poe-code 14.0.83 → 14.0.84

package/packages/safe-js/dist/chunks/{chunk-PT7PBLVT.js → chunk-CYVI4ZUK.js}

@@ -6843,26 +6843,83 @@ function readPendingHostCallPolicyModeValue(value) {
 // packages/safe-js/src/interp/host-call.ts
 import { createHash, randomUUID } from "node:crypto";
 
+// packages/safe-js/src/interp/array-buffer.ts
+import { types as types2 } from "node:util";
+var readLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get;
+var readResizable = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resizable")?.get;
+var readMaxLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "maxByteLength")?.get;
+var arrayBufferPrototypes = /* @__PURE__ */ new WeakMap();
+function isSandboxArrayBuffer(value) {
+  return types2.isArrayBuffer(value) && Object.getPrototypeOf(value) === ArrayBuffer.prototype;
+}
+function arrayBufferLength(value) {
+  return Reflect.apply(readLength, value, []);
+}
+function arrayBufferOptions(value) {
+  return readResizable !== void 0 && Reflect.apply(readResizable, value, []) ? { maxByteLength: Reflect.apply(readMaxLength, value, []) } : void 0;
+}
+function copyArrayBufferStorage(value, state) {
+  state.float32Buffers ??= /* @__PURE__ */ new WeakMap();
+  let copy = state.float32Buffers.get(value);
+  if (copy === void 0) {
+    copy = Reflect.construct(ArrayBuffer, [arrayBufferLength(value), arrayBufferOptions(value)]);
+    new Uint8Array(copy).set(new Uint8Array(value));
+    state.float32Buffers.set(value, copy);
+  }
+  return copy;
+}
+function arrayBufferDataProperties(value) {
+  return Reflect.ownKeys(value).map((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!("value" in descriptor)) throw new TypeError("ArrayBuffer accessors cannot be copied as data.");
+    return [key, descriptor];
+  });
+}
+
 // packages/safe-js/src/interp/float32.ts
 var typedArrayPrototype = Object.getPrototypeOf(Float32Array.prototype);
-var readLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "length").get;
+var readLength2 = Object.getOwnPropertyDescriptor(typedArrayPrototype, "length").get;
 var readOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
 var readBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
 var readTag = Object.getOwnPropertyDescriptor(typedArrayPrototype, Symbol.toStringTag).get;
+var createValuesIterator = Object.getOwnPropertyDescriptor(typedArrayPrototype, "values").value;
 var bufferLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get;
 var bufferResizable = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resizable")?.get;
+var float32ViewLayouts = /* @__PURE__ */ new WeakMap();
+var resizeBuffer = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resize").value;
+function restoreFloat32View(buffer, byteOffset, length, budget) {
+  const originalLength = arrayBufferLength(buffer);
+  const required = byteOffset + (length ?? 0) * 4;
+  const options = arrayBufferOptions(buffer);
+  const grow = required > originalLength;
+  if (grow) {
+    if (options === void 0 || required > options.maxByteLength)
+      throw new RangeError("Float32Array layout exceeds backing capacity.");
+    budget?.allocateArrayLength(Math.ceil(required / 4));
+    budget?.provisionDataUsage(required - originalLength)();
+    Reflect.apply(resizeBuffer, buffer, [required]);
+  }
+  try {
+    const view = new Float32Array(buffer, byteOffset, length);
+    if (options !== void 0) float32ViewLayouts.set(view, { byteOffset, ...length === void 0 ? {} : { length } });
+    return view;
+  } finally {
+    if (grow) Reflect.apply(resizeBuffer, buffer, [originalLength]);
+  }
+}
 function isFloat32Array(value) {
   return ArrayBuffer.isView(value) && Object.getPrototypeOf(value) === Float32Array.prototype && Reflect.apply(readTag, value, []) === "Float32Array";
 }
-function float32Storage(value) {
+function float32Storage(value, requireInBounds = false) {
+  if (requireInBounds) Reflect.apply(createValuesIterator, value, []);
   const buffer = Reflect.apply(readBuffer, value, []);
-  if (Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype || bufferResizable !== void 0 && Reflect.apply(bufferResizable, buffer, [])) {
-    throw new TypeError("Float32Array requires a fixed, non-shared ArrayBuffer.");
+  if (Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype) {
+    throw new TypeError("Float32Array requires a non-shared ArrayBuffer.");
   }
   return {
     buffer,
     byteOffset: Reflect.apply(readOffset, value, []),
-    length: Reflect.apply(readLength, value, []),
+    length: Reflect.apply(readLength2, value, []),
     byteLength: Reflect.apply(bufferLength, buffer, [])
   };
 }
@@ -6903,18 +6960,17 @@ function checkFloat32Allocation(length, budget) {
 }
 function copyFloat32Storage(value, state) {
   const storage = float32Storage(value);
-  state.float32Buffers ??= /* @__PURE__ */ new WeakMap();
-  let buffer = state.float32Buffers.get(storage.buffer);
-  if (buffer === void 0) {
-    buffer = new ArrayBuffer(storage.byteLength);
-    new Uint8Array(buffer).set(new Uint8Array(storage.buffer));
-    state.float32Buffers.set(storage.buffer, buffer);
+  const buffer = copyArrayBufferStorage(storage.buffer, state);
+  if (bufferResizable !== void 0 && Reflect.apply(bufferResizable, storage.buffer, [])) {
+    const layout = float32ViewLayouts.get(value);
+    if (layout === void 0) throw new TypeError("Resizable Float32Array copies require known view layout.");
+    return restoreFloat32View(buffer, layout.byteOffset, layout.length);
   }
   return new Float32Array(buffer, storage.byteOffset, storage.length);
 }
 
 // packages/safe-js/src/interp/date.ts
-import { types as types2 } from "node:util";
+import { types as types3 } from "node:util";
 var NativeDate = Date;
 var readTime = NativeDate.prototype.getTime;
 var writeTime = NativeDate.prototype.setTime;
@@ -6931,7 +6987,7 @@ function dateTime(value) {
   return Reflect.apply(readTime, value, []);
 }
 function copyNativeDate(value) {
-  if (!types2.isDate(value)) return void 0;
+  if (!types3.isDate(value)) return void 0;
   if (Object.getPrototypeOf(value) !== NativeDate.prototype)
     throw new TypeError("Date subclasses are not supported.");
   return createSandboxDate(dateTime(value));
@@ -7366,7 +7422,7 @@ function copySandboxArgumentProperties(source, target, copyValue) {
 }
 
 // packages/safe-js/src/interp/boxed.ts
-import { types as types3 } from "node:util";
+import { types as types4 } from "node:util";
 var boxes = /* @__PURE__ */ new WeakSet();
 var numberValue = Number.prototype.valueOf;
 var stringValue = String.prototype.valueOf;
@@ -7374,11 +7430,11 @@ var booleanValue = Boolean.prototype.valueOf;
 var symbolValue = Symbol.prototype.valueOf;
 var bigintValue = BigInt.prototype.valueOf;
 function nativeBoxedValue(value) {
-  if (types3.isNumberObject(value)) return Reflect.apply(numberValue, value, []);
-  if (types3.isStringObject(value)) return Reflect.apply(stringValue, value, []);
-  if (types3.isBooleanObject(value)) return Reflect.apply(booleanValue, value, []);
-  if (types3.isSymbolObject(value)) return Reflect.apply(symbolValue, value, []);
-  if (types3.isBigIntObject(value)) return Reflect.apply(bigintValue, value, []);
+  if (types4.isNumberObject(value)) return Reflect.apply(numberValue, value, []);
+  if (types4.isStringObject(value)) return Reflect.apply(stringValue, value, []);
+  if (types4.isBooleanObject(value)) return Reflect.apply(booleanValue, value, []);
+  if (types4.isSymbolObject(value)) return Reflect.apply(symbolValue, value, []);
+  if (types4.isBigIntObject(value)) return Reflect.apply(bigintValue, value, []);
   return void 0;
 }
 function createSandboxBox(value) {
@@ -7557,7 +7613,7 @@ async function withRunResources(signal, execute) {
 }
 
 // packages/safe-js/src/interp/host-capabilities.ts
-import { types as types4 } from "node:util";
+import { types as types5 } from "node:util";
 var MAX_INDEXED_LENGTH = 65536;
 var MAX_NAMED_KEYS = 65536;
 var MAX_NAMED_KEY_CODE_UNITS = 1048576;
@@ -7612,7 +7668,7 @@ function createLiveHostObject(definition, controller) {
     for (const name of ["keys", "get", "set", "delete"]) {
       const operation = data[name];
       if (operation === void 0 && (name === "set" || name === "delete")) continue;
-      if (typeof operation !== "function" || types4.isProxy(operation) || types4.isAsyncFunction(operation) || types4.isGeneratorFunction(operation))
+      if (typeof operation !== "function" || types5.isProxy(operation) || types5.isAsyncFunction(operation) || types5.isGeneratorFunction(operation))
         throw new TypeError(`Named ${name} must be a synchronous non-generator function, not a proxy.`);
     }
     if (typeof data.maxKeys !== "number" || !Number.isInteger(data.maxKeys) || data.maxKeys < 1 || data.maxKeys > MAX_NAMED_KEYS)
@@ -7867,7 +7923,7 @@ function namedMutationKeys(state, key, create) {
 function namedKeys(state) {
   const named = state.named;
   return state.controller.read(named.keys, (value) => {
-    if (!Array.isArray(value) || types4.isProxy(value))
+    if (!Array.isArray(value) || types5.isProxy(value))
       throw new TypeError("Named keys must be a dense own-data array of strings, not a proxy.");
     const length = Object.getOwnPropertyDescriptor(value, "length").value;
     if (length > named.maxKeys) throw new RangeError("Named keys exceed maxKeys.");
@@ -8132,11 +8188,13 @@ function releaseObjectPrototype(budget) {
   generatorPrototypes.delete(budget);
   errorPrototypes.delete(budget);
   float32Prototypes.delete(budget);
+  arrayBufferPrototypes.delete(budget);
   initialRegexDescriptors.delete(budget);
   intrinsicPrototypes.delete(budget);
 }
 function getSandboxPrototype(value, budget) {
   if (prototypes.has(value)) return prototypes.get(value) ?? null;
+  if (isSandboxArrayBuffer(value)) return budget === void 0 ? null : arrayBufferPrototypes.get(budget) ?? null;
   if (isFloat32Array(value)) return budget === void 0 ? null : float32Prototypes.get(budget) ?? null;
   const errorType = sandboxErrorTypes.get(value);
   if (budget !== void 0 && errorType !== void 0) {
@@ -8247,6 +8305,7 @@ function setSandboxPrototype(value, prototype, budget) {
   prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+  if (isSandboxArrayBuffer(value)) return true;
   if (isFloat32Array(value)) return true;
   if (isGuestClosure(value)) return true;
   if (isGuestHostObject(value)) return false;
@@ -8511,7 +8570,7 @@ function restoreRegexProperties(value, data, decode) {
 }
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types as types6 } from "node:util";
+import { types as types7 } from "node:util";
 
 // packages/safe-js/src/interp/builtin-call.ts
 async function invokeBuiltinClosure(closure, args, budget, context, thisValue, construct = false) {
@@ -10660,7 +10719,7 @@ async function nextArrayIterator(value, budget, context) {
   const read = (key) => context?.getProperty !== void 0 ? context.getProperty(source, key) : readPropertyDescriptor((isFloat32Array(source) ? Object.getOwnPropertyDescriptor(source, key) : void 0) ?? getSandboxPropertyDescriptor(source, key, budget) ?? { value: void 0 }, source, context);
   try {
     budget.visitNode();
-    const number = isFloat32Array(source) ? float32Storage(source).length : await sandboxNumber(await read("length"), budget, context);
+    const number = isFloat32Array(source) ? float32Storage(source, true).length : await sandboxNumber(await read("length"), budget, context);
     const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
     if (index >= length) {
       state.source = void 0;
@@ -10925,7 +10984,7 @@ function formatNumber(value, methodName, argument, budget) {
 }
 
 // packages/safe-js/src/interp/methods/string.ts
-import { types as types5 } from "node:util";
+import { types as types6 } from "node:util";
 
 // packages/safe-js/src/interp/methods/string-locale.ts
 var collatorOptions = [
@@ -11076,7 +11135,7 @@ function callStringMethod(value, methodName, args, budget, callClosure = async (
   };
   const symbol = methodName === "match" ? Symbol.match : methodName === "search" ? Symbol.search : methodName === "matchAll" ? Symbol.matchAll : methodName === "replace" || methodName === "replaceAll" ? Symbol.replace : methodName === "split" ? Symbol.split : void 0;
   const pattern = args[0];
-  if (symbol !== void 0 && types5.isRegExp(pattern))
+  if (symbol !== void 0 && types6.isRegExp(pattern))
     throw new TypeError(`String#${methodName} does not accept unbranded host RegExp values.`);
   if (symbol === void 0 || pattern === null || pattern === void 0) return fallback();
   const readProperty = (key) => context?.getProperty !== void 0 ? context.getProperty(pattern, key) : key === "flags" && isSandboxRegex(pattern) && getSandboxPropertyDescriptor(pattern, key, budget) === void 0 ? getRegexMember(pattern, key, budget, context) : getSandboxDataProperty(pattern, key, budget);
@@ -14557,6 +14616,31 @@ function createFloat32ArrayGlobal(budget, nativePrototype = false) {
         const prototype = candidate !== null && typeof candidate === "object" ? candidate : float32Prototypes.get(budget);
         const release = retainValues(budget, () => [prototype, ...args]);
         try {
+          if (isSandboxArrayBuffer(args[0])) {
+            const buffer = args[0];
+            const number = await sandboxNumber(args[1], budget, context);
+            const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
+            if (!Number.isSafeInteger(offset) || offset < 0 || offset % 4 !== 0)
+              throw new RangeError("Invalid Float32Array buffer offset.");
+            const bytes = arrayBufferLength(buffer);
+            let length;
+            if (args[2] === void 0) {
+              if (arrayBufferOptions(buffer) === void 0 && bytes % 4 !== 0 || offset > bytes)
+                throw new RangeError("Invalid Float32Array buffer length.");
+              length = Math.floor((bytes - offset) / 4);
+            } else {
+              const size = await sandboxNumber(args[2], budget, context);
+              length = Number.isNaN(size) ? 0 : Math.trunc(size);
+              if (!Number.isSafeInteger(length) || length < 0 || offset + length * 4 > arrayBufferLength(buffer))
+                throw new RangeError("Invalid Float32Array view length.");
+            }
+            budget.allocateArrayLength(length);
+            const result2 = new Float32Array(buffer, offset, args[2] === void 0 ? void 0 : length);
+            if (arrayBufferOptions(buffer) !== void 0)
+              float32ViewLayouts.set(result2, { byteOffset: offset, ...args[2] === void 0 ? {} : { length } });
+            setSandboxPrototype(result2, prototype, budget);
+            return result2;
+          }
           const result = args[0] !== null && typeof args[0] === "object" && !isFloat32Array(args[0]) ? await allocateFloat32Input(args[0], budget, context) : allocateFloat32Array(args[0], budget);
           setSandboxPrototype(result, prototype, budget);
           return result;
@@ -14771,7 +14855,19 @@ function createFloat32ArrayPrototypes(budget, constructor) {
   setSandboxPrototype(prototype, shared);
   setSandboxPrototype(shared, getSandboxPrototype(/* @__PURE__ */ Object.create(null), budget));
   const getters = [];
-  for (const key of ["length", "byteLength", "byteOffset"]) {
+  const species = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "get [Symbol.species]",
+    length: 0,
+    call: (_args, context) => context?.thisValue
+  });
+  getters.push(species);
+  Object.defineProperty(materializeFunctionProperties(typedArray), Symbol.species, {
+    get: accessorAdapter(species, "get"),
+    configurable: true
+  });
+  for (const key of ["length", "byteLength", "byteOffset", "buffer"]) {
     const getter = createSandboxClosure({
       guest: true,
       sandbox: true,
@@ -14787,7 +14883,7 @@ function createFloat32ArrayPrototypes(budget, constructor) {
     Object.defineProperty(shared, key, { get: accessorAdapter(getter, "get"), configurable: true });
   }
   for (const key of ["set", "slice", "subarray"])
-    Object.defineProperty(shared, key, { value: getFloat32Member(new Float32Array(0), key, budget), writable: true, configurable: true });
+    Object.defineProperty(shared, key, { value: getFloat32Member(new Float32Array(0), key, budget, constructor), writable: true, configurable: true });
   const arrayPrototype = resolveIntrinsicIdentity(budget, '["Array","prototype"]');
   Object.defineProperty(shared, "toString", { value: getSandboxDataProperty(arrayPrototype, "toString", budget), writable: true, configurable: true });
   Object.defineProperty(shared, "join", {
@@ -14801,7 +14897,7 @@ function createFloat32ArrayPrototypes(budget, constructor) {
       call: async (args, context) => {
         if (!isFloat32Array(context?.thisValue)) throw new TypeError("TypedArray join requires a typed array receiver.");
         const receiver = context.thisValue;
-        const length = float32Storage(receiver).length;
+        const length = float32Storage(receiver, true).length;
         let separator = ",";
         let text = "";
         const release = retainValues(budget, () => [receiver, separator, text, ...args]);
@@ -14809,7 +14905,8 @@ function createFloat32ArrayPrototypes(budget, constructor) {
           if (args[0] !== void 0) separator = await sandboxString(args[0], budget, context);
           for (let index = 0; index < length; index++) {
             budget.visitNode();
-            text = budget.allocateString(text + (index === 0 ? "" : separator) + String(receiver[index]));
+            const value = receiver[index];
+            text = budget.allocateString(text + (index === 0 ? "" : separator) + (value === void 0 ? "" : String(value)));
           }
           return text;
         } finally {
@@ -14836,6 +14933,7 @@ function createFloat32ArrayPrototypes(budget, constructor) {
       length: 0,
       call: (args, context) => {
         if (!isFloat32Array(context?.thisValue)) throw new TypeError(`TypedArray ${key} requires a typed array receiver.`);
+        float32Storage(context.thisValue, true);
         return invokeBuiltinClosure(method, args, budget, context, context.thisValue);
       }
     });
@@ -14853,7 +14951,7 @@ function createFloat32ArrayPrototypes(budget, constructor) {
 function isFloat32ArrayConstructor(value) {
   return typeof value === "object" && value !== null && constructors.has(value);
 }
-function getFloat32Member(value, property, budget) {
+function getFloat32Member(value, property, budget, defaultConstructor) {
   const key = String(property);
   const descriptor = Object.getOwnPropertyDescriptor(value, key);
   if (descriptor !== void 0) {
@@ -14876,7 +14974,7 @@ function getFloat32Member(value, property, budget) {
       const receiver = context?.thisValue;
       if (!isFloat32Array(receiver))
         throw new TypeError(`Float32Array#${key} requires a Float32Array receiver.`);
-      const storage2 = float32Storage(receiver);
+      const storage2 = float32Storage(receiver, key === "slice");
       const bridge = {
         ...context,
         stack: context?.stack ?? [],
@@ -14897,16 +14995,17 @@ function getFloat32Member(value, property, budget) {
             const number = await sandboxNumber(offsetValue, budget, bridge);
             const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
             if (offset < 0) throw new RangeError("Float32Array#set offset is out of bounds.");
+            const targetStorage = float32Storage(receiver, true);
             if (source === null || source === void 0) throw new TypeError("Float32Array#set requires a non-null source.");
             let length;
-            if (isFloat32Array(source)) length = float32Storage(source).length;
+            if (isFloat32Array(source)) length = float32Storage(source, true).length;
             else {
               sourceObject = typeof source === "object" ? source : createSandboxBox(source);
               current = await bridge.getProperty(sourceObject, "length");
               const size = await sandboxNumber(current, budget, bridge);
               length = Number.isNaN(size) || size <= 0 ? 0 : Math.min(Math.trunc(size), Number.MAX_SAFE_INTEGER);
             }
-            if (offset + length > storage2.length) throw new RangeError("Float32Array#set source is out of bounds.");
+            if (offset + length > targetStorage.length) throw new RangeError("Float32Array#set source is out of bounds.");
             if (isFloat32Array(source)) Float32Array.prototype.set.call(receiver, source, offset);
             else for (let index = 0; index < length; index++) {
               budget.visitNode();
@@ -14920,18 +15019,62 @@ function getFloat32Member(value, property, budget) {
         })();
       }
       return (async () => {
-        const release = retainValues(budget, () => [receiver, ...args]);
+        let candidate;
+        let result;
+        const release = retainValues(budget, () => [receiver, candidate, result, ...args]);
         try {
           const start = relativeIndex(await sandboxNumber(args[0], budget, bridge), storage2.length);
           const end = args[1] === void 0 ? storage2.length : relativeIndex(await sandboxNumber(args[1], budget, bridge), storage2.length);
           const length = Math.max(end - start, 0);
-          if (key === "subarray")
-            return new Float32Array(storage2.buffer, storage2.byteOffset + start * 4, length);
-          checkFloat32Allocation(length, budget);
-          const result = new Float32Array(length);
-          new Uint8Array(result.buffer).set(
-            new Uint8Array(storage2.buffer, storage2.byteOffset + start * 4, length * 4)
-          );
+          const layout = float32ViewLayouts.get(receiver);
+          const offset = (layout?.byteOffset ?? storage2.byteOffset) + start * 4;
+          const tracking = layout !== void 0 && layout.length === void 0 && args[1] === void 0;
+          if (defaultConstructor !== void 0) {
+            candidate = await bridge.getProperty(receiver, "constructor");
+            if (candidate !== void 0) {
+              if (candidate === null || typeof candidate !== "object")
+                throw new TypeError("TypedArray constructor must be an object.");
+              candidate = await bridge.getProperty(candidate, Symbol.species);
+              if (candidate !== void 0 && candidate !== null && (!isSandboxClosure(candidate) || candidate.construct === void 0))
+                throw new TypeError("TypedArray species must be a constructor.");
+            }
+          }
+          if (candidate !== void 0 && candidate !== null && candidate !== defaultConstructor) {
+            const values = key === "slice" ? [length] : [storage2.buffer, offset, tracking ? void 0 : length];
+            result = await invokeBuiltinClosure(candidate, values, budget, bridge, void 0, true);
+            if (!isFloat32Array(result)) throw new TypeError("TypedArray species must return typed storage.");
+            const target = float32Storage(result, key === "slice");
+            if (key === "slice" && target.length < length)
+              throw new TypeError("TypedArray species returned insufficient storage.");
+          }
+          if (key === "subarray") {
+            if (result === void 0) {
+              result = new Float32Array(storage2.buffer, offset, tracking ? void 0 : length);
+              if (arrayBufferOptions(storage2.buffer) !== void 0)
+                float32ViewLayouts.set(result, { byteOffset: offset, ...tracking ? {} : { length } });
+            }
+            return result;
+          }
+          if (result === void 0) {
+            checkFloat32Allocation(length, budget);
+            result = new Float32Array(length);
+          }
+          if (!isFloat32Array(result)) throw new TypeError("TypedArray species must return typed storage.");
+          if (length > 0) {
+            const current = float32Storage(receiver, true);
+            const target = float32Storage(result, true);
+            const count = Math.min(length, Math.max(current.length - start, 0));
+            if (count > 0) {
+              const sourceBytes = new Uint8Array(current.buffer, current.byteOffset + start * 4, count * 4);
+              const targetBytes = new Uint8Array(target.buffer, target.byteOffset, count * 4);
+              if (current.buffer === target.buffer && targetBytes.byteOffset > sourceBytes.byteOffset && targetBytes.byteOffset < sourceBytes.byteOffset + sourceBytes.length) {
+                for (let index = 0; index < sourceBytes.length; index++) {
+                  budget.visitNode();
+                  targetBytes[index] = sourceBytes[index];
+                }
+              } else targetBytes.set(sourceBytes);
+            }
+          }
           return result;
         } finally {
           release();
@@ -21046,18 +21189,20 @@ function serializeArray(value, serializeValue) {
 }
 
 // packages/safe-js/src/snapshot/float32array.ts
-function encodeFloat32Storage(value, id, buffers, reference) {
+function encodeFloat32Layout(value) {
   const storage = float32Storage(value);
-  const existing = buffers.get(storage.buffer);
-  if (existing === void 0) buffers.set(storage.buffer, id);
+  if (arrayBufferOptions(storage.buffer) === void 0) return { byteOffset: storage.byteOffset, length: storage.length };
+  const layout = float32ViewLayouts.get(value);
+  if (layout === void 0) throw new TypeError("Resizable Float32Array snapshots require known view layout.");
   return {
-    kind: "float32array",
-    byteOffset: storage.byteOffset,
-    length: storage.length,
-    ...existing === void 0 ? { bytes: Array.from(new Uint8Array(storage.buffer)) } : { buffer: reference(existing) }
+    byteOffset: layout.byteOffset,
+    length: layout.length ?? 0,
+    ...layout.length === void 0 ? { lengthTracking: true } : {}
   };
 }
 function validateFloat32Storage(value) {
+  if (Object.hasOwn(value, "lengthTracking") && (value.lengthTracking !== true || value.length !== 0 || Object.hasOwn(value, "bytes")))
+    throw new TypeError("Invalid Float32Array length-tracking layout.");
   if (!Number.isSafeInteger(value.length) || Number(value.length) < 0 || !Number.isSafeInteger(value.byteOffset) || Number(value.byteOffset) < 0 || Number(value.byteOffset) % 4 !== 0)
     throw new TypeError("Invalid Float32Array view dimensions.");
   if (Object.hasOwn(value, "bytes") === Object.hasOwn(value, "buffer"))
@@ -21067,7 +21212,7 @@ function validateFloat32Storage(value) {
       throw new TypeError("Invalid Float32Array backing bytes.");
   }
 }
-function decodeFloat32Storage(value, resolve) {
+function decodeFloat32Storage(value, resolve, budget) {
   validateFloat32Storage(value);
   let buffer;
   if (Array.isArray(value.bytes)) {
@@ -21075,10 +21220,50 @@ function decodeFloat32Storage(value, resolve) {
     new Uint8Array(buffer).set(value.bytes);
   } else {
     const referenced = resolve(value.buffer);
-    if (!isFloat32Array(referenced)) throw new TypeError("Invalid Float32Array backing reference.");
-    buffer = float32Storage(referenced).buffer;
+    if (isSandboxArrayBuffer(referenced)) buffer = referenced;
+    else if (isFloat32Array(referenced)) buffer = float32Storage(referenced).buffer;
+    else throw new TypeError("Invalid Float32Array backing reference.");
+  }
+  if (value.lengthTracking === true && arrayBufferOptions(buffer) === void 0)
+    throw new TypeError("Length-tracking layout requires resizable backing storage.");
+  return restoreFloat32View(buffer, Number(value.byteOffset), value.lengthTracking === true ? void 0 : Number(value.length), budget);
+}
+
+// packages/safe-js/src/snapshot/array-buffer.ts
+function captureArrayBufferState(value, encode) {
+  return {
+    properties: serializePropertyDescriptors(value, encode),
+    ...hasExplicitSandboxPrototype(value) ? { prototype: encode(getSandboxPrototype(value)) } : {}
+  };
+}
+function encodeArrayBufferStorage(value, id, buffers, reference) {
+  arrayBufferLength(value);
+  const existing = buffers.get(value);
+  if (existing === void 0) buffers.set(value, id);
+  return { kind: "arraybuffer", ...existing === void 0 ? { bytes: Array.from(new Uint8Array(value)), ...arrayBufferOptions(value) } : { buffer: reference(existing) } };
+}
+function validateArrayBufferStorage(value) {
+  if (Object.hasOwn(value, "bytes") === Object.hasOwn(value, "buffer"))
+    throw new TypeError("ArrayBuffer requires one backing storage description.");
+  if (Object.hasOwn(value, "bytes") && (!Array.isArray(value.bytes) || value.bytes.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)))
+    throw new TypeError("Invalid ArrayBuffer bytes.");
+  if (Object.hasOwn(value, "maxByteLength") && (!Array.isArray(value.bytes) || !Number.isSafeInteger(value.maxByteLength) || Number(value.maxByteLength) < value.bytes.length))
+    throw new TypeError("Invalid ArrayBuffer maximum length.");
+}
+function decodeArrayBufferStorage(value, resolve) {
+  validateArrayBufferStorage(value);
+  if (Array.isArray(value.bytes)) {
+    const buffer = Reflect.construct(ArrayBuffer, [
+      value.bytes.length,
+      Object.hasOwn(value, "maxByteLength") ? { maxByteLength: value.maxByteLength } : void 0
+    ]);
+    new Uint8Array(buffer).set(value.bytes);
+    return buffer;
   }
-  return new Float32Array(buffer, Number(value.byteOffset), Number(value.length));
+  const referenced = resolve(value.buffer);
+  if (isSandboxArrayBuffer(referenced)) return referenced;
+  if (isFloat32Array(referenced)) return float32Storage(referenced).buffer;
+  throw new TypeError("Invalid ArrayBuffer backing reference.");
 }
 
 // packages/safe-js/src/snapshot/date-properties.ts
@@ -21209,7 +21394,7 @@ function serializeDumpValue(value, path, state) {
   if (hasGuestObjectState(value) && !(state.trustedRunReplay && (isSandboxDate(value) || isSandboxPromise(value) || isPromiseResolvingFunction(value)))) {
     throw new TypeError("Guest function properties and prototype links cannot be serialized.");
   }
-  if (isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path, state);
+  if (isSandboxArrayBuffer(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path, state);
   if (Array.isArray(value)) {
     const reference2 = serializeHeapReference(value, path, state);
     if (reference2 !== void 0) {
@@ -21281,11 +21466,21 @@ function serializeHeapReference(value, path, state) {
         const serialized = serializeDumpValue(entry, `${path}.<date-property>`, state);
         return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
       });
+    } else if (isSandboxArrayBuffer(value)) {
+      state.heap[String(id)] = {
+        ...encodeArrayBufferStorage(value, id, state.float32Buffers, (id2) => ({ kind: "ref", id: id2 })),
+        state: captureArrayBufferState(value, (entry) => {
+          const serialized = serializeDumpValue(entry, `${path}.<buffer>`, state);
+          return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+        })
+      };
     } else if (isFloat32Array(value)) {
-      const storage = encodeFloat32Storage(value, id, state.float32Buffers, (id2) => ({
-        kind: "ref",
-        id: id2
-      }));
+      const backing = float32Storage(value);
+      const storage = {
+        kind: "float32array",
+        ...encodeFloat32Layout(value),
+        buffer: serializeHeapReference(backing.buffer, `${path}.buffer`, state)
+      };
       const entries = /* @__PURE__ */ Object.create(null);
       state.heap[String(id)] = { ...storage, entries };
       for (const [key, descriptor] of float32DataProperties(value)) {
@@ -21351,7 +21546,7 @@ function indexHeapContainers(snapshot) {
   const heapIds = /* @__PURE__ */ new Map();
   let nextId = 1;
   for (const [value, stat2] of stats.entries()) {
-    if (stat2.count > 1 || stat2.forceHeap === true || guestValues.has(value) || stat2.cyclic || hasNullObjectPrototype(value) || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat2.count > 1 || stat2.forceHeap === true || guestValues.has(value) || stat2.cyclic || hasNullObjectPrototype(value) || ownSerializableSymbolKeys(value).length > 0 || isSandboxBox(value) || isSandboxRegExpIterator(value) || isSandboxRegex(value) && hasCustomRegexProperties(value) || isSandboxDate(value) || isFloat32Array(value) || isSandboxArrayBuffer(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -21383,12 +21578,16 @@ function collectContainerStats(value, stats, ancestors, guestValues, depth = 0)
   stat2.expanded = true;
   ancestors.add(value);
   const guestEntries = [];
-  const guest = captureGuestHeapNode(value, (entry) => {
+  if (isFloat32Array(value)) guestEntries.push(float32Storage(value).buffer);
+  const guest = isSandboxArrayBuffer(value) ? { kind: "arraybuffer", state: captureArrayBufferState(value, (entry) => {
+    guestEntries.push(entry);
+    return null;
+  }) } : captureGuestHeapNode(value, (entry) => {
     guestEntries.push(entry);
     return null;
   });
   if (guest !== void 0) {
-    guestValues.add(value);
+    if (!isSandboxArrayBuffer(value)) guestValues.add(value);
     for (const entry of guestEntries) {
       collectContainerStats(entry, stats, ancestors, guestValues, depth + 1);
       if (entry !== null && typeof entry === "object") stats.get(entry).forceHeap = true;
@@ -21396,6 +21595,7 @@ function collectContainerStats(value, stats, ancestors, guestValues, depth = 0)
     ancestors.delete(value);
     return;
   }
+  for (const entry of guestEntries) collectContainerStats(entry, stats, ancestors, guestValues, depth + 1);
   if (!Array.isArray(value) && !isPlainObject(value) && !isFloat32Array(value) && !isSandboxDate(value)) {
     ancestors.delete(value);
     return;
@@ -21715,11 +21915,24 @@ function encodeReplayData(value, options = {}) {
         ...symbolProperties.length === 0 ? {} : { symbolProperties },
         ...Object.isExtensible(entry) ? {} : { extensible: false }
       };
+    } else if (isSandboxArrayBuffer(entry)) {
+      const storage = encodeArrayBufferStorage(entry, id, float32Buffers, (id2) => ({ tag: "ref", id: id2 }));
+      const properties = /* @__PURE__ */ Object.create(null);
+      for (const [key, descriptor] of arrayBufferDataProperties(entry)) {
+        if (typeof key === "symbol") continue;
+        properties[key] = {
+          value: child(descriptor.value, key),
+          configurable: descriptor.configurable === true,
+          enumerable: descriptor.enumerable === true,
+          writable: descriptor.writable === true
+        };
+      }
+      let symbolIndex = 0;
+      const symbolEntries = serializeSymbolProperties(entry, (value2) => encode(value2, depth + 1, [...path, { symbol: Math.floor(symbolIndex++ / 2) }]));
+      nodes[id] = { ...storage, properties, extensible: Object.isExtensible(entry), symbolEntries };
     } else if (isFloat32Array(entry)) {
-      const storage = encodeFloat32Storage(entry, id, float32Buffers, (id2) => ({
-        tag: "ref",
-        id: id2
-      }));
+      const backing = float32Storage(entry);
+      const storage = { kind: "float32array", ...encodeFloat32Layout(entry), buffer: child(backing.buffer, "<buffer>") };
       const properties = /* @__PURE__ */ Object.create(null);
       for (const [key, descriptor] of float32DataProperties(entry)) {
         properties[key] = {
@@ -21822,7 +22035,7 @@ function decodeReplayData(input, options = {}, parent) {
     const graph = record2(input);
     const nodes = list(own(graph, "nodes"));
     const restored = /* @__PURE__ */ new Map();
-    const initializeIterators = [];
+    const initializeValues = [];
     const decode = (entry, depth = 0) => {
       if (depth > MAX_DATA_DEPTH) throw new TypeError("Replay data exceeds the nesting limit.");
       if (entry === null || typeof entry === "boolean" || typeof entry === "string") return entry;
@@ -21947,10 +22160,20 @@ function decodeReplayData(input, options = {}, parent) {
         if (node.extensible === false) Object.preventExtensions(result3);
         return result3;
       }
+      if (kind === "arraybuffer") {
+        if (typeof node.extensible !== "boolean") throw new TypeError("Invalid ArrayBuffer extensibility.");
+        const result3 = decodeArrayBufferStorage(node, child);
+        restored.set(id, result3);
+        initializeValues.push(() => {
+          defineProperties(result3, record2(own(node, "properties")), child, node.symbolEntries);
+          if (!node.extensible) Object.preventExtensions(result3);
+        });
+        return result3;
+      }
       if (kind === "float32array") {
         if (typeof node.extensible !== "boolean")
           throw new TypeError("Invalid Float32Array extensibility.");
-        const result3 = decodeFloat32Storage(node, child);
+        const result3 = decodeFloat32Storage(node, child, compilation.owner?.budget);
         restored.set(id, result3);
         defineProperties(result3, record2(own(node, "properties")), child);
         if (!node.extensible) Object.preventExtensions(result3);
@@ -21986,7 +22209,7 @@ function decodeReplayData(input, options = {}, parent) {
         restored.set(id, result3);
         const collection = child(own(node, "collection"));
         if (collection !== void 0 && !isSandboxMap(collection) && !isSandboxSet(collection)) throw new TypeError("Invalid replay collection iterator source.");
-        initializeIterators.push(() => {
+        initializeValues.push(() => {
           restoreSandboxCollectionIterator({ collection, collectionKind, method, index, exhausted }, result3);
         });
         defineProperties(result3, record2(own(node, "properties")), child);
@@ -22057,7 +22280,7 @@ function decodeReplayData(input, options = {}, parent) {
       return result2;
     };
     const result = decode(own(graph, "root"));
-    for (const initialize of initializeIterators) initialize();
+    for (const initialize of initializeValues) initialize();
     if (parent !== void 0) compilation.forward(compilation.tickets, parent);
     return result;
   } finally {
@@ -22836,12 +23059,43 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
     state.seen.set(value, date);
     return date;
   }
+  if (isSandboxArrayBuffer(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const length = arrayBufferLength(value);
+    budget.allocateArrayLength(length);
+    budget.provisionDataUsage(length + 1)();
+    const copy = copyArrayBufferStorage(value, state);
+    state.seen.set(value, copy);
+    for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+      if (typeof key === "symbol") throw new TypeError("Host ArrayBuffer symbol properties require an explicit capability path.");
+      Object.defineProperty(copy, key, {
+        ...descriptor,
+        value: copyHostValueToSandbox(
+          descriptor.value,
+          stackFrames,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], key] },
+          state,
+          joinPath(path, key)
+        )
+      });
+    }
+    if (!Object.isExtensible(value)) Object.preventExtensions(copy);
+    return copy;
+  }
   if (isFloat32Array(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
     checkFloat32Allocation(Math.ceil(float32Storage(value).byteLength / 4), budget);
     const copy = copyFloat32Storage(value, state);
     state.seen.set(value, copy);
+    copyHostValueToSandbox(
+      float32Storage(value).buffer,
+      stackFrames,
+      { ...options, capabilityPath: [...options.capabilityPath ?? [], "buffer"] },
+      state,
+      `${path}.buffer`
+    );
     for (const [key, descriptor] of float32DataProperties(value)) {
       Object.defineProperty(copy, key, {
         ...descriptor,
@@ -24867,6 +25121,128 @@ function createBigIntGlobal(budget) {
   return constructor;
 }
 
+// packages/safe-js/src/interp/globals/array-buffer.ts
+var resizeBuffer2 = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resize").value;
+function createArrayBufferGlobal(budget) {
+  const prototype = /* @__PURE__ */ Object.create(null);
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: "ArrayBuffer",
+    length: 1,
+    call: () => {
+      throw new TypeError("ArrayBuffer requires new.");
+    },
+    construct: async (args, context) => {
+      let selected;
+      let current;
+      const bridge = {
+        ...context,
+        stack: context?.stack ?? [],
+        thisValue: void 0,
+        getProperty: context?.getProperty ?? ((value, key) => {
+          const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+          return descriptor === void 0 ? getSandboxDataProperty(value, key, budget) : readPropertyDescriptor(descriptor, value, bridge);
+        }),
+        invokeClosure: context?.invokeClosure ?? ((callee, values, receiver, construct) => invokeBuiltinClosure(callee, values, budget, context, receiver, construct))
+      };
+      const release = retainValues(budget, () => [selected, current, ...args]);
+      try {
+        const number = await sandboxNumber(args[0], budget, bridge);
+        const length = Number.isNaN(number) ? 0 : Math.trunc(number);
+        if (length < 0 || !Number.isSafeInteger(length)) throw new RangeError("Invalid ArrayBuffer length.");
+        let maxByteLength;
+        if (args[1] !== null && typeof args[1] === "object") {
+          current = await bridge.getProperty(args[1], "maxByteLength");
+          if (current !== void 0) {
+            const maximum = await sandboxNumber(current, budget, bridge);
+            maxByteLength = Number.isNaN(maximum) ? 0 : Math.trunc(maximum);
+            if (!Number.isSafeInteger(maxByteLength) || maxByteLength < length)
+              throw new RangeError("Invalid ArrayBuffer maximum length.");
+          }
+        }
+        const target = context?.newTarget ?? constructor;
+        selected = await bridge.getProperty(target, "prototype");
+        budget.allocateArrayLength(maxByteLength ?? length);
+        budget.provisionDataUsage(length + 1)();
+        const result = Reflect.construct(ArrayBuffer, [length, maxByteLength === void 0 ? void 0 : { maxByteLength }]);
+        setSandboxPrototype(result, selected !== null && typeof selected === "object" ? selected : prototype, budget);
+        return result;
+      } finally {
+        release();
+      }
+    }
+  });
+  Object.defineProperty(materializeFunctionProperties(constructor), "prototype", { value: prototype, writable: false });
+  Object.defineProperty(materializeFunctionProperties(constructor), "isView", {
+    writable: true,
+    configurable: true,
+    value: createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: "isView",
+      length: 1,
+      call: (args) => ArrayBuffer.isView(args[0])
+    })
+  });
+  Object.defineProperties(prototype, {
+    constructor: { value: constructor, writable: true, configurable: true },
+    [Symbol.toStringTag]: { value: "ArrayBuffer", configurable: true }
+  });
+  const getters = [];
+  Object.defineProperty(prototype, "resize", {
+    writable: true,
+    configurable: true,
+    value: createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: "resize",
+      length: 1,
+      call: async (args, context) => {
+        const receiver = context?.thisValue;
+        if (!isSandboxArrayBuffer(receiver) || arrayBufferOptions(receiver) === void 0)
+          throw new TypeError("ArrayBuffer resize requires a resizable buffer receiver.");
+        const release = retainValues(budget, () => [receiver, ...args]);
+        try {
+          const number = await sandboxNumber(args[0], budget, context);
+          const length = Number.isNaN(number) ? 0 : Math.trunc(number);
+          if (!Number.isSafeInteger(length) || length < 0 || length > arrayBufferOptions(receiver).maxByteLength)
+            throw new RangeError("Invalid ArrayBuffer resize length.");
+          budget.allocateArrayLength(length);
+          budget.provisionDataUsage(Math.max(length - arrayBufferLength(receiver), 0))();
+          Reflect.apply(resizeBuffer2, receiver, [length]);
+          return void 0;
+        } finally {
+          release();
+        }
+      }
+    })
+  });
+  for (const key of ["byteLength", "maxByteLength", "resizable"]) {
+    const getter = createSandboxClosure({
+      guest: true,
+      sandbox: true,
+      name: `get ${key}`,
+      length: 0,
+      call: (_args, context) => {
+        if (!isSandboxArrayBuffer(context?.thisValue)) throw new TypeError(`ArrayBuffer ${key} requires a buffer receiver.`);
+        if (key === "byteLength") return arrayBufferLength(context.thisValue);
+        const options = arrayBufferOptions(context.thisValue);
+        return key === "resizable" ? options !== void 0 : options?.maxByteLength ?? arrayBufferLength(context.thisValue);
+      }
+    });
+    Object.defineProperty(prototype, key, { get: accessorAdapter(getter, "get"), configurable: true });
+    getters.push(getter);
+  }
+  setSandboxPrototype(prototype, getSandboxPrototype(/* @__PURE__ */ Object.create(null), budget));
+  arrayBufferPrototypes.set(budget, prototype);
+  registerBuiltinIdentities(budget, { ArrayBuffer: constructor });
+  registerIntrinsicFunction(budget, constructor);
+  for (const getter of getters) registerIntrinsicFunction(budget, getter);
+  registerIntrinsicObject(budget, prototype);
+  return constructor;
+}
+
 // packages/safe-js/src/interp/globals.ts
 function createBuiltinBindings(options) {
   const bindings = {
@@ -24879,6 +25255,7 @@ function createBuiltinBindings(options) {
     ...createErrorGlobals({ ...options, errorPrototypes: options.errorPrototypes !== false }),
     ...createMathGlobals({ random: options.random, budget: options.budget }),
     ...createObjectArrayGlobals(options),
+    ArrayBuffer: createArrayBufferGlobal(options.budget),
     ...createMiscGlobals(options),
     ...createUriGlobals(options.budget),
     ...createPromiseGlobals(options),
@@ -25615,6 +25992,11 @@ function validateDumpHeap(root, state) {
       validateDateRecord(entry, path);
       continue;
     }
+    if (entry.kind === "arraybuffer") {
+      validateArrayBufferStorage(entry);
+      validateGuestHeapNode({ kind: "guest-object", state: entry.state }, heap, state.limits.maxEntries);
+      continue;
+    }
     if (entry.kind === "float32array") {
       validateFloat32Storage(entry);
       requireRecord(entry.entries, `${path}.entries`);
@@ -25838,7 +26220,7 @@ function validateHeapValue(value, path, state, heap) {
     fail("invalidValue", path, String(error));
   }
   validateErrorType(record4, path);
-  if (!["symbol", "arguments", "array", "object", "map", "set", "float32array", "date", "boxed", "collection-iterator", "regexp-iterator", "regex-object"].includes(String(record4.kind)))
+  if (!["symbol", "arguments", "array", "object", "map", "set", "float32array", "arraybuffer", "date", "boxed", "collection-iterator", "regexp-iterator", "regex-object"].includes(String(record4.kind)))
     fail("unknownTag", `${path}.kind`, "unknown heap tag");
   validateValue(record4, path, 1, state);
   if (record4.kind === "symbol") validateSymbolRecord(record4, path, state);
@@ -25847,6 +26229,10 @@ function validateHeapValue(value, path, state, heap) {
   if (record4.kind === "object") requireRecord(record4.entries, `${path}.entries`);
   if (record4.kind === "boxed") validateBoxedRecord(record4, path, heap);
   if (record4.kind === "date") validateDateRecord(record4, path);
+  if (record4.kind === "arraybuffer") {
+    validateArrayBufferStorage(record4);
+    validateGuestHeapNode({ kind: "guest-object", state: record4.state }, heap, state.limits.maxEntries);
+  }
   if (record4.kind === "float32array") {
     validateFloat32Storage(record4);
     requireRecord(record4.entries, `${path}.entries`);
@@ -26043,7 +26429,7 @@ function validateGenericValue(value, path, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail("invalidState", path, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types6.isProxy(value)) {
+  if (state.dataPropertiesOnly && types7.isProxy(value)) {
     fail("invalidType", path, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -26842,12 +27228,10 @@ function measureSandboxData(values, options = {}) {
     }
     const prototype = getSandboxPrototype(value);
     if (prototype !== null) visit(prototype, depth + 1);
+    if (isSandboxArrayBuffer(value)) usage += arrayBufferLength(value);
     if (isFloat32Array(value)) {
       const storage = float32Storage(value);
-      if (!seen.has(storage.buffer)) {
-        seen.add(storage.buffer);
-        usage += storage.byteLength;
-      }
+      visit(storage.buffer, depth + 1);
       for (const [key, descriptor] of float32Properties(value)) {
         usage += 1;
         if (typeof key === "string") usage += key.length;
@@ -26986,7 +27370,7 @@ function measureSandboxData(values, options = {}) {
       const descriptor = Object.getOwnPropertyDescriptor(value, key);
       if (descriptor !== void 0) descriptors2.push([key, descriptor]);
     }
-    const includeNonEnumerable = isSandboxDate(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
+    const includeNonEnumerable = isSandboxDate(value) || isSandboxArrayBuffer(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
     for (const [key, descriptor] of descriptors2) {
       if (!descriptor.enumerable && !includeNonEnumerable) continue;
       usage += 1 + key.length;
@@ -27182,6 +27566,20 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     }
     return sandboxPromise;
   }
+  if (isSandboxArrayBuffer(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = copyArrayBufferStorage(value, state);
+    state.seen.set(value, copy);
+    for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+      Object.defineProperty(copy, key, {
+        ...descriptor,
+        value: copyToSandbox(descriptor.value, state, joinPath2(path, key), cloneSandboxCollections, depth + 1)
+      });
+    }
+    if (!Object.isExtensible(value)) Object.preventExtensions(copy);
+    return copy;
+  }
   if (nodeTypes.isDate(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -27200,6 +27598,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
     if (existing !== void 0) return existing;
     const copy = copyFloat32Storage(value, state);
     state.seen.set(value, copy);
+    copyToSandbox(float32Storage(value).buffer, state, `${path}.buffer`, cloneSandboxCollections, depth + 1);
     for (const [key, descriptor] of float32DataProperties(value)) {
       Object.defineProperty(copy, key, {
         ...descriptor,
@@ -27421,6 +27820,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (existing !== void 0) return existing;
     const copy = copyFloat32Storage(value, state);
     state.seen.set(value, copy);
+    copyFromSandbox(float32Storage(value).buffer, state, `${path}.buffer`, options, depth + 1);
     for (const [key, descriptor] of float32DataProperties(value)) {
       Object.defineProperty(copy, key, {
         ...descriptor,
@@ -27430,6 +27830,20 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
     if (!Object.isExtensible(value)) Object.preventExtensions(copy);
     return copy;
   }
+  if (isSandboxArrayBuffer(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = copyArrayBufferStorage(value, state);
+    state.seen.set(value, copy);
+    for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+      Object.defineProperty(copy, key, {
+        ...descriptor,
+        value: copyFromSandbox(descriptor.value, state, joinPath2(path, key), options, depth + 1)
+      });
+    }
+    if (!Object.isExtensible(value)) Object.preventExtensions(copy);
+    return copy;
+  }
   if (isSandboxDate(value)) {
     const existing = state.seen.get(value);
     if (existing !== void 0) return existing;
@@ -27591,6 +28005,16 @@ function allocateSandboxValue2(value, budget, seen) {
     budget.allocateString(value);
     return;
   }
+  if (isSandboxArrayBuffer(value)) {
+    if (seen.has(value)) return;
+    seen.add(value);
+    budget.allocateArrayLength(arrayBufferLength(value));
+    for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+      if (typeof key === "string") budget.allocateString(key);
+      allocateSandboxValue2(descriptor.value, budget, seen);
+    }
+    return;
+  }
   if (isSandboxBox(value)) {
     if (seen.has(value)) return;
     seen.add(value);
@@ -28336,8 +28760,29 @@ function normalize(value, seen) {
   try {
     const date = copyNativeDate(value);
     if (date !== void 0) return Object.assign(/* @__PURE__ */ Object.create(null), { $type: "date", time: serializedDateTime(date) });
+    if (isSandboxArrayBuffer(value)) {
+      arrayBufferLength(value);
+      const properties = /* @__PURE__ */ Object.create(null);
+      const entries = [];
+      for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+        if (typeof key === "symbol") throw new TypeError("ArrayBuffer symbol properties require an explicit host-call identity.");
+        entries.push([key, descriptor]);
+      }
+      for (const [key, descriptor] of entries.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))
+        defineOwnDataProperty(properties, key, normalize(descriptor.value, seen));
+      return Object.assign(/* @__PURE__ */ Object.create(null), {
+        $type: "arraybuffer",
+        bytes: normalize(Array.from(new Uint8Array(value)), seen),
+        ...arrayBufferOptions(value),
+        properties
+      });
+    }
     if (isFloat32Array(value)) {
       const storage = float32Storage(value);
+      const resizable = arrayBufferOptions(storage.buffer) !== void 0;
+      const layout = resizable ? float32ViewLayouts.get(value) : void 0;
+      if (resizable && layout === void 0)
+        throw new TypeError("Resizable Float32Array host-call identity requires known view layout.");
       const properties = /* @__PURE__ */ Object.create(null);
       for (const [key, descriptor] of float32DataProperties(value).sort(
         ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
@@ -28349,7 +28794,12 @@ function normalize(value, seen) {
         bytes: normalize(Array.from(new Uint8Array(storage.buffer)), seen),
         byteOffset: storage.byteOffset,
         length: storage.length,
-        properties
+        properties,
+        ...resizable || Reflect.ownKeys(storage.buffer).length > 0 ? { buffer: normalize(storage.buffer, seen) } : {},
+        ...layout === void 0 ? {} : { viewLayout: {
+          byteOffset: layout.byteOffset,
+          length: layout.length ?? null
+        } }
       });
     }
     if (Array.isArray(value)) {
@@ -29301,6 +29751,7 @@ function classDefinitionContains(node, expression) {
 var KNOWN_RUNTIME_GLOBALS = [
   "AggregateError",
   "Array",
+  "ArrayBuffer",
   "Boolean",
   "BigInt",
   "Date",
@@ -39693,7 +40144,7 @@ function createReplayableRandom(options = {}) {
 
 // packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-import { types as types7 } from "node:util";
+import { types as types8 } from "node:util";
 
 // packages/safe-js/src/modules/registry.ts
 function createUnknownModuleMessage2(moduleName, moduleNames) {
@@ -39832,7 +40283,7 @@ var RealmState = class {
         throw new TypeError("Realm limits must be positive safe integers with supported names.");
       this.limits[name] = Number(value);
     }
-    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types7.isProxy(options.extensions)))
+    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types8.isProxy(options.extensions)))
       throw new TypeError("Extensions must be a registration array.");
     const registrations = options.extensions ?? [];
     const extensions = [];
@@ -40067,7 +40518,7 @@ var RealmState = class {
     return this.phase.run(phase, () => {
       try {
         const result = call();
-        if (types7.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+        if (types8.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
           return Promise.resolve(result).then(
             async (value) => {
               await Promise.allSettled(phase.pending);
@@ -40136,7 +40587,7 @@ var RealmState = class {
       },
       read: (operation, validate) => {
         const value = this.invokeHost(operation, operation);
-        if (types7.isPromise(value)) {
+        if (types8.isPromise(value)) {
           void Promise.resolve(value).catch(() => void 0);
           throw new TypeError("Live property operations must be synchronous.");
         }
@@ -40144,7 +40595,7 @@ var RealmState = class {
       },
       write: (operation, value) => {
         const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
-        if (types7.isPromise(result)) {
+        if (types8.isPromise(result)) {
           void Promise.resolve(result).catch(() => void 0);
           throw new TypeError("Live property setters must be synchronous.");
         }
@@ -40353,7 +40804,7 @@ var RealmState = class {
         }
       });
       const output = getExtensionSetup(extension)(context);
-      if (types7.isPromise(output)) {
+      if (types8.isPromise(output)) {
         void Promise.resolve(output).catch(() => void 0);
         throw new TypeError("Extension setup must be synchronous.");
       }
@@ -40545,7 +40996,7 @@ var RealmState = class {
 };
 function readModules(input) {
   const entries = (value, label) => {
-    if (types7.isMap(value) && !types7.isProxy(value)) {
+    if (types8.isMap(value) && !types8.isProxy(value)) {
       const result = [...Map.prototype.entries.call(value)];
       if (result.length > 4096 || result.some(([key]) => typeof key !== "string" || key.length === 0))
         throw new TypeError(`${label} requires bounded string keys.`);
@@ -41814,4 +42265,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-PT7PBLVT.js.map
+//# sourceMappingURL=chunk-CYVI4ZUK.js.map