@secure-exec/core 0.1.1-rc.2 → 0.1.1-rc.3

package/dist/bridge.js

@@ -5961,6 +5961,21 @@ var bridge = (() => {
       classification: "hardened",
       rationale: "Host-to-sandbox HTTP server dispatch entrypoint."
     },
+    {
+      name: "_httpServerUpgradeDispatch",
+      classification: "hardened",
+      rationale: "Host-to-sandbox HTTP server upgrade dispatch entrypoint."
+    },
+    {
+      name: "_upgradeSocketData",
+      classification: "hardened",
+      rationale: "Host-to-sandbox upgrade socket data push entrypoint."
+    },
+    {
+      name: "_upgradeSocketEnd",
+      classification: "hardened",
+      rationale: "Host-to-sandbox upgrade socket end push entrypoint."
+    },
     {
       name: "ProcessExitError",
       classification: "hardened",
@@ -6006,6 +6021,71 @@ var bridge = (() => {
       classification: "hardened",
       rationale: "Host entropy bridge reference for crypto.randomUUID."
     },
+    {
+      name: "_cryptoHashDigest",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for createHash digest computation."
+    },
+    {
+      name: "_cryptoHmacDigest",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for createHmac digest computation."
+    },
+    {
+      name: "_cryptoPbkdf2",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for pbkdf2 key derivation."
+    },
+    {
+      name: "_cryptoScrypt",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for scrypt key derivation."
+    },
+    {
+      name: "_cryptoCipheriv",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for createCipheriv encryption."
+    },
+    {
+      name: "_cryptoDecipheriv",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for createDecipheriv decryption."
+    },
+    {
+      name: "_cryptoCipherivCreate",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for stateful cipher/decipher creation."
+    },
+    {
+      name: "_cryptoCipherivUpdate",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for stateful cipher/decipher update."
+    },
+    {
+      name: "_cryptoCipherivFinal",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for stateful cipher/decipher final."
+    },
+    {
+      name: "_cryptoSign",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for sign operations."
+    },
+    {
+      name: "_cryptoVerify",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for verify operations."
+    },
+    {
+      name: "_cryptoGenerateKeyPairSync",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for generateKeyPairSync."
+    },
+    {
+      name: "_cryptoSubtle",
+      classification: "hardened",
+      rationale: "Host crypto bridge reference for Web Crypto subtle operations."
+    },
     {
       name: "_fsReadFile",
       classification: "hardened",
@@ -6156,6 +6236,21 @@ var bridge = (() => {
       classification: "hardened",
       rationale: "Host network bridge reference."
     },
+    {
+      name: "_upgradeSocketWriteRaw",
+      classification: "hardened",
+      rationale: "Host upgrade socket write bridge reference."
+    },
+    {
+      name: "_upgradeSocketEndRaw",
+      classification: "hardened",
+      rationale: "Host upgrade socket end bridge reference."
+    },
+    {
+      name: "_upgradeSocketDestroyRaw",
+      classification: "hardened",
+      rationale: "Host upgrade socket destroy bridge reference."
+    },
     {
       name: "_ptySetRawMode",
       classification: "hardened",
@@ -7145,11 +7240,11 @@ var bridge = (() => {
       const encoding = typeof options === "string" ? options : options?.encoding;
       try {
         if (encoding) {
-          const content = _fs.readFile(pathStr);
+          const content = _fs.readFile.applySyncPromise(void 0, [pathStr]);
           return content;
         } else {
-          const binaryData = _fs.readFileBinary(pathStr);
-          return import_buffer.Buffer.from(binaryData);
+          const base64Content = _fs.readFileBinary.applySyncPromise(void 0, [pathStr]);
+          return import_buffer.Buffer.from(base64Content, "base64");
         }
       } catch (err) {
         const errMsg = err.message || String(err);
@@ -7177,12 +7272,13 @@ var bridge = (() => {
       if (!rawPath) throw createFsError("EBADF", "EBADF: bad file descriptor", "write");
       const pathStr = rawPath;
       if (typeof data === "string") {
-        return _fs.writeFile(pathStr, data);
+        return _fs.writeFile.applySyncPromise(void 0, [pathStr, data]);
       } else if (ArrayBuffer.isView(data)) {
         const uint8 = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-        return _fs.writeFileBinary(pathStr, uint8);
+        const base64 = import_buffer.Buffer.from(uint8).toString("base64");
+        return _fs.writeFileBinary.applySyncPromise(void 0, [pathStr, base64]);
       } else {
-        return _fs.writeFile(pathStr, String(data));
+        return _fs.writeFile.applySyncPromise(void 0, [pathStr, String(data)]);
       }
     },
     appendFileSync(path, data, options) {
@@ -7193,9 +7289,9 @@ var bridge = (() => {
     readdirSync(path, options) {
       const rawPath = toPathString(path);
       const pathStr = rawPath;
-      let entries;
+      let entriesJson;
       try {
-        entries = _fs.readDir(pathStr);
+        entriesJson = _fs.readDir.applySyncPromise(void 0, [pathStr]);
       } catch (err) {
         const errMsg = err.message || String(err);
         if (errMsg.includes("entry not found") || errMsg.includes("not found")) {
@@ -7208,6 +7304,7 @@ var bridge = (() => {
         }
         throw err;
       }
+      const entries = JSON.parse(entriesJson);
       if (options?.withFileTypes) {
         return entries.map((e) => new Dirent(e.name, e.isDirectory, rawPath));
       }
@@ -7217,12 +7314,12 @@ var bridge = (() => {
       const rawPath = toPathString(path);
       const pathStr = rawPath;
       const recursive = typeof options === "object" ? options?.recursive ?? false : false;
-      _fs.mkdir(pathStr, recursive);
+      _fs.mkdir.applySyncPromise(void 0, [pathStr, recursive]);
       return recursive ? rawPath : void 0;
     },
     rmdirSync(path, _options) {
       const pathStr = toPathString(path);
-      _fs.rmdir(pathStr);
+      _fs.rmdir.applySyncPromise(void 0, [pathStr]);
     },
     rmSync(path, options) {
       const pathStr = toPathString(path);
@@ -7257,14 +7354,14 @@ var bridge = (() => {
     },
     existsSync(path) {
       const pathStr = toPathString(path);
-      return _fs.exists(pathStr);
+      return _fs.exists.applySyncPromise(void 0, [pathStr]);
     },
     statSync(path, _options) {
       const rawPath = toPathString(path);
       const pathStr = rawPath;
-      let stat;
+      let statJson;
       try {
-        stat = _fs.stat(pathStr);
+        statJson = _fs.stat.applySyncPromise(void 0, [pathStr]);
       } catch (err) {
         const errMsg = err.message || String(err);
         if (errMsg.includes("entry not found") || errMsg.includes("not found") || errMsg.includes("ENOENT") || errMsg.includes("no such file or directory")) {
@@ -7277,21 +7374,23 @@ var bridge = (() => {
         }
         throw err;
       }
+      const stat = JSON.parse(statJson);
       return new Stats(stat);
     },
     lstatSync(path, _options) {
       const pathStr = toPathString(path);
-      const stat = bridgeCall(() => _fs.lstat(pathStr), "lstat", pathStr);
+      const statJson = bridgeCall(() => _fs.lstat.applySyncPromise(void 0, [pathStr]), "lstat", pathStr);
+      const stat = JSON.parse(statJson);
       return new Stats(stat);
     },
     unlinkSync(path) {
       const pathStr = toPathString(path);
-      _fs.unlink(pathStr);
+      _fs.unlink.applySyncPromise(void 0, [pathStr]);
     },
     renameSync(oldPath, newPath) {
       const oldPathStr = toPathString(oldPath);
       const newPathStr = toPathString(newPath);
-      _fs.rename(oldPathStr, newPathStr);
+      _fs.rename.applySyncPromise(void 0, [oldPathStr, newPathStr]);
     },
     copyFileSync(src, dest, _mode) {
       const content = fs.readFileSync(src);
@@ -7549,35 +7648,35 @@ var bridge = (() => {
     chmodSync(path, mode) {
       const pathStr = toPathString(path);
       const modeNum = typeof mode === "string" ? parseInt(mode, 8) : mode;
-      bridgeCall(() => _fs.chmod(pathStr, modeNum), "chmod", pathStr);
+      bridgeCall(() => _fs.chmod.applySyncPromise(void 0, [pathStr, modeNum]), "chmod", pathStr);
     },
     chownSync(path, uid, gid) {
       const pathStr = toPathString(path);
-      bridgeCall(() => _fs.chown(pathStr, uid, gid), "chown", pathStr);
+      bridgeCall(() => _fs.chown.applySyncPromise(void 0, [pathStr, uid, gid]), "chown", pathStr);
     },
     linkSync(existingPath, newPath) {
       const existingStr = toPathString(existingPath);
       const newStr = toPathString(newPath);
-      bridgeCall(() => _fs.link(existingStr, newStr), "link", newStr);
+      bridgeCall(() => _fs.link.applySyncPromise(void 0, [existingStr, newStr]), "link", newStr);
     },
     symlinkSync(target, path, _type) {
       const targetStr = toPathString(target);
       const pathStr = toPathString(path);
-      bridgeCall(() => _fs.symlink(targetStr, pathStr), "symlink", pathStr);
+      bridgeCall(() => _fs.symlink.applySyncPromise(void 0, [targetStr, pathStr]), "symlink", pathStr);
     },
     readlinkSync(path, _options) {
       const pathStr = toPathString(path);
-      return bridgeCall(() => _fs.readlink(pathStr), "readlink", pathStr);
+      return bridgeCall(() => _fs.readlink.applySyncPromise(void 0, [pathStr]), "readlink", pathStr);
     },
     truncateSync(path, len) {
       const pathStr = toPathString(path);
-      bridgeCall(() => _fs.truncate(pathStr, len ?? 0), "truncate", pathStr);
+      bridgeCall(() => _fs.truncate.applySyncPromise(void 0, [pathStr, len ?? 0]), "truncate", pathStr);
     },
     utimesSync(path, atime, mtime) {
       const pathStr = toPathString(path);
       const atimeNum = typeof atime === "number" ? atime : new Date(atime).getTime() / 1e3;
       const mtimeNum = typeof mtime === "number" ? mtime : new Date(mtime).getTime() / 1e3;
-      bridgeCall(() => _fs.utimes(pathStr, atimeNum, mtimeNum), "utimes", pathStr);
+      bridgeCall(() => _fs.utimes.applySyncPromise(void 0, [pathStr, atimeNum, mtimeNum]), "utimes", pathStr);
     },
     // Async methods - wrap sync methods in callbacks/promises
     //
@@ -8958,11 +9057,12 @@ var bridge = (() => {
       throw new Error("child_process.execSync requires CommandExecutor to be configured");
     }
     const maxBuffer = opts.maxBuffer ?? 1024 * 1024;
-    const result = _childProcessSpawnSync(
+    const jsonResult = _childProcessSpawnSync.applySyncPromise(void 0, [
       "bash",
       JSON.stringify(["-c", command]),
       JSON.stringify({ cwd: opts.cwd, env: opts.env, maxBuffer })
-    );
+    ]);
+    const result = JSON.parse(jsonResult);
     if (result.maxBufferExceeded) {
       const err = new Error("stdout maxBuffer length exceeded");
       err.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
@@ -8997,11 +9097,11 @@ var bridge = (() => {
     child.spawnargs = [command, ...argsArray];
     if (typeof _childProcessSpawnStart !== "undefined") {
       const effectiveCwd = opts.cwd ?? (typeof process !== "undefined" ? process.cwd() : "/");
-      const sessionId = _childProcessSpawnStart(
+      const sessionId = _childProcessSpawnStart.applySync(void 0, [
         command,
         JSON.stringify(argsArray),
         JSON.stringify({ cwd: effectiveCwd, env: opts.env })
-      );
+      ]);
       activeChildren.set(sessionId, child);
       if (typeof _registerHandle === "function") {
         _registerHandle(`child:${sessionId}`, `child_process: ${command} ${argsArray.join(" ")}`);
@@ -9009,19 +9109,19 @@ var bridge = (() => {
       child.stdin.write = (data) => {
         if (typeof _childProcessStdinWrite === "undefined") return false;
         const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
-        _childProcessStdinWrite(sessionId, bytes);
+        _childProcessStdinWrite.applySync(void 0, [sessionId, bytes]);
         return true;
       };
       child.stdin.end = () => {
         if (typeof _childProcessStdinClose !== "undefined") {
-          _childProcessStdinClose(sessionId);
+          _childProcessStdinClose.applySync(void 0, [sessionId]);
         }
         child.stdin.writable = false;
       };
       child.kill = (signal) => {
         if (typeof _childProcessKill === "undefined") return false;
         const sig = signal === "SIGKILL" || signal === 9 ? 9 : signal === "SIGINT" || signal === 2 ? 2 : 15;
-        _childProcessKill(sessionId, sig);
+        _childProcessKill.applySync(void 0, [sessionId, sig]);
         child.killed = true;
         child.signalCode = typeof signal === "string" ? signal : "SIGTERM";
         return true;
@@ -9060,11 +9160,12 @@ var bridge = (() => {
     try {
       const effectiveCwd = opts.cwd ?? (typeof process !== "undefined" ? process.cwd() : "/");
       const maxBuffer = opts.maxBuffer;
-      const result = _childProcessSpawnSync(
+      const jsonResult = _childProcessSpawnSync.applySyncPromise(void 0, [
         command,
         JSON.stringify(argsArray),
         JSON.stringify({ cwd: effectiveCwd, env: opts.env, maxBuffer })
-      );
+      ]);
+      const result = JSON.parse(jsonResult);
       const stdoutBuf = typeof Buffer !== "undefined" ? Buffer.from(result.stdout) : result.stdout;
       const stderrBuf = typeof Buffer !== "undefined" ? Buffer.from(result.stderr) : result.stderr;
       if (result.maxBufferExceeded) {
@@ -9225,26 +9326,43 @@ var bridge = (() => {
     fetch: () => fetch,
     http: () => http,
     http2: () => http2,
-    https: () => https
+    https: () => https,
+    net: () => net,
+    tlsModule: () => tlsModule
   });
   var MAX_HTTP_BODY_BYTES = 50 * 1024 * 1024;
-  async function fetch(url, options = {}) {
+  async function fetch(input, options = {}) {
     if (typeof _networkFetchRaw === "undefined") {
       console.error("fetch requires NetworkAdapter to be configured");
       throw new Error("fetch requires NetworkAdapter to be configured");
     }
+    let resolvedUrl;
+    if (input instanceof Request) {
+      resolvedUrl = input.url;
+      options = {
+        method: input.method,
+        headers: Object.fromEntries(input.headers.entries()),
+        body: input.body,
+        ...options
+      };
+    } else {
+      resolvedUrl = String(input);
+    }
     const optionsJson = JSON.stringify({
       method: options.method || "GET",
       headers: options.headers || {},
       body: options.body || null
     });
-    const response = await _networkFetchRaw(String(url), optionsJson);
+    const responseJson = await _networkFetchRaw.apply(void 0, [resolvedUrl, optionsJson], {
+      result: { promise: true }
+    });
+    const response = JSON.parse(responseJson);
     return {
       ok: response.ok,
       status: response.status,
       statusText: response.statusText,
       headers: new Map(Object.entries(response.headers || {})),
-      url: response.url || String(url),
+      url: response.url || resolvedUrl,
       redirected: response.redirected || false,
       type: "basic",
       async text() {
@@ -9377,7 +9495,8 @@ var bridge = (() => {
       if (typeof options === "function") {
         cb = options;
       }
-      _networkDnsLookupRaw(hostname).then((result) => {
+      _networkDnsLookupRaw.apply(void 0, [hostname], { result: { promise: true } }).then((resultJson) => {
+        const result = JSON.parse(resultJson);
         if (result.error) {
           const err = new Error(result.error);
           err.code = result.code || "ENOTFOUND";
@@ -9754,12 +9873,23 @@ var bridge = (() => {
           body: this._body || null,
           ...tls
         });
-        const response = await _networkHttpRequestRaw(url, optionsJson);
+        const responseJson = await _networkHttpRequestRaw.apply(void 0, [url, optionsJson], {
+          result: { promise: true }
+        });
+        const response = JSON.parse(responseJson);
         this.finished = true;
         if (response.status === 101) {
           const res2 = new IncomingMessage(response);
-          const head = typeof Buffer !== "undefined" ? Buffer.alloc(0) : new Uint8Array(0);
-          this._emit("upgrade", res2, this.socket, head);
+          let socket = this.socket;
+          if (response.upgradeSocketId != null) {
+            socket = new UpgradeSocket(response.upgradeSocketId, {
+              host: this._options.hostname,
+              port: Number(this._options.port) || 80
+            });
+            upgradeSocketInstances.set(response.upgradeSocketId, socket);
+          }
+          const head = typeof Buffer !== "undefined" ? response.body ? Buffer.from(response.body, "base64") : Buffer.alloc(0) : new Uint8Array(0);
+          this._emit("upgrade", res2, socket, head);
           return;
         }
         const res = new IncomingMessage(response);
@@ -9966,6 +10096,7 @@ var bridge = (() => {
   };
   var nextServerId = 1;
   var serverRequestListeners = /* @__PURE__ */ new Map();
+  var serverInstances = /* @__PURE__ */ new Map();
   var ServerIncomingMessage = class {
     headers;
     rawHeaders;
@@ -10275,7 +10406,9 @@ var bridge = (() => {
       } else {
         serverRequestListeners.set(this._serverId, () => void 0);
       }
+      serverInstances.set(this._serverId, this);
     }
+    /** @internal Emit an event — used by upgrade dispatch to fire 'upgrade' events. */
     _emit(event, ...args) {
       const listeners = this._listeners[event];
       if (!listeners || listeners.length === 0) return;
@@ -10287,9 +10420,12 @@ var bridge = (() => {
           "http.createServer requires NetworkAdapter.httpServerListen support"
         );
       }
-      const result = await _networkHttpServerListenRaw(
-        JSON.stringify({ serverId: this._serverId, port, hostname })
+      const resultJson = await _networkHttpServerListenRaw.apply(
+        void 0,
+        [JSON.stringify({ serverId: this._serverId, port, hostname })],
+        { result: { promise: true } }
       );
+      const result = JSON.parse(resultJson);
       this._address = result.address;
       this.listening = true;
       this._handleId = `http-server:${this._serverId}`;
@@ -10318,10 +10454,13 @@ var bridge = (() => {
             await this._listenPromise;
           }
           if (this.listening && typeof _networkHttpServerCloseRaw !== "undefined") {
-            await _networkHttpServerCloseRaw(this._serverId);
+            await _networkHttpServerCloseRaw.apply(void 0, [this._serverId], {
+              result: { promise: true }
+            });
           }
           this.listening = false;
           this._address = null;
+          serverInstances.delete(this._serverId);
           if (this._handleId && typeof _unregisterHandle === "function") {
             _unregisterHandle(this._handleId);
           }
@@ -10387,11 +10526,12 @@ var bridge = (() => {
       return this;
     }
   };
-  async function dispatchServerRequest(serverId, request) {
+  async function dispatchServerRequest(serverId, requestJson) {
     const listener = serverRequestListeners.get(serverId);
     if (!listener) {
       throw new Error(`Unknown HTTP server: ${serverId}`);
     }
+    const request = JSON.parse(requestJson);
     const incoming = new ServerIncomingMessage(request);
     const outgoing = new ServerResponseBridge();
     try {
@@ -10413,7 +10553,183 @@ var bridge = (() => {
       outgoing.end();
     }
     await outgoing.waitForClose();
-    return outgoing.serialize();
+    return JSON.stringify(outgoing.serialize());
+  }
+  var upgradeSocketInstances = /* @__PURE__ */ new Map();
+  var UpgradeSocket = class {
+    remoteAddress;
+    remotePort;
+    localAddress = "127.0.0.1";
+    localPort = 0;
+    connecting = false;
+    destroyed = false;
+    writable = true;
+    readable = true;
+    readyState = "open";
+    bytesWritten = 0;
+    _listeners = {};
+    _socketId;
+    // Readable stream state stub for ws compatibility (socketOnClose checks _readableState.endEmitted)
+    _readableState = { endEmitted: false };
+    _writableState = { finished: false, errorEmitted: false };
+    constructor(socketId, options) {
+      this._socketId = socketId;
+      this.remoteAddress = options?.host || "127.0.0.1";
+      this.remotePort = options?.port || 80;
+    }
+    setTimeout(_ms, _cb) {
+      return this;
+    }
+    setNoDelay(_noDelay) {
+      return this;
+    }
+    setKeepAlive(_enable, _delay) {
+      return this;
+    }
+    ref() {
+      return this;
+    }
+    unref() {
+      return this;
+    }
+    cork() {
+    }
+    uncork() {
+    }
+    pause() {
+      return this;
+    }
+    resume() {
+      return this;
+    }
+    address() {
+      return { address: this.localAddress, family: "IPv4", port: this.localPort };
+    }
+    on(event, listener) {
+      if (!this._listeners[event]) this._listeners[event] = [];
+      this._listeners[event].push(listener);
+      return this;
+    }
+    addListener(event, listener) {
+      return this.on(event, listener);
+    }
+    once(event, listener) {
+      const wrapper = (...args) => {
+        this.off(event, wrapper);
+        listener(...args);
+      };
+      return this.on(event, wrapper);
+    }
+    off(event, listener) {
+      if (this._listeners[event]) {
+        const idx = this._listeners[event].indexOf(listener);
+        if (idx !== -1) this._listeners[event].splice(idx, 1);
+      }
+      return this;
+    }
+    removeListener(event, listener) {
+      return this.off(event, listener);
+    }
+    removeAllListeners(event) {
+      if (event) {
+        delete this._listeners[event];
+      } else {
+        this._listeners = {};
+      }
+      return this;
+    }
+    emit(event, ...args) {
+      const handlers = this._listeners[event];
+      if (handlers) handlers.slice().forEach((fn) => fn.call(this, ...args));
+      return handlers !== void 0 && handlers.length > 0;
+    }
+    listenerCount(event) {
+      return this._listeners[event]?.length || 0;
+    }
+    write(data, encodingOrCb, cb) {
+      if (this.destroyed) return false;
+      const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+      if (typeof _upgradeSocketWriteRaw !== "undefined") {
+        let base64;
+        if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) {
+          base64 = data.toString("base64");
+        } else if (typeof data === "string") {
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(data);
+        } else if (data instanceof Uint8Array) {
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(String.fromCharCode(...data));
+        } else {
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(String(data)).toString("base64") : btoa(String(data));
+        }
+        this.bytesWritten += base64.length;
+        _upgradeSocketWriteRaw.applySync(void 0, [this._socketId, base64]);
+      }
+      if (callback) callback();
+      return true;
+    }
+    end(data) {
+      if (data) this.write(data);
+      if (typeof _upgradeSocketEndRaw !== "undefined" && !this.destroyed) {
+        _upgradeSocketEndRaw.applySync(void 0, [this._socketId]);
+      }
+      this.writable = false;
+      this.emit("finish");
+      return this;
+    }
+    destroy(err) {
+      if (this.destroyed) return this;
+      this.destroyed = true;
+      this.writable = false;
+      this.readable = false;
+      this._readableState.endEmitted = true;
+      this._writableState.finished = true;
+      if (typeof _upgradeSocketDestroyRaw !== "undefined") {
+        _upgradeSocketDestroyRaw.applySync(void 0, [this._socketId]);
+      }
+      upgradeSocketInstances.delete(this._socketId);
+      if (err) this.emit("error", err);
+      this.emit("close", false);
+      return this;
+    }
+    // Push data received from the host into this socket
+    _pushData(data) {
+      this.emit("data", data);
+    }
+    // Signal end-of-stream from the host
+    _pushEnd() {
+      this.readable = false;
+      this._readableState.endEmitted = true;
+      this._writableState.finished = true;
+      this.emit("end");
+      this.emit("close", false);
+      upgradeSocketInstances.delete(this._socketId);
+    }
+  };
+  function dispatchUpgradeRequest(serverId, requestJson, headBase64, socketId) {
+    const server = serverInstances.get(serverId);
+    if (!server) {
+      throw new Error(`Unknown HTTP server for upgrade: ${serverId}`);
+    }
+    const request = JSON.parse(requestJson);
+    const incoming = new ServerIncomingMessage(request);
+    const head = typeof Buffer !== "undefined" ? Buffer.from(headBase64, "base64") : new Uint8Array(0);
+    const socket = new UpgradeSocket(socketId, {
+      host: incoming.headers["host"]?.split(":")[0] || "127.0.0.1"
+    });
+    upgradeSocketInstances.set(socketId, socket);
+    server._emit("upgrade", incoming, socket, head);
+  }
+  function onUpgradeSocketData(socketId, dataBase64) {
+    const socket = upgradeSocketInstances.get(socketId);
+    if (socket) {
+      const data = typeof Buffer !== "undefined" ? Buffer.from(dataBase64, "base64") : new Uint8Array(0);
+      socket._pushData(data);
+    }
+  }
+  function onUpgradeSocketEnd(socketId) {
+    const socket = upgradeSocketInstances.get(socketId);
+    if (socket) {
+      socket._pushEnd();
+    }
   }
   function ServerResponseCallable() {
     this.statusCode = 200;
@@ -10555,11 +10871,396 @@ var bridge = (() => {
       throw new Error("http2.createSecureServer is not supported in sandbox");
     }
   };
+  var netSocketInstances = /* @__PURE__ */ new Map();
+  var NetSocket = class {
+    remoteAddress = "";
+    remotePort = 0;
+    remoteFamily = "";
+    localAddress = "0.0.0.0";
+    localPort = 0;
+    connecting = true;
+    pending = true;
+    destroyed = false;
+    writable = true;
+    readable = true;
+    readyState = "opening";
+    bytesRead = 0;
+    bytesWritten = 0;
+    _listeners = {};
+    /** @internal socket ID shared with TLS upgrade bridge */
+    _socketId = -1;
+    _connectHost = "";
+    _connectPort = 0;
+    // Stream state stubs for compatibility (ssh2 checks _readableState.ended)
+    _readableState = { endEmitted: false, ended: false };
+    _writableState = { finished: false, errorEmitted: false, ended: false };
+    constructor(_options) {
+    }
+    connect(...args) {
+      let port;
+      let host;
+      let connectListener;
+      if (typeof args[0] === "object" && args[0] !== null) {
+        const opts = args[0];
+        port = Number(opts.port);
+        host = String(opts.host || "127.0.0.1");
+        if (typeof args[1] === "function") connectListener = args[1];
+      } else {
+        port = Number(args[0]);
+        host = typeof args[1] === "string" ? args[1] : "127.0.0.1";
+        if (typeof args[1] === "function") {
+          connectListener = args[1];
+          host = "127.0.0.1";
+        } else if (typeof args[2] === "function") {
+          connectListener = args[2];
+        }
+      }
+      this._connectHost = host;
+      this._connectPort = port;
+      if (connectListener) this.once("connect", connectListener);
+      if (typeof _netSocketConnectRaw === "undefined") {
+        Promise.resolve().then(() => {
+          const err = new Error("net.Socket requires NetworkAdapter to be configured");
+          this._onError(err.message);
+        });
+        return this;
+      }
+      if (typeof _registerHandle !== "undefined") {
+        _registerHandle(`net.socket:${host}:${port}`, `TCP connection to ${host}:${port}`);
+      }
+      this._socketId = _netSocketConnectRaw.applySync(void 0, [host, port]);
+      netSocketInstances.set(this._socketId, this);
+      return this;
+    }
+    setTimeout(_ms, _cb) {
+      return this;
+    }
+    setNoDelay(_noDelay) {
+      return this;
+    }
+    setKeepAlive(_enable, _delay) {
+      return this;
+    }
+    setMaxListeners(_n) {
+      return this;
+    }
+    getMaxListeners() {
+      return 10;
+    }
+    ref() {
+      return this;
+    }
+    unref() {
+      return this;
+    }
+    cork() {
+    }
+    uncork() {
+    }
+    pause() {
+      return this;
+    }
+    resume() {
+      return this;
+    }
+    pipe(destination) {
+      return destination;
+    }
+    address() {
+      return { address: this.localAddress, family: "IPv4", port: this.localPort };
+    }
+    listeners(event) {
+      return (this._listeners[event] || []).slice();
+    }
+    rawListeners(event) {
+      return this.listeners(event);
+    }
+    eventNames() {
+      return Object.keys(this._listeners).filter((k) => (this._listeners[k]?.length ?? 0) > 0);
+    }
+    prependListener(event, listener) {
+      if (!this._listeners[event]) this._listeners[event] = [];
+      this._listeners[event].unshift(listener);
+      return this;
+    }
+    prependOnceListener(event, listener) {
+      const wrapper = (...args) => {
+        this.off(event, wrapper);
+        listener(...args);
+      };
+      return this.prependListener(event, wrapper);
+    }
+    on(event, listener) {
+      if (!this._listeners[event]) this._listeners[event] = [];
+      this._listeners[event].push(listener);
+      return this;
+    }
+    addListener(event, listener) {
+      return this.on(event, listener);
+    }
+    once(event, listener) {
+      const wrapper = (...args) => {
+        this.off(event, wrapper);
+        listener(...args);
+      };
+      return this.on(event, wrapper);
+    }
+    off(event, listener) {
+      if (this._listeners[event]) {
+        const idx = this._listeners[event].indexOf(listener);
+        if (idx !== -1) this._listeners[event].splice(idx, 1);
+      }
+      return this;
+    }
+    removeListener(event, listener) {
+      return this.off(event, listener);
+    }
+    removeAllListeners(event) {
+      if (event) {
+        delete this._listeners[event];
+      } else {
+        this._listeners = {};
+      }
+      return this;
+    }
+    emit(event, ...args) {
+      const handlers = this._listeners[event];
+      if (handlers) handlers.slice().forEach((fn) => fn.call(this, ...args));
+      return handlers !== void 0 && handlers.length > 0;
+    }
+    listenerCount(event) {
+      return this._listeners[event]?.length || 0;
+    }
+    write(data, encodingOrCb, cb) {
+      if (this.destroyed) return false;
+      const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+      if (typeof _netSocketWriteRaw !== "undefined" && this._socketId >= 0) {
+        let base64;
+        if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) {
+          base64 = data.toString("base64");
+        } else if (typeof data === "string") {
+          const encoding = typeof encodingOrCb === "string" ? encodingOrCb : "utf8";
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(data, encoding).toString("base64") : btoa(data);
+        } else if (data instanceof Uint8Array) {
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(String.fromCharCode(...data));
+        } else {
+          base64 = typeof Buffer !== "undefined" ? Buffer.from(String(data)).toString("base64") : btoa(String(data));
+        }
+        this.bytesWritten += base64.length;
+        _netSocketWriteRaw.applySync(void 0, [this._socketId, base64]);
+      }
+      if (callback) callback();
+      return true;
+    }
+    end(data, encodingOrCb, cb) {
+      if (data !== void 0 && data !== null) this.write(data, encodingOrCb, cb);
+      if (typeof _netSocketEndRaw !== "undefined" && this._socketId >= 0 && !this.destroyed) {
+        _netSocketEndRaw.applySync(void 0, [this._socketId]);
+      }
+      this.writable = false;
+      this.readyState = this.readable ? "readOnly" : "closed";
+      this.emit("finish");
+      return this;
+    }
+    destroy(err) {
+      if (this.destroyed) return this;
+      this.destroyed = true;
+      this.writable = false;
+      this.readable = false;
+      this.readyState = "closed";
+      this._readableState.endEmitted = true;
+      this._writableState.finished = true;
+      if (typeof _netSocketDestroyRaw !== "undefined" && this._socketId >= 0) {
+        _netSocketDestroyRaw.applySync(void 0, [this._socketId]);
+      }
+      this._cleanup();
+      if (err) this.emit("error", err);
+      this.emit("close", !!err);
+      return this;
+    }
+    // Host→Guest event dispatch handlers
+    _onConnect() {
+      this.connecting = false;
+      this.pending = false;
+      this.remoteAddress = this._connectHost;
+      this.remotePort = this._connectPort;
+      this.remoteFamily = "IPv4";
+      this.readyState = "open";
+      this.emit("connect");
+      this.emit("ready");
+    }
+    _onData(dataBase64) {
+      const buf = typeof Buffer !== "undefined" ? Buffer.from(dataBase64, "base64") : new Uint8Array(0);
+      this.bytesRead += buf.length;
+      this.emit("data", buf);
+    }
+    _onEnd() {
+      this.readable = false;
+      this._readableState.endEmitted = true;
+      this._readableState.ended = true;
+      this.readyState = this.writable ? "writeOnly" : "closed";
+      this.emit("end");
+    }
+    _onError(message) {
+      const err = new Error(message);
+      this.destroy(err);
+    }
+    _onClose(hadError) {
+      this._cleanup();
+      if (!this.destroyed) {
+        this.destroyed = true;
+        this.readable = false;
+        this.writable = false;
+        this.readyState = "closed";
+        this.emit("close", hadError);
+      }
+    }
+    _cleanup() {
+      if (this._socketId >= 0) {
+        netSocketInstances.delete(this._socketId);
+        if (typeof _unregisterHandle !== "undefined") {
+          _unregisterHandle(`net.socket:${this._connectHost}:${this._connectPort}`);
+        }
+      }
+    }
+  };
+  function onNetSocketDispatch(socketId, type, data) {
+    const socket = netSocketInstances.get(socketId);
+    if (!socket) return;
+    switch (type) {
+      case "connect":
+        socket._onConnect();
+        break;
+      case "data":
+        socket._onData(data);
+        break;
+      case "end":
+        socket._onEnd();
+        break;
+      case "error":
+        socket._onError(data);
+        break;
+      case "close":
+        socket._onClose(data === "1");
+        break;
+      case "secureConnect":
+        socket.emit("secureConnect");
+        break;
+    }
+  }
+  function netIsIP(input) {
+    if (typeof input !== "string") return 0;
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(input)) {
+      const parts = input.split(".");
+      if (parts.every((p) => {
+        const n = Number(p);
+        return n >= 0 && n <= 255;
+      })) return 4;
+    }
+    if (/^(::)?([0-9a-fA-F]{1,4}(::?)){0,7}([0-9a-fA-F]{1,4})?$/.test(input)) return 6;
+    if (/^::ffff:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(input)) return 6;
+    return 0;
+  }
+  var net = {
+    Socket: NetSocket,
+    connect(portOrOpts, hostOrCb, cb) {
+      const socket = new NetSocket();
+      socket.connect(portOrOpts, hostOrCb, cb);
+      return socket;
+    },
+    createConnection(portOrOpts, hostOrCb, cb) {
+      return net.connect(portOrOpts, hostOrCb, cb);
+    },
+    createServer() {
+      throw new Error("net.createServer is not supported in sandbox");
+    },
+    isIP: netIsIP,
+    isIPv4(input) {
+      return netIsIP(input) === 4;
+    },
+    isIPv6(input) {
+      return netIsIP(input) === 6;
+    }
+  };
+  var TLSSocket = class extends NetSocket {
+    encrypted = true;
+    authorized = false;
+    authorizationError = null;
+    alpnProtocol = false;
+    _wrappedSocket = null;
+    constructor(originalSocket) {
+      super();
+      this._wrappedSocket = originalSocket;
+      this.remoteAddress = originalSocket.remoteAddress;
+      this.remotePort = originalSocket.remotePort;
+      this.remoteFamily = originalSocket.remoteFamily;
+      this.localAddress = originalSocket.localAddress;
+      this.localPort = originalSocket.localPort;
+      this.connecting = false;
+      this.pending = false;
+      this.readyState = "open";
+      this._socketId = originalSocket._socketId;
+      this._connectHost = originalSocket._connectHost;
+      this._connectPort = originalSocket._connectPort;
+      netSocketInstances.set(this._socketId, this);
+    }
+    _onSecureConnect() {
+      this.authorized = true;
+      this.emit("secureConnect");
+    }
+    // Forward end/close to the wrapped raw socket — Node.js tls.TLSSocket
+    // closes the underlying socket, which fires its 'close' event. Libraries
+    // like pg rely on the original socket's 'close' listener to detect shutdown.
+    _onEnd() {
+      super._onEnd();
+      if (this._wrappedSocket) this._wrappedSocket._onEnd();
+    }
+    _onClose(hadError) {
+      super._onClose(hadError);
+      if (this._wrappedSocket) {
+        this._wrappedSocket._onClose(hadError);
+        this._wrappedSocket = null;
+      }
+    }
+  };
+  var tlsModule = {
+    TLSSocket,
+    connect(options) {
+      const existingSocket = options.socket;
+      if (!existingSocket || existingSocket._socketId < 0) {
+        throw new Error("tls.connect requires an existing connected socket via options.socket");
+      }
+      const tlsSocket = new TLSSocket(existingSocket);
+      if (typeof _netSocketUpgradeTlsRaw === "undefined") {
+        Promise.resolve().then(() => {
+          tlsSocket._onError("tls.connect requires NetworkAdapter TLS support");
+        });
+        return tlsSocket;
+      }
+      _netSocketUpgradeTlsRaw.applySync(void 0, [
+        existingSocket._socketId,
+        JSON.stringify({
+          rejectUnauthorized: options.rejectUnauthorized ?? true,
+          servername: options.servername
+        })
+      ]);
+      return tlsSocket;
+    },
+    createSecureContext(_options) {
+      return {};
+    }
+  };
   exposeCustomGlobal("_httpModule", http);
   exposeCustomGlobal("_httpsModule", https);
   exposeCustomGlobal("_http2Module", http2);
   exposeCustomGlobal("_dnsModule", dns);
+  exposeCustomGlobal("_netModule", net);
+  exposeCustomGlobal("_tlsModule", tlsModule);
   exposeCustomGlobal("_httpServerDispatch", dispatchServerRequest);
+  exposeCustomGlobal("_httpServerUpgradeDispatch", dispatchUpgradeRequest);
+  exposeCustomGlobal("_upgradeSocketData", onUpgradeSocketData);
+  exposeCustomGlobal("_upgradeSocketEnd", onUpgradeSocketEnd);
+  exposeCustomGlobal("_netSocketDispatch", onNetSocketDispatch);
   exposeCustomGlobal("fetch", fetch);
   exposeCustomGlobal("Headers", Headers);
   exposeCustomGlobal("Request", Request);
@@ -10577,6 +11278,8 @@ var bridge = (() => {
     http,
     https,
     http2,
+    net,
+    tls: tlsModule,
     IncomingMessage,
     ClientRequest
   };
@@ -10630,12 +11333,6 @@ var bridge = (() => {
   }
   var _exitCode = 0;
   var _exited = false;
-  globalThis.__runtimeResetProcessState = function() {
-    _processStartTime = typeof performance !== "undefined" && performance.now ? performance.now() : Date.now();
-    _exitCode = 0;
-    _exited = false;
-    delete globalThis.__runtimeResetProcessState;
-  };
   var ProcessExitError = class extends Error {
     code;
     constructor(code) {
@@ -10700,7 +11397,7 @@ var bridge = (() => {
         _processMaxListenersWarned.add(event);
         const warning = `MaxListenersExceededWarning: Possible EventEmitter memory leak detected. ${total} ${event} listeners added to [process]. MaxListeners is ${_processMaxListeners}. Use emitter.setMaxListeners() to increase limit`;
         if (typeof _error !== "undefined") {
-          _error(warning);
+          _error.applySync(void 0, [warning]);
         }
       }
     }
@@ -10741,7 +11438,7 @@ var bridge = (() => {
   var _stdout = {
     write(data) {
       if (typeof _log !== "undefined") {
-        _log(String(data).replace(/\n$/, ""));
+        _log.applySync(void 0, [String(data).replace(/\n$/, "")]);
       }
       return true;
     },
@@ -10765,7 +11462,7 @@ var bridge = (() => {
   var _stderr = {
     write(data) {
       if (typeof _error !== "undefined") {
-        _error(String(data).replace(/\n$/, ""));
+        _error.applySync(void 0, [String(data).replace(/\n$/, "")]);
       }
       return true;
     },
@@ -10901,7 +11598,7 @@ var bridge = (() => {
         throw new Error("setRawMode is not supported when stdin is not a TTY");
       }
       if (typeof _ptySetRawMode !== "undefined") {
-        _ptySetRawMode(mode);
+        _ptySetRawMode.applySync(void 0, [mode]);
       }
       return this;
     },
@@ -11000,9 +11697,9 @@ var bridge = (() => {
       return _cwd;
     },
     chdir(dir) {
-      let stat;
+      let statJson;
       try {
-        stat = _fs.stat(dir);
+        statJson = _fs.stat.applySyncPromise(void 0, [dir]);
       } catch {
         const err = new Error(`ENOENT: no such file or directory, chdir '${dir}'`);
         err.code = "ENOENT";
@@ -11011,7 +11708,8 @@ var bridge = (() => {
         err.path = dir;
         throw err;
       }
-      if (!stat.isDirectory) {
+      const parsed = JSON.parse(statJson);
+      if (!parsed.isDirectory) {
         const err = new Error(`ENOTDIR: not a directory, chdir '${dir}'`);
         err.code = "ENOTDIR";
         err.errno = -20;
@@ -11266,6 +11964,12 @@ var bridge = (() => {
   process2.memoryUsage.rss = function() {
     return 50 * 1024 * 1024;
   };
+  Object.defineProperty(process2, Symbol.toStringTag, {
+    value: "process",
+    writable: false,
+    configurable: true,
+    enumerable: false
+  });
   var process_default = process2;
   var _timerId = 0;
   var _timers = /* @__PURE__ */ new Map();
@@ -11308,7 +12012,7 @@ var bridge = (() => {
     _timers.set(id, handle);
     const actualDelay = delay ?? 0;
     if (typeof _scheduleTimer !== "undefined" && actualDelay > 0) {
-      _scheduleTimer(actualDelay).then(() => {
+      _scheduleTimer.apply(void 0, [actualDelay], { result: { promise: true } }).then(() => {
         if (_timers.has(id)) {
           _timers.delete(id);
           try {
@@ -11343,7 +12047,7 @@ var bridge = (() => {
     const scheduleNext = () => {
       if (!_intervals.has(id)) return;
       if (typeof _scheduleTimer !== "undefined" && actualDelay > 0) {
-        _scheduleTimer(actualDelay).then(() => {
+        _scheduleTimer.apply(void 0, [actualDelay], { result: { promise: true } }).then(() => {
           if (_intervals.has(id)) {
             try {
               callback(...args);
@@ -11380,6 +12084,22 @@ var bridge = (() => {
   var URL2 = import_whatwg_url.URL;
   var URLSearchParams = import_whatwg_url.URLSearchParams;
   var Buffer3 = import_buffer2.Buffer;
+  var bp = import_buffer2.Buffer.prototype;
+  var sliceEncodings = ["utf8", "ascii", "latin1", "binary", "hex", "base64", "ucs2", "utf16le"];
+  for (const enc of sliceEncodings) {
+    const sliceKey = `${enc}Slice`;
+    if (typeof bp[sliceKey] !== "function") {
+      bp[sliceKey] = function(start, end) {
+        return this.toString(enc, start, end);
+      };
+    }
+    const writeKey = `${enc}Write`;
+    if (typeof bp[writeKey] !== "function") {
+      bp[writeKey] = function(str, offset, length) {
+        return this.write(str, offset, length, enc);
+      };
+    }
+  }
   function throwUnsupportedCryptoApi(api) {
     throw new Error(`crypto.${api} is not supported in sandbox`);
   }
@@ -11399,7 +12119,8 @@ var bridge = (() => {
         array.byteLength
       );
       try {
-        const hostBytes = _cryptoRandomFill(bytes.byteLength);
+        const base64 = _cryptoRandomFill.applySync(void 0, [bytes.byteLength]);
+        const hostBytes = import_buffer2.Buffer.from(base64, "base64");
         if (hostBytes.byteLength !== bytes.byteLength) {
           throw new Error("invalid host entropy size");
         }
@@ -11414,7 +12135,7 @@ var bridge = (() => {
         throwUnsupportedCryptoApi("randomUUID");
       }
       try {
-        const uuid = _cryptoRandomUUID();
+        const uuid = _cryptoRandomUUID.applySync(void 0, []);
         if (typeof uuid !== "string") {
           throw new Error("invalid host uuid");
         }
@@ -11546,7 +12267,10 @@ var bridge = (() => {
       return paths;
     };
     const resolve = function(request, _options) {
-      const resolved = _resolveModule(request, dirname);
+      const resolved = _resolveModule.applySyncPromise(void 0, [
+        request,
+        dirname
+      ]);
       if (resolved === null) {
         const err = new Error("Cannot find module '" + request + "'");
         err.code = "MODULE_NOT_FOUND";
@@ -11613,7 +12337,10 @@ var bridge = (() => {
       );
       const moduleRequire = (request) => _requireFrom(request, this.path);
       moduleRequire.resolve = (request) => {
-        const resolved = _resolveModule(request, this.path);
+        const resolved = _resolveModule.applySyncPromise(void 0, [
+          request,
+          this.path
+        ]);
         if (resolved === null) {
           const err = new Error("Cannot find module '" + request + "'");
           err.code = "MODULE_NOT_FOUND";
@@ -11643,7 +12370,10 @@ var bridge = (() => {
     static _cache = typeof _moduleCache !== "undefined" ? _moduleCache : {};
     static _resolveFilename(request, parent, _isMain, _options) {
       const parentDir = parent && parent.path ? parent.path : "/";
-      const resolved = _resolveModule(request, parentDir);
+      const resolved = _resolveModule.applySyncPromise(void 0, [
+        request,
+        parentDir
+      ]);
       if (resolved === null) {
         const err = new Error("Cannot find module '" + request + "'");
         err.code = "MODULE_NOT_FOUND";