@secure-exec/browser 0.0.0-nathan-docs-sdk-expansion.c9c2e4e

package/dist/worker.js

@@ -0,0 +1,1399 @@
+import { transform } from "sucrase";
+import { createBrowserNetworkAdapter } from "./driver.js";
+import { validatePermissionSource } from "./permission-validation.js";
+import { createCommandExecutorStub, createNetworkStub, exposeCustomGlobal, exposeMutableRuntimeStateGlobal, filterEnv, getIsolateRuntimeSource, getRequireSetupCode, isESM, POLYFILL_CODE_MAP, transformDynamicImport, wrapNetworkAdapter, } from "./runtime.js";
+import { assertBrowserSyncBridgeSupport, SYNC_BRIDGE_KIND_BINARY, SYNC_BRIDGE_KIND_JSON, SYNC_BRIDGE_KIND_NONE, SYNC_BRIDGE_KIND_TEXT, SYNC_BRIDGE_SIGNAL_KIND_INDEX, SYNC_BRIDGE_SIGNAL_LENGTH_INDEX, SYNC_BRIDGE_SIGNAL_STATE_IDLE, SYNC_BRIDGE_SIGNAL_STATE_INDEX, SYNC_BRIDGE_SIGNAL_STATUS_INDEX, SYNC_BRIDGE_STATUS_ERROR, } from "./sync-bridge.js";
+let networkAdapter = null;
+let commandExecutor = null;
+let permissions;
+let initialized = false;
+let controlToken = null;
+let runtimeTimingMitigation = "freeze";
+let runtimeProcessConfig = null;
+let activeProcessRequestId = null;
+const dynamicImportCache = new Map();
+const MAX_ERROR_MESSAGE_CHARS = 8192;
+const MAX_STDIO_MESSAGE_CHARS = 8192;
+const MAX_STDIO_DEPTH = 6;
+const MAX_STDIO_OBJECT_KEYS = 60;
+const MAX_STDIO_ARRAY_ITEMS = 120;
+// Payload size defaults matching the Node runtime path
+const DEFAULT_BASE64_TRANSFER_BYTES = 16 * 1024 * 1024;
+const DEFAULT_JSON_PAYLOAD_BYTES = 4 * 1024 * 1024;
+const PAYLOAD_LIMIT_ERROR_CODE = "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
+let base64TransferLimitBytes = DEFAULT_BASE64_TRANSFER_BYTES;
+let jsonPayloadLimitBytes = DEFAULT_JSON_PAYLOAD_BYTES;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+// biome-ignore lint/security/noGlobalEval: the browser worker intentionally evaluates isolated runtime source strings.
+const globalEval = eval;
+const SHARED_ARRAY_BUFFER_FREEZE_KEYS = [
+    "byteLength",
+    "slice",
+    "grow",
+    "maxByteLength",
+    "growable",
+];
+const timingGlobals = {
+    captured: false,
+    sharedArrayBufferPrototypeDescriptors: new Map(),
+};
+function getUtf8ByteLength(text) {
+    return encoder.encode(text).byteLength;
+}
+function getRequiredControlToken() {
+    if (!controlToken) {
+        throw new Error("Browser runtime worker control channel is not initialized");
+    }
+    return controlToken;
+}
+function captureTimingGlobals() {
+    if (timingGlobals.captured) {
+        return;
+    }
+    timingGlobals.captured = true;
+    timingGlobals.dateDescriptor = Object.getOwnPropertyDescriptor(globalThis, "Date");
+    timingGlobals.dateValue = globalThis.Date;
+    timingGlobals.performanceDescriptor = Object.getOwnPropertyDescriptor(globalThis, "performance");
+    timingGlobals.performanceValue = globalThis.performance;
+    timingGlobals.sharedArrayBufferDescriptor = Object.getOwnPropertyDescriptor(globalThis, "SharedArrayBuffer");
+    timingGlobals.sharedArrayBufferValue = globalThis.SharedArrayBuffer;
+    const sharedArrayBufferCtor = globalThis.SharedArrayBuffer;
+    if (typeof sharedArrayBufferCtor !== "function") {
+        return;
+    }
+    const prototype = sharedArrayBufferCtor.prototype;
+    for (const key of SHARED_ARRAY_BUFFER_FREEZE_KEYS) {
+        timingGlobals.sharedArrayBufferPrototypeDescriptors.set(key, Object.getOwnPropertyDescriptor(prototype, key));
+    }
+}
+function restoreGlobalProperty(name, descriptor) {
+    if (descriptor) {
+        try {
+            Object.defineProperty(globalThis, name, descriptor);
+            return;
+        }
+        catch {
+            if ("value" in descriptor) {
+                globalThis[name] = descriptor.value;
+                return;
+            }
+        }
+    }
+    Reflect.deleteProperty(globalThis, name);
+}
+function restoreSharedArrayBufferPrototype() {
+    const sharedArrayBufferCtor = timingGlobals.sharedArrayBufferValue;
+    if (typeof sharedArrayBufferCtor !== "function") {
+        return;
+    }
+    const prototype = sharedArrayBufferCtor.prototype;
+    for (const key of SHARED_ARRAY_BUFFER_FREEZE_KEYS) {
+        const descriptor = timingGlobals.sharedArrayBufferPrototypeDescriptors.get(key);
+        try {
+            if (descriptor) {
+                Object.defineProperty(prototype, key, descriptor);
+            }
+            else {
+                delete prototype[key];
+            }
+        }
+        catch {
+            // Ignore non-configurable SharedArrayBuffer prototype properties.
+        }
+    }
+}
+function restoreTimingMitigationOff() {
+    captureTimingGlobals();
+    restoreGlobalProperty("Date", timingGlobals.dateDescriptor);
+    restoreGlobalProperty("performance", timingGlobals.performanceDescriptor);
+    restoreSharedArrayBufferPrototype();
+    restoreGlobalProperty("SharedArrayBuffer", timingGlobals.sharedArrayBufferDescriptor);
+    if (typeof globalThis.performance === "undefined" ||
+        globalThis.performance === null) {
+        Object.defineProperty(globalThis, "performance", {
+            value: {
+                now: () => Date.now(),
+            },
+            configurable: true,
+            writable: true,
+        });
+    }
+}
+function applyTimingMitigation(timingMitigation, frozenTimeMs) {
+    captureTimingGlobals();
+    restoreTimingMitigationOff();
+    if (timingMitigation !== "freeze") {
+        return undefined;
+    }
+    const frozenTimeValue = typeof frozenTimeMs === "number" && Number.isFinite(frozenTimeMs)
+        ? Math.trunc(frozenTimeMs)
+        : Date.now();
+    const originalDate = timingGlobals.dateValue ?? timingGlobals.dateDescriptor?.value ?? Date;
+    const frozenDateNow = () => frozenTimeValue;
+    const FrozenDate = function (...args) {
+        if (new.target) {
+            if (args.length === 0) {
+                return new originalDate(frozenTimeValue);
+            }
+            return new originalDate(...args);
+        }
+        return originalDate();
+    };
+    Object.defineProperty(FrozenDate, "prototype", {
+        value: originalDate.prototype,
+        writable: false,
+        configurable: false,
+    });
+    Object.defineProperty(FrozenDate, "now", {
+        value: frozenDateNow,
+        configurable: true,
+        writable: false,
+    });
+    FrozenDate.parse = originalDate.parse;
+    FrozenDate.UTC = originalDate.UTC;
+    try {
+        Object.defineProperty(globalThis, "Date", {
+            value: FrozenDate,
+            configurable: true,
+            writable: false,
+        });
+    }
+    catch {
+        globalThis.Date = FrozenDate;
+    }
+    const frozenPerformance = Object.create(null);
+    const originalPerformance = timingGlobals.performanceValue;
+    if (typeof originalPerformance !== "undefined" &&
+        originalPerformance !== null) {
+        const source = originalPerformance;
+        for (const key of Object.getOwnPropertyNames(Object.getPrototypeOf(originalPerformance) ?? originalPerformance)) {
+            if (key === "now") {
+                continue;
+            }
+            try {
+                const value = source[key];
+                frozenPerformance[key] =
+                    typeof value === "function" ? value.bind(originalPerformance) : value;
+            }
+            catch {
+                // Ignore performance accessors that throw in this host.
+            }
+        }
+    }
+    Object.defineProperty(frozenPerformance, "now", {
+        value: () => 0,
+        configurable: true,
+        writable: false,
+    });
+    Object.freeze(frozenPerformance);
+    try {
+        Object.defineProperty(globalThis, "performance", {
+            value: frozenPerformance,
+            configurable: true,
+            writable: false,
+        });
+    }
+    catch {
+        globalThis.performance = frozenPerformance;
+    }
+    const sharedArrayBufferCtor = timingGlobals.sharedArrayBufferValue;
+    if (typeof sharedArrayBufferCtor === "function") {
+        const prototype = sharedArrayBufferCtor.prototype;
+        for (const key of SHARED_ARRAY_BUFFER_FREEZE_KEYS) {
+            try {
+                Object.defineProperty(prototype, key, {
+                    get() {
+                        throw new TypeError("SharedArrayBuffer is not available in sandbox");
+                    },
+                    configurable: true,
+                });
+            }
+            catch {
+                // Ignore non-configurable SharedArrayBuffer prototype properties.
+            }
+        }
+    }
+    try {
+        Object.defineProperty(globalThis, "SharedArrayBuffer", {
+            value: undefined,
+            configurable: true,
+            writable: false,
+            enumerable: false,
+        });
+    }
+    catch {
+        Reflect.deleteProperty(globalThis, "SharedArrayBuffer");
+    }
+    return frozenTimeValue;
+}
+function assertPayloadByteLength(payloadLabel, actualBytes, maxBytes) {
+    if (actualBytes <= maxBytes)
+        return;
+    const error = new Error(`[${PAYLOAD_LIMIT_ERROR_CODE}] ${payloadLabel}: payload is ${actualBytes} bytes, limit is ${maxBytes} bytes`);
+    error.code = PAYLOAD_LIMIT_ERROR_CODE;
+    throw error;
+}
+function assertTextPayloadSize(payloadLabel, text, maxBytes) {
+    assertPayloadByteLength(payloadLabel, getUtf8ByteLength(text), maxBytes);
+}
+function boundErrorMessage(message) {
+    if (message.length <= MAX_ERROR_MESSAGE_CHARS) {
+        return message;
+    }
+    return `${message.slice(0, MAX_ERROR_MESSAGE_CHARS)}...[Truncated]`;
+}
+function boundStdioMessage(message) {
+    if (message.length <= MAX_STDIO_MESSAGE_CHARS) {
+        return message;
+    }
+    return `${message.slice(0, MAX_STDIO_MESSAGE_CHARS)}...[Truncated]`;
+}
+function revivePermission(source) {
+    if (!source)
+        return undefined;
+    // Validate source before eval to prevent code injection
+    if (!validatePermissionSource(source))
+        return undefined;
+    try {
+        const fn = new Function(`return (${source});`)();
+        if (typeof fn === "function")
+            return fn;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Deserialize permission callbacks that were stringified for transfer across the Worker boundary. */
+function revivePermissions(serialized) {
+    if (!serialized)
+        return undefined;
+    const perms = {};
+    perms.fs = revivePermission(serialized.fs);
+    perms.network = revivePermission(serialized.network);
+    perms.childProcess = revivePermission(serialized.childProcess);
+    perms.env = revivePermission(serialized.env);
+    return perms;
+}
+/**
+ * Wrap a sync function in the bridge calling convention (`applySync`) so
+ * bridge code can call it the same way it calls bridge References.
+ */
+function makeApplySync(fn) {
+    const applySync = (_ctx, args) => fn(...args);
+    return {
+        applySync,
+        applySyncPromise: applySync,
+    };
+}
+function makeApplySyncPromise(fn) {
+    return {
+        applySyncPromise(_ctx, args) {
+            return fn(...args);
+        },
+    };
+}
+function makeApplyPromise(fn) {
+    return {
+        apply(_ctx, args) {
+            return fn(...args);
+        },
+    };
+}
+function normalizeTextEncoding(options) {
+    if (typeof options === "string") {
+        return options;
+    }
+    if (options && typeof options === "object" && "encoding" in options) {
+        const encoding = options.encoding;
+        return typeof encoding === "string" ? encoding : null;
+    }
+    return null;
+}
+function toBinaryView(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (ArrayBuffer.isView(data)) {
+        return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+    }
+    if (data instanceof ArrayBuffer) {
+        return new Uint8Array(data);
+    }
+    return new TextEncoder().encode(String(data));
+}
+function toNodeBuffer(bytes) {
+    if (typeof Buffer === "function") {
+        return Buffer.from(bytes);
+    }
+    return bytes;
+}
+function createStats(stat) {
+    return {
+        ...stat,
+        isFile: () => !stat.isDirectory && !stat.isSymbolicLink,
+        isDirectory: () => stat.isDirectory,
+        isSymbolicLink: () => stat.isSymbolicLink,
+    };
+}
+function createDirent(entry) {
+    return {
+        name: entry.name,
+        isFile: () => !entry.isDirectory && !entry.isSymbolicLink,
+        isDirectory: () => entry.isDirectory,
+        isSymbolicLink: () => Boolean(entry.isSymbolicLink),
+    };
+}
+function createFsModule(syncBridge) {
+    const readFileSync = (path, options) => {
+        const encoding = normalizeTextEncoding(options);
+        if (encoding) {
+            return syncBridge.requestText("fs.readFile", [path]);
+        }
+        return toNodeBuffer(syncBridge.requestBinary("fs.readFileBinary", [path]));
+    };
+    const writeFileSync = (path, content) => {
+        if (typeof content === "string") {
+            syncBridge.requestVoid("fs.writeFile", [path, content]);
+            return;
+        }
+        syncBridge.requestVoid("fs.writeFileBinary", [path, toBinaryView(content)]);
+    };
+    const mkdirSync = (path, options) => {
+        const recursive = typeof options === "boolean" ? options : (options?.recursive ?? true);
+        if (recursive) {
+            syncBridge.requestVoid("fs.mkdir", [path]);
+            return;
+        }
+        syncBridge.requestVoid("fs.createDir", [path]);
+    };
+    const readdirSync = (path, options) => {
+        const entries = syncBridge.requestJson("fs.readDir", [
+            path,
+        ]);
+        if (options?.withFileTypes) {
+            return entries.map((entry) => createDirent(entry));
+        }
+        return entries.map((entry) => entry.name);
+    };
+    const statSync = (path) => createStats(syncBridge.requestJson("fs.stat", [path]));
+    const lstatSync = (path) => createStats(syncBridge.requestJson("fs.lstat", [path]));
+    const promises = {
+        readFile(path, options) {
+            return Promise.resolve(readFileSync(path, options));
+        },
+        writeFile(path, content) {
+            writeFileSync(path, content);
+            return Promise.resolve();
+        },
+        mkdir(path, options) {
+            mkdirSync(path, options);
+            return Promise.resolve();
+        },
+        readdir(path, options) {
+            return Promise.resolve(readdirSync(path, options));
+        },
+        stat(path) {
+            return Promise.resolve(statSync(path));
+        },
+        lstat(path) {
+            return Promise.resolve(lstatSync(path));
+        },
+        unlink(path) {
+            syncBridge.requestVoid("fs.unlink", [path]);
+            return Promise.resolve();
+        },
+        rmdir(path) {
+            syncBridge.requestVoid("fs.rmdir", [path]);
+            return Promise.resolve();
+        },
+        rm(path) {
+            syncBridge.requestVoid("fs.unlink", [path]);
+            return Promise.resolve();
+        },
+        rename(oldPath, newPath) {
+            syncBridge.requestVoid("fs.rename", [oldPath, newPath]);
+            return Promise.resolve();
+        },
+        realpath(path) {
+            return Promise.resolve(syncBridge.requestText("fs.realpath", [path]));
+        },
+        readlink(path) {
+            return Promise.resolve(syncBridge.requestText("fs.readlink", [path]));
+        },
+        symlink(target, path) {
+            syncBridge.requestVoid("fs.symlink", [target, path]);
+            return Promise.resolve();
+        },
+        link(existingPath, newPath) {
+            syncBridge.requestVoid("fs.link", [existingPath, newPath]);
+            return Promise.resolve();
+        },
+        chmod(path, mode) {
+            syncBridge.requestVoid("fs.chmod", [path, mode]);
+            return Promise.resolve();
+        },
+        truncate(path, length = 0) {
+            syncBridge.requestVoid("fs.truncate", [path, length]);
+            return Promise.resolve();
+        },
+    };
+    return {
+        readFileSync,
+        writeFileSync,
+        mkdirSync,
+        readdirSync,
+        existsSync(path) {
+            return syncBridge.requestJson("fs.exists", [path]);
+        },
+        statSync,
+        lstatSync,
+        unlinkSync(path) {
+            syncBridge.requestVoid("fs.unlink", [path]);
+        },
+        rmdirSync(path) {
+            syncBridge.requestVoid("fs.rmdir", [path]);
+        },
+        rmSync(path) {
+            syncBridge.requestVoid("fs.unlink", [path]);
+        },
+        renameSync(oldPath, newPath) {
+            syncBridge.requestVoid("fs.rename", [oldPath, newPath]);
+        },
+        realpathSync(path) {
+            return syncBridge.requestText("fs.realpath", [path]);
+        },
+        readlinkSync(path) {
+            return syncBridge.requestText("fs.readlink", [path]);
+        },
+        symlinkSync(target, path) {
+            syncBridge.requestVoid("fs.symlink", [target, path]);
+        },
+        linkSync(existingPath, newPath) {
+            syncBridge.requestVoid("fs.link", [existingPath, newPath]);
+        },
+        chmodSync(path, mode) {
+            syncBridge.requestVoid("fs.chmod", [path, mode]);
+        },
+        truncateSync(path, length = 0) {
+            syncBridge.requestVoid("fs.truncate", [path, length]);
+        },
+        promises,
+    };
+}
+// Save real postMessage before sandbox code can replace it
+const _realPostMessage = self.postMessage.bind(self);
+function postResponse(message) {
+    _realPostMessage({
+        controlToken: getRequiredControlToken(),
+        ...message,
+    });
+}
+function postSyncRequest(message) {
+    _realPostMessage({
+        controlToken: getRequiredControlToken(),
+        ...message,
+    });
+}
+function postStdio(requestId, channel, message) {
+    const payload = {
+        controlToken: getRequiredControlToken(),
+        type: "stdio",
+        requestId,
+        channel,
+        message,
+    };
+    _realPostMessage(payload);
+}
+function formatConsoleValue(value, seen = new WeakSet(), depth = 0) {
+    if (value === null) {
+        return "null";
+    }
+    if (value === undefined) {
+        return "undefined";
+    }
+    if (typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return String(value);
+    }
+    if (typeof value === "bigint") {
+        return `${value.toString()}n`;
+    }
+    if (typeof value === "symbol") {
+        return value.toString();
+    }
+    if (typeof value === "function") {
+        return `[Function ${value.name || "anonymous"}]`;
+    }
+    if (typeof value !== "object") {
+        return String(value);
+    }
+    if (seen.has(value)) {
+        return "[Circular]";
+    }
+    if (depth >= MAX_STDIO_DEPTH) {
+        return "[MaxDepth]";
+    }
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const out = value
+                .slice(0, MAX_STDIO_ARRAY_ITEMS)
+                .map((item) => formatConsoleValue(item, seen, depth + 1));
+            if (value.length > MAX_STDIO_ARRAY_ITEMS) {
+                out.push('"[Truncated]"');
+            }
+            return `[${out.join(", ")}]`;
+        }
+        const entries = [];
+        for (const key of Object.keys(value).slice(0, MAX_STDIO_OBJECT_KEYS)) {
+            entries.push(`${key}: ${formatConsoleValue(value[key], seen, depth + 1)}`);
+        }
+        if (Object.keys(value).length > MAX_STDIO_OBJECT_KEYS) {
+            entries.push('"[Truncated]"');
+        }
+        return `{ ${entries.join(", ")} }`;
+    }
+    catch {
+        return "[Unserializable]";
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+function emitStdio(requestId, channel, args) {
+    const message = boundStdioMessage(args.map((arg) => formatConsoleValue(arg)).join(" "));
+    postStdio(requestId, channel, message);
+}
+function createSyncBridgeClient(payload) {
+    const signal = new Int32Array(payload.signalBuffer);
+    const data = new Uint8Array(payload.dataBuffer);
+    let nextRequestId = 1;
+    const timeoutMs = payload.timeoutMs ?? 30_000;
+    function readBytes(length) {
+        if (length <= 0) {
+            return new Uint8Array(0);
+        }
+        return data.slice(0, length);
+    }
+    function requestRaw(operation, args) {
+        Atomics.store(signal, SYNC_BRIDGE_SIGNAL_STATE_INDEX, SYNC_BRIDGE_SIGNAL_STATE_IDLE);
+        Atomics.store(signal, SYNC_BRIDGE_SIGNAL_STATUS_INDEX, 0);
+        Atomics.store(signal, SYNC_BRIDGE_SIGNAL_KIND_INDEX, SYNC_BRIDGE_KIND_NONE);
+        Atomics.store(signal, SYNC_BRIDGE_SIGNAL_LENGTH_INDEX, 0);
+        postSyncRequest({
+            type: "sync-request",
+            requestId: nextRequestId++,
+            operation,
+            args,
+        });
+        while (true) {
+            const result = Atomics.wait(signal, SYNC_BRIDGE_SIGNAL_STATE_INDEX, SYNC_BRIDGE_SIGNAL_STATE_IDLE, timeoutMs);
+            if (result !== "timed-out") {
+                break;
+            }
+            throw new Error(`Browser runtime sync bridge timed out while handling ${operation}`);
+        }
+        const status = Atomics.load(signal, SYNC_BRIDGE_SIGNAL_STATUS_INDEX);
+        const kind = Atomics.load(signal, SYNC_BRIDGE_SIGNAL_KIND_INDEX);
+        const length = Atomics.load(signal, SYNC_BRIDGE_SIGNAL_LENGTH_INDEX);
+        const bytes = readBytes(length);
+        Atomics.store(signal, SYNC_BRIDGE_SIGNAL_STATE_INDEX, SYNC_BRIDGE_SIGNAL_STATE_IDLE);
+        if (status === SYNC_BRIDGE_STATUS_ERROR) {
+            const errorPayload = JSON.parse(decoder.decode(bytes));
+            const error = new Error(errorPayload.message);
+            if (errorPayload.code) {
+                error.code = errorPayload.code;
+            }
+            throw error;
+        }
+        return { kind, bytes };
+    }
+    return {
+        requestVoid(operation, args) {
+            requestRaw(operation, args);
+        },
+        requestText(operation, args) {
+            const result = requestRaw(operation, args);
+            if (result.kind !== SYNC_BRIDGE_KIND_TEXT) {
+                throw new Error(`Expected text response from ${operation}, received kind ${result.kind}`);
+            }
+            return decoder.decode(result.bytes);
+        },
+        requestNullableText(operation, args) {
+            const result = requestRaw(operation, args);
+            if (result.kind === SYNC_BRIDGE_KIND_NONE) {
+                return null;
+            }
+            if (result.kind !== SYNC_BRIDGE_KIND_TEXT) {
+                throw new Error(`Expected text response from ${operation}, received kind ${result.kind}`);
+            }
+            return decoder.decode(result.bytes);
+        },
+        requestBinary(operation, args) {
+            const result = requestRaw(operation, args);
+            if (result.kind !== SYNC_BRIDGE_KIND_BINARY) {
+                throw new Error(`Expected binary response from ${operation}, received kind ${result.kind}`);
+            }
+            return result.bytes;
+        },
+        requestJson(operation, args) {
+            const result = requestRaw(operation, args);
+            if (result.kind !== SYNC_BRIDGE_KIND_JSON) {
+                throw new Error(`Expected JSON response from ${operation}, received kind ${result.kind}`);
+            }
+            return JSON.parse(decoder.decode(result.bytes));
+        },
+    };
+}
+/**
+ * Initialize the worker-side runtime: set up filesystem, network, bridge
+ * globals, and load the bridge bundle. Called once before any exec/run.
+ */
+async function initRuntime(payload) {
+    if (initialized)
+        return;
+    assertBrowserSyncBridgeSupport();
+    captureTimingGlobals();
+    if (!payload.syncBridge) {
+        throw new Error("Browser runtime sync bridge is required for filesystem and module loading parity");
+    }
+    permissions = revivePermissions(payload.permissions);
+    const syncBridge = createSyncBridgeClient(payload.syncBridge);
+    // Apply payload limits (use defaults if not configured)
+    base64TransferLimitBytes =
+        payload.payloadLimits?.base64TransferBytes ?? DEFAULT_BASE64_TRANSFER_BYTES;
+    jsonPayloadLimitBytes =
+        payload.payloadLimits?.jsonPayloadBytes ?? DEFAULT_JSON_PAYLOAD_BYTES;
+    if (payload.networkEnabled) {
+        networkAdapter = wrapNetworkAdapter(createBrowserNetworkAdapter(), permissions);
+    }
+    else {
+        networkAdapter = createNetworkStub();
+    }
+    commandExecutor = createCommandExecutorStub();
+    const processConfig = payload.processConfig ?? {};
+    runtimeProcessConfig = processConfig;
+    runtimeTimingMitigation =
+        payload.timingMitigation ??
+            processConfig.timingMitigation ??
+            runtimeTimingMitigation;
+    processConfig.env = filterEnv(processConfig.env, permissions);
+    processConfig.timingMitigation = runtimeTimingMitigation;
+    delete processConfig.frozenTimeMs;
+    exposeCustomGlobal("_processConfig", processConfig);
+    exposeCustomGlobal("_osConfig", payload.osConfig ?? {});
+    // Set up filesystem bridge globals before loading runtime shims.
+    const readFileRef = makeApplySync((path) => {
+        const text = syncBridge.requestText("fs.readFile", [path]);
+        assertTextPayloadSize(`fs.readFile ${path}`, text, jsonPayloadLimitBytes);
+        return text;
+    });
+    const writeFileRef = makeApplySync((path, content) => {
+        assertTextPayloadSize(`fs.writeFile ${path}`, content, jsonPayloadLimitBytes);
+        syncBridge.requestVoid("fs.writeFile", [path, content]);
+    });
+    const readFileBinaryRef = makeApplySync((path) => {
+        const data = syncBridge.requestBinary("fs.readFileBinary", [path]);
+        assertPayloadByteLength(`fs.readFileBinary ${path}`, data.byteLength, base64TransferLimitBytes);
+        return data;
+    });
+    const writeFileBinaryRef = makeApplySync((path, binaryContent) => {
+        assertPayloadByteLength(`fs.writeFileBinary ${path}`, binaryContent.byteLength, base64TransferLimitBytes);
+        syncBridge.requestVoid("fs.writeFileBinary", [path, binaryContent]);
+    });
+    const readDirRef = makeApplySync((path) => {
+        const json = JSON.stringify(syncBridge.requestJson("fs.readDir", [path]));
+        assertTextPayloadSize(`fs.readDir ${path}`, json, jsonPayloadLimitBytes);
+        return json;
+    });
+    const mkdirRef = makeApplySync((path) => {
+        syncBridge.requestVoid("fs.mkdir", [path]);
+    });
+    const rmdirRef = makeApplySync((path) => {
+        syncBridge.requestVoid("fs.rmdir", [path]);
+    });
+    const existsRef = makeApplySync((path) => {
+        return syncBridge.requestJson("fs.exists", [path]);
+    });
+    const statRef = makeApplySync((path) => {
+        return JSON.stringify(syncBridge.requestJson("fs.stat", [path]));
+    });
+    const unlinkRef = makeApplySync((path) => {
+        syncBridge.requestVoid("fs.unlink", [path]);
+    });
+    const renameRef = makeApplySync((oldPath, newPath) => {
+        syncBridge.requestVoid("fs.rename", [oldPath, newPath]);
+    });
+    exposeCustomGlobal("_fs", {
+        readFile: readFileRef,
+        writeFile: writeFileRef,
+        readFileBinary: readFileBinaryRef,
+        writeFileBinary: writeFileBinaryRef,
+        readDir: readDirRef,
+        mkdir: mkdirRef,
+        rmdir: rmdirRef,
+        exists: existsRef,
+        stat: statRef,
+        unlink: unlinkRef,
+        rename: renameRef,
+    });
+    exposeCustomGlobal("_loadPolyfill", (moduleName) => {
+        const name = moduleName.replace(/^node:/, "");
+        const polyfillMap = POLYFILL_CODE_MAP;
+        return polyfillMap[name] ?? null;
+    });
+    const resolveModuleSync = (request, fromDir, mode) => {
+        return syncBridge.requestNullableText("module.resolve", [
+            request,
+            fromDir,
+            mode ?? "require",
+        ]);
+    };
+    const loadFileSync = (path, _mode) => {
+        const source = syncBridge.requestNullableText("module.loadFile", [path]);
+        if (source === null) {
+            return null;
+        }
+        let code = source;
+        if (isESM(source, path)) {
+            code = transform(code, { transforms: ["imports"] }).code;
+        }
+        return transformDynamicImport(code);
+    };
+    exposeCustomGlobal("_resolveModuleSync", resolveModuleSync);
+    exposeCustomGlobal("_loadFileSync", loadFileSync);
+    exposeCustomGlobal("_resolveModule", resolveModuleSync);
+    exposeCustomGlobal("_loadFile", loadFileSync);
+    exposeCustomGlobal("_scheduleTimer", {
+        apply(_ctx, args) {
+            return new Promise((resolve) => {
+                setTimeout(resolve, args[0]);
+            });
+        },
+    });
+    const netAdapter = networkAdapter ?? createNetworkStub();
+    exposeCustomGlobal("_networkFetchRaw", makeApplyPromise(async (url, optionsJson) => {
+        const options = JSON.parse(optionsJson);
+        const result = await netAdapter.fetch(url, options);
+        return JSON.stringify(result);
+    }));
+    exposeCustomGlobal("_networkDnsLookupRaw", makeApplyPromise(async (hostname) => {
+        const result = await netAdapter.dnsLookup(hostname);
+        return JSON.stringify(result);
+    }));
+    const execAdapter = commandExecutor ?? createCommandExecutorStub();
+    let nextSessionId = 1;
+    const sessions = new Map();
+    const getDispatch = () => globalThis._childProcessDispatch;
+    exposeCustomGlobal("_childProcessSpawnStart", makeApplySync((command, argsJson, optionsJson) => {
+        const args = JSON.parse(argsJson);
+        const options = JSON.parse(optionsJson);
+        const sessionId = nextSessionId++;
+        const proc = execAdapter.spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            onStdout: (data) => {
+                getDispatch()?.(sessionId, "stdout", data);
+            },
+            onStderr: (data) => {
+                getDispatch()?.(sessionId, "stderr", data);
+            },
+        });
+        void proc.wait().then((code) => {
+            getDispatch()?.(sessionId, "exit", code);
+            sessions.delete(sessionId);
+        });
+        sessions.set(sessionId, proc);
+        return sessionId;
+    }));
+    exposeCustomGlobal("_childProcessStdinWrite", makeApplySync((sessionId, data) => {
+        sessions.get(sessionId)?.writeStdin(data);
+    }));
+    exposeCustomGlobal("_childProcessStdinClose", makeApplySync((sessionId) => {
+        sessions.get(sessionId)?.closeStdin();
+    }));
+    exposeCustomGlobal("_childProcessKill", makeApplySync((sessionId, signal) => {
+        sessions.get(sessionId)?.kill(signal);
+    }));
+    exposeCustomGlobal("_childProcessSpawnSync", makeApplySyncPromise(async (command, argsJson, optionsJson) => {
+        const args = JSON.parse(argsJson);
+        const options = JSON.parse(optionsJson);
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        const proc = execAdapter.spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            onStdout: (data) => stdoutChunks.push(data),
+            onStderr: (data) => stderrChunks.push(data),
+        });
+        const exitCode = await proc.wait();
+        const decoder = new TextDecoder();
+        const stdout = stdoutChunks.map((c) => decoder.decode(c)).join("");
+        const stderr = stderrChunks.map((c) => decoder.decode(c)).join("");
+        return JSON.stringify({ stdout, stderr, code: exitCode });
+    }));
+    exposeCustomGlobal("_fsModule", createFsModule(syncBridge));
+    exposeMutableRuntimeStateGlobal("_moduleCache", {});
+    exposeMutableRuntimeStateGlobal("_pendingModules", {});
+    exposeMutableRuntimeStateGlobal("_currentModule", { dirname: "/" });
+    globalEval(getRequireSetupCode());
+    ensureProcessGlobal();
+    // Block dangerous Web APIs that bypass bridge permission checks
+    const dangerousApis = [
+        "XMLHttpRequest",
+        "WebSocket",
+        "importScripts",
+        "indexedDB",
+        "caches",
+        "BroadcastChannel",
+    ];
+    for (const api of dangerousApis) {
+        try {
+            delete self[api];
+        }
+        catch {
+            // May not exist or may be non-configurable
+        }
+        Object.defineProperty(self, api, {
+            get() {
+                throw new ReferenceError(`${api} is not available in sandbox`);
+            },
+            configurable: false,
+        });
+    }
+    // Lock down self.onmessage so sandbox code cannot hijack the control channel
+    const currentHandler = self.onmessage;
+    Object.defineProperty(self, "onmessage", {
+        value: currentHandler,
+        writable: false,
+        configurable: false,
+    });
+    // Block self.postMessage so sandbox code cannot forge responses to host
+    Object.defineProperty(self, "postMessage", {
+        get() {
+            throw new TypeError("postMessage is not available in sandbox");
+        },
+        configurable: false,
+    });
+    initialized = true;
+}
+function resetModuleState(cwd) {
+    exposeMutableRuntimeStateGlobal("_moduleCache", {});
+    exposeMutableRuntimeStateGlobal("_pendingModules", {});
+    exposeMutableRuntimeStateGlobal("_currentModule", { dirname: cwd });
+}
+function setDynamicImportFallback() {
+    exposeMutableRuntimeStateGlobal("__dynamicImport", (specifier) => {
+        const cached = dynamicImportCache.get(specifier);
+        if (cached)
+            return Promise.resolve(cached);
+        try {
+            const runtimeRequire = globalThis.require;
+            if (typeof runtimeRequire !== "function") {
+                throw new Error("require is not available in browser runtime");
+            }
+            const mod = runtimeRequire(specifier);
+            return Promise.resolve({
+                default: mod,
+                ...mod,
+            });
+        }
+        catch (e) {
+            return Promise.reject(new Error(`Cannot dynamically import '${specifier}': ${String(e)}`));
+        }
+    });
+}
+function toProcessChunk(value, encoding) {
+    if (encoding) {
+        return value;
+    }
+    return encoder.encode(value);
+}
+function normalizeProcessOutputChunk(chunk) {
+    if (typeof chunk === "string") {
+        return chunk;
+    }
+    if (chunk instanceof Uint8Array) {
+        return decoder.decode(chunk);
+    }
+    if (ArrayBuffer.isView(chunk)) {
+        return decoder.decode(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+    }
+    if (chunk instanceof ArrayBuffer) {
+        return decoder.decode(new Uint8Array(chunk));
+    }
+    return String(chunk);
+}
+function emitProcessStdio(channel, chunk) {
+    if (activeProcessRequestId === null) {
+        return true;
+    }
+    emitStdio(activeProcessRequestId, channel, [
+        normalizeProcessOutputChunk(chunk),
+    ]);
+    return true;
+}
+function createBrowserProcess() {
+    let cwd = "/";
+    let stdinData = "";
+    let stdinPosition = 0;
+    let stdinEnded = false;
+    let stdinFlushQueued = false;
+    const stdinListeners = Object.create(null);
+    const stdinOnceListeners = Object.create(null);
+    const emitStdinListeners = (event, value) => {
+        const listeners = [
+            ...(stdinListeners[event] ?? []),
+            ...(stdinOnceListeners[event] ?? []),
+        ];
+        stdinOnceListeners[event] = [];
+        for (const listener of listeners) {
+            listener(value);
+        }
+        return listeners.length > 0;
+    };
+    const clearStdinListeners = () => {
+        for (const key of Object.keys(stdinListeners)) {
+            stdinListeners[key] = [];
+        }
+        for (const key of Object.keys(stdinOnceListeners)) {
+            stdinOnceListeners[key] = [];
+        }
+    };
+    const flushStdin = () => {
+        stdinFlushQueued = false;
+        if (stdin.paused || stdinEnded) {
+            return;
+        }
+        if (stdinPosition < stdinData.length) {
+            const chunk = stdinData.slice(stdinPosition);
+            stdinPosition = stdinData.length;
+            emitStdinListeners("data", toProcessChunk(chunk, stdin.encoding));
+        }
+        if (!stdinEnded) {
+            stdinEnded = true;
+            emitStdinListeners("end");
+            emitStdinListeners("close");
+        }
+    };
+    const scheduleStdinFlush = () => {
+        if (stdinFlushQueued) {
+            return;
+        }
+        stdinFlushQueued = true;
+        queueMicrotask(flushStdin);
+    };
+    const stdin = {
+        readable: true,
+        paused: true,
+        encoding: null,
+        isRaw: false,
+        read(size) {
+            if (stdinPosition >= stdinData.length) {
+                return null;
+            }
+            const chunk = size
+                ? stdinData.slice(stdinPosition, stdinPosition + size)
+                : stdinData.slice(stdinPosition);
+            stdinPosition += chunk.length;
+            return toProcessChunk(chunk, stdin.encoding);
+        },
+        on(event, listener) {
+            if (!stdinListeners[event]) {
+                stdinListeners[event] = [];
+            }
+            stdinListeners[event].push(listener);
+            if (event === "data" && stdin.paused) {
+                stdin.resume();
+            }
+            return stdin;
+        },
+        once(event, listener) {
+            if (!stdinOnceListeners[event]) {
+                stdinOnceListeners[event] = [];
+            }
+            stdinOnceListeners[event].push(listener);
+            if (event === "data" && stdin.paused) {
+                stdin.resume();
+            }
+            return stdin;
+        },
+        off(event, listener) {
+            if (!stdinListeners[event]) {
+                return stdin;
+            }
+            stdinListeners[event] = stdinListeners[event].filter((candidate) => candidate !== listener);
+            return stdin;
+        },
+        removeListener(event, listener) {
+            return stdin.off(event, listener);
+        },
+        emit(event, value) {
+            return emitStdinListeners(event, value);
+        },
+        pause() {
+            stdin.paused = true;
+            return stdin;
+        },
+        resume() {
+            stdin.paused = false;
+            scheduleStdinFlush();
+            return stdin;
+        },
+        setEncoding(encoding) {
+            stdin.encoding = encoding;
+            return stdin;
+        },
+        setRawMode(mode) {
+            stdin.isRaw = mode;
+            return stdin;
+        },
+        get isTTY() {
+            return false;
+        },
+        async *[Symbol.asyncIterator]() {
+            const remaining = stdinData.slice(stdinPosition);
+            for (const line of remaining.split("\n")) {
+                if (line.length > 0) {
+                    yield line;
+                }
+            }
+        },
+    };
+    const processBridge = {
+        browser: true,
+        env: {},
+        argv: ["node"],
+        argv0: "node",
+        pid: 1,
+        ppid: 0,
+        platform: "browser",
+        version: "v22.0.0",
+        versions: {
+            node: "22.0.0",
+        },
+        stdin,
+        stdout: {
+            isTTY: false,
+            write(chunk) {
+                return emitProcessStdio("stdout", chunk);
+            },
+        },
+        stderr: {
+            isTTY: false,
+            write(chunk) {
+                return emitProcessStdio("stderr", chunk);
+            },
+        },
+        exitCode: 0,
+        cwd: () => cwd,
+        chdir: (nextCwd) => {
+            cwd = String(nextCwd);
+        },
+        nextTick: (callback, ...args) => {
+            queueMicrotask(() => callback(...args));
+        },
+        exit(code) {
+            const exitCode = typeof code === "number" ? code : (processBridge.exitCode ?? 0);
+            processBridge.exitCode = exitCode;
+            throw new Error(`process.exit(${exitCode})`);
+        },
+        on() {
+            return processBridge;
+        },
+        once() {
+            return processBridge;
+        },
+        off() {
+            return processBridge;
+        },
+        removeListener() {
+            return processBridge;
+        },
+        emit() {
+            return false;
+        },
+        __secureExecRefreshProcess(nextConfig) {
+            clearStdinListeners();
+            stdinData = typeof nextConfig?.stdin === "string" ? nextConfig.stdin : "";
+            stdinPosition = 0;
+            stdinEnded = false;
+            stdinFlushQueued = false;
+            stdin.paused = true;
+            stdin.encoding = null;
+            stdin.isRaw = false;
+            processBridge.exitCode = 0;
+            processBridge.env =
+                nextConfig?.env && typeof nextConfig.env === "object"
+                    ? { ...nextConfig.env }
+                    : {};
+            if (typeof nextConfig?.cwd === "string") {
+                cwd = nextConfig.cwd;
+            }
+            processBridge.argv = Array.isArray(nextConfig?.argv)
+                ? nextConfig.argv.map((value) => String(value))
+                : ["node"];
+            processBridge.argv0 = processBridge.argv[0] ?? "node";
+            if (typeof nextConfig?.platform === "string") {
+                processBridge.platform = nextConfig.platform;
+            }
+            if (typeof nextConfig?.version === "string") {
+                processBridge.version = nextConfig.version;
+                processBridge.versions.node = nextConfig.version.replace(/^v/, "");
+            }
+            if (typeof nextConfig?.pid === "number") {
+                processBridge.pid = nextConfig.pid;
+            }
+            if (typeof nextConfig?.ppid === "number") {
+                processBridge.ppid = nextConfig.ppid;
+            }
+        },
+    };
+    return processBridge;
+}
+function getRuntimeProcess() {
+    const proc = globalThis.process;
+    if (!proc || typeof proc !== "object") {
+        return undefined;
+    }
+    return proc;
+}
+function refreshRuntimeProcess() {
+    const proc = getRuntimeProcess();
+    const refresh = proc?.__secureExecRefreshProcess;
+    if (typeof refresh === "function") {
+        refresh(runtimeProcessConfig);
+    }
+}
+function ensureProcessGlobal() {
+    if (getRuntimeProcess()) {
+        refreshRuntimeProcess();
+        return;
+    }
+    exposeMutableRuntimeStateGlobal("process", createBrowserProcess());
+    refreshRuntimeProcess();
+}
+function captureConsole(requestId, captureStdio) {
+    const original = console;
+    if (!captureStdio) {
+        const sandboxConsole = {
+            log: () => undefined,
+            info: () => undefined,
+            warn: () => undefined,
+            error: () => undefined,
+        };
+        globalThis.console = sandboxConsole;
+        return {
+            restore: () => {
+                globalThis.console = original;
+            },
+        };
+    }
+    const sandboxConsole = {
+        log: (...args) => emitStdio(requestId, "stdout", args),
+        info: (...args) => emitStdio(requestId, "stdout", args),
+        warn: (...args) => emitStdio(requestId, "stderr", args),
+        error: (...args) => emitStdio(requestId, "stderr", args),
+    };
+    globalThis.console = sandboxConsole;
+    return {
+        restore: () => {
+            globalThis.console = original;
+        },
+    };
+}
+function updateProcessConfig(options, timingMitigation, frozenTimeMs) {
+    if (runtimeProcessConfig) {
+        runtimeProcessConfig.timingMitigation = timingMitigation;
+        if (frozenTimeMs === undefined) {
+            delete runtimeProcessConfig.frozenTimeMs;
+        }
+        else {
+            runtimeProcessConfig.frozenTimeMs = frozenTimeMs;
+        }
+        runtimeProcessConfig.stdin = options?.stdin ?? "";
+        if (options?.env) {
+            const filtered = filterEnv(options.env, permissions);
+            const currentEnv = runtimeProcessConfig.env && typeof runtimeProcessConfig.env === "object"
+                ? runtimeProcessConfig.env
+                : {};
+            runtimeProcessConfig.env = { ...currentEnv, ...filtered };
+        }
+    }
+    refreshRuntimeProcess();
+    const proc = getRuntimeProcess();
+    if (!proc)
+        return;
+    proc.exitCode = 0;
+    proc.timingMitigation = timingMitigation;
+    if (frozenTimeMs === undefined) {
+        delete proc.frozenTimeMs;
+    }
+    else {
+        proc.frozenTimeMs = frozenTimeMs;
+    }
+    if (options?.cwd && typeof proc.chdir === "function") {
+        exposeMutableRuntimeStateGlobal("__runtimeProcessCwdOverride", options.cwd);
+        globalEval(getIsolateRuntimeSource("overrideProcessCwd"));
+        try {
+            proc.chdir(options.cwd);
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                error.message.includes("process.chdir() is not supported in workers"))) {
+                throw error;
+            }
+        }
+    }
+}
+/**
+ * Execute user code as a script (process-style). Transforms ESM/dynamic
+ * imports, sets up module/exports globals, and waits for active handles.
+ */
+async function execScript(requestId, code, options, captureStdio = false) {
+    resetModuleState(options?.cwd ?? "/");
+    const timingMitigation = options?.timingMitigation ?? runtimeTimingMitigation;
+    const frozenTimeMs = applyTimingMitigation(timingMitigation);
+    updateProcessConfig(options, timingMitigation, frozenTimeMs);
+    setDynamicImportFallback();
+    const previousProcessRequestId = activeProcessRequestId;
+    activeProcessRequestId = captureStdio ? requestId : null;
+    const { restore } = captureConsole(requestId, captureStdio);
+    try {
+        let transformed = code;
+        if (isESM(code, options?.filePath)) {
+            transformed = transform(transformed, { transforms: ["imports"] }).code;
+        }
+        transformed = transformDynamicImport(transformed);
+        exposeMutableRuntimeStateGlobal("module", { exports: {} });
+        const moduleRef = globalThis.module;
+        exposeMutableRuntimeStateGlobal("exports", moduleRef.exports);
+        if (options?.filePath) {
+            const dirname = options.filePath.includes("/")
+                ? options.filePath.substring(0, options.filePath.lastIndexOf("/")) ||
+                    "/"
+                : "/";
+            exposeMutableRuntimeStateGlobal("__filename", options.filePath);
+            exposeMutableRuntimeStateGlobal("__dirname", dirname);
+            exposeMutableRuntimeStateGlobal("_currentModule", {
+                dirname,
+                filename: options.filePath,
+            });
+        }
+        // Await the eval result so async IIFEs / top-level promise expressions
+        // resolve before we check for active handles.
+        const evalResult = globalEval(transformed);
+        if (evalResult &&
+            typeof evalResult === "object" &&
+            typeof evalResult.then === "function") {
+            await evalResult;
+        }
+        await Promise.resolve();
+        const waitForActiveHandles = globalThis
+            ._waitForActiveHandles;
+        if (typeof waitForActiveHandles === "function") {
+            await waitForActiveHandles();
+        }
+        const exitCode = globalThis.process
+            ?.exitCode ?? 0;
+        return {
+            code: exitCode,
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const exitMatch = message.match(/process\.exit\((\d+)\)/);
+        if (exitMatch) {
+            const exitCode = Number.parseInt(exitMatch[1], 10);
+            return {
+                code: exitCode,
+            };
+        }
+        return {
+            code: 1,
+            errorMessage: boundErrorMessage(message),
+        };
+    }
+    finally {
+        activeProcessRequestId = previousProcessRequestId;
+        restore();
+    }
+}
+async function runScript(requestId, code, filePath, captureStdio = false) {
+    const execResult = await execScript(requestId, code, { filePath }, captureStdio);
+    const moduleObj = globalThis.module;
+    return {
+        ...execResult,
+        exports: moduleObj?.exports,
+    };
+}
+self.onmessage = async (event) => {
+    const message = event.data;
+    try {
+        if (message.type === "init") {
+            if (typeof message.controlToken !== "string" ||
+                message.controlToken.length === 0) {
+                return;
+            }
+            if (controlToken && message.controlToken !== controlToken) {
+                return;
+            }
+            controlToken = message.controlToken;
+            await initRuntime(message.payload);
+            postResponse({
+                type: "response",
+                id: message.id,
+                ok: true,
+                result: true,
+            });
+            return;
+        }
+        if (!controlToken || message.controlToken !== controlToken) {
+            return;
+        }
+        if (!initialized) {
+            throw new Error("Sandbox worker not initialized");
+        }
+        if (message.type === "exec") {
+            const result = await execScript(message.id, message.payload.code, message.payload.options, message.payload.captureStdio);
+            postResponse({ type: "response", id: message.id, ok: true, result });
+            return;
+        }
+        if (message.type === "run") {
+            const result = await runScript(message.id, message.payload.code, message.payload.filePath, message.payload.captureStdio);
+            postResponse({ type: "response", id: message.id, ok: true, result });
+            return;
+        }
+        if (message.type === "extension") {
+            const error = new Error(`Browser worker extension dispatch is not implemented for namespace ${message.payload.namespace}`);
+            error.code = "ERR_SECURE_EXEC_BROWSER_EXTENSION_UNSUPPORTED";
+            throw error;
+        }
+        if (message.type === "dispose") {
+            postResponse({
+                type: "response",
+                id: message.id,
+                ok: true,
+                result: true,
+            });
+            close();
+        }
+    }
+    catch (err) {
+        const error = err;
+        postResponse({
+            type: "response",
+            id: message.id,
+            ok: false,
+            error: {
+                message: error?.message ?? String(err),
+                stack: error?.stack,
+                code: error?.code,
+            },
+        });
+    }
+};