poe-code 14.0.81 → 14.0.83

package/packages/safe-js/dist/interp/iteration.js

@@ -1,6 +1,7 @@
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxSet } from "./values.js";
 import { enterRunningState } from "./running-state.js";
 import { isFloat32Array } from "./float32.js";
+import { float32Prototypes } from "./float32-prototypes.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
@@ -98,6 +99,9 @@ export async function acquireSandboxIterator(value, budget, context, asyncProtoc
     const iterator = await invokeBuiltinClosure(factory, [], budget, context, value);
     if ((typeof iterator !== "object" && typeof iterator !== "function") || iterator === null)
         throw new TypeError("Iterator must be an object.");
+    if (!asyncProtocol && isSandboxGenerator(iterator) && !iterator.async &&
+        !hasExplicitSandboxPrototype(iterator) && getSandboxPropertyDescriptor(iterator, "next", budget) === undefined)
+        return getSandboxIterator(iterator, budget, context);
     const next = await context.getProperty(iterator, "next");
     return guestIterator(iterator, next, asyncProtocol, budget, context, signal);
 }
@@ -137,7 +141,7 @@ export async function readIteratorResult(iterator, result, property) {
 export function getSandboxAsyncIterator(value, budget, context, signal) {
     if (isSandboxGenerator(value) && value.async) {
         return hasExplicitSandboxPrototype(value) ? context?.getProperty === undefined
-            ? generatorProtocolAdapter(value, budget, context, true, signal) : undefined
+            ? guestProtocolAdapter(value, budget, context, true, signal) : undefined
             : { ...generatorObjectIterator(value, budget, context), asyncProtocol: true };
     }
     if (value !== null &&
@@ -293,6 +297,11 @@ export function getSandboxIterator(value, budget, context) {
     if (isGuestHostObject(value))
         return getHostObjectIterator(value);
     if (isFloat32Array(value)) {
+        if (hasExplicitSandboxPrototype(value) || (budget !== undefined && float32Prototypes.has(budget))) {
+            if (getSandboxPropertyDescriptor(value, Symbol.iterator, budget) === undefined)
+                return undefined;
+            return guestProtocolAdapter(value, budget ?? new Budget(), context, false);
+        }
         return syncIterator(Float32Array.prototype.values.call(value));
     }
     if (isSandboxGenerator(value)) {
@@ -300,7 +309,7 @@ export function getSandboxIterator(value, budget, context) {
             return undefined;
         if (hasExplicitSandboxPrototype(value))
             return context?.getProperty === undefined
-                ? generatorProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
+                ? guestProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
         return generatorObjectIterator(value, budget, context);
     }
     if (typeof value === "string") {
@@ -386,9 +395,9 @@ function collectionIterator(collection, value) {
     return adapter;
 }
 const asyncGeneratorRequests = new WeakMap();
-function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal) {
-    // Direct host adapters still need guest property reads, receiver binding and
-    // cached next methods, but retain their asynchronous generator result channel.
+function guestProtocolAdapter(value, budget, context, asyncProtocol, signal) {
+    // Direct adapters still need guest property reads, receiver binding and
+    // cached next methods without exposing native iterator objects.
     const bridge = {
         ...context,
         stack: context?.stack ?? [],
@@ -403,7 +412,7 @@ function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal)
     let pending;
     const initialize = () => pending ??= acquireSandboxIterator(value, budget, bridge, asyncProtocol, signal).then(iterator => {
         if (iterator === undefined)
-            throw new TypeError("Generator does not provide an iterator protocol.");
+            throw new TypeError("Value does not provide an iterator protocol.");
         return resolved = iterator;
     });
     return {

package/packages/safe-js/dist/interp/object-model.js

@@ -7,6 +7,10 @@ import { releaseTemplateObjects } from "./template-objects.js";
 import { isSandboxDate } from "./date.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
+import { errorPrototypes } from "./error-prototypes.js";
+import { float32Properties, isFloat32Array, isFloat32Index } from "./float32.js";
+import { float32Prototypes } from "./float32-prototypes.js";
+import { sandboxErrorTypes } from "../error/shape.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet } from "./values.js";
 const guestClosures = new WeakSet();
@@ -273,12 +277,24 @@ export function releaseObjectPrototype(budget) {
     arrayPrototypes.delete(budget);
     functionPrototypes.delete(budget);
     generatorPrototypes.delete(budget);
+    errorPrototypes.delete(budget);
+    float32Prototypes.delete(budget);
     initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }
 export function getSandboxPrototype(value, budget) {
     if (prototypes.has(value))
         return prototypes.get(value) ?? null;
+    if (isFloat32Array(value))
+        return budget === undefined ? null : float32Prototypes.get(budget) ?? null;
+    // Host transport records are data-only. Resolve their default prototype in
+    // the receiving realm without persisting executable intrinsic graphs.
+    const errorType = sandboxErrorTypes.get(value);
+    if (budget !== undefined && errorType !== undefined) {
+        const prototype = errorPrototypes.get(budget)?.get(errorType);
+        if (prototype !== undefined)
+            return prototype;
+    }
     if (budget !== undefined && isGuestClosure(value) && runResources.getStore()?.functionSourceText !== false)
         return functionPrototypes.get(budget) ?? null;
     if (budget !== undefined && Array.isArray(value))
@@ -317,6 +333,10 @@ export function getSandboxPropertyDescriptor(value, key, budget) {
     while (typeof current === "object" &&
         current !== null &&
         (Array.isArray(current) || isSandboxGenerator(current) || isSandboxDate(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxMap(current) || isSandboxSet(current) || isPrototypeRecord(current))) {
+        // An integer-indexed object stops numeric-key lookup even when it occurs
+        // inside another object's prototype chain and the index is invalid.
+        if (isFloat32Array(current) && typeof key !== "symbol" && isFloat32Index(String(key)))
+            return Object.getOwnPropertyDescriptor(current, key);
         const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current)
             ? key === "prototype" && current.construct !== undefined && current.boundTarget === undefined
                 ? materializeFunctionProperties(current) : getGuestFunctionProperties(current)
@@ -339,6 +359,8 @@ export function getSandboxDataProperty(value, key, budget) {
     let current = value;
     let depth = 0;
     while (typeof current === "object" && current !== null) {
+        if (isFloat32Array(current) && typeof key !== "symbol" && isFloat32Index(String(key)))
+            return Object.getOwnPropertyDescriptor(current, key)?.value;
         if (isGuestHostObject(current))
             return typeof key === "symbol" ? undefined : getHostObjectMember(current, String(key));
         if (isSandboxRegex(current))
@@ -405,6 +427,8 @@ export function setSandboxPrototype(value, prototype, budget) {
     prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+    if (isFloat32Array(value))
+        return true;
     if (isGuestClosure(value))
         return true;
     if (isGuestHostObject(value))
@@ -436,5 +460,7 @@ export function hasGuestObjectState(value) {
     if (isSandboxBox(value) || isSandboxDate(value))
         return false;
     return (descriptorObjects.has(value) &&
-        Object.values(Object.getOwnPropertyDescriptors(value)).some((descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable));
+        (isFloat32Array(value)
+            ? float32Properties(value).map(([, descriptor]) => descriptor)
+            : Object.values(Object.getOwnPropertyDescriptors(value))).some((descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable));
 }

package/packages/safe-js/dist/interp/values.js

@@ -1,5 +1,6 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
 import { internalSymbols } from "./internal-symbols.js";
+import { getIntrinsicIdentity } from "./intrinsics.js";
 import { getGeneratorProperties } from "./generator-properties.js";
 import { getRegexProperties, regexGuestProperties } from "./regexp-properties.js";
 import { getCollectionProperties, collectionGuestProperties, copyCollectionProperties } from "./collection-properties.js";
@@ -16,7 +17,7 @@ import { boxedDataProperties, boxedValue, createSandboxBox, isSandboxBox, native
 import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, measureHostObjectData, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { types as nodeTypes } from "node:util";
 import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
-import { copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
+import { copyFloat32Storage, float32DataProperties, float32Properties, float32Storage, isFloat32Array } from "./float32.js";
 import { SandboxError } from "./budget.js";
 import { observeSandboxPromise, trackSandboxPromise } from "./promise-tracker.js";
 import { promiseReplayContext } from "./promise-replay.js";
@@ -24,7 +25,7 @@ import { invokeCancelableClosure, readPromiseCancellation, registerPromiseCancel
 import { parseRegex } from "./regex/parse.js";
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { sandboxErrorTypes } from "../error/shape.js";
-import { getGuestFunctionProperties, getSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, hasNullObjectPrototype, isGuestClosure, isIntrinsicFunction, registerGuestClosure, setSandboxPrototype } from "./object-model.js";
+import { getGuestFunctionProperties, getSandboxPrototype, hasExplicitSandboxPrototype, hasGuestObjectState, hasManagedDescriptors, hasNullObjectPrototype, isGuestClosure, isIntrinsicFunction, registerGuestClosure, setSandboxPrototype } from "./object-model.js";
 import { copySandboxArgumentProperties, createSandboxArguments, getSandboxArgumentEntries, isSandboxArguments } from "./arguments.js";
 export { createSandboxArguments, isSandboxArguments } from "./arguments.js";
 export { isSandboxMap, isSandboxSet } from "./collection-brands.js";
@@ -404,9 +405,17 @@ export function measureSandboxData(values, options = {}) {
                 seen.add(storage.buffer);
                 usage += storage.byteLength;
             }
-            for (const [key, descriptor] of float32DataProperties(value)) {
-                usage += key.length + 1;
-                visit(descriptor.value, depth + 1);
+            for (const [key, descriptor] of float32Properties(value)) {
+                usage += 1;
+                if (typeof key === "string")
+                    usage += key.length;
+                else
+                    visit(key, depth + 1);
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+                else
+                    for (const closure of retainedAccessorClosures(descriptor))
+                        visit(closure, depth + 1);
             }
             return;
         }
@@ -578,7 +587,7 @@ export function measureSandboxData(values, options = {}) {
             if (descriptor !== undefined)
                 descriptors.push([key, descriptor]);
         }
-        const includeNonEnumerable = isSandboxDate(value) || hasManagedDescriptors(value);
+        const includeNonEnumerable = isSandboxDate(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
         for (const [key, descriptor] of descriptors) {
             if (!descriptor.enumerable && !includeNonEnumerable)
                 continue;
@@ -908,6 +917,50 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     }
     if (nodeTypes.isProxy(value))
         throw new TypeError("Unsupported proxy sandbox value.");
+    if (sandboxErrorTypes.has(value) && hasExplicitSandboxPrototype(value)) {
+        const prototype = getSandboxPrototype(value);
+        let nativePrototype = null;
+        if (prototype !== null) {
+            const identity = getIntrinsicIdentity(prototype);
+            const nativePrototypes = {
+                Error: Error.prototype, TypeError: TypeError.prototype, RangeError: RangeError.prototype,
+                ReferenceError: ReferenceError.prototype, SyntaxError: SyntaxError.prototype,
+                URIError: URIError.prototype, EvalError: EvalError.prototype, AggregateError: AggregateError.prototype
+            };
+            const path = identity === undefined ? [] : JSON.parse(identity);
+            if (path.length !== 2 || typeof path[0] !== "string" || path[1] !== "prototype" || !Object.hasOwn(nativePrototypes, path[0]))
+                throw new TypeError("Custom Error prototype links cannot be copied as data.");
+            nativePrototype = nativePrototypes[path[0]];
+            let current = prototype;
+            let prototypeDepth = 0;
+            while (current !== null) {
+                assertSandboxDataDepth(++prototypeDepth);
+                const objectPrototype = getIntrinsicIdentity(current) === '["Object","prototype"]';
+                const owner = objectPrototype ? Object.getOwnPropertyDescriptor(current, "constructor")?.value : current;
+                if (owner === null || typeof owner !== "object" ||
+                    (objectPrototype && getIntrinsicIdentity(owner) !== '["Object"]') || hasGuestObjectState(owner))
+                    throw new TypeError("Modified Error prototype links cannot be copied as data.");
+                current = getSandboxPrototype(current);
+            }
+        }
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const descriptors = Reflect.ownKeys(value).filter(key => typeof key !== "symbol" || !internalSymbols.has(key))
+            .map(key => [key, Object.getOwnPropertyDescriptor(value, key)]);
+        if (descriptors.some(([, descriptor]) => !("value" in descriptor)))
+            throw new TypeError("Error accessor properties cannot be copied as data.");
+        const copy = new Error();
+        delete copy.stack;
+        Object.setPrototypeOf(copy, nativePrototype);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of descriptors)
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyFromSandbox(descriptor.value, state, joinPath(path, key), options, depth + 1) });
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
         throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
     }

package/packages/safe-js/dist/parse/parser.js

@@ -2709,6 +2709,7 @@ class Parser {
         return undefined;
     }
     findTopLevelForIterationOperator(startIndex) {
+        let operator;
         let depth = 0;
         let previousToken;
         for (let index = startIndex; index < this.tokens.length; index += 1) {
@@ -2719,7 +2720,7 @@ class Parser {
                 }
                 else if (token.value === ")" || token.value === "]" || token.value === "}") {
                     if (depth === 0 && token.value === ")") {
-                        return undefined;
+                        return operator;
                     }
                     depth -= 1;
                 }
@@ -2730,9 +2731,12 @@ class Parser {
             if (depth === 0 &&
                 token.type === "keyword" &&
                 (token.value === "of" || token.value === "in") &&
+                index !== startIndex &&
+                !(token.value === "of" && index === startIndex + 1 &&
+                    ["const", "let", "var"].includes(previousToken?.value ?? "")) &&
                 previousToken?.value !== "." &&
                 previousToken?.value !== "?.") {
-                return token;
+                operator ??= token;
             }
             previousToken = token;
         }
@@ -3752,7 +3756,8 @@ function isLiteralPropertyKey(token) {
     return token.type === "numeric" || token.type === "string";
 }
 function isIdentifierLikeToken(token) {
-    return token.type === "identifier" || (token.type === "keyword" && token.value === "async");
+    return token.type === "identifier" ||
+        (token.type === "keyword" && (token.value === "async" || token.value === "of"));
 }
 function isNewToken(token) {
     return token.value === "new";

package/packages/safe-js/dist/parse/tokenizer.js

@@ -358,7 +358,7 @@ class Lexer {
             }
             if (char === "/" &&
                 this.peekChar(1) !== "=" &&
-                shouldRejectRegexLiteral(tokens[tokens.length - 1], lastClosedControlParenthesis)) {
+                shouldRejectRegexLiteral(tokens[tokens.length - 1], lastClosedControlParenthesis, tokens)) {
                 if (!this.options.allowRegexLiterals) {
                     this.syntaxError("Regular expression literals are not supported", this.position());
                 }
@@ -633,7 +633,7 @@ class Lexer {
     readSlashOrPunctuator(start) {
         if (this.currentChar() === "/" &&
             this.peekChar(1) !== "=" &&
-            shouldRejectRegexLiteral(this.lastSignificantToken(), this.lastClosedControlParenthesis)) {
+            shouldRejectRegexLiteral(this.lastSignificantToken(), this.lastClosedControlParenthesis, this.tokens)) {
             if (!this.options.allowRegexLiterals) {
                 this.syntaxError("Regular expression literals are not supported", start);
             }
@@ -919,7 +919,7 @@ function matchPunctuator(source, index) {
     return PUNCTUATORS.find((punctuator) => source.startsWith(punctuator, index) &&
         (punctuator !== "?." || !isDecimalDigit(source[index + 2] ?? "")));
 }
-function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
+function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis, tokens) {
     if (previousToken === undefined) {
         return true;
     }
@@ -930,6 +930,8 @@ function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
         return false;
     }
     if (previousToken.type === "keyword") {
+        if (previousToken.value === "of")
+            return endsWithForOfSeparator(tokens);
         return !EXPRESSION_ENDING_KEYWORDS.has(previousToken.value);
     }
     if (previousToken.value === ")") {
@@ -937,6 +939,46 @@ function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
     }
     return !isExpressionEndingPunctuator(previousToken.value);
 }
+function endsWithForOfSeparator(tokens) {
+    let depth = 0;
+    let start = -1;
+    for (let index = tokens.length - 2; index >= 0; index--) {
+        const token = tokens[index];
+        if (token.type !== "punctuator")
+            continue;
+        if ([")", "]", "}"].includes(token.value))
+            depth++;
+        else if (["(", "[", "{"].includes(token.value)) {
+            if (depth > 0) {
+                depth--;
+                continue;
+            }
+            if (token.value === "(" && (tokens[index - 1]?.value === "for" ||
+                (tokens[index - 1]?.value === "await" && tokens[index - 2]?.value === "for")))
+                start = index + 1;
+            break;
+        }
+        else if (depth === 0 && token.value === ";")
+            break;
+    }
+    if (start < 0)
+        return false;
+    depth = 0;
+    for (let index = start; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (token.type === "punctuator") {
+            if (["(", "[", "{"].includes(token.value))
+                depth++;
+            else if ([")", "]", "}"].includes(token.value))
+                depth--;
+        }
+        if (depth === 0 && token.type === "keyword" && token.value === "of" &&
+            index !== start && tokens[index - 1]?.value !== "." && tokens[index - 1]?.value !== "?." &&
+            !(index === start + 1 && ["const", "let", "var"].includes(tokens[start].value)))
+            return index === tokens.length - 1;
+    }
+    return false;
+}
 function updateGroupingState(groupingStack, previousToken, punctuator) {
     if (punctuator === "(") {
         groupingStack.push({

package/packages/safe-js/dist/snapshot/float32array.d.ts

@@ -1,3 +1,6 @@
+import type { GuestObjectState } from "./guest-heap.js";
+export declare function captureFloat32State<T>(value: Float32Array, encode: (value: unknown) => T): GuestObjectState<T>;
+export declare function restoreFloat32Properties<T>(value: Float32Array, state: GuestObjectState<T>, decode: (value: T) => unknown): void;
 export type Float32Data<TReference> = {
     kind: "float32array";
     byteOffset: number;

package/packages/safe-js/dist/snapshot/float32array.js

@@ -1,4 +1,23 @@
-import { float32Storage, isFloat32Array } from "../interp/float32.js";
+import { float32Properties, float32Storage, isFloat32Array, isFloat32Index } from "../interp/float32.js";
+import { getSandboxPrototype, hasExplicitSandboxPrototype } from "../interp/object-model.js";
+import { restorePropertyDescriptors, serializePropertyDescriptors } from "./property-descriptors.js";
+export function captureFloat32State(value, encode) {
+    const metadata = Object.defineProperties(Object.create(null), Object.fromEntries(float32Properties(value)));
+    if (!Object.isExtensible(value))
+        Object.preventExtensions(metadata);
+    return { properties: serializePropertyDescriptors(metadata, encode),
+        ...(hasExplicitSandboxPrototype(value) ? { prototype: encode(getSandboxPrototype(value)) } : {}) };
+}
+export function restoreFloat32Properties(value, state, decode) {
+    const metadata = Object.create(null);
+    restorePropertyDescriptors(metadata, state.properties, decode);
+    const descriptors = Object.getOwnPropertyDescriptors(metadata);
+    if (Object.keys(descriptors).some(isFloat32Index))
+        throw new TypeError("Float32Array metadata cannot replace numeric storage.");
+    Object.defineProperties(value, descriptors);
+    if (!Object.isExtensible(metadata))
+        Object.preventExtensions(value);
+}
 export function encodeFloat32Storage(value, id, buffers, reference) {
     const storage = float32Storage(value);
     const existing = buffers.get(storage.buffer);

package/packages/safe-js/dist/snapshot/guest-heap-validation.js

@@ -1,4 +1,5 @@
 import { Budget } from "../interp/budget.js";
+import { sandboxErrorNames } from "../error/shape.js";
 import { createRawJson } from "../interp/raw-json.js";
 import { createBuiltinBindings } from "../interp/globals.js";
 import { getIntrinsicIdentity, listIntrinsicIdentities, resolveIntrinsicIdentity } from "../interp/intrinsics.js";
@@ -146,7 +147,9 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         state(node.state);
     }
     else if (node.kind === "guest-object" || node.kind === "guest-array") {
-        fields(node, ["kind", "state"], node.kind === "guest-array" ? ["templateNodeId", "templateOwner"] : []);
+        fields(node, ["kind", "state"], node.kind === "guest-array" ? ["templateNodeId", "templateOwner"] : ["errorType"]);
+        if (Object.hasOwn(node, "errorType") && !sandboxErrorNames.includes(node.errorType))
+            throw new TypeError("Invalid guest error type.");
         if (Object.hasOwn(node, "templateOwner"))
             reference(node.templateOwner, ["guest-array"]);
         if (Object.hasOwn(node, "templateNodeId") && integer(node.templateNodeId) < 1)

package/packages/safe-js/dist/snapshot/guest-heap.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxErrorName } from "../error/shape.js";
 import { type ScopeFrame } from "../interp/scope.js";
 import { type PropertyDescriptorData } from "./property-descriptors.js";
 import type { CompletionResult } from "../interp/exceptions.js";
@@ -73,6 +74,7 @@ export type GuestHeapNode<T> = {
 } | {
     kind: "guest-object";
     state: GuestObjectState<T>;
+    errorType?: SandboxErrorName;
 } | {
     kind: "guest-array";
     state: GuestObjectState<T>;

package/packages/safe-js/dist/snapshot/guest-heap.js

@@ -1,5 +1,6 @@
 import { getClosureOrigin, getGeneratorOrigin } from "../interp/closure-origin.js";
 import { boundFunctionStates } from "../interp/bound-function-state.js";
+import { sandboxErrorTypes } from "../error/shape.js";
 import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { getIntrinsicIdentity } from "../interp/intrinsics.js";
 import { getSandboxPrototype, hasExplicitSandboxPrototype, hasGuestObjectState, isGuestClosure, materializeFunctionProperties } from "../interp/object-model.js";
@@ -151,8 +152,11 @@ export function captureGuestHeapNode(value, encode) {
             isSandboxRegExpIterator(value))
             return undefined;
         const prototype = Object.getPrototypeOf(value);
-        if ((prototype === null || prototype === Object.prototype) && hasGuestObjectState(value))
-            return { kind: "guest-object", state: captureObjectState(value, encode) };
+        if ((prototype === null || prototype === Object.prototype) && hasGuestObjectState(value)) {
+            const errorType = sandboxErrorTypes.get(value);
+            return { kind: "guest-object", state: captureObjectState(value, encode),
+                ...(errorType === undefined ? {} : { errorType }) };
+        }
         return undefined;
     }
     if (origin.node.nodeId === undefined)

package/packages/safe-js/dist/snapshot/restore.js

@@ -17,12 +17,12 @@ import { awaitSandboxValue } from "../interp/cancel.js";
 import { runAsyncPrefix } from "../interp/jobs.js";
 import { toPropertyKey } from "../interp/property-key.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
-import { decodeFloat32Storage } from "./float32array.js";
+import { decodeFloat32Storage, restoreFloat32Properties } from "./float32array.js";
 import { restoreDateTime } from "../interp/date.js";
 import { createRawJson } from "../interp/raw-json.js";
 import { createSandboxBox } from "../interp/boxed.js";
 import { restoreBoxedProperties } from "./boxed.js";
-import { sandboxErrorTypes } from "../error/shape.js";
+import { sandboxErrorNames, sandboxErrorTypes } from "../error/shape.js";
 import { SnapshotMismatchError } from "../restore.js";
 import { evaluateNode, Scope, setSandboxProperty } from "../interp/interpreter.js";
 import { getGuestFunctionProperties, getGuestFunctionProperty, getSandboxDataProperty, isGuestClosure, materializeFunctionProperties, registerGuestClosure, setSandboxPrototype } from "../interp/object-model.js";
@@ -398,7 +398,24 @@ function initializeIntrinsicRealm(state) {
             const method = state.heap[String(value.id)];
             return method?.kind === "intrinsic" && method.id === '["%FunctionPrototype%",{"symbol":"hasInstance"}]';
         });
-    createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner, functionHasInstance });
+    const errorConstructors = Object.values(state.heap).filter(node => node.kind === "intrinsic" && sandboxErrorNames.some(name => node.id === JSON.stringify([name])));
+    const errorPrototypes = errorConstructors.every(node => node.kind === "intrinsic" &&
+        node.state?.properties.properties.some(([key, descriptor]) => {
+            if (key !== "prototype" || descriptor.kind !== "data" || descriptor.writable ||
+                descriptor.enumerable || descriptor.configurable)
+                return false;
+            const value = descriptor.value;
+            if (value === null || typeof value !== "object" || !("kind" in value) || value.kind !== "ref")
+                return false;
+            const prototype = state.heap[String(value.id)];
+            return prototype?.kind === "intrinsic" &&
+                prototype.id === JSON.stringify([...JSON.parse(node.id), "prototype"]);
+        }));
+    const float32 = Object.values(state.heap).find(node => node.kind === "intrinsic" && node.id === '["Float32Array"]');
+    const float32Prototypes = float32?.kind !== "intrinsic" ||
+        float32.state?.properties.properties.some(([key, descriptor]) => key === "prototype" && descriptor.kind === "data" &&
+            !descriptor.writable && !descriptor.enumerable && !descriptor.configurable) === true;
+    createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner, functionHasInstance, errorPrototypes, float32Prototypes });
     state.intrinsicsInitialized = true;
 }
 function restoreHeapValue(id, state) {
@@ -440,8 +457,19 @@ function restoreHeapValue(id, state) {
         return value;
     }
     if (serialized.kind === "float32array") {
+        if (serialized.state !== undefined)
+            initializeIntrinsicRealm(state);
         const value = decodeFloat32Storage(serialized, (reference) => deserializeValue(reference, state));
         state.heapValueById.set(id, value);
+        if (serialized.state !== undefined) {
+            const objectState = serialized.state;
+            state.initializeIterators.push(() => {
+                if (objectState.prototype !== undefined)
+                    setSandboxPrototype(value, deserializeValue(objectState.prototype, state), state.budget);
+                restoreFloat32Properties(value, objectState, entry => deserializeValue(entry, state));
+            });
+            return value;
+        }
         for (const [key, entry] of Object.entries(serialized.entries)) {
             Object.defineProperty(value, key, {
                 value: deserializeValue(entry, state),
@@ -653,6 +681,8 @@ function restoreHeapValue(id, state) {
                     throw new TypeError(`Missing restored function properties for ${serialized.kind === "intrinsic" ? serialized.id : serialized.kind}.`);
                 if (objectState.prototype !== undefined)
                     setSandboxPrototype(value, deserializeValue(objectState.prototype, state), state.budget);
+                if (serialized.kind === "guest-object" && serialized.errorType !== undefined)
+                    sandboxErrorTypes.set(value, serialized.errorType);
                 restorePropertyDescriptors(target, objectState.properties, entry => deserializeValue(entry, state));
                 if (serialized.kind === "guest-array" && serialized.templateNodeId !== undefined) {
                     const node = state.nodeById.get(serialized.templateNodeId);

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -4,7 +4,7 @@ import { type SerializedSymbol, type SerializedSymbolProperty } from "./symbols.
 import { type CollectionIterationMethod, type SandboxCollectionIterator } from "../interp/collection-iterator.js";
 import { type SandboxRegExpIterator } from "../interp/regexp-iterator.js";
 import { type SandboxErrorName } from "../error/shape.js";
-import { type GuestHeapNode } from "./guest-heap.js";
+import { type GuestHeapNode, type GuestObjectState } from "./guest-heap.js";
 import { type SerializedArguments } from "./arguments.js";
 import { type SerializedArray } from "./arrays.js";
 import { type Float32Data } from "./float32array.js";
@@ -75,6 +75,7 @@ export type SerializedHeapValue = GuestHeapNode<SerializedSnapshotValue> | {
     entries: Record<string, SerializedSnapshotValue>;
 } | SerializedDate<SerializedSnapshotValue> | (Float32Data<SerializedReferenceValue> & {
     entries: Record<string, SerializedSnapshotValue>;
+    state?: GuestObjectState<SerializedSnapshotValue>;
 }) | SerializedArguments<SerializedSnapshotValue> | SerializedArray<SerializedSnapshotValue> | {
     kind: "object";
     sandboxNullPrototype?: true;

package/packages/safe-js/dist/snapshot/serialize.js

@@ -11,8 +11,8 @@ import { captureGuestHeapNode } from "./guest-heap.js";
 import { getGeneratorOrigin } from "../interp/closure-origin.js";
 import { serializeArguments } from "./arguments.js";
 import { requiresArrayEntries, serializeArray } from "./arrays.js";
-import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
-import { encodeFloat32Storage } from "./float32array.js";
+import { isFloat32Array } from "../interp/float32.js";
+import { captureFloat32State, encodeFloat32Storage } from "./float32array.js";
 import { dateDataProperties, isSandboxDate } from "../interp/date.js";
 import { serializeDate } from "./date-properties.js";
 import { boxedDataProperties, isSandboxBox } from "../interp/boxed.js";
@@ -104,7 +104,7 @@ function serializeValue(value, path, state) {
         }
         return { kind: "ref", id };
     }
-    if (typeof value === "object" && value !== null && hasGuestObjectState(value) && !isSandboxMap(value) && !isSandboxSet(value)) {
+    if (typeof value === "object" && value !== null && hasGuestObjectState(value) && !isSandboxMap(value) && !isSandboxSet(value) && !isFloat32Array(value)) {
         throw new TypeError("Guest function properties and prototype links cannot be serialized.");
     }
     if (value === null || typeof value === "string" || typeof value === "boolean") {
@@ -265,10 +265,8 @@ function serializeHeapReference(value, path, state) {
                 kind: "ref",
                 id
             }));
-            const entries = Object.create(null);
-            state.heap[String(id)] = { ...storage, entries };
-            for (const [key, descriptor] of float32DataProperties(value))
-                entries[key] = serializeValue(descriptor.value, `${path}.${key}`, state);
+            state.heap[String(id)] = { ...storage, entries: {},
+                state: captureFloat32State(value, entry => serializeValue(entry, `${path}.<typed-array>`, state)) };
         }
         else if (isSandboxArguments(value)) {
             state.heap[String(id)] = serializeArguments(value, (entry, key) => serializeValue(entry, `${path}.${key}`, state));
@@ -431,9 +429,12 @@ function collectContainerStats(value, stats, ancestors, guestValues, depth = 0)
     stat.expanded = true;
     ancestors.add(value);
     const guestEntries = [];
-    const guest = captureGuestHeapNode(value, entry => { guestEntries.push(entry); return null; });
+    const guest = isFloat32Array(value)
+        ? { kind: "float32array", state: captureFloat32State(value, entry => { guestEntries.push(entry); return null; }) }
+        : captureGuestHeapNode(value, entry => { guestEntries.push(entry); return null; });
     if (guest !== undefined) {
-        guestValues.add(value);
+        if (!isFloat32Array(value))
+            guestValues.add(value);
         for (const entry of guestEntries) {
             collectContainerStats(entry, stats, ancestors, guestValues, depth + 1);
             if (entry !== null && typeof entry === "object") {

package/packages/safe-js/dist/snapshot/validation.js

@@ -120,6 +120,11 @@ function validateDumpHeap(root, state) {
         if (entry.kind === "float32array") {
             validateFloat32Storage(entry);
             requireRecord(entry.entries, `${path}.entries`);
+            if (Object.hasOwn(entry, "state")) {
+                if (Object.keys(entry.entries).length !== 0)
+                    fail("invalidValue", path, "ambiguous Float32Array property state");
+                validateGuestHeapNode({ kind: "guest-object", state: entry.state }, heap, state.limits.maxEntries);
+            }
             continue;
         }
         if (entry.kind === "arguments") {
@@ -551,6 +556,11 @@ function validateHeapValue(value, path, state, heap) {
     if (record.kind === "float32array") {
         validateFloat32Storage(record);
         requireRecord(record.entries, `${path}.entries`);
+        if (Object.hasOwn(record, "state")) {
+            if (Object.keys(record.entries).length !== 0)
+                fail("invalidValue", path, "ambiguous Float32Array property state");
+            validateGuestHeapNode({ kind: "guest-object", state: record.state }, heap, state.limits.maxEntries);
+        }
     }
     if (record.kind === "map") {
         const entries = requireArray(record.entries, `${path}.entries`, state);
@@ -706,7 +716,7 @@ function validateArrayHeap(record, path, state) {
 function validateErrorType(record, path) {
     if (!Object.hasOwn(record, "errorType"))
         return;
-    if (record.kind !== "object" ||
+    if ((record.kind !== "object" && record.kind !== "guest-object") ||
         !sandboxErrorNames.includes(record.errorType)) {
         fail("invalidValue", `${path}.errorType`, "invalid error metadata");
     }