@agent-vm/gondolin-vm-adapter 0.0.115

package/dist/index.js

@@ -0,0 +1,1772 @@
+import { createRequire } from "node:module";
+import fs from "node:fs/promises";
+import path, { basename } from "node:path";
+import { assertPositiveHostProcessId, createOwnedHostDirectoryController, validateManagedVmFilteredWorkspacePolicy } from "@agent-vm/managed-vm";
+import { ERRNO, MemoryProvider, ReadonlyProvider, RealFSProvider, ShadowProvider, VM, VirtualDirent, createHttpHooks, createShadowPathPredicate, createVirtualDirStats, getInfoFromSshExecRequest, isWriteFlag, validateBuildConfig } from "@earendil-works/gondolin";
+import { parse, printParseErrorCode } from "jsonc-parser";
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { z } from "zod";
+import fs$1 from "node:fs";
+import * as net$1 from "node:net";
+import net from "node:net";
+import * as dns from "node:dns";
+//#region src/rootfs-init-extra.ts
+const agentVmRootfsInitExtraScript = `# Generated by agent-vm.
+# Gondolin mounts devtmpfs over /dev at boot, so Docker-image /dev symlinks are hidden.
+mkdir -p /dev
+ln -sfn /proc/self/fd /dev/fd 2>/dev/null || true
+ln -sfn /proc/self/fd/0 /dev/stdin 2>/dev/null || true
+ln -sfn /proc/self/fd/1 /dev/stdout 2>/dev/null || true
+ln -sfn /proc/self/fd/2 /dev/stderr 2>/dev/null || true
+if [ ! -e /dev/ptmx ] && [ -e /dev/pts/ptmx ]; then
+  ln -sfn pts/ptmx /dev/ptmx 2>/dev/null || true
+fi
+`;
+const managedGatewayInputStagingRoot = "/run/agent-vm/managed-gateway-inputs";
+const managedGatewayInputRoot = "/run/agent-vm/managed-gateway";
+const managedGatewayRuntimeRoot = "/run/agent-vm/gateway-runtime";
+const managedGatewayLogRoot = "/var/log/agent-vm";
+function frameworkBootCommand(frameworkBootEntry) {
+	switch (frameworkBootEntry) {
+		case "hermes-framework-service": return "/usr/local/bin/agent-vm-hermes-gateway";
+		case "openclaw-framework-service": return "/usr/local/bin/openclaw gateway --port 18789";
+	}
+}
+function frameworkLogFileName(frameworkBootEntry) {
+	return frameworkBootEntry === "openclaw-framework-service" ? "openclaw-service.log" : "hermes-service.log";
+}
+function renderManagedGatewayRootfsInitScript(projection) {
+	const selectedFrameworkBootCommand = frameworkBootCommand(projection.frameworkBootEntry);
+	const selectedFrameworkLogPath = `${managedGatewayLogRoot}/${frameworkLogFileName(projection.frameworkBootEntry)}`;
+	return `# Fixed managed Gateway sibling boot entries.
+managed_gateway_input_staging_root=${managedGatewayInputStagingRoot}
+managed_gateway_input_root=${managedGatewayInputRoot}
+mkdir -p ${managedGatewayLogRoot}
+install -d -m 0700 "$managed_gateway_input_root"
+install -d -m 0700 ${managedGatewayRuntimeRoot}
+install -m 0600 /dev/null ${managedGatewayLogRoot}/tool-portal-service.log
+install -m 0600 /dev/null ${selectedFrameworkLogPath}
+(
+  for managed_gateway_input_name in tool-portal.environment.sh tool-portal-service.json mcp.config.json; do
+    if [ ! -f "$managed_gateway_input_staging_root/$managed_gateway_input_name" ]; then exit 78; fi
+    install -m 0600 "$managed_gateway_input_staging_root/$managed_gateway_input_name" "$managed_gateway_input_root/$managed_gateway_input_name" || exit 78
+  done
+  exec /bin/sh -c 'set -a; . ${managedGatewayInputRoot}/tool-portal.environment.sh; set +a; exec /usr/local/bin/agent-vm-gateway-runtime --config ${managedGatewayInputRoot}/tool-portal-service.json'
+) >> ${managedGatewayLogRoot}/tool-portal-service.log 2>&1 &
+(
+  for managed_gateway_input_name in ${projection.frameworkBootEntry === "hermes-framework-service" ? "framework.environment.sh framework-service.json config.yaml" : "framework.environment.sh framework-service.json"}; do
+    if [ ! -f "$managed_gateway_input_staging_root/$managed_gateway_input_name" ]; then exit 78; fi
+    install -m 0600 "$managed_gateway_input_staging_root/$managed_gateway_input_name" "$managed_gateway_input_root/$managed_gateway_input_name" || exit 78
+  done
+  exec /bin/sh -c 'set -a; . ${managedGatewayInputRoot}/framework.environment.sh; set +a; exec ${selectedFrameworkBootCommand}'
+) >> ${selectedFrameworkLogPath} 2>&1 &
+`;
+}
+function resolveBuildConfigPath(filePath, configDir) {
+	return path.isAbsolute(filePath) ? filePath : path.resolve(configDir ?? process.cwd(), filePath);
+}
+async function readExistingRootfsInitExtra(buildConfig, configDir) {
+	const existingRootfsInitExtra = buildConfig.init?.rootfsInitExtra;
+	if (!existingRootfsInitExtra) return;
+	const resolvedRootfsInitExtra = resolveBuildConfigPath(existingRootfsInitExtra, configDir);
+	try {
+		return await fs.readFile(resolvedRootfsInitExtra, "utf8");
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`Failed to read Gondolin rootfs init extra '${resolvedRootfsInitExtra}': ${message}`, { cause: error });
+	}
+}
+function composeRootfsInitExtra(existingRootfsInitExtra) {
+	return existingRootfsInitExtra ? `${agentVmRootfsInitExtraScript.trimEnd()}\n\n${existingRootfsInitExtra}` : agentVmRootfsInitExtraScript;
+}
+async function resolveRootfsInitExtra(options) {
+	if (options.managedGatewayBoot !== void 0 && options.buildConfig.init?.rootfsInitExtra) throw new Error("Managed Gateway images cannot compose deployment-authored rootfs init authority.");
+	const existingRootfsInitExtra = await readExistingRootfsInitExtra(options.buildConfig, options.configDir);
+	const managedGatewayRootfsInitExtra = options.managedGatewayBoot === void 0 ? void 0 : renderManagedGatewayRootfsInitScript(options.managedGatewayBoot);
+	const composedRootfsInitExtra = composeRootfsInitExtra(existingRootfsInitExtra);
+	return {
+		content: managedGatewayRootfsInitExtra === void 0 ? composedRootfsInitExtra : `${composedRootfsInitExtra.trimEnd()}\n\n${managedGatewayRootfsInitExtra}`,
+		fingerprintInput: {
+			agentVmRootfsInitExtra: agentVmRootfsInitExtraScript,
+			...existingRootfsInitExtra === void 0 ? {} : { deploymentRootfsInitExtra: existingRootfsInitExtra },
+			...options.managedGatewayBoot === void 0 ? {} : { managedGatewayBoot: options.managedGatewayBoot }
+		}
+	};
+}
+async function prepareBuildConfigWithAgentVmRootfsInitExtra(options) {
+	const rootfsInitExtraPath = path.join(options.imagePath, "agent-vm-rootfs-init-extra.sh");
+	await fs.writeFile(rootfsInitExtraPath, options.rootfsInitExtraContent, {
+		encoding: "utf8",
+		mode: 493
+	});
+	return {
+		...options.buildConfig,
+		init: {
+			...options.buildConfig.init,
+			rootfsInitExtra: rootfsInitExtraPath
+		}
+	};
+}
+//#endregion
+//#region src/build-pipeline.ts
+const buildImageAssetFileNames = [
+	"manifest.json",
+	"rootfs.ext4",
+	"initramfs.cpio.lz4",
+	"vmlinuz-virt"
+];
+function requireValidBuildConfig(buildConfig) {
+	if (!validateBuildConfig(buildConfig)) throw new Error("Managed VM image recipe has an invalid build shape.");
+	return buildConfig;
+}
+function createGondolinImageBuildTooling() {
+	return {
+		async buildImage(options, dependencies) {
+			return await buildImage({
+				...options,
+				buildConfig: requireValidBuildConfig(options.buildConfig)
+			}, dependencies);
+		},
+		async computeFingerprint(options) {
+			return (await computeEffectiveBuildFingerprint({
+				...options,
+				buildConfig: requireValidBuildConfig(options.buildConfig)
+			})).fingerprint;
+		}
+	};
+}
+const inFlightImageBuilds = /* @__PURE__ */ new Map();
+const gondolinWorkDirectoryName = ".agent-vm-gondolin-work";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function stableSerialize(value) {
+	if (Array.isArray(value)) return `[${value.map((entry) => stableSerialize(entry)).join(",")}]`;
+	if (isRecord$1(value)) return `{${Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)).map(([entryKey, entryValue]) => `${JSON.stringify(entryKey)}:${stableSerialize(entryValue)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function isMissingPathError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function pathExists(filePath) {
+	try {
+		await fs.access(filePath);
+		return true;
+	} catch (error) {
+		if (!isMissingPathError(error)) throw error;
+		return false;
+	}
+}
+async function hasBuiltImageAssets(outputDirectoryPath) {
+	for (const fileName of buildImageAssetFileNames) if (!await pathExists(path.join(outputDirectoryPath, fileName))) return false;
+	return true;
+}
+async function loadBuildAssets() {
+	const gondolinModule = await import("@earendil-works/gondolin");
+	return async (buildConfig, outputDirectory, configDir, workDir, verbose) => await gondolinModule.buildAssets(buildConfig, {
+		outputDir: outputDirectory,
+		verbose: verbose ?? false,
+		...configDir ? { configDir } : {},
+		...workDir ? { workDir } : {}
+	});
+}
+function createRedirectedWrite(output) {
+	return ((chunk, encodingOrCallback, callback) => {
+		const writeCallback = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+		const wrote = output.write(chunk);
+		writeCallback?.();
+		return wrote;
+	});
+}
+async function withCapturedBuildOutput(output, fn) {
+	if (!output) return await fn();
+	const originalStderrWrite = process.stderr.write.bind(process.stderr);
+	const originalStdoutWrite = process.stdout.write.bind(process.stdout);
+	const originalCi = process.env.CI;
+	const redirectedWrite = createRedirectedWrite(output);
+	process.stderr.write = redirectedWrite;
+	process.stdout.write = redirectedWrite;
+	process.env.CI = "true";
+	try {
+		return await fn();
+	} finally {
+		process.stderr.write = originalStderrWrite;
+		process.stdout.write = originalStdoutWrite;
+		if (originalCi === void 0) delete process.env.CI;
+		else process.env.CI = originalCi;
+	}
+}
+function computeBuildFingerprint(buildConfig, gondolinVersion = "unknown", fingerprintInput) {
+	const payload = fingerprintInput === void 0 ? `${stableSerialize(buildConfig)}|${gondolinVersion}` : `${stableSerialize(buildConfig)}|${gondolinVersion}|${stableSerialize(fingerprintInput)}`;
+	return crypto.createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+async function computeEffectiveBuildFingerprint(options) {
+	const resolvedRootfsInitExtra = await resolveRootfsInitExtra({
+		buildConfig: options.buildConfig,
+		...options.configDir ? { configDir: options.configDir } : {},
+		...options.managedGatewayBoot === void 0 ? {} : { managedGatewayBoot: options.managedGatewayBoot }
+	});
+	return {
+		fingerprint: computeBuildFingerprint(options.buildConfig, options.gondolinVersion, {
+			agentVmRootfsInitExtra: resolvedRootfsInitExtra.fingerprintInput,
+			...options.fingerprintInput === void 0 ? {} : { callerFingerprintInput: options.fingerprintInput }
+		}),
+		rootfsInitExtraContent: resolvedRootfsInitExtra.content
+	};
+}
+async function buildImage(options, dependencies = {}) {
+	const effectiveBuildFingerprint = await computeEffectiveBuildFingerprint({
+		buildConfig: options.buildConfig,
+		...options.configDir ? { configDir: options.configDir } : {},
+		...options.fingerprintInput === void 0 ? {} : { fingerprintInput: options.fingerprintInput },
+		...options.managedGatewayBoot === void 0 ? {} : { managedGatewayBoot: options.managedGatewayBoot },
+		...dependencies.gondolinVersion ? { gondolinVersion: dependencies.gondolinVersion } : {}
+	});
+	const fingerprint = effectiveBuildFingerprint.fingerprint;
+	const imagePath = path.join(options.cacheDir, fingerprint);
+	const buildImageForFingerprint = async () => {
+		if (options.fullReset) await fs.rm(imagePath, {
+			recursive: true,
+			force: true
+		});
+		if (await hasBuiltImageAssets(imagePath)) return {
+			built: false,
+			fingerprint,
+			imagePath
+		};
+		await fs.mkdir(imagePath, { recursive: true });
+		const buildAssetsImplementation = dependencies.buildAssets ?? await loadBuildAssets();
+		const effectiveBuildConfig = await prepareBuildConfigWithAgentVmRootfsInitExtra({
+			buildConfig: options.buildConfig,
+			imagePath,
+			rootfsInitExtraContent: effectiveBuildFingerprint.rootfsInitExtraContent
+		});
+		const gondolinWorkDir = path.join(imagePath, gondolinWorkDirectoryName);
+		await fs.rm(gondolinWorkDir, {
+			recursive: true,
+			force: true
+		});
+		try {
+			await withCapturedBuildOutput(options.output, async () => {
+				await buildAssetsImplementation(effectiveBuildConfig, imagePath, options.configDir, gondolinWorkDir, options.output !== void 0);
+			});
+		} finally {
+			await fs.rm(gondolinWorkDir, {
+				recursive: true,
+				force: true
+			});
+		}
+		if (!await hasBuiltImageAssets(imagePath)) throw new Error(`Expected Gondolin assets to be written to ${imagePath}.`);
+		return {
+			built: true,
+			fingerprint,
+			imagePath
+		};
+	};
+	if (options.output) return await buildImageForFingerprint();
+	const inFlightKey = path.resolve(imagePath);
+	const existingBuild = inFlightImageBuilds.get(inFlightKey);
+	if (existingBuild) return await existingBuild;
+	const buildPromise = buildImageForFingerprint();
+	inFlightImageBuilds.set(inFlightKey, buildPromise);
+	try {
+		return await buildPromise;
+	} finally {
+		if (inFlightImageBuilds.get(inFlightKey) === buildPromise) inFlightImageBuilds.delete(inFlightKey);
+	}
+}
+//#endregion
+//#region src/exact-recorded-process-termination.ts
+const execFileAsync = promisify(execFile);
+const terminationStageTimeoutMs = 2e3;
+const processIdentityPollIntervalMs = 100;
+const darwinProcessCommandNameLimit = 16;
+const linuxTaskCommandNameLimit = 15;
+function processErrorCode(error) {
+	return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+}
+function isManagedVmHostCommand(command) {
+	return /\b(qemu-system|krun)\b/u.test(command);
+}
+function isMatchingDarwinFallbackCommand(options) {
+	const fallbackCommandMatch = /^\(([^()]+)\)$/u.exec(options.currentCommand);
+	if (fallbackCommandMatch === null) return false;
+	const recordedExecutable = options.recordedCommand.split(/[ \t]/u, 1)[0];
+	if (recordedExecutable === void 0 || recordedExecutable.length === 0) return false;
+	return fallbackCommandMatch[1] === basename(recordedExecutable).slice(0, darwinProcessCommandNameLimit);
+}
+function isMatchingLinuxTaskFallbackCommand(options) {
+	const fallbackCommandMatch = /^\[([^\r\n]+)\]$/u.exec(options.currentCommand);
+	if (fallbackCommandMatch === null) return false;
+	const recordedExecutable = options.recordedCommand.split(/[ \t]/u, 1)[0];
+	if (recordedExecutable === void 0 || recordedExecutable.length === 0) return false;
+	return fallbackCommandMatch[1] === basename(recordedExecutable).slice(0, linuxTaskCommandNameLimit);
+}
+function findProcessCommandBoundary(processDescription) {
+	let tokenCount = 0;
+	let insideToken = false;
+	for (let index = 0; index < processDescription.length; index += 1) {
+		const character = processDescription[index];
+		const isWhitespace = character === " " || character === "	";
+		if (!isWhitespace && !insideToken) insideToken = true;
+		else if (isWhitespace && insideToken) {
+			insideToken = false;
+			tokenCount += 1;
+			if (tokenCount === 5) return index;
+		}
+	}
+	return null;
+}
+function parseProcessIdentityOutput(hostProcessId, processDescription) {
+	const trimmedDescription = processDescription.trim();
+	const processStateBoundary = trimmedDescription.search(/[ \t]/u);
+	if (processStateBoundary === -1) throw new Error(`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`);
+	const processState = trimmedDescription.slice(0, processStateBoundary).trim();
+	const startAndCommandDescription = trimmedDescription.slice(processStateBoundary).trim();
+	const commandBoundary = findProcessCommandBoundary(startAndCommandDescription);
+	if (commandBoundary === null) throw new Error(`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`);
+	const processStartIdentity = startAndCommandDescription.slice(0, commandBoundary).trim();
+	const command = startAndCommandDescription.slice(commandBoundary).trim();
+	if (processState.length === 0 || processStartIdentity.length === 0 || command.length === 0) throw new Error(`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps omitted the process state, start, or command.`);
+	return {
+		command,
+		processStartIdentity,
+		processState
+	};
+}
+async function readGondolinHostProcessIdentity(hostProcessId) {
+	try {
+		const { stdout } = await execFileAsync("ps", [
+			"-p",
+			String(hostProcessId),
+			"-o",
+			"state=",
+			"-o",
+			"lstart=",
+			"-o",
+			"command="
+		]);
+		if (stdout.trim().length === 0) throw new Error(`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned empty output.`);
+		return parseProcessIdentityOutput(hostProcessId, stdout);
+	} catch (error) {
+		if (processErrorCode(error) === 1) return null;
+		throw error;
+	}
+}
+function sendHostProcessSignal(hostProcessId, signal) {
+	process.kill(hostProcessId, signal);
+}
+async function sleep(delayMs) {
+	await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+const defaultDependencies = {
+	now: Date.now,
+	readProcessIdentity: readGondolinHostProcessIdentity,
+	sendSignal: sendHostProcessSignal,
+	sleep
+};
+function assertTerminationRequest(request) {
+	if (request.contextLabel.trim().length === 0) throw new Error("Exact managed VM process termination requires a non-empty context label.");
+	if (!Number.isSafeInteger(request.identity.hostProcessId) || request.identity.hostProcessId <= 0) throw new Error("Exact managed VM process termination requires a positive safe host pid.");
+	if (request.identity.vmId.length === 0 || request.identity.processStartIdentity.length === 0 || request.identity.command.length === 0) throw new Error("Exact managed VM process termination requires complete recorded identity.");
+}
+async function observeRecordedProcess(options) {
+	const currentIdentity = await options.dependencies.readProcessIdentity(options.identity.hostProcessId);
+	if (currentIdentity === null) return "absent";
+	if (currentIdentity.processStartIdentity !== options.identity.processStartIdentity) return "absent";
+	if (currentIdentity.processState.startsWith("Z")) return "absent";
+	if (options.mode === "after-signal" && currentIdentity.processState.includes("E")) return "exact";
+	if (options.mode === "after-signal" && (currentIdentity.processState.startsWith("U") || currentIdentity.processState.startsWith("R")) && (isMatchingDarwinFallbackCommand({
+		currentCommand: currentIdentity.command,
+		recordedCommand: options.identity.command
+	}) || isMatchingLinuxTaskFallbackCommand({
+		currentCommand: currentIdentity.command,
+		recordedCommand: options.identity.command
+	}))) return "exact";
+	if (currentIdentity.command !== options.identity.command) throw new Error(`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)}: same process start identity was observed with state ${JSON.stringify(currentIdentity.processState)} but command changed (recorded ${JSON.stringify(options.identity.command)}, current ${JSON.stringify(currentIdentity.command)}).`);
+	if (!isManagedVmHostCommand(currentIdentity.command)) throw new Error(`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)} because the exact command is not a managed VM process.`);
+	return "exact";
+}
+async function waitForRecordedProcessAbsence(options) {
+	const deadline = options.dependencies.now() + terminationStageTimeoutMs;
+	while (options.dependencies.now() < deadline) {
+		if (await observeRecordedProcess({
+			action: `continued containment after ${options.afterSignal} for`,
+			contextLabel: options.contextLabel,
+			dependencies: options.dependencies,
+			identity: options.identity,
+			mode: "after-signal"
+		}) === "absent") return true;
+		await options.dependencies.sleep(processIdentityPollIntervalMs);
+	}
+	return await observeRecordedProcess({
+		action: `continued containment after ${options.afterSignal} for`,
+		contextLabel: options.contextLabel,
+		dependencies: options.dependencies,
+		identity: options.identity,
+		mode: "after-signal"
+	}) === "absent";
+}
+function signalRecordedProcess(options) {
+	try {
+		options.dependencies.sendSignal(options.hostProcessId, options.signal);
+	} catch (error) {
+		if (processErrorCode(error) !== "ESRCH") throw error;
+	}
+}
+async function terminateExactRecordedManagedVmHostProcess(options) {
+	assertTerminationRequest(options);
+	if (await observeRecordedProcess({
+		action: "SIGTERM to",
+		contextLabel: options.contextLabel,
+		dependencies: options.dependencies,
+		identity: options.identity,
+		mode: "before-signal"
+	}) === "absent") return {
+		hostProcessId: options.identity.hostProcessId,
+		kind: "already-absent"
+	};
+	signalRecordedProcess({
+		dependencies: options.dependencies,
+		hostProcessId: options.identity.hostProcessId,
+		signal: "SIGTERM"
+	});
+	if (await waitForRecordedProcessAbsence({
+		afterSignal: "SIGTERM",
+		contextLabel: options.contextLabel,
+		dependencies: options.dependencies,
+		identity: options.identity
+	})) return {
+		hostProcessId: options.identity.hostProcessId,
+		kind: "terminated"
+	};
+	if (await observeRecordedProcess({
+		action: "SIGKILL to",
+		contextLabel: options.contextLabel,
+		dependencies: options.dependencies,
+		identity: options.identity,
+		mode: "after-signal"
+	}) === "absent") return {
+		hostProcessId: options.identity.hostProcessId,
+		kind: "terminated"
+	};
+	signalRecordedProcess({
+		dependencies: options.dependencies,
+		hostProcessId: options.identity.hostProcessId,
+		signal: "SIGKILL"
+	});
+	if (await waitForRecordedProcessAbsence({
+		afterSignal: "SIGKILL",
+		contextLabel: options.contextLabel,
+		dependencies: options.dependencies,
+		identity: options.identity
+	})) return {
+		hostProcessId: options.identity.hostProcessId,
+		kind: "terminated"
+	};
+	throw new Error(`Failed to terminate exact recorded managed VM process ${String(options.identity.hostProcessId)} (${options.contextLabel}).`);
+}
+function createGondolinExactProcessTerminationCapability(dependencies = defaultDependencies) {
+	return { async terminateRecordedHostProcess(request) {
+		return await terminateExactRecordedManagedVmHostProcess({
+			contextLabel: request.contextLabel,
+			dependencies,
+			identity: request.identity
+		});
+	} };
+}
+//#endregion
+//#region src/gondolin-package.ts
+const requireFromHere = createRequire(import.meta.url);
+const gondolinPackageJsonSchema = z.object({ version: z.string().min(1) });
+function isMissingFileError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function getErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function parseMinimumZigVersion(rawContents) {
+	const match = rawContents.match(/\.minimum_zig_version\s*=\s*"([^"]*)"/u);
+	if (!match) throw new Error("minimum_zig_version declaration not found. Expected a line like `.minimum_zig_version = \"0.15.2\"`.");
+	const version = match[1];
+	if (!version) throw new Error("minimum_zig_version is empty.");
+	return version;
+}
+function resolveGondolinPackageJsonPath() {
+	return requireFromHere.resolve("@earendil-works/gondolin/package.json");
+}
+async function resolveGondolinPackageSpec() {
+	const packageJsonPath = resolveGondolinPackageJsonPath();
+	const parsed = JSON.parse(await fs.readFile(packageJsonPath, "utf8"));
+	return `@earendil-works/gondolin@${gondolinPackageJsonSchema.parse(parsed).version}`;
+}
+async function resolveDefaultBuildZigZonPath() {
+	const packageJsonPath = resolveGondolinPackageJsonPath();
+	return path.join(path.dirname(packageJsonPath), "dist", "guest", "build.zig.zon");
+}
+async function resolveGondolinMinimumZigVersion(options = {}) {
+	const zonPath = options.buildZigZonPath ?? await resolveDefaultBuildZigZonPath();
+	let rawContents;
+	try {
+		rawContents = await fs.readFile(zonPath, "utf8");
+	} catch (error) {
+		if (isMissingFileError(error)) throw new Error(`Missing Gondolin build.zig.zon at '${zonPath}'.`, { cause: error });
+		throw new Error(`Failed to read Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`, { cause: error });
+	}
+	try {
+		return parseMinimumZigVersion(rawContents);
+	} catch (error) {
+		throw new Error(`Failed to parse Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`, { cause: error });
+	}
+}
+//#endregion
+//#region src/pinned-realfs.ts
+const terminallyClosedPinnedRoots = /* @__PURE__ */ new WeakSet();
+function formatRootIdentity(root) {
+	return `${root.device}:${root.inode}`;
+}
+function openDirectoryNoFollow(candidatePath) {
+	return fs$1.openSync(candidatePath, fs$1.constants.O_RDONLY | fs$1.constants.O_DIRECTORY | fs$1.constants.O_NOFOLLOW);
+}
+function pinRealFsRoot(hostPath) {
+	if (!hostPath || !path.isAbsolute(hostPath)) throw new Error(`Pinned RealFS root must be a non-empty absolute path: ${hostPath}`);
+	const resolvedHostPath = path.resolve(hostPath);
+	const fd = openDirectoryNoFollow(resolvedHostPath);
+	try {
+		const stats = fs$1.fstatSync(fd);
+		if (!stats.isDirectory()) throw new Error(`Pinned RealFS root is not a directory: ${resolvedHostPath}`);
+		const realPath = fs$1.realpathSync(resolvedHostPath);
+		const realPathStats = fs$1.statSync(realPath);
+		if (realPathStats.dev !== stats.dev || realPathStats.ino !== stats.ino) throw new Error(`Pinned RealFS root changed while opening: ${resolvedHostPath} opened ${stats.dev}:${stats.ino} but resolved to ${realPathStats.dev}:${realPathStats.ino}`);
+		return {
+			device: stats.dev,
+			fd,
+			hostPath: resolvedHostPath,
+			inode: stats.ino,
+			realPath
+		};
+	} catch (error) {
+		fs$1.closeSync(fd);
+		throw error;
+	}
+}
+function closePinnedRealFsRoot(root) {
+	if (terminallyClosedPinnedRoots.has(root)) return;
+	fs$1.closeSync(root.fd);
+	terminallyClosedPinnedRoots.add(root);
+}
+function assertPinnedRealFsRoot(root) {
+	const pinnedStats = fs$1.fstatSync(root.fd);
+	const currentStats = fs$1.statSync(root.realPath);
+	if (pinnedStats.dev !== root.device || pinnedStats.ino !== root.inode || currentStats.dev !== root.device || currentStats.ino !== root.inode) throw new Error(`Pinned RealFS root changed before mount access: ${root.realPath} expected ${formatRootIdentity(root)} got ${currentStats.dev}:${currentStats.ino}`);
+}
+function createPinnedRealFsProvider(options) {
+	assertPinnedRealFsRoot(options.root);
+	const provider = options.createRealFsProvider(options.root.realPath);
+	return new Proxy(provider, { get(target, property, receiver) {
+		const value = Reflect.get(target, property, receiver);
+		if (typeof value !== "function") return value;
+		return (...methodArguments) => {
+			assertPinnedRealFsRoot(options.root);
+			return Reflect.apply(value, target, methodArguments);
+		};
+	} });
+}
+//#endregion
+//#region src/filtered-workspace-provider.ts
+function toAbsoluteProviderPath(relativePath) {
+	return `/${relativePath}`;
+}
+function normalizeProviderPath(providerPath) {
+	const absolutePath = providerPath.startsWith("/") ? providerPath : `/${providerPath}`;
+	return path.posix.normalize(absolutePath);
+}
+function toRelativeProviderPath(providerPath) {
+	const normalizedPath = normalizeProviderPath(providerPath);
+	return normalizedPath === "/" ? "" : normalizedPath.slice(1);
+}
+function isEqualOrDescendant(candidatePath, ancestorPath) {
+	return candidatePath === ancestorPath || candidatePath.startsWith(`${ancestorPath}/`);
+}
+function pathsOverlap(firstPath, secondPath) {
+	return isEqualOrDescendant(firstPath, secondPath) || isEqualOrDescendant(secondPath, firstPath);
+}
+function createFilesystemPolicyError(code, syscall, providerPath) {
+	return Object.assign(/* @__PURE__ */ new Error(`${code}: ${syscall} '${providerPath}'`), {
+		code,
+		errno: ERRNO[code],
+		path: providerPath,
+		syscall
+	});
+}
+function invokeProviderMethod(provider, property, methodArguments) {
+	const method = Reflect.get(provider, property, provider);
+	if (typeof method !== "function") return method;
+	return Reflect.apply(method, provider, methodArguments);
+}
+const singlePathMutationMethods = new Set([
+	"appendFile",
+	"appendFileSync",
+	"mkdir",
+	"mkdirSync",
+	"rmdir",
+	"rmdirSync",
+	"symlink",
+	"symlinkSync",
+	"truncate",
+	"truncateSync",
+	"unlink",
+	"unlinkSync",
+	"writeFile",
+	"writeFileSync"
+]);
+function mutationPathArgumentIndex(property) {
+	return property === "symlink" || property === "symlinkSync" ? 1 : 0;
+}
+function failProviderMutation(property, providerPath) {
+	return failProviderOperation(property, providerPath, "EROFS");
+}
+function failProviderOperation(property, providerPath, code) {
+	const operationError = createFilesystemPolicyError(code, property, providerPath);
+	if (property.endsWith("Sync")) throw operationError;
+	return Promise.reject(operationError);
+}
+function createRelativeRootProvider(provider, sourceRelativePath) {
+	const sourceProviderPath = toAbsoluteProviderPath(sourceRelativePath);
+	const translatePath = (providerPath) => {
+		const suffix = toRelativeProviderPath(providerPath);
+		return toAbsoluteProviderPath(suffix.length === 0 ? sourceRelativePath : `${sourceRelativePath}/${suffix}`);
+	};
+	const translateArguments = (property, methodArguments) => {
+		const translatedArguments = [...methodArguments];
+		if (property === "rename" || property === "renameSync" || property === "link" || property === "linkSync" || property === "copyFile" || property === "copyFileSync") {
+			translatedArguments[0] = translatePath(String(methodArguments[0]));
+			translatedArguments[1] = translatePath(String(methodArguments[1]));
+			return translatedArguments;
+		}
+		translatedArguments[mutationPathArgumentIndex(property)] = translatePath(String(methodArguments[mutationPathArgumentIndex(property)]));
+		return translatedArguments;
+	};
+	const assertResolvedPathWithinSource = (resolvedPath, canonicalSourcePath, property, providerPath) => {
+		if (!isEqualOrDescendant(toRelativeProviderPath(resolvedPath), toRelativeProviderPath(canonicalSourcePath))) throw createFilesystemPolicyError("ENOENT", property, providerPath);
+	};
+	const resolveConfinedPath = async (property, providerPath, translatedPath) => {
+		if (!provider.realpath) throw createFilesystemPolicyError("ENOENT", property, providerPath);
+		const [canonicalSourcePath, resolvedPath] = await Promise.all([provider.realpath(sourceProviderPath), provider.realpath(translatedPath)]);
+		assertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);
+		return {
+			canonicalSourcePath,
+			resolvedPath
+		};
+	};
+	const resolveConfinedPathSync = (property, providerPath, translatedPath) => {
+		if (!provider.realpathSync) throw createFilesystemPolicyError("ENOENT", property, providerPath);
+		const canonicalSourcePath = provider.realpathSync(sourceProviderPath);
+		const resolvedPath = provider.realpathSync(translatedPath);
+		assertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);
+		return {
+			canonicalSourcePath,
+			resolvedPath
+		};
+	};
+	const parentProviderPath = (providerPath) => {
+		const normalizedPath = normalizeProviderPath(providerPath);
+		return normalizedPath === "/" ? "/" : path.posix.dirname(normalizedPath);
+	};
+	const remapResolvedPath = (resolvedPath, canonicalSourcePath) => {
+		const resolvedRelativePath = toRelativeProviderPath(resolvedPath);
+		const canonicalSourceRelativePath = toRelativeProviderPath(canonicalSourcePath);
+		if (resolvedRelativePath === canonicalSourceRelativePath) return "/";
+		return toAbsoluteProviderPath(canonicalSourceRelativePath.length === 0 ? resolvedRelativePath : resolvedRelativePath.slice(`${canonicalSourceRelativePath}/`.length));
+	};
+	const asyncFollowMethods = new Set([
+		"access",
+		"open",
+		"readdir",
+		"readFile",
+		"stat",
+		"statfs"
+	]);
+	const syncFollowMethods = new Set([
+		"accessSync",
+		"openSync",
+		"readdirSync",
+		"readFileSync",
+		"statSync",
+		"watch",
+		"watchAsync",
+		"watchFile",
+		"unwatchFile"
+	]);
+	return new Proxy(provider, { get(target, property) {
+		const value = Reflect.get(target, property, target);
+		if (typeof property !== "string" || typeof value !== "function") return value;
+		return (...methodArguments) => {
+			const translatedArguments = translateArguments(property, methodArguments);
+			if (property === "realpath") return resolveConfinedPath(property, String(methodArguments[0]), String(translatedArguments[0])).then(({ canonicalSourcePath, resolvedPath }) => remapResolvedPath(resolvedPath, canonicalSourcePath));
+			if (property === "realpathSync") {
+				const { canonicalSourcePath, resolvedPath } = resolveConfinedPathSync(property, String(methodArguments[0]), String(translatedArguments[0]));
+				return remapResolvedPath(resolvedPath, canonicalSourcePath);
+			}
+			if (property === "lstat" || property === "readlink") {
+				const providerPath = String(methodArguments[0]);
+				return resolveConfinedPath(property, providerPath, translatePath(parentProviderPath(providerPath))).then(() => Reflect.apply(value, target, translatedArguments));
+			}
+			if (property === "lstatSync" || property === "readlinkSync") {
+				const providerPath = String(methodArguments[0]);
+				resolveConfinedPathSync(property, providerPath, translatePath(parentProviderPath(providerPath)));
+				return Reflect.apply(value, target, translatedArguments);
+			}
+			if (property === "exists") return resolveConfinedPath(property, String(methodArguments[0]), String(translatedArguments[0])).then(() => Reflect.apply(value, target, translatedArguments)).catch(() => false);
+			if (property === "existsSync" || property === "internalModuleStat") {
+				const providerPath = String(methodArguments[0]);
+				try {
+					resolveConfinedPathSync(property, providerPath, String(translatedArguments[0]));
+					return Reflect.apply(value, target, translatedArguments);
+				} catch {
+					return property === "existsSync" ? false : -2;
+				}
+			}
+			if (asyncFollowMethods.has(property)) return resolveConfinedPath(property, String(methodArguments[0]), String(translatedArguments[0])).then(() => Reflect.apply(value, target, translatedArguments));
+			if (syncFollowMethods.has(property)) resolveConfinedPathSync(property, String(methodArguments[0]), String(translatedArguments[0]));
+			return Reflect.apply(value, target, translatedArguments);
+		};
+	} });
+}
+function createPositiveWorkspaceProjectionProvider(provider, policy, dependencies) {
+	const isVisible = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return relativePath.length === 0 || policy.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath));
+	};
+	const isWritable = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return policy.writablePaths.some((writablePath) => isEqualOrDescendant(relativePath, writablePath));
+	};
+	const projectedProvider = dependencies.createShadowProvider(provider, {
+		shouldShadow: ({ path: providerPath }) => !isVisible(providerPath),
+		writeMode: "deny"
+	});
+	const readonlyProvider = dependencies.createReadonlyProvider(projectedProvider);
+	return new Proxy(projectedProvider, { get(target, property) {
+		const value = Reflect.get(target, property, target);
+		if (typeof property !== "string" || typeof value !== "function") return value;
+		if (property === "open" || property === "openSync") return (...methodArguments) => {
+			const providerPath = String(methodArguments[0]);
+			return invokeProviderMethod(isVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target, property, methodArguments);
+		};
+		if (singlePathMutationMethods.has(property)) return (...methodArguments) => {
+			const pathIndex = mutationPathArgumentIndex(property);
+			const providerPath = String(methodArguments[pathIndex]);
+			return invokeProviderMethod(isVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target, property, methodArguments);
+		};
+		if (property === "rename" || property === "renameSync") return (...methodArguments) => {
+			const affectedPaths = [String(methodArguments[0]), String(methodArguments[1])];
+			return invokeProviderMethod(affectedPaths.every(isVisible) && affectedPaths.some((affectedPath) => !isWritable(affectedPath)) ? readonlyProvider : target, property, methodArguments);
+		};
+		if (property === "copyFile" || property === "copyFileSync") return (...methodArguments) => {
+			const sourcePath = String(methodArguments[0]);
+			const destinationPath = String(methodArguments[1]);
+			return invokeProviderMethod(isVisible(sourcePath) && isVisible(destinationPath) && !isWritable(destinationPath) ? readonlyProvider : target, property, methodArguments);
+		};
+		return (...methodArguments) => Reflect.apply(value, target, methodArguments);
+	} });
+}
+function createWorkspaceHardlinkProvider(provider, baseProvider, policy) {
+	const hidden = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));
+	};
+	const temporary = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return policy.temporaryPaths.some((temporaryPath) => isEqualOrDescendant(relativePath, temporaryPath));
+	};
+	const visible = (providerPath) => {
+		if (policy.visibility.kind === "whole-root-writable") return true;
+		const relativePath = toRelativeProviderPath(providerPath);
+		return relativePath.length === 0 || policy.visibility.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath));
+	};
+	const writable = (providerPath) => {
+		if (temporary(providerPath)) return false;
+		if (policy.visibility.kind === "whole-root-writable") return true;
+		const relativePath = toRelativeProviderPath(providerPath);
+		return policy.visibility.writablePaths.some((writablePath) => isEqualOrDescendant(relativePath, writablePath));
+	};
+	return new Proxy(provider, { get(target, property) {
+		const value = Reflect.get(target, property, target);
+		if (property !== "link" && property !== "linkSync") return typeof value === "function" ? (...methodArguments) => Reflect.apply(value, target, methodArguments) : value;
+		const underlyingLinkMethod = Reflect.get(baseProvider, property, baseProvider);
+		if (typeof underlyingLinkMethod !== "function") return;
+		return (...methodArguments) => {
+			const sourcePath = String(methodArguments[0]);
+			const destinationPath = String(methodArguments[1]);
+			if (hidden(sourcePath) || !visible(sourcePath)) return failProviderOperation(property, sourcePath, "ENOENT");
+			if (hidden(destinationPath) || !visible(destinationPath)) return failProviderOperation(property, destinationPath, "EACCES");
+			if (!writable(sourcePath)) return failProviderOperation(property, sourcePath, "EROFS");
+			if (!writable(destinationPath)) return failProviderOperation(property, destinationPath, "EROFS");
+			return Reflect.apply(underlyingLinkMethod, baseProvider, methodArguments);
+		};
+	} });
+}
+function directReadonlyDestinationChildren(providerPath, readonlyInputs) {
+	const relativePath = toRelativeProviderPath(providerPath);
+	const prefix = relativePath.length === 0 ? "" : `${relativePath}/`;
+	const children = /* @__PURE__ */ new Set();
+	for (const readonlyInput of readonlyInputs) {
+		if (!readonlyInput.destinationRelativePath.startsWith(prefix)) continue;
+		const childName = readonlyInput.destinationRelativePath.slice(prefix.length).split("/")[0];
+		if (childName) children.add(childName);
+	}
+	return [...children].toSorted();
+}
+function entryName(entry) {
+	return typeof entry === "string" ? entry : entry.name;
+}
+function mergeDirectoryEntries(entries, virtualChildren, withFileTypes) {
+	const presentNames = new Set(entries.map(entryName));
+	const missingChildren = virtualChildren.filter((childName) => !presentNames.has(childName));
+	return [...entries, ...missingChildren.map((childName) => withFileTypes ? new VirtualDirent(childName) : childName)];
+}
+function isNoEntryError(error) {
+	return typeof error === "object" && error !== null && ("code" in error && (error.code === "ENOENT" || error.code === "ERRNO_2") || "errno" in error && (error.errno === ERRNO.ENOENT || error.errno === -ERRNO.ENOENT));
+}
+function createNestedReadonlyWorkspaceProvider(provider, sourceProvider, policy, dependencies) {
+	const readonlyInputs = [];
+	for (const readonlyInput of policy.readonlyInputs) {
+		if (policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(readonlyInput.destinationRelativePath, hiddenPath))) continue;
+		let inputProvider = createRelativeRootProvider(sourceProvider, readonlyInput.sourceRelativePath);
+		const nestedHiddenPaths = policy.hiddenPaths.flatMap((hiddenPath) => {
+			const destinationPrefix = `${readonlyInput.destinationRelativePath}/`;
+			return hiddenPath.startsWith(destinationPrefix) ? [toAbsoluteProviderPath(hiddenPath.slice(destinationPrefix.length))] : [];
+		});
+		if (nestedHiddenPaths.length > 0) inputProvider = dependencies.createShadowProvider(inputProvider, {
+			shouldShadow: dependencies.createShadowPathPredicate(nestedHiddenPaths),
+			writeMode: "deny"
+		});
+		readonlyInputs.push({
+			destinationRelativePath: readonlyInput.destinationRelativePath,
+			provider: dependencies.createReadonlyProvider(inputProvider)
+		});
+	}
+	if (readonlyInputs.length === 0) return provider;
+	const findInput = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return readonlyInputs.find((readonlyInput) => isEqualOrDescendant(relativePath, readonlyInput.destinationRelativePath));
+	};
+	const mapInputPath = (providerPath, readonlyInput) => {
+		const suffix = toRelativeProviderPath(providerPath).slice(readonlyInput.destinationRelativePath.length);
+		return suffix.length === 0 ? "/" : suffix;
+	};
+	const conflictsWithReadonlyInput = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return readonlyInputs.some((readonlyInput) => pathsOverlap(relativePath, readonlyInput.destinationRelativePath));
+	};
+	const isHidden = (providerPath) => {
+		const relativePath = toRelativeProviderPath(providerPath);
+		return policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));
+	};
+	return new Proxy(provider, { get(target, property) {
+		const value = Reflect.get(target, property, target);
+		if (typeof property !== "string" || typeof value !== "function") return value;
+		if (property === "readdir" || property === "readdirSync") return (...methodArguments) => {
+			const providerPath = String(methodArguments[0]);
+			const readdirOptions = methodArguments[1];
+			const withFileTypes = typeof readdirOptions === "object" && readdirOptions !== null && "withFileTypes" in readdirOptions && readdirOptions.withFileTypes === true;
+			const readonlyInput = findInput(providerPath);
+			if (readonlyInput && !isHidden(providerPath)) return invokeProviderMethod(readonlyInput.provider, property, [mapInputPath(providerPath, readonlyInput), ...methodArguments.slice(1)]);
+			const virtualChildren = directReadonlyDestinationChildren(providerPath, readonlyInputs);
+			if (virtualChildren.length === 0) return Reflect.apply(value, target, methodArguments);
+			if (property === "readdir") return Promise.resolve(Reflect.apply(value, target, methodArguments)).catch((error) => {
+				if (isNoEntryError(error)) return [];
+				throw error;
+			}).then((entries) => mergeDirectoryEntries(entries, virtualChildren, withFileTypes));
+			try {
+				return mergeDirectoryEntries(Reflect.apply(value, target, methodArguments), virtualChildren, withFileTypes);
+			} catch (error) {
+				if (isNoEntryError(error)) return virtualChildren;
+				throw error;
+			}
+		};
+		if (property === "stat" || property === "statSync" || property === "lstat" || property === "lstatSync") return (...methodArguments) => {
+			const providerPath = String(methodArguments[0]);
+			const readonlyInput = findInput(providerPath);
+			if (readonlyInput && !isHidden(providerPath)) return invokeProviderMethod(readonlyInput.provider, property, [mapInputPath(providerPath, readonlyInput), ...methodArguments.slice(1)]);
+			if (directReadonlyDestinationChildren(providerPath, readonlyInputs).length === 0) return Reflect.apply(value, target, methodArguments);
+			if (property === "stat" || property === "lstat") return Promise.resolve(Reflect.apply(value, target, methodArguments)).catch((error) => {
+				if (isNoEntryError(error)) return createVirtualDirStats();
+				throw error;
+			});
+			try {
+				return Reflect.apply(value, target, methodArguments);
+			} catch (error) {
+				if (isNoEntryError(error)) return createVirtualDirStats();
+				throw error;
+			}
+		};
+		if (property === "open" || property === "openSync") return (...methodArguments) => {
+			const providerPath = String(methodArguments[0]);
+			const readonlyInput = findInput(providerPath);
+			return readonlyInput && !isHidden(providerPath) ? invokeProviderMethod(readonlyInput.provider, property, [mapInputPath(providerPath, readonlyInput), ...methodArguments.slice(1)]) : Reflect.apply(value, target, methodArguments);
+		};
+		if (singlePathMutationMethods.has(property)) return (...methodArguments) => {
+			const providerPath = String(methodArguments[mutationPathArgumentIndex(property)]);
+			if (!isHidden(providerPath) && conflictsWithReadonlyInput(providerPath)) return failProviderMutation(property, providerPath);
+			return Reflect.apply(value, target, methodArguments);
+		};
+		if (property === "rename" || property === "renameSync" || property === "link" || property === "linkSync") return (...methodArguments) => {
+			const conflictingPath = [String(methodArguments[0]), String(methodArguments[1])].find((affectedPath) => !isHidden(affectedPath) && conflictsWithReadonlyInput(affectedPath));
+			if (conflictingPath) return failProviderMutation(property, conflictingPath);
+			return Reflect.apply(value, target, methodArguments);
+		};
+		if (property === "copyFile" || property === "copyFileSync") return (...methodArguments) => {
+			const sourcePath = String(methodArguments[0]);
+			const destinationPath = String(methodArguments[1]);
+			if (!isHidden(destinationPath) && conflictsWithReadonlyInput(destinationPath)) return failProviderMutation(property, destinationPath);
+			const sourceInput = findInput(sourcePath);
+			if (!sourceInput || isHidden(sourcePath)) return Reflect.apply(value, target, methodArguments);
+			const mappedSourcePath = mapInputPath(sourcePath, sourceInput);
+			if (property === "copyFile") return Promise.resolve(invokeProviderMethod(sourceInput.provider, "readFile", [mappedSourcePath])).then((contents) => invokeProviderMethod(target, "writeFile", [destinationPath, contents]));
+			return invokeProviderMethod(target, "writeFileSync", [destinationPath, invokeProviderMethod(sourceInput.provider, "readFileSync", [mappedSourcePath])]);
+		};
+		return (...methodArguments) => {
+			const providerPath = String(methodArguments[0]);
+			const readonlyInput = findInput(providerPath);
+			const result = readonlyInput && !isHidden(providerPath) ? invokeProviderMethod(readonlyInput.provider, property, [mapInputPath(providerPath, readonlyInput), ...methodArguments.slice(1)]) : Reflect.apply(value, target, methodArguments);
+			if (!readonlyInput || isHidden(providerPath)) return result;
+			if (property === "realpath") return Promise.resolve(result).then((resolvedPath) => {
+				const resolvedRelativePath = toRelativeProviderPath(String(resolvedPath));
+				return toAbsoluteProviderPath(resolvedRelativePath.length === 0 ? readonlyInput.destinationRelativePath : `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`);
+			});
+			if (property === "realpathSync") {
+				const resolvedRelativePath = toRelativeProviderPath(String(result));
+				return toAbsoluteProviderPath(resolvedRelativePath.length === 0 ? readonlyInput.destinationRelativePath : `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`);
+			}
+			return result;
+		};
+	} });
+}
+function createFilteredWorkspaceProvider(options) {
+	let workspaceProvider = options.baseProvider;
+	if (options.policy.visibility.kind === "positive-paths") workspaceProvider = createPositiveWorkspaceProjectionProvider(workspaceProvider, options.policy.visibility, options.dependencies);
+	if (options.policy.hiddenPaths.length > 0) workspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {
+		shouldShadow: options.dependencies.createShadowPathPredicate(options.policy.hiddenPaths.map(toAbsoluteProviderPath)),
+		writeMode: "deny"
+	});
+	if (options.policy.temporaryPaths.length > 0) {
+		const hiddenPredicate = options.dependencies.createShadowPathPredicate(options.policy.hiddenPaths.map(toAbsoluteProviderPath));
+		const temporaryPredicate = options.dependencies.createShadowPathPredicate(options.policy.temporaryPaths.map(toAbsoluteProviderPath));
+		workspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {
+			shouldShadow: (context) => !hiddenPredicate(context) && temporaryPredicate(context),
+			tmpfs: options.dependencies.createMemoryProvider(),
+			writeMode: "tmpfs"
+		});
+	}
+	workspaceProvider = createWorkspaceHardlinkProvider(workspaceProvider, options.baseProvider, options.policy);
+	return createNestedReadonlyWorkspaceProvider(workspaceProvider, options.baseProvider, options.policy, options.dependencies);
+}
+//#endregion
+//#region src/host-network-defaults.ts
+/**
+* Gondolin raw tcpHosts passthrough sockets are opened by the host-side Node
+* process, not by guest Node processes. VM NODE_OPTIONS cannot affect those
+* sockets, so host processes that create Gondolin VMs also force deterministic
+* IPv4-first behavior before network state is constructed.
+*/
+function configureHostNetworkDefaults(dependencies = {}) {
+	const setDefaultResultOrder = "setDefaultResultOrder" in dependencies ? dependencies.setDefaultResultOrder : dns.setDefaultResultOrder;
+	const setDefaultAutoSelectFamily = "setDefaultAutoSelectFamily" in dependencies ? dependencies.setDefaultAutoSelectFamily : net$1.setDefaultAutoSelectFamily;
+	let dnsResultOrder = "unavailable";
+	if (typeof setDefaultResultOrder === "function") {
+		setDefaultResultOrder("ipv4first");
+		dnsResultOrder = "ipv4first";
+	}
+	let autoSelectFamily = "unavailable";
+	if (typeof setDefaultAutoSelectFamily === "function") {
+		setDefaultAutoSelectFamily(false);
+		autoSelectFamily = false;
+	}
+	return {
+		autoSelectFamily,
+		dnsResultOrder
+	};
+}
+//#endregion
+//#region src/vm-adapter.ts
+const SYNTHETIC_DNS_IPV4_BENCHMARK = "198.18.0.1";
+const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = "::ffff:198.18.0.1";
+const MANAGED_VM_DEFAULT_INGRESS_OPTIONS = {
+	allowWebSockets: true,
+	bufferResponseBody: false,
+	maxBufferedResponseBodyBytes: 512 * 1024 * 1024,
+	upstreamHeaderTimeoutMs: 12e4,
+	upstreamResponseTimeoutMs: 12e4
+};
+function createReadonlyMutationError(syscall, filePath) {
+	const pathSuffix = filePath === void 0 ? "" : ` '${filePath}'`;
+	return Object.assign(/* @__PURE__ */ new Error(`EROFS: ${syscall}${pathSuffix}`), {
+		code: "EROFS",
+		errno: ERRNO.EROFS,
+		...filePath === void 0 ? {} : { path: filePath },
+		syscall
+	});
+}
+function createHardenedReadonlyFileHandle(handle) {
+	return new Proxy(handle, { get(target, property, receiver) {
+		const value = Reflect.get(target, property, receiver);
+		if (property === "write" || property === "writeFile" || property === "truncate") return async () => {
+			throw createReadonlyMutationError(String(property), target.path);
+		};
+		if (property === "writeSync" || property === "writeFileSync" || property === "truncateSync") return () => {
+			throw createReadonlyMutationError(String(property), target.path);
+		};
+		return typeof value === "function" ? (...methodArguments) => Reflect.apply(value, target, methodArguments) : value;
+	} });
+}
+function createHardenedReadonlyProvider(provider) {
+	const readonlyProvider = new ReadonlyProvider(provider);
+	return new Proxy(readonlyProvider, { get(target, property, receiver) {
+		const value = Reflect.get(target, property, receiver);
+		if (property === "open") return async (entryPath, flags, mode) => {
+			if (isWriteFlag(flags)) throw createReadonlyMutationError("open", entryPath);
+			return createHardenedReadonlyFileHandle(await target.open(entryPath, flags, mode));
+		};
+		if (property === "openSync") return (entryPath, flags, mode) => {
+			if (isWriteFlag(flags)) throw createReadonlyMutationError("openSync", entryPath);
+			return createHardenedReadonlyFileHandle(target.openSync(entryPath, flags, mode));
+		};
+		if (property === "mkdir" || property === "rmdir" || property === "unlink" || property === "rename" || property === "link" || property === "writeFile" || property === "appendFile" || property === "copyFile" || property === "symlink") return async (entryPath) => {
+			throw createReadonlyMutationError(String(property), entryPath);
+		};
+		if (property === "mkdirSync" || property === "rmdirSync" || property === "unlinkSync" || property === "renameSync" || property === "linkSync" || property === "writeFileSync" || property === "appendFileSync" || property === "copyFileSync" || property === "symlinkSync") return (entryPath) => {
+			throw createReadonlyMutationError(String(property), entryPath);
+		};
+		return typeof value === "function" ? (...methodArguments) => Reflect.apply(value, target, methodArguments) : value;
+	} });
+}
+function isSshServerHostKey(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("algorithm" in value) || !("publicKeyBase64" in value)) return false;
+	const algorithm = value.algorithm;
+	const publicKeyBase64 = value.publicKeyBase64;
+	if (algorithm !== "ssh-ed25519" || typeof publicKeyBase64 !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/u.test(publicKeyBase64)) return false;
+	try {
+		const decodedPublicKey = Buffer.from(publicKeyBase64, "base64");
+		if (decodedPublicKey.toString("base64") !== publicKeyBase64 || decodedPublicKey.length < 4) return false;
+		const algorithmLength = decodedPublicKey.readUInt32BE(0);
+		const algorithmStart = 4;
+		const algorithmEnd = algorithmStart + algorithmLength;
+		const publicKeyLengthOffset = algorithmEnd;
+		const publicKeyStart = publicKeyLengthOffset + 4;
+		return algorithmEnd + 4 <= decodedPublicKey.length && decodedPublicKey.subarray(algorithmStart, algorithmEnd).toString("utf8") === "ssh-ed25519" && decodedPublicKey.readUInt32BE(publicKeyLengthOffset) === 32 && decodedPublicKey.length === publicKeyStart + 32;
+	} catch {
+		return false;
+	}
+}
+function parseSshServerHostKey(publicKeyText) {
+	const publicKeyLines = publicKeyText.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	if (publicKeyLines.length !== 1) throw new Error("Tool VM did not expose exactly one ssh-ed25519 server host key.");
+	const publicKeyFields = publicKeyLines[0]?.split(/\s+/u);
+	const serverHostKey = {
+		algorithm: publicKeyFields?.[0],
+		publicKeyBase64: publicKeyFields?.[1]
+	};
+	if (!isSshServerHostKey(serverHostKey)) throw new Error("Tool VM did not expose a valid ssh-ed25519 server host key.");
+	return serverHostKey;
+}
+async function readSshServerHostKey(vmInstance) {
+	const publicKeyResult = await vmInstance.exec(["/bin/cat", "/etc/ssh/ssh_host_ed25519_key.pub"]);
+	if (publicKeyResult.exitCode !== 0) throw new Error(`Tool VM server host key read failed with exit ${String(publicKeyResult.exitCode)}.`);
+	return parseSshServerHostKey(publicKeyResult.stdout);
+}
+async function closeSshAccessAfterIdentityFailure(sshAccess, identityError) {
+	try {
+		await sshAccess.close();
+	} catch (closeError) {
+		throw new AggregateError([identityError, closeError], "Tool VM SSH server identity validation and SSH access cleanup both failed.", { cause: identityError });
+	}
+	throw identityError;
+}
+function createDefaultDependencies() {
+	const createDefaultRealFsProvider = (hostPath) => new RealFSProvider(hostPath);
+	return {
+		configureHostNetworkDefaults,
+		createVm: async (vmOptions) => await VM.create(vmOptions),
+		createHttpHooks: (hookOptions) => createHttpHooks({
+			allowedHosts: [...hookOptions.allowedHosts],
+			...hookOptions.allowedInternalHosts === void 0 ? {} : { allowedInternalHosts: [...hookOptions.allowedInternalHosts] },
+			...hookOptions.isIpAllowed ? { isIpAllowed: hookOptions.isIpAllowed } : {},
+			secrets: Object.fromEntries(Object.entries(hookOptions.secrets).map(([secretName, secretSpec]) => [secretName, {
+				hosts: [...secretSpec.hosts],
+				...secretSpec.placeholder === void 0 ? {} : { placeholder: secretSpec.placeholder },
+				value: secretSpec.value
+			}])),
+			...hookOptions.onRequest ? { onRequest: hookOptions.onRequest } : {},
+			...hookOptions.onResponse ? { onResponse: hookOptions.onResponse } : {}
+		}),
+		closePinnedRealFsRoot,
+		createPinnedRealFsProvider: (root) => createPinnedRealFsProvider({
+			createRealFsProvider: createDefaultRealFsProvider,
+			root
+		}),
+		createRealFsProvider: createDefaultRealFsProvider,
+		createReadonlyProvider: createHardenedReadonlyProvider,
+		createMemoryProvider: () => new MemoryProvider(),
+		createShadowProvider: (provider, shadowOptions) => new ShadowProvider(provider, shadowOptions),
+		createShadowPathPredicate: (paths) => createShadowPathPredicate([...paths])
+	};
+}
+function normalizeShadowPath(pathValue) {
+	const trimmedPath = pathValue.trim();
+	if (trimmedPath.startsWith("/")) return trimmedPath;
+	return `/${trimmedPath.startsWith("./") ? trimmedPath.slice(2) : trimmedPath}`;
+}
+function createRealFsProviderForSpec(mountSpec, dependencies, mountKind) {
+	if (mountSpec.pinnedHostRoot) return dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot);
+	if (mountSpec.hostPath) return dependencies.createRealFsProvider(mountSpec.hostPath);
+	throw new Error(`${mountKind} mounts require hostPath or pinnedHostRoot`);
+}
+function createProviderFromSpec(mountSpec, dependencies) {
+	switch (mountSpec.kind) {
+		case "memory": return dependencies.createMemoryProvider();
+		case "realfs": return createRealFsProviderForSpec(mountSpec, dependencies, "realfs");
+		case "realfs-readonly": return dependencies.createReadonlyProvider(createRealFsProviderForSpec(mountSpec, dependencies, "realfs-readonly"));
+		case "filtered-workspace": return createFilteredWorkspaceProvider({
+			baseProvider: dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot),
+			dependencies,
+			policy: mountSpec.policy
+		});
+		case "shadow": {
+			let shadowProvider = mountSpec.hostPath || mountSpec.pinnedHostRoot ? createRealFsProviderForSpec(mountSpec, dependencies, "shadow") : dependencies.createMemoryProvider();
+			const shadowConfig = mountSpec.shadowConfig;
+			if (shadowConfig?.deny.length) shadowProvider = dependencies.createShadowProvider(shadowProvider, {
+				shouldShadow: dependencies.createShadowPathPredicate(shadowConfig.deny.map((shadowPath) => normalizeShadowPath(shadowPath))),
+				writeMode: "deny"
+			});
+			if (shadowConfig?.tmpfs.length) shadowProvider = dependencies.createShadowProvider(shadowProvider, {
+				shouldShadow: dependencies.createShadowPathPredicate(shadowConfig.tmpfs.map((shadowPath) => normalizeShadowPath(shadowPath))),
+				writeMode: "tmpfs"
+			});
+			return shadowProvider;
+		}
+		default: throw new Error("Unsupported VFS mount kind.");
+	}
+}
+function createVfsMounts(vfsMounts, dependencies) {
+	const mountMap = {};
+	for (const [guestPath, mountSpec] of Object.entries(vfsMounts)) mountMap[guestPath] = createProviderFromSpec(mountSpec, dependencies);
+	return mountMap;
+}
+function collectPinnedRealFsRoots(vfsMounts) {
+	const roots = /* @__PURE__ */ new Map();
+	for (const mountSpec of Object.values(vfsMounts)) if ("pinnedHostRoot" in mountSpec && mountSpec.pinnedHostRoot) roots.set(mountSpec.pinnedHostRoot.fd, mountSpec.pinnedHostRoot);
+	return [...roots.values()];
+}
+function closePinnedRealFsRoots(roots, dependencies) {
+	const closeErrors = [];
+	for (const root of roots) try {
+		dependencies.closePinnedRealFsRoot(root);
+	} catch (error) {
+		closeErrors.push(error);
+	}
+	if (closeErrors.length === 1) throw closeErrors[0];
+	if (closeErrors.length > 1) throw new AggregateError(closeErrors, "Multiple pinned RealFS roots failed to close.");
+}
+function closePinnedRealFsRootsAfterFailure(roots, dependencies) {
+	try {
+		closePinnedRealFsRoots(roots, dependencies);
+	} catch {}
+}
+function resolveManagedVmIngressOptions(ingressOptions = {}) {
+	const resolvedOptions = { ...MANAGED_VM_DEFAULT_INGRESS_OPTIONS };
+	if (ingressOptions.listenHost !== void 0) resolvedOptions.listenHost = ingressOptions.listenHost;
+	if (ingressOptions.listenPort !== void 0) resolvedOptions.listenPort = ingressOptions.listenPort;
+	if (ingressOptions.allowWebSockets !== void 0) resolvedOptions.allowWebSockets = ingressOptions.allowWebSockets;
+	if (ingressOptions.hooks !== void 0) resolvedOptions.hooks = ingressOptions.hooks;
+	if (ingressOptions.bufferResponseBody !== void 0) resolvedOptions.bufferResponseBody = ingressOptions.bufferResponseBody;
+	if (ingressOptions.maxBufferedResponseBodyBytes !== void 0) resolvedOptions.maxBufferedResponseBodyBytes = ingressOptions.maxBufferedResponseBodyBytes;
+	if (ingressOptions.upstreamHeaderTimeoutMs !== void 0) resolvedOptions.upstreamHeaderTimeoutMs = ingressOptions.upstreamHeaderTimeoutMs;
+	if (ingressOptions.upstreamResponseTimeoutMs !== void 0) resolvedOptions.upstreamResponseTimeoutMs = ingressOptions.upstreamResponseTimeoutMs;
+	return resolvedOptions;
+}
+function normalizePolicyHostname(hostname) {
+	return hostname.toLowerCase();
+}
+function parseTcpHostEndpoint(endpoint) {
+	if (endpoint.startsWith("[")) {
+		const closingBracketIndex = endpoint.indexOf("]");
+		if (closingBracketIndex > 1) {
+			const portValue = Number.parseInt(endpoint.slice(closingBracketIndex + 2), 10);
+			if (!Number.isFinite(portValue)) return;
+			return {
+				hostname: normalizePolicyHostname(endpoint.slice(1, closingBracketIndex)),
+				port: portValue
+			};
+		}
+	}
+	const portSeparatorIndex = endpoint.lastIndexOf(":");
+	if (portSeparatorIndex <= 0) return;
+	const portValue = Number.parseInt(endpoint.slice(portSeparatorIndex + 1), 10);
+	if (!Number.isFinite(portValue)) return;
+	return {
+		hostname: normalizePolicyHostname(endpoint.slice(0, portSeparatorIndex)),
+		port: portValue
+	};
+}
+function ipv4AddressIsInternal(ipAddress) {
+	const octets = ipAddress.split(".").map((segment) => Number.parseInt(segment, 10));
+	if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return false;
+	const firstOctet = octets[0];
+	const secondOctet = octets[1];
+	if (firstOctet === void 0 || secondOctet === void 0) return false;
+	return firstOctet === 10 || firstOctet === 127 || firstOctet === 169 && secondOctet === 254 || firstOctet === 172 && secondOctet >= 16 && secondOctet <= 31 || firstOctet === 192 && secondOctet === 168 || firstOctet === 100 && secondOctet >= 64 && secondOctet <= 127;
+}
+function ipAddressIsInternal(ipAddress) {
+	if (net.isIP(ipAddress) === 4) return ipv4AddressIsInternal(ipAddress);
+	const normalizedIpAddress = ipAddress.toLowerCase();
+	if (normalizedIpAddress.startsWith("::ffff:")) return ipv4AddressIsInternal(normalizedIpAddress.slice(7));
+	return normalizedIpAddress === "::1" || normalizedIpAddress.startsWith("fc") || normalizedIpAddress.startsWith("fd") || normalizedIpAddress.startsWith("fe80:");
+}
+function endpointHostnameIsInternal(hostname) {
+	const normalizedHostname = normalizePolicyHostname(hostname);
+	return normalizedHostname === "localhost" || normalizedHostname === "host.docker.internal" || ipAddressIsInternal(normalizedHostname);
+}
+function deriveInternalTcpHostRules(tcpHosts) {
+	if (!tcpHosts) return [];
+	const rules = [];
+	for (const [tcpHostKey, tcpHostTarget] of Object.entries(tcpHosts)) {
+		const exposedEndpoint = parseTcpHostEndpoint(tcpHostKey);
+		const targetEndpoint = parseTcpHostEndpoint(tcpHostTarget);
+		if (!exposedEndpoint || !targetEndpoint || !endpointHostnameIsInternal(targetEndpoint.hostname)) continue;
+		if (!rules.some((rule) => rule.hostname === exposedEndpoint.hostname && rule.port === exposedEndpoint.port)) rules.push(exposedEndpoint);
+	}
+	return rules;
+}
+function mergeUniqueHosts(hosts, additionalHosts) {
+	const mergedHosts = [...hosts];
+	for (const host of additionalHosts) if (!mergedHosts.includes(host)) mergedHosts.push(host);
+	return mergedHosts;
+}
+function normalizeGitRepoPath(repoPath) {
+	return repoPath.replace(/^\/+/u, "").replace(/\.git$/u, "");
+}
+function createGitReadOnlySshEgressOptions(options) {
+	const allowedRepos = options.allowedRepos === void 0 ? void 0 : new Set(options.allowedRepos.map((repoPath) => normalizeGitRepoPath(repoPath)));
+	return {
+		allowedHosts: [...options.allowedHosts],
+		...options.agent ? { agent: options.agent } : {},
+		...options.knownHostsFile ? { knownHostsFile: options.knownHostsFile } : {},
+		execPolicy: (request) => {
+			const gitExec = getInfoFromSshExecRequest(request);
+			if (!gitExec) return {
+				allow: false,
+				message: "agent-vm: non-git SSH exec is denied"
+			};
+			if (gitExec.service === "git-receive-pack") return {
+				allow: false,
+				message: "agent-vm: git push over guest SSH is denied"
+			};
+			if (gitExec.service !== "git-upload-pack") return {
+				allow: false,
+				message: "agent-vm: unsupported git SSH service is denied"
+			};
+			if (allowedRepos && !allowedRepos.has(normalizeGitRepoPath(gitExec.repo))) return {
+				allow: false,
+				message: "agent-vm: git repository is not allowlisted for guest SSH reads"
+			};
+			return { allow: true };
+		}
+	};
+}
+function createInternalTcpHostPolicy(rules) {
+	if (rules.length === 0) return;
+	const ruleHostnames = new Set(rules.map((rule) => rule.hostname));
+	return (info) => {
+		const hostname = normalizePolicyHostname(info.hostname);
+		const exactRuleMatched = rules.some((rule) => rule.hostname === hostname && rule.port === info.port);
+		if (ruleHostnames.has(hostname)) return exactRuleMatched;
+		if (ipAddressIsInternal(info.ip)) return false;
+		return true;
+	};
+}
+async function createManagedVm(options, dependencies = createDefaultDependencies()) {
+	dependencies.configureHostNetworkDefaults?.();
+	const hasTcpHosts = options.tcpHosts && Object.keys(options.tcpHosts).length > 0;
+	const hasSshEgress = options.sshEgress !== void 0 && options.sshEgress.allowedHosts.length > 0;
+	const internalTcpHostRules = deriveInternalTcpHostRules(options.tcpHosts);
+	const allowedInternalHosts = mergeUniqueHosts([], internalTcpHostRules.map((rule) => rule.hostname));
+	const isIpAllowed = createInternalTcpHostPolicy(internalTcpHostRules);
+	const pinnedRealFsRoots = collectPinnedRealFsRoots(options.vfsMounts);
+	let vmInstance;
+	try {
+		const hookBundle = dependencies.createHttpHooks({
+			allowedHosts: options.allowedHosts,
+			...allowedInternalHosts.length > 0 ? { allowedInternalHosts } : {},
+			...isIpAllowed ? { isIpAllowed } : {},
+			secrets: options.secrets,
+			...options.onRequest ? { onRequest: options.onRequest } : {},
+			...options.onResponse ? { onResponse: options.onResponse } : {}
+		});
+		vmInstance = await dependencies.createVm({
+			...options.imagePath.length > 0 ? { sandbox: { imagePath: options.imagePath } } : {},
+			...options.sessionLabel ? { sessionLabel: options.sessionLabel } : {},
+			rootfs: {
+				mode: options.rootfsMode,
+				...options.runtimeRootfsSize === void 0 ? {} : { size: options.runtimeRootfsSize }
+			},
+			memory: options.memory,
+			cpus: options.cpus,
+			env: {
+				...hookBundle.env,
+				...options.env
+			},
+			httpHooks: hookBundle.httpHooks,
+			vfs: {
+				fuseMount: "/data",
+				mounts: createVfsMounts(options.vfsMounts, dependencies)
+			},
+			...hasTcpHosts || hasSshEgress ? {
+				dns: {
+					mode: "synthetic",
+					syntheticIPv4: SYNTHETIC_DNS_IPV4_BENCHMARK,
+					syntheticIPv6: SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK,
+					syntheticHostMapping: "per-host"
+				},
+				...hasSshEgress ? { ssh: options.sshEgress } : {},
+				...hasTcpHosts ? { tcp: { hosts: options.tcpHosts } } : {}
+			} : {}
+		});
+	} catch (error) {
+		closePinnedRealFsRootsAfterFailure(pinnedRealFsRoots, dependencies);
+		throw error;
+	}
+	return {
+		fs: vmInstance.fs,
+		id: vmInstance.id,
+		exec(command, execOptions) {
+			const normalizedCommand = typeof command === "string" ? command : [...command];
+			return vmInstance.exec(normalizedCommand, execOptions);
+		},
+		async enableSsh(sshOptions) {
+			const sshAccess = await vmInstance.enableSsh(sshOptions);
+			let serverHostKey;
+			try {
+				serverHostKey = await readSshServerHostKey(vmInstance);
+			} catch (identityError) {
+				return await closeSshAccessAfterIdentityFailure(sshAccess, identityError);
+			}
+			return {
+				close: async () => await sshAccess.close(),
+				command: sshAccess.command,
+				host: sshAccess.host,
+				identityFile: sshAccess.identityFile,
+				port: sshAccess.port,
+				serverHostKey,
+				user: sshAccess.user
+			};
+		},
+		async enableIngress(ingressOptions) {
+			return await vmInstance.enableIngress(resolveManagedVmIngressOptions(ingressOptions));
+		},
+		getHostPid() {
+			return vmInstance.getHostPid?.() ?? null;
+		},
+		getVmInstance() {
+			return vmInstance;
+		},
+		setIngressRoutes(routes) {
+			vmInstance.setIngressRoutes(routes);
+		},
+		async start() {
+			await vmInstance.start();
+		},
+		async close() {
+			const closeErrors = [];
+			try {
+				await vmInstance.close();
+			} catch (error) {
+				closeErrors.push(error);
+			}
+			try {
+				closePinnedRealFsRoots(pinnedRealFsRoots, dependencies);
+			} catch (error) {
+				if (error instanceof AggregateError) closeErrors.push(...error.errors);
+				else closeErrors.push(error);
+			}
+			if (closeErrors.length === 1) throw closeErrors[0];
+			if (closeErrors.length > 1) throw new AggregateError(closeErrors, "Managed Gondolin VM cleanup failed.");
+		}
+	};
+}
+//#endregion
+//#region src/managed-vm-provider.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatUnknownValue(value) {
+	return typeof value === "string" ? value : JSON.stringify(value);
+}
+function assertCreateRequestSupported(request) {
+	if (![
+		"readonly",
+		"memory",
+		"cow"
+	].includes(request.rootfsMode)) throw new Error(`Unsupported managed VM rootfs mode: ${formatUnknownValue(request.rootfsMode)}`);
+	if (!Number.isSafeInteger(request.resources.cpuCount) || request.resources.cpuCount <= 0) throw new Error("Managed VM CPU count must be a positive safe integer.");
+	if (request.imageReference.length === 0 || request.resources.memory.length === 0) throw new Error("Managed VM image reference and memory must be non-empty.");
+	if (request.sshEgress !== void 0 && request.sshEgress.kind !== "git-read-only") throw new Error(`Unsupported managed VM SSH egress kind: ${formatUnknownValue(request.sshEgress.kind)}`);
+	for (const [guestPath, mount] of Object.entries(request.mounts)) {
+		if (!guestPath.startsWith("/")) throw new Error(`Managed VM mount path must be absolute: ${guestPath}`);
+		if (![
+			"host-directory",
+			"owned-host-directory",
+			"owned-filtered-workspace",
+			"memory",
+			"shadow"
+		].includes(mount.kind)) throw new Error(`Unsupported managed VM mount kind: ${formatUnknownValue(mount.kind)}`);
+	}
+	const mediatedSecretNames = /* @__PURE__ */ new Set();
+	for (const secret of request.mediatedSecrets) {
+		if (mediatedSecretNames.has(secret.environmentVariable)) throw new Error(`Duplicate managed VM mediated-secret environment variable: ${secret.environmentVariable}`);
+		mediatedSecretNames.add(secret.environmentVariable);
+	}
+	const tcpGuestHosts = /* @__PURE__ */ new Set();
+	for (const mapping of request.tcpHosts) {
+		if (tcpGuestHosts.has(mapping.guestHost)) throw new Error(`Duplicate managed VM TCP guest host: ${mapping.guestHost}`);
+		tcpGuestHosts.add(mapping.guestHost);
+	}
+}
+function closeOwnedDirectoryTransfers(transfers) {
+	const closeErrors = [];
+	for (const transfer of transfers) try {
+		transfer.close();
+	} catch (error) {
+		closeErrors.push(error);
+	}
+	return closeErrors;
+}
+function isReadonlyStringArray(value) {
+	return Array.isArray(value);
+}
+function translateExecEnvironment(environment) {
+	return isReadonlyStringArray(environment) ? [...environment] : { ...environment };
+}
+function translateExecStdin(stdin) {
+	if (typeof stdin === "string") return stdin;
+	if (stdin instanceof Uint8Array) return Buffer.from(stdin);
+	return (async function* () {
+		for await (const chunk of stdin) yield Buffer.from(chunk);
+	})();
+}
+const MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES = 4 * 1024;
+const MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES = 16 * 1024 * 1024;
+function translateExecStreamMode(mode) {
+	if (typeof mode !== "object" || mode === null || !("kind" in mode)) throw new Error("Unsupported managed VM exec output mode.");
+	if (mode.kind === "pipe") return "pipe";
+	if (mode.kind === "discard") return "ignore";
+	throw new Error("Unsupported managed VM exec output mode.");
+}
+function translateExecStreamingOptions(output) {
+	if (!Number.isInteger(output.windowBytes) || output.windowBytes < MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES || output.windowBytes > MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES) throw new Error(`Managed VM exec output window must be an integer between ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES)} and ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES)} bytes.`);
+	return {
+		stderr: translateExecStreamMode(output.stderr),
+		stdout: translateExecStreamMode(output.stdout),
+		windowBytes: output.windowBytes
+	};
+}
+function translateExecOptions(options) {
+	return {
+		...options.argv ? { argv: [...options.argv] } : {},
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.env ? { env: translateExecEnvironment(options.env) } : {},
+		...options.output === void 0 ? {} : translateExecStreamingOptions(options.output),
+		...options.pty === void 0 ? {} : { pty: options.pty },
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdin === void 0 ? {} : { stdin: translateExecStdin(options.stdin) }
+	};
+}
+function wrapExecProcess(nativeProcess) {
+	const result = nativeProcess.result;
+	return Object.assign(result, {
+		[Symbol.asyncIterator]() {
+			return nativeProcess[Symbol.asyncIterator]();
+		},
+		end() {
+			nativeProcess.end();
+		},
+		lines() {
+			return nativeProcess.lines();
+		},
+		output() {
+			return nativeProcess.output();
+		},
+		resize(rows, columns) {
+			nativeProcess.resize(rows, columns);
+		},
+		result,
+		write(data) {
+			nativeProcess.write(typeof data === "string" ? data : Buffer.from(data));
+		}
+	});
+}
+async function assertReadonlyInputSourcesStayWithinOwnedRoot(pinnedRoot, policy) {
+	const canonicalRootPrefix = pinnedRoot.realPath.endsWith(path.sep) ? pinnedRoot.realPath : `${pinnedRoot.realPath}${path.sep}`;
+	await Promise.all(policy.readonlyInputs.map(async (readonlyInput) => {
+		const sourcePath = path.join(pinnedRoot.realPath, ...readonlyInput.sourceRelativePath.split("/"));
+		const canonicalSourcePath = await fs.realpath(sourcePath);
+		if (canonicalSourcePath !== pinnedRoot.realPath && !canonicalSourcePath.startsWith(canonicalRootPrefix)) throw new Error(`Managed filtered workspace read-only source crosses the owned root boundary: ${readonlyInput.sourceRelativePath}`);
+	}));
+}
+async function translateMounts(mounts, ownedDirectoryRoots) {
+	const translatedMounts = {};
+	const transfers = [];
+	const sourceValidations = [];
+	try {
+		for (const [guestPath, mount] of Object.entries(mounts)) switch (mount.kind) {
+			case "host-directory":
+				translatedMounts[guestPath] = {
+					hostPath: mount.hostPath,
+					kind: mount.access === "read-only" ? "realfs-readonly" : "realfs"
+				};
+				break;
+			case "owned-host-directory": {
+				const pinnedRoot = ownedDirectoryRoots.get(mount.directory);
+				if (!pinnedRoot) throw new Error("Owned host directory was not acquired by this Gondolin provider.");
+				assertPinnedRealFsRoot(pinnedRoot);
+				transfers.push(mount.directory.consume());
+				ownedDirectoryRoots.delete(mount.directory);
+				translatedMounts[guestPath] = {
+					kind: mount.access === "read-only" ? "realfs-readonly" : "realfs",
+					pinnedHostRoot: pinnedRoot
+				};
+				break;
+			}
+			case "owned-filtered-workspace": {
+				const pinnedRoot = ownedDirectoryRoots.get(mount.directory);
+				if (!pinnedRoot) throw new Error("Owned host directory was not acquired by this Gondolin provider.");
+				assertPinnedRealFsRoot(pinnedRoot);
+				transfers.push(mount.directory.consume());
+				ownedDirectoryRoots.delete(mount.directory);
+				const policy = validateManagedVmFilteredWorkspacePolicy(mount.policy);
+				sourceValidations.push({
+					pinnedRoot,
+					policy
+				});
+				translatedMounts[guestPath] = {
+					kind: "filtered-workspace",
+					pinnedHostRoot: pinnedRoot,
+					policy
+				};
+				break;
+			}
+			case "memory":
+				translatedMounts[guestPath] = { kind: "memory" };
+				break;
+			case "shadow":
+				translatedMounts[guestPath] = {
+					hostPath: mount.hostPath,
+					kind: "shadow",
+					shadowConfig: {
+						deny: mount.deny,
+						tmpfs: mount.temporaryFilesystems
+					}
+				};
+				break;
+		}
+		await Promise.all(sourceValidations.map(({ pinnedRoot, policy }) => assertReadonlyInputSourcesStayWithinOwnedRoot(pinnedRoot, policy)));
+	} catch (error) {
+		const closeErrors = closeOwnedDirectoryTransfers(transfers);
+		if (closeErrors.length > 0) throw new AggregateError([error, ...closeErrors], "Managed VM mount translation and owned-directory cleanup both failed.", { cause: error });
+		throw error;
+	}
+	return {
+		mounts: translatedMounts,
+		transfers
+	};
+}
+function wrapManagedVm(nativeVm, ownedDirectoryTransfers) {
+	let closePromise;
+	let hostProcessId = null;
+	let lifecycleState = "created";
+	let startPromise;
+	const closeOnce = async () => {
+		if (startPromise) try {
+			await startPromise;
+		} catch {}
+		const closeErrors = [];
+		try {
+			await nativeVm.close();
+		} catch (error) {
+			closeErrors.push(error);
+		}
+		closeErrors.push(...closeOwnedDirectoryTransfers(ownedDirectoryTransfers));
+		try {
+			if (closeErrors.length === 1) throw closeErrors[0];
+			if (closeErrors.length > 1) throw new AggregateError(closeErrors, "Managed VM cleanup failed.");
+		} finally {
+			hostProcessId = null;
+			lifecycleState = "closed";
+		}
+	};
+	return {
+		async close() {
+			if (!closePromise) {
+				lifecycleState = "closing";
+				closePromise = closeOnce();
+			}
+			await closePromise;
+		},
+		configureIngressRoutes(routes) {
+			nativeVm.setIngressRoutes(routes.map((route) => ({
+				port: route.port,
+				prefix: route.prefix,
+				stripPrefix: route.stripPrefix
+			})));
+		},
+		async enableIngress(options) {
+			return await nativeVm.enableIngress(options);
+		},
+		async enableSsh(options) {
+			const access = await nativeVm.enableSsh(options);
+			if (!access.command || !access.identityFile || !access.user) {
+				await access.close();
+				throw new Error("Gondolin SSH access omitted required neutral connection fields.");
+			}
+			return {
+				close: async () => await access.close(),
+				command: access.command,
+				host: access.host,
+				identityFile: access.identityFile,
+				port: access.port,
+				serverHostKey: access.serverHostKey,
+				user: access.user
+			};
+		},
+		exec(command, options) {
+			const normalizedCommand = typeof command === "string" ? command : [...command];
+			return wrapExecProcess(nativeVm.exec(normalizedCommand, options ? translateExecOptions(options) : void 0));
+		},
+		getHostProcessId() {
+			if (hostProcessId === null) return null;
+			const currentHostProcessId = nativeVm.getHostPid();
+			if (currentHostProcessId === null) return null;
+			if (currentHostProcessId !== hostProcessId) throw new Error(`Gondolin runner identity changed for managed VM '${nativeVm.id}': expected pid ${String(hostProcessId)}, observed ${String(currentHostProcessId)}.`);
+			return hostProcessId;
+		},
+		id: nativeVm.id,
+		async start() {
+			if (lifecycleState === "closing" || lifecycleState === "closed") throw new Error("Managed VM cannot start after close has been requested.");
+			if (lifecycleState === "started") return;
+			if (!startPromise) {
+				lifecycleState = "starting";
+				startPromise = (async () => {
+					try {
+						await nativeVm.start();
+						const startedHostProcessId = assertPositiveHostProcessId(nativeVm.getHostPid());
+						if (lifecycleState !== "starting") throw new Error("Managed VM closed while startup was settling.");
+						hostProcessId = startedHostProcessId;
+						lifecycleState = "started";
+					} catch (error) {
+						if (lifecycleState === "starting") lifecycleState = "start-failed";
+						throw error;
+					}
+				})();
+			}
+			await startPromise;
+		}
+	};
+}
+function openOwnedHostDirectory(hostPath, ownedDirectoryRoots) {
+	const pinnedRoot = pinRealFsRoot(hostPath);
+	const directory = createOwnedHostDirectoryController({
+		identity: {
+			canonicalPath: pinnedRoot.realPath,
+			device: pinnedRoot.device,
+			inode: pinnedRoot.inode
+		},
+		onClose: () => closePinnedRealFsRoot(pinnedRoot),
+		onConsume: () => assertPinnedRealFsRoot(pinnedRoot)
+	});
+	ownedDirectoryRoots.set(directory, pinnedRoot);
+	return directory;
+}
+function createGondolinManagedVmProvider() {
+	const ownedDirectoryRoots = /* @__PURE__ */ new WeakMap();
+	return {
+		diagnostics: { async checkCompatibility() {
+			const diagnostics = [];
+			try {
+				await Promise.all([resolveGondolinPackageSpec(), resolveGondolinMinimumZigVersion()]);
+			} catch (error) {
+				diagnostics.push({
+					code: "gondolin-toolchain-unavailable",
+					message: error instanceof Error ? error.message : String(error),
+					severity: "error"
+				});
+			}
+			return diagnostics;
+		} },
+		exactProcessTermination: createGondolinExactProcessTerminationCapability(),
+		factory: { async createManagedVm(request) {
+			assertCreateRequestSupported(request);
+			const secrets = Object.fromEntries(request.mediatedSecrets.map((secret) => [secret.environmentVariable, {
+				hosts: [...secret.allowedHosts],
+				...secret.guestPlaceholder === void 0 ? {} : { placeholder: secret.guestPlaceholder },
+				value: secret.value
+			}]));
+			const tcpHosts = Object.fromEntries(request.tcpHosts.map((mapping) => [mapping.guestHost, mapping.target]));
+			const translatedMounts = await translateMounts(request.mounts, ownedDirectoryRoots);
+			let nativeVm;
+			try {
+				nativeVm = await createManagedVm({
+					allowedHosts: [...request.allowedHosts],
+					cpus: request.resources.cpuCount,
+					env: { ...request.environment },
+					imagePath: request.imageReference,
+					memory: request.resources.memory,
+					...request.mediation?.onRequest ? { onRequest: request.mediation.onRequest } : {},
+					...request.mediation?.onResponse ? { onResponse: request.mediation.onResponse } : {},
+					rootfsMode: request.rootfsMode,
+					...request.runtimeRootfsSize ? { runtimeRootfsSize: request.runtimeRootfsSize } : {},
+					secrets,
+					sessionLabel: request.sessionLabel,
+					...request.sshEgress ? { sshEgress: createGitReadOnlySshEgressOptions({
+						allowedHosts: request.sshEgress.allowedHosts,
+						...request.sshEgress.agentSocket ? { agent: request.sshEgress.agentSocket } : {},
+						...request.sshEgress.allowedRepositories ? { allowedRepos: request.sshEgress.allowedRepositories } : {},
+						...request.sshEgress.knownHostsFile ? { knownHostsFile: request.sshEgress.knownHostsFile } : {}
+					}) } : {},
+					tcpHosts,
+					vfsMounts: translatedMounts.mounts
+				});
+			} catch (error) {
+				const closeErrors = closeOwnedDirectoryTransfers(translatedMounts.transfers);
+				if (closeErrors.length > 0) throw new AggregateError([error, ...closeErrors], "Managed VM construction and owned-directory cleanup both failed.", { cause: error });
+				throw error;
+			}
+			return wrapManagedVm(nativeVm, translatedMounts.transfers);
+		} },
+		images: { async prepareImage(request) {
+			const parseErrors = [];
+			const parsedRecipe = parse(await fs.readFile(request.recipePath, "utf8"), parseErrors, { allowTrailingComma: true });
+			if (parseErrors.length > 0) throw new Error(`Invalid managed VM image recipe '${request.recipePath}': ${parseErrors.map((parseError) => printParseErrorCode(parseError.error)).join(", ")}`);
+			if (!isRecord(parsedRecipe) || !validateBuildConfig(parsedRecipe)) throw new Error(`Managed VM image recipe has an invalid build shape: ${request.recipePath}`);
+			const result = await buildImage({
+				buildConfig: parsedRecipe,
+				cacheDir: request.cacheDirectory,
+				configDir: path.dirname(request.recipePath),
+				...request.forceRebuild === void 0 ? {} : { fullReset: request.forceRebuild }
+			});
+			return {
+				built: result.built,
+				fingerprint: result.fingerprint,
+				imageReference: result.imagePath
+			};
+		} },
+		ownedDirectories: { openHostDirectory: (hostPath) => openOwnedHostDirectory(hostPath, ownedDirectoryRoots) }
+	};
+}
+//#endregion
+export { buildImageAssetFileNames, configureHostNetworkDefaults, createGondolinImageBuildTooling, createGondolinManagedVmProvider, hasBuiltImageAssets, resolveGondolinMinimumZigVersion, resolveGondolinPackageSpec };
+
+//# sourceMappingURL=index.js.map