@local-sandbox/lsb-nodejs 0.1.0

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2025 SuperHQ AI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,193 @@
+# `@local-sandbox/lsb-nodejs`
+
+Native Node.js bindings for [lsb](https://github.com/LocalSandBox/local-sandbox.git), built with
+[`napi-rs`](https://napi.rs/).
+
+This package is the canonical JavaScript and TypeScript entrypoint for lsb. It wraps the
+Rust [`lsb-sdk`](../../crates/lsb-sdk) directly and exposes a Node-facing `Sandbox` API.
+
+## Install
+
+```sh
+npm install @local-sandbox/lsb-nodejs
+```
+
+The published npm package is split into a root package plus a platform package. On supported hosts,
+`npm` resolves and installs either `@local-sandbox/lsb-nodejs-darwin-arm64` or
+`@local-sandbox/lsb-nodejs-darwin-x64` automatically.
+
+For local development, use Corepack to run the Yarn version pinned in
+[`package.json`](./package.json):
+
+```sh
+corepack yarn install
+```
+
+## Requirements
+
+- Node.js 18+
+- macOS 14+ on Apple Silicon or Intel x86_64
+- [lsb CLI](https://github.com/LocalSandBox/local-sandbox.git) installed
+- `Sandbox.start()` expects the lsb runtime data directory to already exist. In the default
+  location, `~/.local/share/lsb/Image` must be present before booting a sandbox. This VM image
+  is not bundled with `@local-sandbox/lsb-nodejs` and needs to be downloaded manually as part of your
+  lsb runtime setup.
+- On macOS, the `node` executable loading this SDK must be code signed with the
+  `com.apple.security.virtualization` entitlement. For a project-local workflow, sign a copied
+  Node binary with [`../../lsb.entitlements`](../../lsb.entitlements), or use
+  [`test:signed-node`](./package.json) as a reference.
+
+## Usage
+
+### Start a sandbox and run commands
+
+```ts
+import { Sandbox } from '@local-sandbox/lsb-nodejs'
+
+const dataDir = `${process.env.HOME}/.local/share/lsb`
+const sandbox = await Sandbox.start({
+  dataDir,
+  cpus: 2,
+  memory: 2048,
+  allowNet: true,
+  mounts: {
+    './src': '/workspace',
+  },
+})
+
+const result = await sandbox.exec('echo hello from lsb')
+console.log(result.stdout)
+
+await sandbox.writeFile('/tmp/demo.txt', 'hello')
+const content = await sandbox.readFile('/tmp/demo.txt')
+console.log(content.toString())
+
+await sandbox.stop()
+```
+
+### Pass argv directly or run through a shell
+
+```ts
+import { Sandbox } from '@local-sandbox/lsb-nodejs'
+
+const sandbox = await Sandbox.start()
+
+const argvResult = await sandbox.exec(['sh', '-lc', 'printf "%s" "$HOME"'])
+console.log(argvResult.stdout)
+
+const shellResult = await sandbox.execShell('uname -a')
+console.log(shellResult.stdout)
+
+await sandbox.stop()
+```
+
+### Inspect the guest filesystem
+
+```ts
+import { Sandbox } from '@local-sandbox/lsb-nodejs'
+
+const sandbox = await Sandbox.start()
+
+await sandbox.writeFile('/tmp/demo.txt', 'hello from lsb')
+
+const entries = await sandbox.readDir('/tmp')
+const stat = await sandbox.stat('/tmp/demo.txt')
+const exists = await sandbox.exists('/tmp/demo.txt')
+
+console.log(entries.map((entry) => `${entry.type}: ${entry.name}`))
+console.log({ size: stat.size, mode: stat.mode, exists })
+
+await sandbox.stop()
+```
+
+### Save and resume from a checkpoint
+
+```ts
+import { Sandbox } from '@local-sandbox/lsb-nodejs'
+
+const base = await Sandbox.start()
+await base.exec('mkdir -p /workspace && echo ready > /workspace/state.txt')
+await base.checkpoint('my-env')
+
+const resumed = await Sandbox.start({ from: 'my-env' })
+const state = await resumed.readFile('/workspace/state.txt')
+console.log(state.toString())
+
+await resumed.stop()
+```
+
+### Configure mounts, ports, secrets, and network policy
+
+```ts
+import { Sandbox } from '@local-sandbox/lsb-nodejs'
+
+const sandbox = await Sandbox.start({
+  cpus: 4,
+  memory: 4096,
+  diskSize: 8192,
+  allowNet: true,
+  ports: ['8080:80'],
+  mounts: { './src': '/workspace' },
+  secrets: {
+    API_KEY: { value: 'sk-test', hosts: ['api.openai.com'] },
+  },
+  network: { allow: ['api.openai.com', 'registry.npmjs.org'] },
+})
+
+console.log(sandbox.instanceDir)
+
+await sandbox.stop()
+```
+
+### Start options
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `from` | `string` | Checkpoint name to start from |
+| `cpus` | `number` | Number of vCPUs |
+| `memory` | `number` | Memory in MB |
+| `diskSize` | `number` | Disk size in MB |
+| `dataDir` | `string` | lsb runtime data directory |
+| `allowNet` | `boolean` | Enable network access |
+| `allowedHosts` | `string[]` | Additional allowlisted hosts |
+| `ports` | `string[]` | Port forwards (`"host:guest"`) |
+| `mounts` | `Record<string, string>` | Directory mounts (`{ hostPath: guestPath }`) |
+| `secrets` | `Record<string, SecretConfig>` | Secrets injected via the lsb proxy |
+| `network` | `NetworkConfig` | Network access policy |
+
+## Scripts
+
+```sh
+corepack yarn build
+corepack yarn test
+corepack yarn test:signed-node
+```
+
+`corepack yarn test` always builds the native binding first, then runs AVA against the
+generated root entrypoint. The positive VM smoke test only runs when both of these are true:
+
+- lsb runtime assets already exist in `~/.local/share/lsb` or in `LSB_NODEJS_TEST_DATA_DIR`
+  (`Image` is expected there and usually needs to be provisioned manually)
+- the current `node` executable has the `com.apple.security.virtualization` entitlement
+
+To avoid modifying your global Node installation, use [`test:signed-node`](./package.json),
+which copies the current `node` binary into `.signed-node/node`, signs that local copy with
+[`../../lsb.entitlements`](../../lsb.entitlements), prepends it to `PATH`, and then runs
+the local `napi build --platform` plus `ava` commands through that signed Node:
+
+```sh
+corepack yarn test:signed-node
+```
+
+If runtime assets are missing, provision them in the lsb data directory first. The generated build outputs
+(`index.js`, `index.d.ts`, `lsb-nodejs.*.node`) are local artifacts and are ignored by git.
+This explicit smoke-test entrypoint will attempt a real VM boot; if your host still refuses
+virtualization after signing the local Node copy, the command will surface that underlying error.
+
+## Platform Notes
+
+- Supported targets: macOS on Apple Silicon (`aarch64-apple-darwin`) and Intel (`x86_64-apple-darwin`).
+- Installation is limited to supported macOS architectures. Unsupported platforms should fail during
+  `npm install` instead of installing a package that only errors at runtime.
+- The published native binaries live in the platform packages
+  `@local-sandbox/lsb-nodejs-darwin-arm64` and `@local-sandbox/lsb-nodejs-darwin-x64`.

package/index.d.ts

@@ -0,0 +1,106 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+export declare class Sandbox {
+  static start(opts?: StartOptions | undefined | null): Promise<Sandbox>
+  exec(command: string | Array<string>, opts?: ExecOptions | undefined | null): Promise<ExecResult>
+  execShell(command: string): Promise<ExecResult>
+  spawn(command: string | Array<string>, opts?: SpawnOptions | undefined | null): Promise<SpawnedProcess>
+  watch(path: string, callback: (arg: FileChangeEvent) => unknown, opts?: WatchOptions | undefined | null): void
+  readFile(path: string): Promise<Buffer>
+  writeFile(path: string, content: string | Uint8Array): Promise<void>
+  mkdir(path: string, opts?: MkdirOptions | undefined | null): Promise<void>
+  readDir(path: string): Promise<Array<DirEntry>>
+  stat(path: string): Promise<StatResult>
+  remove(path: string, opts?: RemoveOptions | undefined | null): Promise<void>
+  rename(oldPath: string, newPath: string): Promise<void>
+  copy(src: string, dst: string, opts?: CopyOptions | undefined | null): Promise<void>
+  chmod(path: string, mode: number): Promise<void>
+  exists(path: string): Promise<boolean>
+  checkpoint(name: string): Promise<void>
+  stop(): Promise<void>
+  get instanceDir(): string
+}
+
+export declare class SpawnedProcess {
+  on(event: string, callback: (arg: unknown) => unknown): void
+  write(data: string | Uint8Array): void
+  kill(): Promise<void>
+  get pid(): string
+  get exited(): Promise<number>
+}
+
+export interface CopyOptions {
+  recursive?: boolean
+}
+
+export interface DirEntry {
+  name: string
+  type: string
+  size: number
+}
+
+export interface ExecOptions {
+  shell?: string
+}
+
+export interface ExecResult {
+  stdout: string
+  stderr: string
+  exitCode: number
+}
+
+export interface FileChangeEvent {
+  path: string
+  event: string
+}
+
+export interface MkdirOptions {
+  recursive?: boolean
+}
+
+export interface NetworkConfig {
+  allow?: Array<string>
+}
+
+export interface RemoveOptions {
+  recursive?: boolean
+}
+
+export interface SecretConfig {
+  value: string
+  hosts: Array<string>
+}
+
+export interface SpawnOptions {
+  cwd?: string
+  env?: Record<string, string>
+  shell?: string
+}
+
+export interface StartOptions {
+  instanceId?: string
+  from?: string
+  cpus?: number
+  memory?: number
+  diskSize?: number
+  dataDir?: string
+  allowNet?: boolean
+  allowedHosts?: Array<string>
+  ports?: Array<string>
+  mounts?: Record<string, string>
+  secrets?: Record<string, SecretConfig>
+  network?: NetworkConfig
+}
+
+export interface StatResult {
+  size: number
+  mode: number
+  mtime: number
+  isDir: boolean
+  isFile: boolean
+  isSymlink: boolean
+}
+
+export interface WatchOptions {
+  recursive?: boolean
+}

package/index.js

@@ -0,0 +1,561 @@
+// prettier-ignore
+/* eslint-disable */
+// @ts-nocheck
+/* auto-generated by NAPI-RS */
+
+const { createRequire } = require('node:module')
+require = createRequire(__filename)
+
+const { readFileSync } = require('node:fs')
+let nativeBinding = null
+const loadErrors = []
+
+const isMusl = () => {
+  let musl = false
+  if (process.platform === 'linux') {
+    musl = isMuslFromFilesystem()
+    if (musl === null) {
+      musl = isMuslFromReport()
+    }
+    if (musl === null) {
+      musl = isMuslFromChildProcess()
+    }
+  }
+  return musl
+}
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+const isMuslFromFilesystem = () => {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+const isMuslFromReport = () => {
+  let report = null
+  if (typeof process.report?.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) {
+    return null
+  }
+  if (report.header && report.header.glibcVersionRuntime) {
+    return false
+  }
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) {
+      return true
+    }
+  }
+  return false
+}
+
+const isMuslFromChildProcess = () => {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch (e) {
+    // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false
+    return false
+  }
+}
+
+function requireNative() {
+  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
+    try {
+      return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
+    } catch (err) {
+      loadErrors.push(err)
+    }
+  } else if (process.platform === 'android') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./lsb-nodejs.android-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-android-arm64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-android-arm64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./lsb-nodejs.android-arm-eabi.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-android-arm-eabi')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-android-arm-eabi/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Android ${process.arch}`))
+    }
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./lsb-nodejs.win32-x64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-win32-x64-msvc')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-win32-x64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'ia32') {
+      try {
+        return require('./lsb-nodejs.win32-ia32-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-win32-ia32-msvc')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-win32-ia32-msvc/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lsb-nodejs.win32-arm64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-win32-arm64-msvc')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-win32-arm64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Windows: ${process.arch}`))
+    }
+  } else if (process.platform === 'darwin') {
+    try {
+      return require('./lsb-nodejs.darwin-universal.node')
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    try {
+      const binding = require('@local-sandbox/lsb-nodejs-darwin-universal')
+      const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-darwin-universal/package.json').version
+      if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      }
+      return binding
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    if (process.arch === 'x64') {
+      try {
+        return require('./lsb-nodejs.darwin-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-darwin-x64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-darwin-x64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lsb-nodejs.darwin-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-darwin-arm64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-darwin-arm64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on macOS: ${process.arch}`))
+    }
+  } else if (process.platform === 'freebsd') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./lsb-nodejs.freebsd-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-freebsd-x64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-freebsd-x64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lsb-nodejs.freebsd-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-freebsd-arm64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-freebsd-arm64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on FreeBSD: ${process.arch}`))
+    }
+  } else if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      if (isMusl()) {
+        try {
+          return require('./lsb-nodejs.linux-x64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-x64-musl')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-x64-musl/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lsb-nodejs.linux-x64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-x64-gnu')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-x64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm64') {
+      if (isMusl()) {
+        try {
+          return require('./lsb-nodejs.linux-arm64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-arm64-musl')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-arm64-musl/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lsb-nodejs.linux-arm64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-arm64-gnu')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-arm64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm') {
+      if (isMusl()) {
+        try {
+          return require('./lsb-nodejs.linux-arm-musleabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-arm-musleabihf')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-arm-musleabihf/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lsb-nodejs.linux-arm-gnueabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-arm-gnueabihf')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-arm-gnueabihf/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'loong64') {
+      if (isMusl()) {
+        try {
+          return require('./lsb-nodejs.linux-loong64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-loong64-musl')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-loong64-musl/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lsb-nodejs.linux-loong64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-loong64-gnu')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-loong64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'riscv64') {
+      if (isMusl()) {
+        try {
+          return require('./lsb-nodejs.linux-riscv64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-riscv64-musl')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-riscv64-musl/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lsb-nodejs.linux-riscv64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@local-sandbox/lsb-nodejs-linux-riscv64-gnu')
+          const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-riscv64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'ppc64') {
+      try {
+        return require('./lsb-nodejs.linux-ppc64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-linux-ppc64-gnu')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-ppc64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 's390x') {
+      try {
+        return require('./lsb-nodejs.linux-s390x-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-linux-s390x-gnu')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-linux-s390x-gnu/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Linux: ${process.arch}`))
+    }
+  } else if (process.platform === 'openharmony') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./lsb-nodejs.openharmony-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-openharmony-arm64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-openharmony-arm64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'x64') {
+      try {
+        return require('./lsb-nodejs.openharmony-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-openharmony-x64')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-openharmony-x64/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./lsb-nodejs.openharmony-arm.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@local-sandbox/lsb-nodejs-openharmony-arm')
+        const bindingPackageVersion = require('@local-sandbox/lsb-nodejs-openharmony-arm/package.json').version
+        if (bindingPackageVersion !== '0.1.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.1.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on OpenHarmony: ${process.arch}`))
+    }
+  } else {
+    loadErrors.push(new Error(`Unsupported OS: ${process.platform}, architecture: ${process.arch}`))
+  }
+}
+
+nativeBinding = requireNative()
+
+if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
+  let wasiBinding = null
+  let wasiBindingError = null
+  try {
+    wasiBinding = require('./lsb-nodejs.wasi.cjs')
+    nativeBinding = wasiBinding
+  } catch (err) {
+    if (process.env.NAPI_RS_FORCE_WASI) {
+      wasiBindingError = err
+    }
+  }
+  if (!nativeBinding) {
+    try {
+      wasiBinding = require('@local-sandbox/lsb-nodejs-wasm32-wasi')
+      nativeBinding = wasiBinding
+    } catch (err) {
+      if (process.env.NAPI_RS_FORCE_WASI) {
+        wasiBindingError.cause = err
+        loadErrors.push(err)
+      }
+    }
+  }
+  if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
+    const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
+    error.cause = wasiBindingError
+    throw error
+  }
+}
+
+if (!nativeBinding) {
+  if (loadErrors.length > 0) {
+    throw new Error(
+      `Cannot find native binding. ` +
+        `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
+        'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
+      {
+        cause: loadErrors.reduce((err, cur) => {
+          cur.cause = err
+          return cur
+        }),
+      },
+    )
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+module.exports = nativeBinding
+module.exports.Sandbox = nativeBinding.Sandbox
+module.exports.SpawnedProcess = nativeBinding.SpawnedProcess

package/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "@local-sandbox/lsb-nodejs",
+  "version": "0.1.0",
+  "description": "Native Node.js bindings for lsb microVM sandboxes",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "license": "Apache-2.0",
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64",
+    "x64"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LocalSandBox/local-sandbox.git",
+    "directory": "bindings/nodejs"
+  },
+  "keywords": [
+    "lsb",
+    "napi-rs",
+    "node-addon",
+    "sandbox",
+    "microvm"
+  ],
+  "files": [
+    "README.md",
+    "LICENSE",
+    "index.d.ts",
+    "index.js"
+  ],
+  "napi": {
+    "binaryName": "lsb-nodejs",
+    "packageName": "@local-sandbox/lsb-nodejs",
+    "targets": [
+      "aarch64-apple-darwin",
+      "x86_64-apple-darwin"
+    ]
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "scripts": {
+    "artifacts": "napi artifacts",
+    "build": "napi build --platform --release",
+    "build:debug": "napi build --platform",
+    "format": "run-p format:prettier format:rs format:toml",
+    "format:prettier": "prettier . -w",
+    "format:rs": "cargo fmt",
+    "format:toml": "taplo format",
+    "lint": "oxlint .",
+    "prepublishOnly": "napi prepublish -t npm --no-gh-release",
+    "test": "napi build --platform && ava",
+    "test:signed-node": "./scripts/test-with-signed-node.sh",
+    "version": "napi version"
+  },
+  "devDependencies": {
+    "@napi-rs/cli": "^3.2.0",
+    "@oxc-node/core": "^0.0.35",
+    "@taplo/cli": "^0.7.0",
+    "@types/node": "^22.15.30",
+    "ava": "^7.0.0",
+    "npm-run-all2": "^8.0.4",
+    "oxlint": "^1.14.0",
+    "prettier": "^3.6.2",
+    "typescript": "^5.9.2"
+  },
+  "ava": {
+    "files": [
+      "test/**/*.spec.ts"
+    ],
+    "extensions": {
+      "ts": "module"
+    },
+    "timeout": "1m",
+    "workerThreads": false,
+    "environmentVariables": {
+      "OXC_TSCONFIG_PATH": "./test/tsconfig.json"
+    },
+    "nodeArguments": [
+      "--import",
+      "@oxc-node/core/register"
+    ]
+  },
+  "prettier": {
+    "printWidth": 100,
+    "semi": false,
+    "trailingComma": "all",
+    "singleQuote": true,
+    "arrowParens": "always"
+  },
+  "packageManager": "yarn@4.12.0",
+  "optionalDependencies": {
+    "@local-sandbox/lsb-nodejs-darwin-arm64": "0.1.0",
+    "@local-sandbox/lsb-nodejs-darwin-x64": "0.1.0"
+  }
+}