@nimbus-sh/core 0.1.0

package/dist/runtime/wasi-instance.d.ts

@@ -0,0 +1,215 @@
+/**
+ * wasi-instance.ts — WASI snapshot_preview1 shim for Nimbus.
+ *
+ * Core WASI surface:
+ *   args_get / args_sizes_get / environ_get / environ_sizes_get
+ *   fd_close / fd_write / fd_read / fd_seek / fd_tell
+ *   fd_fdstat_get / fd_fdstat_set_flags
+ *   proc_exit
+ *   clock_time_get / clock_res_get
+ *   random_get
+ *   sched_yield
+ *
+ * Filesystem WASI additions:
+ *   path_open
+ *   path_create_directory / path_remove_directory
+ *   path_unlink_file
+ *   path_rename
+ *   path_filestat_get / path_filestat_set_times
+ *   fd_readdir                          (cookie-paginated)
+ *   fd_filestat_get / fd_filestat_set_size
+ *   fd_pread / fd_pwrite
+ *   fd_prestat_get / fd_prestat_dir_name (real preopens, not EBADF)
+ *
+ * Socket, polling, and metadata additions:
+ *   - per-file mtime/atime/ctime tracking + in-memory symlink table
+ *       (additive — files Map shape unchanged; parallel times/symlinks Maps)
+ *   - fd_filestat_set_times / path_filestat_set_times — implementations that
+ *       write mtime/atime; honor ATIM_NOW / MTIM_NOW flags via clock_realtime
+ *   - path_symlink / path_readlink / path_link. Symlink
+ *       resolution via __wasiResolvePathFull(baseFd, path, followFlag)
+ *       with POSIX-style 40-deep loop detection (returns ELOOP).
+ *   - fd_allocate extends bytes to offset+len and zero-fills.
+ *   - proc_raise(sig) throws __WasiExit(128 + sig) per POSIX shell convention
+ *       (SIGABRT=6 -> 134, SIGTERM=15 -> 143).
+ *   - fd_fdstat_set_rights tracks per-fd rights mask;
+ *       fd_fdstat_get returns the tracked mask instead of wide-open).
+ *
+ * Socket support via cloudflare:sockets + JSPI:
+ *   - sock_send / sock_recv / sock_shutdown via
+ *       WebAssembly.Suspending wrapping. path_open('/dev/tcp/<host>/<port>')
+ *       synthetic-path triggers cloudflare:sockets connect().
+ *
+ * Poll support via JSPI:
+ *   - poll_oneoff handles all three subscription types in a
+ *       single Promise.race wrapped via WebAssembly.Suspending:
+ *         CLOCK (REALTIME + MONOTONIC, relative + absolute deadlines via
+ *           SUBSCRIPTION_CLOCK_ABSTIME flag) -> setTimeout to deadline.
+ *         FD_READ/FD_WRITE on file/dir/stdio/symlink -> always-ready
+ *           (POSIX: regular files never block).
+ *         FD_READ on socket -> real await on
+ *           socket.readable.getReader().read(); data is stashed on
+ *           entry.readBuf so subsequent sock_recv sees it pre-loaded.
+ *         FD_WRITE on socket -> always-ready (CF Workers writable
+ *           streams have unbounded queue from wasm-side perspective).
+ *       Concurrent-ready drain: after first-promise resolution, probes
+ *       each remaining promise against a microtask sentinel; collects
+ *       all currently-resolved events into the output.
+ *
+ * wasi-threads:
+ *   Implemented, in runtime/wasi-threads.ts, whose preamble is appended to
+ *   this one — threads syscall through THESE imports, so they share one
+ *   evaluated scope. This file's only stake in it is two lines: a park
+ *   releases the scheduler token (withParkDeadline) and sched_yield is a
+ *   real scheduling point. Correct but never parallel; see
+ *   docs/wasi-threads.md.
+ *
+ * Architecture (filesystem WASI strategy)
+ * ──────────────────────────────
+ *
+ * Strategy: live VFS, seeded cache. The session VFS (supervisor DO) is the
+ * single source of truth. The facet holds a CACHE of it:
+ *
+ *   - `__wasiInitFS(seed)` installs a metadata manifest (dirs, modes, sizes,
+ *     times, symlinks) plus optional file content. Content the seed did not
+ *     carry is listed in `sizes` and demand-loaded through the SUPERVISOR
+ *     binding (`fsReadRange`, 64 KiB chunks) on first read — a seed miss is
+ *     a cache miss, never a correctness failure.
+ *   - Writes apply to the cache synchronously and enqueue write-through ops
+ *     (writeFile / fsWriteRange / unlink / mkdir / rename / …) on a FIFO
+ *     persist queue that drains continuously. Callers await
+ *     `__wasiDrainPersist()` before returning a result and at every resident
+ *     park, so a server's writes are durable while it runs — there is no
+ *     flush-on-exit and no diff-back.
+ *   - Any live read (content fetch, stat miss, readdir refresh) first drains
+ *     the queue, so the supervisor's answer always includes this process's
+ *     own writes.
+ *   - A metadata miss with a supervisor present goes to a live `stat` before
+ *     reporting ENOENT, so files created after spawn are visible.
+ *
+ * Seeds are validated supervisor-side by the per-subtree VFS revision
+ * (runners rebuild the seed when the revision moved), so a served seed is
+ * never stale. Without a supervisor binding the seed is authoritative and
+ * behavior degrades to the closed-world snapshot semantics unit tests use.
+ *
+ * Blocking discipline: file/stdio ops that can be answered from the cache
+ * return a plain errno number (JSPI passes it through with no suspender, so
+ * sync callers — ruby _initialize, opentui render — are unaffected). Ops
+ * that need the supervisor return a Promise which the Suspending wrapper
+ * parks the guest on; the guest must run under WebAssembly.promising.
+ *
+ * Errno values (subset)
+ * ─────────────────────
+ *   ESUCCESS = 0     EBADF = 8     ENOENT = 44   EEXIST = 20
+ *   EISDIR   = 31    ENOTDIR = 54  EINVAL = 28   ENOSYS = 52
+ *   ELOOP    = 32    ENOTEMPTY = 55  ENOTCAPABLE = 76
+ *   ESPIPE   = 70    (stdio is a non-seekable pipe)
+ *
+ * Clock IDs
+ * ─────────
+ *   CLOCK_REALTIME = 0  / MONOTONIC = 1  / PROCESS_CPUTIME = 2  / THREAD = 3
+ *
+ * fstflags (filestat_set_times)
+ * ─────────────────────────────
+ *   __WASI_FSTFLAGS_ATIM     = 1
+ *   __WASI_FSTFLAGS_ATIM_NOW = 2
+ *   __WASI_FSTFLAGS_MTIM     = 4
+ *   __WASI_FSTFLAGS_MTIM_NOW = 8
+ */
+/**
+ * Source string injected as the loader-pool `preamble`. The facet's
+ * module init evaluates this verbatim so the WASI helpers (`__wasiInitFS`,
+ * `__wasiMakeImports`, `__wasiRunStart`, `__wasiReadFilesB64`) are in scope
+ * when the user fn runs. Self-contained — no closure captures, no imports.
+ *
+ * The wasi-threads scheduler is appended rather than inlined: it is one
+ * evaluated scope with the syscall layer (it has to be — threads syscall
+ * through these very imports), but it is a separate concern and lives in its
+ * own file.
+ */
+export declare const WASI_INSTANCE_PREAMBLE_SRC: string;
+/**
+ * A bundle of file/dir state passed from supervisor → facet for a WASI
+ * invocation. Files are base64-encoded for structured-clone transport.
+ *
+ * WASI socket and polling support B1+B3: added optional `times` and `symlinks` fields.
+ * `roots` is additive and lets language runtimes snapshot a cwd plus targeted
+ * persistent runtime state without widening every command to the whole home
+ * directory. Backward-compatible — callers that omit it use `root` only.
+ */
+/**
+ * The two WASI wire ABIs still in circulation. They share every function name
+ * and every signature, differing only in fd_seek's whence constants and the
+ * filestat struct layout — so binding the wrong one is silent, not a trap.
+ * `preview1` is `wasi_snapshot_preview1`; `preview0` is `wasi_unstable`.
+ */
+export type WasiAbi = 'preview1' | 'preview0';
+export declare const WASI_ABI_NAMESPACE: Readonly<Record<WasiAbi, string>>;
+export interface WasiFsSnapshot {
+    /** Canonical VFS root (no leading slash). E.g. `home/user/wasi-files`. */
+    root: string;
+    /** Canonical VFS roots covered by this snapshot. Defaults to `[root]`. */
+    roots?: string[];
+    /** Preopen list (order matters; preopens are assigned to fd 3, 4, …). */
+    preopens: Array<{
+        wasiPath: string;
+        vfsPath: string;
+    }>;
+    /** vfsPath → base64-encoded content. Empty if a fresh file. */
+    files: Record<string, string>;
+    /** Initial directory list (vfsPaths). */
+    dirs: string[];
+    /**
+     * vfsPath → size for files the manifest knows but whose bytes were not
+     * seeded. First read demand-loads them through the supervisor. A seed that
+     * lists a file here instead of in `files` trades one round trip on first
+     * access for not shipping bytes the process may never open.
+     */
+    sizes?: Record<string, number>;
+    /**
+     * Files at or above this many bytes are never held resident; reads window
+     * through the supervisor instead. Defaults to 8 MiB.
+     */
+    residentFileCap?: number;
+    /**
+     * Roots this seed listed COMPLETELY. Only a producer that walked the subtree
+     * with no exclusions may claim one: inside a claimed root an unlisted path
+     * is treated as genuinely absent and answered without a round trip.
+     */
+    enumeratedRoots?: string[];
+    /** Supervisor VFS revision the seed was built against (see fsRevision). */
+    revision?: number;
+    /** Effective read/write/execute bits for the invoking process, keyed by vfsPath. */
+    modes: Record<string, number>;
+    /**
+     * WASI socket and polling support B1: per-path nanosecond timestamps. Values are decimal strings
+     * (JSON.stringify-safe; BigInt would throw). Optional — omitted paths
+     * default to wall-clock-now at init time.
+     */
+    times?: Record<string, {
+        mtime: string;
+        atime: string;
+        ctime: string;
+    }>;
+    /**
+     * WASI socket and polling support B3: initial symlink table. `vfsPath → targetPath`. Target is
+     * stored verbatim per POSIX (resolution at lookup time).
+     */
+    symlinks?: Record<string, string>;
+}
+/**
+ * Names of the WASI imports implemented by this shim.
+ *
+ * `wasm-runner --help` prints this to users, so under-reporting sends a caller
+ * away from a syscall that is right there.
+ *
+ * The list stays hand-ordered because it is read by people — grouped the way the
+ * spec groups them — but it is no longer hand-MAINTAINED. `satisfies` rejects a
+ * name the import table does not implement, and `_AllSyscallsListed` below
+ * rejects a syscall the table implements that nobody added here. Both directions
+ * are compile errors, so the list cannot drift from the table in either one.
+ * `tests/unit/wasi-implemented-fns.mjs` remains the runtime half of the check:
+ * types cannot see inside the emitted source string.
+ */
+export declare const WASI_IMPLEMENTED_FNS: readonly ["args_get", "args_sizes_get", "environ_get", "environ_sizes_get", "fd_close", "fd_read", "fd_write", "fd_seek", "fd_tell", "fd_fdstat_get", "fd_fdstat_set_flags", "proc_exit", "proc_raise", "clock_time_get", "clock_res_get", "random_get", "sched_yield", "fd_prestat_get", "fd_prestat_dir_name", "path_open", "path_create_directory", "path_remove_directory", "path_unlink_file", "path_rename", "path_filestat_get", "path_filestat_set_times", "fd_filestat_get", "fd_filestat_set_size", "fd_filestat_set_times", "fd_pread", "fd_pwrite", "fd_readdir", "fd_renumber", "fd_advise", "fd_datasync", "fd_sync", "path_symlink", "path_readlink", "path_link", "fd_allocate", "fd_fdstat_set_rights", "sock_send", "sock_recv", "sock_shutdown", "sock_accept", "poll_oneoff"];
+//# sourceMappingURL=wasi-instance.d.ts.map

package/dist/runtime/wasi-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasi-instance.d.ts","sourceRoot":"","sources":["../../src/runtime/wasi-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AAMH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,QAAqD,CAAC;AAE7F;;;;;;;;GAQG;AACH;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9C,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAG/D,CAAC;AAEH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,yCAAyC;IACzC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,mwBA4BmB,CAAC"}

package/dist/runtime/wasi-instance.generated.d.ts

@@ -0,0 +1,14 @@
+/**
+ * wasi-instance.generated.ts — AUTO-GENERATED. DO NOT EDIT.
+ *
+ * Produced by scripts/bundle-facet-workers.mjs from:
+ *   - src/runtime/wasi/preamble.ts
+ *
+ * The WASI snapshot_preview1 shim as a flat ESM body, for splicing into a
+ * facet module source. wasi-instance.ts appends the wasi-threads scheduler
+ * and re-exports the result as WASI_INSTANCE_PREAMBLE_SRC.
+ *
+ * Size: 82.93 KiB
+ */
+export declare const WASI_INSTANCE_BODY_SRC: string;
+//# sourceMappingURL=wasi-instance.generated.d.ts.map

package/dist/runtime/wasi-instance.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasi-instance.generated.d.ts","sourceRoot":"","sources":["../../src/runtime/wasi-instance.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,sBAAsB,EAAE,MAAo/qF,CAAC"}

package/dist/runtime/wasi-instance.generated.js

@@ -0,0 +1,13 @@
+/**
+ * wasi-instance.generated.ts — AUTO-GENERATED. DO NOT EDIT.
+ *
+ * Produced by scripts/bundle-facet-workers.mjs from:
+ *   - src/runtime/wasi/preamble.ts
+ *
+ * The WASI snapshot_preview1 shim as a flat ESM body, for splicing into a
+ * facet module source. wasi-instance.ts appends the wasi-threads scheduler
+ * and re-exports the result as WASI_INSTANCE_PREAMBLE_SRC.
+ *
+ * Size: 82.93 KiB
+ */
+export const WASI_INSTANCE_BODY_SRC = "// src/runtime/wasi/preamble.ts\nvar __WASI_ESUCCESS = 0;\nvar __WASI_EAGAIN = 6;\nvar __WASI_EACCES = 2;\nvar __WASI_EBADF = 8;\nvar __WASI_ECONNREFUSED = 14;\nvar __WASI_EEXIST = 20;\nvar __WASI_EHOSTUNREACH = 23;\nvar __WASI_EINVAL = 28;\nvar __WASI_EIO = 29;\nvar __WASI_EISDIR = 31;\nvar __WASI_ELOOP = 32;\nvar __WASI_ENOENT = 44;\nvar __WASI_ENOSYS = 52;\nvar __WASI_ENOTCONN = 53;\nvar __WASI_ENOTDIR = 54;\nvar __WASI_ENOTEMPTY = 55;\nvar __WASI_ENOTSOCK = 57;\nvar __WASI_EPIPE = 64;\nvar __WASI_ESPIPE = 70;\nvar __WASI_ETIMEDOUT = 73;\nvar __WASI_ENOTCAPABLE = 76;\nvar __WASI_CLOCK_REALTIME = 0;\nvar __WASI_CLOCK_MONOTONIC = 1;\nvar __WASI_CLOCK_PROCESS_CPUTIME_ID = 2;\nvar __WASI_CLOCK_THREAD_CPUTIME_ID = 3;\nvar __WASI_O_CREAT = 1;\nvar __WASI_O_DIRECTORY = 2;\nvar __WASI_O_EXCL = 4;\nvar __WASI_O_TRUNC = 8;\nvar __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW = 1;\nvar __WASI_FDFLAGS_APPEND = 1;\nvar __WASI_FDFLAGS_NONBLOCK = 4;\nvar __WASI_FSTFLAGS_ATIM = 1;\nvar __WASI_FSTFLAGS_ATIM_NOW = 2;\nvar __WASI_FSTFLAGS_MTIM = 4;\nvar __WASI_FSTFLAGS_MTIM_NOW = 8;\nvar __WASI_FT_UNKNOWN = 0;\nvar __WASI_FT_BLOCK_DEVICE = 1;\nvar __WASI_FT_CHARACTER_DEVICE = 2;\nvar __WASI_FT_DIRECTORY = 3;\nvar __WASI_FT_REGULAR_FILE = 4;\nvar __WASI_FT_SOCKET_DGRAM = 5;\nvar __WASI_FT_SOCKET_STREAM = 6;\nvar __WASI_FT_SYMBOLIC_LINK = 7;\nvar __WASI_PREOPENTYPE_DIR = 0;\nvar __WASI_SYMLOOP_MAX = 40;\nvar __WASI_RIGHTS_ALL = 0xFFFFFFFFFFFFFFFFn;\nvar __WASI_RIGHT_FD_READ = 1n << 1n;\nvar __WASI_RIGHT_FD_WRITE = 1n << 6n;\nvar __WASI_SDFLAGS_RD = 1;\nvar __WASI_SDFLAGS_WR = 2;\nvar __WASI_EVENTTYPE_CLOCK = 0;\nvar __WASI_EVENTTYPE_FD_READ = 1;\nvar __WASI_EVENTTYPE_FD_WRITE = 2;\nvar __WASI_SUBCLOCKFLAGS_ABSTIME = 1;\nvar __WASI_TCP_PATH_PREFIX = \"/dev/tcp/\";\nvar __WASI_ACCEPTED_PATH_PREFIX = \"/dev/nimbus/socket/\";\nvar __WASI_LISTEN_PATH_PREFIX = \"/dev/nimbus/listen/\";\nvar __cfSocketConnect = null;\ntry {\n  const __mod = await import(\"cloudflare:sockets\");\n  __cfSocketConnect = __mod.connect;\n} catch (__e) {\n}\nvar __WasiExit = class {\n  constructor(code) {\n    this.code = code | 0;\n  }\n};\nfunction __wasiEmptyFS() {\n  return {\n    root: \"\",\n    files: /* @__PURE__ */ new Map(),\n    dirs: /* @__PURE__ */ new Set(),\n    times: /* @__PURE__ */ new Map(),\n    symlinks: /* @__PURE__ */ new Map(),\n    modes: /* @__PURE__ */ new Map(),\n    sizes: /* @__PURE__ */ new Map(),\n    origFiles: /* @__PURE__ */ new Map(),\n    residentFileCap: 8 * 1024 * 1024,\n    enumeratedRoots: [],\n    revision: null\n  };\n}\nvar __wasiFS = __wasiEmptyFS();\nvar __wasiPreopens = [];\nvar __wasiThreads = null;\nvar __wasiSup = null;\nvar __wasiPersistQ = { pending: [], tail: Promise.resolve(), failures: [] };\nfunction __wasiAdoptSupervisor(sup) {\n  if (sup) __wasiSup = sup;\n}\nfunction __wasiExpectsLiveBacking() {\n  return __wasiFS.revision !== null && __wasiFS.revision !== void 0;\n}\nfunction __wasiEnqueue(op, run) {\n  if (!__wasiSup) {\n    if (__wasiExpectsLiveBacking()) {\n      __wasiPersistQ.failures.push(op + \": no supervisor adopted for a live-backed filesystem\");\n    }\n    return;\n  }\n  const sup = __wasiSup;\n  const entry = { op };\n  __wasiPersistQ.pending.push(entry);\n  __wasiPersistQ.tail = __wasiPersistQ.tail.then(async () => {\n    try {\n      await run(sup);\n    } catch (e) {\n      __wasiPersistQ.failures.push(op + \": \" + (e && e.message || String(e)));\n    } finally {\n      const i = __wasiPersistQ.pending.indexOf(entry);\n      if (i >= 0) __wasiPersistQ.pending.splice(i, 1);\n    }\n  });\n}\nvar __wasiDirty = /* @__PURE__ */ new Set();\nvar __wasiNegative = /* @__PURE__ */ new Set();\nfunction __wasiPersistFile(vfsPath) {\n  if (__wasiDirty.has(vfsPath)) return;\n  __wasiDirty.add(vfsPath);\n  const fs = __wasiFS;\n  __wasiEnqueue(\"writeFile \" + vfsPath, async (sup) => {\n    __wasiDirty.delete(vfsPath);\n    const bytes = fs && fs.files.get(vfsPath);\n    if (!bytes) return;\n    await sup.writeFile(vfsPath, bytes);\n  });\n}\nfunction __wasiPersistTimes(vfsPath) {\n  const t = __wasiFS.times.get(vfsPath);\n  if (!t) return;\n  const atimeMs = Number(t.atime / 1000000n);\n  const mtimeMs = Number(t.mtime / 1000000n);\n  __wasiEnqueue(\"utimes \" + vfsPath, (sup) => sup.utimes(vfsPath, atimeMs, mtimeMs));\n}\nfunction __wasiPersistSymlink(target, vfsPath) {\n  __wasiEnqueue(\"symlink \" + vfsPath, (sup) => sup.symlink(target, vfsPath));\n}\nfunction __wasiEvictCleanContent() {\n  if (!__wasiFS || !__wasiSup) return [];\n  const evicted = [];\n  for (const [path, bytes] of [...__wasiFS.files]) {\n    if (__wasiDirty.has(path)) continue;\n    const orig = __wasiFS.origFiles.get(path);\n    if (!orig || orig.length !== bytes.length) continue;\n    let same = true;\n    for (let i = 0; i < orig.length; i++) {\n      if (orig[i] !== bytes[i]) {\n        same = false;\n        break;\n      }\n    }\n    if (!same) continue;\n    __wasiFS.files.delete(path);\n    __wasiFS.sizes.set(path, bytes.length);\n    evicted.push(path);\n  }\n  return evicted;\n}\nasync function __wasiRevalidateFS() {\n  if (!__wasiSup || !__wasiFS) return [];\n  await __wasiDrainPersist();\n  if (typeof __wasiSup.fsRevision === \"function\") {\n    let revision;\n    try {\n      revision = await __wasiSup.fsRevision(__wasiFS.root);\n    } catch {\n      revision = null;\n    }\n    if (revision !== null && revision === __wasiFS.revision) return [];\n    __wasiFS.revision = revision;\n  }\n  __wasiNegative.clear();\n  return __wasiEvictCleanContent();\n}\nasync function __wasiDrainPersist() {\n  await __wasiPersistQ.tail;\n  if (__wasiPersistQ.failures.length > 0) {\n    const failures = __wasiPersistQ.failures.slice();\n    __wasiPersistQ.failures.length = 0;\n    throw new Error(\"wasi persist failed: \" + failures.join(\"; \"));\n  }\n}\nfunction __wasiCanonicalize(p) {\n  if (!p) return \"\";\n  const parts = p.split(\"/\");\n  const out = [];\n  for (const seg of parts) {\n    if (seg === \"\" || seg === \".\") continue;\n    if (seg === \"..\") {\n      if (out.length > 0) out.pop();\n      continue;\n    }\n    out.push(seg);\n  }\n  return out.join(\"/\");\n}\nvar __WASI_DEV = 1n;\nvar __WASI_INO_MASK = 0xFFFFFFFFFFFFFFFFn;\nfunction __wasiInode(path) {\n  let h = 14695981039346656037n;\n  const p = String(path === void 0 || path === null ? \"\" : path);\n  for (let i = 0; i < p.length; i++) {\n    h = (h ^ BigInt(p.charCodeAt(i) & 255)) * 1099511628211n & __WASI_INO_MASK;\n  }\n  return h === 0n ? 1n : h;\n}\nfunction __wasiNowNs() {\n  return BigInt(Date.now()) * 1000000n;\n}\nfunction __wasiInitFS(opts) {\n  __wasiSup = null;\n  __wasiDirty.clear();\n  __wasiNegative.clear();\n  __wasiPersistQ.pending.length = 0;\n  __wasiPersistQ.failures.length = 0;\n  __wasiPersistQ.tail = Promise.resolve();\n  const files = /* @__PURE__ */ new Map();\n  const dirs = /* @__PURE__ */ new Set();\n  const times = /* @__PURE__ */ new Map();\n  const symlinks = /* @__PURE__ */ new Map();\n  const modes = /* @__PURE__ */ new Map();\n  const origFiles = /* @__PURE__ */ new Map();\n  const nowNs = __wasiNowNs();\n  for (const [path, b64] of Object.entries(opts.files || {})) {\n    const canon = __wasiCanonicalize(path);\n    const bin = atob(b64);\n    const u8 = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) u8[i] = bin.charCodeAt(i);\n    files.set(canon, u8);\n    origFiles.set(canon, u8.slice());\n    times.set(canon, { mtime: nowNs, atime: nowNs, ctime: nowNs });\n  }\n  for (const path of opts.dirs || []) {\n    const canon = __wasiCanonicalize(path);\n    dirs.add(canon);\n    if (!times.has(canon)) times.set(canon, { mtime: nowNs, atime: nowNs, ctime: nowNs });\n  }\n  for (const [path, mode] of Object.entries(opts.modes)) {\n    modes.set(__wasiCanonicalize(path), Number(mode) & 7);\n  }\n  for (const [path, t] of Object.entries(opts.times || {})) {\n    const canon = __wasiCanonicalize(path);\n    const cur = times.get(canon);\n    if (!cur) continue;\n    const mtime = t && t.mtime !== void 0 ? BigInt(t.mtime) : cur.mtime;\n    const atime = t && t.atime !== void 0 ? BigInt(t.atime) : cur.atime;\n    const ctime = t && t.ctime !== void 0 ? BigInt(t.ctime) : cur.ctime;\n    times.set(canon, { mtime, atime, ctime });\n  }\n  for (const [path, target] of Object.entries(opts.symlinks || {})) {\n    const canon = __wasiCanonicalize(path);\n    symlinks.set(canon, String(target));\n  }\n  const sizes = /* @__PURE__ */ new Map();\n  for (const [path, size] of Object.entries(opts.sizes || {})) {\n    const canon = __wasiCanonicalize(path);\n    sizes.set(canon, Number(size));\n    if (!times.has(canon)) times.set(canon, { mtime: nowNs, atime: nowNs, ctime: nowNs });\n  }\n  __wasiFS = {\n    root: __wasiCanonicalize(opts.root || \"\"),\n    files,\n    dirs,\n    times,\n    symlinks,\n    modes,\n    sizes,\n    origFiles,\n    // Files at or above this size are never held whole; reads window through\n    // the supervisor instead. Keeps a 200 MiB blob from ending the isolate.\n    residentFileCap: Number(opts.residentFileCap ?? 8 * 1024 * 1024),\n    // Roots the seed claims to have listed COMPLETELY. Only a producer that\n    // walked a subtree without exclusions may claim one. Inside such a root a\n    // path the manifest lacks is genuinely absent, so the miss is answered\n    // here instead of costing a round trip — which is most of the traffic a\n    // language runtime generates ($LOAD_PATH / sys.path probing walks\n    // candidate names that mostly do not exist).\n    enumeratedRoots: (opts.enumeratedRoots || []).map(__wasiCanonicalize),\n    // Supervisor revision the seed was built against; a park re-checks it and\n    // only then drops cached content. Without this the cache could serve\n    // content another process has since changed.\n    revision: opts.revision ?? null\n  };\n  __wasiPreopens = [];\n  fdTable.clear();\n  fdTable.set(0, { kind: \"stdin\" });\n  fdTable.set(1, { kind: \"stdout\" });\n  fdTable.set(2, { kind: \"stderr\" });\n  nextFd = 3;\n  for (const po of opts.preopens || []) {\n    const fd = nextFd++;\n    const vfsPath = __wasiCanonicalize(po.vfsPath);\n    fdTable.set(fd, { kind: \"preopen\", wasiPath: po.wasiPath, vfsPath });\n    __wasiPreopens.push({ fd, wasiPath: po.wasiPath, vfsPath });\n    if (!dirs.has(vfsPath)) dirs.add(vfsPath);\n    if (!times.has(vfsPath)) times.set(vfsPath, { mtime: nowNs, atime: nowNs, ctime: nowNs });\n  }\n}\nfunction __wasiGuestPath(baseFd, pathArg) {\n  if (pathArg.startsWith(\"/\")) return pathArg;\n  const base = fdTable.get(baseFd);\n  if (!base || base.kind !== \"preopen\") return pathArg;\n  return base.wasiPath.endsWith(\"/\") ? base.wasiPath + pathArg : base.wasiPath + \"/\" + pathArg;\n}\nfunction __wasiIsLoopbackHost(host) {\n  const h = host.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  return h === \"localhost\" || h === \"::1\" || h === \"::\" || h === \"0.0.0.0\" || /^127\\.\\d+\\.\\d+\\.\\d+$/.test(h);\n}\nglobalThis.__nimbusWasiLastSocketError = \"\";\nfunction __wasiConnectLoopback(port) {\n  const kernel = globalThis.__nimbusVirtualSockets;\n  if (!kernel || typeof kernel.connectStream !== \"function\") {\n    globalThis.__nimbusWasiLastSocketError = \"this process has no Nimbus virtual socket kernel, so in-session ports cannot be dialed\";\n    return { errno: __WASI_ENOSYS, socket: null };\n  }\n  try {\n    return { errno: __WASI_ESUCCESS, socket: kernel.connectStream(port) };\n  } catch (e) {\n    globalThis.__nimbusWasiLastSocketError = e && e.message ? e.message : String(e);\n    return { errno: __WASI_ECONNREFUSED, socket: null };\n  }\n}\nfunction __wasiConnectRemote(host, port) {\n  if (typeof __cfSocketConnect !== \"function\") {\n    globalThis.__nimbusWasiLastSocketError = \"outbound TCP is unavailable in this runtime\";\n    return { errno: __WASI_ENOSYS, socket: null };\n  }\n  try {\n    return { errno: __WASI_ESUCCESS, socket: __cfSocketConnect({ hostname: host, port }, { allowHalfOpen: true }) };\n  } catch (e) {\n    globalThis.__nimbusWasiLastSocketError = e && e.message ? e.message : String(e);\n    return { errno: __WASI_ECONNREFUSED, socket: null };\n  }\n}\nfunction __wasiOpenTcpSocket(pathArg, fdflags, fdOutPtr, writeU32LE) {\n  const tail = pathArg.substring(__WASI_TCP_PATH_PREFIX.length);\n  const slashIdx = tail.lastIndexOf(\"/\");\n  if (slashIdx <= 0 || slashIdx === tail.length - 1) return __WASI_EINVAL;\n  const host = tail.substring(0, slashIdx);\n  const portStr = tail.substring(slashIdx + 1);\n  const port = parseInt(portStr, 10);\n  if (!host || !(port > 0 && port < 65536)) return __WASI_EINVAL;\n  const opened = __wasiIsLoopbackHost(host) ? __wasiConnectLoopback(port) : __wasiConnectRemote(host, port);\n  if (opened.errno !== __WASI_ESUCCESS) return opened.errno;\n  writeU32LE(fdOutPtr, __wasiAdoptSocket(opened.socket, fdflags));\n  return __WASI_ESUCCESS;\n}\nfunction __wasiKernelOrNull(what) {\n  const kernel = globalThis.__nimbusVirtualSockets;\n  if (kernel) return kernel;\n  globalThis.__nimbusWasiLastSocketError = \"this process has no Nimbus virtual socket kernel, so \" + what;\n  return null;\n}\nfunction __wasiOpenListener(pathArg, fdflags, fdOutPtr, writeU32LE) {\n  const port = parseInt(pathArg.substring(__WASI_LISTEN_PATH_PREFIX.length), 10);\n  if (!Number.isInteger(port) || port <= 0 || port >= 65536) return __WASI_EINVAL;\n  const kernel = __wasiKernelOrNull(\"ports cannot be listened on\");\n  if (!kernel) return __WASI_ENOSYS;\n  if (!kernel.listeners.has(port)) {\n    try {\n      kernel.listen(port);\n    } catch (e) {\n      globalThis.__nimbusWasiLastSocketError = \"port \" + port + \" could not be bound: \" + (e && e.message ? e.message : String(e));\n      return __WASI_ENOTCONN;\n    }\n    const announce = Reflect.get(globalThis, \"__nimbusVirtualSocketDidListen\");\n    if (typeof announce === \"function\") announce(port);\n  }\n  const fd = nextFd++;\n  fdTable.set(fd, { kind: \"listener\", port, fdflags: fdflags | 0 });\n  writeU32LE(fdOutPtr, fd);\n  return __WASI_ESUCCESS;\n}\nasync function __wasiAcceptRead(entry, iovsPtr, iovsLen, nreadPtr, writeU32LE, view, u8) {\n  const kernel = __wasiKernelOrNull(\"connections cannot be accepted\");\n  if (!kernel) return __WASI_ENOSYS;\n  try {\n    let accepted;\n    if ((entry.fdflags & __WASI_FDFLAGS_NONBLOCK) !== 0) {\n      accepted = kernel.acceptNow(entry.port);\n      if (!accepted) {\n        writeU32LE(nreadPtr, 0);\n        return __WASI_EAGAIN;\n      }\n    } else {\n      accepted = await kernel.accept(entry.port);\n    }\n    const bytes = new TextEncoder().encode(String(accepted.id) + \"\\n\");\n    const dv = view();\n    const memU8 = u8();\n    let total = 0;\n    for (let i = 0; i < iovsLen && total < bytes.length; i++) {\n      const iov = iovsPtr + i * 8;\n      const bufPtr = dv.getUint32(iov, true);\n      const bufLen = dv.getUint32(iov + 4, true);\n      const n = Math.min(bufLen, bytes.length - total);\n      memU8.set(bytes.subarray(total, total + n), bufPtr);\n      total += n;\n    }\n    writeU32LE(nreadPtr, total);\n    return __WASI_ESUCCESS;\n  } catch (e) {\n    globalThis.__nimbusWasiLastSocketError = e && e.message ? e.message : String(e);\n    return __WASI_ENOTCONN;\n  }\n}\nfunction __wasiOpenAcceptedSocket(pathArg, fdflags, fdOutPtr, writeU32LE) {\n  const id = parseInt(pathArg.substring(__WASI_ACCEPTED_PATH_PREFIX.length), 10);\n  if (!Number.isInteger(id) || id <= 0) return __WASI_EINVAL;\n  const kernel = globalThis.__nimbusVirtualSockets;\n  if (!kernel || typeof kernel.streamFor !== \"function\") {\n    globalThis.__nimbusWasiLastSocketError = \"this process has no Nimbus virtual socket kernel, so accepted connections cannot be bound\";\n    return __WASI_ENOSYS;\n  }\n  let socket;\n  try {\n    socket = kernel.streamFor(id);\n  } catch (e) {\n    globalThis.__nimbusWasiLastSocketError = e && e.message ? e.message : String(e);\n    return __WASI_ENOTCONN;\n  }\n  writeU32LE(fdOutPtr, __wasiAdoptSocket(socket, fdflags));\n  return __WASI_ESUCCESS;\n}\nfunction __wasiAdoptSocket(socket, fdflags) {\n  const fd = nextFd++;\n  fdTable.set(fd, {\n    kind: \"socket\",\n    socket,\n    reader: null,\n    // lazy: getReader() on first sock_recv\n    writer: null,\n    // lazy: getWriter() on first sock_send\n    readBuf: new Uint8Array(0),\n    readBufOffset: 0,\n    eof: false,\n    closed: false,\n    halfClosedWr: false,\n    fdflags: fdflags | 0\n  });\n  return fd;\n}\nfunction __wasiTouchTimes(canonPath, mtimeNs, atimeNs, ctimeNs) {\n  const cur = __wasiFS.times.get(canonPath);\n  if (cur) {\n    if (mtimeNs !== null) cur.mtime = mtimeNs;\n    if (atimeNs !== null) cur.atime = atimeNs;\n    if (ctimeNs !== null) cur.ctime = ctimeNs;\n  } else {\n    const now = __wasiNowNs();\n    __wasiFS.times.set(canonPath, {\n      mtime: mtimeNs !== null ? mtimeNs : now,\n      atime: atimeNs !== null ? atimeNs : now,\n      ctime: ctimeNs !== null ? ctimeNs : now\n    });\n  }\n}\nfunction __wasiBumpMtime(canonPath) {\n  const now = __wasiNowNs();\n  __wasiTouchTimes(canonPath, now, null, now);\n}\nfunction __wasiReadFilesB64(paths) {\n  const out = {};\n  for (const path of paths) {\n    const canon = __wasiCanonicalize(path);\n    const bytes = __wasiFS.files.get(canon);\n    if (!bytes) continue;\n    const CHUNK = 32768;\n    let s = \"\";\n    for (let i = 0; i < bytes.length; i += CHUNK) {\n      s += String.fromCharCode.apply(null, bytes.subarray(i, Math.min(i + CHUNK, bytes.length)));\n    }\n    out[path] = btoa(s);\n  }\n  return out;\n}\nvar fdTable = /* @__PURE__ */ new Map();\nvar nextFd = 3;\nfunction __wasiResolvePath(baseFd, pathStr) {\n  const entry = fdTable.get(baseFd);\n  if (!entry) return null;\n  let baseVfs;\n  if (entry.kind === \"preopen\" || entry.kind === \"dir\") baseVfs = entry.vfsPath;\n  else return null;\n  let trimmed = pathStr.replace(/^\\.?\\/+/, \"\").replace(/^\\/+/, \"\");\n  if (entry.kind === \"preopen\" && baseVfs.length > 0) {\n    if (trimmed === baseVfs) {\n      trimmed = \"\";\n    } else if (trimmed.length > baseVfs.length && trimmed.charCodeAt(baseVfs.length) === 47 && trimmed.substring(0, baseVfs.length) === baseVfs) {\n      trimmed = trimmed.substring(baseVfs.length + 1);\n    }\n  }\n  return __wasiCanonicalize(baseVfs + \"/\" + trimmed);\n}\nfunction __wasiResolvePathFull(baseFd, pathStr, followFlag) {\n  let p = __wasiResolvePath(baseFd, pathStr);\n  if (p === null) return { path: \"\", isSymlink: false, err: __WASI_EBADF };\n  if (!followFlag) {\n    return { path: p, isSymlink: __wasiFS.symlinks.has(p), err: __WASI_ESUCCESS };\n  }\n  let depth = 0;\n  while (__wasiFS.symlinks.has(p)) {\n    if (depth++ >= __WASI_SYMLOOP_MAX) {\n      return { path: p, isSymlink: true, err: __WASI_ELOOP };\n    }\n    const target = __wasiFS.symlinks.get(p);\n    let next;\n    if (target.startsWith(\"/\")) {\n      const e = fdTable.get(baseFd);\n      const baseVfs = e && (e.kind === \"preopen\" || e.kind === \"dir\") ? e.vfsPath : \"\";\n      next = __wasiCanonicalize(baseVfs + \"/\" + target);\n    } else {\n      const lastSlash = p.lastIndexOf(\"/\");\n      const parent = lastSlash >= 0 ? p.substring(0, lastSlash) : \"\";\n      next = __wasiCanonicalize(parent + \"/\" + target);\n    }\n    p = next;\n  }\n  return { path: p, isSymlink: false, err: __WASI_ESUCCESS };\n}\nfunction __wasiEffectiveMode(path) {\n  const mode = __wasiFS.modes.get(path);\n  if (mode !== void 0) return mode;\n  return __wasiInodeExists(path) ? 0 : 7;\n}\nfunction __wasiInodeExists(path) {\n  return __wasiFS.files.has(path) || __wasiFS.dirs.has(path) || __wasiFS.symlinks.has(path) || __wasiFS.modes.has(path);\n}\nfunction __wasiCheckTraversal(baseFd, resolved) {\n  const entry = fdTable.get(baseFd);\n  if (!entry || entry.kind !== \"preopen\" && entry.kind !== \"dir\") return __WASI_EBADF;\n  const base = entry.vfsPath;\n  if (resolved === base) return __WASI_ESUCCESS;\n  const prefix = base ? base + \"/\" : \"\";\n  const relative = resolved.startsWith(prefix) ? resolved.substring(prefix.length) : resolved;\n  const parts = relative.split(\"/\").filter(Boolean);\n  let ancestor = base;\n  for (let i = 0; i < parts.length; i++) {\n    if (!__wasiFS.dirs.has(ancestor)) {\n      return __wasiInodeExists(ancestor) ? __WASI_ENOTDIR : __WASI_ENOENT;\n    }\n    if ((__wasiEffectiveMode(ancestor) & 1) === 0) return __WASI_EACCES;\n    if (i === parts.length - 1) break;\n    ancestor = ancestor ? ancestor + \"/\" + parts[i] : parts[i];\n  }\n  return __WASI_ESUCCESS;\n}\nfunction __wasiCheckMode(path, requested) {\n  return (__wasiEffectiveMode(path) & requested) === requested ? __WASI_ESUCCESS : __WASI_EACCES;\n}\nvar __WASI_PARK_CEILING_MS = 15e3;\nvar __WASI_PARK_DEADLINE_MS = 1e4;\nvoid __WASI_PARK_CEILING_MS;\nfunction withParkDeadline(fn) {\n  return function parkGuarded(...args) {\n    const r = fn.apply(this, args);\n    if (!r || typeof r.then !== \"function\") return r;\n    const guarded = new Promise((resolve) => {\n      let settled = false;\n      const timer = setTimeout(() => {\n        if (settled) return;\n        settled = true;\n        resolve(__WASI_EAGAIN);\n      }, __WASI_PARK_DEADLINE_MS);\n      const finish = (value) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        resolve(value);\n      };\n      r.then(finish, () => finish(__WASI_EAGAIN));\n    });\n    return __wasiThreads ? __wasiThreads.parkIo(guarded) : guarded;\n  };\n}\nfunction __wasiMakeImports(opts) {\n  const preview0 = opts.abi === \"preview0\";\n  const WHENCE_SET = preview0 ? 2 : 0;\n  const WHENCE_CUR = preview0 ? 0 : 1;\n  const WHENCE_END = preview0 ? 1 : 2;\n  const argv = opts.argv || [];\n  const envArr = [];\n  if (opts.env) for (const k of Object.keys(opts.env)) envArr.push(k + \"=\" + opts.env[k]);\n  const utf8enc = new TextEncoder();\n  const utf8dec = new TextDecoder();\n  function view() {\n    return new DataView(opts.getMemory().buffer);\n  }\n  function u8() {\n    return new Uint8Array(opts.getMemory().buffer);\n  }\n  function writeU32LE(off, v) {\n    view().setUint32(off, v >>> 0, true);\n  }\n  function writeU64LE(off, v) {\n    const dv = view();\n    if (typeof v === \"bigint\") {\n      dv.setBigUint64(off, v, true);\n      return;\n    }\n    const lo = v >>> 0;\n    const hi = Math.floor(v / 4294967296) >>> 0;\n    dv.setUint32(off, lo, true);\n    dv.setUint32(off + 4, hi, true);\n  }\n  function readPath(ptr, len) {\n    const bytes = u8().subarray(ptr, ptr + len);\n    return utf8dec.decode(bytes);\n  }\n  function writeFilestat(statPtr, path, ftype, size, t) {\n    const dv = view();\n    writeU64LE(statPtr, __WASI_DEV);\n    writeU64LE(statPtr + 8, __wasiInode(path));\n    dv.setUint8(statPtr + 16, ftype);\n    if (preview0) {\n      for (let i = 17; i < 20; i++) dv.setUint8(statPtr + i, 0);\n      dv.setUint32(statPtr + 20, 1, true);\n      writeU64LE(statPtr + 24, size);\n      writeU64LE(statPtr + 32, t.atime);\n      writeU64LE(statPtr + 40, t.mtime);\n      writeU64LE(statPtr + 48, t.ctime);\n      return __WASI_ESUCCESS;\n    }\n    for (let i = 17; i < 24; i++) dv.setUint8(statPtr + i, 0);\n    writeU64LE(statPtr + 24, 1n);\n    writeU64LE(statPtr + 32, size);\n    writeU64LE(statPtr + 40, t.atime);\n    writeU64LE(statPtr + 48, t.mtime);\n    writeU64LE(statPtr + 56, t.ctime);\n    return __WASI_ESUCCESS;\n  }\n  let stdoutBuf = \"\";\n  let stderrBuf = \"\";\n  function appendStream(kind, bytes) {\n    const s = utf8dec.decode(bytes);\n    if (kind === \"stdout\") {\n      if (opts.stdoutWrite) opts.stdoutWrite(s);\n      else stdoutBuf += s;\n    } else {\n      if (opts.stderrWrite) opts.stderrWrite(s);\n      else stderrBuf += s;\n    }\n  }\n  function getFile(vfsPath) {\n    return __wasiFS.files.get(vfsPath) || null;\n  }\n  function fileKnown(vfsPath) {\n    return __wasiFS.files.has(vfsPath) || __wasiFS.sizes.has(vfsPath);\n  }\n  function fileSize(vfsPath) {\n    const resident = __wasiFS.files.get(vfsPath);\n    if (resident) return resident.length;\n    return __wasiFS.sizes.get(vfsPath) ?? 0;\n  }\n  function readRange(vfsPath, offset, length) {\n    const resident = __wasiFS.files.get(vfsPath);\n    if (resident) {\n      const start = Math.min(offset, resident.length);\n      return resident.subarray(start, Math.min(resident.length, start + length));\n    }\n    const size = __wasiFS.sizes.get(vfsPath);\n    if (size === void 0) return new Uint8Array(0);\n    if (!__wasiSup) return null;\n    return (async () => {\n      await __wasiDrainPersist();\n      if (size <= __wasiFS.residentFileCap) {\n        const whole = await __wasiSup.fsReadRange(vfsPath, 0, size);\n        const bytes = whole instanceof Uint8Array ? whole : new Uint8Array(whole);\n        __wasiFS.files.set(vfsPath, bytes);\n        __wasiFS.origFiles.set(vfsPath, bytes.slice());\n        const start = Math.min(offset, bytes.length);\n        return bytes.subarray(start, Math.min(bytes.length, start + length));\n      }\n      const want = Math.max(0, Math.min(length, size - offset));\n      if (want === 0) return new Uint8Array(0);\n      const win = await __wasiSup.fsReadRange(vfsPath, offset, want);\n      return win instanceof Uint8Array ? win : new Uint8Array(win);\n    })();\n  }\n  function scatterIovs(bytes, iovsPtr, iovsLen, dv, memU8) {\n    let done = 0;\n    for (let i = 0; i < iovsLen && done < bytes.length; i++) {\n      const iov = iovsPtr + i * 8;\n      const bufPtr = dv.getUint32(iov, true);\n      const bufLen = dv.getUint32(iov + 4, true);\n      const n = Math.min(bufLen, bytes.length - done);\n      if (n <= 0) break;\n      memU8.set(bytes.subarray(done, done + n), bufPtr);\n      done += n;\n      if (n < bufLen) break;\n    }\n    return done;\n  }\n  function underEnumeratedRoot(vfsPath) {\n    for (const root of __wasiFS.enumeratedRoots) {\n      if (root === \"\" || vfsPath === root || vfsPath.startsWith(root + \"/\")) return true;\n    }\n    return false;\n  }\n  function statLive(vfsPath) {\n    if (!__wasiSup || __wasiNegative.has(vfsPath)) return false;\n    if (underEnumeratedRoot(vfsPath)) return false;\n    return (async () => {\n      await __wasiDrainPersist();\n      const st = await __wasiSup.stat(vfsPath);\n      if (!st) {\n        __wasiNegative.add(vfsPath);\n        return false;\n      }\n      ensureParentDirs(vfsPath);\n      if (st.type === \"directory\") {\n        __wasiFS.dirs.add(vfsPath);\n        __wasiFS.modes.set(vfsPath, 7);\n      } else {\n        __wasiFS.sizes.set(vfsPath, Number(st.size ?? 0));\n        __wasiFS.modes.set(vfsPath, 6);\n      }\n      const ns = BigInt(st.mtime ?? Date.now()) * 1000000n;\n      __wasiFS.times.set(vfsPath, { mtime: ns, atime: ns, ctime: ns });\n      return true;\n    })();\n  }\n  function iovsCapacity(iovsPtr, iovsLen, dv) {\n    let total = 0;\n    for (let i = 0; i < iovsLen; i++) total += dv.getUint32(iovsPtr + i * 8 + 4, true);\n    return total;\n  }\n  function hasDir(vfsPath) {\n    if (__wasiFS.dirs.has(vfsPath)) return true;\n    return false;\n  }\n  function setFile(vfsPath, bytes) {\n    __wasiFS.files.set(vfsPath, bytes);\n    __wasiFS.sizes.delete(vfsPath);\n    __wasiNegative.delete(vfsPath);\n    if (!__wasiFS.modes.has(vfsPath)) __wasiFS.modes.set(vfsPath, 6);\n    __wasiBumpMtime(vfsPath);\n    __wasiPersistFile(vfsPath);\n  }\n  function unsetFile(vfsPath) {\n    __wasiFS.files.delete(vfsPath);\n    __wasiFS.sizes.delete(vfsPath);\n    __wasiFS.times.delete(vfsPath);\n    __wasiFS.modes.delete(vfsPath);\n    __wasiEnqueue(\"unlink \" + vfsPath, (sup) => sup.unlink(vfsPath));\n  }\n  function touchAccess(vfsPath) {\n    const cur = __wasiFS.times.get(vfsPath);\n    if (cur) cur.atime = __wasiNowNs();\n  }\n  function ensureParentDirs(vfsPath) {\n    const parts = vfsPath.split(\"/\");\n    if (parts.length <= 1) return;\n    let p = \"\";\n    for (let i = 0; i < parts.length - 1; i++) {\n      p = p ? p + \"/\" + parts[i] : parts[i];\n      __wasiFS.dirs.add(p);\n      if (!__wasiFS.modes.has(p)) __wasiFS.modes.set(p, 7);\n      if (!__wasiFS.times.has(p)) {\n        const now = __wasiNowNs();\n        __wasiFS.times.set(p, { mtime: now, atime: now, ctime: now });\n      }\n    }\n  }\n  function readdirChildren(vfsPath) {\n    const out = [];\n    const seen = /* @__PURE__ */ new Set();\n    const prefix = vfsPath === \"\" ? \"\" : vfsPath + \"/\";\n    for (const path of __wasiFS.files.keys()) {\n      if (path.startsWith(prefix)) {\n        const rest = path.substring(prefix.length);\n        if (rest && rest.indexOf(\"/\") === -1) {\n          out.push({ name: rest, type: __WASI_FT_REGULAR_FILE });\n          seen.add(rest);\n        }\n      }\n    }\n    for (const path of __wasiFS.dirs) {\n      if (path !== vfsPath && path.startsWith(prefix)) {\n        const rest = path.substring(prefix.length);\n        if (rest && rest.indexOf(\"/\") === -1) {\n          out.push({ name: rest, type: __WASI_FT_DIRECTORY });\n          seen.add(rest);\n        }\n      }\n    }\n    for (const path of __wasiFS.modes.keys()) {\n      if (path.startsWith(prefix)) {\n        const rest = path.substring(prefix.length);\n        if (rest && rest.indexOf(\"/\") === -1 && !seen.has(rest)) {\n          out.push({ name: rest, type: __WASI_FT_REGULAR_FILE });\n        }\n      }\n    }\n    return out;\n  }\n  const imports = {\n    // ── args / env ──\n    args_get(argvPtr, argvBufPtr) {\n      let buf = argvBufPtr;\n      const memU8 = u8();\n      const dv = view();\n      for (let i = 0; i < argv.length; i++) {\n        dv.setUint32(argvPtr + i * 4, buf, true);\n        const bytes = utf8enc.encode(argv[i] + \"\\0\");\n        memU8.set(bytes, buf);\n        buf += bytes.length;\n      }\n      return __WASI_ESUCCESS;\n    },\n    args_sizes_get(argcPtr, sizePtr) {\n      let total = 0;\n      for (let i = 0; i < argv.length; i++) total += utf8enc.encode(argv[i]).length + 1;\n      writeU32LE(argcPtr, argv.length);\n      writeU32LE(sizePtr, total);\n      return __WASI_ESUCCESS;\n    },\n    environ_get(environPtr, envBufPtr) {\n      let buf = envBufPtr;\n      const memU8 = u8();\n      const dv = view();\n      for (let i = 0; i < envArr.length; i++) {\n        dv.setUint32(environPtr + i * 4, buf, true);\n        const bytes = utf8enc.encode(envArr[i] + \"\\0\");\n        memU8.set(bytes, buf);\n        buf += bytes.length;\n      }\n      return __WASI_ESUCCESS;\n    },\n    environ_sizes_get(envcPtr, sizePtr) {\n      let total = 0;\n      for (let i = 0; i < envArr.length; i++) total += utf8enc.encode(envArr[i]).length + 1;\n      writeU32LE(envcPtr, envArr.length);\n      writeU32LE(sizePtr, total);\n      return __WASI_ESUCCESS;\n    },\n    // ── fd basic ──\n    fd_close(fd) {\n      if (fd === 0 || fd === 1 || fd === 2) return __WASI_ESUCCESS;\n      if (!fdTable.has(fd)) return __WASI_EBADF;\n      const entry = fdTable.get(fd);\n      if (entry.kind === \"preopen\") return __WASI_ESUCCESS;\n      if (entry.kind === \"socket\" && !entry.closed) {\n        try {\n          entry.socket.close();\n        } catch {\n        }\n        entry.closed = true;\n      }\n      fdTable.delete(fd);\n      return __WASI_ESUCCESS;\n    },\n    fd_read(fd, iovsPtr, iovsLen, nreadPtr) {\n      if (fd === 0) {\n        writeU32LE(nreadPtr, 0);\n        return __WASI_ESUCCESS;\n      }\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      if (entry.kind === \"socket\") return __rawSockRecv(fd, iovsPtr, iovsLen, 0, nreadPtr, 0);\n      if (entry.kind === \"listener\") {\n        return __wasiAcceptRead(entry, iovsPtr, iovsLen, nreadPtr, writeU32LE, view, u8);\n      }\n      if (entry.kind === \"dir\" || entry.kind === \"preopen\") return __WASI_EISDIR;\n      if (entry.kind !== \"file\") return __WASI_EBADF;\n      if (!fileKnown(entry.vfsPath)) return __WASI_ENOENT;\n      const want = iovsCapacity(iovsPtr, iovsLen, view());\n      const take = Math.min(want, Math.max(0, fileSize(entry.vfsPath) - entry.offset));\n      if (take === 0) {\n        writeU32LE(nreadPtr, 0);\n        return __WASI_ESUCCESS;\n      }\n      const chunk = readRange(entry.vfsPath, entry.offset, take);\n      const deliver = (bytes) => {\n        if (bytes === null) return __WASI_EIO;\n        const n = scatterIovs(bytes, iovsPtr, iovsLen, view(), u8());\n        entry.offset += n;\n        writeU32LE(nreadPtr, n);\n        return __WASI_ESUCCESS;\n      };\n      return chunk && typeof chunk.then === \"function\" ? chunk.then(deliver) : deliver(chunk);\n    },\n    fd_write(fd, iovsPtr, iovsLen, nwrittenPtr) {\n      const sockEntry = fdTable.get(fd);\n      if (sockEntry && sockEntry.kind === \"socket\") {\n        return __rawSockSend(fd, iovsPtr, iovsLen, 0, nwrittenPtr);\n      }\n      const dv = view();\n      const memU8 = u8();\n      let total = 0;\n      const parts = [];\n      for (let i = 0; i < iovsLen; i++) {\n        const iov = iovsPtr + i * 8;\n        const bufPtr = dv.getUint32(iov, true);\n        const bufLen = dv.getUint32(iov + 4, true);\n        if (bufLen > 0) parts.push(memU8.slice(bufPtr, bufPtr + bufLen));\n        total += bufLen;\n      }\n      let combined;\n      if (parts.length === 0) combined = new Uint8Array(0);\n      else if (parts.length === 1) combined = parts[0];\n      else {\n        combined = new Uint8Array(total);\n        let off = 0;\n        for (const p of parts) {\n          combined.set(p, off);\n          off += p.length;\n        }\n      }\n      if (fd === 1 || fd === 2) {\n        appendStream(fd === 1 ? \"stdout\" : \"stderr\", combined);\n        writeU32LE(nwrittenPtr, total);\n        return __WASI_ESUCCESS;\n      }\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      const file = getFile(entry.vfsPath) || new Uint8Array(0);\n      const appendMode = (entry.fdflags & __WASI_FDFLAGS_APPEND) !== 0;\n      const writeAt = appendMode ? file.length : entry.offset;\n      const newLen = Math.max(file.length, writeAt + total);\n      const next = new Uint8Array(newLen);\n      next.set(file, 0);\n      next.set(combined, writeAt);\n      setFile(entry.vfsPath, next);\n      entry.offset = writeAt + total;\n      writeU32LE(nwrittenPtr, total);\n      return __WASI_ESUCCESS;\n    },\n    fd_seek(fd, offsetArg, whence, newOffsetPtr) {\n      if (fd === 0 || fd === 1 || fd === 2) {\n        return __WASI_ESPIPE;\n      }\n      const entry = fdTable.get(fd);\n      if (entry && (entry.kind === \"socket\" || entry.kind === \"listener\")) return __WASI_ESPIPE;\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      const delta = typeof offsetArg === \"bigint\" ? offsetArg : BigInt(offsetArg | 0);\n      const cur = BigInt(entry.offset);\n      const fileLen = BigInt(fileSize(entry.vfsPath));\n      let next;\n      if (whence === WHENCE_SET) next = delta;\n      else if (whence === WHENCE_CUR) next = cur + delta;\n      else if (whence === WHENCE_END) next = fileLen + delta;\n      else return __WASI_EINVAL;\n      if (next < 0n) return __WASI_EINVAL;\n      entry.offset = Number(next);\n      writeU64LE(newOffsetPtr, next);\n      return __WASI_ESUCCESS;\n    },\n    fd_tell(fd, offsetPtr) {\n      if (fd === 0 || fd === 1 || fd === 2) {\n        return __WASI_ESPIPE;\n      }\n      const entry = fdTable.get(fd);\n      if (entry && (entry.kind === \"socket\" || entry.kind === \"listener\")) return __WASI_ESPIPE;\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      writeU64LE(offsetPtr, BigInt(entry.offset));\n      return __WASI_ESUCCESS;\n    },\n    fd_fdstat_get(fd, statPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      const dv = view();\n      let ftype = __WASI_FT_UNKNOWN;\n      if (entry.kind === \"stdin\" || entry.kind === \"stdout\" || entry.kind === \"stderr\") {\n        ftype = __WASI_FT_CHARACTER_DEVICE;\n      } else if (entry.kind === \"preopen\" || entry.kind === \"dir\") {\n        ftype = __WASI_FT_DIRECTORY;\n      } else if (entry.kind === \"file\") {\n        ftype = __WASI_FT_REGULAR_FILE;\n      } else if (entry.kind === \"socket\" || entry.kind === \"listener\") {\n        ftype = __WASI_FT_SOCKET_STREAM;\n      }\n      dv.setUint8(statPtr, ftype);\n      dv.setUint8(statPtr + 1, 0);\n      dv.setUint16(statPtr + 2, (entry.fdflags || 0) & 65535, true);\n      dv.setUint32(statPtr + 4, 0, true);\n      const rb = entry.rights !== void 0 ? entry.rights : __WASI_RIGHTS_ALL;\n      const ri = entry.rightsInheriting !== void 0 ? entry.rightsInheriting : __WASI_RIGHTS_ALL;\n      writeU64LE(statPtr + 8, rb);\n      writeU64LE(statPtr + 16, ri);\n      return __WASI_ESUCCESS;\n    },\n    fd_fdstat_set_flags(fd, flags) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      if (entry.kind === \"file\" || entry.kind === \"socket\" || entry.kind === \"listener\") entry.fdflags = flags;\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B6: track per-fd rights mask. Callers narrow their own caps;\n    // we record but don't enforce in v1 (single-tenant facet). The narrow\n    // is visible to subsequent fd_fdstat_get calls, satisfying capability-\n    // tightening probes that round-trip the mask.\n    fd_fdstat_set_rights(fd, rightsBase, rightsInheriting) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      const rb = typeof rightsBase === \"bigint\" ? rightsBase : BigInt(rightsBase >>> 0);\n      const ri = typeof rightsInheriting === \"bigint\" ? rightsInheriting : BigInt(rightsInheriting >>> 0);\n      const curRb = entry.rights !== void 0 ? entry.rights : __WASI_RIGHTS_ALL;\n      const curRi = entry.rightsInheriting !== void 0 ? entry.rightsInheriting : __WASI_RIGHTS_ALL;\n      if ((rb & ~curRb) !== 0n) return __WASI_ENOTCAPABLE;\n      if ((ri & ~curRi) !== 0n) return __WASI_ENOTCAPABLE;\n      entry.rights = rb;\n      entry.rightsInheriting = ri;\n      return __WASI_ESUCCESS;\n    },\n    // ── preopens ──\n    fd_prestat_get(fd, prestatPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"preopen\") return __WASI_EBADF;\n      const dv = view();\n      dv.setUint8(prestatPtr, __WASI_PREOPENTYPE_DIR);\n      const nameBytes = utf8enc.encode(entry.wasiPath);\n      dv.setUint32(prestatPtr + 4, nameBytes.length, true);\n      return __WASI_ESUCCESS;\n    },\n    fd_prestat_dir_name(fd, pathPtr, pathLen) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"preopen\") return __WASI_EBADF;\n      const nameBytes = utf8enc.encode(entry.wasiPath);\n      if (nameBytes.length > pathLen) return __WASI_EINVAL;\n      u8().set(nameBytes, pathPtr);\n      return __WASI_ESUCCESS;\n    },\n    // ── path_open ──\n    path_open(baseFd, dirflags, pathPtr, pathLen, oflags, rightsBase, _rightsInheriting, fdflags, fdOutPtr) {\n      const pathArg = readPath(pathPtr, pathLen);\n      const guestPath = __wasiGuestPath(baseFd, pathArg);\n      if (guestPath.startsWith(__WASI_TCP_PATH_PREFIX)) {\n        return __wasiOpenTcpSocket(guestPath, fdflags, fdOutPtr, writeU32LE);\n      }\n      if (guestPath.startsWith(__WASI_ACCEPTED_PATH_PREFIX)) {\n        return __wasiOpenAcceptedSocket(guestPath, fdflags, fdOutPtr, writeU32LE);\n      }\n      if (guestPath.startsWith(__WASI_LISTEN_PATH_PREFIX)) {\n        return __wasiOpenListener(guestPath, fdflags, fdOutPtr, writeU32LE);\n      }\n      const follow = (dirflags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0;\n      const rp = __wasiResolvePathFull(baseFd, pathArg, follow);\n      if (rp.err === __WASI_EBADF) return __WASI_EBADF;\n      if (rp.err === __WASI_ELOOP) return __WASI_ELOOP;\n      const resolved = rp.path;\n      const traversal = __wasiCheckTraversal(baseFd, resolved);\n      if (traversal !== __WASI_ESUCCESS) return traversal;\n      const isCreate = (oflags & __WASI_O_CREAT) !== 0;\n      const isDirectory = (oflags & __WASI_O_DIRECTORY) !== 0;\n      const isExcl = (oflags & __WASI_O_EXCL) !== 0;\n      const isTrunc = (oflags & __WASI_O_TRUNC) !== 0;\n      if (!follow && rp.isSymlink) {\n        return __WASI_ELOOP;\n      }\n      const fileExists = __wasiFS.files.has(resolved) || __wasiFS.sizes.has(resolved) || __wasiFS.modes.has(resolved) && !__wasiFS.dirs.has(resolved) && !__wasiFS.symlinks.has(resolved);\n      const dirExists = __wasiFS.dirs.has(resolved);\n      if (isDirectory) {\n        if (!dirExists) return __WASI_ENOENT;\n        const access = __wasiCheckMode(resolved, 1);\n        if (access !== __WASI_ESUCCESS) return access;\n        const fd2 = nextFd++;\n        fdTable.set(fd2, { kind: \"dir\", vfsPath: resolved, readdirEntries: null, cookie: 0n, oflags, fdflags });\n        writeU32LE(fdOutPtr, fd2);\n        return __WASI_ESUCCESS;\n      }\n      if (dirExists) {\n        return __WASI_EISDIR;\n      }\n      if (!fileExists) {\n        if (!isCreate) return __WASI_ENOENT;\n        const parentSlash = resolved.lastIndexOf(\"/\");\n        const parent = parentSlash < 0 ? \"\" : resolved.substring(0, parentSlash);\n        const access = __wasiCheckMode(parent, 3);\n        if (access !== __WASI_ESUCCESS) return access;\n        ensureParentDirs(resolved);\n        setFile(resolved, new Uint8Array(0));\n      } else if (isExcl) {\n        return __WASI_EEXIST;\n      } else if (isTrunc) {\n        const access = __wasiCheckMode(resolved, 2);\n        if (access !== __WASI_ESUCCESS) return access;\n        setFile(resolved, new Uint8Array(0));\n      }\n      const requested = typeof rightsBase === \"bigint\" ? rightsBase : BigInt(rightsBase >>> 0);\n      let requiredMode = 0;\n      if ((requested & __WASI_RIGHT_FD_READ) !== 0n) requiredMode |= 4;\n      if ((requested & __WASI_RIGHT_FD_WRITE) !== 0n) requiredMode |= 2;\n      if (requiredMode !== 0) {\n        const access = __wasiCheckMode(resolved, requiredMode);\n        if (access !== __WASI_ESUCCESS) return access;\n      }\n      const fd = nextFd++;\n      fdTable.set(fd, { kind: \"file\", vfsPath: resolved, offset: 0, oflags, fdflags });\n      writeU32LE(fdOutPtr, fd);\n      return __WASI_ESUCCESS;\n    },\n    // ── path_create_directory ──\n    path_create_directory(baseFd, pathPtr, pathLen) {\n      const path = readPath(pathPtr, pathLen);\n      const resolved = __wasiResolvePath(baseFd, path);\n      if (resolved === null) return __WASI_EBADF;\n      if (__wasiFS.dirs.has(resolved)) return __WASI_EEXIST;\n      if (__wasiFS.files.has(resolved)) return __WASI_EEXIST;\n      ensureParentDirs(resolved);\n      __wasiFS.dirs.add(resolved);\n      __wasiFS.modes.set(resolved, 7);\n      __wasiNegative.delete(resolved);\n      const now = __wasiNowNs();\n      __wasiFS.times.set(resolved, { mtime: now, atime: now, ctime: now });\n      __wasiEnqueue(\"mkdir \" + resolved, (sup) => sup.mkdir(resolved));\n      return __WASI_ESUCCESS;\n    },\n    path_remove_directory(baseFd, pathPtr, pathLen) {\n      const path = readPath(pathPtr, pathLen);\n      const resolved = __wasiResolvePath(baseFd, path);\n      if (resolved === null) return __WASI_EBADF;\n      if (!__wasiFS.dirs.has(resolved)) return __WASI_ENOENT;\n      const children = readdirChildren(resolved);\n      if (children.length > 0) return __WASI_ENOTEMPTY;\n      __wasiFS.dirs.delete(resolved);\n      __wasiFS.modes.delete(resolved);\n      __wasiEnqueue(\"rmdir \" + resolved, (sup) => sup.rmdir(resolved));\n      return __WASI_ESUCCESS;\n    },\n    path_unlink_file(baseFd, pathPtr, pathLen) {\n      const path = readPath(pathPtr, pathLen);\n      const resolved = __wasiResolvePath(baseFd, path);\n      if (resolved === null) return __WASI_EBADF;\n      if (__wasiFS.dirs.has(resolved)) return __WASI_EISDIR;\n      if (__wasiFS.symlinks.has(resolved)) {\n        __wasiFS.symlinks.delete(resolved);\n        __wasiFS.times.delete(resolved);\n        __wasiFS.modes.delete(resolved);\n        return __WASI_ESUCCESS;\n      }\n      if (!fileKnown(resolved)) return __WASI_ENOENT;\n      unsetFile(resolved);\n      return __WASI_ESUCCESS;\n    },\n    // ── path_rename (atomic; overwrites destination) ──\n    path_rename(srcFd, srcPathPtr, srcPathLen, dstFd, dstPathPtr, dstPathLen) {\n      const srcPath = readPath(srcPathPtr, srcPathLen);\n      const dstPath = readPath(dstPathPtr, dstPathLen);\n      const src = __wasiResolvePath(srcFd, srcPath);\n      const dst = __wasiResolvePath(dstFd, dstPath);\n      if (src === null || dst === null) return __WASI_EBADF;\n      const srcFile = __wasiFS.files.get(src);\n      const srcIsDir = __wasiFS.dirs.has(src);\n      const srcIsSymlink = __wasiFS.symlinks.has(src);\n      const srcIsLazy = srcFile === void 0 && __wasiFS.sizes.has(src);\n      if (srcFile === void 0 && !srcIsLazy && !srcIsDir && !srcIsSymlink) return __WASI_ENOENT;\n      if (src === dst) return __WASI_ESUCCESS;\n      const moveTimes = (from, to) => {\n        const t = __wasiFS.times.get(from);\n        __wasiFS.times.delete(from);\n        const now = __wasiNowNs();\n        __wasiFS.times.set(to, t ? { mtime: t.mtime, atime: t.atime, ctime: now } : { mtime: now, atime: now, ctime: now });\n      };\n      const moveMode = (from, to) => {\n        const mode = __wasiFS.modes.get(from);\n        __wasiFS.modes.delete(from);\n        if (mode !== void 0) __wasiFS.modes.set(to, mode);\n      };\n      __wasiFS.files.delete(dst);\n      __wasiFS.sizes.delete(dst);\n      __wasiFS.dirs.delete(dst);\n      __wasiFS.symlinks.delete(dst);\n      __wasiFS.times.delete(dst);\n      __wasiFS.modes.delete(dst);\n      if (srcIsLazy) {\n        __wasiFS.sizes.set(dst, __wasiFS.sizes.get(src));\n        __wasiFS.sizes.delete(src);\n        moveTimes(src, dst);\n        moveMode(src, dst);\n      } else if (srcIsSymlink) {\n        __wasiFS.symlinks.set(dst, __wasiFS.symlinks.get(src));\n        __wasiFS.symlinks.delete(src);\n        moveTimes(src, dst);\n        moveMode(src, dst);\n      } else if (srcFile !== void 0) {\n        __wasiFS.files.set(dst, srcFile);\n        __wasiFS.files.delete(src);\n        moveTimes(src, dst);\n        moveMode(src, dst);\n      } else {\n        __wasiFS.dirs.delete(src);\n        __wasiFS.dirs.add(dst);\n        moveTimes(src, dst);\n        moveMode(src, dst);\n        const srcPrefix = src + \"/\";\n        const rebase = (key) => dst + \"/\" + key.substring(srcPrefix.length);\n        for (const key of [...__wasiFS.files.keys()]) {\n          if (key.startsWith(srcPrefix)) {\n            const nk = rebase(key);\n            __wasiFS.files.set(nk, __wasiFS.files.get(key));\n            __wasiFS.files.delete(key);\n            moveTimes(key, nk);\n            moveMode(key, nk);\n          }\n        }\n        for (const key of [...__wasiFS.dirs]) {\n          if (key.startsWith(srcPrefix)) {\n            const nk = rebase(key);\n            __wasiFS.dirs.add(nk);\n            __wasiFS.dirs.delete(key);\n            moveTimes(key, nk);\n            moveMode(key, nk);\n          }\n        }\n        for (const key of [...__wasiFS.symlinks.keys()]) {\n          if (key.startsWith(srcPrefix)) {\n            const nk = rebase(key);\n            __wasiFS.symlinks.set(nk, __wasiFS.symlinks.get(key));\n            __wasiFS.symlinks.delete(key);\n            moveTimes(key, nk);\n            moveMode(key, nk);\n          }\n        }\n        for (const key of [...__wasiFS.sizes.keys()]) {\n          if (key.startsWith(srcPrefix)) {\n            __wasiFS.sizes.set(rebase(key), __wasiFS.sizes.get(key));\n            __wasiFS.sizes.delete(key);\n          }\n        }\n      }\n      __wasiEnqueue(\"rename \" + src + \" -> \" + dst, (sup) => sup.rename(src, dst));\n      return __WASI_ESUCCESS;\n    },\n    // ── path_filestat_get ──\n    path_filestat_get(baseFd, lookupflags, pathPtr, pathLen, statPtr) {\n      const path = readPath(pathPtr, pathLen);\n      const follow = (lookupflags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0;\n      const rp = __wasiResolvePathFull(baseFd, path, follow);\n      if (rp.err === __WASI_EBADF) return __WASI_EBADF;\n      if (rp.err === __WASI_ELOOP) return __WASI_ELOOP;\n      const resolved = rp.path;\n      const traversal = __wasiCheckTraversal(baseFd, resolved);\n      if (traversal !== __WASI_ESUCCESS) return traversal;\n      const classify = () => {\n        if (!follow && rp.isSymlink) {\n          return [\n            __WASI_FT_SYMBOLIC_LINK,\n            BigInt(new TextEncoder().encode(__wasiFS.symlinks.get(resolved)).length)\n          ];\n        }\n        if (__wasiFS.files.has(resolved) || __wasiFS.sizes.has(resolved)) {\n          return [__WASI_FT_REGULAR_FILE, BigInt(fileSize(resolved))];\n        }\n        if (__wasiFS.dirs.has(resolved)) return [__WASI_FT_DIRECTORY, 0n];\n        if (__wasiFS.modes.has(resolved)) return [__WASI_FT_REGULAR_FILE, 0n];\n        return null;\n      };\n      let kind = classify();\n      if (!kind) {\n        const live = statLive(resolved);\n        if (live && typeof live.then === \"function\") {\n          return live.then((found) => {\n            const settled = found ? classify() : null;\n            return settled ? emitStat(...settled) : __WASI_ENOENT;\n          });\n        }\n        return __WASI_ENOENT;\n      }\n      return emitStat(...kind);\n      function emitStat(ftype, size) {\n        const t = __wasiFS.times.get(resolved) || { mtime: 0n, atime: 0n, ctime: 0n };\n        return writeFilestat(statPtr, resolved, ftype, size, t);\n      }\n    },\n    // WASI socket and polling support B2: real path_filestat_set_times. Honors ATIM/ATIM_NOW/\n    // MTIM/MTIM_NOW flags. Spec: atim_ns and mtim_ns are absolute\n    // nanosecond timestamps; flags select which fields to update + whether\n    // to clamp to \"now\". ENOENT if path doesn't exist.\n    path_filestat_set_times(baseFd, lookupflags, pathPtr, pathLen, atimArg, mtimArg, fstflags) {\n      const path = readPath(pathPtr, pathLen);\n      const follow = (lookupflags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0;\n      const rp = __wasiResolvePathFull(baseFd, path, follow);\n      if (rp.err === __WASI_EBADF) return __WASI_EBADF;\n      if (rp.err === __WASI_ELOOP) return __WASI_ELOOP;\n      const resolved = rp.path;\n      const isSymlinkOnly = !follow && rp.isSymlink;\n      if (!isSymlinkOnly && !__wasiFS.files.has(resolved) && !__wasiFS.dirs.has(resolved)) {\n        return __WASI_ENOENT;\n      }\n      const setAtim = (fstflags & __WASI_FSTFLAGS_ATIM) !== 0;\n      const setAtimNow = (fstflags & __WASI_FSTFLAGS_ATIM_NOW) !== 0;\n      const setMtim = (fstflags & __WASI_FSTFLAGS_MTIM) !== 0;\n      const setMtimNow = (fstflags & __WASI_FSTFLAGS_MTIM_NOW) !== 0;\n      if (setAtim && setAtimNow || setMtim && setMtimNow) return __WASI_EINVAL;\n      const now = __wasiNowNs();\n      const atimNs = setAtimNow ? now : setAtim ? typeof atimArg === \"bigint\" ? atimArg : BigInt(atimArg) : null;\n      const mtimNs = setMtimNow ? now : setMtim ? typeof mtimArg === \"bigint\" ? mtimArg : BigInt(mtimArg) : null;\n      __wasiTouchTimes(resolved, mtimNs, atimNs, now);\n      __wasiPersistTimes(resolved);\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B3: read the target string of a symlink. Spec:\n    //   path_readlink(fd, path, path_len, buf, buf_len, *bufused)\n    // Truncates to buf_len; writes actual bytes to *bufused.\n    path_readlink(baseFd, pathPtr, pathLen, bufPtr, bufLen, bufUsedPtr) {\n      const path = readPath(pathPtr, pathLen);\n      const rp = __wasiResolvePathFull(baseFd, path, false);\n      if (rp.err === __WASI_EBADF) return __WASI_EBADF;\n      if (rp.err === __WASI_ELOOP) return __WASI_ELOOP;\n      const resolved = rp.path;\n      if (!__wasiFS.symlinks.has(resolved)) return __WASI_EINVAL;\n      const target = __wasiFS.symlinks.get(resolved);\n      const enc = new TextEncoder();\n      const targetBytes = enc.encode(target);\n      const n = Math.min(targetBytes.length, bufLen);\n      u8().set(targetBytes.subarray(0, n), bufPtr);\n      writeU32LE(bufUsedPtr, n);\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B3: create a symlink. Spec:\n    //   path_symlink(old_path, fd, new_path)\n    // old_path is the symlink's TARGET (stored verbatim); fd+new_path\n    // is the location where the symlink itself is created.\n    path_symlink(oldPathPtr, oldPathLen, newFd, newPathPtr, newPathLen) {\n      const oldPath = readPath(oldPathPtr, oldPathLen);\n      const newPath = readPath(newPathPtr, newPathLen);\n      const resolved = __wasiResolvePath(newFd, newPath);\n      if (resolved === null) return __WASI_EBADF;\n      if (__wasiFS.files.has(resolved)) return __WASI_EEXIST;\n      if (__wasiFS.dirs.has(resolved)) return __WASI_EEXIST;\n      if (__wasiFS.symlinks.has(resolved)) return __WASI_EEXIST;\n      __wasiFS.symlinks.set(resolved, oldPath);\n      __wasiFS.modes.set(resolved, 7);\n      ensureParentDirs(resolved);\n      const now = __wasiNowNs();\n      __wasiFS.times.set(resolved, { mtime: now, atime: now, ctime: now });\n      __wasiNegative.delete(resolved);\n      __wasiPersistSymlink(oldPath, resolved);\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B3: hardlink. Spec:\n    //   path_link(old_fd, old_flags, old_path, new_fd, new_path)\n    // Implements as a shared-buffer alias. POSIX semantics: both names\n    // point at the same inode, so writes through either are visible to\n    // the other. In our in-memory FS the \"same inode\" is the same\n    // Uint8Array reference. CAVEAT: our setFile/fd_write paths REPLACE\n    // the buffer reference (immutable-style update) so subsequent writes\n    // don't propagate. Matches link(2) at the WASI-layer (link itself\n    // succeeds; concurrent-mutation semantics are filesystem-dependent\n    // and our shim is a single-call sandbox).\n    path_link(oldFd, oldFlags, oldPathPtr, oldPathLen, newFd, newPathPtr, newPathLen) {\n      const oldPath = readPath(oldPathPtr, oldPathLen);\n      const newPath = readPath(newPathPtr, newPathLen);\n      const follow = (oldFlags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0;\n      const rpOld = __wasiResolvePathFull(oldFd, oldPath, follow);\n      if (rpOld.err === __WASI_EBADF) return __WASI_EBADF;\n      if (rpOld.err === __WASI_ELOOP) return __WASI_ELOOP;\n      const src = rpOld.path;\n      const dst = __wasiResolvePath(newFd, newPath);\n      if (dst === null) return __WASI_EBADF;\n      if (!__wasiFS.files.has(src)) return __WASI_ENOENT;\n      if (__wasiFS.files.has(dst) || __wasiFS.dirs.has(dst) || __wasiFS.symlinks.has(dst)) {\n        return __WASI_EEXIST;\n      }\n      __wasiFS.files.set(dst, __wasiFS.files.get(src));\n      __wasiFS.modes.set(dst, __wasiEffectiveMode(src));\n      ensureParentDirs(dst);\n      const now = __wasiNowNs();\n      __wasiFS.times.set(dst, { mtime: now, atime: now, ctime: now });\n      __wasiNegative.delete(dst);\n      __wasiPersistFile(dst);\n      return __WASI_ESUCCESS;\n    },\n    // ── fd_filestat_get / fd_filestat_set_size ──\n    fd_filestat_get(fd, statPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      let ftype = __WASI_FT_UNKNOWN;\n      let size = 0n;\n      let timesPath = null;\n      if (entry.kind === \"file\") {\n        ftype = __WASI_FT_REGULAR_FILE;\n        size = BigInt(fileSize(entry.vfsPath));\n        timesPath = entry.vfsPath;\n      } else if (entry.kind === \"dir\" || entry.kind === \"preopen\") {\n        ftype = __WASI_FT_DIRECTORY;\n        timesPath = entry.vfsPath;\n      } else if (entry.kind === \"stdin\" || entry.kind === \"stdout\" || entry.kind === \"stderr\") {\n        ftype = __WASI_FT_CHARACTER_DEVICE;\n      } else if (entry.kind === \"socket\" || entry.kind === \"listener\") {\n        ftype = __WASI_FT_SOCKET_STREAM;\n      }\n      const t = timesPath && __wasiFS.times.get(timesPath) || { mtime: 0n, atime: 0n, ctime: 0n };\n      return writeFilestat(statPtr, timesPath === null ? \"\\0fd/\" + fd : timesPath, ftype, size, t);\n    },\n    fd_filestat_set_size(fd, size) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      const cur = getFile(entry.vfsPath) || new Uint8Array(0);\n      const newSize = Number(size);\n      const next = new Uint8Array(newSize);\n      next.set(cur.subarray(0, Math.min(cur.length, newSize)), 0);\n      setFile(entry.vfsPath, next);\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B2: real fd_filestat_set_times.\n    fd_filestat_set_times(fd, atimArg, mtimArg, fstflags) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      if (entry.kind !== \"file\" && entry.kind !== \"dir\" && entry.kind !== \"preopen\") {\n        return __WASI_ESUCCESS;\n      }\n      const setAtim = (fstflags & __WASI_FSTFLAGS_ATIM) !== 0;\n      const setAtimNow = (fstflags & __WASI_FSTFLAGS_ATIM_NOW) !== 0;\n      const setMtim = (fstflags & __WASI_FSTFLAGS_MTIM) !== 0;\n      const setMtimNow = (fstflags & __WASI_FSTFLAGS_MTIM_NOW) !== 0;\n      if (setAtim && setAtimNow || setMtim && setMtimNow) return __WASI_EINVAL;\n      const now = __wasiNowNs();\n      const atimNs = setAtimNow ? now : setAtim ? typeof atimArg === \"bigint\" ? atimArg : BigInt(atimArg) : null;\n      const mtimNs = setMtimNow ? now : setMtim ? typeof mtimArg === \"bigint\" ? mtimArg : BigInt(mtimArg) : null;\n      __wasiTouchTimes(entry.vfsPath, mtimNs, atimNs, now);\n      __wasiPersistTimes(entry.vfsPath);\n      return __WASI_ESUCCESS;\n    },\n    // ── fd_pread / fd_pwrite (offset-explicit) ──\n    fd_pread(fd, iovsPtr, iovsLen, offsetArg, nreadPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      if (!fileKnown(entry.vfsPath)) return __WASI_ENOENT;\n      const offset = typeof offsetArg === \"bigint\" ? Number(offsetArg) : offsetArg >>> 0;\n      const want = iovsCapacity(iovsPtr, iovsLen, view());\n      const take = Math.min(want, Math.max(0, fileSize(entry.vfsPath) - offset));\n      if (take === 0) {\n        writeU32LE(nreadPtr, 0);\n        return __WASI_ESUCCESS;\n      }\n      const chunk = readRange(entry.vfsPath, offset, take);\n      const deliver = (bytes) => {\n        if (bytes === null) return __WASI_EIO;\n        writeU32LE(nreadPtr, scatterIovs(bytes, iovsPtr, iovsLen, view(), u8()));\n        return __WASI_ESUCCESS;\n      };\n      return chunk && typeof chunk.then === \"function\" ? chunk.then(deliver) : deliver(chunk);\n    },\n    fd_pwrite(fd, iovsPtr, iovsLen, offsetArg, nwrittenPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      let offset = typeof offsetArg === \"bigint\" ? Number(offsetArg) : offsetArg >>> 0;\n      const dv = view();\n      const memU8 = u8();\n      let total = 0;\n      const parts = [];\n      for (let i = 0; i < iovsLen; i++) {\n        const iov = iovsPtr + i * 8;\n        const bufPtr = dv.getUint32(iov, true);\n        const bufLen = dv.getUint32(iov + 4, true);\n        if (bufLen > 0) parts.push(memU8.slice(bufPtr, bufPtr + bufLen));\n        total += bufLen;\n      }\n      let combined;\n      if (parts.length === 0) combined = new Uint8Array(0);\n      else if (parts.length === 1) combined = parts[0];\n      else {\n        combined = new Uint8Array(total);\n        let off = 0;\n        for (const p of parts) {\n          combined.set(p, off);\n          off += p.length;\n        }\n      }\n      const cur = getFile(entry.vfsPath) || new Uint8Array(0);\n      const newLen = Math.max(cur.length, offset + total);\n      const next = new Uint8Array(newLen);\n      next.set(cur, 0);\n      next.set(combined, offset);\n      setFile(entry.vfsPath, next);\n      writeU32LE(nwrittenPtr, total);\n      return __WASI_ESUCCESS;\n    },\n    // ── fd_readdir ──\n    //\n    // WASI dirent layout (24 bytes per entry):\n    //   d_next   u64 @ 0    (cookie for next entry)\n    //   d_ino    u64 @ 8\n    //   d_namlen u32 @ 16\n    //   d_type   u8  @ 20\n    //   pad             21..23\n    // followed by name bytes (variable).\n    fd_readdir(fd, bufPtr, bufLen, cookieArg, bufusedPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"dir\" && entry.kind !== \"preopen\") return __WASI_EBADF;\n      const access = __wasiCheckMode(entry.vfsPath, 4);\n      if (access !== __WASI_ESUCCESS) return access;\n      if (!entry.readdirEntries) {\n        const kids = readdirChildren(entry.vfsPath);\n        entry.readdirEntries = [\n          { name: \".\", type: __WASI_FT_DIRECTORY },\n          { name: \"..\", type: __WASI_FT_DIRECTORY },\n          ...kids\n        ];\n      }\n      let startCookie = typeof cookieArg === \"bigint\" ? Number(cookieArg) : cookieArg >>> 0;\n      let written = 0;\n      const dv = view();\n      const memU8 = u8();\n      for (let i = startCookie; i < entry.readdirEntries.length; i++) {\n        const e = entry.readdirEntries[i];\n        const nameBytes = utf8enc.encode(e.name);\n        const recordSize = 24 + nameBytes.length;\n        if (written + 24 > bufLen) break;\n        writeU64LE(bufPtr + written, BigInt(i + 1));\n        writeU64LE(bufPtr + written + 8, 0n);\n        dv.setUint32(bufPtr + written + 16, nameBytes.length, true);\n        dv.setUint8(bufPtr + written + 20, e.type);\n        for (let j = 21; j < 24; j++) dv.setUint8(bufPtr + written + j, 0);\n        written += 24;\n        const nameRoom = Math.min(nameBytes.length, bufLen - written);\n        memU8.set(nameBytes.subarray(0, nameRoom), bufPtr + written);\n        written += nameRoom;\n        if (nameRoom < nameBytes.length) break;\n      }\n      writeU32LE(bufusedPtr, written);\n      return __WASI_ESUCCESS;\n    },\n    fd_advise() {\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B4: real fd_allocate. Extends the file's byte buffer with\n    // zeros so [offset, offset+len) is allocated. POSIX posix_fallocate\n    // semantics. ENOSPC is not reachable in our in-memory FS (the\n    // 32 MiB snapshot cap is enforced at supervisor level; in-call we\n    // just allocate the JS Uint8Array).\n    fd_allocate(fd, offsetArg, lenArg) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"file\") return __WASI_EBADF;\n      const offset = typeof offsetArg === \"bigint\" ? Number(offsetArg) : offsetArg >>> 0;\n      const len = typeof lenArg === \"bigint\" ? Number(lenArg) : lenArg >>> 0;\n      const cur = getFile(entry.vfsPath) || new Uint8Array(0);\n      const needed = offset + len;\n      if (needed <= cur.length) return __WASI_ESUCCESS;\n      const next = new Uint8Array(needed);\n      next.set(cur, 0);\n      setFile(entry.vfsPath, next);\n      return __WASI_ESUCCESS;\n    },\n    fd_datasync() {\n      return __WASI_ESUCCESS;\n    },\n    fd_sync() {\n      return __WASI_ESUCCESS;\n    },\n    // dup2(2), and the only way to reach it: preview1 has no dup. Renumbering\n    // CLOSES `to` — dropping the entry instead leaks whatever it held, and for\n    // a socket that is a live stream the kernel is never told about.\n    fd_renumber(from, to) {\n      const entry = fdTable.get(from);\n      if (!entry) return __WASI_EBADF;\n      if (from === to) return __WASI_ESUCCESS;\n      const target = fdTable.get(to);\n      if (target && target.kind === \"preopen\") return __WASI_ENOTCAPABLE;\n      if (target && target.kind === \"socket\" && !target.closed) {\n        try {\n          target.socket.close();\n        } catch {\n        }\n        target.closed = true;\n      }\n      fdTable.delete(from);\n      fdTable.set(to, entry);\n      return __WASI_ESUCCESS;\n    },\n    // ── proc_exit ──\n    proc_exit(code) {\n      throw new __WasiExit(code | 0);\n    },\n    // WASI socket and polling support B5: proc_raise(sig) — POSIX shell convention encodes a\n    // signal-terminated process as exit-status 128+sig. SIGABRT=6 → 134,\n    // SIGTERM=15 → 143, SIGKILL=9 → 137. Returns errno (never actually;\n    // throws via __WasiExit). The legacy 'throw new __WasiExit(128)' was\n    // wrong: it discarded the signal number, so probes couldn't\n    // distinguish SIGABRT from SIGTERM at the exit-code layer.\n    proc_raise(sig) {\n      throw new __WasiExit(128 + ((sig | 0) & 255));\n    },\n    // ── clock ──\n    clock_time_get(clockId, _precision, timePtr) {\n      let nowNs;\n      if (clockId === __WASI_CLOCK_REALTIME) {\n        nowNs = BigInt(Date.now()) * 1000000n;\n      } else if (clockId === __WASI_CLOCK_MONOTONIC || clockId === __WASI_CLOCK_PROCESS_CPUTIME_ID || clockId === __WASI_CLOCK_THREAD_CPUTIME_ID) {\n        const ms = typeof performance !== \"undefined\" && performance.now ? performance.now() : Date.now();\n        nowNs = BigInt(Math.floor(ms * 1e3)) * 1000n;\n      } else return __WASI_EINVAL;\n      writeU64LE(timePtr, nowNs);\n      return __WASI_ESUCCESS;\n    },\n    clock_res_get(clockId, resPtr) {\n      if (clockId === __WASI_CLOCK_REALTIME) {\n        writeU64LE(resPtr, 1000000n);\n        return __WASI_ESUCCESS;\n      }\n      if (clockId === __WASI_CLOCK_MONOTONIC || clockId === __WASI_CLOCK_PROCESS_CPUTIME_ID || clockId === __WASI_CLOCK_THREAD_CPUTIME_ID) {\n        writeU64LE(resPtr, 1000n);\n        return __WASI_ESUCCESS;\n      }\n      return __WASI_EINVAL;\n    },\n    // ── random ──\n    random_get(bufPtr, bufLen) {\n      const memU8 = u8();\n      const CHUNK = 65536;\n      let off = 0;\n      while (off < bufLen) {\n        const n = Math.min(bufLen - off, CHUNK);\n        crypto.getRandomValues(memU8.subarray(bufPtr + off, bufPtr + off + n));\n        off += n;\n      }\n      return __WASI_ESUCCESS;\n    },\n    // A yield is a no-op for a single-threaded guest and a real scheduling\n    // point for a threaded one — the same syscall, answered by whoever owns\n    // the runnable set.\n    sched_yield() {\n      return __wasiThreads ? __wasiThreads.yieldNow() : __WASI_ESUCCESS;\n    },\n    // ── WASI socket and polling support B8: poll_oneoff FULL ────────────────────────────────\n    //\n    // Spec: WASI preview1 poll_oneoff(in_subscriptions, out_events,\n    // nsubscriptions, *retNevents) blocks until at least one event fires,\n    // writes events to out_events, returns count via *retNevents.\n    //\n    // Subscription layout (48B per entry, align 8):\n    //   +0  userdata: u64\n    //   +8  tag: u8  (EVENTTYPE_CLOCK=0 | FD_READ=1 | FD_WRITE=2)\n    //   +9..15  pad\n    //   +16 CLOCK:   id:u32, +24 timeout:u64, +32 precision:u64, +40 flags:u16\n    //       FD_R/W: file_descriptor:u32\n    //\n    // Event layout (32B per entry, align 8):\n    //   +0  userdata: u64\n    //   +8  error: u16\n    //   +10 type: u8\n    //   +11..15 pad\n    //   +16 nbytes: u64 (fd events) — 0 for clock\n    //   +24 flags: u16 (fd events) — 0 here (no peer-hangup detection)\n    //   +26..31 pad\n    //\n    // Implementation: async fn that:\n    //   1. Parses all subscriptions.\n    //   2. Builds a Promise per subscription:\n    //      - CLOCK: setTimeout(deadline) → resolves with subscription idx.\n    //      - FD_READ/WRITE on regular file/dir/stdio: always-resolved Promise.\n    //      - FD_READ on socket: socket.readable.getReader().read() peek.\n    //      - FD_WRITE on socket: always-resolved (writable streams have\n    //        unbounded queue from the wasm side's perspective).\n    //   3. Promise.race over all of them.\n    //   4. After race resolves, drain all NOW-ready subscriptions\n    //      (winning + any others that also resolved or were always-ready).\n    //   5. Write events; return count.\n    //\n    // Cancellation: pending setTimeouts and reader-locks are cleaned up\n    // on every iteration to avoid leaking resources between poll calls.\n    //\n    // Wrapped in WebAssembly.Suspending at the imports-object finalise\n    // point (with sock_*). When Suspending is unavailable, the bare async\n    // fn returns a Promise which the wasm caller cannot consume — the\n    // trap surfaces via __wasiRunStartAsync's catch.\n    async poll_oneoff(inSubsPtr, outEventsPtr, nsubs, retNeventsPtr) {\n      const dv = view();\n      if ((nsubs | 0) <= 0) {\n        writeU32LE(retNeventsPtr, 0);\n        return __WASI_ESUCCESS;\n      }\n      const subs = [];\n      for (let i = 0; i < nsubs; i++) {\n        const base = inSubsPtr + i * 48;\n        const userdata = dv.getBigUint64(base, true);\n        const tag = dv.getUint8(base + 8);\n        if (tag === __WASI_EVENTTYPE_CLOCK) {\n          const id = dv.getUint32(base + 16, true);\n          const timeout = dv.getBigUint64(base + 24, true);\n          const precision = dv.getBigUint64(base + 32, true);\n          const flags = dv.getUint16(base + 40, true);\n          subs.push({ idx: i, userdata, tag, id, timeout, precision, flags });\n        } else if (tag === __WASI_EVENTTYPE_FD_READ || tag === __WASI_EVENTTYPE_FD_WRITE) {\n          const fd = dv.getUint32(base + 16, true);\n          subs.push({ idx: i, userdata, tag, fd });\n        } else {\n          subs.push({ idx: i, userdata, tag, badTag: true });\n        }\n      }\n      const timerIds = new Array(subs.length).fill(null);\n      const readerLocks = [];\n      const monoNowNs = () => {\n        const ms = typeof performance !== \"undefined\" && performance.now ? performance.now() : Date.now();\n        return BigInt(Math.floor(ms * 1e3)) * 1000n;\n      };\n      const promises = subs.map((s) => {\n        if (s.badTag) {\n          return Promise.resolve({\n            idx: s.idx,\n            error: __WASI_EINVAL,\n            type: s.tag,\n            nbytes: 0n,\n            flags: 0\n          });\n        }\n        if (s.tag === __WASI_EVENTTYPE_CLOCK) {\n          let deadlineNs;\n          if ((s.flags & __WASI_SUBCLOCKFLAGS_ABSTIME) !== 0) {\n            deadlineNs = s.timeout;\n          } else {\n            const nowNs = s.id === __WASI_CLOCK_REALTIME ? BigInt(Date.now()) * 1000000n : monoNowNs();\n            deadlineNs = nowNs + s.timeout;\n          }\n          const nowAgain = s.id === __WASI_CLOCK_REALTIME ? BigInt(Date.now()) * 1000000n : monoNowNs();\n          const remainNs = deadlineNs > nowAgain ? deadlineNs - nowAgain : 0n;\n          const remainMs = Number(remainNs / 1000000n);\n          return new Promise((resolve) => {\n            const t = setTimeout(() => resolve({\n              idx: s.idx,\n              error: __WASI_ESUCCESS,\n              type: s.tag,\n              nbytes: 0n,\n              flags: 0\n            }), remainMs > 0 ? remainMs : 0);\n            timerIds[s.idx] = t;\n          });\n        }\n        const entry = fdTable.get(s.fd);\n        if (!entry) {\n          return Promise.resolve({\n            idx: s.idx,\n            error: __WASI_EBADF,\n            type: s.tag,\n            nbytes: 0n,\n            flags: 0\n          });\n        }\n        if (entry.kind === \"file\" || entry.kind === \"dir\" || entry.kind === \"preopen\" || entry.kind === \"stdin\" || entry.kind === \"stdout\" || entry.kind === \"stderr\") {\n          let nbytes = 0n;\n          if (entry.kind === \"file\" && s.tag === __WASI_EVENTTYPE_FD_READ) {\n            const f = getFile(entry.vfsPath);\n            if (f) {\n              const remain = f.length - (entry.offset || 0);\n              nbytes = remain > 0 ? BigInt(remain) : 0n;\n            }\n          } else if (s.tag === __WASI_EVENTTYPE_FD_WRITE) {\n            nbytes = 0xFFFFFFFFn;\n          }\n          return Promise.resolve({\n            idx: s.idx,\n            error: __WASI_ESUCCESS,\n            type: s.tag,\n            nbytes,\n            flags: 0\n          });\n        }\n        if (entry.kind === \"listener\") {\n          if (s.tag === __WASI_EVENTTYPE_FD_WRITE) {\n            return Promise.resolve({ idx: s.idx, error: __WASI_ESUCCESS, type: s.tag, nbytes: 0n, flags: 0 });\n          }\n          const kernel = globalThis.__nimbusVirtualSockets;\n          if (!kernel) {\n            return Promise.resolve({ idx: s.idx, error: __WASI_ENOSYS, type: s.tag, nbytes: 0n, flags: 0 });\n          }\n          const ready2 = () => ({\n            idx: s.idx,\n            error: __WASI_ESUCCESS,\n            type: s.tag,\n            nbytes: BigInt(kernel.pending(entry.port)),\n            flags: 0\n          });\n          if (kernel.pending(entry.port) > 0) return Promise.resolve(ready2());\n          return kernel.waitReadable([entry.port], null).then(ready2);\n        }\n        if (entry.kind === \"socket\") {\n          if (s.tag === __WASI_EVENTTYPE_FD_WRITE) {\n            return Promise.resolve({\n              idx: s.idx,\n              error: __WASI_ESUCCESS,\n              type: s.tag,\n              nbytes: 0xFFFFFFFFn,\n              flags: 0\n            });\n          }\n          if (entry.readBuf && entry.readBufOffset < entry.readBuf.length) {\n            const avail = BigInt(entry.readBuf.length - entry.readBufOffset);\n            return Promise.resolve({\n              idx: s.idx,\n              error: __WASI_ESUCCESS,\n              type: s.tag,\n              nbytes: avail,\n              flags: 0\n            });\n          }\n          if (entry.eof || entry.closed) {\n            return Promise.resolve({\n              idx: s.idx,\n              error: __WASI_ESUCCESS,\n              type: s.tag,\n              nbytes: 0n,\n              flags: 1\n              // RECV_DATA_TRUNCATED bit doesn't apply; flag 1 == HANGUP per eventrwflags_t bit 0.\n            });\n          }\n          return (async () => {\n            try {\n              if (!entry.reader) entry.reader = entry.socket.readable.getReader();\n              await entry.socket.opened;\n              const { value, done } = await entry.reader.read();\n              if (done) {\n                entry.eof = true;\n                entry.readBuf = new Uint8Array(0);\n                entry.readBufOffset = 0;\n                return {\n                  idx: s.idx,\n                  error: __WASI_ESUCCESS,\n                  type: s.tag,\n                  nbytes: 0n,\n                  flags: 1\n                  // HANGUP\n                };\n              }\n              entry.readBuf = value instanceof Uint8Array ? value : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);\n              entry.readBufOffset = 0;\n              return {\n                idx: s.idx,\n                error: __WASI_ESUCCESS,\n                type: s.tag,\n                nbytes: BigInt(entry.readBuf.length),\n                flags: 0\n              };\n            } catch (e) {\n              return {\n                idx: s.idx,\n                error: __WASI_EIO,\n                type: s.tag,\n                nbytes: 0n,\n                flags: 0\n              };\n            }\n          })();\n        }\n        return Promise.resolve({\n          idx: s.idx,\n          error: __WASI_EBADF,\n          type: s.tag,\n          nbytes: 0n,\n          flags: 0\n        });\n      });\n      const winnerResult = await Promise.race(promises);\n      const ready = [];\n      ready.push(winnerResult);\n      const sentinel = Promise.resolve(\"__not-ready__\");\n      for (let i = 0; i < promises.length; i++) {\n        if (i === winnerResult.idx) continue;\n        const p = promises[i];\n        const probed = await Promise.race([p, sentinel]);\n        if (probed !== \"__not-ready__\") {\n          ready.push(probed);\n        } else {\n          if (timerIds[i] !== null) {\n            try {\n              clearTimeout(timerIds[i]);\n            } catch {\n            }\n            timerIds[i] = null;\n          }\n        }\n      }\n      let nevents = 0;\n      for (const ev of ready) {\n        const off = outEventsPtr + nevents * 32;\n        const subUserdata = subs[ev.idx].userdata;\n        dv.setBigUint64(off, subUserdata, true);\n        dv.setUint16(off + 8, ev.error, true);\n        dv.setUint8(off + 10, ev.type);\n        for (let p = 11; p < 16; p++) dv.setUint8(off + p, 0);\n        dv.setBigUint64(off + 16, ev.nbytes || 0n, true);\n        dv.setUint16(off + 24, ev.flags || 0, true);\n        for (let p = 26; p < 32; p++) dv.setUint8(off + p, 0);\n        nevents++;\n      }\n      writeU32LE(retNeventsPtr, nevents);\n      return __WASI_ESUCCESS;\n    },\n    // WASI socket and polling support B7: sockets via cloudflare:sockets connect() + JSPI.\n    //\n    // sock_send/sock_recv/sock_shutdown are ASYNC fns. They await on\n    // ReadableStream/WritableStream readers/writers, which means the\n    // wasm caller's expectation of a sync errno return must be bridged\n    // via WebAssembly.Suspending. The Suspending wrapper is applied in\n    // the return statement below where the imports object is finalised\n    // (not here — wrapping at definition site would shadow the bare\n    // function in the imports map). The async functions below have\n    // signature compatible with 'new WebAssembly.Suspending(asyncFn)':\n    // they return Promise<i32 errno>.\n    async sock_send(fd, siDataPtr, siDataLen, _siFlags, retDataLenPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"socket\") return __WASI_ENOTSOCK;\n      if (entry.closed || entry.halfClosedWr) return __WASI_EPIPE;\n      const dv = view();\n      const memU8 = u8();\n      let total = 0;\n      const parts = [];\n      for (let i = 0; i < siDataLen; i++) {\n        const iov = siDataPtr + i * 8;\n        const bufPtr = dv.getUint32(iov, true);\n        const bufLen = dv.getUint32(iov + 4, true);\n        if (bufLen > 0) parts.push(memU8.slice(bufPtr, bufPtr + bufLen));\n        total += bufLen;\n      }\n      let combined;\n      if (parts.length === 0) combined = new Uint8Array(0);\n      else if (parts.length === 1) combined = parts[0];\n      else {\n        combined = new Uint8Array(total);\n        let off = 0;\n        for (const p of parts) {\n          combined.set(p, off);\n          off += p.length;\n        }\n      }\n      try {\n        if (!entry.writer) entry.writer = entry.socket.writable.getWriter();\n        await entry.socket.opened;\n        await entry.writer.write(combined);\n      } catch (e) {\n        const msg = e && e.message ? e.message : String(e);\n        globalThis.__nimbusWasiLastSocketError = msg;\n        if (/refused|ECONNREFUSED/i.test(msg)) return __WASI_ECONNREFUSED;\n        if (/unreach|EHOSTUNREACH/i.test(msg)) return __WASI_EHOSTUNREACH;\n        return __WASI_EIO;\n      }\n      writeU32LE(retDataLenPtr, total);\n      return __WASI_ESUCCESS;\n    },\n    async sock_recv(fd, riDataPtr, riDataLen, _riFlags, retDataLenPtr, retFlagsPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"socket\") return __WASI_ENOTSOCK;\n      if (entry.closed) return __WASI_ENOTCONN;\n      const dv = view();\n      const memU8 = u8();\n      if (entry.readBufOffset >= entry.readBuf.length && !entry.eof) {\n        try {\n          if (!entry.reader) entry.reader = entry.socket.readable.getReader();\n          await entry.socket.opened;\n          const { value, done } = await entry.reader.read();\n          if (done) {\n            entry.eof = true;\n            entry.readBuf = new Uint8Array(0);\n            entry.readBufOffset = 0;\n          } else {\n            entry.readBuf = value instanceof Uint8Array ? value : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);\n            entry.readBufOffset = 0;\n          }\n        } catch (e) {\n          const msg = e && e.message ? e.message : String(e);\n          if (/refused|ECONNREFUSED/i.test(msg)) return __WASI_ECONNREFUSED;\n          if (/unreach|EHOSTUNREACH/i.test(msg)) return __WASI_EHOSTUNREACH;\n          return __WASI_EIO;\n        }\n      }\n      let total = 0;\n      for (let i = 0; i < riDataLen; i++) {\n        const iov = riDataPtr + i * 8;\n        const bufPtr = dv.getUint32(iov, true);\n        const bufLen = dv.getUint32(iov + 4, true);\n        const remain = entry.readBuf.length - entry.readBufOffset;\n        if (remain <= 0) break;\n        const n = Math.min(bufLen, remain);\n        memU8.set(entry.readBuf.subarray(entry.readBufOffset, entry.readBufOffset + n), bufPtr);\n        entry.readBufOffset += n;\n        total += n;\n        if (n < bufLen) break;\n      }\n      writeU32LE(retDataLenPtr, total);\n      if (typeof retFlagsPtr === \"number\") {\n        dv.setUint16(retFlagsPtr, 0, true);\n      }\n      return __WASI_ESUCCESS;\n    },\n    async sock_shutdown(fd, how) {\n      const entry = fdTable.get(fd);\n      if (!entry || entry.kind !== \"socket\") return __WASI_ENOTSOCK;\n      const wantRd = (how & __WASI_SDFLAGS_RD) !== 0;\n      const wantWr = (how & __WASI_SDFLAGS_WR) !== 0;\n      try {\n        if (wantRd && wantWr) {\n          if (entry.writer) {\n            try {\n              await entry.writer.close();\n            } catch {\n            }\n          }\n          if (entry.reader) {\n            try {\n              await entry.reader.cancel();\n            } catch {\n            }\n          }\n          try {\n            await entry.socket.close();\n          } catch {\n          }\n          entry.halfClosedWr = true;\n          entry.eof = true;\n          entry.closed = true;\n          return __WASI_ESUCCESS;\n        }\n        if (wantWr && !entry.halfClosedWr) {\n          entry.halfClosedWr = true;\n        }\n        if (wantRd && !entry.eof) {\n          if (entry.reader) {\n            try {\n              await entry.reader.cancel();\n            } catch {\n            }\n          }\n          entry.eof = true;\n        }\n      } catch (e) {\n        return __WASI_EIO;\n      }\n      return __WASI_ESUCCESS;\n    },\n    // The last preview1 syscall, and the one a guest written against libc\n    // reaches for: wasi-libc's accept(2) is a direct call to this and nothing\n    // else. The path_open route — open '/dev/nimbus/listen/N', read the id,\n    // open '/dev/nimbus/socket/<id>' — exists because ruby.wasm resolves\n    // descriptors through its own fd table and cannot use one handed to it out\n    // of band. That constraint belongs to guests layered over wasi-vfs, not to\n    // WASI. Both routes end at __wasiAdoptSocket, so an accepted connection is\n    // the same kind of fd whichever way it arrived.\n    async sock_accept(fd, flags, fdOutPtr) {\n      const entry = fdTable.get(fd);\n      if (!entry) return __WASI_EBADF;\n      if (entry.kind !== \"listener\") return __WASI_ENOTSOCK;\n      const kernel = __wasiKernelOrNull(\"connections cannot be accepted\");\n      if (!kernel) return __WASI_ENOSYS;\n      const nonblock = ((entry.fdflags | flags) & __WASI_FDFLAGS_NONBLOCK) !== 0;\n      try {\n        let accepted;\n        if (nonblock) {\n          accepted = kernel.acceptNow(entry.port);\n          if (!accepted) return __WASI_EAGAIN;\n        } else {\n          accepted = await kernel.accept(entry.port);\n        }\n        const socket = kernel.streamFor(accepted.id);\n        writeU32LE(fdOutPtr, __wasiAdoptSocket(socket, flags & __WASI_FDFLAGS_NONBLOCK));\n        return __WASI_ESUCCESS;\n      } catch (e) {\n        globalThis.__nimbusWasiLastSocketError = e && e.message ? e.message : String(e);\n        return __WASI_ENOTCONN;\n      }\n    }\n  };\n  const __rawSockRecv = imports.sock_recv;\n  const __rawSockSend = imports.sock_send;\n  const parkable = [\n    \"sock_send\",\n    \"sock_recv\",\n    \"sock_shutdown\",\n    \"sock_accept\",\n    \"poll_oneoff\",\n    \"fd_read\",\n    \"fd_write\",\n    \"fd_pread\",\n    \"path_filestat_get\"\n  ];\n  for (const name of parkable) {\n    if (typeof imports[name] === \"function\") imports[name] = withParkDeadline(imports[name]);\n  }\n  if (opts.parking === \"none\") {\n    if (opts.threads) {\n      throw new Error(\n        \"wasi: a threads build cannot run with parking:none; its threads block on a software futex, which requires the guest to be entered under WebAssembly.promising\"\n      );\n    }\n    for (const name of parkable) {\n      const fn = imports[name];\n      if (typeof fn !== \"function\") continue;\n      imports[name] = function noPark(...args) {\n        const r = fn.apply(this, args);\n        if (r && typeof r.then === \"function\") {\n          throw new Error(\n            \"wasi: \" + name + \" parked in a non-suspending instance; a guest that cannot be entered under WebAssembly.promising must not be given a filesystem or socket that blocks\"\n          );\n        }\n        return r;\n      };\n    }\n  } else if (typeof WebAssembly !== \"undefined\" && typeof WebAssembly.Suspending === \"function\") {\n    imports.sock_send = new WebAssembly.Suspending(imports.sock_send);\n    imports.sock_recv = new WebAssembly.Suspending(imports.sock_recv);\n    imports.sock_shutdown = new WebAssembly.Suspending(imports.sock_shutdown);\n    imports.sock_accept = new WebAssembly.Suspending(imports.sock_accept);\n    imports.poll_oneoff = new WebAssembly.Suspending(imports.poll_oneoff);\n    imports.fd_read = new WebAssembly.Suspending(imports.fd_read);\n    imports.fd_write = new WebAssembly.Suspending(imports.fd_write);\n    imports.fd_pread = new WebAssembly.Suspending(imports.fd_pread);\n    imports.path_filestat_get = new WebAssembly.Suspending(imports.path_filestat_get);\n    if (opts.threads) imports.sched_yield = new WebAssembly.Suspending(imports.sched_yield);\n  }\n  return {\n    wasiImport: imports,\n    getStdout: () => stdoutBuf,\n    getStderr: () => stderrBuf\n  };\n}\nfunction __wasiRunStart(instance, ctx) {\n  try {\n    const start = instance.exports._start;\n    if (typeof start !== \"function\") {\n      return { exitCode: 1, error: \"_start is not a function (got \" + typeof start + \")\" };\n    }\n    start();\n    return { exitCode: 0 };\n  } catch (e) {\n    if (e && e.constructor && e.constructor.name === \"__WasiExit\") {\n      return { exitCode: e.code };\n    }\n    return { exitCode: 1, error: e && e.message ? e.message : String(e) };\n  }\n}\nasync function __wasiRunStartAsync(instance, ctx) {\n  try {\n    const start = instance.exports._start;\n    if (typeof start !== \"function\") {\n      return { exitCode: 1, error: \"_start is not a function (got \" + typeof start + \")\" };\n    }\n    if (typeof WebAssembly !== \"undefined\" && typeof WebAssembly.promising === \"function\") {\n      const promisingStart = WebAssembly.promising(start);\n      await promisingStart();\n    } else {\n      start();\n    }\n    return { exitCode: 0 };\n  } catch (e) {\n    if (e && e.constructor && e.constructor.name === \"__WasiExit\") {\n      return { exitCode: e.code };\n    }\n    return { exitCode: 1, error: e && e.message ? e.message : String(e) };\n  }\n}\nglobalThis.__wasiAdoptSupervisor = __wasiAdoptSupervisor;\nglobalThis.__wasiDrainPersist = __wasiDrainPersist;\nglobalThis.__wasiRevalidateFS = __wasiRevalidateFS;";