@ricsam/isolate 0.0.1 → 0.1.1

package/README.md

@@ -1,45 +1,254 @@
 # @ricsam/isolate
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+`@ricsam/isolate` is a runtime-centric JavaScript sandbox built on [`isolated-vm`](https://github.com/nicknisi/isolated-vm). It gives you a single host API for running isolated code with web-style capabilities such as `fetch`, files, streams, server handlers, module loading, and Playwright-backed browser tests.
+
+## Installation
+
+```bash
+npm add @ricsam/isolate isolated-vm
+```
+
+Install Playwright when you want browser runtimes:
+
+```bash
+npm add playwright
+```
+
+## What You Get
+
+`@ricsam/isolate` exports a small top-level API:
+
+- `createIsolateHost()` to start, connect to, and manage isolate-backed runtimes
+- `createModuleResolver()` to provide virtual modules, source trees, mounted `node_modules`, and fallback resolution
+- `createFileBindings()` to expose a rooted file API to sandboxed code
+- `getTypeProfile()`, `typecheck()`, and `formatTypecheckErrors()` for sandbox-aware TypeScript tooling
+
+The host can create three runtime styles:
+
+- `host.createRuntime()` for scripts, agents, and ad hoc execution
+- `host.createAppServer()` for `serve()`-based request handlers
+- `host.createBrowserRuntime()` for Playwright-backed execution
+
+## Host Bindings
+
+Each runtime is configured through `bindings`, which describe how sandboxed code talks to the host:
+
+- `console` forwards runtime and browser console output
+- `fetch` handles outbound HTTP requests from the sandbox
+- `files` exposes a safe, root-scoped filesystem
+- `modules` resolves virtual modules, source trees, and mounted packages
+- `tools` exposes async host functions and async iterators
+
+Every host callback receives a `HostCallContext` with an `AbortSignal`, runtime identity, resource identity, and request metadata.
+
+## Quick Start
+
+```ts
+import {
+  createFileBindings,
+  createIsolateHost,
+  createModuleResolver,
+} from "@ricsam/isolate";
+
+const host = await createIsolateHost({
+  daemon: {
+    socketPath: "/tmp/isolate.sock",
+  },
+});
+
+const runtime = await host.createRuntime({
+  bindings: {
+    console: {
+      onEntry(entry) {
+        if (entry.type === "output") {
+          console.log(entry.stdout);
+        }
+      },
+    },
+    fetch: async (request) => await fetch(request),
+    files: createFileBindings({
+      root: process.cwd(),
+      allowWrite: true,
+    }),
+    modules: createModuleResolver()
+      .virtual(
+        "@/env",
+        `export const mode = "sandbox";`,
+        { filename: "env.ts", resolveDir: "/app" },
+      )
+      .virtual(
+        "/app/main.ts",
+        `
+          import { mode } from "@/env";
+
+          const response = await fetch("https://example.com");
+          console.log("mode:", mode);
+          console.log("status:", response.status);
+          console.log(await greet("isolate"));
+        `,
+        { filename: "main.ts", resolveDir: "/app" },
+      ),
+    tools: {
+      greet: async (name: string) => `hello ${name}`,
+    },
+  },
+});
+
+try {
+  await runtime.eval(`import "/app/main.ts";`, { filename: "/app/entry.ts" });
+} finally {
+  await runtime.dispose();
+  await host.close();
+}
+```
+
+## App Servers
+
+`createAppServer()` is the long-lived server-oriented API. It boots a runtime around an entry module that calls `serve()` and then lets the host dispatch requests into it.
+
+```ts
+import { createIsolateHost, createModuleResolver } from "@ricsam/isolate";
+
+const host = await createIsolateHost();
+const server = await host.createAppServer({
+  key: "example/server",
+  entry: "/server.ts",
+  bindings: {
+    modules: createModuleResolver().virtual(
+      "/server.ts",
+      `
+        serve({
+          fetch(request) {
+            return Response.json({
+              pathname: new URL(request.url).pathname,
+            });
+          },
+        });
+      `,
+    ),
+  },
+});
+
+const result = await server.handle(new Request("http://localhost/hello"));
+if (result.type === "response") {
+  console.log(await result.response.json());
+}
+
+await server.dispose();
+await host.close();
+```
+
+`server.handle()` returns either a normal HTTP response or WebSocket upgrade metadata. The `server.ws` helpers let the host continue an upgraded connection by sending open, message, close, and error events back into the runtime.
+
+## Browser Runtimes
+
+`createBrowserRuntime()` runs sandboxed code against a Playwright page while keeping the host in control of file access, diagnostics, and browser event collection.
+
+```ts
+import { chromium } from "playwright";
+import { createIsolateHost } from "@ricsam/isolate";
+
+const browser = await chromium.launch();
+const context = await browser.newContext();
+const page = await context.newPage();
+
+const host = await createIsolateHost();
+const runtime = await host.createBrowserRuntime({
+  key: "example/browser",
+  bindings: {},
+  features: { tests: true },
+  browser: {
+    page,
+    captureConsole: true,
+  },
+});
+
+const result = await runtime.run(
+  `
+    test("loads a page", async () => {
+      await page.goto("https://example.com");
+      await expect(page).toHaveTitle(/Example Domain/);
+    });
+  `,
+  {
+    filename: "/browser-test.ts",
+    asTestSuite: true,
+    timeoutMs: 10_000,
+  },
+);
+
+console.log(result.tests);
+
+await runtime.dispose();
+await context.close();
+await browser.close();
+await host.close();
+```
+
+## Module Resolution
+
+`createModuleResolver()` is a fluent builder. You can mix and match:
+
+- `virtual(specifier, source, options)` for inline modules
+- `virtualFile(specifier, filePath, options)` for a host file mapped to a virtual specifier
+- `sourceTree(prefix, loader)` for lazy source loading under a virtual path
+- `mountNodeModules(virtualMount, hostPath)` for package resolution from a real `node_modules`
+- `fallback(loader)` for custom last-resort resolution
+
+## File Bindings
+
+`createFileBindings({ root, allowWrite })` creates a filesystem bridge that stays inside the configured root directory. Attempts to escape that root are rejected, and write operations are disabled unless `allowWrite` is set to `true`.
+
+## Typechecking
+
+The typecheck helpers let you validate sandbox code against supported capability profiles before executing it.
+
+```ts
+import {
+  formatTypecheckErrors,
+  getTypeProfile,
+  typecheck,
+} from "@ricsam/isolate";
+
+const profile = getTypeProfile({
+  profile: "browser-test",
+  capabilities: ["files"],
+});
+
+console.log(profile.include);
+
+const result = typecheck({
+  code: "page.goto('/')",
+  profile: "browser-test",
+});
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+if (!result.success) {
+  console.error(formatTypecheckErrors(result.errors));
+}
+```
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Built-in profiles:
 
-## Purpose
+- `backend`
+- `agent`
+- `browser-test`
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@ricsam/isolate`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+Capabilities can extend a profile with `fetch`, `files`, `tests`, `browser`, `tools`, `console`, `encoding`, and `timers`.
 
-## What is OIDC Trusted Publishing?
+## Daemon CLI
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+The package also exposes an `isolate-daemon` binary:
 
-## Setup Instructions
+```bash
+isolate-daemon --socket /tmp/isolate.sock
+```
 
-To properly configure OIDC trusted publishing for this package:
+By default, `createIsolateHost()` will auto-start a daemon when needed. You can also point the host at an already-running daemon with `daemon.socketPath`, or disable auto-start with `daemon.autoStart: false`.
+
+## Development
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**
+```bash
+npm run build
+npm run typecheck
+npm test
+```

package/dist/cjs/bridge/diagnostics.cjs

@@ -0,0 +1,58 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/bridge/diagnostics.ts
+var exports_diagnostics = {};
+__export(exports_diagnostics, {
+  createRuntimeDiagnostics: () => createRuntimeDiagnostics
+});
+module.exports = __toCommonJS(exports_diagnostics);
+function createRuntimeDiagnostics() {
+  return {
+    activeRequests: 0,
+    activeResources: 0,
+    pendingFiles: 0,
+    pendingFetches: 0,
+    pendingModules: 0,
+    pendingTools: 0,
+    streamCount: 0,
+    lifecycleState: "idle"
+  };
+}
+
+//# debugId=40FF8D24B6369A0D64756E2164756E21

package/dist/cjs/bridge/diagnostics.cjs.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bridge/diagnostics.ts"],
+  "sourcesContent": [
+    "import type { RuntimeDiagnostics } from \"../types.cjs\";\n\nexport interface MutableRuntimeDiagnostics extends RuntimeDiagnostics {\n  activeRequests: number;\n  activeResources: number;\n  pendingFiles: number;\n  pendingFetches: number;\n  pendingModules: number;\n  pendingTools: number;\n  streamCount: number;\n  lifecycleState: \"idle\" | \"active\" | \"reloading\" | \"disposing\";\n}\n\nexport function createRuntimeDiagnostics(): MutableRuntimeDiagnostics {\n  return {\n    activeRequests: 0,\n    activeResources: 0,\n    pendingFiles: 0,\n    pendingFetches: 0,\n    pendingModules: 0,\n    pendingTools: 0,\n    streamCount: 0,\n    lifecycleState: \"idle\",\n  };\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaO,SAAS,wBAAwB,GAA8B;AAAA,EACpE,OAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd,aAAa;AAAA,IACb,gBAAgB;AAAA,EAClB;AAAA;",
+  "debugId": "40FF8D24B6369A0D64756E2164756E21",
+  "names": []
+}

package/dist/cjs/bridge/legacy-adapters.cjs

@@ -0,0 +1,242 @@
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/bridge/legacy-adapters.ts
+var exports_legacy_adapters = {};
+__export(exports_legacy_adapters, {
+  tryResolveModule: () => tryResolveModule,
+  normalizeExplicitModuleResult: () => normalizeExplicitModuleResult,
+  createMappedNodeModulesLoader: () => createMappedNodeModulesLoader,
+  createLegacyRuntimeOptions: () => createLegacyRuntimeOptions
+});
+module.exports = __toCommonJS(exports_legacy_adapters);
+var import_node_path = __toESM(require("node:path"));
+var import_request_context = require("./request-context.cjs");
+function createHostCallContext(runtimeId, signal, resourceId) {
+  const requestContext = import_request_context.getRequestContext();
+  return {
+    signal,
+    runtimeId,
+    requestId: requestContext.requestId,
+    resourceId,
+    metadata: requestContext.metadata
+  };
+}
+async function normalizeModuleResolveResult(specifier, result, fallbackResolveDir) {
+  const resolved = await result;
+  if (resolved == null) {
+    return null;
+  }
+  if (typeof resolved === "string") {
+    const filename = import_node_path.default.posix.basename(specifier) || "__virtual_module__.js";
+    const resolveDir = specifier.startsWith("/") ? import_node_path.default.posix.dirname(specifier) : fallbackResolveDir ?? "/";
+    return {
+      code: resolved,
+      filename,
+      resolveDir
+    };
+  }
+  return {
+    static: resolved.static,
+    filename: resolved.filename,
+    resolveDir: resolved.resolveDir,
+    code: resolved.code
+  };
+}
+function isAsyncGeneratorFunction(handler) {
+  return handler.constructor.name === "AsyncGeneratorFunction";
+}
+function createLegacyRuntimeOptions(bindings, getRuntimeId, diagnostics) {
+  const moduleLoader = createLegacyModuleLoader(bindings.modules, getRuntimeId, diagnostics);
+  return {
+    console: bindings.console?.onEntry ? {
+      onEntry: (entry) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `console:${crypto.randomUUID()}`);
+        bindings.console?.onEntry?.(entry, context);
+      }
+    } : undefined,
+    fetch: bindings.fetch ? async (url, init) => {
+      diagnostics.pendingFetches += 1;
+      diagnostics.activeResources += 1;
+      try {
+        const request = new Request(url, {
+          method: init.method,
+          headers: init.headers,
+          body: init.rawBody ? init.rawBody.slice(0) : null
+        });
+        const context = createHostCallContext(getRuntimeId(), init.signal, `fetch:${crypto.randomUUID()}`);
+        return await bindings.fetch(request, context);
+      } finally {
+        diagnostics.pendingFetches -= 1;
+        diagnostics.activeResources -= 1;
+      }
+    } : undefined,
+    fs: bindings.files ? {
+      readFile: bindings.files.readFile ? async (filePath) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:read:${crypto.randomUUID()}`);
+        return await bindings.files.readFile(filePath, context);
+      } : undefined,
+      writeFile: bindings.files.writeFile ? async (filePath, data) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:write:${crypto.randomUUID()}`);
+        return await bindings.files.writeFile(filePath, data, context);
+      } : undefined,
+      unlink: bindings.files.unlink ? async (filePath) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:unlink:${crypto.randomUUID()}`);
+        return await bindings.files.unlink(filePath, context);
+      } : undefined,
+      readdir: bindings.files.readdir ? async (dirPath) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:readdir:${crypto.randomUUID()}`);
+        return await bindings.files.readdir(dirPath, context);
+      } : undefined,
+      mkdir: bindings.files.mkdir ? async (dirPath, options) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:mkdir:${crypto.randomUUID()}`);
+        return await bindings.files.mkdir(dirPath, options, context);
+      } : undefined,
+      rmdir: bindings.files.rmdir ? async (dirPath) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:rmdir:${crypto.randomUUID()}`);
+        return await bindings.files.rmdir(dirPath, context);
+      } : undefined,
+      stat: bindings.files.stat ? async (filePath) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:stat:${crypto.randomUUID()}`);
+        return await bindings.files.stat(filePath, context);
+      } : undefined,
+      rename: bindings.files.rename ? async (from, to) => {
+        const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:rename:${crypto.randomUUID()}`);
+        return await bindings.files.rename(from, to, context);
+      } : undefined
+    } : undefined,
+    moduleLoader,
+    customFunctions: bindings.tools ? Object.fromEntries(Object.entries(bindings.tools).map(([name, handler]) => {
+      if (isAsyncGeneratorFunction(handler)) {
+        return [
+          name,
+          {
+            type: "asyncIterator",
+            fn: (...args) => {
+              diagnostics.pendingTools += 1;
+              diagnostics.activeResources += 1;
+              const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `tool:${name}:${crypto.randomUUID()}`);
+              const iterator = handler(...args, context);
+              return async function* () {
+                try {
+                  yield* iterator;
+                } finally {
+                  diagnostics.pendingTools -= 1;
+                  diagnostics.activeResources -= 1;
+                }
+              }();
+            }
+          }
+        ];
+      }
+      return [
+        name,
+        {
+          type: "async",
+          fn: async (...args) => {
+            diagnostics.pendingTools += 1;
+            diagnostics.activeResources += 1;
+            try {
+              const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `tool:${name}:${crypto.randomUUID()}`);
+              return await handler(...args, context);
+            } finally {
+              diagnostics.pendingTools -= 1;
+              diagnostics.activeResources -= 1;
+            }
+          }
+        }
+      ];
+    })) : undefined
+  };
+}
+function createLegacyModuleLoader(resolver, getRuntimeId, diagnostics) {
+  if (!resolver) {
+    return;
+  }
+  return async (specifier, importer) => {
+    diagnostics.activeResources += 1;
+    try {
+      const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `module:${crypto.randomUUID()}`);
+      const result = await resolver.resolve(specifier, importer, context);
+      return result;
+    } finally {
+      diagnostics.activeResources -= 1;
+    }
+  };
+}
+function createMappedNodeModulesLoader(mappings) {
+  if (mappings.length === 0) {
+    return;
+  }
+  throw new Error("createMappedNodeModulesLoader is no longer used directly; call createModuleResolver().mountNodeModules() instead.");
+}
+async function tryResolveModule(resolver, specifier, importer, context) {
+  if (!resolver) {
+    return null;
+  }
+  return normalizeModuleResolveResult(specifier, resolver.resolve(specifier, importer, context), importer.resolveDir);
+}
+async function normalizeExplicitModuleResult(specifier, result, fallbackResolveDir) {
+  return normalizeModuleResolveResult(specifier, result, fallbackResolveDir);
+}
+
+//# debugId=D5F0F03020F4D4CD64756E2164756E21

package/dist/cjs/bridge/legacy-adapters.cjs.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bridge/legacy-adapters.ts"],
+  "sourcesContent": [
+    "import path from \"node:path\";\nimport type { RuntimeOptions } from \"../internal/client/index.cjs\";\nimport type { ModuleLoaderCallback } from \"../internal/protocol/index.cjs\";\nimport { getRequestContext } from \"./request-context.cjs\";\nimport type { HostBindings, HostCallContext, ModuleResolveResult, ModuleResolver, ModuleSource, ToolHandler } from \"../types.cjs\";\nimport type { MutableRuntimeDiagnostics } from \"./diagnostics.cjs\";\n\nfunction createHostCallContext(\n  runtimeId: string,\n  signal: AbortSignal,\n  resourceId: string,\n): HostCallContext {\n  const requestContext = getRequestContext();\n  return {\n    signal,\n    runtimeId,\n    requestId: requestContext.requestId,\n    resourceId,\n    metadata: requestContext.metadata,\n  };\n}\n\nasync function normalizeModuleResolveResult(\n  specifier: string,\n  result: ModuleResolveResult,\n  fallbackResolveDir?: string,\n): Promise<ModuleSource | null> {\n  const resolved = await result;\n  if (resolved == null) {\n    return null;\n  }\n\n  if (typeof resolved === \"string\") {\n    const filename = path.posix.basename(specifier) || \"__virtual_module__.js\";\n    const resolveDir = specifier.startsWith(\"/\")\n      ? path.posix.dirname(specifier)\n      : fallbackResolveDir ?? \"/\";\n    return {\n      code: resolved,\n      filename,\n      resolveDir,\n    };\n  }\n\n  return {\n    static: resolved.static,\n    filename: resolved.filename,\n    resolveDir: resolved.resolveDir,\n    code: resolved.code,\n  };\n}\n\nfunction isAsyncGeneratorFunction(handler: ToolHandler): boolean {\n  return handler.constructor.name === \"AsyncGeneratorFunction\";\n}\n\nexport function createLegacyRuntimeOptions(\n  bindings: HostBindings,\n  getRuntimeId: () => string,\n  diagnostics: MutableRuntimeDiagnostics,\n): RuntimeOptions {\n  const moduleLoader = createLegacyModuleLoader(bindings.modules, getRuntimeId, diagnostics);\n\n  return {\n    console: bindings.console?.onEntry\n      ? {\n          onEntry: (entry) => {\n            const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `console:${crypto.randomUUID()}`);\n            bindings.console?.onEntry?.(entry, context);\n          },\n        }\n      : undefined,\n    fetch: bindings.fetch\n      ? async (url, init) => {\n          diagnostics.pendingFetches += 1;\n          diagnostics.activeResources += 1;\n          try {\n            const request = new Request(url, {\n              method: init.method,\n              headers: init.headers,\n              body: init.rawBody ? init.rawBody.slice(0) : null,\n            });\n            const context = createHostCallContext(getRuntimeId(), init.signal, `fetch:${crypto.randomUUID()}`);\n            return await bindings.fetch!(request, context);\n          } finally {\n            diagnostics.pendingFetches -= 1;\n            diagnostics.activeResources -= 1;\n          }\n        }\n      : undefined,\n    fs: bindings.files\n      ? {\n          readFile: bindings.files.readFile\n            ? async (filePath: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:read:${crypto.randomUUID()}`);\n                return await bindings.files!.readFile!(filePath, context);\n              }\n            : undefined,\n          writeFile: bindings.files.writeFile\n            ? async (filePath: string, data: ArrayBuffer) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:write:${crypto.randomUUID()}`);\n                return await bindings.files!.writeFile!(filePath, data, context);\n              }\n            : undefined,\n          unlink: bindings.files.unlink\n            ? async (filePath: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:unlink:${crypto.randomUUID()}`);\n                return await bindings.files!.unlink!(filePath, context);\n              }\n            : undefined,\n          readdir: bindings.files.readdir\n            ? async (dirPath: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:readdir:${crypto.randomUUID()}`);\n                return await bindings.files!.readdir!(dirPath, context);\n              }\n            : undefined,\n          mkdir: bindings.files.mkdir\n            ? async (dirPath: string, options?: { recursive?: boolean }) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:mkdir:${crypto.randomUUID()}`);\n                return await bindings.files!.mkdir!(dirPath, options, context);\n              }\n            : undefined,\n          rmdir: bindings.files.rmdir\n            ? async (dirPath: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:rmdir:${crypto.randomUUID()}`);\n                return await bindings.files!.rmdir!(dirPath, context);\n              }\n            : undefined,\n          stat: bindings.files.stat\n            ? async (filePath: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:stat:${crypto.randomUUID()}`);\n                return await bindings.files!.stat!(filePath, context);\n              }\n            : undefined,\n          rename: bindings.files.rename\n            ? async (from: string, to: string) => {\n                const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `files:rename:${crypto.randomUUID()}`);\n                return await bindings.files!.rename!(from, to, context);\n              }\n            : undefined,\n        }\n      : undefined,\n    moduleLoader,\n    customFunctions: bindings.tools\n      ? Object.fromEntries(\n          Object.entries(bindings.tools).map(([name, handler]) => {\n            if (isAsyncGeneratorFunction(handler)) {\n              return [\n                name,\n                {\n                  type: \"asyncIterator\" as const,\n                  fn: (...args: unknown[]) => {\n                    diagnostics.pendingTools += 1;\n                    diagnostics.activeResources += 1;\n                    const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `tool:${name}:${crypto.randomUUID()}`);\n                    const iterator = handler(...args, context) as AsyncGenerator<unknown, unknown, unknown>;\n                    return (async function* () {\n                      try {\n                        yield* iterator;\n                      } finally {\n                        diagnostics.pendingTools -= 1;\n                        diagnostics.activeResources -= 1;\n                      }\n                    })();\n                  },\n                },\n              ];\n            }\n\n            return [\n              name,\n              {\n                type: \"async\" as const,\n                fn: async (...args: unknown[]) => {\n                  diagnostics.pendingTools += 1;\n                  diagnostics.activeResources += 1;\n                  try {\n                    const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `tool:${name}:${crypto.randomUUID()}`);\n                    return await handler(...args, context);\n                  } finally {\n                    diagnostics.pendingTools -= 1;\n                    diagnostics.activeResources -= 1;\n                  }\n                },\n              },\n            ];\n          }),\n        )\n      : undefined,\n  };\n}\n\nfunction createLegacyModuleLoader(\n  resolver: ModuleResolver | undefined,\n  getRuntimeId: () => string,\n  diagnostics: MutableRuntimeDiagnostics,\n): ModuleLoaderCallback | undefined {\n  if (!resolver) {\n    return undefined;\n  }\n\n  return async (specifier, importer) => {\n    diagnostics.activeResources += 1;\n    try {\n      const context = createHostCallContext(getRuntimeId(), AbortSignal.abort(), `module:${crypto.randomUUID()}`);\n      const result = await resolver.resolve(specifier, importer, context);\n      return result;\n    } finally {\n      diagnostics.activeResources -= 1;\n    }\n  };\n}\n\nexport function createMappedNodeModulesLoader(mappings: Array<{ from: string; to: string }>): ModuleLoaderCallback | undefined {\n  if (mappings.length === 0) {\n    return undefined;\n  }\n  throw new Error(\"createMappedNodeModulesLoader is no longer used directly; call createModuleResolver().mountNodeModules() instead.\");\n}\n\nexport async function tryResolveModule(\n  resolver: ModuleResolver | undefined,\n  specifier: string,\n  importer: { path: string; resolveDir: string },\n  context: HostCallContext,\n): Promise<ModuleSource | null> {\n  if (!resolver) {\n    return null;\n  }\n  return normalizeModuleResolveResult(specifier, resolver.resolve(specifier, importer, context), importer.resolveDir);\n}\n\nexport async function normalizeExplicitModuleResult(\n  specifier: string,\n  result: ModuleResolveResult,\n  fallbackResolveDir?: string,\n): Promise<ModuleSource | null> {\n  return normalizeModuleResolveResult(specifier, result, fallbackResolveDir);\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAiB,IAAjB;AAGkC,IAAlC;AAIA,SAAS,qBAAqB,CAC5B,WACA,QACA,YACiB;AAAA,EACjB,MAAM,iBAAiB,yCAAkB;AAAA,EACzC,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,eAAe;AAAA,IAC1B;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B;AAAA;AAGF,eAAe,4BAA4B,CACzC,WACA,QACA,oBAC8B;AAAA,EAC9B,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,YAAY,MAAM;AAAA,IACpB,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,aAAa,UAAU;AAAA,IAChC,MAAM,WAAW,yBAAK,MAAM,SAAS,SAAS,KAAK;AAAA,IACnD,MAAM,aAAa,UAAU,WAAW,GAAG,IACvC,yBAAK,MAAM,QAAQ,SAAS,IAC5B,sBAAsB;AAAA,IAC1B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,IACrB,MAAM,SAAS;AAAA,EACjB;AAAA;AAGF,SAAS,wBAAwB,CAAC,SAA+B;AAAA,EAC/D,OAAO,QAAQ,YAAY,SAAS;AAAA;AAG/B,SAAS,0BAA0B,CACxC,UACA,cACA,aACgB;AAAA,EAChB,MAAM,eAAe,yBAAyB,SAAS,SAAS,cAAc,WAAW;AAAA,EAEzF,OAAO;AAAA,IACL,SAAS,SAAS,SAAS,UACvB;AAAA,MACE,SAAS,CAAC,UAAU;AAAA,QAClB,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,WAAW,OAAO,WAAW,GAAG;AAAA,QAC3G,SAAS,SAAS,UAAU,OAAO,OAAO;AAAA;AAAA,IAE9C,IACA;AAAA,IACJ,OAAO,SAAS,QACZ,OAAO,KAAK,SAAS;AAAA,MACnB,YAAY,kBAAkB;AAAA,MAC9B,YAAY,mBAAmB;AAAA,MAC/B,IAAI;AAAA,QACF,MAAM,UAAU,IAAI,QAAQ,KAAK;AAAA,UAC/B,QAAQ,KAAK;AAAA,UACb,SAAS,KAAK;AAAA,UACd,MAAM,KAAK,UAAU,KAAK,QAAQ,MAAM,CAAC,IAAI;AAAA,QAC/C,CAAC;AAAA,QACD,MAAM,UAAU,sBAAsB,aAAa,GAAG,KAAK,QAAQ,SAAS,OAAO,WAAW,GAAG;AAAA,QACjG,OAAO,MAAM,SAAS,MAAO,SAAS,OAAO;AAAA,gBAC7C;AAAA,QACA,YAAY,kBAAkB;AAAA,QAC9B,YAAY,mBAAmB;AAAA;AAAA,QAGnC;AAAA,IACJ,IAAI,SAAS,QACT;AAAA,MACE,UAAU,SAAS,MAAM,WACrB,OAAO,aAAqB;AAAA,QAC1B,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,cAAc,OAAO,WAAW,GAAG;AAAA,QAC9G,OAAO,MAAM,SAAS,MAAO,SAAU,UAAU,OAAO;AAAA,UAE1D;AAAA,MACJ,WAAW,SAAS,MAAM,YACtB,OAAO,UAAkB,SAAsB;AAAA,QAC7C,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,eAAe,OAAO,WAAW,GAAG;AAAA,QAC/G,OAAO,MAAM,SAAS,MAAO,UAAW,UAAU,MAAM,OAAO;AAAA,UAEjE;AAAA,MACJ,QAAQ,SAAS,MAAM,SACnB,OAAO,aAAqB;AAAA,QAC1B,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,gBAAgB,OAAO,WAAW,GAAG;AAAA,QAChH,OAAO,MAAM,SAAS,MAAO,OAAQ,UAAU,OAAO;AAAA,UAExD;AAAA,MACJ,SAAS,SAAS,MAAM,UACpB,OAAO,YAAoB;AAAA,QACzB,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,iBAAiB,OAAO,WAAW,GAAG;AAAA,QACjH,OAAO,MAAM,SAAS,MAAO,QAAS,SAAS,OAAO;AAAA,UAExD;AAAA,MACJ,OAAO,SAAS,MAAM,QAClB,OAAO,SAAiB,YAAsC;AAAA,QAC5D,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,eAAe,OAAO,WAAW,GAAG;AAAA,QAC/G,OAAO,MAAM,SAAS,MAAO,MAAO,SAAS,SAAS,OAAO;AAAA,UAE/D;AAAA,MACJ,OAAO,SAAS,MAAM,QAClB,OAAO,YAAoB;AAAA,QACzB,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,eAAe,OAAO,WAAW,GAAG;AAAA,QAC/G,OAAO,MAAM,SAAS,MAAO,MAAO,SAAS,OAAO;AAAA,UAEtD;AAAA,MACJ,MAAM,SAAS,MAAM,OACjB,OAAO,aAAqB;AAAA,QAC1B,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,cAAc,OAAO,WAAW,GAAG;AAAA,QAC9G,OAAO,MAAM,SAAS,MAAO,KAAM,UAAU,OAAO;AAAA,UAEtD;AAAA,MACJ,QAAQ,SAAS,MAAM,SACnB,OAAO,MAAc,OAAe;AAAA,QAClC,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,gBAAgB,OAAO,WAAW,GAAG;AAAA,QAChH,OAAO,MAAM,SAAS,MAAO,OAAQ,MAAM,IAAI,OAAO;AAAA,UAExD;AAAA,IACN,IACA;AAAA,IACJ;AAAA,IACA,iBAAiB,SAAS,QACtB,OAAO,YACL,OAAO,QAAQ,SAAS,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa;AAAA,MACtD,IAAI,yBAAyB,OAAO,GAAG;AAAA,QACrC,OAAO;AAAA,UACL;AAAA,UACA;AAAA,YACE,MAAM;AAAA,YACN,IAAI,IAAI,SAAoB;AAAA,cAC1B,YAAY,gBAAgB;AAAA,cAC5B,YAAY,mBAAmB;AAAA,cAC/B,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,QAAQ,QAAQ,OAAO,WAAW,GAAG;AAAA,cAChH,MAAM,WAAW,QAAQ,GAAG,MAAM,OAAO;AAAA,cACzC,OAAQ,gBAAgB,GAAG;AAAA,gBACzB,IAAI;AAAA,kBACF,OAAO;AAAA,0BACP;AAAA,kBACA,YAAY,gBAAgB;AAAA,kBAC5B,YAAY,mBAAmB;AAAA;AAAA,gBAEhC;AAAA;AAAA,UAEP;AAAA,QACF;AAAA,MACF;AAAA,MAEA,OAAO;AAAA,QACL;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI,UAAU,SAAoB;AAAA,YAChC,YAAY,gBAAgB;AAAA,YAC5B,YAAY,mBAAmB;AAAA,YAC/B,IAAI;AAAA,cACF,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,QAAQ,QAAQ,OAAO,WAAW,GAAG;AAAA,cAChH,OAAO,MAAM,QAAQ,GAAG,MAAM,OAAO;AAAA,sBACrC;AAAA,cACA,YAAY,gBAAgB;AAAA,cAC5B,YAAY,mBAAmB;AAAA;AAAA;AAAA,QAGrC;AAAA,MACF;AAAA,KACD,CACH,IACA;AAAA,EACN;AAAA;AAGF,SAAS,wBAAwB,CAC/B,UACA,cACA,aACkC;AAAA,EAClC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,WAAW,aAAa;AAAA,IACpC,YAAY,mBAAmB;AAAA,IAC/B,IAAI;AAAA,MACF,MAAM,UAAU,sBAAsB,aAAa,GAAG,YAAY,MAAM,GAAG,UAAU,OAAO,WAAW,GAAG;AAAA,MAC1G,MAAM,SAAS,MAAM,SAAS,QAAQ,WAAW,UAAU,OAAO;AAAA,MAClE,OAAO;AAAA,cACP;AAAA,MACA,YAAY,mBAAmB;AAAA;AAAA;AAAA;AAK9B,SAAS,6BAA6B,CAAC,UAAiF;AAAA,EAC7H,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB;AAAA,EACF;AAAA,EACA,MAAM,IAAI,MAAM,mHAAmH;AAAA;AAGrI,eAAsB,gBAAgB,CACpC,UACA,WACA,UACA,SAC8B;AAAA,EAC9B,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EACA,OAAO,6BAA6B,WAAW,SAAS,QAAQ,WAAW,UAAU,OAAO,GAAG,SAAS,UAAU;AAAA;AAGpH,eAAsB,6BAA6B,CACjD,WACA,QACA,oBAC8B;AAAA,EAC9B,OAAO,6BAA6B,WAAW,QAAQ,kBAAkB;AAAA;",
+  "debugId": "D5F0F03020F4D4CD64756E2164756E21",
+  "names": []
+}