poe-code 14.0.83 → 14.0.84

package/packages/safe-js/dist/interp/host-call.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { float32DataProperties, float32Storage, isFloat32Array } from "./float32.js";
+import { float32DataProperties, float32Storage, float32ViewLayouts, isFloat32Array } from "./float32.js";
+import { arrayBufferDataProperties, arrayBufferLength, arrayBufferOptions, isSandboxArrayBuffer } from "./array-buffer.js";
 import { copyNativeDate, serializedDateTime } from "./date.js";
 import { cloneSandboxValue, createSandboxClosure, defineOwnDataProperty, isArrayIndexKey, measureSandboxData } from "./values.js";
 import { CompileScope } from "./regex/compile-guard.js";
@@ -585,8 +586,26 @@ function normalize(value, seen) {
         const date = copyNativeDate(value);
         if (date !== undefined)
             return Object.assign(Object.create(null), { $type: "date", time: serializedDateTime(date) });
+        if (isSandboxArrayBuffer(value)) {
+            arrayBufferLength(value);
+            const properties = Object.create(null);
+            const entries = [];
+            for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+                if (typeof key === "symbol")
+                    throw new TypeError("ArrayBuffer symbol properties require an explicit host-call identity.");
+                entries.push([key, descriptor]);
+            }
+            for (const [key, descriptor] of entries.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))
+                defineOwnDataProperty(properties, key, normalize(descriptor.value, seen));
+            return Object.assign(Object.create(null), { $type: "arraybuffer",
+                bytes: normalize(Array.from(new Uint8Array(value)), seen), ...arrayBufferOptions(value), properties });
+        }
         if (isFloat32Array(value)) {
             const storage = float32Storage(value);
+            const resizable = arrayBufferOptions(storage.buffer) !== undefined;
+            const layout = resizable ? float32ViewLayouts.get(value) : undefined;
+            if (resizable && layout === undefined)
+                throw new TypeError("Resizable Float32Array host-call identity requires known view layout.");
             const properties = Object.create(null);
             for (const [key, descriptor] of float32DataProperties(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
                 defineOwnDataProperty(properties, key, normalize(descriptor.value, seen));
@@ -596,7 +615,12 @@ function normalize(value, seen) {
                 bytes: normalize(Array.from(new Uint8Array(storage.buffer)), seen),
                 byteOffset: storage.byteOffset,
                 length: storage.length,
-                properties
+                properties,
+                ...(resizable || Reflect.ownKeys(storage.buffer).length > 0
+                    ? { buffer: normalize(storage.buffer, seen) } : {}),
+                ...(layout === undefined ? {} : { viewLayout: {
+                        byteOffset: layout.byteOffset, length: layout.length ?? null
+                    } })
             });
         }
         if (Array.isArray(value)) {

package/packages/safe-js/dist/interp/methods/array-iterator.js

@@ -18,7 +18,7 @@ export async function nextArrayIterator(value, budget, context) {
             ?? getSandboxPropertyDescriptor(source, key, budget) ?? { value: undefined }, source, context);
     try {
         budget.visitNode();
-        const number = isFloat32Array(source) ? float32Storage(source).length
+        const number = isFloat32Array(source) ? float32Storage(source, true).length
             : await sandboxNumber(await read("length"), budget, context);
         const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
         if (index >= length) {

package/packages/safe-js/dist/interp/object-model.js

@@ -10,6 +10,7 @@ import { getHostObjectMember, isGuestHostObject, isLiveCapability } from "./host
 import { errorPrototypes } from "./error-prototypes.js";
 import { float32Properties, isFloat32Array, isFloat32Index } from "./float32.js";
 import { float32Prototypes } from "./float32-prototypes.js";
+import { arrayBufferPrototypes, isSandboxArrayBuffer } from "./array-buffer.js";
 import { sandboxErrorTypes } from "../error/shape.js";
 import { boxedValue, isSandboxBox } from "./boxed.js";
 import { isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet } from "./values.js";
@@ -279,12 +280,15 @@ export function releaseObjectPrototype(budget) {
     generatorPrototypes.delete(budget);
     errorPrototypes.delete(budget);
     float32Prototypes.delete(budget);
+    arrayBufferPrototypes.delete(budget);
     initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }
 export function getSandboxPrototype(value, budget) {
     if (prototypes.has(value))
         return prototypes.get(value) ?? null;
+    if (isSandboxArrayBuffer(value))
+        return budget === undefined ? null : arrayBufferPrototypes.get(budget) ?? null;
     if (isFloat32Array(value))
         return budget === undefined ? null : float32Prototypes.get(budget) ?? null;
     // Host transport records are data-only. Resolve their default prototype in
@@ -427,6 +431,8 @@ export function setSandboxPrototype(value, prototype, budget) {
     prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+    if (isSandboxArrayBuffer(value))
+        return true;
     if (isFloat32Array(value))
         return true;
     if (isGuestClosure(value))

package/packages/safe-js/dist/interp/values.d.ts

@@ -17,7 +17,7 @@ declare const sandboxRegexBrand: unique symbol;
 declare const sandboxRegexPattern: unique symbol;
 declare const sandboxRetainedValues: unique symbol;
 export type SandboxPrimitive = string | number | bigint | boolean | symbol | null | undefined;
-export type SandboxValue = SandboxPrimitive | Date | Float32Array | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
+export type SandboxValue = SandboxPrimitive | Date | Float32Array | ArrayBuffer | SandboxObject | SandboxArray | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | SandboxMap | SandboxSet | SandboxPromise | SandboxRegex;
 export type SandboxObject = {
     [key: string]: SandboxValue;
     [key: symbol]: SandboxValue;

package/packages/safe-js/dist/interp/values.js

@@ -1,4 +1,5 @@
 import { bindOtelSpan, getBoundOtelSpan } from "../observability/otel.js";
+import { arrayBufferDataProperties, arrayBufferLength, copyArrayBufferStorage, isSandboxArrayBuffer } from "./array-buffer.js";
 import { internalSymbols } from "./internal-symbols.js";
 import { getIntrinsicIdentity } from "./intrinsics.js";
 import { getGeneratorProperties } from "./generator-properties.js";
@@ -399,12 +400,11 @@ export function measureSandboxData(values, options = {}) {
         const prototype = getSandboxPrototype(value);
         if (prototype !== null)
             visit(prototype, depth + 1);
+        if (isSandboxArrayBuffer(value))
+            usage += arrayBufferLength(value);
         if (isFloat32Array(value)) {
             const storage = float32Storage(value);
-            if (!seen.has(storage.buffer)) {
-                seen.add(storage.buffer);
-                usage += storage.byteLength;
-            }
+            visit(storage.buffer, depth + 1);
             for (const [key, descriptor] of float32Properties(value)) {
                 usage += 1;
                 if (typeof key === "string")
@@ -587,7 +587,7 @@ export function measureSandboxData(values, options = {}) {
             if (descriptor !== undefined)
                 descriptors.push([key, descriptor]);
         }
-        const includeNonEnumerable = isSandboxDate(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
+        const includeNonEnumerable = isSandboxDate(value) || isSandboxArrayBuffer(value) || sandboxErrorTypes.has(value) || hasManagedDescriptors(value);
         for (const [key, descriptor] of descriptors) {
             if (!descriptor.enumerable && !includeNonEnumerable)
                 continue;
@@ -804,6 +804,20 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
         }
         return sandboxPromise;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyToSandbox(descriptor.value, state, joinPath(path, key), cloneSandboxCollections, depth + 1) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (nodeTypes.isDate(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -827,6 +841,7 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
             return existing;
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyToSandbox(float32Storage(value).buffer, state, `${path}.buffer`, cloneSandboxCollections, depth + 1);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,
@@ -1021,6 +1036,7 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             return existing;
         const copy = copyFloat32Storage(value, state);
         state.seen.set(value, copy);
+        copyFromSandbox(float32Storage(value).buffer, state, `${path}.buffer`, options, depth + 1);
         for (const [key, descriptor] of float32DataProperties(value)) {
             Object.defineProperty(copy, key, {
                 ...descriptor,
@@ -1031,6 +1047,20 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
             Object.preventExtensions(copy);
         return copy;
     }
+    if (isSandboxArrayBuffer(value)) {
+        const existing = state.seen.get(value);
+        if (existing !== undefined)
+            return existing;
+        const copy = copyArrayBufferStorage(value, state);
+        state.seen.set(value, copy);
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            Object.defineProperty(copy, key, { ...descriptor,
+                value: copyFromSandbox(descriptor.value, state, joinPath(path, key), options, depth + 1) });
+        }
+        if (!Object.isExtensible(value))
+            Object.preventExtensions(copy);
+        return copy;
+    }
     if (isSandboxDate(value)) {
         const existing = state.seen.get(value);
         if (existing !== undefined)
@@ -1188,6 +1218,18 @@ function allocateSandboxValue(value, budget, seen) {
         budget.allocateString(value);
         return;
     }
+    if (isSandboxArrayBuffer(value)) {
+        if (seen.has(value))
+            return;
+        seen.add(value);
+        budget.allocateArrayLength(arrayBufferLength(value));
+        for (const [key, descriptor] of arrayBufferDataProperties(value)) {
+            if (typeof key === "string")
+                budget.allocateString(key);
+            allocateSandboxValue(descriptor.value, budget, seen);
+        }
+        return;
+    }
     if (isSandboxBox(value)) {
         if (seen.has(value))
             return;

package/packages/safe-js/dist/lint/rules/known-globals.d.ts

@@ -1 +1 @@
-export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "Boolean", "BigInt", "Date", "decodeURI", "decodeURIComponent", "encodeURI", "encodeURIComponent", "Error", "EvalError", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "URIError", "console"];
+export declare const KNOWN_RUNTIME_GLOBALS: readonly ["AggregateError", "Array", "ArrayBuffer", "Boolean", "BigInt", "Date", "decodeURI", "decodeURIComponent", "encodeURI", "encodeURIComponent", "Error", "EvalError", "Infinity", "isFinite", "isNaN", "JSON", "Map", "Float32Array", "Math", "NaN", "Number", "Object", "parseFloat", "parseInt", "Promise", "RangeError", "ReferenceError", "RegExp", "Set", "String", "Symbol", "structuredClone", "SyntaxError", "TypeError", "URIError", "console"];

package/packages/safe-js/dist/lint/rules/known-globals.js

@@ -1,6 +1,7 @@
 export const KNOWN_RUNTIME_GLOBALS = [
     "AggregateError",
     "Array",
+    "ArrayBuffer",
     "Boolean",
     "BigInt",
     "Date",

package/packages/safe-js/dist/snapshot/array-buffer.d.ts

@@ -0,0 +1,13 @@
+import type { GuestObjectState } from "./guest-heap.js";
+export type ArrayBufferData<TReference> = {
+    kind: "arraybuffer";
+} & ({
+    bytes: number[];
+    maxByteLength?: number;
+} | {
+    buffer: TReference;
+});
+export declare function captureArrayBufferState<T>(value: ArrayBuffer, encode: (value: unknown) => T): GuestObjectState<T>;
+export declare function encodeArrayBufferStorage<T>(value: ArrayBuffer, id: number, buffers: WeakMap<ArrayBuffer, number>, reference: (id: number) => T): ArrayBufferData<T>;
+export declare function validateArrayBufferStorage(value: Record<string, unknown>): void;
+export declare function decodeArrayBufferStorage(value: Record<string, unknown>, resolve: (reference: unknown) => unknown): ArrayBuffer;

package/packages/safe-js/dist/snapshot/array-buffer.js

@@ -0,0 +1,40 @@
+import { arrayBufferLength, arrayBufferOptions, isSandboxArrayBuffer } from "../interp/array-buffer.js";
+import { float32Storage, isFloat32Array } from "../interp/float32.js";
+import { getSandboxPrototype, hasExplicitSandboxPrototype } from "../interp/object-model.js";
+import { serializePropertyDescriptors } from "./property-descriptors.js";
+export function captureArrayBufferState(value, encode) {
+    return { properties: serializePropertyDescriptors(value, encode),
+        ...(hasExplicitSandboxPrototype(value) ? { prototype: encode(getSandboxPrototype(value)) } : {}) };
+}
+export function encodeArrayBufferStorage(value, id, buffers, reference) {
+    arrayBufferLength(value);
+    const existing = buffers.get(value);
+    if (existing === undefined)
+        buffers.set(value, id);
+    return { kind: "arraybuffer", ...(existing === undefined ? { bytes: Array.from(new Uint8Array(value)), ...arrayBufferOptions(value) } : { buffer: reference(existing) }) };
+}
+export function validateArrayBufferStorage(value) {
+    if (Object.hasOwn(value, "bytes") === Object.hasOwn(value, "buffer"))
+        throw new TypeError("ArrayBuffer requires one backing storage description.");
+    if (Object.hasOwn(value, "bytes") && (!Array.isArray(value.bytes) ||
+        value.bytes.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)))
+        throw new TypeError("Invalid ArrayBuffer bytes.");
+    if (Object.hasOwn(value, "maxByteLength") && (!Array.isArray(value.bytes) ||
+        !Number.isSafeInteger(value.maxByteLength) || Number(value.maxByteLength) < value.bytes.length))
+        throw new TypeError("Invalid ArrayBuffer maximum length.");
+}
+export function decodeArrayBufferStorage(value, resolve) {
+    validateArrayBufferStorage(value);
+    if (Array.isArray(value.bytes)) {
+        const buffer = Reflect.construct(ArrayBuffer, [value.bytes.length,
+            Object.hasOwn(value, "maxByteLength") ? { maxByteLength: value.maxByteLength } : undefined]);
+        new Uint8Array(buffer).set(value.bytes);
+        return buffer;
+    }
+    const referenced = resolve(value.buffer);
+    if (isSandboxArrayBuffer(referenced))
+        return referenced;
+    if (isFloat32Array(referenced))
+        return float32Storage(referenced).buffer;
+    throw new TypeError("Invalid ArrayBuffer backing reference.");
+}

package/packages/safe-js/dist/snapshot/dump-format.js

@@ -12,8 +12,10 @@ import { sandboxErrorTypes } from "../error/shape.js";
 import { getSandboxArgumentEntries, isSandboxArguments } from "../interp/arguments.js";
 import { serializeArguments } from "./arguments.js";
 import { requiresArrayEntries, serializeArray } from "./arrays.js";
-import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
-import { encodeFloat32Storage } from "./float32array.js";
+import { float32DataProperties, float32Storage, isFloat32Array } from "../interp/float32.js";
+import { encodeFloat32Layout } from "./float32array.js";
+import { isSandboxArrayBuffer } from "../interp/array-buffer.js";
+import { captureArrayBufferState, encodeArrayBufferStorage } from "./array-buffer.js";
 import { dateDataProperties, isSandboxDate } from "../interp/date.js";
 import { serializeDate } from "./date-properties.js";
 import { boxedDataProperties, isSandboxBox } from "../interp/boxed.js";
@@ -109,7 +111,7 @@ function serializeDumpValue(value, path, state) {
     if (hasGuestObjectState(value) && !(state.trustedRunReplay && (isSandboxDate(value) || isSandboxPromise(value) || isPromiseResolvingFunction(value)))) {
         throw new TypeError("Guest function properties and prototype links cannot be serialized.");
     }
-    if (isSandboxRegExpIterator(value) || (isSandboxRegex(value) && hasCustomRegexProperties(value)) || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
+    if (isSandboxArrayBuffer(value) || isSandboxRegExpIterator(value) || (isSandboxRegex(value) && hasCustomRegexProperties(value)) || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value))
         return serializeHeapReference(value, path, state);
     if (Array.isArray(value)) {
         const reference = serializeHeapReference(value, path, state);
@@ -186,11 +188,17 @@ function serializeHeapReference(value, path, state) {
                 return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
             });
         }
+        else if (isSandboxArrayBuffer(value)) {
+            state.heap[String(id)] = { ...encodeArrayBufferStorage(value, id, state.float32Buffers, id => ({ kind: "ref", id })),
+                state: captureArrayBufferState(value, entry => {
+                    const serialized = serializeDumpValue(entry, `${path}.<buffer>`, state);
+                    return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+                }) };
+        }
         else if (isFloat32Array(value)) {
-            const storage = encodeFloat32Storage(value, id, state.float32Buffers, (id) => ({
-                kind: "ref",
-                id
-            }));
+            const backing = float32Storage(value);
+            const storage = { kind: "float32array", ...encodeFloat32Layout(value),
+                buffer: serializeHeapReference(backing.buffer, `${path}.buffer`, state) };
             const entries = Object.create(null);
             state.heap[String(id)] = { ...storage, entries };
             for (const [key, descriptor] of float32DataProperties(value)) {
@@ -271,6 +279,7 @@ function indexHeapContainers(snapshot) {
             (isSandboxRegex(value) && hasCustomRegexProperties(value)) ||
             isSandboxDate(value) ||
             isFloat32Array(value) ||
+            isSandboxArrayBuffer(value) ||
             (Array.isArray(value) && requiresArrayEntries(value)) ||
             isSandboxArguments(value) ||
             sandboxErrorTypes.has(value)) {
@@ -305,9 +314,14 @@ function collectContainerStats(value, stats, ancestors, guestValues, depth = 0)
     stat.expanded = true;
     ancestors.add(value);
     const guestEntries = [];
-    const guest = captureGuestHeapNode(value, entry => { guestEntries.push(entry); return null; });
+    if (isFloat32Array(value))
+        guestEntries.push(float32Storage(value).buffer);
+    const guest = isSandboxArrayBuffer(value)
+        ? { kind: "arraybuffer", state: captureArrayBufferState(value, entry => { guestEntries.push(entry); return null; }) }
+        : captureGuestHeapNode(value, entry => { guestEntries.push(entry); return null; });
     if (guest !== undefined) {
-        guestValues.add(value);
+        if (!isSandboxArrayBuffer(value))
+            guestValues.add(value);
         for (const entry of guestEntries) {
             collectContainerStats(entry, stats, ancestors, guestValues, depth + 1);
             if (entry !== null && typeof entry === "object")
@@ -316,6 +330,8 @@ function collectContainerStats(value, stats, ancestors, guestValues, depth = 0)
         ancestors.delete(value);
         return;
     }
+    for (const entry of guestEntries)
+        collectContainerStats(entry, stats, ancestors, guestValues, depth + 1);
     if (!Array.isArray(value) && !isPlainObject(value) && !isFloat32Array(value) && !isSandboxDate(value)) {
         ancestors.delete(value);
         return;

package/packages/safe-js/dist/snapshot/float32array.d.ts

@@ -1,15 +1,22 @@
 import type { GuestObjectState } from "./guest-heap.js";
+import type { Budget } from "../interp/budget.js";
 export declare function captureFloat32State<T>(value: Float32Array, encode: (value: unknown) => T): GuestObjectState<T>;
 export declare function restoreFloat32Properties<T>(value: Float32Array, state: GuestObjectState<T>, decode: (value: T) => unknown): void;
 export type Float32Data<TReference> = {
     kind: "float32array";
     byteOffset: number;
     length: number;
+    lengthTracking?: true;
 } & ({
     bytes: number[];
 } | {
     buffer: TReference;
 });
+export declare function encodeFloat32Layout(value: Float32Array): {
+    byteOffset: number;
+    length: number;
+    lengthTracking?: true;
+};
 export declare function encodeFloat32Storage<TReference>(value: Float32Array, id: number, buffers: WeakMap<ArrayBuffer, number>, reference: (id: number) => TReference): Float32Data<TReference>;
 export declare function validateFloat32Storage(value: Record<string, unknown>): void;
-export declare function decodeFloat32Storage(value: Record<string, unknown>, resolve: (reference: unknown) => unknown): Float32Array;
+export declare function decodeFloat32Storage(value: Record<string, unknown>, resolve: (reference: unknown) => unknown, budget?: Budget): Float32Array;

package/packages/safe-js/dist/snapshot/float32array.js

@@ -1,6 +1,7 @@
-import { float32Properties, float32Storage, isFloat32Array, isFloat32Index } from "../interp/float32.js";
+import { float32Properties, float32Storage, float32ViewLayouts, restoreFloat32View, isFloat32Array, isFloat32Index } from "../interp/float32.js";
 import { getSandboxPrototype, hasExplicitSandboxPrototype } from "../interp/object-model.js";
 import { restorePropertyDescriptors, serializePropertyDescriptors } from "./property-descriptors.js";
+import { arrayBufferOptions, isSandboxArrayBuffer } from "../interp/array-buffer.js";
 export function captureFloat32State(value, encode) {
     const metadata = Object.defineProperties(Object.create(null), Object.fromEntries(float32Properties(value)));
     if (!Object.isExtensible(value))
@@ -18,6 +19,16 @@ export function restoreFloat32Properties(value, state, decode) {
     if (!Object.isExtensible(metadata))
         Object.preventExtensions(value);
 }
+export function encodeFloat32Layout(value) {
+    const storage = float32Storage(value);
+    if (arrayBufferOptions(storage.buffer) === undefined)
+        return { byteOffset: storage.byteOffset, length: storage.length };
+    const layout = float32ViewLayouts.get(value);
+    if (layout === undefined)
+        throw new TypeError("Resizable Float32Array snapshots require known view layout.");
+    return { byteOffset: layout.byteOffset, length: layout.length ?? 0,
+        ...(layout.length === undefined ? { lengthTracking: true } : {}) };
+}
 export function encodeFloat32Storage(value, id, buffers, reference) {
     const storage = float32Storage(value);
     const existing = buffers.get(storage.buffer);
@@ -33,6 +44,8 @@ export function encodeFloat32Storage(value, id, buffers, reference) {
     };
 }
 export function validateFloat32Storage(value) {
+    if (Object.hasOwn(value, "lengthTracking") && (value.lengthTracking !== true || value.length !== 0 || Object.hasOwn(value, "bytes")))
+        throw new TypeError("Invalid Float32Array length-tracking layout.");
     if (!Number.isSafeInteger(value.length) ||
         Number(value.length) < 0 ||
         !Number.isSafeInteger(value.byteOffset) ||
@@ -48,7 +61,7 @@ export function validateFloat32Storage(value) {
             throw new TypeError("Invalid Float32Array backing bytes.");
     }
 }
-export function decodeFloat32Storage(value, resolve) {
+export function decodeFloat32Storage(value, resolve, budget) {
     validateFloat32Storage(value);
     let buffer;
     if (Array.isArray(value.bytes)) {
@@ -57,9 +70,14 @@ export function decodeFloat32Storage(value, resolve) {
     }
     else {
         const referenced = resolve(value.buffer);
-        if (!isFloat32Array(referenced))
+        if (isSandboxArrayBuffer(referenced))
+            buffer = referenced;
+        else if (isFloat32Array(referenced))
+            buffer = float32Storage(referenced).buffer;
+        else
             throw new TypeError("Invalid Float32Array backing reference.");
-        buffer = float32Storage(referenced).buffer;
     }
-    return new Float32Array(buffer, Number(value.byteOffset), Number(value.length));
+    if (value.lengthTracking === true && arrayBufferOptions(buffer) === undefined)
+        throw new TypeError("Length-tracking layout requires resizable backing storage.");
+    return restoreFloat32View(buffer, Number(value.byteOffset), value.lengthTracking === true ? undefined : Number(value.length), budget);
 }

package/packages/safe-js/dist/snapshot/replay-data.d.ts

@@ -4,6 +4,7 @@ import { type SerializedSymbol, type SerializedSymbolProperty } from "./symbols.
 import { type CollectionIterationMethod } from "../interp/collection-iterator.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { type Float32Data } from "./float32array.js";
+import { type ArrayBufferData } from "./array-buffer.js";
 import { type SandboxErrorName } from "../error/shape.js";
 import { type SandboxClosure, type SandboxPromise, type SandboxValue } from "../interp/values.js";
 import { type SerializedArguments } from "./arguments.js";
@@ -69,6 +70,10 @@ type DataNode = {
 } | (Float32Data<Atom> & {
     properties: Properties;
     extensible: boolean;
+}) | (ArrayBufferData<Atom> & {
+    properties: Properties;
+    extensible: boolean;
+    symbolEntries?: Array<SerializedSymbolProperty<Atom>>;
 }) | {
     kind: "capability";
     id: string;

package/packages/safe-js/dist/snapshot/replay-data.js

@@ -10,8 +10,10 @@ import { isSandboxCollectionIterator, restoreSandboxCollectionIterator, snapshot
 import { isSandboxRegExpIterator, regexpIteratorState, restoreSandboxRegExpIterator } from "../interp/regexp-iterator.js";
 import { hasGuestObjectState, hasNullObjectPrototype, setSandboxPrototype } from "../interp/object-model.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
-import { float32DataProperties, isFloat32Array } from "../interp/float32.js";
-import { decodeFloat32Storage, encodeFloat32Storage } from "./float32array.js";
+import { float32DataProperties, float32Storage, isFloat32Array } from "../interp/float32.js";
+import { decodeFloat32Storage, encodeFloat32Layout } from "./float32array.js";
+import { arrayBufferDataProperties, isSandboxArrayBuffer } from "../interp/array-buffer.js";
+import { decodeArrayBufferStorage, encodeArrayBufferStorage } from "./array-buffer.js";
 import { dateDataProperties, isSandboxDate, restoreDateTime, serializedDateTime } from "../interp/date.js";
 import { createRawJson, isRawJson } from "../interp/raw-json.js";
 import { boxedDataProperties, createSandboxBox, nativeBoxedValue } from "../interp/boxed.js";
@@ -119,11 +121,22 @@ export function encodeReplayData(value, options = {}) {
                 ...(Object.isExtensible(entry) ? {} : { extensible: false })
             };
         }
+        else if (isSandboxArrayBuffer(entry)) {
+            const storage = encodeArrayBufferStorage(entry, id, float32Buffers, id => ({ tag: "ref", id }));
+            const properties = Object.create(null);
+            for (const [key, descriptor] of arrayBufferDataProperties(entry)) {
+                if (typeof key === "symbol")
+                    continue;
+                properties[key] = { value: child(descriptor.value, key), configurable: descriptor.configurable === true,
+                    enumerable: descriptor.enumerable === true, writable: descriptor.writable === true };
+            }
+            let symbolIndex = 0;
+            const symbolEntries = serializeSymbolProperties(entry, value => encode(value, depth + 1, [...path, { symbol: Math.floor(symbolIndex++ / 2) }]));
+            nodes[id] = { ...storage, properties, extensible: Object.isExtensible(entry), symbolEntries };
+        }
         else if (isFloat32Array(entry)) {
-            const storage = encodeFloat32Storage(entry, id, float32Buffers, (id) => ({
-                tag: "ref",
-                id
-            }));
+            const backing = float32Storage(entry);
+            const storage = { kind: "float32array", ...encodeFloat32Layout(entry), buffer: child(backing.buffer, "<buffer>") };
             const properties = Object.create(null);
             for (const [key, descriptor] of float32DataProperties(entry)) {
                 properties[key] = {
@@ -227,7 +240,7 @@ export function decodeReplayData(input, options = {}, parent) {
         const graph = record(input);
         const nodes = list(own(graph, "nodes"));
         const restored = new Map();
-        const initializeIterators = [];
+        const initializeValues = [];
         const decode = (entry, depth = 0) => {
             if (depth > MAX_DATA_DEPTH)
                 throw new TypeError("Replay data exceeds the nesting limit.");
@@ -378,10 +391,22 @@ export function decodeReplayData(input, options = {}, parent) {
                     Object.preventExtensions(result);
                 return result;
             }
+            if (kind === "arraybuffer") {
+                if (typeof node.extensible !== "boolean")
+                    throw new TypeError("Invalid ArrayBuffer extensibility.");
+                const result = decodeArrayBufferStorage(node, child);
+                restored.set(id, result);
+                initializeValues.push(() => {
+                    defineProperties(result, record(own(node, "properties")), child, node.symbolEntries);
+                    if (!node.extensible)
+                        Object.preventExtensions(result);
+                });
+                return result;
+            }
             if (kind === "float32array") {
                 if (typeof node.extensible !== "boolean")
                     throw new TypeError("Invalid Float32Array extensibility.");
-                const result = decodeFloat32Storage(node, child);
+                const result = decodeFloat32Storage(node, child, compilation.owner?.budget);
                 restored.set(id, result);
                 defineProperties(result, record(own(node, "properties")), child);
                 if (!node.extensible)
@@ -421,7 +446,7 @@ export function decodeReplayData(input, options = {}, parent) {
                 const collection = child(own(node, "collection"));
                 if (collection !== undefined && !isSandboxMap(collection) && !isSandboxSet(collection))
                     throw new TypeError("Invalid replay collection iterator source.");
-                initializeIterators.push(() => { restoreSandboxCollectionIterator({ collection, collectionKind, method, index, exhausted }, result); });
+                initializeValues.push(() => { restoreSandboxCollectionIterator({ collection, collectionKind, method, index, exhausted }, result); });
                 defineProperties(result, record(own(node, "properties")), child);
                 if (!node.extensible)
                     Object.preventExtensions(result);
@@ -503,7 +528,7 @@ export function decodeReplayData(input, options = {}, parent) {
             return result;
         };
         const result = decode(own(graph, "root"));
-        for (const initialize of initializeIterators)
+        for (const initialize of initializeValues)
             initialize();
         if (parent !== undefined)
             compilation.forward(compilation.tickets, parent);

package/packages/safe-js/dist/snapshot/restore.js

@@ -18,6 +18,7 @@ import { runAsyncPrefix } from "../interp/jobs.js";
 import { toPropertyKey } from "../interp/property-key.js";
 import { CompileScope } from "../interp/regex/compile-guard.js";
 import { decodeFloat32Storage, restoreFloat32Properties } from "./float32array.js";
+import { decodeArrayBufferStorage } from "./array-buffer.js";
 import { restoreDateTime } from "../interp/date.js";
 import { createRawJson } from "../interp/raw-json.js";
 import { createSandboxBox } from "../interp/boxed.js";
@@ -456,10 +457,21 @@ function restoreHeapValue(id, state) {
         restoreRegexProperties(value, serialized, entry => deserializeValue(entry, state));
         return value;
     }
+    if (serialized.kind === "arraybuffer") {
+        initializeIntrinsicRealm(state);
+        const value = decodeArrayBufferStorage(serialized, reference => deserializeValue(reference, state));
+        state.heapValueById.set(id, value);
+        state.initializeIterators.push(() => {
+            if (serialized.state.prototype !== undefined)
+                setSandboxPrototype(value, deserializeValue(serialized.state.prototype, state), state.budget);
+            restorePropertyDescriptors(value, serialized.state.properties, entry => deserializeValue(entry, state));
+        });
+        return value;
+    }
     if (serialized.kind === "float32array") {
         if (serialized.state !== undefined)
             initializeIntrinsicRealm(state);
-        const value = decodeFloat32Storage(serialized, (reference) => deserializeValue(reference, state));
+        const value = decodeFloat32Storage(serialized, (reference) => deserializeValue(reference, state), state.budget);
         state.heapValueById.set(id, value);
         if (serialized.state !== undefined) {
             const objectState = serialized.state;

package/packages/safe-js/dist/snapshot/serialize.d.ts

@@ -8,6 +8,7 @@ import { type GuestHeapNode, type GuestObjectState } from "./guest-heap.js";
 import { type SerializedArguments } from "./arguments.js";
 import { type SerializedArray } from "./arrays.js";
 import { type Float32Data } from "./float32array.js";
+import { type ArrayBufferData } from "./array-buffer.js";
 import { type SerializedDate } from "./date-properties.js";
 import { type SandboxBox } from "../interp/boxed.js";
 import { type BoxedData } from "./boxed.js";
@@ -51,7 +52,9 @@ export type SerializedReferenceValue = {
     kind: "ref";
     id: number;
 };
-export type SerializedHeapValue = GuestHeapNode<SerializedSnapshotValue> | {
+export type SerializedHeapValue = (ArrayBufferData<SerializedReferenceValue> & {
+    state: GuestObjectState<SerializedSnapshotValue>;
+}) | GuestHeapNode<SerializedSnapshotValue> | {
     kind: "regexp-iterator";
     matcher: SerializedSnapshotValue;
     input: SerializedSnapshotValue;
@@ -112,7 +115,7 @@ export type RuntimePromiseValue = {
     id: SnapshotId;
     promise?: Promise<unknown>;
 };
-export type RuntimeSnapshotValue = bigint | symbol | SandboxBox | Date | Float32Array | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
+export type RuntimeSnapshotValue = bigint | symbol | SandboxBox | Date | Float32Array | ArrayBuffer | boolean | null | number | string | undefined | RuntimeClosureValue | SandboxClosure | SandboxGenerator | SandboxCollectionIterator | SandboxRegExpIterator | RuntimePromiseValue | SandboxMap | SandboxRegex | SandboxSet | RuntimeSnapshotValue[] | {
     [key: string]: RuntimeSnapshotValue;
 };
 export type RuntimeScopeFrame = {