poe-code 14.0.79 → 14.0.81

package/packages/safe-js/dist/interp/object-model.js

@@ -1,4 +1,7 @@
 import { assertSandboxDataDepth } from "../graph-depth.js";
+import { getGeneratorProperties } from "./generator-properties.js";
+import { generatorPrototypes } from "./generator-prototypes.js";
+import { runResources } from "./resources.js";
 import { getIntrinsicIdentity, registerBuiltinIdentities, releaseIntrinsicIdentities } from "./intrinsics.js";
 import { releaseTemplateObjects } from "./template-objects.js";
 import { isSandboxDate } from "./date.js";
@@ -8,6 +11,7 @@ import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet } from "./values.js";
 const guestClosures = new WeakSet();
 const functionProperties = new WeakMap();
+const functionPropertyRevisions = new WeakMap();
 const prototypes = new WeakMap();
 const intrinsicPrototypes = new WeakMap();
 const boxedPrototypes = new WeakMap();
@@ -16,6 +20,7 @@ const collectionPrototypes = new WeakMap();
 const promisePrototypes = new WeakMap();
 const datePrototypes = new WeakMap();
 const arrayPrototypes = new WeakMap();
+const functionPrototypes = new WeakMap();
 const initialArrayMethods = new WeakMap();
 const initialRegexDescriptors = new WeakMap();
 const intrinsicPrototypeRoots = new WeakMap();
@@ -53,9 +58,26 @@ export function materializeFunctionProperties(closure) {
         descriptorObjects.add(prototype);
         Object.defineProperty(properties, "prototype", { value: prototype, writable: true });
     }
-    descriptorObjects.add(properties);
-    functionProperties.set(closure, properties);
-    return properties;
+    // Never expose the raw table: native callers must invalidate captures too.
+    const state = { revision: 0 };
+    const tracked = new Proxy(properties, {
+        defineProperty(target, key, descriptor) {
+            const changed = Reflect.defineProperty(target, key, descriptor);
+            if (changed)
+                state.revision++;
+            return changed;
+        },
+        deleteProperty(target, key) {
+            const changed = Reflect.deleteProperty(target, key);
+            if (changed)
+                state.revision++;
+            return changed;
+        }
+    });
+    functionPropertyRevisions.set(tracked, state);
+    descriptorObjects.add(tracked);
+    functionProperties.set(closure, tracked);
+    return tracked;
 }
 export function getGuestFunctionProperty(closure, key) {
     let properties = functionProperties.get(closure);
@@ -79,6 +101,12 @@ export function installObjectPrototype(budget, prototype, constructor) {
     intrinsicPrototypes.set(budget, prototype);
     registerIntrinsicPrototype(budget, prototype, constructor);
 }
+export function installFunctionPrototype(budget, prototype) {
+    functionPrototypes.set(budget, prototype);
+    registerBuiltinIdentities(budget, { "%FunctionPrototype%": prototype });
+    registerIntrinsicFunction(budget, prototype);
+    registerIntrinsicObject(budget, materializeFunctionProperties(prototype));
+}
 export function installBoxedPrototype(budget, prototype, constructor, kind = typeof boxedValue(prototype)) {
     let state = boxedPrototypes.get(budget);
     if (state === undefined)
@@ -181,6 +209,9 @@ function trackIntrinsicState(budget, root, owner, targets) {
     }))
         .map((record) => ({
         ...record,
+        revision: functionPropertyRevisions.get(record.value),
+        capturedRevision: -1,
+        captured: [],
         extensible: Object.isExtensible(record.value),
         descriptors: new Map(Reflect.ownKeys(record.value).map(key => [key, Object.getOwnPropertyDescriptor(record.value, key)]))
     }));
@@ -206,16 +237,24 @@ function trackIntrinsicState(budget, root, owner, targets) {
     budget.setRetainedValues(root, () => {
         // Capture every change before measurement invokes retained-value callbacks.
         const retained = [];
-        for (const { target, value, descriptors, prototype: parent } of records) {
+        for (const record of records) {
+            const { target, value, descriptors, prototype: parent, revision } = record;
             const currentPrototype = getSandboxPrototype(target);
             if (currentPrototype !== parent)
                 retained.push(currentPrototype);
-            for (const key of Reflect.ownKeys(value)) {
-                const descriptor = Object.getOwnPropertyDescriptor(value, key);
-                if (unchanged(descriptors.get(key), descriptor))
-                    continue;
-                retained.push(key, descriptor.value, ...retainedAccessorClosures(descriptor));
+            if (revision === undefined || revision.revision !== record.capturedRevision) {
+                const captured = [];
+                for (const key of Reflect.ownKeys(value)) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                    if (unchanged(descriptors.get(key), descriptor))
+                        continue;
+                    captured.push(key, descriptor.value, ...retainedAccessorClosures(descriptor));
+                }
+                record.captured = captured;
+                record.capturedRevision = revision?.revision ?? -1;
             }
+            for (const item of record.captured)
+                retained.push(item);
         }
         return retained;
     });
@@ -232,12 +271,16 @@ export function releaseObjectPrototype(budget) {
     promisePrototypes.delete(budget);
     datePrototypes.delete(budget);
     arrayPrototypes.delete(budget);
+    functionPrototypes.delete(budget);
+    generatorPrototypes.delete(budget);
     initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }
 export function getSandboxPrototype(value, budget) {
     if (prototypes.has(value))
         return prototypes.get(value) ?? null;
+    if (budget !== undefined && isGuestClosure(value) && runResources.getStore()?.functionSourceText !== false)
+        return functionPrototypes.get(budget) ?? null;
     if (budget !== undefined && Array.isArray(value))
         return arrayPrototypes.get(budget) ?? null;
     if (budget !== undefined && isSandboxDate(value))
@@ -273,9 +316,14 @@ export function getSandboxPropertyDescriptor(value, key, budget) {
     let depth = 0;
     while (typeof current === "object" &&
         current !== null &&
-        (Array.isArray(current) || isSandboxDate(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxMap(current) || isSandboxSet(current) || isPrototypeRecord(current))) {
-        const properties = isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? getGuestFunctionProperties(current)
+        (Array.isArray(current) || isSandboxGenerator(current) || isSandboxDate(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxMap(current) || isSandboxSet(current) || isPrototypeRecord(current))) {
+        const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current)
+            ? key === "prototype" && current.construct !== undefined && current.boundTarget === undefined
+                ? materializeFunctionProperties(current) : getGuestFunctionProperties(current)
             : isSandboxRegex(current) ? getRegexProperties(current) : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
+        if (properties === undefined && isGuestClosure(current) && (key === "name" || key === "length"))
+            return { value: key === "name" ? current.name ?? "" : current.length ?? 0,
+                writable: false, enumerable: false, configurable: true };
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
         if (descriptor !== undefined)
             return descriptor;
@@ -297,6 +345,11 @@ export function getSandboxDataProperty(value, key, budget) {
             return Object.getOwnPropertyDescriptor(getRegexProperties(current), key)?.value;
         if (isSandboxPromise(current))
             return Object.getOwnPropertyDescriptor(getPromiseProperties(current), key)?.value;
+        if (isSandboxGenerator(current)) {
+            const descriptor = Object.getOwnPropertyDescriptor(getGeneratorProperties(current), key);
+            if (descriptor !== undefined)
+                return descriptor.value;
+        }
         if (isSandboxMap(current) || isSandboxSet(current))
             return Object.getOwnPropertyDescriptor(getCollectionProperties(current), key)?.value;
         if (isGuestClosure(current)) {
@@ -313,10 +366,9 @@ export function getSandboxDataProperty(value, key, budget) {
         if (isSandboxMap(current) ||
             isSandboxSet(current) ||
             isSandboxPromise(current) ||
-            isSandboxRegex(current) ||
-            isSandboxGenerator(current))
+            isSandboxRegex(current))
             return undefined;
-        if (!isSandboxClosure(current) && Object.hasOwn(current, key))
+        if (!isSandboxClosure(current) && !isSandboxGenerator(current) && Object.hasOwn(current, key))
             return current[key];
         current = getSandboxPrototype(current, budget);
         if (current !== null) {
@@ -330,8 +382,8 @@ export function setSandboxPrototype(value, prototype, budget) {
     if (budget !== undefined && intrinsicPrototypes.get(budget) === value && prototype !== null) {
         throw new TypeError("Object.prototype has an immutable null prototype.");
     }
-    if ((!Array.isArray(value) && !isSandboxDate(value) && !isSandboxPromise(value) && !isSandboxRegex(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isPrototypeRecord(value)) ||
-        (prototype !== null && !Array.isArray(prototype) && !isSandboxDate(prototype) && !isSandboxPromise(prototype) && !isSandboxRegex(prototype) && !isSandboxMap(prototype) && !isSandboxSet(prototype) && !isPrototypeRecord(prototype))) {
+    if ((!Array.isArray(value) && !isSandboxGenerator(value) && !isSandboxDate(value) && !isSandboxPromise(value) && !isSandboxRegex(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isPrototypeRecord(value)) ||
+        (prototype !== null && !Array.isArray(prototype) && !isSandboxGenerator(prototype) && !isSandboxDate(prototype) && !isSandboxPromise(prototype) && !isSandboxRegex(prototype) && !isSandboxMap(prototype) && !isSandboxSet(prototype) && !isPrototypeRecord(prototype))) {
         throw new TypeError("Prototype links require supported sandbox objects.");
     }
     if (getSandboxPrototype(value, budget) === prototype) {
@@ -340,7 +392,7 @@ export function setSandboxPrototype(value, prototype, budget) {
             prototypes.set(value, null);
         return;
     }
-    if (!Object.isExtensible(isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value)) {
+    if (!Object.isExtensible(isSandboxGenerator(value) ? getGeneratorProperties(value) : isGuestClosure(value) ? materializeFunctionProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isSandboxRegex(value) ? getRegexProperties(value) : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : value)) {
         throw new TypeError("Cannot change the prototype of a non-extensible object.");
     }
     let depth = 0;

package/packages/safe-js/dist/interp/string-coercion.js

@@ -1,4 +1,5 @@
 import { sandboxErrorTypes } from "../error/shape.js";
+import { getGeneratorProperties } from "./generator-properties.js";
 import { readPropertyDescriptor } from "./accessors.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
 import { invokeBuiltinClosure } from "./builtin-call.js";
@@ -115,7 +116,7 @@ function conversionHook(value, name, budget, context) {
         ((Array.isArray(value) && getSandboxPrototype(value, budget) === null) ||
             isFloat32Array(value) ||
             sandboxErrorTypes.has(value) ||
-            isSandboxClosure(value) ||
+            (isSandboxClosure(value) && getSandboxPrototype(value, budget) === null) ||
             isSandboxMap(value) ||
             isSandboxSet(value) ||
             isSandboxCollectionIterator(value) ||
@@ -127,7 +128,7 @@ function conversionHook(value, name, budget, context) {
     let current = value;
     let depth = 0;
     while (current !== null) {
-        const properties = isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? getGuestFunctionProperties(current)
+        const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? getGuestFunctionProperties(current)
             : isSandboxRegex(current) ? getRegexProperties(current)
                 : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, name);

package/packages/safe-js/dist/interp/values.js

@@ -1,5 +1,6 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { internalSymbols } from "./internal-symbols.js";
+import { getGeneratorProperties } from "./generator-properties.js";
 import { getRegexProperties, regexGuestProperties } from "./regexp-properties.js";
 import { getCollectionProperties, collectionGuestProperties, copyCollectionProperties } from "./collection-properties.js";
 export { getCollectionProperties } from "./collection-properties.js";
@@ -118,6 +119,8 @@ export function ownEnumerableSandboxEntries(value, excludedKeys) {
         entries = Object.entries(getRegexProperties(value));
     else if (isSandboxPromise(value))
         entries = Object.entries(getPromiseProperties(value));
+    else if (isSandboxGenerator(value))
+        entries = Object.entries(getGeneratorProperties(value));
     else if (isSandboxMap(value) || isSandboxSet(value))
         entries = Object.entries(getCollectionProperties(value));
     else if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
@@ -137,15 +140,15 @@ export function ownSandboxSymbolKeys(value) {
         value = getRegexProperties(value);
     else if (isSandboxPromise(value))
         value = getPromiseProperties(value);
+    else if (isSandboxGenerator(value))
+        value = getGeneratorProperties(value);
     else if (isSandboxMap(value) || isSandboxSet(value))
         value = getCollectionProperties(value);
-    else if (isSandboxGenerator(value) || isSandboxMap(value) || isSandboxSet(value) || isSandboxPromise(value) || isSandboxRegex(value))
-        return [];
     return Object.getOwnPropertySymbols(Object(value)).filter(key => !internalSymbols.has(key));
 }
 export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
     if (includeSymbols) {
-        const properties = isSandboxClosure(value) ? value.properties ?? {} : isSandboxPromise(value) ? getPromiseProperties(value) : isSandboxRegex(value) ? getRegexProperties(value)
+        const properties = isSandboxClosure(value) ? value.properties ?? {} : isSandboxGenerator(value) ? getGeneratorProperties(value) : isSandboxPromise(value) ? getPromiseProperties(value) : isSandboxRegex(value) ? getRegexProperties(value)
             : isSandboxMap(value) || isSandboxSet(value) ? getCollectionProperties(value) : Object(value);
         return [...ownEnumerableSandboxKeys(value), ...ownSandboxSymbolKeys(value).filter(key => Object.getOwnPropertyDescriptor(properties, key)?.enumerable === true)];
     }
@@ -157,6 +160,8 @@ export function ownEnumerableSandboxKeys(value, includeSymbols = false) {
         return Object.keys(value.properties ?? {});
     if (isSandboxPromise(value))
         return Object.keys(getPromiseProperties(value));
+    if (isSandboxGenerator(value))
+        return Object.keys(getGeneratorProperties(value));
     if (isSandboxRegex(value))
         return Object.keys(getRegexProperties(value));
     if (isSandboxMap(value) || isSandboxSet(value))
@@ -213,6 +218,7 @@ export function createSandboxGenerator(channel, metadata = undefined) {
         enumerable: false,
         value: true
     });
+    getGeneratorProperties(generator);
     return generator;
 }
 export function createSandboxMap(entries = []) {
@@ -501,6 +507,18 @@ export function measureSandboxData(values, options = {}) {
             return;
         }
         if (isSandboxGenerator(value)) {
+            const descriptors = Object.getOwnPropertyDescriptors(getGeneratorProperties(value));
+            for (const key of Reflect.ownKeys(descriptors)) {
+                const descriptor = descriptors[key];
+                usage += typeof key === "string" ? key.length + 1 : 1;
+                if (typeof key === "symbol")
+                    visit(key, depth + 1);
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+                else
+                    for (const closure of retainedAccessorClosures(descriptor))
+                        visit(closure, depth + 1);
+            }
             const snapshot = value.channel.snapshot();
             usage += snapshot.sent.length;
             for (const completion of snapshot.sent)

package/packages/safe-js/dist/snapshot/guest-heap-validation.js

@@ -4,6 +4,7 @@ import { createBuiltinBindings } from "../interp/globals.js";
 import { getIntrinsicIdentity, listIntrinsicIdentities, resolveIntrinsicIdentity } from "../interp/intrinsics.js";
 import { releaseObjectPrototype } from "../interp/object-model.js";
 import { isSandboxClosure } from "../interp/values.js";
+import { assertSnapshotDataDepth } from "../graph-depth.js";
 let intrinsicKinds;
 function intrinsicCatalogue() {
     if (intrinsicKinds !== undefined)
@@ -59,7 +60,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         createRawJson(node.text);
         return true;
     }
-    if (!["intrinsic", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
+    if (!["intrinsic", "bound-function", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
         return false;
     const reference = (value, kinds) => {
         const ref = record(value);
@@ -74,7 +75,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
     const callable = (value) => {
         if (absent(value))
             return;
-        const target = reference(value, ["intrinsic", "guest-function", "guest-class"]);
+        const target = reference(value, ["intrinsic", "bound-function", "guest-function", "guest-class"]);
         if (target.kind === "intrinsic" && intrinsicCatalogue().get(String(target.id)) !== true)
             throw new TypeError("Guest accessor reference is not callable.");
     };
@@ -199,6 +200,27 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
             throw new TypeError("Invalid class prototype descriptor.");
         reference(descriptor.value, ["object", "guest-object"]);
     }
+    else if (node.kind === "bound-function") {
+        fields(node, ["kind", "target", "thisValue", "args", "length", "state"], ["name"]);
+        if (Object.hasOwn(node, "name") && typeof node.name !== "string")
+            throw new TypeError("Invalid bound function name.");
+        if (array(node.args).length > maxArrayLength)
+            throw new TypeError("Bound arguments exceed allocation limit.");
+        if (!absent(node.length) && !(typeof node.length === "number" && node.length >= 0) &&
+            !(record(node.length).kind === "number" && record(node.length).value === "Infinity"))
+            throw new TypeError("Invalid bound function length.");
+        const visited = new Set([raw]);
+        let current = node;
+        while (current.kind === "bound-function") {
+            assertSnapshotDataDepth(visited.size, "<bound-target>");
+            callable(current.target);
+            current = reference(current.target);
+            if (visited.has(current))
+                throw new TypeError("Cyclic bound function target.");
+            visited.add(current);
+        }
+        state(node.state);
+    }
     else if (node.kind === "guest-function") {
         fields(node, ["kind", "astNodeId", "scope", "state"], ["name", "environment"]);
         if (integer(node.astNodeId) < 1)
@@ -217,7 +239,9 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         state(node.state);
     }
     else if (node.kind === "guest-generator") {
-        fields(node, ["kind", "state", "astNodeId", "async", "scope", "closureScope", "sent"], ["suspendedScope", "yieldNodeId", "environment", "blockScopes", "finallyCompletions", "expressionStates"]);
+        fields(node, ["kind", "state", "astNodeId", "async", "scope", "closureScope", "sent"], ["suspendedScope", "yieldNodeId", "environment", "blockScopes", "finallyCompletions", "expressionStates", "objectState"]);
+        if (Object.hasOwn(node, "objectState"))
+            state(node.objectState);
         if (!["start", "running", "suspended", "done"].includes(String(node.state)) || typeof node.async !== "boolean" || integer(node.astNodeId) < 1)
             throw new TypeError("Invalid generator state.");
         reference(node.scope, ["scope-frame"]);

package/packages/safe-js/dist/snapshot/guest-heap.d.ts

@@ -13,6 +13,14 @@ export type GuestObjectState<T> = {
     prototype?: T;
 };
 export type GuestHeapNode<T> = {
+    kind: "bound-function";
+    target: T;
+    thisValue: T;
+    args: T[];
+    name?: string;
+    length: T;
+    state: GuestObjectState<T>;
+} | {
     kind: "array-iterator";
     source: T;
     index: number;
@@ -61,6 +69,7 @@ export type GuestHeapNode<T> = {
         homeObject?: T;
         newTarget?: T;
     };
+    objectState?: GuestObjectState<T>;
 } | {
     kind: "guest-object";
     state: GuestObjectState<T>;

package/packages/safe-js/dist/snapshot/guest-heap.js

@@ -1,4 +1,6 @@
 import { getClosureOrigin, getGeneratorOrigin } from "../interp/closure-origin.js";
+import { boundFunctionStates } from "../interp/bound-function-state.js";
+import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { getIntrinsicIdentity } from "../interp/intrinsics.js";
 import { getSandboxPrototype, hasExplicitSandboxPrototype, hasGuestObjectState, isGuestClosure, materializeFunctionProperties } from "../interp/object-model.js";
 import { isLiveCapability } from "../interp/host-capabilities.js";
@@ -26,6 +28,12 @@ export function captureGuestHeapNode(value, encode) {
         const state = captureObjectState(value, encode);
         return { kind: "intrinsic", id: intrinsic, ...(state === undefined ? {} : { state }) };
     }
+    const bound = boundFunctionStates.get(value);
+    if (bound !== undefined && isSandboxClosure(value)) {
+        return { kind: "bound-function", target: encode(bound.target), thisValue: encode(bound.thisValue),
+            args: bound.args.map(encode), length: encode(value.length),
+            ...(value.name === undefined ? {} : { name: value.name }), state: captureObjectState(value, encode) };
+    }
     if (isSandboxMap(value))
         return { kind: "map", entries: [...value.entries].map(([key, entry]) => [encode(key), encode(entry)]), ...serializeCollectionProperties(value, encode) };
     if (isSandboxSet(value))
@@ -65,6 +73,7 @@ export function captureGuestHeapNode(value, encode) {
         const channel = value.channel.snapshot();
         return {
             kind: "guest-generator", state: value.state, astNodeId: origin.node.nodeId, async: value.async === true,
+            objectState: captureObjectState(value, encode),
             scope: encode(origin.scope), closureScope: encode(origin.closureScope),
             ...(value.state !== "suspended" || origin.suspendedScope === undefined ? {} : { suspendedScope: encode(origin.suspendedScope) }),
             ...(value.state !== "suspended" || origin.blockScopes === undefined ? {} : {
@@ -164,6 +173,8 @@ export function captureGuestHeapNode(value, encode) {
 }
 function captureObjectState(value, encode) {
     let properties = value;
+    if (isSandboxGenerator(value))
+        properties = getGeneratorProperties(value);
     if (isSandboxClosure(value)) {
         properties = value.properties;
         if (isGuestClosure(value))

package/packages/safe-js/dist/snapshot/restore.js

@@ -1,4 +1,7 @@
 import { Budget, SandboxError } from "../interp/budget.js";
+import { createBoundFunction } from "../interp/bound-function.js";
+import { invokeBuiltinClosure } from "../interp/builtin-call.js";
+import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { restoreRegexProperties } from "./regexp-properties.js";
 import { classOrigins, createClassConstructor } from "../interp/classes.js";
 import { mapIteratorSnapshot } from "../interp/iteration.js";
@@ -375,6 +378,29 @@ function isSerializedRegexValue(value) {
         typeof value.flags === "string" &&
         typeof value.lastIndex === "number");
 }
+function initializeIntrinsicRealm(state) {
+    if (state.intrinsicsInitialized)
+        return;
+    const prototype = Object.values(state.heap).find(node => node.kind === "intrinsic" && node.id === '["%FunctionPrototype%"]');
+    // Older heaps could omit this property or contain a guest-defined hook.
+    // Do not preinstall a nonconfigurable property over their captured state.
+    const functionHasInstance = prototype?.kind !== "intrinsic" || prototype.state === undefined ||
+        prototype.state.properties.properties.some(([key, descriptor]) => {
+            if (key === null || typeof key !== "object" || !("kind" in key) || key.kind !== "ref")
+                return false;
+            const symbol = state.heap[String(key.id)];
+            if (symbol?.kind !== "symbol" || symbol.wellKnown !== "hasInstance" || descriptor.kind !== "data" ||
+                descriptor.writable || descriptor.enumerable || descriptor.configurable)
+                return false;
+            const value = descriptor.value;
+            if (value === null || typeof value !== "object" || !("kind" in value) || value.kind !== "ref")
+                return false;
+            const method = state.heap[String(value.id)];
+            return method?.kind === "intrinsic" && method.id === '["%FunctionPrototype%",{"symbol":"hasInstance"}]';
+        });
+    createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner, functionHasInstance });
+    state.intrinsicsInitialized = true;
+}
 function restoreHeapValue(id, state) {
     const existing = state.heapValueById.get(id);
     if (existing !== undefined) {
@@ -521,15 +547,36 @@ function restoreHeapValue(id, state) {
     if (serialized.kind === "guest-generator") {
         const generator = restoreGuestGenerator(serialized, state);
         state.heapValueById.set(id, generator);
+        const objectState = serialized.objectState;
+        if (objectState !== undefined)
+            state.initializeIterators.push(() => {
+                if (objectState.prototype !== undefined)
+                    setSandboxPrototype(generator, deserializeValue(objectState.prototype, state), state.budget);
+                restorePropertyDescriptors(getGeneratorProperties(generator), objectState.properties, entry => deserializeValue(entry, state));
+            });
         return generator;
     }
-    if (serialized.kind === "intrinsic" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
+    if (serialized.kind === "intrinsic" || serialized.kind === "bound-function" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
         let value;
-        if (serialized.kind === "intrinsic") {
-            if (!state.intrinsicsInitialized) {
-                createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner });
-                state.intrinsicsInitialized = true;
-            }
+        if (serialized.kind === "bound-function") {
+            initializeIntrinsicRealm(state);
+            const target = deserializeValue(serialized.target, state);
+            if (!isSandboxClosure(target))
+                throw new TypeError("Invalid bound function target.");
+            const boundState = { target, thisValue: undefined, args: [] };
+            const length = deserializeValue(serialized.length, state);
+            if (length !== undefined && typeof length !== "number")
+                throw new TypeError("Invalid bound function length.");
+            value = createBoundFunction(boundState, serialized.name, length, (callee, args, stack, thisValue, construct, newTarget) => invokeBuiltinClosure(callee, args, state.budget, { stack, thisValue, newTarget }, thisValue, construct));
+            // Allocate every bound identity before decoding arguments and receivers:
+            // either may point back to this function, including through another bind.
+            state.initializeIterators.push(() => {
+                boundState.thisValue = deserializeValue(serialized.thisValue, state);
+                boundState.args = serialized.args.map(entry => deserializeValue(entry, state));
+            });
+        }
+        else if (serialized.kind === "intrinsic") {
+            initializeIntrinsicRealm(state);
             value = resolveIntrinsicIdentity(state.budget, serialized.id);
         }
         else if (serialized.kind === "guest-class") {
@@ -570,12 +617,19 @@ function restoreHeapValue(id, state) {
                 homeObject: serialized.environment.homeObject === undefined ? undefined : deserializeValue(serialized.environment.homeObject, state),
                 newTarget: serialized.environment.newTarget === undefined ? undefined : deserializeValue(serialized.environment.newTarget, state)
             };
+            // Current generator functions need their realm before creation, not only
+            // when a later prototype reference is decoded. Earlier heaps can lack the
+            // native nonconfigurable prototype property and retain that legacy shape.
+            const initializeGeneratorPrototype = node.type !== "ArrowFunctionExpression" && node.generator &&
+                serialized.state.properties.properties.some(([key, descriptor]) => key === "prototype" && descriptor.kind === "data" && !descriptor.configurable);
+            if (initializeGeneratorPrototype)
+                initializeIntrinsicRealm(state);
             value = createInterpretedClosure(node, {
                 scope, budget: state.budget, compilation: state.compilation, rootNode: state.rootNode,
                 signal: state.signal, inferredName: serialized.name, functionEnvironment: environment,
                 callStack: [], activeLoopIterations: new Map(), restoredLoopIterations: new Map(),
                 stats: { currentDataSize: 0, nodeVisits: 0, peakDataSize: 0 }
-            }, evaluateNode, environment?.homeObject);
+            }, evaluateNode, environment?.homeObject, initializeGeneratorPrototype);
         }
         else
             value = serialized.kind === "guest-array" ? [] : Object.create(null);