
+        registerIntrinsicObject(budget, instancePrototype);
+        state.set(async, { functionPrototype, instancePrototype });
+    }
+    generatorPrototypes.set(budget, state);
+}

package/packages/safe-js/dist/interp/globals/object-array.js

@@ -1,4 +1,5 @@
 import { isFatalSandboxError } from "../budget.js";
+import { getGeneratorProperties } from "../generator-properties.js";
 import { accessorAdapter, accessorClosure, readPropertyDescriptor, retainedAccessorClosures } from "../accessors.js";
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { createDataCheckpoint } from "../data-checkpoint.js";
@@ -19,7 +20,7 @@ import { toPropertyKey } from "../property-key.js";
 import { createNumericParsers } from "./numeric-parsers.js";
 import { createPrimitiveConstructor } from "./primitives.js";
 import { arrayMethodNames, callArrayMethod } from "../methods/array.js";
-import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, installArrayPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, installArrayPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, registerIntrinsicObject, registerIntrinsicFunction, setSandboxPrototype } from "../object-model.js";
 import { allocateProducedSandboxValue, createSandboxClosure, deepCopyToSandbox, defineOwnDataProperty, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet, measureSandboxData, ownEnumerableSandboxKeys as getOwnEnumerableKeys, ownSandboxSymbolKeys, ownEnumerableSandboxEntries as getDirectEntries } from "../values.js";
 export function createObjectArrayGlobals(options) {
     return {
@@ -180,14 +181,14 @@ export function createObjectArrayGlobals(options) {
                 call: ([value]) => {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be made non-extensible.");
-                    Object.preventExtensions(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
+                    Object.preventExtensions(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
                     return value;
                 },
                 name: "preventExtensions"
             }),
             isExtensible: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isExtensible(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
+                call: ([value]) => Object.isExtensible(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
                 name: "isExtensible"
             }),
             seal: createSandboxClosure({
@@ -195,14 +196,14 @@ export function createObjectArrayGlobals(options) {
                 call: ([value]) => {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be sealed.");
-                    Object.seal(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
+                    Object.seal(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
                     return value;
                 },
                 name: "seal"
             }),
             isSealed: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isSealed(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
+                call: ([value]) => Object.isSealed(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
                 name: "isSealed"
             }),
             freeze: createSandboxClosure({
@@ -211,7 +212,7 @@ export function createObjectArrayGlobals(options) {
                     if (isGuestHostObject(value))
                         throw new TypeError("Live host objects cannot be frozen.");
                     if (typeof value === "object" && value !== null) {
-                        Object.freeze(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
+                        Object.freeze(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value);
                     }
                     return value;
                 },
@@ -219,7 +220,7 @@ export function createObjectArrayGlobals(options) {
             }),
             isFrozen: createSandboxClosure({
                 sandbox: true,
-                call: ([value]) => Object.isFrozen(isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
+                call: ([value]) => Object.isFrozen(isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value),
                 name: "isFrozen"
             }),
             assign: createSandboxClosure({
@@ -331,6 +332,21 @@ function createArrayGlobal(budget) {
             guest: true, sandbox: true, name: "[Symbol.iterator]", length: 0,
             call: (_args, context) => context?.thisValue
         }), writable: true, configurable: true });
+    const iteratorTagGetter = createSandboxClosure({ guest: true, sandbox: true,
+        name: "get [Symbol.toStringTag]", length: 0, call: () => "Iterator" });
+    const iteratorTagSetter = createSandboxClosure({ guest: true, sandbox: true,
+        name: "set [Symbol.toStringTag]", length: 1, call: ([value], context) => {
+            const receiver = context?.thisValue;
+            if (receiver === iterablePrototype || receiver === null || typeof receiver !== "object")
+                throw new TypeError("Iterator tag setter requires a distinct object receiver.");
+            defineOwnDataProperty(objectProperties(receiver, true), Symbol.toStringTag, value);
+            createDataCheckpoint(budget, context)(receiver, 0, true);
+            return undefined;
+        }
+    });
+    Object.defineProperty(iterablePrototype, Symbol.toStringTag, {
+        get: accessorAdapter(iteratorTagGetter, "get"), set: accessorAdapter(iteratorTagSetter, "set"), configurable: true
+    });
     setSandboxPrototype(iterablePrototype, getSandboxPrototype(Object.create(null), budget));
     setSandboxPrototype(iteratorPrototype, iterablePrototype);
     Object.defineProperties(iteratorPrototype, {
@@ -340,6 +356,9 @@ function createArrayGlobal(budget) {
         [Symbol.toStringTag]: { value: "Array Iterator", configurable: true }
     });
     registerBuiltinIdentities(budget, { "%ArrayIteratorPrototype%": iteratorPrototype, "%IteratorPrototype%": iterablePrototype });
+    registerIntrinsicFunction(budget, iterablePrototype[Symbol.iterator]);
+    registerIntrinsicFunction(budget, iteratorTagGetter);
+    registerIntrinsicFunction(budget, iteratorTagSetter);
     registerIntrinsicObject(budget, iterablePrototype);
     registerIntrinsicObject(budget, iteratorPrototype);
     for (const method of ["keys", "values", "entries"]) {
@@ -556,6 +575,8 @@ function reflectionProperties(value) {
     return objectProperties(value);
 }
 export function objectProperties(value, mutable = false) {
+    if (isSandboxGenerator(value))
+        return getGeneratorProperties(value);
     if (isSandboxPromise(value))
         return getPromiseProperties(value);
     if (isSandboxMap(value) || isSandboxSet(value))

package/packages/safe-js/dist/interp/globals/object.js

@@ -1,4 +1,5 @@
 import { assertSandboxDataDepth } from "../../graph-depth.js";
+import { getGeneratorProperties } from "../generator-properties.js";
 import { readPropertyDescriptor } from "../accessors.js";
 import { isSandboxArguments } from "../arguments.js";
 import { isSandboxDate } from "../date.js";
@@ -153,7 +154,7 @@ export function hasOwnSandboxProperty(value, key, enumerable) {
     else if (isSandboxPromise(value))
         properties = getPromiseProperties(value);
     else if (isSandboxGenerator(value))
-        return false;
+        properties = getGeneratorProperties(value);
     else if (isSandboxRegex(value))
         properties = getRegexProperties(value);
     else

package/packages/safe-js/dist/interp/globals.d.ts

@@ -3,6 +3,7 @@ import type { RunClock } from "../run.js";
 export declare function createBuiltinBindings(options: Parameters<typeof createConsoleJsonGlobals>[0] & {
     random?: () => number;
     clock?: RunClock;
+    functionHasInstance?: boolean;
 }): {
     RegExp: import("./values.js").SandboxClosure;
     Promise: import("./values.js").SandboxClosure;

package/packages/safe-js/dist/interp/globals.js

@@ -7,6 +7,8 @@ import { createRegexGlobals } from "./globals/regex.js";
 import { createMiscGlobals } from "./globals/misc.js";
 import { createUriGlobals } from "./globals/uri.js";
 import { createObjectArrayGlobals } from "./globals/object-array.js";
+import { createFunctionPrototype } from "./globals/function.js";
+import { createGeneratorPrototypes } from "./globals/generator.js";
 import { createPromiseGlobals } from "./promise.js";
 import { createDateGlobal } from "./globals/date.js";
 import { createSymbolGlobal } from "./globals/symbol.js";
@@ -28,6 +30,8 @@ export function createBuiltinBindings(options) {
         ...createPromiseGlobals(options),
         ...createRegexGlobals(options)
     };
+    createFunctionPrototype(options.budget, options.functionHasInstance);
+    createGeneratorPrototypes(options.budget);
     registerBuiltinIdentities(options.budget, bindings);
     return bindings;
 }

package/packages/safe-js/dist/interp/instanceof.d.ts

@@ -0,0 +1,4 @@
+import type { Budget } from "./budget.js";
+import { type SandboxCallContext, type SandboxValue } from "./values.js";
+export declare function evaluateInstanceof(value: SandboxValue, constructor: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<boolean>;
+export declare function ordinaryHasInstance(value: SandboxValue, constructor: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<boolean>;

package/packages/safe-js/dist/interp/instanceof.js

@@ -0,0 +1,58 @@
+import { assertSandboxDataDepth } from "../graph-depth.js";
+import { readPropertyDescriptor } from "./accessors.js";
+import { invokeBuiltinClosure } from "./builtin-call.js";
+import { isFloat32Array } from "./float32.js";
+import { isFloat32ArrayConstructor } from "./globals/float32array.js";
+import { isSandboxErrorConstructorInstance } from "./globals/error.js";
+import { getSandboxPropertyDescriptor, getSandboxPrototype, isGuestClosure } from "./object-model.js";
+import { isSandboxClosure } from "./values.js";
+export async function evaluateInstanceof(value, constructor, budget, context) {
+    if (constructor === null || typeof constructor !== "object")
+        throw new TypeError("Right-hand side of 'instanceof' must be an object.");
+    const method = await readInstanceProperty(constructor, Symbol.hasInstance, budget, context);
+    if (method !== undefined && method !== null) {
+        if (!isSandboxClosure(method))
+            throw new TypeError("Symbol.hasInstance must be callable.");
+        return Boolean(await invokeBuiltinClosure(method, [value], budget, context, constructor));
+    }
+    if (!isSandboxClosure(constructor))
+        throw new TypeError("Right-hand side of 'instanceof' is not a function.");
+    return ordinaryHasInstance(value, constructor, budget, context);
+}
+export async function ordinaryHasInstance(value, constructor, budget, context) {
+    if (!isSandboxClosure(constructor))
+        return false;
+    if (constructor.boundTarget !== undefined) {
+        budget.visitNode();
+        return evaluateInstanceof(value, constructor.boundTarget, budget, context);
+    }
+    // These existing built-ins do not yet have ordinary prototype graphs.
+    if (isFloat32ArrayConstructor(constructor))
+        return isFloat32Array(value);
+    if (isSandboxErrorConstructorInstance(value, constructor))
+        return true;
+    if (!isGuestClosure(constructor) || typeof value !== "object" || value === null)
+        return false;
+    const prototype = await readInstanceProperty(constructor, "prototype", budget, context);
+    if (typeof prototype !== "object" || prototype === null)
+        throw new TypeError("Function has a non-object prototype in instanceof check.");
+    let depth = 0;
+    for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+        budget.visitNode();
+        assertSandboxDataDepth(depth++);
+        if (current === prototype)
+            return true;
+    }
+    return false;
+}
+async function readInstanceProperty(value, key, budget, context) {
+    if (context?.getProperty !== undefined)
+        return context.getProperty(value, key);
+    const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+    if (descriptor === undefined)
+        return undefined;
+    return readPropertyDescriptor(descriptor, value, {
+        ...context, stack: context?.stack ?? [], thisValue: value,
+        invokeClosure: context?.invokeClosure ?? ((closure, args, receiver) => invokeBuiltinClosure(closure, args, budget, context, receiver))
+    });
+}