seroval 1.6.7 → 1.6.8

package/dist/dev/index.cjs

@@ -700,16 +700,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -725,7 +735,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -757,12 +769,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1294,7 +1425,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1316,8 +1447,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1359,6 +1494,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1413,11 +1550,14 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
@@ -1508,21 +1648,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1560,10 +1699,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/dist/dev/index.d.cts

@@ -737,14 +737,25 @@ interface StreamListener<T> {
   throw(value: unknown): void;
   return(value: T): void;
 }
-interface Stream<T> {
-  __SEROVAL_STREAM__: true;
+/**
+ * An internal class rather than a tagged POJO: identity is checked with
+ * `instanceof`, which untrusted input cannot forge (the class is not exported).
+ *
+ * The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+ * constructor's source is embedded verbatim into the eval-based `deserialize`
+ * output, which has no access to this class, so the two cannot be shared. A
+ * stream read back through `deserialize` is therefore a plain POJO and, by
+ * design, is not treated as a genuine Stream on re-serialization. Keep the two
+ * implementations in sync.
+ */
+declare class Stream<T> {
+  #private;
   on(listener: StreamListener<T>): () => void;
   next(value: T): void;
   throw(value: unknown): void;
   return(value: T): void;
 }
-declare function isStream<T>(value: object): value is Stream<T>;
+declare function isStream<T>(value: unknown): value is Stream<T>;
 declare function createStream<T>(): Stream<T>;
 //#endregion
 //#region src/core/tree/index.d.ts

package/dist/dev/index.d.ts

@@ -737,14 +737,25 @@ interface StreamListener<T> {
   throw(value: unknown): void;
   return(value: T): void;
 }
-interface Stream<T> {
-  __SEROVAL_STREAM__: true;
+/**
+ * An internal class rather than a tagged POJO: identity is checked with
+ * `instanceof`, which untrusted input cannot forge (the class is not exported).
+ *
+ * The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+ * constructor's source is embedded verbatim into the eval-based `deserialize`
+ * output, which has no access to this class, so the two cannot be shared. A
+ * stream read back through `deserialize` is therefore a plain POJO and, by
+ * design, is not treated as a genuine Stream on re-serialization. Keep the two
+ * implementations in sync.
+ */
+declare class Stream<T> {
+  #private;
   on(listener: StreamListener<T>): () => void;
   next(value: T): void;
   throw(value: unknown): void;
   return(value: T): void;
 }
-declare function isStream<T>(value: object): value is Stream<T>;
+declare function isStream<T>(value: unknown): value is Stream<T>;
 declare function createStream<T>(): Stream<T>;
 //#endregion
 //#region src/core/tree/index.d.ts

package/dist/dev/index.js

@@ -699,16 +699,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -724,7 +734,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -756,12 +768,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1293,7 +1424,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1315,8 +1446,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1358,6 +1493,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1412,11 +1549,14 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
@@ -1507,21 +1647,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1559,10 +1698,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/dist/index.cjs

@@ -693,16 +693,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -718,7 +728,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -750,12 +762,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1287,7 +1418,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1309,8 +1440,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1352,6 +1487,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1406,11 +1543,14 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
@@ -1501,21 +1641,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1553,10 +1692,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/dist/index.d.cts

@@ -737,14 +737,25 @@ interface StreamListener<T> {
   throw(value: unknown): void;
   return(value: T): void;
 }
-interface Stream<T> {
-  __SEROVAL_STREAM__: true;
+/**
+ * An internal class rather than a tagged POJO: identity is checked with
+ * `instanceof`, which untrusted input cannot forge (the class is not exported).
+ *
+ * The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+ * constructor's source is embedded verbatim into the eval-based `deserialize`
+ * output, which has no access to this class, so the two cannot be shared. A
+ * stream read back through `deserialize` is therefore a plain POJO and, by
+ * design, is not treated as a genuine Stream on re-serialization. Keep the two
+ * implementations in sync.
+ */
+declare class Stream<T> {
+  #private;
   on(listener: StreamListener<T>): () => void;
   next(value: T): void;
   throw(value: unknown): void;
   return(value: T): void;
 }
-declare function isStream<T>(value: object): value is Stream<T>;
+declare function isStream<T>(value: unknown): value is Stream<T>;
 declare function createStream<T>(): Stream<T>;
 //#endregion
 //#region src/core/tree/index.d.ts

package/dist/index.d.ts

@@ -737,14 +737,25 @@ interface StreamListener<T> {
   throw(value: unknown): void;
   return(value: T): void;
 }
-interface Stream<T> {
-  __SEROVAL_STREAM__: true;
+/**
+ * An internal class rather than a tagged POJO: identity is checked with
+ * `instanceof`, which untrusted input cannot forge (the class is not exported).
+ *
+ * The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+ * constructor's source is embedded verbatim into the eval-based `deserialize`
+ * output, which has no access to this class, so the two cannot be shared. A
+ * stream read back through `deserialize` is therefore a plain POJO and, by
+ * design, is not treated as a genuine Stream on re-serialization. Keep the two
+ * implementations in sync.
+ */
+declare class Stream<T> {
+  #private;
   on(listener: StreamListener<T>): () => void;
   next(value: T): void;
   throw(value: unknown): void;
   return(value: T): void;
 }
-declare function isStream<T>(value: object): value is Stream<T>;
+declare function isStream<T>(value: unknown): value is Stream<T>;
 declare function createStream<T>(): Stream<T>;
 //#endregion
 //#region src/core/tree/index.d.ts

package/dist/index.js

@@ -692,16 +692,26 @@ const ARRAY_BUFFER_CONSTRUCTOR = (b64) => {
 const SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR = /* @__PURE__ */ ARRAY_BUFFER_CONSTRUCTOR.toString();
 //#endregion
 //#region src/core/sequence.ts
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+* The eval-based `deserialize` path still rebuilds a `{__SEROVAL_SEQUENCE__…}`
+* POJO from embedded source - it has no access to this class - so a value read
+* back through `deserialize` is not an instance and, by design, is not treated
+* as a genuine Sequence on re-serialization.
+*/
+var Sequence = class {
+	constructor(values, throwAt, doneAt) {
+		this.v = values;
+		this.t = throwAt;
+		this.d = doneAt;
+	}
+};
 function isSequence(value) {
-	return "__SEROVAL_SEQUENCE__" in value;
+	return value instanceof Sequence;
 }
 function createSequence(values, throwAt, doneAt) {
-	return {
-		__SEROVAL_SEQUENCE__: true,
-		v: values,
-		t: throwAt,
-		d: doneAt
-	};
+	return new Sequence(values, throwAt, doneAt);
 }
 function createSequenceFromIterable(source) {
 	const values = [];
@@ -717,7 +727,9 @@ function createSequenceFromIterable(source) {
 		}
 	} catch (error) {
 		throwsAt = values.length;
+		doneAt = throwsAt;
 		values.push(error);
+		break;
 	}
 	return createSequence(values, throwsAt, doneAt);
 }
@@ -749,12 +761,131 @@ const SPECIAL_REF_STRING = {
 	[5]: SERIALIZED_ARRAY_BUFFER_CONSTRUCTOR
 };
 //#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/checkPrivateRedeclaration.js
+function _checkPrivateRedeclaration(e, t) {
+	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateMethodInitSpec.js
+function _classPrivateMethodInitSpec(e, a) {
+	_checkPrivateRedeclaration(e, a), a.add(e);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/assertClassBrand.js
+function _assertClassBrand(e, t, n) {
+	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
+	throw new TypeError("Private element is not present on this object");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.143.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
 //#region src/core/stream.ts
+var _buffer = /* @__PURE__ */ new WeakMap();
+var _listeners = /* @__PURE__ */ new WeakMap();
+var _alive = /* @__PURE__ */ new WeakMap();
+var _success = /* @__PURE__ */ new WeakMap();
+var _count = /* @__PURE__ */ new WeakMap();
+var _Stream_brand = /* @__PURE__ */ new WeakSet();
+/**
+* An internal class rather than a tagged POJO: identity is checked with
+* `instanceof`, which untrusted input cannot forge (the class is not exported).
+*
+* The behavior is intentionally duplicated from `STREAM_CONSTRUCTOR`. That
+* constructor's source is embedded verbatim into the eval-based `deserialize`
+* output, which has no access to this class, so the two cannot be shared. A
+* stream read back through `deserialize` is therefore a plain POJO and, by
+* design, is not treated as a genuine Stream on re-serialization. Keep the two
+* implementations in sync.
+*/
+var Stream = class {
+	constructor() {
+		_classPrivateMethodInitSpec(this, _Stream_brand);
+		_classPrivateFieldInitSpec(this, _buffer, []);
+		_classPrivateFieldInitSpec(this, _listeners, []);
+		_classPrivateFieldInitSpec(this, _alive, true);
+		_classPrivateFieldInitSpec(this, _success, false);
+		_classPrivateFieldInitSpec(this, _count, 0);
+	}
+	on(listener) {
+		let subscribed = _classPrivateFieldGet2(_alive, this);
+		let temp = 0;
+		if (subscribed) {
+			for (; temp < _classPrivateFieldGet2(_count, this); temp++) if (!_classPrivateFieldGet2(_listeners, this)[temp]) break;
+			if (temp === _classPrivateFieldGet2(_count, this)) {
+				var _this$count;
+				_classPrivateFieldSet2(_count, this, (_this$count = _classPrivateFieldGet2(_count, this), _this$count++, _this$count));
+			}
+			_classPrivateFieldGet2(_listeners, this)[temp] = listener;
+		}
+		_assertClassBrand(_Stream_brand, this, _replay).call(this, listener);
+		return () => {
+			if (_classPrivateFieldGet2(_alive, this) && subscribed) {
+				subscribed = false;
+				_classPrivateFieldGet2(_listeners, this)[temp] = void 0;
+				while (_classPrivateFieldGet2(_count, this) > 0 && !_classPrivateFieldGet2(_listeners, this)[_classPrivateFieldGet2(_count, this) - 1]) {
+					var _this$count3;
+					_classPrivateFieldSet2(_count, this, (_this$count3 = _classPrivateFieldGet2(_count, this), _this$count3--, _this$count3));
+				}
+				_classPrivateFieldGet2(_listeners, this).length = _classPrivateFieldGet2(_count, this);
+			}
+		};
+	}
+	next(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "next");
+		}
+	}
+	throw(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "throw");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, false);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+	return(value) {
+		if (_classPrivateFieldGet2(_alive, this)) {
+			_classPrivateFieldGet2(_buffer, this).push(value);
+			_assertClassBrand(_Stream_brand, this, _flush).call(this, value, "return");
+			_classPrivateFieldSet2(_alive, this, false);
+			_classPrivateFieldSet2(_success, this, true);
+			_classPrivateFieldGet2(_listeners, this).length = 0;
+		}
+	}
+};
+function _flush(value, mode) {
+	for (let x = 0; x < _classPrivateFieldGet2(_count, this); x++) {
+		var _classPrivateFieldGet2$1;
+		(_classPrivateFieldGet2$1 = _classPrivateFieldGet2(_listeners, this)[x]) === null || _classPrivateFieldGet2$1 === void 0 || _classPrivateFieldGet2$1[mode](value);
+	}
+}
+function _replay(listener) {
+	for (let x = 0, z = _classPrivateFieldGet2(_buffer, this).length; x < z; x++) {
+		const current = _classPrivateFieldGet2(_buffer, this)[x];
+		if (!_classPrivateFieldGet2(_alive, this) && x === z - 1) listener[_classPrivateFieldGet2(_success, this) ? "return" : "throw"](current);
+		else listener.next(current);
+	}
+}
 function isStream(value) {
-	return "__SEROVAL_STREAM__" in value;
+	return value instanceof Stream;
 }
 function createStream() {
-	return STREAM_CONSTRUCTOR();
+	return new Stream();
 }
 function createStreamFromAsyncIterable(iterable, cleanups) {
 	const stream = createStream();
@@ -1286,7 +1417,7 @@ function guardIndexedValue(ctx, id) {
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
 function isThennable(value) {
-	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+	return !!value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function";
 }
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
@@ -1308,8 +1439,12 @@ function deserializeKnownValue(node, record, key) {
 function deserializeReference(ctx, node) {
 	return assignIndexedValue$1(ctx, node.i, getReference(deserializeString(node.s)));
 }
+function validateNodeList(node, list) {
+	if (!Array.isArray(list)) throw new SerovalMalformedNodeError(node);
+}
 function deserializeArray(ctx, depth, node) {
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	const result = assignIndexedValue$1(ctx, node.i, new Array(len));
 	for (let i = 0, item; i < len; i++) {
@@ -1351,6 +1486,8 @@ function validateNodeType(ctx, node, id, type) {
 }
 function deserializeProperties(ctx, depth, node, result) {
 	const keys = node.k;
+	validateNodeList(node, keys);
+	validateNodeList(node, node.v);
 	if (keys.length > 0) for (let i = 0, vals = node.v, len = keys.length; i < len; i++) assignProperty(ctx, depth, result, keys[i], vals[i]);
 	return result;
 }
@@ -1405,11 +1542,14 @@ function deserializeRegExp(ctx, node) {
 }
 function deserializeSet(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Set());
+	validateNodeList(node, node.a);
 	for (let i = 0, items = node.a, len = items.length; i < len; i++) result.add(deserialize$1(ctx, depth, items[i]));
 	return result;
 }
 function deserializeMap(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, /* @__PURE__ */ new Map());
+	validateNodeList(node, node.e.k);
+	validateNodeList(node, node.e.v);
 	for (let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length; i < len; i++) result.set(deserialize$1(ctx, depth, keys[i]), deserialize$1(ctx, depth, vals[i]));
 	return result;
 }
@@ -1500,21 +1640,20 @@ function deserializePromiseFulfill(ctx, depth, node) {
 function deserializeIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 35);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isSequence(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return sequenceToIterator(source);
 }
 function deserializeAsyncIteratorFactoryInstance(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[0]);
 	const source = deserialize$1(ctx, depth, node.a[1]);
-	validateNodeType(ctx, node, node.a[1].i, 31);
-	if (!source) throw new SerovalMalformedNodeError(node.a[1]);
+	if (!isStream(source)) throw new SerovalMalformedNodeError(node.a[1]);
 	return streamToAsyncIterable(source);
 }
 function deserializeStreamConstructor(ctx, depth, node) {
 	const result = assignIndexedValue$1(ctx, node.i, createStream());
 	assignNodeType(ctx, node.i, 31);
 	const items = node.a;
+	validateNodeList(node, items);
 	const len = items.length;
 	if (len) for (let i = 0; i < len; i++) deserialize$1(ctx, depth, items[i]);
 	return result;
@@ -1552,10 +1691,15 @@ function deserializeIteratorFactory(ctx, depth, node) {
 function deserializeAsyncIteratorFactory(ctx, depth, node) {
 	deserialize$1(ctx, depth, node.a[1]);
 }
+function isSequenceIndex(value, size) {
+	return Number.isInteger(value) && value >= -1 && value < size;
+}
 function deserializeSequence(ctx, depth, node) {
+	validateNodeList(node, node.a);
+	const size = node.a.length;
+	if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) throw new SerovalMalformedNodeError(node);
 	const result = assignIndexedValue$1(ctx, node.i, createSequence([], node.s, node.l));
-	assignNodeType(ctx, node.i, 35);
-	for (let i = 0, len = node.a.length; i < len; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
+	for (let i = 0; i < size; i++) result.v[i] = deserialize$1(ctx, depth, node.a[i]);
 	return result;
 }
 function deserialize$1(ctx, depth, node) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "seroval",
   "type": "module",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "files": [
     "dist"
   ],