seroval 1.6.6 → 1.6.8

package/dist/dev/index.js

@@ -196,6 +196,7 @@ function deserializeReplacer(str) {
 	}
 }
 function deserializeString(str) {
+	if (typeof str === "string" && !str.includes("\\")) return str;
 	return str.replace(/(\\\\|\\"|\\n|\\r|\\b|\\t|\\f|\\u2028|\\u2029|\\x3C)/g, deserializeReplacer);
 }
 //#endregion
@@ -698,16 +699,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -723,7 +734,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -755,12 +768,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1233,6 +1365,7 @@ function isValidSymbol(symbol) {
 //#endregion
 //#region src/core/context/deserializer.ts
 const DEFAULT_MAX_BASE64_LENGTH = 1e6;
+const MIN_NATIVE_BASE64_LENGTH = 512;
 const MAX_BIGINT_LENGTH = 1e4;
 const MAX_REGEXP_SOURCE_LENGTH = 2e4;
 function applyObjectFlag(obj, flag) {
@@ -1291,7 +1424,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1313,8 +1446,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1356,6 +1493,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1410,18 +1549,29 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
 function deserializeArrayBuffer(ctx, node) {
 	if (typeof node.s !== "string") throw new SerovalMalformedNodeError(node);
 	if (node.s.length > ctx.base.maxBase64Length) throw new RangeError("ArrayBuffer exceeds maxBase64Length (" + ctx.base.maxBase64Length + ")");
-	return assignIndexedValue$1(ctx, node.i, ARRAY_BUFFER_CONSTRUCTOR(deserializeString(node.s)));
+	const source = deserializeString(node.s);
+	let buffer;
+	if (source.length < MIN_NATIVE_BASE64_LENGTH || typeof Buffer === "undefined") buffer = ARRAY_BUFFER_CONSTRUCTOR(source);
+	else {
+		const decoded = atob(source);
+		buffer = new ArrayBuffer(decoded.length);
+		Buffer.from(buffer).write(decoded, "latin1");
+	}
+	return assignIndexedValue$1(ctx, node.i, buffer);
 }
 function deserializeTypedArray(ctx, depth, node) {
 	var _node$b;
@@ -1429,7 +1579,7 @@ function deserializeTypedArray(ctx, depth, node) {
 	const source = deserialize$1(ctx, depth, node.f);
 	if (!(source instanceof ArrayBuffer)) throw new SerovalMalformedNodeError(node);
 	const offset = (_node$b = node.b) !== null && _node$b !== void 0 ? _node$b : 0;
-	if (offset < 0 || offset > source.byteLength || node.l > ctx.base.maxBase64Length) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new construct(source, offset, node.l));
 }
 function deserializeDataView(ctx, depth, node) {
@@ -1437,7 +1587,7 @@ function deserializeDataView(ctx, depth, node) {
 	const source = deserialize$1(ctx, depth, node.f);
 	if (!(source instanceof ArrayBuffer)) throw new SerovalMalformedNodeError(node);
 	const offset = (_node$b2 = node.b) !== null && _node$b2 !== void 0 ? _node$b2 : 0;
-	if (offset < 0 || offset > source.byteLength || node.l > ctx.base.maxBase64Length) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new DataView(source, offset, node.l));
 }
 function deserializeDictionary(ctx, depth, node, result) {
@@ -1497,21 +1647,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1549,10 +1698,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/dist/index.cjs

@@ -197,6 +197,7 @@ function deserializeReplacer(str) {
 	}
 }
 function deserializeString(str) {
+	if (typeof str === "string" && !str.includes("\\")) return str;
 	return str.replace(/(\\\\|\\"|\\n|\\r|\\b|\\t|\\f|\\u2028|\\u2029|\\x3C)/g, deserializeReplacer);
 }
 //#endregion
@@ -692,16 +693,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -717,7 +728,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -749,12 +762,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1227,6 +1359,7 @@ function isValidSymbol(symbol) {
 //#endregion
 //#region src/core/context/deserializer.ts
 const DEFAULT_MAX_BASE64_LENGTH = 1e6;
+const MIN_NATIVE_BASE64_LENGTH = 512;
 const MAX_BIGINT_LENGTH = 1e4;
 const MAX_REGEXP_SOURCE_LENGTH = 2e4;
 function applyObjectFlag(obj, flag) {
@@ -1285,7 +1418,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1307,8 +1440,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1350,6 +1487,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1404,18 +1543,29 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
 function deserializeArrayBuffer(ctx, node) {
 	if (typeof node.s !== "string") throw new SerovalMalformedNodeError(node);
 	if (node.s.length > ctx.base.maxBase64Length) throw new RangeError("ArrayBuffer exceeds maxBase64Length (" + ctx.base.maxBase64Length + ")");
-	return assignIndexedValue$1(ctx, node.i, ARRAY_BUFFER_CONSTRUCTOR(deserializeString(node.s)));
+	const source = deserializeString(node.s);
+	let buffer;
+	if (source.length < MIN_NATIVE_BASE64_LENGTH || typeof Buffer === "undefined") buffer = ARRAY_BUFFER_CONSTRUCTOR(source);
+	else {
+		const decoded = atob(source);
+		buffer = new ArrayBuffer(decoded.length);
+		Buffer.from(buffer).write(decoded, "latin1");
+	}
+	return assignIndexedValue$1(ctx, node.i, buffer);
 }
 function deserializeTypedArray(ctx, depth, node) {
 	var _node$b;
@@ -1423,7 +1573,7 @@ function deserializeTypedArray(ctx, depth, node) {
 	const source = deserialize$1(ctx, depth, node.f);
 	if (!(source instanceof ArrayBuffer)) throw new SerovalMalformedNodeError(node);
 	const offset = (_node$b = node.b) !== null && _node$b !== void 0 ? _node$b : 0;
-	if (offset < 0 || offset > source.byteLength || node.l > ctx.base.maxBase64Length) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new construct(source, offset, node.l));
 }
 function deserializeDataView(ctx, depth, node) {
@@ -1431,7 +1581,7 @@ function deserializeDataView(ctx, depth, node) {
 	const source = deserialize$1(ctx, depth, node.f);
 	if (!(source instanceof ArrayBuffer)) throw new SerovalMalformedNodeError(node);
 	const offset = (_node$b2 = node.b) !== null && _node$b2 !== void 0 ? _node$b2 : 0;
-	if (offset < 0 || offset > source.byteLength || node.l > ctx.base.maxBase64Length) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new DataView(source, offset, node.l));
 }
 function deserializeDictionary(ctx, depth, node, result) {
@@ -1491,21 +1641,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1543,10 +1692,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/dist/index.d.cts

@@ -737,14 +737,25 @@ interface StreamListener<T> {
   throw(value: unknown): void;
   return(value: T): void;
 }
-interface Stream<T> {
-  __SEROVAL_STREAM__: true;
+/**
+ * An internal class rather than a tagged POJO: identity is checked with
+ * `instanceof`, which untrusted input cannot forge (the class is not exported).
+ *
+ * The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+ * constructor's source is embedded verbatim into the eval-based `deserialize`
+ * output, which has no access to this class, so the two cannot be shared. A
+ * stream read back through `deserialize` is therefore a plain POJO and, by
+ * design, is not treated as a genuine Stream on re-serialization. Keep the two
+ * implementations in sync.
+ */
+declare class Stream<T> {
+  #private;
   on(listener: StreamListener<T>): () => void;
   next(value: T): void;
   throw(value: unknown): void;
   return(value: T): void;
 }
-declare function isStream<T>(value: object): value is Stream<T>;
+declare function isStream<T>(value: unknown): value is Stream<T>;
 declare function createStream<T>(): Stream<T>;
 //#endregion
 //#region src/core/tree/index.d.ts