@1aboveio/skills 0.19.2 → 0.20.1

package/skills/engineering/resolve-release/scripts/isolated-adapter-evaluator.mjs

@@ -1,752 +0,0 @@
-import crypto from 'node:crypto'
-import fs from 'node:fs'
-import path from 'node:path'
-import {
-  newQuickJSWASMModuleFromVariant,
-  shouldInterruptAfterDeadline,
-} from '../vendor/quickjs/core/dist/index.mjs'
-import QUICKJS_RELEASE_SYNC from '../vendor/quickjs/release-sync/dist/index.mjs'
-
-export const ISOLATED_ADAPTER_RUNTIME = Object.freeze({
-  name: 'quickjs-emscripten',
-  version: '0.32.0',
-  variant: '@jitl/quickjs-wasmfile-release-sync',
-})
-export const ISOLATED_ADAPTER_LIMITS = Object.freeze({
-  executionMs: 250,
-  memoryBytes: 32 * 1024 * 1024,
-  stackBytes: 256 * 1024,
-  payloadBytes: 256 * 1024,
-  resultBytes: 1024 * 1024,
-  fileBytes: 1024 * 1024,
-  fileCount: 32,
-  pendingJobs: 1024,
-  serializationDepth: 32,
-  serializationNodes: 10_000,
-})
-
-const ADAPTER_EXPORT = 'DURABLE_PROCESSING_ADAPTER'
-const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
-const JSON_SERIALIZER_SOURCE = `
-(() => {
-  const objectPrototype = Object.prototype
-  const arrayPrototype = Array.prototype
-  const getPrototypeOf = Object.getPrototypeOf
-  const getOwnPropertyDescriptors = Object.getOwnPropertyDescriptors
-  const ownKeys = Reflect.ownKeys
-  const isArray = Array.isArray
-  const numberIsFinite = Number.isFinite
-  const numberIsSafeInteger = Number.isSafeInteger
-  const jsonStringify = JSON.stringify
-  const objectCreate = Object.create
-  const setConstructor = Set
-  const dangerous = new setConstructor(['__proto__', 'constructor', 'prototype'])
-
-  return (value, maxDepth, maxNodes, safeIntegers) => {
-    const seen = new setConstructor()
-    let nodes = 0
-    const visit = (input, depth) => {
-      nodes += 1
-      if (nodes > maxNodes || depth > maxDepth) throw new Error('e:adapter-result-too-large')
-      if (input === null || typeof input === 'string' || typeof input === 'boolean') return input
-      if (typeof input === 'number') {
-        if (!numberIsFinite(input) || (safeIntegers && !numberIsSafeInteger(input))) {
-          throw new Error('e:adapter-result-not-serializable')
-        }
-        return input
-      }
-      if (typeof input !== 'object') throw new Error('e:adapter-result-not-serializable')
-      if (seen.has(input)) throw new Error('e:adapter-result-not-serializable')
-      seen.add(input)
-      const prototype = getPrototypeOf(input)
-      const array = isArray(input)
-      if (array ? prototype !== arrayPrototype : prototype !== objectPrototype && prototype !== null) {
-        throw new Error('e:adapter-result-not-plain')
-      }
-      const descriptors = getOwnPropertyDescriptors(input)
-      const keys = ownKeys(input)
-      for (const key of keys) {
-        if (typeof key !== 'string' || dangerous.has(key)) {
-          throw new Error('e:adapter-result-not-plain')
-        }
-      }
-      const output = array ? [] : objectCreate(null)
-      for (const key of keys) {
-        const descriptor = descriptors[key]
-        if (array && key === 'length') continue
-        if (!descriptor.enumerable || !('value' in descriptor)) throw new Error('e:adapter-result-not-plain')
-        output[key] = visit(descriptor.value, depth + 1)
-      }
-      seen.delete(input)
-      return output
-    }
-    return jsonStringify(visit(value, 0))
-  }
-})()
-`
-
-const ADAPTER_INSPECTOR_SOURCE = `
-(() => {
-  const objectPrototype = Object.prototype
-  const getPrototypeOf = Object.getPrototypeOf
-  const getOwnPropertyDescriptors = Object.getOwnPropertyDescriptors
-  const ownKeys = Reflect.ownKeys
-  const objectCreate = Object.create
-  const setConstructor = Set
-  const dangerous = new setConstructor(["__proto__", "constructor", "prototype"])
-  return (adapter) => {
-    const prototype = getPrototypeOf(adapter)
-    if (prototype !== objectPrototype && prototype !== null) throw new Error("e:adapter-export-invalid")
-    const descriptors = getOwnPropertyDescriptors(adapter)
-    const keys = ownKeys(adapter)
-    for (const key of keys) {
-      if (typeof key !== "string" || dangerous.has(key)) throw new Error("e:adapter-export-invalid")
-    }
-    const metadata = objectCreate(null)
-    let executable = false
-    for (const key of keys) {
-      const descriptor = descriptors[key]
-      if (!descriptor.enumerable || !("value" in descriptor)) throw new Error("e:adapter-export-invalid")
-      if (key === "execute") {
-        executable = typeof descriptor.value === "function"
-      } else {
-        metadata[key] = descriptor.value
-      }
-    }
-    return { metadata, executable }
-  }
-})()
-`
-
-const INVOKER_SOURCE = `
-(() => {
-  const jsonParse = JSON.parse
-  const objectFreeze = Object.freeze
-  const objectHasOwn = Object.hasOwn
-  return async (adapter, requestText, configText, snapshotsText) => {
-    const request = jsonParse(requestText)
-    const config = jsonParse(configText)
-    const snapshots = jsonParse(snapshotsText)
-    const writes = []
-    const host = objectFreeze({
-      readTextFile(target) {
-        if (typeof target !== "string" || !objectHasOwn(snapshots, target)) {
-          throw new Error("e:adapter-file-authority-forbidden")
-        }
-        for (let index = writes.length - 1; index >= 0; index -= 1) {
-          if (writes[index].target === target) return writes[index].contents
-        }
-        return snapshots[target]
-      },
-      writeTextFile(target, contents) {
-        if (typeof target !== "string" || !objectHasOwn(snapshots, target)) {
-          throw new Error("e:adapter-file-authority-forbidden")
-        }
-        if (typeof contents !== "string") throw new Error("e:adapter-file-write-invalid")
-        writes[writes.length] = { target, contents }
-      },
-    })
-    const output = await adapter.execute(request, config, host)
-    return { output, writes }
-  }
-})()
-`
-
-let quickJSPromise
-
-function fail(code) {
-  const error = new Error(code)
-  error.code = code
-  throw error
-}
-
-function transactionError(code, fields = {}) {
-  const error = new Error(code)
-  error.code = code
-  Object.assign(error, fields)
-  return error
-}
-
-function byteLength(value) {
-  return Buffer.byteLength(value, 'utf8')
-}
-
-function boundedJson(value, maxBytes, code) {
-  let text
-  try {
-    text = JSON.stringify(value)
-  } catch {
-    fail(code)
-  }
-  if (text === undefined || byteLength(text) > maxBytes) fail(code)
-  return text
-}
-
-function canonicalJson(value) {
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
-  if (value != null && typeof value === 'object') {
-    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`
-  }
-  return JSON.stringify(value)
-}
-
-function detachedPlain(value, code = 'e:adapter-result-not-serializable') {
-  try {
-    return JSON.parse(JSON.stringify(value))
-  } catch {
-    fail(code)
-  }
-}
-
-async function quickJS() {
-  quickJSPromise ??= newQuickJSWASMModuleFromVariant(QUICKJS_RELEASE_SYNC)
-  return quickJSPromise
-}
-
-function dispose(value) {
-  if (value?.alive) value.dispose()
-}
-
-function disposeAll(...values) {
-  let firstError
-  for (const value of values) {
-    try {
-      dispose(value)
-    } catch (error) {
-      firstError ??= error
-    }
-  }
-  if (firstError != null) throw firstError
-}
-
-function guestError(vm, handle) {
-  let dumped
-  try {
-    dumped = vm.dump(handle)
-  } catch {
-    return 'e:adapter-execution-failed'
-  }
-  const message = typeof dumped === 'object' && dumped != null ? dumped.message : String(dumped)
-  if (message === 'interrupted') return 'e:adapter-execution-timeout'
-  if (message === 'stack overflow') return 'e:adapter-stack-limit'
-  if (message === 'out of memory') return 'e:adapter-memory-limit'
-  if (typeof message === 'string' && /^e:adapter-[a-z0-9-]+$/.test(message)) return message
-  return 'e:adapter-execution-failed'
-}
-
-function unwrap(vm, result) {
-  if (result.error) {
-    const code = guestError(vm, result.error)
-    dispose(result.error)
-    fail(code)
-  }
-  return result.value
-}
-
-function settle(vm, runtime, handle) {
-  for (let jobs = 0; jobs <= ISOLATED_ADAPTER_LIMITS.pendingJobs; jobs += 1) {
-    const state = vm.getPromiseState(handle)
-    if (state.type === 'fulfilled') {
-      return state.notAPromise ? handle.dup() : state.value
-    }
-    if (state.type === 'rejected') {
-      const code = guestError(vm, state.error)
-      dispose(state.error)
-      fail(code)
-    }
-    if (jobs === ISOLATED_ADAPTER_LIMITS.pendingJobs || !runtime.hasPendingJob()) {
-      fail('e:adapter-execution-timeout')
-    }
-    const executed = runtime.executePendingJobs(1)
-    if (executed.error) {
-      const code = guestError(vm, executed.error)
-      dispose(executed.error)
-      fail(code)
-    }
-  }
-  fail('e:adapter-execution-timeout')
-}
-
-function ownPropertyNames(vm, handle) {
-  const result = vm.getOwnPropertyNames(handle, { strings: true, symbols: true, onlyEnumerable: true })
-  const handles = unwrap(vm, result)
-  try {
-    return handles.map((item) => item.consume(vm.dump))
-  } finally {
-    handles.dispose()
-  }
-}
-
-function serializeGuestValue(vm, serializer, value, maxBytes) {
-  const maxDepth = vm.newNumber(ISOLATED_ADAPTER_LIMITS.serializationDepth)
-  const maxNodes = vm.newNumber(ISOLATED_ADAPTER_LIMITS.serializationNodes)
-  let serialized
-  try {
-    serialized = unwrap(vm, vm.callFunction(
-      serializer, vm.undefined, value, maxDepth, maxNodes, vm.false,
-    ))
-    if (vm.typeof(serialized) !== 'string') fail('e:adapter-result-not-serializable')
-    const text = vm.getString(serialized)
-    if (byteLength(text) > maxBytes) fail('e:adapter-result-too-large')
-    try {
-      return JSON.parse(text)
-    } catch {
-      fail('e:adapter-result-not-serializable')
-    }
-  } finally {
-    disposeAll(serialized, maxNodes, maxDepth)
-  }
-}
-
-function extractMetadata(vm, serializer, inspector, moduleHandle) {
-  const names = ownPropertyNames(vm, moduleHandle)
-  if (names.length !== 1 || names[0] !== ADAPTER_EXPORT) fail('e:adapter-export-invalid')
-  const adapter = vm.getProp(moduleHandle, ADAPTER_EXPORT)
-  let inspected
-  try {
-    if (vm.typeof(adapter) !== 'object') fail('e:adapter-export-invalid')
-    inspected = unwrap(vm, vm.callFunction(inspector, vm.undefined, adapter))
-    const metadata = vm.getProp(inspected, 'metadata')
-    const executable = vm.getProp(inspected, 'executable')
-    try {
-      return {
-        metadata: serializeGuestValue(vm, serializer, metadata, ISOLATED_ADAPTER_LIMITS.resultBytes),
-        executable: vm.dump(executable) === true,
-      }
-    } finally {
-      disposeAll(executable, metadata)
-    }
-  } finally {
-    disposeAll(inspected, adapter)
-  }
-}
-
-function createRuntime(QuickJS) {
-  const runtime = QuickJS.newRuntime({
-    memoryLimitBytes: ISOLATED_ADAPTER_LIMITS.memoryBytes,
-    maxStackSizeBytes: ISOLATED_ADAPTER_LIMITS.stackBytes,
-  })
-  runtime.setInterruptHandler(shouldInterruptAfterDeadline(
-    Date.now() + ISOLATED_ADAPTER_LIMITS.executionMs,
-  ))
-  return runtime
-}
-
-function installGuestConsole(vm) {
-  const result = vm.evalCode(`
-    globalThis.console = Object.create(null)
-    for (const name of ['log', 'info', 'warn', 'error', 'debug']) console[name] = () => undefined
-  `, 'checked-adapter-console.js', { type: 'global', strict: true })
-  unwrap(vm, result).dispose()
-}
-
-function loadGuestFunction(vm, source, filename) {
-  return unwrap(vm, vm.evalCode(source, filename, { type: 'global', strict: true }))
-}
-
-function evaluateModule(vm, runtime, source, contentHash) {
-  const evaluated = unwrap(vm, vm.evalCode(source, `sha256-${contentHash}.mjs`, { type: 'module' }))
-  try {
-    return settle(vm, runtime, evaluated)
-  } finally {
-    evaluated.dispose()
-  }
-}
-
-async function withGuest(source, contentHash, run) {
-  const QuickJS = await quickJS()
-  const runtime = createRuntime(QuickJS)
-  const vm = runtime.newContext()
-  let serializer
-  let inspector
-  let invoker
-  let moduleHandle
-  try {
-    serializer = loadGuestFunction(vm, JSON_SERIALIZER_SOURCE, 'checked-adapter-serializer.js')
-    inspector = loadGuestFunction(vm, ADAPTER_INSPECTOR_SOURCE, 'checked-adapter-inspector.js')
-    invoker = loadGuestFunction(vm, INVOKER_SOURCE, 'checked-adapter-invoker.js')
-    installGuestConsole(vm)
-    moduleHandle = evaluateModule(vm, runtime, source, contentHash)
-    return run({ vm, runtime, serializer, inspector, invoker, moduleHandle })
-  } catch (error) {
-    if (error?.code) throw error
-    fail('e:adapter-execution-failed')
-  } finally {
-    disposeAll(moduleHandle, invoker, inspector, serializer, vm, runtime)
-  }
-}
-
-function collectConfiguredFiles(config) {
-  const files = new Set()
-  const pending = [config]
-  const seen = new Set()
-  while (pending.length > 0) {
-    const value = pending.pop()
-    if (typeof value === 'string') {
-      if (path.isAbsolute(value)) files.add(path.resolve(value))
-      continue
-    }
-    if (value == null || typeof value !== 'object' || seen.has(value)) continue
-    seen.add(value)
-    pending.push(...(Array.isArray(value) ? value : Object.values(value)))
-  }
-  if (files.size > ISOLATED_ADAPTER_LIMITS.fileCount) fail('e:adapter-file-count-limit')
-  return [...files]
-}
-
-function snapshotConfiguredFiles(config) {
-  const snapshots = Object.create(null)
-  const identities = new Map()
-  for (const target of collectConfiguredFiles(config)) {
-    let stat
-    let contents
-    try {
-      const pathStat = fs.lstatSync(target, { bigint: true })
-      stat = fs.statSync(target, { bigint: true })
-      if (!pathStat.isFile() || !stat.isFile()
-          || pathStat.dev !== stat.dev || pathStat.ino !== stat.ino
-          || stat.size > BigInt(ISOLATED_ADAPTER_LIMITS.fileBytes)) {
-        fail('e:adapter-file-limit')
-      }
-      contents = fs.readFileSync(target, 'utf8')
-    } catch (error) {
-      if (error?.code?.startsWith?.('e:')) throw error
-      fail('e:adapter-file-unreadable')
-    }
-    if (byteLength(contents) > ISOLATED_ADAPTER_LIMITS.fileBytes) fail('e:adapter-file-limit')
-    snapshots[target] = contents
-    identities.set(target, {
-      dev: stat.dev, ino: stat.ino, size: stat.size, mode: stat.mode,
-      originalContents: Buffer.from(contents, 'utf8'),
-      mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs,
-    })
-  }
-  return { snapshots, identities }
-}
-
-function sameFileIdentity(left, right) {
-  return left.dev === right.dev && left.ino === right.ino && left.size === right.size
-    && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs
-}
-
-let commitFaultInjector
-
-// Host-test seam only. This callback is never installed in, or callable from, the guest runtime.
-export function setAdapterCommitFaultInjectorForTests(injector) {
-  if (injector != null && typeof injector !== 'function') throw new TypeError('injector must be a function')
-  commitFaultInjector = injector
-  return () => {
-    if (commitFaultInjector === injector) commitFaultInjector = undefined
-  }
-}
-
-function injectCommitFault(operation, target, index) {
-  commitFaultInjector?.(Object.freeze({ operation, target, index }))
-}
-
-const UNSUPPORTED_DIRECTORY_SYNC = new Set(['EBADF', 'EINVAL', 'EISDIR', 'ENOTSUP', 'EOPNOTSUPP', 'EPERM'])
-
-function syncDirectory(directory) {
-  let descriptor
-  try {
-    descriptor = fs.openSync(directory, fs.constants.O_RDONLY)
-    fs.fsyncSync(descriptor)
-  } catch (error) {
-    if (!UNSUPPORTED_DIRECTORY_SYNC.has(error?.code)) throw error
-  } finally {
-    if (descriptor != null) fs.closeSync(descriptor)
-  }
-}
-
-function syncDirectories(directories) {
-  for (const directory of [...directories].sort()) syncDirectory(directory)
-}
-
-function artifactPath(target, nonce, index, kind) {
-  const digest = crypto.createHash('sha256').update(target).digest('hex').slice(0, 16)
-  return path.join(path.dirname(target), `.adapter-write-${digest}-${nonce}-${index}-${kind}`)
-}
-
-function stageExclusive(file, contents, mode) {
-  let descriptor
-  let created = false
-  let failure
-  try {
-    descriptor = fs.openSync(
-      file,
-      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
-      Number(mode & 0o7777n),
-    )
-    created = true
-    fs.writeFileSync(descriptor, contents)
-    fs.fchmodSync(descriptor, Number(mode & 0o7777n))
-    fs.fsyncSync(descriptor)
-  } catch (error) {
-    failure = error
-  }
-  if (descriptor != null) {
-    try {
-      fs.closeSync(descriptor)
-    } catch (error) {
-      failure ??= error
-    }
-  }
-  if (failure != null) {
-    if (!created) throw failure
-    try {
-      fs.unlinkSync(file)
-    } catch {
-      throw transactionError('e:adapter-write-cleanup-failed', {
-        affectedTargets: [file],
-        ambiguousEffects: false,
-      })
-    }
-    throw failure
-  }
-}
-
-function removeArtifacts(transactions) {
-  const failed = []
-  for (const transaction of transactions) {
-    for (const [artifact, owned] of [
-      [transaction.finalStage, transaction.finalOwned],
-      [transaction.originalStage, transaction.originalOwned],
-    ]) {
-      if (!owned) continue
-      if (artifact == null) continue
-      try {
-        fs.unlinkSync(artifact)
-      } catch (error) {
-        if (error?.code !== 'ENOENT') failed.push(artifact)
-      }
-    }
-  }
-  return failed
-}
-
-function createCommit(writes, identities) {
-  let committed = false
-  return () => {
-    if (committed) fail('e:adapter-write-already-committed')
-    if (writes.length === 0) {
-      committed = true
-      return
-    }
-
-    const ordered = [...writes].sort((left, right) =>
-      left.target < right.target ? -1 : left.target > right.target ? 1 : 0)
-    const nonce = crypto.randomBytes(12).toString('hex')
-    const transactions = []
-    const directories = new Set()
-    const replaced = []
-    let failure
-
-    try {
-      for (const [index, write] of ordered.entries()) {
-        const expected = identities.get(write.target)
-        if (expected == null) fail('e:adapter-file-authority-forbidden')
-        const transaction = {
-          ...write,
-          expected,
-          index,
-          finalStage: artifactPath(write.target, nonce, index, 'final'),
-          originalStage: artifactPath(write.target, nonce, index, 'original'),
-          finalOwned: false,
-          originalOwned: false,
-        }
-        transactions.push(transaction)
-        directories.add(path.dirname(write.target))
-        injectCommitFault('stage-final', write.target, index)
-        stageExclusive(transaction.finalStage, write.contents, expected.mode)
-        transaction.finalOwned = true
-        injectCommitFault('stage-original', write.target, index)
-        stageExclusive(transaction.originalStage, expected.originalContents, expected.mode)
-        transaction.originalOwned = true
-      }
-      syncDirectories(directories)
-
-      // Final pre-mutation boundary: the complete identity pass directly precedes replacement.
-      for (const transaction of transactions) {
-        injectCommitFault('validate-identity', transaction.target, transaction.index)
-        let actual
-        try {
-          const pathStat = fs.lstatSync(transaction.target, { bigint: true })
-          actual = fs.statSync(transaction.target, { bigint: true })
-          if (!pathStat.isFile() || pathStat.dev !== actual.dev || pathStat.ino !== actual.ino) {
-            fail('e:adapter-file-changed')
-          }
-        } catch {
-          fail('e:adapter-file-changed')
-        }
-        if (!actual.isFile() || !sameFileIdentity(transaction.expected, actual)) {
-          fail('e:adapter-file-changed')
-        }
-      }
-
-      for (const transaction of transactions) {
-        injectCommitFault('replace', transaction.target, transaction.index)
-        fs.renameSync(transaction.finalStage, transaction.target)
-        transaction.finalOwned = false
-        replaced.push(transaction)
-      }
-      injectCommitFault('complete-replacements', ordered.at(-1).target, ordered.length - 1)
-      syncDirectories(directories)
-      committed = true
-    } catch (error) {
-      failure = error
-    }
-
-    if (failure != null && replaced.length > 0) {
-      const rollbackFailed = []
-      for (const transaction of [...replaced].reverse()) {
-        try {
-          injectCommitFault('rollback', transaction.target, transaction.index)
-          fs.renameSync(transaction.originalStage, transaction.target)
-          transaction.originalOwned = false
-        } catch {
-          rollbackFailed.push(transaction.target)
-        }
-      }
-      try {
-        syncDirectories(directories)
-      } catch {
-        for (const transaction of replaced) {
-          if (!rollbackFailed.includes(transaction.target)) rollbackFailed.push(transaction.target)
-        }
-      }
-      const cleanupFailed = removeArtifacts(transactions)
-      try {
-        syncDirectories(directories)
-      } catch {
-        // The target replacement result above already determines rollback ambiguity.
-      }
-      if (rollbackFailed.length > 0) {
-        throw transactionError('e:adapter-write-rollback-failed', {
-          affectedTargets: rollbackFailed.sort(),
-          ambiguousEffects: true,
-          cleanupFailed,
-        })
-      }
-      if (cleanupFailed.length > 0) {
-        throw transactionError('e:adapter-write-cleanup-failed', {
-          affectedTargets: cleanupFailed.sort(),
-          ambiguousEffects: false,
-        })
-      }
-      throw transactionError('e:adapter-write-failed', {
-        affectedTargets: ordered.map(({ target }) => target),
-      })
-    }
-
-    const cleanupFailed = removeArtifacts(transactions)
-    let cleanupSyncFailed = false
-    try {
-      syncDirectories(directories)
-    } catch {
-      cleanupSyncFailed = true
-    }
-    if (cleanupFailed.length > 0 || cleanupSyncFailed) {
-      throw transactionError('e:adapter-write-cleanup-failed', {
-        affectedTargets: cleanupFailed.length > 0
-          ? cleanupFailed.sort()
-          : ordered.map(({ target }) => target),
-        committedEffects: committed,
-      })
-    }
-    if (failure != null) {
-      if (failure?.code === 'e:adapter-file-changed'
-          || failure?.code === 'e:adapter-write-cleanup-failed'
-          || failure?.code === 'e:adapter-file-authority-forbidden') throw failure
-      throw transactionError('e:adapter-write-failed', {
-        affectedTargets: ordered.map(({ target }) => target),
-      })
-    }
-  }
-}
-
-function validateWrites(value, identities) {
-  if (!Array.isArray(value) || value.length > ISOLATED_ADAPTER_LIMITS.fileCount) {
-    fail('e:adapter-file-count-limit')
-  }
-  const finalByTarget = new Map()
-  for (const write of value) {
-    if (write == null || typeof write !== 'object' || Array.isArray(write)
-        || Object.keys(write).length !== 2 || typeof write.target !== 'string'
-        || typeof write.contents !== 'string' || !identities.has(path.resolve(write.target))) {
-      fail('e:adapter-file-authority-forbidden')
-    }
-    if (byteLength(write.contents) > ISOLATED_ADAPTER_LIMITS.fileBytes) fail('e:adapter-file-limit')
-    const target = path.resolve(write.target)
-    finalByTarget.set(target, Object.freeze({ target, contents: write.contents }))
-  }
-  return [...finalByTarget.values()]
-}
-
-export async function inspectIsolatedAdapter({ source, bytes, contentHash }) {
-  if (typeof source !== 'string' || !Buffer.isBuffer(bytes)
-      || crypto.createHash('sha256').update(bytes).digest('hex') !== contentHash
-      || Buffer.compare(bytes, Buffer.from(source, 'utf8')) !== 0) {
-    fail('e:adapter-content-identity-mismatch')
-  }
-  const boundBytes = Buffer.from(bytes)
-  return withGuest(source, contentHash, ({ vm, serializer, inspector, moduleHandle }) => {
-    const { metadata, executable } = extractMetadata(vm, serializer, inspector, moduleHandle)
-    const boundMetadata = detachedPlain(metadata)
-    const execute = executable
-      ? async (request, config) => executeIsolatedAdapter({
-          source, bytes: boundBytes, contentHash, expectedMetadata: boundMetadata, request, config,
-        })
-      : undefined
-    const adapter = Object.freeze({ ...boundMetadata, ...(execute ? { execute } : {}) })
-    return Object.freeze({ module: Object.freeze({ [ADAPTER_EXPORT]: adapter }) })
-  })
-}
-
-export async function executeIsolatedAdapter({ source, bytes, contentHash, expectedMetadata, request, config }) {
-  if (crypto.createHash('sha256').update(bytes).digest('hex') !== contentHash
-      || Buffer.compare(bytes, Buffer.from(source, 'utf8')) !== 0) {
-    fail('e:adapter-content-identity-mismatch')
-  }
-  if (expectedMetadata == null || typeof expectedMetadata !== 'object') {
-    fail('e:adapter-export-invalid')
-  }
-  const requestText = boundedJson(request, ISOLATED_ADAPTER_LIMITS.payloadBytes, 'e:adapter-payload-too-large')
-  const configText = boundedJson(config, ISOLATED_ADAPTER_LIMITS.payloadBytes, 'e:adapter-payload-too-large')
-  const { snapshots, identities } = snapshotConfiguredFiles(config)
-  const snapshotsText = boundedJson(snapshots, ISOLATED_ADAPTER_LIMITS.fileBytes * ISOLATED_ADAPTER_LIMITS.fileCount,
-    'e:adapter-file-limit')
-  return withGuest(source, contentHash, ({ vm, runtime, serializer, inspector, invoker, moduleHandle }) => {
-    const current = extractMetadata(vm, serializer, inspector, moduleHandle)
-    if (!current.executable || canonicalJson(current.metadata) !== canonicalJson(expectedMetadata)) {
-      fail('e:adapter-export-changed')
-    }
-    const adapter = vm.getProp(moduleHandle, ADAPTER_EXPORT)
-    const requestHandle = vm.newString(requestText)
-    const configHandle = vm.newString(configText)
-    const snapshotsHandle = vm.newString(snapshotsText)
-    let called
-    try {
-      called = unwrap(vm, vm.callFunction(
-        invoker, vm.undefined, adapter, requestHandle, configHandle, snapshotsHandle,
-      ))
-    } finally {
-      disposeAll(snapshotsHandle, configHandle, requestHandle, adapter)
-    }
-    let settled
-    try {
-      settled = settle(vm, runtime, called)
-      const envelope = serializeGuestValue(vm, serializer, settled, ISOLATED_ADAPTER_LIMITS.resultBytes)
-      if (envelope == null || typeof envelope !== 'object' || Array.isArray(envelope)
-          || !Object.hasOwn(envelope, 'output') || !Object.hasOwn(envelope, 'writes')) {
-        fail('e:adapter-result-not-serializable')
-      }
-      const output = detachedPlain(envelope.output)
-      boundedJson(output, ISOLATED_ADAPTER_LIMITS.resultBytes, 'e:adapter-result-too-large')
-      const writes = validateWrites(envelope.writes, identities)
-      return Object.freeze({ output, commit: createCommit(writes, identities) })
-    } finally {
-      dispose(settled)
-      called.dispose()
-    }
-  })
-}