poe-code 14.0.82 → 14.0.84

package/packages/safe-js/dist/interp/globals.js

@@ -1,6 +1,6 @@
 import { createConsoleJsonGlobals } from "./globals/console-json.js";
 import { createCollectionGlobals } from "./globals/collections.js";
-import { createFloat32ArrayGlobal } from "./globals/float32array.js";
+import { createFloat32ArrayGlobal, createFloat32ArrayPrototypes } from "./globals/float32array.js";
 import { createErrorGlobals, createErrorPrototypes } from "./globals/error.js";
 import { createMathGlobals } from "./globals/math.js";
 import { createRegexGlobals } from "./globals/regex.js";
@@ -13,24 +13,28 @@ import { createPromiseGlobals } from "./promise.js";
 import { createDateGlobal } from "./globals/date.js";
 import { createSymbolGlobal } from "./globals/symbol.js";
 import { createBigIntGlobal } from "./globals/bigint.js";
+import { createArrayBufferGlobal } from "./globals/array-buffer.js";
 import { registerBuiltinIdentities } from "./intrinsics.js";
 export function createBuiltinBindings(options) {
     const bindings = {
         ...createConsoleJsonGlobals(options),
         ...createCollectionGlobals(options),
-        Float32Array: createFloat32ArrayGlobal(options.budget),
+        Float32Array: createFloat32ArrayGlobal(options.budget, options.float32Prototypes !== false),
         Date: createDateGlobal(options),
         Symbol: createSymbolGlobal(options.budget),
         BigInt: createBigIntGlobal(options.budget),
         ...createErrorGlobals({ ...options, errorPrototypes: options.errorPrototypes !== false }),
         ...createMathGlobals({ random: options.random, budget: options.budget }),
         ...createObjectArrayGlobals(options),
+        ArrayBuffer: createArrayBufferGlobal(options.budget),
         ...createMiscGlobals(options),
         ...createUriGlobals(options.budget),
         ...createPromiseGlobals(options),
         ...createRegexGlobals(options)
     };
     createFunctionPrototype(options.budget, options.functionHasInstance);
+    if (options.float32Prototypes !== false)
+        createFloat32ArrayPrototypes(options.budget, bindings.Float32Array);
     if (options.errorPrototypes !== false)
         createErrorPrototypes(options.budget, bindings);
     createGeneratorPrototypes(options.budget);

package/packages/safe-js/dist/interp/host-bridge.d.ts

@@ -42,5 +42,6 @@ export declare function copyHostValueToSandbox(value: unknown, stackFrames: read
     errorData?: boolean;
 }, state: {
     seen: WeakMap<object, SandboxValue>;
+    float32Buffers?: WeakMap<ArrayBuffer, ArrayBuffer>;
 }, path: string): SandboxValue;
 export {};

package/packages/safe-js/dist/interp/host-bridge.js

@@ -5,6 +5,7 @@ import { exportHostCapability, importHostCapability, isLiveCapability } from "./
 import { attachErrorSpan, replaceErrorStack } from "../error/shape.js";
 import { SandboxError } from "./budget.js";
 import { CompileScope } from "./regex/compile-guard.js";
+import { arrayBufferDataProperties, arrayBufferLength, copyArrayBufferStorage, isSandboxArrayBuffer } from "./array-buffer.js";
 import { checkFloat32Allocation, copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
 import { createSubsetErrorValue } from "./exceptions.js";
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
@@ -705,6 +706,25 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
         state.seen.set(value, date);
         return date;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const length = arrayBufferLength(value);
+        budget.allocateArrayLength(length);
+        budget.provisionDataUsage(length + 1)();
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            if (typeof key === "symbol")
+                throw new TypeError("Host ArrayBuffer symbol properties require an explicit capability path.");
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyHostValueToSandbox(descriptor.value, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), key] }, state, joinPath(path, key)) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (isFloat32Array(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -712,6 +732,7 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
         checkFloat32Allocation(Math.ceil(float32Storage(value).byteLength / 4), budget);
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyHostValueToSandbox(float32Storage(value).buffer, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), "buffer"] }, state, `${path}.buffer`);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,

package/packages/safe-js/dist/interp/host-call.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
+import { float32DataProperties, float32Storage, float32ViewLayouts, isFloat32Array } from "./float32.js";
+import { arrayBufferDataProperties, arrayBufferLength, arrayBufferOptions, isSandboxArrayBuffer } from "./array-buffer.js";
 import { copyNativeDate, serializedDateTime } from "./date.js";
 import { cloneSandboxValue, createSandboxClosure, defineOwnDataProperty, isArrayIndexKey, measureSandboxData } from "./values.js";
 import { CompileScope } from "./regex/compile-guard.js";
@@ -585,8 +586,26 @@ function normalize(value, seen) {
         const date = copyNativeDate(value);
         if (date !== undefined)
             return Object.assign(Object.create(null), { $type: "date", time: serializedDateTime(date) });
+        if (isSandboxArrayBuffer(value)) {
+            arrayBufferLength(value);
+            const properties = Object.create(null);
+            const entries = [];
+            for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+                if (typeof key === "symbol")
+                    throw new TypeError("ArrayBuffer symbol properties require an explicit host-call identity.");
+                entries.push([key, descriptor]);
+            }
+            for (const [key, descriptor] of entries.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))
+                defineOwnDataProperty(properties, key, normalize(descriptor.value, seen));
+            return Object.assign(Object.create(null), { $type: "arraybuffer",
+                bytes: normalize(Array.from(new Uint8Array(value)), seen), ...arrayBufferOptions(value), properties });
+        }
         if (isFloat32Array(value)) {
             const storage = float32Storage(value);
+            const resizable = arrayBufferOptions(storage.buffer) !== undefined;
+            const layout = resizable ? float32ViewLayouts.get(value) : undefined;
+            if (resizable && layout === undefined)
+                throw new TypeError("Resizable Float32Array host-call identity requires known view layout.");
             const properties = Object.create(null);
             for (const [key, descriptor] of float32DataProperties(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
                 defineOwnDataProperty(properties, key, normalize(descriptor.value, seen));
@@ -596,7 +615,12 @@ function normalize(value, seen) {
                 bytes: normalize(Array.from(new Uint8Array(storage.buffer)), seen),
                 byteOffset: storage.byteOffset,
                 length: storage.length,
-                properties
+                properties,
+                ...(resizable || Reflect.ownKeys(storage.buffer).length > 0
+                    ? { buffer: normalize(storage.buffer, seen) } : {}),
+                ...(layout === undefined ? {} : { viewLayout: {
+                        byteOffset: layout.byteOffset, length: layout.length ?? null
+                    } })
             });
         }
         if (Array.isArray(value)) {

package/packages/safe-js/dist/interp/instanceof.js

@@ -27,7 +27,7 @@ export async function ordinaryHasInstance(value, constructor, budget, context) {
         return evaluateInstanceof(value, constructor.boundTarget, budget, context);
     }
     // These existing built-ins do not yet have ordinary prototype graphs.
-    if (isFloat32ArrayConstructor(constructor))
+    if (isFloat32ArrayConstructor(constructor) && !isGuestClosure(constructor))
         return isFloat32Array(value);
     if ((!isGuestClosure(constructor) || (value !== null && typeof value === "object" && !hasExplicitSandboxPrototype(value))) &&
         isSandboxErrorConstructorInstance(value, constructor))

package/packages/safe-js/dist/interp/interpreter.js

@@ -2380,7 +2380,7 @@ async function evaluateMemberCallExpression(node, context) {
             return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (isFloat32Array(member.object)) {
-            return evaluateResolvedCallExpression(node, getFloat32Member(member.object, member.property, context.budget), context, member.object);
+            return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (isSandboxSet(member.object)) {
             return evaluatePrimitiveMemberCall(node, "Set", member.property, getSetMember(member.object, member.property, createSetMethodOptions(context)), context);
@@ -2911,9 +2911,7 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
     if (isSandboxMap(target) || isSandboxSet(target))
         target = getCollectionProperties(target);
     if (isFloat32Array(target)) {
-        if (typeof property === "symbol")
-            throw new TypeError("Typed array symbol properties are not yet supported.");
-        setFloat32Member(target, property, value);
+        setFloat32Member(target, property, value, budget);
         return;
     }
     if (isSandboxRegex(target)) {

package/packages/safe-js/dist/interp/iteration.js

@@ -1,6 +1,7 @@
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxSet } from "./values.js";
 import { enterRunningState } from "./running-state.js";
 import { isFloat32Array } from "./float32.js";
+import { float32Prototypes } from "./float32-prototypes.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
@@ -98,6 +99,9 @@ export async function acquireSandboxIterator(value, budget, context, asyncProtoc
     const iterator = await invokeBuiltinClosure(factory, [], budget, context, value);
     if ((typeof iterator !== "object" && typeof iterator !== "function") || iterator === null)
         throw new TypeError("Iterator must be an object.");
+    if (!asyncProtocol && isSandboxGenerator(iterator) && !iterator.async &&
+        !hasExplicitSandboxPrototype(iterator) && getSandboxPropertyDescriptor(iterator, "next", budget) === undefined)
+        return getSandboxIterator(iterator, budget, context);
     const next = await context.getProperty(iterator, "next");
     return guestIterator(iterator, next, asyncProtocol, budget, context, signal);
 }
@@ -137,7 +141,7 @@ export async function readIteratorResult(iterator, result, property) {
 export function getSandboxAsyncIterator(value, budget, context, signal) {
     if (isSandboxGenerator(value) && value.async) {
         return hasExplicitSandboxPrototype(value) ? context?.getProperty === undefined
-            ? generatorProtocolAdapter(value, budget, context, true, signal) : undefined
+            ? guestProtocolAdapter(value, budget, context, true, signal) : undefined
             : { ...generatorObjectIterator(value, budget, context), asyncProtocol: true };
     }
     if (value !== null &&
@@ -293,6 +297,11 @@ export function getSandboxIterator(value, budget, context) {
     if (isGuestHostObject(value))
         return getHostObjectIterator(value);
     if (isFloat32Array(value)) {
+        if (hasExplicitSandboxPrototype(value) || (budget !== undefined && float32Prototypes.has(budget))) {
+            if (getSandboxPropertyDescriptor(value, Symbol.iterator, budget) === undefined)
+                return undefined;
+            return guestProtocolAdapter(value, budget ?? new Budget(), context, false);
+        }
         return syncIterator(Float32Array.prototype.values.call(value));
     }
     if (isSandboxGenerator(value)) {
@@ -300,7 +309,7 @@ export function getSandboxIterator(value, budget, context) {
             return undefined;
         if (hasExplicitSandboxPrototype(value))
             return context?.getProperty === undefined
-                ? generatorProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
+                ? guestProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
         return generatorObjectIterator(value, budget, context);
     }
     if (typeof value === "string") {
@@ -386,9 +395,9 @@ function collectionIterator(collection, value) {
     return adapter;
 }
 const asyncGeneratorRequests = new WeakMap();
-function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal) {
-    // Direct host adapters still need guest property reads, receiver binding and
-    // cached next methods, but retain their asynchronous generator result channel.
+function guestProtocolAdapter(value, budget, context, asyncProtocol, signal) {
+    // Direct adapters still need guest property reads, receiver binding and
+    // cached next methods without exposing native iterator objects.
     const bridge = {
         ...context,
         stack: context?.stack ?? [],
@@ -403,7 +412,7 @@ function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal)
     let pending;
     const initialize = () => pending ??= acquireSandboxIterator(value, budget, bridge, asyncProtocol, signal).then(iterator => {
         if (iterator === undefined)
-            throw new TypeError("Generator does not provide an iterator protocol.");
+            throw new TypeError("Value does not provide an iterator protocol.");
         return resolved = iterator;
     });
     return {

package/packages/safe-js/dist/interp/methods/array-iterator.js

@@ -18,7 +18,7 @@ export async function nextArrayIterator(value, budget, context) {
             ?? getSandboxPropertyDescriptor(source, key, budget) ?? { value: undefined }, source, context);
     try {
         budget.visitNode();
-        const number = isFloat32Array(source) ? float32Storage(source).length
+        const number = isFloat32Array(source) ? float32Storage(source, true).length
             : await sandboxNumber(await read("length"), budget, context);
         const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
         if (index >= length) {

package/packages/safe-js/dist/interp/object-model.js

@@ -8,6 +8,9 @@ import { isSandboxDate } from "./date.js";
 import { retainedAccessorClosures } from "./accessors.js";
 import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { errorPrototypes } from "./error-prototypes.js";
+import { float32Properties, isFloat32Array, isFloat32Index } from "./float32.js";
+import { float32Prototypes } from "./float32-prototypes.js";
+import { arrayBufferPrototypes, isSandboxArrayBuffer } from "./array-buffer.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet } from "./values.js";
@@ -276,12 +279,18 @@ export function releaseObjectPrototype(budget) {
     functionPrototypes.delete(budget);
     generatorPrototypes.delete(budget);
     errorPrototypes.delete(budget);
+    float32Prototypes.delete(budget);
+    arrayBufferPrototypes.delete(budget);
     initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }
 export function getSandboxPrototype(value, budget) {
     if (prototypes.has(value))
         return prototypes.get(value) ?? null;
+    if (isSandboxArrayBuffer(value))
+        return budget === undefined ? null : arrayBufferPrototypes.get(budget) ?? null;
+    if (isFloat32Array(value))
+        return budget === undefined ? null : float32Prototypes.get(budget) ?? null;
     // Host transport records are data-only. Resolve their default prototype in
     // the receiving realm without persisting executable intrinsic graphs.
     const errorType = sandboxErrorTypes.get(value);
@@ -328,6 +337,10 @@ export function getSandboxPropertyDescriptor(value, key, budget) {
     while (typeof current === "object" &&
         current !== null &&
         (Array.isArray(current) || isSandboxGenerator(current) || isSandboxDate(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxMap(current) || isSandboxSet(current) || isPrototypeRecord(current))) {
+        // An integer-indexed object stops numeric-key lookup even when it occurs
+        // inside another object's prototype chain and the index is invalid.
+        if (isFloat32Array(current) && typeof key !== "symbol" && isFloat32Index(String(key)))
+            return Object.getOwnPropertyDescriptor(current, key);
         const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current)
             ? key === "prototype" && current.construct !== undefined && current.boundTarget === undefined
                 ? materializeFunctionProperties(current) : getGuestFunctionProperties(current)
@@ -350,6 +363,8 @@ export function getSandboxDataProperty(value, key, budget) {
     let current = value;
     let depth = 0;
     while (typeof current === "object" && current !== null) {
+        if (isFloat32Array(current) && typeof key !== "symbol" && isFloat32Index(String(key)))
+            return Object.getOwnPropertyDescriptor(current, key)?.value;
         if (isGuestHostObject(current))
             return typeof key === "symbol" ? undefined : getHostObjectMember(current, String(key));
         if (isSandboxRegex(current))
@@ -416,6 +431,10 @@ export function setSandboxPrototype(value, prototype, budget) {
     prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+    if (isSandboxArrayBuffer(value))
+        return true;
+    if (isFloat32Array(value))
+        return true;
     if (isGuestClosure(value))
         return true;
     if (isGuestHostObject(value))
@@ -447,5 +466,7 @@ export function hasGuestObjectState(value) {
     if (isSandboxBox(value) || isSandboxDate(value))
         return false;
     return (descriptorObjects.has(value) &&
-        Object.values(Object.getOwnPropertyDescriptors(value)).some((descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable));
+        (isFloat32Array(value)
+            ? float32Properties(value).map(([, descriptor]) => descriptor)
+            : Object.values(Object.getOwnPropertyDescriptors(value))).some((descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable));
 }

package/packages/safe-js/dist/interp/values.d.ts

@@ -17,7 +17,7 @@ declare const sandboxRegexBrand: unique symbol;
 declare const sandboxRegexPattern: unique symbol;
 declare const sandboxRetainedValues: unique symbol;
 export type SandboxPrimitive = string | number | bigint | boolean | symbol | null | undefined;
-export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
+export type SandboxValue = SandboxPrimitive | Date | Float32Array | ArrayBuffer | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
 export type SandboxObject = {
     [key: string]: SandboxValue;
     [key: symbol]: SandboxValue;

package/packages/safe-js/dist/interp/values.js

@@ -1,4 +1,5 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
+import { arrayBufferDataProperties, arrayBufferLength, copyArrayBufferStorage, isSandboxArrayBuffer } from "./array-buffer.js";
 import { internalSymbols } from "./internal-symbols.js";
 import { getIntrinsicIdentity } from "./intrinsics.js";
 import { getGeneratorProperties } from "./generator-properties.js";
@@ -17,7 +18,7 @@ import { boxedDataProperties, boxedValue, createSandboxBox, isSandboxBox, native
 import { getHostObjectKeys, getHostObjectMember, hasHostObjectMember, measureHostObjectData, isGuestHostObject, isLiveCapability } from "./host-capabilities.js";
 import { types as nodeTypes } from "node:util";
 import { CompileScope, RegexCompileGuard, regexCompiledData } from "./regex/compile-guard.js";
-import { copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
+import { copyFloat32Storage, float32DataProperties, float32Properties, float32Storage, isFloat32Array } from "./float32.js";
 import { SandboxError } from "./budget.js";
 import { observeSandboxPromise, trackSandboxPromise } from "./promise-tracker.js";
 import { promiseReplayContext } from "./promise-replay.js";
@@ -399,15 +400,22 @@ export function measureSandboxData(values, options = {}) {
         const prototype = getSandboxPrototype(value);
         if (prototype !== null)
             visit(prototype, depth + 1);
+        if (isSandboxArrayBuffer(value))
+            usage += arrayBufferLength(value);
         if (isFloat32Array(value)) {
             const storage = float32Storage(value);
-            if (!seen.has(storage.buffer)) {
-                seen.add(storage.buffer);
-                usage += storage.byteLength;
-            }
-            for (const [key, descriptor] of float32DataProperties(value)) {
-                usage += key.length + 1;
-                visit(descriptor.value, depth + 1);
+            visit(storage.buffer, depth + 1);
+            for (const [key, descriptor] of float32Properties(value)) {
+                usage += 1;
+                if (typeof key === "string")
+                    usage += key.length;
+                else
+                    visit(key, depth + 1);
+                if ("value" in descriptor)
+                    visit(descriptor.value, depth + 1);
+                else
+                    for (const closure of retainedAccessorClosures(descriptor))
+                        visit(closure, depth + 1);
             }
             return;
         }
@@ -579,7 +587,7 @@ export function measureSandboxData(values, options = {}) {
             if (descriptor !== undefined)
                 descriptors.push([key, descriptor]);
         }
-        const includeNonEnumerable = isSandboxDate(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
+        const includeNonEnumerable = isSandboxDate(value) || isSandboxArrayBuffer(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
         for (const [key, descriptor] of descriptors) {
             if (!descriptor.enumerable && !includeNonEnumerable)
                 continue;
@@ -796,6 +804,20 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         }
         return sandboxPromise;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyToSandbox(descriptor.value, state, joinPath(path, key), cloneSandboxCollections, depth + 1) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (nodeTypes.isDate(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -819,6 +841,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
             return existing;
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyToSandbox(float32Storage(value).buffer, state, `${path}.buffer`, cloneSandboxCollections, depth + 1);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,
@@ -1013,6 +1036,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             return existing;
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyFromSandbox(float32Storage(value).buffer, state, `${path}.buffer`, options, depth + 1);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,
@@ -1023,6 +1047,20 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             Object.preventExtensions(copy);
         return copy;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyFromSandbox(descriptor.value, state, joinPath(path, key), options, depth + 1) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (isSandboxDate(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -1180,6 +1218,18 @@ function allocateSandboxValue(value, budget, seen) {
         budget.allocateString(value);
         return;
     }
+    if (isSandboxArrayBuffer(value)) {
+        if (seen.has(value))
+            return;
+        seen.add(value);
+        budget.allocateArrayLength(arrayBufferLength(value));
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            if (typeof key === "string")
+                budget.allocateString(key);
+            allocateSandboxValue(descriptor.value, budget, seen);
+        }
+        return;
+    }
     if (isSandboxBox(value)) {
         if (seen.has(value))
             return;

package/packages/safe-js/dist/lint/rules/known-globals.d.ts

@@ -1 +1 @@
-export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "BigInt", "Date", "decodeURI", "decodeURIComponent", "encodeURI", "encodeURIComponent", "Error", "EvalError", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "URIError", "console"];
+export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "ArrayBuffer", "Boolean", "BigInt", "Date", "decodeURI", "decodeURIComponent", "encodeURI", "encodeURIComponent", "Error", "EvalError", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "URIError", "console"];

package/packages/safe-js/dist/lint/rules/known-globals.js

@@ -1,6 +1,7 @@
 export const KNOWN_RUNTIME_GLOBALS = [
     "AggregateError",
     "Array",
+    "ArrayBuffer",
     "Boolean",
     "BigInt",
     "Date",

package/packages/safe-js/dist/parse/parser.js

@@ -2709,6 +2709,7 @@ class Parser {
         return undefined;
     }
     findTopLevelForIterationOperator(startIndex) {
+        let operator;
         let depth = 0;
         let previousToken;
         for (let index = startIndex; index < this.tokens.length; index += 1) {
@@ -2719,7 +2720,7 @@ class Parser {
                 }
                 else if (token.value === ")" || token.value === "]" || token.value === "}") {
                     if (depth === 0 && token.value === ")") {
-                        return undefined;
+                        return operator;
                     }
                     depth -= 1;
                 }
@@ -2730,9 +2731,12 @@ class Parser {
             if (depth === 0 &&
                 token.type === "keyword" &&
                 (token.value === "of" || token.value === "in") &&
+                index !== startIndex &&
+                !(token.value === "of" && index === startIndex + 1 &&
+                    ["const", "let", "var"].includes(previousToken?.value ?? "")) &&
                 previousToken?.value !== "." &&
                 previousToken?.value !== "?.") {
-                return token;
+                operator ??= token;
             }
             previousToken = token;
         }
@@ -3752,7 +3756,8 @@ function isLiteralPropertyKey(token) {
     return token.type === "numeric" || token.type === "string";
 }
 function isIdentifierLikeToken(token) {
-    return token.type === "identifier" || (token.type === "keyword" && token.value === "async");
+    return token.type === "identifier" ||
+        (token.type === "keyword" && (token.value === "async" || token.value === "of"));
 }
 function isNewToken(token) {
     return token.value === "new";

package/packages/safe-js/dist/parse/tokenizer.js

@@ -358,7 +358,7 @@ class Lexer {
             }
             if (char === "/" &&
                 this.peekChar(1) !== "=" &&
-                shouldRejectRegexLiteral(tokens[tokens.length - 1], lastClosedControlParenthesis)) {
+                shouldRejectRegexLiteral(tokens[tokens.length - 1], lastClosedControlParenthesis, tokens)) {
                 if (!this.options.allowRegexLiterals) {
                     this.syntaxError("Regular expression literals are not supported", this.position());
                 }
@@ -633,7 +633,7 @@ class Lexer {
     readSlashOrPunctuator(start) {
         if (this.currentChar() === "/" &&
             this.peekChar(1) !== "=" &&
-            shouldRejectRegexLiteral(this.lastSignificantToken(), this.lastClosedControlParenthesis)) {
+            shouldRejectRegexLiteral(this.lastSignificantToken(), this.lastClosedControlParenthesis, this.tokens)) {
             if (!this.options.allowRegexLiterals) {
                 this.syntaxError("Regular expression literals are not supported", start);
             }
@@ -919,7 +919,7 @@ function matchPunctuator(source, index) {
     return PUNCTUATORS.find((punctuator) => source.startsWith(punctuator, index) &&
         (punctuator !== "?." || !isDecimalDigit(source[index + 2] ?? "")));
 }
-function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
+function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis, tokens) {
     if (previousToken === undefined) {
         return true;
     }
@@ -930,6 +930,8 @@ function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
         return false;
     }
     if (previousToken.type === "keyword") {
+        if (previousToken.value === "of")
+            return endsWithForOfSeparator(tokens);
         return !EXPRESSION_ENDING_KEYWORDS.has(previousToken.value);
     }
     if (previousToken.value === ")") {
@@ -937,6 +939,46 @@ function shouldRejectRegexLiteral(previousToken, lastClosedControlParenthesis) {
     }
     return !isExpressionEndingPunctuator(previousToken.value);
 }
+function endsWithForOfSeparator(tokens) {
+    let depth = 0;
+    let start = -1;
+    for (let index = tokens.length - 2; index >= 0; index--) {
+        const token = tokens[index];
+        if (token.type !== "punctuator")
+            continue;
+        if ([")", "]", "}"].includes(token.value))
+            depth++;
+        else if (["(", "[", "{"].includes(token.value)) {
+            if (depth > 0) {
+                depth--;
+                continue;
+            }
+            if (token.value === "(" && (tokens[index - 1]?.value === "for" ||
+                (tokens[index - 1]?.value === "await" && tokens[index - 2]?.value === "for")))
+                start = index + 1;
+            break;
+        }
+        else if (depth === 0 && token.value === ";")
+            break;
+    }
+    if (start < 0)
+        return false;
+    depth = 0;
+    for (let index = start; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (token.type === "punctuator") {
+            if (["(", "[", "{"].includes(token.value))
+                depth++;
+            else if ([")", "]", "}"].includes(token.value))
+                depth--;
+        }
+        if (depth === 0 && token.type === "keyword" && token.value === "of" &&
+            index !== start && tokens[index - 1]?.value !== "." && tokens[index - 1]?.value !== "?." &&
+            !(index === start + 1 && ["const", "let", "var"].includes(tokens[start].value)))
+            return index === tokens.length - 1;
+    }
+    return false;
+}
 function updateGroupingState(groupingStack, previousToken, punctuator) {
     if (punctuator === "(") {
         groupingStack.push({

package/packages/safe-js/dist/snapshot/array-buffer.d.ts

@@ -0,0 +1,13 @@
+import type { GuestObjectState } from "./guest-heap.js";
+export type ArrayBufferData<TReference> = {
+    kind: "arraybuffer";
+} & ({
+    bytes: number[];
+    maxByteLength?: number;
+} | {
+    buffer: TReference;
+});
+export declare function captureArrayBufferState<T>(value: ArrayBuffer, encode: (value: unknown) => T): GuestObjectState<T>;
+export declare function encodeArrayBufferStorage<T>(value: ArrayBuffer, id: number, buffers: WeakMap<ArrayBuffer, number>, reference: (id: number) => T): ArrayBufferData<T>;
+export declare function validateArrayBufferStorage(value: Record<string, unknown>): void;
+export declare function decodeArrayBufferStorage(value: Record<string, unknown>, resolve: (reference: unknown) => unknown): ArrayBuffer;