poe-code 14.0.80 → 14.0.81

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-34G5WW2O.js";
+} from "./chunks/chunk-2LNBLFJ3.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-M4L3EZHL.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-M4L3EZHL.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-34G5WW2O.js";
+} from "./chunks/chunk-2LNBLFJ3.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-M4L3EZHL.js";
+} from "./chunks/chunk-ZSYBRZU6.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/async.d.ts

@@ -70,7 +70,7 @@ export type EvaluateAsyncNode = (node: ParseResult, context: AsyncEvaluationCont
 export declare function emitResumeBreakpoint(context: AsyncEvaluationContext, breakpoint: ResumeBreakpoint): void;
 export declare function evaluateArrowFunctionExpression(node: ArrowFunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
 export declare function evaluateFunctionExpression(node: FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
-export declare function createInterpretedClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode, homeObject?: SandboxObject | SandboxClosure): SandboxClosure;
+export declare function createInterpretedClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode, homeObject?: SandboxObject | SandboxClosure, initializeGeneratorPrototype?: boolean): SandboxClosure;
 export declare function executeAsyncFunction(execute: (onSuspend: () => void) => Promise<SandboxValue>, budget: Budget, signal?: AbortSignal, callContext?: SandboxCallContext): import("./values.js").SandboxPromise;
 export declare function evaluateAwaitExpression(node: AwaitExpression, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<AsyncEvaluationResult>;
 export declare function executeClosure(node: ArrowFunctionExpression | FunctionDeclaration | FunctionExpression, args: readonly SandboxValue[], thisValue: SandboxValue, context: AsyncEvaluationContext, evaluateNode: EvaluateAsyncNode): Promise<SandboxValue>;

package/packages/safe-js/dist/interp/async.js

@@ -7,7 +7,9 @@ import { CompileScope } from "./regex/compile-guard.js";
 import { awaitSandboxValue } from "./cancel.js";
 import { hoistVarDeclarations } from "./var-hoist.js";
 import { createCoercionContext, createPatternContext } from "./interpreter.js";
-import { getGuestFunctionProperty, setSandboxPrototype } from "./object-model.js";
+import { getGuestFunctionProperty, markDescriptorObject, materializeFunctionProperties, setSandboxPrototype } from "./object-model.js";
+import { generatorPrototypes } from "./generator-prototypes.js";
+import { retainValues, runResources } from "./resources.js";
 import { functionSources } from "../parse/function-source.js";
 import { registerClosureOrigin, registerGeneratorOrigin } from "./closure-origin.js";
 import { boundIdentifiers, containsParameterExpression, getFunctionLength, hoistedVarDeclarations } from "../parse/bindings.js";
@@ -42,12 +44,12 @@ export async function evaluateFunctionExpression(node, context, evaluateNode) {
         value: closure
     };
 }
-export function createInterpretedClosure(node, context, evaluateNode, homeObject) {
+export function createInterpretedClosure(node, context, evaluateNode, homeObject, initializeGeneratorPrototype = true) {
     if (node.type !== "ArrowFunctionExpression") {
         context = { ...context, functionEnvironment: { homeObject } };
     }
     if (node.type !== "ArrowFunctionExpression" && node.generator) {
-        return createGeneratorClosure(node, context, evaluateNode);
+        return createGeneratorClosure(node, context, evaluateNode, initializeGeneratorPrototype);
     }
     const construct = node.type !== "ArrowFunctionExpression" &&
         !(node.type === "FunctionExpression" && node.method === true) &&
@@ -123,7 +125,9 @@ export function executeAsyncFunction(execute, budget, signal, callContext) {
     });
     return createSandboxPromise(promise, { synchronousPrefix });
 }
-function createGeneratorClosure(node, context, evaluateNode) {
+function createGeneratorClosure(node, context, evaluateNode, initializePrototype) {
+    const prototypes = !initializePrototype || runResources.getStore()?.functionSourceText === false ? undefined
+        : generatorPrototypes.get(context.budget)?.get(node.async === true);
     const closure = createSandboxClosure({
         sourceRange: functionSources.get(node),
         guest: true,
@@ -133,48 +137,66 @@ function createGeneratorClosure(node, context, evaluateNode) {
         ...(node.id === undefined ? { name: context.inferredName } : { name: node.id.name }),
         retainedValues: () => [...context.scope.retainedValues(), context.functionEnvironment?.homeObject, context.functionEnvironment?.newTarget],
         call: async (args, callContext) => {
-            const closureContext = {
-                ...context,
-                compilation: callContext?.compilation ?? context.compilation,
-                callStack: [...(callContext?.stack ?? context.callStack)]
-            };
-            const scope = await createClosureScope(node, args, callContext?.thisValue, closureContext, evaluateNode);
-            const channel = createGeneratorChannel((generatorYield) => {
-                const execute = async () => {
-                    const result = await evaluateNode(node.body, {
-                        ...closureContext,
-                        functionBody: node.body,
-                        asyncGenerator: node.async,
-                        generatorBlockScopes: new Map(),
-                        generatorExpressionStates: new Map(),
-                        captureGeneratorScope: (suspendedScope, blocks, completions, expressions) => {
-                            origin.suspendedScope = suspendedScope;
-                            origin.blockScopes = blocks;
-                            origin.finallyCompletions = completions;
-                            origin.expressionStates = expressions;
-                        },
-                        generatorYield: (value, yieldNodeId) => {
-                            generator.state = "suspended";
-                            return generatorYield(value, yieldNodeId);
-                        },
-                        scope
-                    });
-                    if (result.kind === "error") {
-                        throw result.error;
-                    }
-                    if (result.kind === "throw") {
-                        throw result.value;
-                    }
-                    const value = result.hasValue ? result.value : undefined;
-                    return node.async ? awaitSandboxValue(value, context.signal, context.budget, createCoercionContext(context)) : value;
+            // Native generators select their instance prototype before initializing parameters.
+            const candidate = prototypes === undefined ? undefined : getGuestFunctionProperty(closure, "prototype");
+            const prototype = typeof candidate === "object" && candidate !== null ? candidate : prototypes?.instancePrototype;
+            const releasePrototype = prototype === undefined ? undefined : retainValues(context.budget, () => [prototype]);
+            try {
+                const closureContext = {
+                    ...context,
+                    compilation: callContext?.compilation ?? context.compilation,
+                    callStack: [...(callContext?.stack ?? context.callStack)]
                 };
-                return node.async ? runAsyncPrefix(execute) : execute();
-            });
-            const generator = createSandboxGenerator(channel, { async: node.async });
-            const origin = registerGeneratorOrigin(generator, node, scope, closureContext);
-            return generator;
+                const scope = await createClosureScope(node, args, callContext?.thisValue, closureContext, evaluateNode);
+                const channel = createGeneratorChannel((generatorYield) => {
+                    const execute = async () => {
+                        const result = await evaluateNode(node.body, {
+                            ...closureContext,
+                            functionBody: node.body,
+                            asyncGenerator: node.async,
+                            generatorBlockScopes: new Map(),
+                            generatorExpressionStates: new Map(),
+                            captureGeneratorScope: (suspendedScope, blocks, completions, expressions) => {
+                                origin.suspendedScope = suspendedScope;
+                                origin.blockScopes = blocks;
+                                origin.finallyCompletions = completions;
+                                origin.expressionStates = expressions;
+                            },
+                            generatorYield: (value, yieldNodeId) => {
+                                generator.state = "suspended";
+                                return generatorYield(value, yieldNodeId);
+                            },
+                            scope
+                        });
+                        if (result.kind === "error") {
+                            throw result.error;
+                        }
+                        if (result.kind === "throw") {
+                            throw result.value;
+                        }
+                        const value = result.hasValue ? result.value : undefined;
+                        return node.async ? awaitSandboxValue(value, context.signal, context.budget, createCoercionContext(context)) : value;
+                    };
+                    return node.async ? runAsyncPrefix(execute) : execute();
+                });
+                const generator = createSandboxGenerator(channel, { async: node.async });
+                if (prototype !== undefined)
+                    setSandboxPrototype(generator, prototype, context.budget);
+                const origin = registerGeneratorOrigin(generator, node, scope, closureContext);
+                return generator;
+            }
+            finally {
+                releasePrototype?.();
+            }
         }
     });
+    if (prototypes !== undefined) {
+        const prototype = Object.create(null);
+        markDescriptorObject(prototype);
+        setSandboxPrototype(prototype, prototypes.instancePrototype);
+        Object.defineProperty(materializeFunctionProperties(closure), "prototype", { value: prototype, writable: true });
+        setSandboxPrototype(closure, prototypes.functionPrototype);
+    }
     registerClosureOrigin(closure, node, context);
     return closure;
 }

package/packages/safe-js/dist/interp/bound-function-state.d.ts

@@ -0,0 +1,7 @@
+import type { SandboxClosure, SandboxValue } from "./values.js";
+export type BoundFunctionState = {
+    target: SandboxClosure;
+    thisValue: SandboxValue;
+    args: SandboxValue[];
+};
+export declare const boundFunctionStates: WeakMap<object, BoundFunctionState>;

package/packages/safe-js/dist/interp/bound-function-state.js

@@ -0,0 +1 @@
+export const boundFunctionStates = new WeakMap();

package/packages/safe-js/dist/interp/bound-function.d.ts

@@ -0,0 +1,4 @@
+import { type SandboxClosure } from "./values.js";
+import { type BoundFunctionState } from "./bound-function-state.js";
+import type { FunctionMethodOptions } from "./methods/function.js";
+export declare function createBoundFunction(state: BoundFunctionState, name: string | undefined, length: number | undefined, callClosure: FunctionMethodOptions["callClosure"]): SandboxClosure;

package/packages/safe-js/dist/interp/bound-function.js

@@ -0,0 +1,18 @@
+import { createSandboxClosure } from "./values.js";
+import { boundFunctionStates } from "./bound-function-state.js";
+export function createBoundFunction(state, name, length, callClosure) {
+    const bound = createSandboxClosure({
+        guest: true,
+        sandbox: true,
+        name,
+        length,
+        boundTarget: state.target,
+        retainedValues: () => [state.target, state.thisValue, ...state.args, bound.name],
+        call: (args, context) => callClosure(state.target, [...state.args, ...args], context?.stack ?? [], state.thisValue),
+        ...(state.target.construct === undefined ? {} : {
+            construct: (args, context) => callClosure(state.target, [...state.args, ...args], context?.stack ?? [], undefined, true, context?.newTarget === bound ? state.target : context?.newTarget)
+        })
+    });
+    boundFunctionStates.set(bound, state);
+    return bound;
+}

package/packages/safe-js/dist/interp/generator-prototypes.d.ts

@@ -0,0 +1,6 @@
+import type { Budget } from "./budget.js";
+import type { SandboxObject } from "./values.js";
+export declare const generatorPrototypes: WeakMap<Budget, Map<boolean, {
+    functionPrototype: SandboxObject;
+    instancePrototype: SandboxObject;
+}>>;

package/packages/safe-js/dist/interp/generator-prototypes.js

@@ -0,0 +1 @@
+export const generatorPrototypes = new WeakMap();

package/packages/safe-js/dist/interp/globals/function.d.ts

@@ -1,2 +1,2 @@
 import type { Budget } from "../budget.js";
-export declare function createFunctionPrototype(budget: Budget): void;
+export declare function createFunctionPrototype(budget: Budget, installHasInstance?: boolean): void;

package/packages/safe-js/dist/interp/globals/function.js

@@ -1,8 +1,9 @@
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { callFunctionMethod } from "../methods/function.js";
-import { getSandboxPrototype, installFunctionPrototype, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
+import { getSandboxPrototype, installFunctionPrototype, materializeFunctionProperties, registerIntrinsicFunction, setSandboxPrototype } from "../object-model.js";
 import { createSandboxClosure } from "../values.js";
-export function createFunctionPrototype(budget) {
+import { ordinaryHasInstance } from "../instanceof.js";
+export function createFunctionPrototype(budget, installHasInstance = true) {
     const prototype = createSandboxClosure({ guest: true, sandbox: true, name: "", length: 0, call: () => undefined });
     const properties = materializeFunctionProperties(prototype);
     // Invocation support does not grant the host's dynamic source constructor.
@@ -19,6 +20,13 @@ export function createFunctionPrototype(budget) {
             })
         });
     }
+    const hasInstance = installHasInstance ? createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.hasInstance]", length: 1,
+        call: ([value], context) => ordinaryHasInstance(value, context?.thisValue, budget, context)
+    }) : undefined;
+    if (hasInstance !== undefined)
+        Object.defineProperty(properties, Symbol.hasInstance, { value: hasInstance });
     setSandboxPrototype(prototype, getSandboxPrototype(Object.create(null), budget));
     installFunctionPrototype(budget, prototype);
+    if (hasInstance !== undefined)
+        registerIntrinsicFunction(budget, hasInstance);
 }

package/packages/safe-js/dist/interp/globals/generator.d.ts

@@ -0,0 +1,2 @@
+import type { Budget } from "../budget.js";
+export declare function createGeneratorPrototypes(budget: Budget): void;

package/packages/safe-js/dist/interp/globals/generator.js

@@ -0,0 +1,51 @@
+import { generatorPrototypes } from "../generator-prototypes.js";
+import { registerBuiltinIdentities, resolveIntrinsicIdentity } from "../intrinsics.js";
+import { callGeneratorMethod } from "../methods/generator.js";
+import { getSandboxPrototype, registerIntrinsicFunction, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { createSandboxClosure } from "../values.js";
+export function createGeneratorPrototypes(budget) {
+    const asyncIteratorPrototype = Object.create(null);
+    const asyncIterator = createSandboxClosure({ guest: true, sandbox: true,
+        name: "[Symbol.asyncIterator]", length: 0, call: (_args, context) => context?.thisValue });
+    Object.defineProperty(asyncIteratorPrototype, Symbol.asyncIterator, {
+        value: asyncIterator, writable: true, configurable: true
+    });
+    setSandboxPrototype(asyncIteratorPrototype, getSandboxPrototype(Object.create(null), budget));
+    registerBuiltinIdentities(budget, { "%AsyncIteratorPrototype%": asyncIteratorPrototype });
+    registerIntrinsicObject(budget, asyncIteratorPrototype);
+    registerIntrinsicFunction(budget, asyncIterator);
+    const state = new Map();
+    for (const async of [false, true]) {
+        const tag = async ? "AsyncGenerator" : "Generator";
+        const functionPrototype = Object.create(null);
+        const instancePrototype = Object.create(null);
+        setSandboxPrototype(functionPrototype, resolveIntrinsicIdentity(budget, JSON.stringify(["%FunctionPrototype%"])));
+        setSandboxPrototype(instancePrototype, async ? asyncIteratorPrototype
+            : resolveIntrinsicIdentity(budget, JSON.stringify(["%IteratorPrototype%"])));
+        Object.defineProperties(functionPrototype, {
+            prototype: { value: instancePrototype, configurable: true },
+            // Do not expose native dynamic-source constructors through this graph.
+            constructor: { value: undefined, configurable: true },
+            [Symbol.toStringTag]: { value: `${tag}Function`, configurable: true }
+        });
+        Object.defineProperties(instancePrototype, {
+            constructor: { value: functionPrototype, configurable: true },
+            [Symbol.toStringTag]: { value: tag, configurable: true }
+        });
+        for (const method of ["next", "return", "throw"]) {
+            Object.defineProperty(instancePrototype, method, { writable: true, configurable: true,
+                value: createSandboxClosure({ guest: true, sandbox: true, name: method, length: 1,
+                    call: ([value], context) => callGeneratorMethod(context?.thisValue, method, value, budget, context, async)
+                })
+            });
+        }
+        registerBuiltinIdentities(budget, {
+            [`%${tag}Prototype%`]: instancePrototype,
+            [`%${tag}FunctionPrototype%`]: functionPrototype
+        });
+        registerIntrinsicObject(budget, functionPrototype);
+        registerIntrinsicObject(budget, instancePrototype);
+        state.set(async, { functionPrototype, instancePrototype });
+    }
+    generatorPrototypes.set(budget, state);
+}

package/packages/safe-js/dist/interp/globals/object-array.js

@@ -20,7 +20,7 @@ import { toPropertyKey } from "../property-key.js";
 import { createNumericParsers } from "./numeric-parsers.js";
 import { createPrimitiveConstructor } from "./primitives.js";
 import { arrayMethodNames, callArrayMethod } from "../methods/array.js";
-import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, installArrayPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, installArrayPrototype, isGuestClosure, markDescriptorObject, materializeFunctionProperties, registerIntrinsicObject, registerIntrinsicFunction, setSandboxPrototype } from "../object-model.js";
 import { allocateProducedSandboxValue, createSandboxClosure, deepCopyToSandbox, defineOwnDataProperty, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet, measureSandboxData, ownEnumerableSandboxKeys as getOwnEnumerableKeys, ownSandboxSymbolKeys, ownEnumerableSandboxEntries as getDirectEntries } from "../values.js";
 export function createObjectArrayGlobals(options) {
     return {
@@ -332,6 +332,21 @@ function createArrayGlobal(budget) {
             guest: true, sandbox: true, name: "[Symbol.iterator]", length: 0,
             call: (_args, context) => context?.thisValue
         }), writable: true, configurable: true });
+    const iteratorTagGetter = createSandboxClosure({ guest: true, sandbox: true,
+        name: "get [Symbol.toStringTag]", length: 0, call: () => "Iterator" });
+    const iteratorTagSetter = createSandboxClosure({ guest: true, sandbox: true,
+        name: "set [Symbol.toStringTag]", length: 1, call: ([value], context) => {
+            const receiver = context?.thisValue;
+            if (receiver === iterablePrototype || receiver === null || typeof receiver !== "object")
+                throw new TypeError("Iterator tag setter requires a distinct object receiver.");
+            defineOwnDataProperty(objectProperties(receiver, true), Symbol.toStringTag, value);
+            createDataCheckpoint(budget, context)(receiver, 0, true);
+            return undefined;
+        }
+    });
+    Object.defineProperty(iterablePrototype, Symbol.toStringTag, {
+        get: accessorAdapter(iteratorTagGetter, "get"), set: accessorAdapter(iteratorTagSetter, "set"), configurable: true
+    });
     setSandboxPrototype(iterablePrototype, getSandboxPrototype(Object.create(null), budget));
     setSandboxPrototype(iteratorPrototype, iterablePrototype);
     Object.defineProperties(iteratorPrototype, {
@@ -341,6 +356,9 @@ function createArrayGlobal(budget) {
         [Symbol.toStringTag]: { value: "Array Iterator", configurable: true }
     });
     registerBuiltinIdentities(budget, { "%ArrayIteratorPrototype%": iteratorPrototype, "%IteratorPrototype%": iterablePrototype });
+    registerIntrinsicFunction(budget, iterablePrototype[Symbol.iterator]);
+    registerIntrinsicFunction(budget, iteratorTagGetter);
+    registerIntrinsicFunction(budget, iteratorTagSetter);
     registerIntrinsicObject(budget, iterablePrototype);
     registerIntrinsicObject(budget, iteratorPrototype);
     for (const method of ["keys", "values", "entries"]) {

package/packages/safe-js/dist/interp/globals.d.ts

@@ -3,6 +3,7 @@ import type { RunClock } from "../run.js";
 export declare function createBuiltinBindings(options: Parameters<typeof createConsoleJsonGlobals>[0] & {
     random?: () => number;
     clock?: RunClock;
+    functionHasInstance?: boolean;
 }): {
     RegExp: import("./values.js").SandboxClosure;
     Promise: import("./values.js").SandboxClosure;

package/packages/safe-js/dist/interp/globals.js

@@ -8,6 +8,7 @@ import { createMiscGlobals } from "./globals/misc.js";
 import { createUriGlobals } from "./globals/uri.js";
 import { createObjectArrayGlobals } from "./globals/object-array.js";
 import { createFunctionPrototype } from "./globals/function.js";
+import { createGeneratorPrototypes } from "./globals/generator.js";
 import { createPromiseGlobals } from "./promise.js";
 import { createDateGlobal } from "./globals/date.js";
 import { createSymbolGlobal } from "./globals/symbol.js";
@@ -29,7 +30,8 @@ export function createBuiltinBindings(options) {
         ...createPromiseGlobals(options),
         ...createRegexGlobals(options)
     };
-    createFunctionPrototype(options.budget);
+    createFunctionPrototype(options.budget, options.functionHasInstance);
+    createGeneratorPrototypes(options.budget);
     registerBuiltinIdentities(options.budget, bindings);
     return bindings;
 }

package/packages/safe-js/dist/interp/instanceof.d.ts

@@ -0,0 +1,4 @@
+import type { Budget } from "./budget.js";
+import { type SandboxCallContext, type SandboxValue } from "./values.js";
+export declare function evaluateInstanceof(value: SandboxValue, constructor: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<boolean>;
+export declare function ordinaryHasInstance(value: SandboxValue, constructor: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<boolean>;

package/packages/safe-js/dist/interp/instanceof.js

@@ -0,0 +1,58 @@
+import { assertSandboxDataDepth } from "../graph-depth.js";
+import { readPropertyDescriptor } from "./accessors.js";
+import { invokeBuiltinClosure } from "./builtin-call.js";
+import { isFloat32Array } from "./float32.js";
+import { isFloat32ArrayConstructor } from "./globals/float32array.js";
+import { isSandboxErrorConstructorInstance } from "./globals/error.js";
+import { getSandboxPropertyDescriptor, getSandboxPrototype, isGuestClosure } from "./object-model.js";
+import { isSandboxClosure } from "./values.js";
+export async function evaluateInstanceof(value, constructor, budget, context) {
+    if (constructor === null || typeof constructor !== "object")
+        throw new TypeError("Right-hand side of 'instanceof' must be an object.");
+    const method = await readInstanceProperty(constructor, Symbol.hasInstance, budget, context);
+    if (method !== undefined && method !== null) {
+        if (!isSandboxClosure(method))
+            throw new TypeError("Symbol.hasInstance must be callable.");
+        return Boolean(await invokeBuiltinClosure(method, [value], budget, context, constructor));
+    }
+    if (!isSandboxClosure(constructor))
+        throw new TypeError("Right-hand side of 'instanceof' is not a function.");
+    return ordinaryHasInstance(value, constructor, budget, context);
+}
+export async function ordinaryHasInstance(value, constructor, budget, context) {
+    if (!isSandboxClosure(constructor))
+        return false;
+    if (constructor.boundTarget !== undefined) {
+        budget.visitNode();
+        return evaluateInstanceof(value, constructor.boundTarget, budget, context);
+    }
+    // These existing built-ins do not yet have ordinary prototype graphs.
+    if (isFloat32ArrayConstructor(constructor))
+        return isFloat32Array(value);
+    if (isSandboxErrorConstructorInstance(value, constructor))
+        return true;
+    if (!isGuestClosure(constructor) || typeof value !== "object" || value === null)
+        return false;
+    const prototype = await readInstanceProperty(constructor, "prototype", budget, context);
+    if (typeof prototype !== "object" || prototype === null)
+        throw new TypeError("Function has a non-object prototype in instanceof check.");
+    let depth = 0;
+    for (let current = getSandboxPrototype(value, budget); current !== null; current = getSandboxPrototype(current, budget)) {
+        budget.visitNode();
+        assertSandboxDataDepth(depth++);
+        if (current === prototype)
+            return true;
+    }
+    return false;
+}
+async function readInstanceProperty(value, key, budget, context) {
+    if (context?.getProperty !== undefined)
+        return context.getProperty(value, key);
+    const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+    if (descriptor === undefined)
+        return undefined;
+    return readPropertyDescriptor(descriptor, value, {
+        ...context, stack: context?.stack ?? [], thisValue: value,
+        invokeClosure: context?.invokeClosure ?? ((closure, args, receiver) => invokeBuiltinClosure(closure, args, budget, context, receiver))
+    });
+}

package/packages/safe-js/dist/interp/interpreter.js

@@ -34,13 +34,13 @@ import { getRegexMember, setRegexMember } from "./methods/regex.js";
 import { bindPattern } from "./patterns.js";
 import { callStringMethod, getStringMember, isStringMethodName, validateStringMethodArguments } from "./methods/string.js";
 import { callSetMethod, getSetMember, isSetMethodName } from "./methods/set.js";
-import { isSandboxErrorConstructorInstance } from "./globals/error.js";
+import { evaluateInstanceof } from "./instanceof.js";
 import { hasOwnSandboxProperty } from "./globals/object.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
 import { getCollectionIteratorMember } from "./methods/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState } from "./regexp-iterator.js";
 import { getRegExpIteratorMember } from "./methods/regexp-iterator.js";
-import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
+import { getFloat32Member, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
 import { createSandboxRegex, allocateProducedSandboxValue, ownEnumerableSandboxKeys, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet, reconcileCompiledValues } from "./values.js";
@@ -2604,48 +2604,11 @@ function applyBinaryOperator(node, left, right, context) {
         case ">>>":
             return toNumber(left) >>> toNumber(right);
         case "instanceof":
-            return evaluateInstanceof(left, right, context);
+            return evaluateInstanceof(left, right, context.budget, createCoercionContext(context));
         case "in":
             return hasSandboxProperty(right, left, context);
     }
 }
-async function evaluateInstanceof(left, right, context) {
-    while (true) {
-        if (right === null || (typeof right !== "object" && typeof right !== "function"))
-            throw new TypeError("Right-hand side of 'instanceof' must be an object.");
-        const method = await getPropertyValue(right, Symbol.hasInstance, context);
-        if (method !== undefined && method !== null) {
-            if (!isSandboxClosure(method))
-                throw new TypeError("Symbol.hasInstance must be callable.");
-            return Boolean(await invokeSandboxClosure(method, [left], context, context.callStack, undefined, right));
-        }
-        if (!isSandboxClosure(right))
-            throw new TypeError("Right-hand side of 'instanceof' is not a function.");
-        if (right.boundTarget === undefined)
-            break;
-        context.budget.visitNode();
-        right = right.boundTarget;
-    }
-    if (isFloat32ArrayConstructor(right))
-        return isFloat32Array(left);
-    if (isSandboxErrorConstructorInstance(left, right))
-        return true;
-    if (isGuestClosure(right)) {
-        if (typeof left !== "object" || left === null)
-            return false;
-        const prototype = await getPropertyValue(right, "prototype", context);
-        if (typeof prototype !== "object" || prototype === null)
-            throw new TypeError("Function has a non-object prototype in instanceof check.");
-        let depth = 0;
-        for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
-            context.budget.visitNode();
-            assertSandboxDataDepth(depth++);
-            if (current === prototype)
-                return true;
-        }
-    }
-    return false;
-}
 export function createCoercionContext(context) {
     return {
         stack: context.callStack,

package/packages/safe-js/dist/interp/iteration.js

@@ -14,6 +14,7 @@ import { suspendJob } from "./jobs.js";
 import { invokeBuiltinClosure } from "./builtin-call.js";
 import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype } from "./object-model.js";
 import { getIntrinsicIdentity } from "./intrinsics.js";
+import { readPropertyDescriptor } from "./accessors.js";
 export function mapIteratorSnapshot(snapshot, map) {
     if (snapshot.kind === "unsupported")
         throw new TypeError("Host-owned iterator cannot be portably snapshotted.");
@@ -51,16 +52,14 @@ export async function acquireSandboxIterator(value, budget, context, asyncProtoc
     if (getSandboxPropertyDescriptor(value, key, budget) === undefined &&
         !(isSandboxRegExpIterator(value) && !asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)) {
         if (isSandboxGenerator(value)) {
-            if (hasExplicitSandboxPrototype(value))
-                return undefined;
-            if ((value.async === true) === asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)
+            if (!hasExplicitSandboxPrototype(value) && (value.async === true) === asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)
                 return guestIterator(value, await context.getProperty(value, "next"), asyncProtocol, budget, context, signal);
         }
         if (!asyncProtocol && Array.isArray(value) && getSandboxPrototype(value, budget) !== null)
             return undefined;
         if (!asyncProtocol)
             return getSandboxIterator(value, budget, context);
-        if (isSandboxGenerator(value) && value.async)
+        if (isSandboxGenerator(value) && value.async && !hasExplicitSandboxPrototype(value))
             return getSandboxAsyncIterator(value, budget, context, signal);
         const iterator = await acquireSandboxIterator(value, budget, context);
         return iterator === undefined ? undefined : asyncFromSyncIterator(iterator, budget, signal, context);
@@ -137,7 +136,8 @@ export async function readIteratorResult(iterator, result, property) {
 }
 export function getSandboxAsyncIterator(value, budget, context, signal) {
     if (isSandboxGenerator(value) && value.async) {
-        return hasExplicitSandboxPrototype(value) ? undefined
+        return hasExplicitSandboxPrototype(value) ? context?.getProperty === undefined
+            ? generatorProtocolAdapter(value, budget, context, true, signal) : undefined
             : { ...generatorObjectIterator(value, budget, context), asyncProtocol: true };
     }
     if (value !== null &&
@@ -296,7 +296,12 @@ export function getSandboxIterator(value, budget, context) {
         return syncIterator(Float32Array.prototype.values.call(value));
     }
     if (isSandboxGenerator(value)) {
-        return value.async || hasExplicitSandboxPrototype(value) ? undefined : generatorObjectIterator(value, budget, context);
+        if (value.async)
+            return undefined;
+        if (hasExplicitSandboxPrototype(value))
+            return context?.getProperty === undefined
+                ? generatorProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
+        return generatorObjectIterator(value, budget, context);
     }
     if (typeof value === "string") {
         const iterator = value[Symbol.iterator]();
@@ -381,6 +386,39 @@ function collectionIterator(collection, value) {
     return adapter;
 }
 const asyncGeneratorRequests = new WeakMap();
+function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal) {
+    // Direct host adapters still need guest property reads, receiver binding and
+    // cached next methods, but retain their asynchronous generator result channel.
+    const bridge = {
+        ...context,
+        stack: context?.stack ?? [],
+        thisValue: value,
+        invokeClosure: (closure, args, receiver, construct) => invokeBuiltinClosure(closure, args, budget, context, receiver, construct),
+        getProperty: (target, key) => {
+            const descriptor = getSandboxPropertyDescriptor(target, key, budget);
+            return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, target, bridge, true);
+        }
+    };
+    let resolved;
+    let pending;
+    const initialize = () => pending ??= acquireSandboxIterator(value, budget, bridge, asyncProtocol, signal).then(iterator => {
+        if (iterator === undefined)
+            throw new TypeError("Generator does not provide an iterator protocol.");
+        return resolved = iterator;
+    });
+    return {
+        asynchronous: true,
+        ...(asyncProtocol ? { asyncProtocol: true } : {}),
+        get retainedValue() { return [value, resolved?.retainedValue]; },
+        snapshot: () => resolved?.snapshot?.() ?? { kind: "unsupported" },
+        next: async (...args) => (await initialize()).next(...args),
+        getOperation: async (method) => {
+            const iterator = await initialize();
+            return iterator.getOperation === undefined ? iterator[method] : iterator.getOperation(method);
+        },
+        readResultProperty: async (result, property) => readIteratorResult(await initialize(), result, property)
+    };
+}
 function generatorObjectIterator(generator, budget, context) {
     const iterator = generatorIterator(generator, budget, context);
     if (context?.getProperty === undefined)