poe-code 14.0.83 → 14.0.84

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-37V6Q4K3.js";
+} from "./chunks/chunk-2EZQJQ2C.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-PT7PBLVT.js";
+} from "./chunks/chunk-CYVI4ZUK.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-PT7PBLVT.js";
+} from "./chunks/chunk-CYVI4ZUK.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-37V6Q4K3.js";
+} from "./chunks/chunk-2EZQJQ2C.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-PT7PBLVT.js";
+} from "./chunks/chunk-CYVI4ZUK.js";
 import "./chunks/chunk-M2DLCGEF.js";
 import "./chunks/chunk-Q7USUEL7.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/array-buffer.d.ts

@@ -0,0 +1,12 @@
+import type { Budget } from "./budget.js";
+import type { SandboxObject } from "./values.js";
+export declare const arrayBufferPrototypes: WeakMap<Budget, SandboxObject>;
+export declare function isSandboxArrayBuffer(value: unknown): value is ArrayBuffer;
+export declare function arrayBufferLength(value: ArrayBuffer): number;
+export declare function arrayBufferOptions(value: ArrayBuffer): {
+    maxByteLength: number;
+} | undefined;
+export declare function copyArrayBufferStorage(value: ArrayBuffer, state: {
+    float32Buffers?: WeakMap<ArrayBuffer, ArrayBuffer>;
+}): ArrayBuffer;
+export declare function arrayBufferDataProperties(value: ArrayBuffer): Array<[string | symbol, PropertyDescriptor]>;

package/packages/safe-js/dist/interp/array-buffer.js

@@ -0,0 +1,33 @@
+import { types } from "node:util";
+const readLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get;
+const readResizable = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resizable")?.get;
+const readMaxLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "maxByteLength")?.get;
+export const arrayBufferPrototypes = new WeakMap();
+export function isSandboxArrayBuffer(value) {
+    return types.isArrayBuffer(value) && Object.getPrototypeOf(value) === ArrayBuffer.prototype;
+}
+export function arrayBufferLength(value) {
+    return Reflect.apply(readLength, value, []);
+}
+export function arrayBufferOptions(value) {
+    return readResizable !== undefined && Reflect.apply(readResizable, value, [])
+        ? { maxByteLength: Reflect.apply(readMaxLength, value, []) } : undefined;
+}
+export function copyArrayBufferStorage(value, state) {
+    state.float32Buffers ??= new WeakMap();
+    let copy = state.float32Buffers.get(value);
+    if (copy === undefined) {
+        copy = Reflect.construct(ArrayBuffer, [arrayBufferLength(value), arrayBufferOptions(value)]);
+        new Uint8Array(copy).set(new Uint8Array(value));
+        state.float32Buffers.set(value, copy);
+    }
+    return copy;
+}
+export function arrayBufferDataProperties(value) {
+    return Reflect.ownKeys(value).map(key => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!("value" in descriptor))
+            throw new TypeError("ArrayBuffer accessors cannot be copied as data.");
+        return [key, descriptor];
+    });
+}

package/packages/safe-js/dist/interp/float32.d.ts

@@ -1,6 +1,11 @@
 import type { Budget } from "./budget.js";
+export declare const float32ViewLayouts: WeakMap<Float32Array<ArrayBufferLike>, {
+    byteOffset: number;
+    length?: number;
+}>;
+export declare function restoreFloat32View(buffer: ArrayBuffer, byteOffset: number, length?: number, budget?: Budget): Float32Array;
 export declare function isFloat32Array(value: unknown): value is Float32Array;
-export declare function float32Storage(value: Float32Array): {
+export declare function float32Storage(value: Float32Array, requireInBounds?: boolean): {
     buffer: ArrayBuffer;
     byteOffset: number;
     length: number;

package/packages/safe-js/dist/interp/float32.js

@@ -1,20 +1,48 @@
+import { arrayBufferLength, arrayBufferOptions, copyArrayBufferStorage } from "./array-buffer.js";
 const typedArrayPrototype = Object.getPrototypeOf(Float32Array.prototype);
 const readLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "length").get;
 const readOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
 const readBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
 const readTag = Object.getOwnPropertyDescriptor(typedArrayPrototype, Symbol.toStringTag).get;
+const createValuesIterator = Object.getOwnPropertyDescriptor(typedArrayPrototype, "values").value;
 const bufferLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get;
 const bufferResizable = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resizable")?.get;
+export const float32ViewLayouts = new WeakMap();
+const resizeBuffer = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resize").value;
+export function restoreFloat32View(buffer, byteOffset, length, budget) {
+    const originalLength = arrayBufferLength(buffer);
+    const required = byteOffset + (length ?? 0) * 4;
+    const options = arrayBufferOptions(buffer);
+    const grow = required > originalLength;
+    if (grow) {
+        if (options === undefined || required > options.maxByteLength)
+            throw new RangeError("Float32Array layout exceeds backing capacity.");
+        budget?.allocateArrayLength(Math.ceil(required / 4));
+        budget?.provisionDataUsage(required - originalLength)();
+        Reflect.apply(resizeBuffer, buffer, [required]);
+    }
+    try {
+        const view = new Float32Array(buffer, byteOffset, length);
+        if (options !== undefined)
+            float32ViewLayouts.set(view, { byteOffset, ...(length === undefined ? {} : { length }) });
+        return view;
+    }
+    finally {
+        if (grow)
+            Reflect.apply(resizeBuffer, buffer, [originalLength]);
+    }
+}
 export function isFloat32Array(value) {
     return (ArrayBuffer.isView(value) &&
         Object.getPrototypeOf(value) === Float32Array.prototype &&
         Reflect.apply(readTag, value, []) === "Float32Array");
 }
-export function float32Storage(value) {
+export function float32Storage(value, requireInBounds = false) {
+    if (requireInBounds)
+        Reflect.apply(createValuesIterator, value, []);
     const buffer = Reflect.apply(readBuffer, value, []);
-    if (Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype ||
-        (bufferResizable !== undefined && Reflect.apply(bufferResizable, buffer, []))) {
-        throw new TypeError("Float32Array requires a fixed, non-shared ArrayBuffer.");
+    if (Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype) {
+        throw new TypeError("Float32Array requires a non-shared ArrayBuffer.");
     }
     return {
         buffer,
@@ -63,12 +91,12 @@ export function checkFloat32Allocation(length, budget) {
 }
 export function copyFloat32Storage(value, state) {
     const storage = float32Storage(value);
-    state.float32Buffers ??= new WeakMap();
-    let buffer = state.float32Buffers.get(storage.buffer);
-    if (buffer === undefined) {
-        buffer = new ArrayBuffer(storage.byteLength);
-        new Uint8Array(buffer).set(new Uint8Array(storage.buffer));
-        state.float32Buffers.set(storage.buffer, buffer);
+    const buffer = copyArrayBufferStorage(storage.buffer, state);
+    if (bufferResizable !== undefined && Reflect.apply(bufferResizable, storage.buffer, [])) {
+        const layout = float32ViewLayouts.get(value);
+        if (layout === undefined)
+            throw new TypeError("Resizable Float32Array copies require known view layout.");
+        return restoreFloat32View(buffer, layout.byteOffset, layout.length);
     }
     return new Float32Array(buffer, storage.byteOffset, storage.length);
 }

package/packages/safe-js/dist/interp/globals/array-buffer.d.ts

@@ -0,0 +1,3 @@
+import type { Budget } from "../budget.js";
+import { type SandboxClosure } from "../values.js";
+export declare function createArrayBufferGlobal(budget: Budget): SandboxClosure;

package/packages/safe-js/dist/interp/globals/array-buffer.js

@@ -0,0 +1,112 @@
+import { arrayBufferLength, arrayBufferOptions, arrayBufferPrototypes, isSandboxArrayBuffer } from "../array-buffer.js";
+import { accessorAdapter, readPropertyDescriptor } from "../accessors.js";
+import { createSandboxClosure } from "../values.js";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, materializeFunctionProperties, registerIntrinsicFunction, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { invokeBuiltinClosure } from "../builtin-call.js";
+import { registerBuiltinIdentities } from "../intrinsics.js";
+import { sandboxNumber } from "../string-coercion.js";
+import { retainValues } from "../resources.js";
+const resizeBuffer = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resize").value;
+export function createArrayBufferGlobal(budget) {
+    const prototype = Object.create(null);
+    const constructor = createSandboxClosure({
+        guest: true, sandbox: true, name: "ArrayBuffer", length: 1,
+        call: () => { throw new TypeError("ArrayBuffer requires new."); },
+        construct: async (args, context) => {
+            let selected;
+            let current;
+            const bridge = {
+                ...context, stack: context?.stack ?? [], thisValue: undefined,
+                getProperty: context?.getProperty ?? ((value, key) => {
+                    const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+                    return descriptor === undefined ? getSandboxDataProperty(value, key, budget)
+                        : readPropertyDescriptor(descriptor, value, bridge);
+                }),
+                invokeClosure: context?.invokeClosure ?? ((callee, values, receiver, construct) => invokeBuiltinClosure(callee, values, budget, context, receiver, construct))
+            };
+            const release = retainValues(budget, () => [selected, current, ...args]);
+            try {
+                const number = await sandboxNumber(args[0], budget, bridge);
+                const length = Number.isNaN(number) ? 0 : Math.trunc(number);
+                if (length < 0 || !Number.isSafeInteger(length))
+                    throw new RangeError("Invalid ArrayBuffer length.");
+                let maxByteLength;
+                if (args[1] !== null && typeof args[1] === "object") {
+                    current = await bridge.getProperty(args[1], "maxByteLength");
+                    if (current !== undefined) {
+                        const maximum = await sandboxNumber(current, budget, bridge);
+                        maxByteLength = Number.isNaN(maximum) ? 0 : Math.trunc(maximum);
+                        if (!Number.isSafeInteger(maxByteLength) || maxByteLength < length)
+                            throw new RangeError("Invalid ArrayBuffer maximum length.");
+                    }
+                }
+                const target = context?.newTarget ?? constructor;
+                selected = await bridge.getProperty(target, "prototype");
+                budget.allocateArrayLength(maxByteLength ?? length);
+                budget.provisionDataUsage(length + 1)();
+                const result = Reflect.construct(ArrayBuffer, [length, maxByteLength === undefined ? undefined : { maxByteLength }]);
+                setSandboxPrototype(result, selected !== null && typeof selected === "object" ? selected : prototype, budget);
+                return result;
+            }
+            finally {
+                release();
+            }
+        }
+    });
+    Object.defineProperty(materializeFunctionProperties(constructor), "prototype", { value: prototype, writable: false });
+    Object.defineProperty(materializeFunctionProperties(constructor), "isView", {
+        writable: true, configurable: true,
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "isView", length: 1,
+            call: args => ArrayBuffer.isView(args[0]) })
+    });
+    Object.defineProperties(prototype, {
+        constructor: { value: constructor, writable: true, configurable: true },
+        [Symbol.toStringTag]: { value: "ArrayBuffer", configurable: true }
+    });
+    const getters = [];
+    Object.defineProperty(prototype, "resize", { writable: true, configurable: true,
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "resize", length: 1,
+            call: async (args, context) => {
+                const receiver = context?.thisValue;
+                if (!isSandboxArrayBuffer(receiver) || arrayBufferOptions(receiver) === undefined)
+                    throw new TypeError("ArrayBuffer resize requires a resizable buffer receiver.");
+                const release = retainValues(budget, () => [receiver, ...args]);
+                try {
+                    const number = await sandboxNumber(args[0], budget, context);
+                    const length = Number.isNaN(number) ? 0 : Math.trunc(number);
+                    if (!Number.isSafeInteger(length) || length < 0 || length > arrayBufferOptions(receiver).maxByteLength)
+                        throw new RangeError("Invalid ArrayBuffer resize length.");
+                    budget.allocateArrayLength(length);
+                    budget.provisionDataUsage(Math.max(length - arrayBufferLength(receiver), 0))();
+                    Reflect.apply(resizeBuffer, receiver, [length]);
+                    return undefined;
+                }
+                finally {
+                    release();
+                }
+            }
+        })
+    });
+    for (const key of ["byteLength", "maxByteLength", "resizable"]) {
+        const getter = createSandboxClosure({ guest: true, sandbox: true, name: `get ${key}`, length: 0,
+            call: (_args, context) => {
+                if (!isSandboxArrayBuffer(context?.thisValue))
+                    throw new TypeError(`ArrayBuffer ${key} requires a buffer receiver.`);
+                if (key === "byteLength")
+                    return arrayBufferLength(context.thisValue);
+                const options = arrayBufferOptions(context.thisValue);
+                return key === "resizable" ? options !== undefined : options?.maxByteLength ?? arrayBufferLength(context.thisValue);
+            }
+        });
+        Object.defineProperty(prototype, key, { get: accessorAdapter(getter, "get"), configurable: true });
+        getters.push(getter);
+    }
+    setSandboxPrototype(prototype, getSandboxPrototype(Object.create(null), budget));
+    arrayBufferPrototypes.set(budget, prototype);
+    registerBuiltinIdentities(budget, { ArrayBuffer: constructor });
+    registerIntrinsicFunction(budget, constructor);
+    for (const getter of getters)
+        registerIntrinsicFunction(budget, getter);
+    registerIntrinsicObject(budget, prototype);
+    return constructor;
+}

package/packages/safe-js/dist/interp/globals/float32array.d.ts

@@ -3,5 +3,5 @@ import { type SandboxClosure, type SandboxValue } from "../values.js";
 export declare function createFloat32ArrayGlobal(budget: Budget, nativePrototype?: boolean): SandboxClosure;
 export declare function createFloat32ArrayPrototypes(budget: Budget, constructor: SandboxClosure): void;
 export declare function isFloat32ArrayConstructor(value: unknown): boolean;
-export declare function getFloat32Member(value: Float32Array, property: string | number, budget: Budget): SandboxValue;
+export declare function getFloat32Member(value: Float32Array, property: string | number, budget: Budget, defaultConstructor?: SandboxClosure): SandboxValue;
 export declare function setFloat32Member(value: Float32Array, property: PropertyKey, entry: SandboxValue, budget?: Budget): void;

package/packages/safe-js/dist/interp/globals/float32array.js

@@ -1,4 +1,4 @@
-import { checkFloat32Allocation, float32Number, float32Storage, isFloat32Array, isFloat32Index } from "../float32.js";
+import { checkFloat32Allocation, float32Number, float32Storage, float32ViewLayouts, isFloat32Array, isFloat32Index } from "../float32.js";
 import { createSandboxClosure, isSandboxClosure, measureSandboxData } from "../values.js";
 import { accessorAdapter, readPropertyDescriptor } from "../accessors.js";
 import { float32Prototypes } from "../float32-prototypes.js";
@@ -10,6 +10,7 @@ import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { acquireSandboxIterator, readIteratorResult } from "../iteration.js";
 import { createDataCheckpoint } from "../data-checkpoint.js";
 import { createSandboxBox } from "../boxed.js";
+import { arrayBufferLength, arrayBufferOptions, isSandboxArrayBuffer } from "../array-buffer.js";
 const constructors = new WeakSet();
 export function createFloat32ArrayGlobal(budget, nativePrototype = false) {
     const constructor = createSandboxClosure({
@@ -32,6 +33,32 @@ export function createFloat32ArrayGlobal(budget, nativePrototype = false) {
                 const prototype = candidate !== null && typeof candidate === "object" ? candidate : float32Prototypes.get(budget);
                 const release = retainValues(budget, () => [prototype, ...args]);
                 try {
+                    if (isSandboxArrayBuffer(args[0])) {
+                        const buffer = args[0];
+                        const number = await sandboxNumber(args[1], budget, context);
+                        const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
+                        if (!Number.isSafeInteger(offset) || offset < 0 || offset % 4 !== 0)
+                            throw new RangeError("Invalid Float32Array buffer offset.");
+                        const bytes = arrayBufferLength(buffer);
+                        let length;
+                        if (args[2] === undefined) {
+                            if ((arrayBufferOptions(buffer) === undefined && bytes % 4 !== 0) || offset > bytes)
+                                throw new RangeError("Invalid Float32Array buffer length.");
+                            length = Math.floor((bytes - offset) / 4);
+                        }
+                        else {
+                            const size = await sandboxNumber(args[2], budget, context);
+                            length = Number.isNaN(size) ? 0 : Math.trunc(size);
+                            if (!Number.isSafeInteger(length) || length < 0 || offset + length * 4 > arrayBufferLength(buffer))
+                                throw new RangeError("Invalid Float32Array view length.");
+                        }
+                        budget.allocateArrayLength(length);
+                        const result = new Float32Array(buffer, offset, args[2] === undefined ? undefined : length);
+                        if (arrayBufferOptions(buffer) !== undefined)
+                            float32ViewLayouts.set(result, { byteOffset: offset, ...(args[2] === undefined ? {} : { length }) });
+                        setSandboxPrototype(result, prototype, budget);
+                        return result;
+                    }
                     const result = args[0] !== null && typeof args[0] === "object" && !isFloat32Array(args[0])
                         ? await allocateFloat32Input(args[0], budget, context)
                         : allocateFloat32Array(args[0], budget);
@@ -242,7 +269,13 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
     setSandboxPrototype(prototype, shared);
     setSandboxPrototype(shared, getSandboxPrototype(Object.create(null), budget));
     const getters = [];
-    for (const key of ["length", "byteLength", "byteOffset"]) {
+    const species = createSandboxClosure({ guest: true, sandbox: true, name: "get [Symbol.species]", length: 0,
+        call: (_args, context) => context?.thisValue });
+    getters.push(species);
+    Object.defineProperty(materializeFunctionProperties(typedArray), Symbol.species, {
+        get: accessorAdapter(species, "get"), configurable: true
+    });
+    for (const key of ["length", "byteLength", "byteOffset", "buffer"]) {
         const getter = createSandboxClosure({ guest: true, sandbox: true, name: `get ${key}`, length: 0,
             call: (_args, context) => {
                 if (!isFloat32Array(context?.thisValue))
@@ -255,7 +288,7 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
         Object.defineProperty(shared, key, { get: accessorAdapter(getter, "get"), configurable: true });
     }
     for (const key of ["set", "slice", "subarray"])
-        Object.defineProperty(shared, key, { value: getFloat32Member(new Float32Array(0), key, budget), writable: true, configurable: true });
+        Object.defineProperty(shared, key, { value: getFloat32Member(new Float32Array(0), key, budget, constructor), writable: true, configurable: true });
     const arrayPrototype = resolveIntrinsicIdentity(budget, '["Array","prototype"]');
     Object.defineProperty(shared, "toString", { value: getSandboxDataProperty(arrayPrototype, "toString", budget), writable: true, configurable: true });
     Object.defineProperty(shared, "join", { writable: true, configurable: true,
@@ -264,7 +297,7 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
                 if (!isFloat32Array(context?.thisValue))
                     throw new TypeError("TypedArray join requires a typed array receiver.");
                 const receiver = context.thisValue;
-                const length = float32Storage(receiver).length;
+                const length = float32Storage(receiver, true).length;
                 let separator = ",";
                 let text = "";
                 const release = retainValues(budget, () => [receiver, separator, text, ...args]);
@@ -273,7 +306,8 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
                         separator = await sandboxString(args[0], budget, context);
                     for (let index = 0; index < length; index++) {
                         budget.visitNode();
-                        text = budget.allocateString(text + (index === 0 ? "" : separator) + String(receiver[index]));
+                        const value = receiver[index];
+                        text = budget.allocateString(text + (index === 0 ? "" : separator) + (value === undefined ? "" : String(value)));
                     }
                     return text;
                 }
@@ -293,6 +327,7 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
             call: (args, context) => {
                 if (!isFloat32Array(context?.thisValue))
                     throw new TypeError(`TypedArray ${key} requires a typed array receiver.`);
+                float32Storage(context.thisValue, true);
                 return invokeBuiltinClosure(method, args, budget, context, context.thisValue);
             }
         });
@@ -312,7 +347,7 @@ export function createFloat32ArrayPrototypes(budget, constructor) {
 export function isFloat32ArrayConstructor(value) {
     return typeof value === "object" && value !== null && constructors.has(value);
 }
-export function getFloat32Member(value, property, budget) {
+export function getFloat32Member(value, property, budget, defaultConstructor) {
     const key = String(property);
     const descriptor = Object.getOwnPropertyDescriptor(value, key);
     if (descriptor !== undefined) {
@@ -342,7 +377,7 @@ export function getFloat32Member(value, property, budget) {
             const receiver = context?.thisValue;
             if (!isFloat32Array(receiver))
                 throw new TypeError(`Float32Array#${key} requires a Float32Array receiver.`);
-            const storage = float32Storage(receiver);
+            const storage = float32Storage(receiver, key === "slice");
             const bridge = {
                 ...context, stack: context?.stack ?? [], thisValue: receiver,
                 getProperty: context?.getProperty ?? ((value, property) => {
@@ -363,18 +398,19 @@ export function getFloat32Member(value, property, budget) {
                         const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
                         if (offset < 0)
                             throw new RangeError("Float32Array#set offset is out of bounds.");
+                        const targetStorage = float32Storage(receiver, true);
                         if (source === null || source === undefined)
                             throw new TypeError("Float32Array#set requires a non-null source.");
                         let length;
                         if (isFloat32Array(source))
-                            length = float32Storage(source).length;
+                            length = float32Storage(source, true).length;
                         else {
                             sourceObject = typeof source === "object" ? source : createSandboxBox(source);
                             current = await bridge.getProperty(sourceObject, "length");
                             const size = await sandboxNumber(current, budget, bridge);
                             length = Number.isNaN(size) || size <= 0 ? 0 : Math.min(Math.trunc(size), Number.MAX_SAFE_INTEGER);
                         }
-                        if (offset + length > storage.length)
+                        if (offset + length > targetStorage.length)
                             throw new RangeError("Float32Array#set source is out of bounds.");
                         if (isFloat32Array(source))
                             Float32Array.prototype.set.call(receiver, source, offset);
@@ -392,17 +428,70 @@ export function getFloat32Member(value, property, budget) {
                 })();
             }
             return (async () => {
-                const release = retainValues(budget, () => [receiver, ...args]);
+                let candidate;
+                let result;
+                const release = retainValues(budget, () => [receiver, candidate, result, ...args]);
                 try {
                     const start = relativeIndex(await sandboxNumber(args[0], budget, bridge), storage.length);
                     const end = args[1] === undefined ? storage.length
                         : relativeIndex(await sandboxNumber(args[1], budget, bridge), storage.length);
                     const length = Math.max(end - start, 0);
-                    if (key === "subarray")
-                        return new Float32Array(storage.buffer, storage.byteOffset + start * 4, length);
-                    checkFloat32Allocation(length, budget);
-                    const result = new Float32Array(length);
-                    new Uint8Array(result.buffer).set(new Uint8Array(storage.buffer, storage.byteOffset + start * 4, length * 4));
+                    const layout = float32ViewLayouts.get(receiver);
+                    const offset = (layout?.byteOffset ?? storage.byteOffset) + start * 4;
+                    const tracking = layout !== undefined && layout.length === undefined && args[1] === undefined;
+                    if (defaultConstructor !== undefined) {
+                        candidate = await bridge.getProperty(receiver, "constructor");
+                        if (candidate !== undefined) {
+                            if (candidate === null || typeof candidate !== "object")
+                                throw new TypeError("TypedArray constructor must be an object.");
+                            candidate = await bridge.getProperty(candidate, Symbol.species);
+                            if (candidate !== undefined && candidate !== null &&
+                                (!isSandboxClosure(candidate) || candidate.construct === undefined))
+                                throw new TypeError("TypedArray species must be a constructor.");
+                        }
+                    }
+                    if (candidate !== undefined && candidate !== null && candidate !== defaultConstructor) {
+                        const values = key === "slice" ? [length]
+                            : [storage.buffer, offset, tracking ? undefined : length];
+                        result = await invokeBuiltinClosure(candidate, values, budget, bridge, undefined, true);
+                        if (!isFloat32Array(result))
+                            throw new TypeError("TypedArray species must return typed storage.");
+                        const target = float32Storage(result, key === "slice");
+                        if (key === "slice" && target.length < length)
+                            throw new TypeError("TypedArray species returned insufficient storage.");
+                    }
+                    if (key === "subarray") {
+                        if (result === undefined) {
+                            result = new Float32Array(storage.buffer, offset, tracking ? undefined : length);
+                            if (arrayBufferOptions(storage.buffer) !== undefined)
+                                float32ViewLayouts.set(result, { byteOffset: offset, ...(tracking ? {} : { length }) });
+                        }
+                        return result;
+                    }
+                    if (result === undefined) {
+                        checkFloat32Allocation(length, budget);
+                        result = new Float32Array(length);
+                    }
+                    if (!isFloat32Array(result))
+                        throw new TypeError("TypedArray species must return typed storage.");
+                    if (length > 0) {
+                        const current = float32Storage(receiver, true);
+                        const target = float32Storage(result, true);
+                        const count = Math.min(length, Math.max(current.length - start, 0));
+                        if (count > 0) {
+                            const sourceBytes = new Uint8Array(current.buffer, current.byteOffset + start * 4, count * 4);
+                            const targetBytes = new Uint8Array(target.buffer, target.byteOffset, count * 4);
+                            if (current.buffer === target.buffer && targetBytes.byteOffset > sourceBytes.byteOffset &&
+                                targetBytes.byteOffset < sourceBytes.byteOffset + sourceBytes.length) {
+                                for (let index = 0; index < sourceBytes.length; index++) {
+                                    budget.visitNode();
+                                    targetBytes[index] = sourceBytes[index];
+                                }
+                            }
+                            else
+                                targetBytes.set(sourceBytes);
+                        }
+                    }
                     return result;
                 }
                 finally {

package/packages/safe-js/dist/interp/globals.d.ts

@@ -18,6 +18,7 @@ export declare function createBuiltinBindings(options: Parameters<typeof createC
     parseFloat: import("./values.js").SandboxClosure;
     isNaN: import("./values.js").SandboxClosure;
     isFinite: import("./values.js").SandboxClosure;
+    ArrayBuffer: import("./values.js").SandboxClosure;
     Object: import("./values.js").SandboxClosure;
     Array: import("./values.js").SandboxClosure;
     String: import("./values.js").SandboxClosure;

package/packages/safe-js/dist/interp/globals.js

@@ -13,6 +13,7 @@ import { createPromiseGlobals } from "./promise.js";
 import { createDateGlobal } from "./globals/date.js";
 import { createSymbolGlobal } from "./globals/symbol.js";
 import { createBigIntGlobal } from "./globals/bigint.js";
+import { createArrayBufferGlobal } from "./globals/array-buffer.js";
 import { registerBuiltinIdentities } from "./intrinsics.js";
 export function createBuiltinBindings(options) {
     const bindings = {
@@ -25,6 +26,7 @@ export function createBuiltinBindings(options) {
         ...createErrorGlobals({ ...options, errorPrototypes: options.errorPrototypes !== false }),
         ...createMathGlobals({ random: options.random, budget: options.budget }),
         ...createObjectArrayGlobals(options),
+        ArrayBuffer: createArrayBufferGlobal(options.budget),
         ...createMiscGlobals(options),
         ...createUriGlobals(options.budget),
         ...createPromiseGlobals(options),

package/packages/safe-js/dist/interp/host-bridge.d.ts

@@ -42,5 +42,6 @@ export declare function copyHostValueToSandbox(value: unknown, stackFrames: read
     errorData?: boolean;
 }, state: {
     seen: WeakMap<object, SandboxValue>;
+    float32Buffers?: WeakMap<ArrayBuffer, ArrayBuffer>;
 }, path: string): SandboxValue;
 export {};

package/packages/safe-js/dist/interp/host-bridge.js

@@ -5,6 +5,7 @@ import { exportHostCapability, importHostCapability, isLiveCapability } from "./
 import { attachErrorSpan, replaceErrorStack } from "../error/shape.js";
 import { SandboxError } from "./budget.js";
 import { CompileScope } from "./regex/compile-guard.js";
+import { arrayBufferDataProperties, arrayBufferLength, copyArrayBufferStorage, isSandboxArrayBuffer } from "./array-buffer.js";
 import { checkFloat32Allocation, copyFloat32Storage, float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
 import { createSubsetErrorValue } from "./exceptions.js";
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
@@ -705,6 +706,25 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
         state.seen.set(value, date);
         return date;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const length = arrayBufferLength(value);
+        budget.allocateArrayLength(length);
+        budget.provisionDataUsage(length + 1)();
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            if (typeof key === "symbol")
+                throw new TypeError("Host ArrayBuffer symbol properties require an explicit capability path.");
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyHostValueToSandbox(descriptor.value, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), key] }, state, joinPath(path, key)) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (isFloat32Array(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -712,6 +732,7 @@ export function copyHostValueToSandbox(value, stackFrames, options, state, path)
         checkFloat32Allocation(Math.ceil(float32Storage(value).byteLength / 4), budget);
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyHostValueToSandbox(float32Storage(value).buffer, stackFrames, { ...options, capabilityPath: [...(options.capabilityPath ?? []), "buffer"] }, state, `${path}.buffer`);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,