@isol8/core 0.13.0-alpha.0

package/dist/index.js

@@ -0,0 +1,2777 @@
+import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __toESM = (mod, isNodeMode, target) => {
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: () => mod[key],
+        enumerable: true
+      });
+  return to;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: (newValue) => all[name] = () => newValue
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/runtime/adapter.ts
+var adapters, extensionMap, RuntimeRegistry;
+var init_adapter = __esm(() => {
+  adapters = new Map;
+  extensionMap = new Map;
+  RuntimeRegistry = {
+    register(adapter, aliases = []) {
+      adapters.set(adapter.name, adapter);
+      extensionMap.set(adapter.getFileExtension(), adapter);
+      for (const ext of aliases) {
+        extensionMap.set(ext, adapter);
+      }
+    },
+    get(name) {
+      const adapter = adapters.get(name);
+      if (!adapter) {
+        throw new Error(`Unknown runtime: "${name}". Available: ${[...adapters.keys()].join(", ")}`);
+      }
+      return adapter;
+    },
+    detect(filename) {
+      const ext = `.${filename.split(".").pop()}`;
+      const adapter = extensionMap.get(ext);
+      if (!adapter) {
+        throw new Error(`Cannot detect runtime for "${filename}". Known extensions: ${[...extensionMap.keys()].join(", ")}`);
+      }
+      return adapter;
+    },
+    list() {
+      return [...adapters.values()];
+    }
+  };
+});
+
+// src/runtime/adapters/bash.ts
+var bashAdapter;
+var init_bash = __esm(() => {
+  bashAdapter = {
+    name: "bash",
+    image: "isol8:bash",
+    getCommand(code, filePath) {
+      if (filePath) {
+        return ["bash", filePath];
+      }
+      return ["bash", "-c", code];
+    },
+    getFileExtension() {
+      return ".sh";
+    }
+  };
+});
+
+// src/runtime/adapters/bun.ts
+var BunAdapter;
+var init_bun = __esm(() => {
+  BunAdapter = {
+    name: "bun",
+    image: "isol8:bun",
+    getCommand(code, filePath) {
+      if (filePath) {
+        return ["bun", "run", filePath];
+      }
+      return ["bun", "-e", code];
+    },
+    getFileExtension() {
+      return ".ts";
+    }
+  };
+});
+
+// src/runtime/adapters/deno.ts
+var DenoAdapter;
+var init_deno = __esm(() => {
+  DenoAdapter = {
+    name: "deno",
+    image: "isol8:deno",
+    getCommand(_code, filePath) {
+      if (!filePath) {
+        throw new Error("Deno adapter requires a file path — inline code is not supported.");
+      }
+      return [
+        "deno",
+        "run",
+        "--allow-read=/sandbox,/tmp",
+        "--allow-write=/sandbox,/tmp",
+        "--allow-env",
+        "--allow-net",
+        filePath
+      ];
+    },
+    getFileExtension() {
+      return ".mts";
+    }
+  };
+});
+
+// src/runtime/adapters/node.ts
+var NodeAdapter;
+var init_node = __esm(() => {
+  NodeAdapter = {
+    name: "node",
+    image: "isol8:node",
+    getCommand(code, filePath) {
+      if (filePath) {
+        return ["node", filePath];
+      }
+      return ["node", "-e", code];
+    },
+    getFileExtension() {
+      return ".mjs";
+    }
+  };
+});
+
+// src/runtime/adapters/python.ts
+var PythonAdapter;
+var init_python = __esm(() => {
+  PythonAdapter = {
+    name: "python",
+    image: "isol8:python",
+    getCommand(code, filePath) {
+      if (filePath) {
+        return ["python3", filePath];
+      }
+      return ["python3", "-c", code];
+    },
+    getFileExtension() {
+      return ".py";
+    }
+  };
+});
+
+// src/runtime/index.ts
+var init_runtime = __esm(() => {
+  init_adapter();
+  init_bash();
+  init_bun();
+  init_deno();
+  init_node();
+  init_python();
+  init_adapter();
+  init_bash();
+  init_bun();
+  init_deno();
+  init_node();
+  init_python();
+  RuntimeRegistry.register(PythonAdapter);
+  RuntimeRegistry.register(NodeAdapter, [".js", ".cjs"]);
+  RuntimeRegistry.register(BunAdapter);
+  RuntimeRegistry.register(bashAdapter);
+  RuntimeRegistry.register(DenoAdapter);
+});
+
+// src/utils/logger.ts
+class Logger {
+  debugMode = false;
+  setDebug(enabled) {
+    this.debugMode = enabled;
+  }
+  debug(...args) {
+    if (this.debugMode) {
+      console.log("[DEBUG]", ...args);
+    }
+  }
+  info(...args) {
+    console.log(...args);
+  }
+  warn(...args) {
+    console.warn("[WARN]", ...args);
+  }
+  error(...args) {
+    console.error("[ERROR]", ...args);
+  }
+}
+var logger;
+var init_logger = __esm(() => {
+  logger = new Logger;
+});
+
+// src/engine/utils.ts
+var exports_utils = {};
+__export(exports_utils, {
+  validatePackageName: () => validatePackageName,
+  truncateOutput: () => truncateOutput,
+  parseMemoryLimit: () => parseMemoryLimit,
+  maskSecrets: () => maskSecrets,
+  extractFromTar: () => extractFromTar,
+  createTarBuffer: () => createTarBuffer
+});
+function parseMemoryLimit(limit) {
+  const match = limit.match(/^(\d+(?:\.\d+)?)\s*([kmgt]?)b?$/i);
+  if (!match) {
+    throw new Error(`Invalid memory limit format: "${limit}". Use e.g. "512m", "1g".`);
+  }
+  const value = Number.parseFloat(match[1]);
+  const unit = (match[2] || "b").toLowerCase();
+  const multipliers = {
+    b: 1,
+    k: 1024,
+    m: 1024 ** 2,
+    g: 1024 ** 3,
+    t: 1024 ** 4
+  };
+  return Math.floor(value * (multipliers[unit] ?? 1));
+}
+function truncateOutput(output, maxBytes) {
+  const encoder = new TextEncoder;
+  const bytes = encoder.encode(output);
+  if (bytes.length <= maxBytes) {
+    return { text: output, truncated: false };
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+  const truncated = decoder.decode(bytes.slice(0, maxBytes));
+  return {
+    text: `${truncated}
+
+--- OUTPUT TRUNCATED (${bytes.length} bytes, limit: ${maxBytes}) ---`,
+    truncated: true
+  };
+}
+function maskSecrets(text, secrets) {
+  let result = text;
+  for (const value of Object.values(secrets)) {
+    if (value.length > 0) {
+      result = result.replaceAll(value, "***");
+    }
+  }
+  return result;
+}
+function createTarBuffer(filePath, content) {
+  const data = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
+  const headerSize = 512;
+  const dataBlocks = Math.ceil(data.length / 512);
+  const totalSize = headerSize + dataBlocks * 512 + 1024;
+  const buf = Buffer.alloc(totalSize);
+  buf.write(filePath.replace(/^\//, ""), 0, 100, "utf-8");
+  buf.write("0000644\x00", 100, 8, "utf-8");
+  buf.write("0000000\x00", 108, 8, "utf-8");
+  buf.write("0000000\x00", 116, 8, "utf-8");
+  buf.write(`${data.length.toString(8).padStart(11, "0")}\x00`, 124, 12, "utf-8");
+  buf.write(`${Math.floor(Date.now() / 1000).toString(8).padStart(11, "0")}\x00`, 136, 12, "utf-8");
+  buf.write("0", 156, 1, "utf-8");
+  buf.write("ustar\x00", 257, 6, "utf-8");
+  buf.write("00", 263, 2, "utf-8");
+  buf.write("        ", 148, 8, "utf-8");
+  let checksum = 0;
+  for (let i = 0;i < headerSize; i++) {
+    checksum += buf[i];
+  }
+  buf.write(`${checksum.toString(8).padStart(6, "0")}\x00 `, 148, 8, "utf-8");
+  data.copy(buf, headerSize);
+  return buf;
+}
+function extractFromTar(tarBuffer, targetPath) {
+  const normalizedTarget = targetPath.replace(/^\//, "");
+  const basename = targetPath.split("/").pop() ?? targetPath;
+  let offset = 0;
+  while (offset < tarBuffer.length - 512) {
+    const nameEnd = tarBuffer.indexOf(0, offset);
+    const name = tarBuffer.subarray(offset, Math.min(nameEnd, offset + 100)).toString("utf-8");
+    if (name.length === 0) {
+      break;
+    }
+    const sizeStr = tarBuffer.subarray(offset + 124, offset + 136).toString("utf-8").trim();
+    const size = Number.parseInt(sizeStr, 8);
+    if (Number.isNaN(size)) {
+      break;
+    }
+    const dataStart = offset + 512;
+    const dataBlocks = Math.ceil(size / 512);
+    if (name === normalizedTarget || name.endsWith(`/${normalizedTarget}`) || name === basename) {
+      return Buffer.from(tarBuffer.subarray(dataStart, dataStart + size));
+    }
+    offset = dataStart + dataBlocks * 512;
+  }
+  throw new Error(`File "${targetPath}" not found in tar archive`);
+}
+function validatePackageName(name) {
+  if (!/^[@a-zA-Z0-9_./\-=]+$/.test(name)) {
+    throw new Error(`Invalid package name: "${name}". Only alphanumeric, -, _, ., /, @, and = are allowed.`);
+  }
+  return name;
+}
+
+// src/engine/image-builder.ts
+var exports_image_builder = {};
+__export(exports_image_builder, {
+  normalizePackages: () => normalizePackages,
+  imageExists: () => imageExists,
+  getCustomImageTag: () => getCustomImageTag,
+  ensureImages: () => ensureImages,
+  buildCustomImages: () => buildCustomImages,
+  buildCustomImage: () => buildCustomImage,
+  buildBaseImages: () => buildBaseImages
+});
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+function resolveDockerDir() {
+  const fromExec = join3(dirname(process.execPath), "docker");
+  if (existsSync3(fromExec) && statSync2(fromExec).isDirectory()) {
+    return fromExec;
+  }
+  if (!import.meta.url.includes("$bunfs")) {
+    const fromBundled = new URL("./docker", import.meta.url).pathname;
+    if (existsSync3(fromBundled)) {
+      return fromBundled;
+    }
+  }
+  if (!import.meta.url.includes("$bunfs")) {
+    const fromDev = new URL("../../docker", import.meta.url).pathname;
+    if (existsSync3(fromDev)) {
+      return fromDev;
+    }
+  }
+  const fromCwd = join3(process.cwd(), "docker");
+  if (existsSync3(fromCwd)) {
+    return fromCwd;
+  }
+  return new URL("../../docker", import.meta.url).pathname;
+}
+function computeDockerDirHash() {
+  const hash = createHash2("sha256");
+  const files = [...DOCKER_BUILD_FILES].sort();
+  for (const file of files) {
+    const filePath = join3(DOCKERFILE_DIR, file);
+    if (existsSync3(filePath)) {
+      const content = readFileSync2(filePath);
+      hash.update(file);
+      hash.update(content);
+    }
+  }
+  return hash.digest("hex");
+}
+function computeDepsHash(runtime, packages) {
+  const hash = createHash2("sha256");
+  hash.update(runtime);
+  for (const pkg of [...packages].sort()) {
+    hash.update(pkg);
+  }
+  return hash.digest("hex");
+}
+function normalizePackages(packages) {
+  return [...new Set(packages.map((pkg) => pkg.trim()).filter(Boolean))].sort();
+}
+function getCustomImageTag(runtime, packages) {
+  const normalizedPackages = normalizePackages(packages);
+  const depsHash = computeDepsHash(runtime, normalizedPackages);
+  const shortHash = depsHash.slice(0, 12);
+  return `isol8:${runtime}-custom-${shortHash}`;
+}
+async function getImageLabels(docker, imageName) {
+  try {
+    const image = docker.getImage(imageName);
+    const inspect = await image.inspect();
+    return inspect.Config?.Labels ?? {};
+  } catch {
+    return null;
+  }
+}
+async function removeImage(docker, imageId) {
+  try {
+    const image = docker.getImage(imageId);
+    await image.remove();
+    logger.debug(`[ImageBuilder] Removed old image: ${imageId.slice(0, 12)}`);
+  } catch (err) {
+    logger.debug(`[ImageBuilder] Could not remove image ${imageId.slice(0, 12)}: ${err}`);
+  }
+}
+async function buildBaseImages(docker, onProgress, force = false, onlyRuntimes) {
+  const allRuntimes = RuntimeRegistry.list();
+  const runtimes = onlyRuntimes ? allRuntimes.filter((r) => onlyRuntimes.includes(r.name)) : allRuntimes;
+  const dockerHash = computeDockerDirHash();
+  logger.debug(`[ImageBuilder] Docker directory hash: ${dockerHash.slice(0, 16)}...`);
+  for (const adapter of runtimes) {
+    const target = adapter.name;
+    const imageName = adapter.image;
+    if (!force) {
+      const labels = await getImageLabels(docker, imageName);
+      if (labels && labels[LABELS.dockerHash] === dockerHash) {
+        logger.debug(`[ImageBuilder] Base image ${target} is up to date, skipping build`);
+        onProgress?.({ runtime: target, status: "done", message: "Up to date" });
+        continue;
+      }
+    }
+    let oldImageId = null;
+    try {
+      const oldImage = await docker.getImage(imageName).inspect();
+      oldImageId = oldImage.Id;
+      logger.debug(`[ImageBuilder] Existing image ${target} ID: ${oldImageId.slice(0, 12)}`);
+    } catch {
+      logger.debug(`[ImageBuilder] No existing image for ${target}`);
+    }
+    onProgress?.({ runtime: target, status: "building" });
+    try {
+      const stream = await docker.buildImage({ context: DOCKERFILE_DIR, src: DOCKER_BUILD_FILES }, {
+        t: imageName,
+        target,
+        dockerfile: "Dockerfile",
+        labels: {
+          [LABELS.dockerHash]: dockerHash
+        }
+      });
+      await new Promise((resolve2, reject) => {
+        docker.modem.followProgress(stream, (err) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve2();
+          }
+        });
+      });
+      if (oldImageId) {
+        await removeImage(docker, oldImageId);
+      }
+      onProgress?.({ runtime: target, status: "done" });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      onProgress?.({ runtime: target, status: "error", message });
+      throw new Error(`Failed to build image for ${target}: ${message}`);
+    }
+  }
+}
+async function buildCustomImages(docker, config, onProgress, force = false) {
+  const deps = config.dependencies;
+  const python = deps.python ? normalizePackages(deps.python) : [];
+  const node = deps.node ? normalizePackages(deps.node) : [];
+  const bun = deps.bun ? normalizePackages(deps.bun) : [];
+  const deno = deps.deno ? normalizePackages(deps.deno) : [];
+  const bash = deps.bash ? normalizePackages(deps.bash) : [];
+  if (python.length) {
+    await buildCustomImage(docker, "python", python, onProgress, force);
+  }
+  if (node.length) {
+    await buildCustomImage(docker, "node", node, onProgress, force);
+  }
+  if (bun.length) {
+    await buildCustomImage(docker, "bun", bun, onProgress, force);
+  }
+  if (deno.length) {
+    await buildCustomImage(docker, "deno", deno, onProgress, force);
+  }
+  if (bash.length) {
+    await buildCustomImage(docker, "bash", bash, onProgress, force);
+  }
+}
+async function buildCustomImage(docker, runtime, packages, onProgress, force = false) {
+  const normalizedPackages = normalizePackages(packages);
+  const tag = getCustomImageTag(runtime, normalizedPackages);
+  const depsHash = computeDepsHash(runtime, normalizedPackages);
+  logger.debug(`[ImageBuilder] ${runtime} custom deps hash: ${depsHash.slice(0, 16)}...`);
+  if (!force) {
+    const labels = await getImageLabels(docker, tag);
+    if (labels && labels[LABELS.depsHash] === depsHash) {
+      logger.debug(`[ImageBuilder] Custom image ${runtime} is up to date, skipping build`);
+      onProgress?.({ runtime, status: "done", message: "Up to date" });
+      return;
+    }
+  }
+  let oldImageId = null;
+  try {
+    const oldImage = await docker.getImage(tag).inspect();
+    oldImageId = oldImage.Id;
+    logger.debug(`[ImageBuilder] Existing custom image ${runtime} ID: ${oldImageId.slice(0, 12)}`);
+  } catch {
+    logger.debug(`[ImageBuilder] No existing custom image for ${runtime}`);
+  }
+  onProgress?.({
+    runtime,
+    status: "building",
+    message: `Custom: ${normalizedPackages.join(", ")}`
+  });
+  let installCmd;
+  switch (runtime) {
+    case "python":
+      installCmd = `RUN pip install --no-cache-dir ${normalizedPackages.join(" ")}`;
+      break;
+    case "node":
+      installCmd = `RUN npm install -g ${normalizedPackages.join(" ")}`;
+      break;
+    case "bun":
+      installCmd = `RUN bun install -g ${normalizedPackages.join(" ")}`;
+      break;
+    case "deno":
+      installCmd = normalizedPackages.map((p) => `RUN deno cache ${p}`).join(`
+`);
+      break;
+    case "bash":
+      installCmd = `RUN apk add --no-cache ${normalizedPackages.join(" ")}`;
+      break;
+    default:
+      throw new Error(`Unknown runtime: ${runtime}`);
+  }
+  const dockerfileContent = `FROM isol8:${runtime}
+${installCmd}
+`;
+  const { createTarBuffer: createTarBuffer2, validatePackageName: validatePackageName2 } = await Promise.resolve().then(() => exports_utils);
+  const { Readable } = await import("node:stream");
+  normalizedPackages.forEach(validatePackageName2);
+  const tarBuffer = createTarBuffer2("Dockerfile", dockerfileContent);
+  const stream = await docker.buildImage(Readable.from(tarBuffer), {
+    t: tag,
+    dockerfile: "Dockerfile",
+    labels: {
+      [LABELS.depsHash]: depsHash
+    }
+  });
+  await new Promise((resolve2, reject) => {
+    docker.modem.followProgress(stream, (err) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve2();
+      }
+    });
+  });
+  if (oldImageId) {
+    await removeImage(docker, oldImageId);
+  }
+  onProgress?.({ runtime, status: "done" });
+}
+async function imageExists(docker, imageName) {
+  try {
+    await docker.getImage(imageName).inspect();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureImages(docker, onProgress) {
+  const runtimes = RuntimeRegistry.list();
+  const missing = [];
+  for (const adapter of runtimes) {
+    if (!await imageExists(docker, adapter.image)) {
+      missing.push(adapter.name);
+    }
+  }
+  if (missing.length > 0) {
+    await buildBaseImages(docker, onProgress, false, missing);
+  }
+}
+var DOCKERFILE_DIR, LABELS, DOCKER_BUILD_FILES;
+var init_image_builder = __esm(() => {
+  init_runtime();
+  init_logger();
+  DOCKERFILE_DIR = resolveDockerDir();
+  LABELS = {
+    dockerHash: "org.isol8.build.hash",
+    depsHash: "org.isol8.deps.hash"
+  };
+  DOCKER_BUILD_FILES = ["Dockerfile", "proxy.sh", "proxy-handler.sh"];
+});
+
+// src/client/remote.ts
+class RemoteIsol8 {
+  host;
+  apiKey;
+  sessionId;
+  isol8Options;
+  constructor(options, isol8Options) {
+    this.host = options.host.replace(/\/$/, "");
+    this.apiKey = options.apiKey;
+    this.sessionId = options.sessionId;
+    this.isol8Options = isol8Options;
+  }
+  async start(_options) {
+    const res = await this.fetch("/health");
+    if (!res.ok) {
+      throw new Error(`Remote server health check failed: ${res.status}`);
+    }
+  }
+  async stop() {
+    if (this.sessionId) {
+      await this.fetch(`/session/${this.sessionId}`, { method: "DELETE" });
+    }
+  }
+  async execute(req) {
+    const res = await this.fetch("/execute", {
+      method: "POST",
+      body: JSON.stringify({
+        request: req,
+        options: this.isol8Options,
+        sessionId: this.sessionId
+      })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new Error(`Execution failed: ${body.error ?? res.statusText}`);
+    }
+    return res.json();
+  }
+  async* executeStream(req) {
+    const res = await this.fetch("/execute/stream", {
+      method: "POST",
+      body: JSON.stringify({
+        request: req,
+        options: this.isol8Options,
+        sessionId: this.sessionId
+      })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new Error(`Stream failed: ${body.error ?? res.statusText}`);
+    }
+    if (!res.body) {
+      throw new Error("No response body for streaming");
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder;
+    let buffer = "";
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split(`
+`);
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          if (line.startsWith("data: ")) {
+            const json = line.slice(6).trim();
+            if (json) {
+              yield JSON.parse(json);
+            }
+          }
+        }
+      }
+      if (buffer.startsWith("data: ")) {
+        const json = buffer.slice(6).trim();
+        if (json) {
+          yield JSON.parse(json);
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  async putFile(path, content) {
+    if (!this.sessionId) {
+      throw new Error("File operations require a sessionId (persistent mode)");
+    }
+    const base64 = typeof content === "string" ? Buffer.from(content).toString("base64") : content.toString("base64");
+    const res = await this.fetch("/file", {
+      method: "POST",
+      body: JSON.stringify({
+        sessionId: this.sessionId,
+        path,
+        content: base64
+      })
+    });
+    if (!res.ok) {
+      throw new Error(`File upload failed: ${res.statusText}`);
+    }
+  }
+  async getFile(path) {
+    if (!this.sessionId) {
+      throw new Error("File operations require a sessionId (persistent mode)");
+    }
+    const params = new URLSearchParams({ sessionId: this.sessionId, path });
+    const res = await this.fetch(`/file?${params}`);
+    if (!res.ok) {
+      throw new Error(`File download failed: ${res.statusText}`);
+    }
+    const body = await res.json();
+    return Buffer.from(body.content, "base64");
+  }
+  async fetch(path, init) {
+    return globalThis.fetch(`${this.host}${path}`, {
+      ...init,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.apiKey}`,
+        ...init?.headers ?? {}
+      }
+    });
+  }
+}
+// src/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+var DEFAULT_CONFIG = {
+  maxConcurrent: 10,
+  defaults: {
+    timeoutMs: 30000,
+    memoryLimit: "512m",
+    cpuLimit: 1,
+    network: "none",
+    sandboxSize: "512m",
+    tmpSize: "256m",
+    readonlyRootFs: true
+  },
+  network: {
+    whitelist: [],
+    blacklist: []
+  },
+  cleanup: {
+    autoPrune: true,
+    maxContainerAgeMs: 3600000
+  },
+  poolStrategy: "fast",
+  poolSize: { clean: 1, dirty: 1 },
+  dependencies: {},
+  security: {
+    seccomp: "strict"
+  },
+  remoteCode: {
+    enabled: false,
+    allowedSchemes: ["https"],
+    allowedHosts: [],
+    blockedHosts: [
+      "^localhost$",
+      "^127(?:\\.[0-9]{1,3}){3}$",
+      "^\\[::1\\]$",
+      "^::1$",
+      "^10(?:\\.[0-9]{1,3}){3}$",
+      "^172\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\.[0-9]{1,3}){2}$",
+      "^192\\.168(?:\\.[0-9]{1,3}){2}$",
+      "^169\\.254(?:\\.[0-9]{1,3}){2}$",
+      "^metadata\\.google\\.internal$",
+      "^169\\.254\\.169\\.254$"
+    ],
+    maxCodeSize: 10 * 1024 * 1024,
+    fetchTimeoutMs: 30000,
+    requireHash: false,
+    enableCache: true,
+    cacheTtl: 3600
+  },
+  audit: {
+    enabled: false,
+    destination: "filesystem",
+    logDir: undefined,
+    postLogScript: undefined,
+    trackResources: true,
+    retentionDays: 90,
+    includeCode: false,
+    includeOutput: false
+  },
+  debug: false
+};
+function loadConfig(cwd) {
+  const searchPaths = [
+    join(resolve(cwd ?? process.cwd()), "isol8.config.json"),
+    join(homedir(), ".isol8", "config.json")
+  ];
+  for (const configPath of searchPaths) {
+    if (existsSync(configPath)) {
+      const raw = readFileSync(configPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      return mergeConfig(DEFAULT_CONFIG, parsed);
+    }
+  }
+  return { ...DEFAULT_CONFIG };
+}
+function mergeConfig(defaults, overrides) {
+  return {
+    maxConcurrent: overrides.maxConcurrent ?? defaults.maxConcurrent,
+    defaults: {
+      ...defaults.defaults,
+      ...overrides.defaults,
+      readonlyRootFs: overrides.defaults?.readonlyRootFs ?? defaults.defaults.readonlyRootFs
+    },
+    network: {
+      whitelist: overrides.network?.whitelist ?? defaults.network.whitelist,
+      blacklist: overrides.network?.blacklist ?? defaults.network.blacklist
+    },
+    cleanup: {
+      ...defaults.cleanup,
+      ...overrides.cleanup
+    },
+    poolStrategy: overrides.poolStrategy ?? defaults.poolStrategy,
+    poolSize: overrides.poolSize ?? defaults.poolSize,
+    dependencies: {
+      ...defaults.dependencies,
+      ...overrides.dependencies
+    },
+    security: {
+      seccomp: overrides.security?.seccomp ?? defaults.security.seccomp,
+      customProfilePath: overrides.security?.customProfilePath ?? defaults.security.customProfilePath
+    },
+    remoteCode: {
+      ...defaults.remoteCode,
+      ...overrides.remoteCode,
+      allowedSchemes: overrides.remoteCode?.allowedSchemes ?? defaults.remoteCode.allowedSchemes,
+      allowedHosts: overrides.remoteCode?.allowedHosts ?? defaults.remoteCode.allowedHosts,
+      blockedHosts: overrides.remoteCode?.blockedHosts ?? defaults.remoteCode.blockedHosts
+    },
+    audit: {
+      ...defaults.audit,
+      ...overrides.audit
+    },
+    debug: overrides.debug ?? defaults.debug
+  };
+}
+// src/engine/concurrency.ts
+class Semaphore {
+  max;
+  current = 0;
+  queue = [];
+  constructor(max) {
+    this.max = max;
+    if (max < 1) {
+      throw new Error("Semaphore max must be >= 1");
+    }
+  }
+  get available() {
+    return this.max - this.current;
+  }
+  get pending() {
+    return this.queue.length;
+  }
+  async acquire() {
+    if (this.current < this.max) {
+      this.current++;
+      return;
+    }
+    return new Promise((resolve2) => {
+      this.queue.push(resolve2);
+    });
+  }
+  release() {
+    const next = this.queue.shift();
+    if (next) {
+      next();
+    } else {
+      this.current--;
+    }
+  }
+}
+// src/engine/docker.ts
+init_runtime();
+init_logger();
+import { randomUUID } from "node:crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { PassThrough } from "node:stream";
+import Docker from "dockerode";
+
+// src/engine/audit.ts
+init_logger();
+import { spawn } from "node:child_process";
+import { appendFileSync, existsSync as existsSync2, mkdirSync, readdirSync, statSync, unlinkSync } from "node:fs";
+import { join as join2 } from "node:path";
+
+class AuditLogger {
+  config;
+  auditFile;
+  constructor(config) {
+    this.config = config;
+    const auditDir = config.logDir ?? process.env.ISOL8_AUDIT_DIR ?? join2(process.cwd(), "./.isol8_audit");
+    this.auditFile = join2(auditDir, "executions.log");
+    if (!existsSync2(auditDir)) {
+      try {
+        mkdirSync(auditDir, { recursive: true });
+      } catch (err) {
+        logger.error("Failed to create audit dir:", err);
+      }
+    }
+    this.cleanupOldLogs();
+  }
+  cleanupOldLogs() {
+    if (!this.config.enabled || this.config.retentionDays <= 0) {
+      return;
+    }
+    try {
+      const auditDir = join2(this.auditFile, "..");
+      if (!existsSync2(auditDir)) {
+        return;
+      }
+      const cutoffTime = Date.now() - this.config.retentionDays * 24 * 60 * 60 * 1000;
+      const files = readdirSync(auditDir);
+      let cleanedCount = 0;
+      for (const file of files) {
+        if (file.endsWith(".log") || file.endsWith(".jsonl")) {
+          const filePath = join2(auditDir, file);
+          try {
+            const stats = statSync(filePath);
+            if (stats.mtimeMs < cutoffTime) {
+              unlinkSync(filePath);
+              cleanedCount++;
+              logger.debug(`Cleaned up old audit log: ${file}`);
+            }
+          } catch (err) {
+            logger.debug(`Failed to check/remove old log file ${file}:`, err);
+          }
+        }
+      }
+      if (cleanedCount > 0) {
+        logger.info(`Audit log cleanup: removed ${cleanedCount} old log files`);
+      }
+    } catch (err) {
+      logger.error("Failed to cleanup old audit logs:", err);
+    }
+  }
+  record(audit) {
+    if (!this.config.enabled) {
+      return;
+    }
+    try {
+      const filteredAudit = this.filterAuditData(audit);
+      const line = `${JSON.stringify(filteredAudit)}
+`;
+      switch (this.config.destination) {
+        case "file":
+        case "filesystem":
+          appendFileSync(this.auditFile, line, { encoding: "utf-8" });
+          break;
+        case "stdout":
+          console.log("AUDIT_LOG:", filteredAudit);
+          break;
+        default:
+          logger.error(`Unsupported audit destination: ${this.config.destination}`);
+          return;
+      }
+      logger.debug("Audit record written:", audit.executionId);
+      if (this.config.postLogScript) {
+        this.runPostLogScript();
+      }
+    } catch (err) {
+      logger.error("Failed to write audit record:", err);
+    }
+  }
+  runPostLogScript() {
+    if (!this.config.postLogScript) {
+      return;
+    }
+    try {
+      const child = spawn(this.config.postLogScript, [this.auditFile], {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.on("error", (err) => {
+        logger.error("Failed to run post-log script:", err);
+      });
+      child.unref();
+    } catch (err) {
+      logger.error("Failed to spawn post-log script:", err);
+    }
+  }
+  filterAuditData(audit) {
+    const result = {
+      executionId: audit.executionId,
+      userId: audit.userId,
+      timestamp: audit.timestamp,
+      runtime: audit.runtime,
+      codeHash: audit.codeHash,
+      containerId: audit.containerId,
+      exitCode: audit.exitCode,
+      durationMs: audit.durationMs
+    };
+    if (audit.resourceUsage !== undefined) {
+      result.resourceUsage = audit.resourceUsage;
+    }
+    if (audit.securityEvents !== undefined) {
+      result.securityEvents = audit.securityEvents;
+    }
+    if (audit.metadata !== undefined) {
+      result.metadata = audit.metadata;
+    }
+    if (this.config.includeCode && audit.code !== undefined) {
+      result.code = audit.code;
+    }
+    if (this.config.includeOutput) {
+      if (audit.stdout !== undefined) {
+        result.stdout = audit.stdout;
+      }
+      if (audit.stderr !== undefined) {
+        result.stderr = audit.stderr;
+      }
+    }
+    return result;
+  }
+}
+
+// src/engine/code-fetcher.ts
+import { createHash } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
+var IPV4_SEPARATOR = ".";
+var IPV6_LOOPBACK = "::1";
+function sha256Hex(input) {
+  return createHash("sha256").update(input, "utf-8").digest("hex");
+}
+function normalizeScheme(url) {
+  return url.protocol.replace(/:$/, "").toLowerCase();
+}
+function isBlockedByPattern(host, patterns) {
+  return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
+}
+function isAllowedByPattern(host, patterns) {
+  if (patterns.length === 0) {
+    return true;
+  }
+  return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
+}
+function isPrivateIpv4(ip) {
+  const parts = ip.split(IPV4_SEPARATOR).map((v) => Number.parseInt(v, 10));
+  if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) {
+    return false;
+  }
+  const a = parts[0];
+  const b = parts[1];
+  if (a === 10 || a === 127 || a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true;
+  }
+  return false;
+}
+function isPrivateIpv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === IPV6_LOOPBACK) {
+    return true;
+  }
+  return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
+}
+function isPrivateIp(ip) {
+  const family = isIP(ip);
+  if (family === 4) {
+    return isPrivateIpv4(ip);
+  }
+  if (family === 6) {
+    return isPrivateIpv6(ip);
+  }
+  return false;
+}
+async function assertHostResolvesPublic(host, lookupFn) {
+  if (isIP(host) && isPrivateIp(host)) {
+    throw new Error(`Blocked code URL host: ${host}`);
+  }
+  try {
+    const records = await lookupFn(host);
+    for (const record of records) {
+      if (isPrivateIp(record.address)) {
+        throw new Error(`Blocked code URL host: ${host}`);
+      }
+    }
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Blocked code URL host:")) {
+      throw err;
+    }
+    throw new Error(`Failed to resolve code URL host: ${host}`);
+  }
+}
+function decodeUtf8(content) {
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const text = decoder.decode(content);
+  if (text.includes("\x00")) {
+    throw new Error("Fetched code appears to be binary content");
+  }
+  return text;
+}
+async function fetchRemoteCode(request, policy, deps = {}) {
+  if (!policy.enabled) {
+    throw new Error("Remote code fetching is disabled. Set remoteCode.enabled=true to allow it.");
+  }
+  const fetchFn = deps.fetchFn ?? globalThis.fetch;
+  const lookupFn = deps.lookupFn ?? (async (hostname) => {
+    const records = await dnsLookup(hostname, { all: true, verbatim: true });
+    return records;
+  });
+  if (!request.codeUrl) {
+    throw new Error("codeUrl is required for remote code fetching");
+  }
+  const url = new URL(request.codeUrl);
+  const scheme = normalizeScheme(url);
+  if (scheme === "http" && !request.allowInsecureCodeUrl) {
+    throw new Error("Insecure code URL blocked. Use allowInsecureCodeUrl=true to allow HTTP.");
+  }
+  if (!policy.allowedSchemes.map((s) => s.toLowerCase()).includes(scheme)) {
+    throw new Error(`URL scheme not allowed: ${scheme}`);
+  }
+  const host = url.hostname.toLowerCase();
+  if (!isAllowedByPattern(host, policy.allowedHosts) || isBlockedByPattern(host, policy.blockedHosts)) {
+    throw new Error(`Blocked code URL host: ${host}`);
+  }
+  await assertHostResolvesPublic(host, lookupFn);
+  if (policy.requireHash && !request.codeHash) {
+    throw new Error("Hash verification required: provide codeHash for remote code execution.");
+  }
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), policy.fetchTimeoutMs);
+  let response;
+  try {
+    response = await fetchFn(url.toString(), {
+      method: "GET",
+      redirect: "follow",
+      signal: controller.signal
+    });
+  } catch (err) {
+    throw new Error(err instanceof Error && err.name === "AbortError" ? `Remote code fetch timed out after ${policy.fetchTimeoutMs}ms` : `Failed to fetch remote code: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (!response.ok) {
+    throw new Error(`Failed to fetch remote code: HTTP ${response.status}`);
+  }
+  const contentLengthHeader = response.headers.get("content-length");
+  if (contentLengthHeader) {
+    const parsedLength = Number.parseInt(contentLengthHeader, 10);
+    if (!Number.isNaN(parsedLength) && parsedLength > policy.maxCodeSize) {
+      throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes): ${parsedLength} bytes`);
+    }
+  }
+  if (!response.body) {
+    throw new Error("Remote code response body is empty");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (!value) {
+      continue;
+    }
+    totalBytes += value.byteLength;
+    if (totalBytes > policy.maxCodeSize) {
+      throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes)`);
+    }
+    chunks.push(value);
+  }
+  const buffer = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const code = decodeUtf8(buffer);
+  const hash = sha256Hex(code);
+  if (request.codeHash && hash.toLowerCase() !== request.codeHash.toLowerCase()) {
+    throw new Error("Remote code hash mismatch");
+  }
+  return { code, url: url.toString(), hash };
+}
+
+// src/engine/default-seccomp-profile.ts
+var EMBEDDED_DEFAULT_SECCOMP_PROFILE = JSON.stringify({
+  defaultAction: "SCMP_ACT_ALLOW",
+  architectures: ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_AARCH64"],
+  syscalls: [
+    {
+      names: [
+        "acct",
+        "add_key",
+        "bpf",
+        "clock_adjtime",
+        "clock_settime",
+        "create_module",
+        "delete_module",
+        "finit_module",
+        "get_mempolicy",
+        "init_module",
+        "ioperm",
+        "iopl",
+        "kcmp",
+        "kexec_file_load",
+        "kexec_load",
+        "keyctl",
+        "lookup_dcookie",
+        "mbind",
+        "mount",
+        "move_pages",
+        "name_to_handle_at",
+        "open_by_handle_at",
+        "perf_event_open",
+        "pivot_root",
+        "process_vm_readv",
+        "process_vm_writev",
+        "ptrace",
+        "query_module",
+        "quotactl",
+        "reboot",
+        "request_key",
+        "set_mempolicy",
+        "setns",
+        "settimeofday",
+        "stime",
+        "swapon",
+        "swapoff",
+        "sysfs",
+        "syslog",
+        "umount",
+        "umount2",
+        "unshare",
+        "uselib",
+        "userfaultfd",
+        "ustat",
+        "vm86",
+        "vm86old"
+      ],
+      action: "SCMP_ACT_ERRNO",
+      args: [],
+      comment: "",
+      includes: {},
+      excludes: {}
+    }
+  ]
+});
+
+// src/engine/docker.ts
+init_image_builder();
+
+// src/engine/pool.ts
+init_logger();
+
+class ContainerPool {
+  docker;
+  poolStrategy;
+  cleanPoolSize;
+  dirtyPoolSize;
+  createOptions;
+  networkMode;
+  securityMode;
+  pools = new Map;
+  replenishing = new Set;
+  pendingReplenishments = new Set;
+  cleaningInterval = null;
+  constructor(options) {
+    this.docker = options.docker;
+    this.poolStrategy = options.poolStrategy ?? "fast";
+    this.createOptions = options.createOptions;
+    this.networkMode = options.networkMode;
+    this.securityMode = options.securityMode;
+    if (typeof options.poolSize === "number") {
+      this.cleanPoolSize = options.poolSize;
+      this.dirtyPoolSize = options.poolSize;
+    } else if (options.poolSize) {
+      this.cleanPoolSize = options.poolSize.clean ?? 1;
+      this.dirtyPoolSize = options.poolSize.dirty ?? 1;
+    } else {
+      this.cleanPoolSize = 1;
+      this.dirtyPoolSize = 1;
+    }
+    if (this.poolStrategy === "fast") {
+      this.startBackgroundCleaning();
+    }
+  }
+  async acquire(image) {
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
+    if (this.poolStrategy === "fast") {
+      if (pool.clean.length > 0) {
+        const entry = pool.clean.shift();
+        this.pools.set(image, pool);
+        this.replenish(image);
+        return entry.container;
+      }
+      if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+        await this.cleanDirtyImmediate(image);
+        const updatedPool = this.pools.get(image);
+        if (updatedPool && updatedPool.clean.length > 0) {
+          const entry = updatedPool.clean.shift();
+          this.pools.set(image, updatedPool);
+          this.replenish(image);
+          return entry.container;
+        }
+      }
+      return this.createContainer(image);
+    }
+    if (pool.clean && pool.clean.length > 0) {
+      const entry = pool.clean.shift();
+      this.pools.set(image, { clean: pool.clean, dirty: [] });
+      await this.cleanupContainer(entry.container);
+      this.replenish(image);
+      return entry.container;
+    }
+    return this.createContainer(image);
+  }
+  async release(container, image) {
+    let pool = this.pools.get(image);
+    if (!pool) {
+      pool = { clean: [], dirty: [] };
+      this.pools.set(image, pool);
+    }
+    if (this.poolStrategy === "fast") {
+      if (pool.dirty.length >= this.dirtyPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      pool.dirty.push({ container, createdAt: Date.now() });
+    } else {
+      if (pool.clean.length >= this.cleanPoolSize) {
+        await container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      if (!pool.clean) {
+        pool.clean = [];
+      }
+      pool.clean.push({ container, createdAt: Date.now() });
+    }
+  }
+  startBackgroundCleaning() {
+    this.cleaningInterval = setInterval(async () => {
+      for (const [_image, pool] of this.pools) {
+        for (let i = 0;i < this.dirtyPoolSize; i++) {
+          if (pool.dirty.length > 0 && pool.clean.length < this.cleanPoolSize) {
+            const entry = pool.dirty.shift();
+            try {
+              await this.cleanupContainer(entry.container);
+              pool.clean.push(entry);
+            } catch {
+              entry.container.remove({ force: true }).catch(() => {});
+            }
+          }
+        }
+      }
+    }, 5000);
+  }
+  async cleanDirtyImmediate(image) {
+    const pool = this.pools.get(image);
+    if (!pool || pool.dirty.length === 0 || pool.clean.length >= this.cleanPoolSize) {
+      return;
+    }
+    const entry = pool.dirty.shift();
+    try {
+      await this.cleanupContainer(entry.container);
+      pool.clean.push(entry);
+    } catch {
+      entry.container.remove({ force: true }).catch(() => {});
+    }
+  }
+  async cleanupContainer(container) {
+    const needsCleanup = this.securityMode === "strict";
+    const needsIptables = this.networkMode === "filtered" && needsCleanup;
+    if (!needsCleanup) {
+      return;
+    }
+    try {
+      const cleanupCmd = needsIptables ? "pkill -9 -u sandbox 2>/dev/null; /usr/sbin/iptables -F OUTPUT 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true" : "pkill -9 -u sandbox 2>/dev/null; rm -rf /sandbox/* /sandbox/.[!.]* 2>/dev/null; true";
+      const cleanExec = await container.exec({
+        Cmd: ["sh", "-c", cleanupCmd]
+      });
+      await cleanExec.start({ Detach: true });
+      let info = await cleanExec.inspect();
+      while (info.Running) {
+        await new Promise((r) => setTimeout(r, 5));
+        info = await cleanExec.inspect();
+      }
+    } catch {}
+  }
+  async warm(image) {
+    const pool = this.pools.get(image) ?? { clean: [], dirty: [] };
+    this.pools.set(image, pool);
+    const needed = this.poolStrategy === "fast" ? this.cleanPoolSize - pool.clean.length : this.cleanPoolSize - (pool.clean?.length ?? 0);
+    if (needed <= 0) {
+      return;
+    }
+    const promises = [];
+    for (let i = 0;i < needed; i++) {
+      promises.push(this.createContainer(image).then((container) => {
+        if (this.poolStrategy === "fast") {
+          pool.clean.push({ container, createdAt: Date.now() });
+        } else {
+          if (!pool.clean) {
+            pool.clean = [];
+          }
+          pool.clean.push({ container, createdAt: Date.now() });
+        }
+      }));
+    }
+    await Promise.all(promises);
+  }
+  async stop() {
+    return this.drain();
+  }
+  async drain() {
+    if (this.cleaningInterval) {
+      clearInterval(this.cleaningInterval);
+      this.cleaningInterval = null;
+    }
+    await Promise.all(this.pendingReplenishments);
+    const promises = [];
+    for (const [, pool] of this.pools) {
+      for (const entry of pool.clean ?? []) {
+        promises.push(entry.container.remove({ force: true }).catch(() => {}));
+      }
+      for (const entry of pool.dirty) {
+        promises.push(entry.container.remove({ force: true }).catch(() => {}));
+      }
+    }
+    await Promise.all(promises);
+    this.pools.clear();
+  }
+  async createContainer(image) {
+    const container = await this.docker.createContainer({
+      ...this.createOptions,
+      Image: image
+    });
+    logger.debug(`[Pool] Container ${container.id} created for image: ${image}`);
+    await container.start();
+    logger.debug(`[Pool] Container ${container.id} started`);
+    return container;
+  }
+  replenish(image) {
+    if (this.replenishing.has(image)) {
+      return;
+    }
+    const pool = this.pools.get(image);
+    const currentSize = pool ? this.poolStrategy === "fast" ? pool.clean.length : pool.clean?.length ?? 0 : 0;
+    const targetSize = this.cleanPoolSize;
+    if (currentSize >= targetSize) {
+      return;
+    }
+    this.replenishing.add(image);
+    const promise = this.createContainer(image).then((container) => {
+      const p = this.pools.get(image);
+      if (!p) {
+        container.remove({ force: true }).catch(() => {});
+        return;
+      }
+      if (this.poolStrategy === "fast") {
+        if (p.clean.length < this.cleanPoolSize) {
+          p.clean.push({ container, createdAt: Date.now() });
+        } else {
+          container.remove({ force: true }).catch(() => {});
+        }
+      } else {
+        if (!p.clean) {
+          p.clean = [];
+        }
+        if (p.clean.length < this.cleanPoolSize) {
+          p.clean.push({ container, createdAt: Date.now() });
+        } else {
+          container.remove({ force: true }).catch(() => {});
+        }
+      }
+    }).catch((err) => {
+      logger.error(`[Pool] Error during replenishment for ${image}:`, err);
+    }).finally(() => {
+      this.replenishing.delete(image);
+      this.pendingReplenishments.delete(promise);
+    });
+    this.pendingReplenishments.add(promise);
+  }
+}
+
+// src/engine/stats.ts
+function calculateCPUPercent(stats) {
+  const cpuDelta = stats.cpu_stats.cpu_usage.total_usage - stats.precpu_stats.cpu_usage.total_usage;
+  const systemDelta = stats.cpu_stats.system_cpu_usage - stats.precpu_stats.system_cpu_usage;
+  if (systemDelta === 0 || cpuDelta === 0) {
+    return 0;
+  }
+  const numCores = stats.cpu_stats.online_cpus ?? stats.cpu_stats.cpu_usage.percpu_usage?.length ?? 1;
+  return cpuDelta / systemDelta * numCores * 100;
+}
+function calculateNetworkStats(stats) {
+  if (!stats.networks) {
+    return { in: 0, out: 0 };
+  }
+  let rxBytes = 0;
+  let txBytes = 0;
+  for (const iface of Object.values(stats.networks)) {
+    rxBytes += iface.rx_bytes;
+    txBytes += iface.tx_bytes;
+  }
+  return { in: rxBytes, out: txBytes };
+}
+async function getContainerStats(container) {
+  const stats = await container.stats({
+    stream: false
+  });
+  const cpuPercent = calculateCPUPercent(stats);
+  const memoryBytes = stats.memory_stats.usage;
+  const network = calculateNetworkStats(stats);
+  return {
+    cpuPercent: Math.round(cpuPercent * 100) / 100,
+    memoryMB: Math.round(memoryBytes / (1024 * 1024)),
+    networkBytesIn: network.in,
+    networkBytesOut: network.out
+  };
+}
+function calculateResourceDelta(before, after) {
+  return {
+    cpuPercent: after.cpuPercent,
+    memoryMB: after.memoryMB,
+    networkBytesIn: after.networkBytesIn - before.networkBytesIn,
+    networkBytesOut: after.networkBytesOut - before.networkBytesOut
+  };
+}
+
+// src/engine/docker.ts
+async function writeFileViaExec(container, filePath, content) {
+  const data = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
+  const b64 = data.toString("base64");
+  if (b64.length < 20000) {
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${b64}' | base64 -d > ${filePath}`],
+      User: "sandbox"
+    });
+    await exec.start({ Detach: true });
+    let info2 = await exec.inspect();
+    while (info2.Running) {
+      await new Promise((r) => setTimeout(r, 5));
+      info2 = await exec.inspect();
+    }
+    if (info2.ExitCode !== 0) {
+      throw new Error(`Failed to write file ${filePath} in container (exit code ${info2.ExitCode})`);
+    }
+    return;
+  }
+  const tempPath = `/tmp/b64_${Date.now()}.tmp`;
+  const chunkSize = 8000;
+  for (let i = 0;i < b64.length; i += chunkSize) {
+    const chunk = b64.slice(i, i + chunkSize);
+    const exec = await container.exec({
+      Cmd: ["sh", "-c", `printf '%s' '${chunk}' >> ${tempPath}`],
+      User: "sandbox"
+    });
+    await exec.start({ Detach: true });
+    await exec.inspect();
+  }
+  const decodeExec = await container.exec({
+    Cmd: ["sh", "-c", `base64 -d ${tempPath} > ${filePath} && rm ${tempPath}`],
+    User: "sandbox"
+  });
+  await decodeExec.start({ Detach: true });
+  let info = await decodeExec.inspect();
+  while (info.Running) {
+    await new Promise((r) => setTimeout(r, 5));
+    info = await decodeExec.inspect();
+  }
+  if (info.ExitCode !== 0) {
+    throw new Error(`Failed to write file ${filePath} in container (exit code ${info.ExitCode})`);
+  }
+}
+async function readFileViaExec(container, filePath) {
+  const exec = await container.exec({
+    Cmd: ["base64", filePath],
+    AttachStdout: true,
+    AttachStderr: true,
+    User: "sandbox"
+  });
+  const stream = await exec.start({ Tty: false });
+  const chunks = [];
+  const stderrChunks = [];
+  const stdoutStream = new PassThrough;
+  const stderrStream = new PassThrough;
+  container.modem.demuxStream(stream, stdoutStream, stderrStream);
+  stdoutStream.on("data", (chunk) => chunks.push(chunk));
+  stderrStream.on("data", (chunk) => stderrChunks.push(chunk));
+  await new Promise((resolve2, reject) => {
+    stream.on("end", resolve2);
+    stream.on("error", reject);
+  });
+  const inspectResult = await exec.inspect();
+  if (inspectResult.ExitCode !== 0) {
+    const stderr = Buffer.concat(stderrChunks).toString("utf-8").trim();
+    throw new Error(`Failed to read file ${filePath} in container: ${stderr} (exit code ${inspectResult.ExitCode})`);
+  }
+  const b64Output = Buffer.concat(chunks).toString("utf-8").trim();
+  return Buffer.from(b64Output, "base64");
+}
+var SANDBOX_WORKDIR = "/sandbox";
+var MAX_OUTPUT_BYTES = 1024 * 1024;
+var PROXY_PORT = 8118;
+var PROXY_STARTUP_TIMEOUT_MS = 5000;
+var PROXY_POLL_INTERVAL_MS = 100;
+async function startProxy(container, networkFilter) {
+  const envParts = [];
+  if (networkFilter) {
+    envParts.push(`ISOL8_WHITELIST='${JSON.stringify(networkFilter.whitelist)}'`);
+    envParts.push(`ISOL8_BLACKLIST='${JSON.stringify(networkFilter.blacklist)}'`);
+  }
+  const envPrefix = envParts.length > 0 ? `${envParts.join(" ")} ` : "";
+  const startExec = await container.exec({
+    Cmd: ["sh", "-c", `${envPrefix}bash /usr/local/bin/proxy.sh &`]
+  });
+  await startExec.start({ Detach: true });
+  const deadline = Date.now() + PROXY_STARTUP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      const checkExec = await container.exec({
+        Cmd: ["sh", "-c", `nc -z 127.0.0.1 ${PROXY_PORT} 2>/dev/null`]
+      });
+      await checkExec.start({ Detach: true });
+      let info = await checkExec.inspect();
+      while (info.Running) {
+        await new Promise((r) => setTimeout(r, 50));
+        info = await checkExec.inspect();
+      }
+      if (info.ExitCode === 0) {
+        return;
+      }
+    } catch {}
+    await new Promise((r) => setTimeout(r, PROXY_POLL_INTERVAL_MS));
+  }
+  throw new Error("Proxy failed to start within timeout");
+}
+async function setupIptables(container) {
+  const rules = [
+    "/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT",
+    "/usr/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
+    `/usr/sbin/iptables -A OUTPUT -p tcp -d 127.0.0.1 --dport ${PROXY_PORT} -m owner --uid-owner 100 -j ACCEPT`,
+    "/usr/sbin/iptables -A OUTPUT -m owner --uid-owner 100 -j DROP"
+  ].join(" && ");
+  const exec = await container.exec({
+    Cmd: ["sh", "-c", rules]
+  });
+  await exec.start({ Detach: true });
+  let info = await exec.inspect();
+  while (info.Running) {
+    await new Promise((r) => setTimeout(r, 50));
+    info = await exec.inspect();
+  }
+  if (info.ExitCode !== 0) {
+    throw new Error(`Failed to set up iptables rules (exit code ${info.ExitCode})`);
+  }
+  logger.debug("[Filtered] iptables rules applied — sandbox user restricted to proxy only");
+}
+function wrapWithTimeout(cmd, timeoutSec) {
+  return ["timeout", "-s", "KILL", String(timeoutSec), ...cmd];
+}
+function getInstallCommand(runtime, packages) {
+  switch (runtime) {
+    case "python":
+      return [
+        "pip",
+        "install",
+        "--user",
+        "--no-cache-dir",
+        "--break-system-packages",
+        "--disable-pip-version-check",
+        "--retries",
+        "0",
+        "--timeout",
+        "15",
+        ...packages
+      ];
+    case "node":
+      return ["npm", "install", "--prefix", "/sandbox", ...packages];
+    case "bun":
+      return ["bun", "install", "-g", "--global-dir=/sandbox/.bun-global", ...packages];
+    case "deno":
+      return ["sh", "-c", packages.map((p) => `deno cache ${p}`).join(" && ")];
+    case "bash":
+      return ["apk", "add", "--no-cache", ...packages];
+    default:
+      throw new Error(`Unknown runtime for package install: ${runtime}`);
+  }
+}
+async function installPackages(container, runtime, packages, timeoutMs) {
+  const timeoutSec = Math.max(1, Math.ceil(timeoutMs / 1000));
+  const cmd = wrapWithTimeout(getInstallCommand(runtime, packages), timeoutSec);
+  logger.debug(`Installing packages: ${JSON.stringify(cmd)}`);
+  const env = [
+    "PATH=/sandbox/.local/bin:/sandbox/.npm-global/bin:/sandbox/.bun-global/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin"
+  ];
+  if (runtime === "python") {
+    env.push("PYTHONUSERBASE=/sandbox/.local");
+  } else if (runtime === "node") {
+    env.push("NPM_CONFIG_PREFIX=/sandbox/.npm-global");
+    env.push("NPM_CONFIG_CACHE=/sandbox/.npm-cache");
+    env.push("npm_config_cache=/sandbox/.npm-cache");
+    env.push("NPM_CONFIG_FETCH_RETRIES=0");
+    env.push("npm_config_fetch_retries=0");
+    env.push("NPM_CONFIG_FETCH_RETRY_MINTIMEOUT=1000");
+    env.push("npm_config_fetch_retry_mintimeout=1000");
+    env.push("NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT=2000");
+    env.push("npm_config_fetch_retry_maxtimeout=2000");
+  } else if (runtime === "bun") {
+    env.push("BUN_INSTALL_GLOBAL_DIR=/sandbox/.bun-global");
+    env.push("BUN_INSTALL_CACHE_DIR=/sandbox/.bun-cache");
+    env.push("BUN_INSTALL_BIN=/sandbox/.bun-global/bin");
+  } else if (runtime === "deno") {
+    env.push("DENO_DIR=/sandbox/.deno");
+  }
+  const exec = await container.exec({
+    Cmd: cmd,
+    AttachStdout: true,
+    AttachStderr: true,
+    Env: env,
+    User: runtime === "bash" ? "root" : "sandbox"
+  });
+  const stream = await exec.start({ Detach: false, Tty: false });
+  return new Promise((resolve2, reject) => {
+    let stderr = "";
+    const stdoutStream = new PassThrough;
+    const stderrStream = new PassThrough;
+    container.modem.demuxStream(stream, stdoutStream, stderrStream);
+    stderrStream.on("data", (chunk) => {
+      const text = chunk.toString();
+      stderr += text;
+      logger.debug(`[install:${runtime}:stderr] ${text.trimEnd()}`);
+    });
+    stdoutStream.on("data", (chunk) => {
+      const text = chunk.toString();
+      logger.debug(`[install:${runtime}:stdout] ${text.trimEnd()}`);
+    });
+    stream.on("end", async () => {
+      try {
+        const info = await exec.inspect();
+        if (info.ExitCode !== 0) {
+          reject(new Error(`Package install failed (exit code ${info.ExitCode}): ${stderr}`));
+        } else {
+          resolve2();
+        }
+      } catch (err) {
+        reject(err);
+      }
+    });
+    stream.on("error", reject);
+  });
+}
+
+class DockerIsol8 {
+  docker;
+  mode;
+  network;
+  networkFilter;
+  cpuLimit;
+  memoryLimit;
+  pidsLimit;
+  readonlyRootFs;
+  maxOutputSize;
+  secrets;
+  defaultTimeoutMs;
+  overrideImage;
+  semaphore;
+  sandboxSize;
+  tmpSize;
+  security;
+  persist;
+  logNetwork;
+  poolStrategy;
+  poolSize;
+  dependencies;
+  auditLogger;
+  remoteCodePolicy;
+  container = null;
+  persistentRuntime = null;
+  pool = null;
+  imageCache = new Map;
+  async resolveExecutionRequest(req) {
+    const inlineCode = req.code?.trim();
+    const codeUrl = req.codeUrl?.trim();
+    if (inlineCode && codeUrl) {
+      throw new Error("ExecutionRequest.code and ExecutionRequest.codeUrl are mutually exclusive.");
+    }
+    if (!(inlineCode || codeUrl)) {
+      throw new Error("ExecutionRequest must include either code or codeUrl.");
+    }
+    if (inlineCode) {
+      return { ...req, code: req.code };
+    }
+    const fetched = await fetchRemoteCode({
+      codeUrl,
+      codeHash: req.codeHash,
+      allowInsecureCodeUrl: req.allowInsecureCodeUrl
+    }, this.remoteCodePolicy);
+    return { ...req, code: fetched.code };
+  }
+  constructor(options = {}, maxConcurrent = 10) {
+    this.docker = options.docker ?? new Docker;
+    this.mode = options.mode ?? "ephemeral";
+    this.network = options.network ?? "none";
+    this.networkFilter = options.networkFilter;
+    this.cpuLimit = options.cpuLimit ?? 1;
+    this.memoryLimit = options.memoryLimit ?? "512m";
+    this.pidsLimit = options.pidsLimit ?? 64;
+    this.readonlyRootFs = options.readonlyRootFs ?? true;
+    this.maxOutputSize = options.maxOutputSize ?? MAX_OUTPUT_BYTES;
+    this.secrets = options.secrets ?? {};
+    this.defaultTimeoutMs = options.timeoutMs ?? 30000;
+    this.overrideImage = options.image;
+    this.semaphore = new Semaphore(maxConcurrent);
+    this.sandboxSize = options.sandboxSize ?? "512m";
+    this.tmpSize = options.tmpSize ?? "256m";
+    this.persist = options.persist ?? false;
+    this.security = options.security ?? { seccomp: "strict" };
+    this.logNetwork = options.logNetwork ?? false;
+    this.poolStrategy = options.poolStrategy ?? "fast";
+    this.poolSize = options.poolSize ?? { clean: 1, dirty: 1 };
+    this.dependencies = options.dependencies ?? {};
+    this.remoteCodePolicy = options.remoteCode ?? {
+      enabled: false,
+      allowedSchemes: ["https"],
+      allowedHosts: [],
+      blockedHosts: [],
+      maxCodeSize: 10 * 1024 * 1024,
+      fetchTimeoutMs: 30000,
+      requireHash: false,
+      enableCache: true,
+      cacheTtl: 3600
+    };
+    if (options.audit) {
+      this.auditLogger = new AuditLogger(options.audit);
+    }
+    if (options.debug) {
+      logger.setDebug(true);
+    }
+  }
+  async start(options = {}) {
+    if (this.mode !== "ephemeral") {
+      return;
+    }
+    const prewarm = options.prewarm;
+    if (!prewarm) {
+      return;
+    }
+    const pool = this.ensurePool();
+    const images = new Set;
+    const adapters2 = typeof prewarm === "object" && prewarm.runtimes?.length ? prewarm.runtimes.map((runtime) => RuntimeRegistry.get(runtime)) : RuntimeRegistry.list();
+    for (const adapter of adapters2) {
+      try {
+        images.add(await this.resolveImage(adapter));
+      } catch (err) {
+        logger.debug(`[Pool] Pre-warm image resolution failed for ${adapter.name}: ${err}`);
+      }
+    }
+    await Promise.all([...images].map(async (image) => {
+      try {
+        await pool.warm(image);
+        logger.debug(`[Pool] Pre-warmed image: ${image}`);
+      } catch (err) {
+        logger.debug(`[Pool] Pre-warm failed for ${image}: ${err}`);
+      }
+    }));
+  }
+  async stop() {
+    if (this.container) {
+      try {
+        await this.container.stop({ t: 2 });
+      } catch {}
+      try {
+        await this.container.remove({ force: true });
+      } catch {}
+      this.container = null;
+      this.persistentRuntime = null;
+    }
+    if (this.pool) {
+      await this.pool.drain();
+      this.pool = null;
+    }
+  }
+  async execute(req) {
+    await this.semaphore.acquire();
+    const startTime = Date.now();
+    try {
+      const request = await this.resolveExecutionRequest(req);
+      const result = this.mode === "persistent" ? await this.executePersistent(request, startTime) : await this.executeEphemeral(request, startTime);
+      return result;
+    } finally {
+      this.semaphore.release();
+    }
+  }
+  async recordAudit(req, result, startTime, container) {
+    try {
+      const enc = new TextEncoder;
+      const data = enc.encode(req.code);
+      const digest = await crypto.subtle.digest("SHA-256", data);
+      const codeHash = Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+      let securityEvents;
+      if (container && this.network === "filtered") {
+        securityEvents = await this.collectSecurityEvents(container);
+        if (securityEvents.length === 0) {
+          securityEvents = undefined;
+        }
+      }
+      let networkLogs;
+      if (this.logNetwork && result.networkLogs) {
+        networkLogs = result.networkLogs;
+      }
+      const audit = {
+        executionId: result.executionId,
+        userId: req.metadata?.userId || "",
+        timestamp: new Date(startTime).toISOString(),
+        runtime: result.runtime,
+        codeHash,
+        containerId: result.containerId || "",
+        exitCode: result.exitCode,
+        durationMs: result.durationMs,
+        resourceUsage: result.resourceUsage,
+        securityEvents,
+        networkLogs,
+        metadata: req.metadata
+      };
+      this.auditLogger.record(audit);
+    } catch (err) {
+      logger.error("Failed to record audit log:", err);
+    }
+  }
+  async collectSecurityEvents(container) {
+    const events = [];
+    try {
+      const exec = await container.exec({
+        Cmd: ["cat", "/tmp/isol8-proxy/security-events.jsonl"],
+        AttachStdout: true,
+        AttachStderr: false,
+        User: "root"
+      });
+      const stream = await exec.start({ Tty: false });
+      const chunks = [];
+      for await (const chunk of stream) {
+        chunks.push(chunk);
+      }
+      const output = Buffer.concat(chunks).toString("utf-8").trim();
+      if (output) {
+        for (const line of output.split(`
+`)) {
+          if (line.trim()) {
+            try {
+              const event = JSON.parse(line);
+              events.push({
+                type: event.type || "unknown",
+                message: `Security event: ${event.type}`,
+                details: event.details || {},
+                timestamp: event.timestamp || new Date().toISOString()
+              });
+            } catch {}
+          }
+        }
+      }
+    } catch {}
+    return events;
+  }
+  async collectNetworkLogs(container) {
+    const logs = [];
+    try {
+      const exec = await container.exec({
+        Cmd: ["cat", "/tmp/isol8-proxy/network.jsonl"],
+        AttachStdout: true,
+        AttachStderr: false,
+        User: "root"
+      });
+      const stream = await exec.start({ Tty: false });
+      const chunks = [];
+      for await (const chunk of stream) {
+        chunks.push(chunk);
+      }
+      const output = Buffer.concat(chunks).toString("utf-8").trim();
+      logger.debug(`[NetworkLogs] Raw output length: ${output.length}, first 100 chars: ${output.substring(0, 100).replace(/\\n/g, "\\n")}`);
+      const jsonLines = output.split(`
+`).filter((line) => line.includes("timestamp"));
+      logger.debug(`[NetworkLogs] Found ${jsonLines.length} JSON lines out of ${output.split(`
+`).length} total lines`);
+      for (const line of jsonLines) {
+        const startIdx = line.indexOf("{");
+        const endIdx = line.lastIndexOf("}");
+        if (startIdx === -1 || endIdx === -1) {
+          continue;
+        }
+        const jsonStr = line.substring(startIdx, endIdx + 1);
+        try {
+          const entry = JSON.parse(jsonStr);
+          logs.push({
+            timestamp: entry.timestamp || new Date().toISOString(),
+            method: entry.method || "UNKNOWN",
+            host: entry.host || "",
+            path: entry.path,
+            action: entry.action || "ALLOW",
+            durationMs: entry.durationMs || 0
+          });
+          logger.debug(`[NetworkLogs] Successfully parsed line: ${JSON.stringify(entry)}`);
+        } catch (e) {
+          logger.debug(`[NetworkLogs] Failed to parse line: ${line.substring(0, 50)}..., error: ${e}`);
+        }
+      }
+      logger.debug(`[NetworkLogs] Total parsed logs: ${logs.length}`);
+    } catch {}
+    return logs;
+  }
+  async putFile(path, content) {
+    if (!this.container) {
+      throw new Error("No active container. Call execute() first in persistent mode.");
+    }
+    if (this.readonlyRootFs) {
+      await writeFileViaExec(this.container, path, content);
+    } else {
+      const tar = createTarBuffer(path, content);
+      await this.container.putArchive(tar, { path: "/" });
+    }
+  }
+  async getFile(path) {
+    if (!this.container) {
+      throw new Error("No active container. Call execute() first in persistent mode.");
+    }
+    if (this.readonlyRootFs) {
+      return readFileViaExec(this.container, path);
+    }
+    const stream = await this.container.getArchive({ path });
+    const chunks = [];
+    for await (const chunk of stream) {
+      chunks.push(chunk);
+    }
+    const tarBuffer = Buffer.concat(chunks);
+    return extractFromTar(tarBuffer, path);
+  }
+  get containerId() {
+    return this.container?.id ?? null;
+  }
+  async* executeStream(req) {
+    await this.semaphore.acquire();
+    try {
+      const request = await this.resolveExecutionRequest(req);
+      const adapter = this.getAdapter(request.runtime);
+      const timeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
+      const image = await this.resolveImage(adapter);
+      const container = await this.docker.createContainer({
+        Image: image,
+        Cmd: ["sleep", "infinity"],
+        WorkingDir: SANDBOX_WORKDIR,
+        Env: this.buildEnv(),
+        NetworkDisabled: this.network === "none",
+        HostConfig: this.buildHostConfig(),
+        StopTimeout: 2
+      });
+      try {
+        await container.start();
+        if (this.network === "filtered") {
+          await startProxy(container, this.networkFilter);
+          await setupIptables(container);
+        }
+        const ext = request.fileExtension ?? adapter.getFileExtension();
+        const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
+        await writeFileViaExec(container, filePath, request.code);
+        if (request.installPackages?.length) {
+          await installPackages(container, request.runtime, request.installPackages, timeoutMs);
+        }
+        if (request.files) {
+          for (const [fPath, fContent] of Object.entries(request.files)) {
+            await writeFileViaExec(container, fPath, fContent);
+          }
+        }
+        const rawCmd = adapter.getCommand(request.code, filePath);
+        const timeoutSec = Math.ceil(timeoutMs / 1000);
+        let cmd;
+        if (request.stdin) {
+          const stdinPath = `${SANDBOX_WORKDIR}/_stdin`;
+          await writeFileViaExec(container, stdinPath, request.stdin);
+          const cmdStr = rawCmd.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+          cmd = wrapWithTimeout(["sh", "-c", `cat ${stdinPath} | ${cmdStr}`], timeoutSec);
+        } else {
+          cmd = wrapWithTimeout(rawCmd, timeoutSec);
+        }
+        const exec = await container.exec({
+          Cmd: cmd,
+          Env: this.buildEnv(request.env),
+          AttachStdout: true,
+          AttachStderr: true,
+          WorkingDir: SANDBOX_WORKDIR,
+          User: "sandbox"
+        });
+        const execStream = await exec.start({ Tty: false });
+        yield* this.streamExecOutput(execStream, exec, container, timeoutMs);
+      } finally {
+        if (this.persist) {
+          logger.debug(`[Persist] Leaving container running for inspection: ${container.id}`);
+        } else {
+          try {
+            await container.remove({ force: true });
+          } catch {}
+        }
+      }
+    } finally {
+      this.semaphore.release();
+    }
+  }
+  async resolveImage(adapter) {
+    if (this.overrideImage) {
+      return this.overrideImage;
+    }
+    const cacheKey = adapter.image;
+    const cached = this.imageCache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
+    let resolvedImage = adapter.image;
+    const configuredDeps = this.dependencies[adapter.name];
+    const normalizedDeps = configuredDeps ? normalizePackages(configuredDeps) : [];
+    if (normalizedDeps.length > 0) {
+      const hashedCustomTag = getCustomImageTag(adapter.name, normalizedDeps);
+      try {
+        await this.docker.getImage(hashedCustomTag).inspect();
+        resolvedImage = hashedCustomTag;
+      } catch {
+        logger.debug(`[ImageBuilder] Hashed custom image not found for ${adapter.name}: ${hashedCustomTag}`);
+      }
+    }
+    if (resolvedImage === adapter.image) {
+      const legacyCustomTag = `${adapter.image}-custom`;
+      try {
+        await this.docker.getImage(legacyCustomTag).inspect();
+        resolvedImage = legacyCustomTag;
+      } catch {}
+    }
+    try {
+      await this.docker.getImage(resolvedImage).inspect();
+    } catch {
+      logger.debug(`[ImageBuilder] Image ${resolvedImage} not found. Building...`);
+      const { buildBaseImages: buildBaseImages2, buildCustomImage: buildCustomImage2 } = await Promise.resolve().then(() => (init_image_builder(), exports_image_builder));
+      if (resolvedImage !== adapter.image && normalizedDeps.length > 0) {
+        try {
+          await this.docker.getImage(adapter.image).inspect();
+        } catch {
+          logger.debug(`[ImageBuilder] Base image ${adapter.image} missing. Building...`);
+          await buildBaseImages2(this.docker, undefined, false, [adapter.name]);
+        }
+        logger.debug(`[ImageBuilder] Building custom image for ${adapter.name}...`);
+        await buildCustomImage2(this.docker, adapter.name, normalizedDeps);
+      } else {
+        logger.debug(`[ImageBuilder] Building base image for ${adapter.name}...`);
+        await buildBaseImages2(this.docker, undefined, false, [adapter.name]);
+      }
+    }
+    this.imageCache.set(cacheKey, resolvedImage);
+    return resolvedImage;
+  }
+  ensurePool() {
+    if (!this.pool) {
+      this.pool = new ContainerPool({
+        docker: this.docker,
+        poolStrategy: this.poolStrategy,
+        poolSize: this.poolSize,
+        networkMode: this.network,
+        securityMode: this.security.seccomp ?? "strict",
+        createOptions: {
+          Cmd: ["sleep", "infinity"],
+          WorkingDir: SANDBOX_WORKDIR,
+          Env: this.buildEnv(),
+          NetworkDisabled: this.network === "none",
+          HostConfig: this.buildHostConfig(),
+          StopTimeout: 2
+        }
+      });
+    }
+    return this.pool;
+  }
+  async executeEphemeral(req, startTime) {
+    const adapter = this.getAdapter(req.runtime);
+    const timeoutMs = req.timeoutMs ?? this.defaultTimeoutMs;
+    const image = await this.resolveImage(adapter);
+    const pool = this.ensurePool();
+    const container = await pool.acquire(image);
+    let startStats;
+    if (this.auditLogger) {
+      try {
+        startStats = await getContainerStats(container);
+      } catch (err) {
+        logger.debug("Failed to collect baseline stats:", err);
+      }
+    }
+    try {
+      if (this.network === "filtered") {
+        await startProxy(container, this.networkFilter);
+        await setupIptables(container);
+      }
+      const canUseInline = !(req.stdin || req.files || req.outputPaths) && (!req.installPackages || req.installPackages.length === 0);
+      let rawCmd;
+      if (canUseInline) {
+        try {
+          rawCmd = adapter.getCommand(req.code);
+        } catch {
+          const ext = req.fileExtension ?? adapter.getFileExtension();
+          const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
+          await writeFileViaExec(container, filePath, req.code);
+          rawCmd = adapter.getCommand(req.code, filePath);
+        }
+      } else {
+        const ext = req.fileExtension ?? adapter.getFileExtension();
+        const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
+        await writeFileViaExec(container, filePath, req.code);
+        rawCmd = adapter.getCommand(req.code, filePath);
+      }
+      if (req.installPackages?.length) {
+        await installPackages(container, req.runtime, req.installPackages, timeoutMs);
+      }
+      const timeoutSec = Math.ceil(timeoutMs / 1000);
+      let cmd;
+      if (req.stdin) {
+        const stdinPath = `${SANDBOX_WORKDIR}/_stdin`;
+        await writeFileViaExec(container, stdinPath, req.stdin);
+        const cmdStr = rawCmd.map((a) => `'${a.replace(/'/g, "'\\''")}' `).join("");
+        cmd = wrapWithTimeout(["sh", "-c", `cat ${stdinPath} | ${cmdStr}`], timeoutSec);
+      } else {
+        cmd = wrapWithTimeout(rawCmd, timeoutSec);
+      }
+      if (req.files) {
+        for (const [fPath, fContent] of Object.entries(req.files)) {
+          await writeFileViaExec(container, fPath, fContent);
+        }
+      }
+      const exec = await container.exec({
+        Cmd: cmd,
+        Env: this.buildEnv(req.env),
+        AttachStdout: true,
+        AttachStderr: true,
+        WorkingDir: SANDBOX_WORKDIR,
+        User: "sandbox"
+      });
+      const start = performance.now();
+      const execStream = await exec.start({ Tty: false });
+      const { stdout, stderr, truncated } = await this.collectExecOutput(execStream, container, timeoutMs);
+      const durationMs = Math.round(performance.now() - start);
+      const inspectResult = await exec.inspect();
+      let resourceUsage;
+      if (startStats) {
+        try {
+          const endStats = await getContainerStats(container);
+          resourceUsage = calculateResourceDelta(startStats, endStats);
+        } catch (err) {
+          logger.debug("Failed to collect final stats:", err);
+        }
+      }
+      let networkLogs;
+      if (this.logNetwork && this.network === "filtered") {
+        try {
+          networkLogs = await this.collectNetworkLogs(container);
+          if (networkLogs.length === 0) {
+            networkLogs = undefined;
+          }
+        } catch (err) {
+          logger.debug("Failed to collect network logs:", err);
+        }
+      }
+      const result = {
+        stdout: this.postProcessOutput(stdout, truncated),
+        stderr: this.postProcessOutput(stderr, false),
+        exitCode: inspectResult.ExitCode ?? 1,
+        durationMs,
+        truncated,
+        executionId: randomUUID(),
+        runtime: req.runtime,
+        timestamp: new Date().toISOString(),
+        containerId: container.id,
+        ...resourceUsage ? { resourceUsage } : {},
+        ...networkLogs ? { networkLogs } : {},
+        ...req.outputPaths ? { files: await this.retrieveFiles(container, req.outputPaths) } : {}
+      };
+      if (this.auditLogger) {
+        await this.recordAudit(req, result, startTime, container);
+      }
+      return result;
+    } finally {
+      if (this.persist) {
+        logger.debug(`[Persist] Leaving container running for inspection: ${container.id}`);
+      } else {
+        pool.release(container, image).catch((err) => {
+          logger.debug(`[Pool] release failed: ${err}`);
+          container.remove({ force: true }).catch(() => {});
+        });
+      }
+    }
+  }
+  async executePersistent(req, startTime) {
+    const adapter = this.getAdapter(req.runtime);
+    const timeoutMs = req.timeoutMs ?? this.defaultTimeoutMs;
+    if (!this.container) {
+      await this.startPersistentContainer(adapter);
+    } else if (this.persistentRuntime?.name !== adapter.name) {
+      throw new Error(`Cannot switch runtime from "${this.persistentRuntime?.name}" to "${adapter.name}". Each persistent container supports a single runtime. Create a new Isol8 instance for a different runtime.`);
+    }
+    const ext = req.fileExtension ?? adapter.getFileExtension();
+    const filePath = `${SANDBOX_WORKDIR}/exec_${Date.now()}${ext}`;
+    if (this.readonlyRootFs) {
+      await writeFileViaExec(this.container, filePath, req.code);
+    } else {
+      const tar = createTarBuffer(filePath, req.code);
+      await this.container.putArchive(tar, { path: "/" });
+    }
+    if (req.files) {
+      for (const [fPath, fContent] of Object.entries(req.files)) {
+        if (this.readonlyRootFs) {
+          await writeFileViaExec(this.container, fPath, fContent);
+        } else {
+          const tar = createTarBuffer(fPath, fContent);
+          await this.container.putArchive(tar, { path: "/" });
+        }
+      }
+    }
+    const rawCmd = adapter.getCommand(req.code, filePath);
+    const timeoutSec = Math.ceil(timeoutMs / 1000);
+    if (req.installPackages?.length) {
+      await installPackages(this.container, req.runtime, req.installPackages, timeoutMs);
+    }
+    let cmd;
+    if (req.stdin) {
+      const stdinPath = `${SANDBOX_WORKDIR}/_stdin_${Date.now()}`;
+      await writeFileViaExec(this.container, stdinPath, req.stdin);
+      const cmdStr = rawCmd.map((a) => `'${a.replace(/'/g, "'\\''")}' `).join("");
+      cmd = wrapWithTimeout(["sh", "-c", `cat ${stdinPath} | ${cmdStr}`], timeoutSec);
+    } else {
+      cmd = wrapWithTimeout(rawCmd, timeoutSec);
+    }
+    const execEnv = this.buildEnv(req.env);
+    const exec = await this.container.exec({
+      Cmd: cmd,
+      Env: execEnv,
+      AttachStdout: true,
+      AttachStderr: true,
+      WorkingDir: SANDBOX_WORKDIR,
+      User: "sandbox"
+    });
+    const start = performance.now();
+    const execStream = await exec.start({ Tty: false });
+    const { stdout, stderr, truncated } = await this.collectExecOutput(execStream, this.container, timeoutMs);
+    const durationMs = Math.round(performance.now() - start);
+    const inspectResult = await exec.inspect();
+    let resourceUsage;
+    if (this.auditLogger) {
+      try {
+        const endStats = await getContainerStats(this.container);
+        resourceUsage = {
+          cpuPercent: endStats.cpuPercent,
+          memoryMB: endStats.memoryMB,
+          networkBytesIn: endStats.networkBytesIn,
+          networkBytesOut: endStats.networkBytesOut
+        };
+      } catch (err) {
+        logger.debug("Failed to collect resource stats:", err);
+      }
+    }
+    let networkLogs;
+    if (this.logNetwork && this.network === "filtered") {
+      try {
+        networkLogs = await this.collectNetworkLogs(this.container);
+        if (networkLogs.length === 0) {
+          networkLogs = undefined;
+        }
+      } catch (err) {
+        logger.debug("Failed to collect network logs:", err);
+      }
+    }
+    const result = {
+      stdout: this.postProcessOutput(stdout, truncated),
+      stderr: this.postProcessOutput(stderr, false),
+      exitCode: inspectResult.ExitCode ?? 1,
+      durationMs,
+      truncated,
+      executionId: randomUUID(),
+      runtime: req.runtime,
+      timestamp: new Date().toISOString(),
+      containerId: this.container?.id,
+      ...resourceUsage ? { resourceUsage } : {},
+      ...networkLogs ? { networkLogs } : {},
+      ...req.outputPaths ? { files: await this.retrieveFiles(this.container, req.outputPaths) } : {}
+    };
+    if (this.auditLogger) {
+      await this.recordAudit(req, result, startTime, this.container);
+    }
+    return result;
+  }
+  async retrieveFiles(container, paths) {
+    const files = {};
+    for (const p of paths) {
+      try {
+        const buf = this.readonlyRootFs ? await readFileViaExec(container, p) : await this.getFileFromContainer(container, p);
+        files[p] = buf.toString("base64");
+      } catch {}
+    }
+    return files;
+  }
+  async getFileFromContainer(container, path) {
+    const stream = await container.getArchive({ path });
+    const chunks = [];
+    for await (const chunk of stream) {
+      chunks.push(chunk);
+    }
+    return extractFromTar(Buffer.concat(chunks), path);
+  }
+  async startPersistentContainer(adapter) {
+    const image = await this.resolveImage(adapter);
+    this.container = await this.docker.createContainer({
+      Image: image,
+      Cmd: ["sleep", "infinity"],
+      WorkingDir: SANDBOX_WORKDIR,
+      Env: this.buildEnv(),
+      NetworkDisabled: this.network === "none",
+      HostConfig: this.buildHostConfig(),
+      StopTimeout: 2,
+      Labels: {
+        "isol8.managed": "true",
+        "isol8.runtime": adapter.name
+      }
+    });
+    await this.container.start();
+    if (this.network === "filtered") {
+      await startProxy(this.container, this.networkFilter);
+      await setupIptables(this.container);
+    }
+    this.persistentRuntime = adapter;
+  }
+  getAdapter(runtime) {
+    return RuntimeRegistry.get(runtime);
+  }
+  buildHostConfig() {
+    const config = {
+      Memory: parseMemoryLimit(this.memoryLimit),
+      NanoCpus: Math.floor(this.cpuLimit * 1e9),
+      PidsLimit: this.pidsLimit,
+      ReadonlyRootfs: this.readonlyRootFs,
+      Tmpfs: {
+        "/tmp": `rw,noexec,nosuid,nodev,size=${this.tmpSize}`,
+        [SANDBOX_WORKDIR]: `rw,exec,nosuid,nodev,size=${this.sandboxSize},uid=100,gid=101`
+      },
+      SecurityOpt: this.buildSecurityOpts()
+    };
+    if (this.network === "filtered") {
+      config.NetworkMode = "bridge";
+      config.CapAdd = ["NET_ADMIN"];
+    } else if (this.network === "host") {
+      config.NetworkMode = "host";
+    }
+    return config;
+  }
+  buildSecurityOpts() {
+    const opts = ["no-new-privileges"];
+    if (this.security.seccomp === "unconfined") {
+      opts.push("seccomp=unconfined");
+      return opts;
+    }
+    if (this.security.seccomp === "custom" && this.security.customProfilePath) {
+      try {
+        const profile = readFileSync3(this.security.customProfilePath, "utf-8");
+        opts.push(`seccomp=${profile}`);
+      } catch (e) {
+        throw new Error(`Failed to load custom seccomp profile at ${this.security.customProfilePath}: ${e}`);
+      }
+      return opts;
+    }
+    try {
+      const profile = this.loadDefaultSeccompProfile();
+      opts.push(`seccomp=${profile}`);
+    } catch (e) {
+      throw new Error(`Failed to load default seccomp profile: ${e}`);
+    }
+    return opts;
+  }
+  loadDefaultSeccompProfile() {
+    const devPath = new URL("../../docker/seccomp-profile.json", import.meta.url);
+    if (existsSync4(devPath)) {
+      return readFileSync3(devPath, "utf-8");
+    }
+    const prodPath = new URL("./docker/seccomp-profile.json", import.meta.url);
+    if (existsSync4(prodPath)) {
+      return readFileSync3(prodPath, "utf-8");
+    }
+    if (EMBEDDED_DEFAULT_SECCOMP_PROFILE.length > 0) {
+      logger.debug(`Default seccomp profile file not found. Using embedded profile. Tried: ${devPath.pathname}, ${prodPath.pathname}`);
+      return EMBEDDED_DEFAULT_SECCOMP_PROFILE;
+    }
+    throw new Error("Embedded default seccomp profile is unavailable");
+  }
+  buildEnv(extra) {
+    const env = [
+      "PYTHONUNBUFFERED=1",
+      "PYTHONUSERBASE=/sandbox/.local",
+      "NPM_CONFIG_PREFIX=/sandbox/.npm-global",
+      "DENO_DIR=/sandbox/.deno",
+      "PATH=/sandbox/.local/bin:/sandbox/.npm-global/bin:/sandbox/.bun-global/bin:/usr/local/bin:/usr/bin:/bin",
+      "NODE_PATH=/usr/local/lib/node_modules:/sandbox/.npm-global/lib/node_modules:/sandbox/node_modules"
+    ];
+    for (const [key, value] of Object.entries(this.secrets)) {
+      env.push(`${key}=${value}`);
+    }
+    if (extra) {
+      for (const [key, value] of Object.entries(extra)) {
+        env.push(`${key}=${value}`);
+      }
+    }
+    if (this.network === "filtered") {
+      if (this.networkFilter) {
+        env.push(`ISOL8_WHITELIST=${JSON.stringify(this.networkFilter.whitelist)}`);
+        env.push(`ISOL8_BLACKLIST=${JSON.stringify(this.networkFilter.blacklist)}`);
+      }
+      env.push(`HTTP_PROXY=http://127.0.0.1:${PROXY_PORT}`);
+      env.push(`HTTPS_PROXY=http://127.0.0.1:${PROXY_PORT}`);
+      env.push(`http_proxy=http://127.0.0.1:${PROXY_PORT}`);
+      env.push(`https_proxy=http://127.0.0.1:${PROXY_PORT}`);
+    }
+    return env;
+  }
+  async* streamExecOutput(stream, exec, container, timeoutMs) {
+    const queue = [];
+    let resolve2 = null;
+    let done = false;
+    const push = (event) => {
+      queue.push(event);
+      if (resolve2) {
+        resolve2();
+        resolve2 = null;
+      }
+    };
+    const timer = setTimeout(() => {
+      push({ type: "error", data: "EXECUTION TIMED OUT" });
+      push({ type: "exit", data: "137" });
+      done = true;
+    }, timeoutMs);
+    const stdoutStream = new PassThrough;
+    const stderrStream = new PassThrough;
+    container.modem.demuxStream(stream, stdoutStream, stderrStream);
+    stdoutStream.on("data", (chunk) => {
+      let text = chunk.toString("utf-8");
+      if (Object.keys(this.secrets).length > 0) {
+        text = maskSecrets(text, this.secrets);
+      }
+      push({ type: "stdout", data: text });
+    });
+    stderrStream.on("data", (chunk) => {
+      let text = chunk.toString("utf-8");
+      if (Object.keys(this.secrets).length > 0) {
+        text = maskSecrets(text, this.secrets);
+      }
+      push({ type: "stderr", data: text });
+    });
+    stream.on("end", async () => {
+      clearTimeout(timer);
+      try {
+        const info = await exec.inspect();
+        push({ type: "exit", data: (info.ExitCode ?? 0).toString() });
+      } catch {
+        push({ type: "exit", data: "1" });
+      }
+      done = true;
+    });
+    stream.on("error", (err) => {
+      clearTimeout(timer);
+      push({ type: "error", data: err.message });
+      push({ type: "exit", data: "1" });
+      done = true;
+    });
+    while (!done || queue.length > 0) {
+      if (queue.length > 0) {
+        yield queue.shift();
+      } else if (resolve2) {
+        await new Promise((r) => {
+          resolve2 = r;
+        });
+      } else {
+        await new Promise((r) => setTimeout(r, 10));
+      }
+    }
+  }
+  async collectExecOutput(stream, container, timeoutMs) {
+    return new Promise((resolve2, reject) => {
+      let stdout = "";
+      let stderr = "";
+      let truncated = false;
+      let settled = false;
+      let stdoutEnded = false;
+      let stderrEnded = false;
+      const timer = setTimeout(() => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        if (stream.destroy) {
+          stream.destroy();
+        }
+        resolve2({ stdout, stderr: `${stderr}
+--- EXECUTION TIMED OUT ---`, truncated });
+      }, timeoutMs);
+      const stdoutStream = new PassThrough;
+      const stderrStream = new PassThrough;
+      container.modem.demuxStream(stream, stdoutStream, stderrStream);
+      stdoutStream.on("data", (chunk) => {
+        stdout += chunk.toString("utf-8");
+        if (stdout.length > this.maxOutputSize) {
+          const result = truncateOutput(stdout, this.maxOutputSize);
+          stdout = result.text;
+          truncated = true;
+        }
+      });
+      stderrStream.on("data", (chunk) => {
+        stderr += chunk.toString("utf-8");
+        if (stderr.length > this.maxOutputSize) {
+          const result = truncateOutput(stderr, this.maxOutputSize);
+          stderr = result.text;
+          truncated = true;
+        }
+      });
+      const checkDone = () => {
+        if (settled) {
+          return;
+        }
+        if (stdoutEnded && stderrEnded) {
+          settled = true;
+          clearTimeout(timer);
+          resolve2({ stdout, stderr, truncated });
+        }
+      };
+      stdoutStream.on("end", () => {
+        stdoutEnded = true;
+        checkDone();
+      });
+      stderrStream.on("end", () => {
+        stderrEnded = true;
+        checkDone();
+      });
+      stream.on("error", (err) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        reject(err);
+      });
+      stream.on("end", () => {
+        if (settled) {
+          return;
+        }
+        setTimeout(() => {
+          if (!settled) {
+            stdoutEnded = true;
+            stderrEnded = true;
+            checkDone();
+          }
+        }, 100);
+      });
+    });
+  }
+  postProcessOutput(output, _truncated) {
+    let result = output;
+    if (Object.keys(this.secrets).length > 0) {
+      result = maskSecrets(result, this.secrets);
+    }
+    return result.trimEnd();
+  }
+  static async cleanup(docker) {
+    const dockerInstance = docker ?? new Docker;
+    const containers = await dockerInstance.listContainers({ all: true });
+    const isol8Containers = containers.filter((c) => c.Image.startsWith("isol8:"));
+    let removed = 0;
+    let failed = 0;
+    const errors = [];
+    for (const containerInfo of isol8Containers) {
+      try {
+        const container = dockerInstance.getContainer(containerInfo.Id);
+        await container.remove({ force: true });
+        removed++;
+      } catch (err) {
+        failed++;
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        errors.push(`${containerInfo.Id.slice(0, 12)}: ${errorMsg}`);
+      }
+    }
+    return { removed, failed, errors };
+  }
+  static async cleanupImages(docker) {
+    const dockerInstance = docker ?? new Docker;
+    const images = await dockerInstance.listImages({ all: true });
+    const isol8Images = images.filter((img) => img.RepoTags?.some((tag) => tag.startsWith("isol8:")));
+    let removed = 0;
+    let failed = 0;
+    const errors = [];
+    for (const imageInfo of isol8Images) {
+      try {
+        const image = dockerInstance.getImage(imageInfo.Id);
+        await image.remove({ force: true });
+        removed++;
+      } catch (err) {
+        failed++;
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        const imageRef = imageInfo.RepoTags?.[0] ?? imageInfo.Id.slice(0, 12);
+        errors.push(`${imageRef}: ${errorMsg}`);
+      }
+    }
+    return { removed, failed, errors };
+  }
+}
+
+// src/index.ts
+init_image_builder();
+init_runtime();
+init_logger();
+// package.json
+var package_default = {
+  name: "@isol8/core",
+  version: "0.13.0-alpha.0",
+  description: "Core engine for isol8 secure code execution",
+  author: "Illusion47586",
+  license: "MIT",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./schema": "./schema/isol8.config.schema.json"
+  },
+  scripts: {
+    build: "bun run scripts/build.ts",
+    test: "bun test tests/unit/",
+    "test:prod": "echo 'No production tests in core package'",
+    "lint:check": "ultracite check",
+    "lint:fix": "ultracite fix",
+    schema: "ts-json-schema-generator --path src/types.ts --type Isol8UserConfig --tsconfig tsconfig.json -o schema/isol8.config.schema.json && ultracite fix schema/isol8.config.schema.json"
+  },
+  dependencies: {
+    dockerode: "^4.0.9",
+    hono: "^4.11.9"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    "@types/dockerode": "^4.0.1",
+    "@types/node": "^25.2.3",
+    "ts-json-schema-generator": "^2.5.0",
+    typescript: "^5.9.3",
+    ultracite: "^7.2.0"
+  },
+  files: [
+    "dist",
+    "schema",
+    "docker"
+  ],
+  jsonValidation: [
+    {
+      fileMatch: "isol8.config.json",
+      url: "./schema/isol8.config.schema.json"
+    }
+  ]
+};
+
+// src/version.ts
+var VERSION = package_default.version;
+export {
+  logger,
+  loadConfig,
+  buildCustomImages,
+  buildBaseImages,
+  bashAdapter,
+  VERSION,
+  Semaphore,
+  RuntimeRegistry,
+  RemoteIsol8,
+  PythonAdapter,
+  NodeAdapter,
+  DockerIsol8,
+  DenoAdapter,
+  BunAdapter
+};
+
+//# debugId=22F12DAC58898F0F64756E2164756E21