@secure-exec/nodejs 0.2.0-rc.1

package/dist/module-access.js

@@ -0,0 +1,606 @@
+import * as fs from "node:fs/promises";
+import * as fsSync from "node:fs";
+import path from "node:path";
+import { createEaccesError } from "@secure-exec/core/internal/shared/errors";
+import { O_TRUNC } from "@secure-exec/core";
+const MODULE_ACCESS_INVALID_CONFIG = "ERR_MODULE_ACCESS_INVALID_CONFIG";
+const MODULE_ACCESS_OUT_OF_SCOPE = "ERR_MODULE_ACCESS_OUT_OF_SCOPE";
+const MODULE_ACCESS_NATIVE_ADDON = "ERR_MODULE_ACCESS_NATIVE_ADDON";
+const SANDBOX_APP_ROOT = "/root";
+const SANDBOX_NODE_MODULES_ROOT = `${SANDBOX_APP_ROOT}/node_modules`;
+const VIRTUAL_DIR_MODE = 0o040755;
+function toVirtualPath(value) {
+    if (!value || value === ".")
+        return "/";
+    const normalized = path.posix.normalize(value.startsWith("/") ? value : `/${value}`);
+    if (normalized.length > 1 && normalized.endsWith("/")) {
+        return normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function isWithinPath(candidate, parent) {
+    const relative = path.relative(parent, candidate);
+    return (relative === "" ||
+        (!relative.startsWith("..") && !path.isAbsolute(relative)));
+}
+function startsWithPath(value, prefix) {
+    return value === prefix || value.startsWith(`${prefix}/`);
+}
+function createEnoentError(syscall, targetPath) {
+    const error = new Error(`ENOENT: no such file or directory, ${syscall} '${targetPath}'`);
+    error.code = "ENOENT";
+    error.path = targetPath;
+    error.syscall = syscall;
+    return error;
+}
+function createModuleAccessError(code, message) {
+    const error = new Error(`${code}: ${message}`);
+    error.code = code;
+    return error;
+}
+function createVirtualDirStat() {
+    const now = Date.now();
+    return {
+        mode: VIRTUAL_DIR_MODE,
+        size: 4096,
+        isDirectory: true,
+        isSymbolicLink: false,
+        atimeMs: now,
+        mtimeMs: now,
+        ctimeMs: now,
+        birthtimeMs: now,
+        ino: 0,
+        nlink: 2,
+        uid: 0,
+        gid: 0,
+    };
+}
+function normalizeOverlayPath(pathValue) {
+    return toVirtualPath(pathValue);
+}
+function isNativeAddonPath(pathValue) {
+    return pathValue.endsWith(".node");
+}
+/**
+ * Walk the host node_modules directory and its pnpm virtual-store, resolving
+ * symlink targets to build the full set of allowed host paths. This prevents
+ * symlink-based escapes from the overlay projection.
+ */
+function collectOverlayAllowedRoots(hostNodeModulesRoot) {
+    const roots = new Set([hostNodeModulesRoot]);
+    const symlinkScanRoots = [hostNodeModulesRoot, path.join(hostNodeModulesRoot, ".pnpm", "node_modules")];
+    const addSymlinkTarget = (entryPath) => {
+        try {
+            const target = fsSync.realpathSync(entryPath);
+            roots.add(target);
+        }
+        catch {
+            // Ignore broken symlinks.
+        }
+    };
+    const scanDirForSymlinks = (scanRoot) => {
+        let entries = [];
+        try {
+            entries = fsSync.readdirSync(scanRoot, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const entryPath = path.join(scanRoot, entry.name);
+            if (entry.isSymbolicLink()) {
+                addSymlinkTarget(entryPath);
+                continue;
+            }
+            if (entry.isDirectory() && entry.name.startsWith("@")) {
+                let scopedEntries = [];
+                try {
+                    scopedEntries = fsSync.readdirSync(entryPath, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const scopedEntry of scopedEntries) {
+                    if (!scopedEntry.isSymbolicLink())
+                        continue;
+                    addSymlinkTarget(path.join(entryPath, scopedEntry.name));
+                }
+            }
+        }
+    };
+    for (const scanRoot of symlinkScanRoots) {
+        scanDirForSymlinks(scanRoot);
+    }
+    return [...roots];
+}
+/**
+ * Union filesystem that overlays host `node_modules` (read-only) onto a base
+ * VFS. Sandbox code sees `/root/node_modules/...` which maps to the host's
+ * real `<cwd>/node_modules/...`. Write operations to the overlay throw EACCES.
+ * Symlinks are resolved and validated against the allowed-roots allowlist to
+ * prevent path-traversal escapes. Native `.node` addons are rejected.
+ */
+export class ModuleAccessFileSystem {
+    baseFileSystem;
+    hostNodeModulesRoot;
+    overlayAllowedRoots;
+    constructor(baseFileSystem, options) {
+        this.baseFileSystem = baseFileSystem;
+        const cwdInput = options.cwd ?? process.cwd();
+        if (options.cwd !== undefined && !path.isAbsolute(options.cwd)) {
+            throw createModuleAccessError(MODULE_ACCESS_INVALID_CONFIG, `moduleAccess.cwd must be an absolute path, got '${options.cwd}'`);
+        }
+        const cwd = path.resolve(cwdInput);
+        const nodeModulesPath = path.join(cwd, "node_modules");
+        try {
+            this.hostNodeModulesRoot = fsSync.realpathSync(nodeModulesPath);
+            this.overlayAllowedRoots = collectOverlayAllowedRoots(this.hostNodeModulesRoot);
+        }
+        catch {
+            this.hostNodeModulesRoot = null;
+            this.overlayAllowedRoots = [];
+        }
+    }
+    isWithinAllowedOverlayRoots(canonicalPath) {
+        return this.overlayAllowedRoots.some((root) => isWithinPath(canonicalPath, root));
+    }
+    isSyntheticPath(virtualPath) {
+        if (virtualPath === "/" || virtualPath === SANDBOX_APP_ROOT) {
+            return true;
+        }
+        if (virtualPath === SANDBOX_NODE_MODULES_ROOT) {
+            return this.hostNodeModulesRoot !== null;
+        }
+        return false;
+    }
+    syntheticChildren(pathValue) {
+        const entries = new Map();
+        if (pathValue === "/") {
+            entries.set("app", true);
+        }
+        if (pathValue === SANDBOX_APP_ROOT && this.hostNodeModulesRoot !== null) {
+            entries.set("node_modules", true);
+        }
+        return entries;
+    }
+    isReadOnlyProjectionPath(virtualPath) {
+        return startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT);
+    }
+    shouldMergeBase(pathValue) {
+        return (pathValue === "/" ||
+            pathValue === SANDBOX_APP_ROOT ||
+            !startsWithPath(pathValue, SANDBOX_NODE_MODULES_ROOT));
+    }
+    overlayHostPathFor(virtualPath) {
+        if (!startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            return null;
+        }
+        if (!this.hostNodeModulesRoot) {
+            return null;
+        }
+        if (virtualPath === SANDBOX_NODE_MODULES_ROOT) {
+            return this.hostNodeModulesRoot;
+        }
+        const relative = path.posix
+            .relative(SANDBOX_NODE_MODULES_ROOT, virtualPath)
+            .replace(/^\/+/, "");
+        if (!relative) {
+            return this.hostNodeModulesRoot;
+        }
+        return path.join(this.hostNodeModulesRoot, ...relative.split("/"));
+    }
+    prepareOpenSync(pathValue, flags) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError((flags & O_TRUNC) !== 0 ? "truncate" : "write", virtualPath);
+        }
+        const syncBase = this.baseFileSystem;
+        return syncBase?.prepareOpenSync?.(virtualPath, flags) ?? false;
+    }
+    /** Translate a sandbox path to the corresponding host path (for sync module resolution). */
+    toHostPath(sandboxPath) {
+        return this.overlayHostPathFor(normalizeOverlayPath(sandboxPath));
+    }
+    /** Translate a host path back to the sandbox path (reverse of toHostPath). */
+    toSandboxPath(hostPath) {
+        if (this.hostNodeModulesRoot && isWithinPath(hostPath, this.hostNodeModulesRoot)) {
+            const relative = path.relative(this.hostNodeModulesRoot, hostPath);
+            return path.posix.join(SANDBOX_NODE_MODULES_ROOT, ...relative.split(path.sep));
+        }
+        return hostPath;
+    }
+    async resolveOverlayHostPath(virtualPath, syscall) {
+        if (isNativeAddonPath(virtualPath)) {
+            throw createModuleAccessError(MODULE_ACCESS_NATIVE_ADDON, `native addon '${virtualPath}' is not supported for module overlay`);
+        }
+        const hostPath = this.overlayHostPathFor(virtualPath);
+        if (!hostPath) {
+            return null;
+        }
+        try {
+            const canonical = await fs.realpath(hostPath);
+            if (!this.hostNodeModulesRoot ||
+                !this.isWithinAllowedOverlayRoots(canonical)) {
+                throw createModuleAccessError(MODULE_ACCESS_OUT_OF_SCOPE, `resolved path for '${virtualPath}' escapes allowed overlay roots`);
+            }
+            if (isNativeAddonPath(canonical)) {
+                throw createModuleAccessError(MODULE_ACCESS_NATIVE_ADDON, `native addon '${virtualPath}' is not supported for module overlay`);
+            }
+            return canonical;
+        }
+        catch (error) {
+            const err = error;
+            if (err?.code === "ENOENT") {
+                return null;
+            }
+            if (err?.code === MODULE_ACCESS_OUT_OF_SCOPE) {
+                throw err;
+            }
+            if (err?.code === MODULE_ACCESS_NATIVE_ADDON) {
+                throw err;
+            }
+            if (err?.code === "EACCES") {
+                throw createEaccesError(syscall, virtualPath);
+            }
+            throw err;
+        }
+    }
+    async readMergedDir(pathValue) {
+        const entries = this.syntheticChildren(pathValue);
+        const overlayHostPath = await this.resolveOverlayHostPath(pathValue, "scandir");
+        if (overlayHostPath) {
+            const hostEntries = await fs.readdir(overlayHostPath, { withFileTypes: true });
+            for (const entry of hostEntries) {
+                entries.set(entry.name, entry.isDirectory());
+            }
+        }
+        if (this.baseFileSystem && this.shouldMergeBase(pathValue)) {
+            try {
+                const baseEntries = await this.baseFileSystem.readDirWithTypes(pathValue);
+                for (const entry of baseEntries) {
+                    if (!entries.has(entry.name)) {
+                        entries.set(entry.name, entry.isDirectory);
+                    }
+                }
+            }
+            catch {
+                // Ignore base fs misses for synthetic and overlay-facing reads.
+            }
+        }
+        if (entries.size === 0 && !this.isSyntheticPath(pathValue)) {
+            throw createEnoentError("scandir", pathValue);
+        }
+        return entries;
+    }
+    async fallbackReadFile(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("open", pathValue);
+        }
+        return this.baseFileSystem.readFile(pathValue);
+    }
+    async fallbackReadTextFile(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("open", pathValue);
+        }
+        return this.baseFileSystem.readTextFile(pathValue);
+    }
+    async fallbackReadDir(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("scandir", pathValue);
+        }
+        return this.baseFileSystem.readDir(pathValue);
+    }
+    async fallbackReadDirWithTypes(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("scandir", pathValue);
+        }
+        return this.baseFileSystem.readDirWithTypes(pathValue);
+    }
+    async fallbackWriteFile(pathValue, content) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("write", pathValue);
+        }
+        return this.baseFileSystem.writeFile(pathValue, content);
+    }
+    async fallbackCreateDir(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("mkdir", pathValue);
+        }
+        return this.baseFileSystem.createDir(pathValue);
+    }
+    async fallbackMkdir(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("mkdir", pathValue);
+        }
+        return this.baseFileSystem.mkdir(pathValue);
+    }
+    async fallbackExists(pathValue) {
+        if (!this.baseFileSystem) {
+            return false;
+        }
+        return this.baseFileSystem.exists(pathValue);
+    }
+    async fallbackStat(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("stat", pathValue);
+        }
+        return this.baseFileSystem.stat(pathValue);
+    }
+    async fallbackRemoveFile(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("unlink", pathValue);
+        }
+        return this.baseFileSystem.removeFile(pathValue);
+    }
+    async fallbackRemoveDir(pathValue) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("rmdir", pathValue);
+        }
+        return this.baseFileSystem.removeDir(pathValue);
+    }
+    async fallbackRename(oldPath, newPath) {
+        if (!this.baseFileSystem) {
+            throw createEnoentError("rename", `${oldPath} -> ${newPath}`);
+        }
+        return this.baseFileSystem.rename(oldPath, newPath);
+    }
+    async readFile(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "open");
+        if (hostPath) {
+            return fs.readFile(hostPath);
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("open", virtualPath);
+        }
+        return this.fallbackReadFile(virtualPath);
+    }
+    async readTextFile(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "open");
+        if (hostPath) {
+            return fs.readFile(hostPath, "utf8");
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("open", virtualPath);
+        }
+        return this.fallbackReadTextFile(virtualPath);
+    }
+    async readDir(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isSyntheticPath(virtualPath) ||
+            startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            const entries = await this.readMergedDir(virtualPath);
+            return Array.from(entries.keys()).sort((left, right) => left.localeCompare(right));
+        }
+        return this.fallbackReadDir(virtualPath);
+    }
+    async readDirWithTypes(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isSyntheticPath(virtualPath) ||
+            startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            const entries = await this.readMergedDir(virtualPath);
+            return Array.from(entries.entries())
+                .map(([name, isDirectory]) => ({ name, isDirectory }))
+                .sort((left, right) => left.name.localeCompare(right.name));
+        }
+        return this.fallbackReadDirWithTypes(virtualPath);
+    }
+    async writeFile(pathValue, content) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("write", virtualPath);
+        }
+        return this.fallbackWriteFile(virtualPath, content);
+    }
+    async createDir(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("mkdir", virtualPath);
+        }
+        return this.fallbackCreateDir(virtualPath);
+    }
+    async mkdir(pathValue, _options) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("mkdir", virtualPath);
+        }
+        return this.fallbackMkdir(virtualPath);
+    }
+    async exists(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isSyntheticPath(virtualPath)) {
+            return true;
+        }
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "access");
+        if (hostPath) {
+            return true;
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            return false;
+        }
+        return this.fallbackExists(virtualPath);
+    }
+    async stat(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isSyntheticPath(virtualPath)) {
+            const hostPath = await this.resolveOverlayHostPath(virtualPath, "stat");
+            if (!hostPath) {
+                return createVirtualDirStat();
+            }
+        }
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "stat");
+        if (hostPath) {
+            const info = await fs.stat(hostPath);
+            return {
+                mode: info.mode,
+                size: info.size,
+                isDirectory: info.isDirectory(),
+                isSymbolicLink: false,
+                atimeMs: info.atimeMs,
+                mtimeMs: info.mtimeMs,
+                ctimeMs: info.ctimeMs,
+                birthtimeMs: info.birthtimeMs,
+                ino: info.ino,
+                nlink: info.nlink,
+                uid: info.uid,
+                gid: info.gid,
+            };
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("stat", virtualPath);
+        }
+        return this.fallbackStat(virtualPath);
+    }
+    async removeFile(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("unlink", virtualPath);
+        }
+        return this.fallbackRemoveFile(virtualPath);
+    }
+    async removeDir(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("rmdir", virtualPath);
+        }
+        return this.fallbackRemoveDir(virtualPath);
+    }
+    async rename(oldPath, newPath) {
+        const oldVirtualPath = normalizeOverlayPath(oldPath);
+        const newVirtualPath = normalizeOverlayPath(newPath);
+        if (this.isReadOnlyProjectionPath(oldVirtualPath) ||
+            this.isReadOnlyProjectionPath(newVirtualPath)) {
+            throw createEaccesError("rename", `${oldVirtualPath} -> ${newVirtualPath}`);
+        }
+        return this.fallbackRename(oldVirtualPath, newVirtualPath);
+    }
+    async symlink(target, linkPath) {
+        const virtualPath = normalizeOverlayPath(linkPath);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("symlink", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("symlink", virtualPath);
+        return this.baseFileSystem.symlink(target, virtualPath);
+    }
+    async readlink(path) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (!this.baseFileSystem)
+            throw createEnoentError("readlink", virtualPath);
+        return this.baseFileSystem.readlink(virtualPath);
+    }
+    async lstat(path) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (this.isSyntheticPath(virtualPath)) {
+            return createVirtualDirStat();
+        }
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "lstat");
+        if (hostPath) {
+            const info = await fs.lstat(hostPath);
+            return {
+                mode: info.mode,
+                size: info.size,
+                isDirectory: info.isDirectory(),
+                isSymbolicLink: info.isSymbolicLink(),
+                atimeMs: info.atimeMs,
+                mtimeMs: info.mtimeMs,
+                ctimeMs: info.ctimeMs,
+                birthtimeMs: info.birthtimeMs,
+                ino: info.ino,
+                nlink: info.nlink,
+                uid: info.uid,
+                gid: info.gid,
+            };
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("lstat", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("lstat", virtualPath);
+        return this.baseFileSystem.lstat(virtualPath);
+    }
+    async link(oldPath, newPath) {
+        const oldVirtualPath = normalizeOverlayPath(oldPath);
+        const newVirtualPath = normalizeOverlayPath(newPath);
+        if (this.isReadOnlyProjectionPath(newVirtualPath)) {
+            throw createEaccesError("link", newVirtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("link", oldVirtualPath);
+        return this.baseFileSystem.link(oldVirtualPath, newVirtualPath);
+    }
+    async chmod(path, mode) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("chmod", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("chmod", virtualPath);
+        return this.baseFileSystem.chmod(virtualPath, mode);
+    }
+    async chown(path, uid, gid) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("chown", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("chown", virtualPath);
+        return this.baseFileSystem.chown(virtualPath, uid, gid);
+    }
+    async utimes(path, atime, mtime) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("utimes", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("utimes", virtualPath);
+        return this.baseFileSystem.utimes(virtualPath, atime, mtime);
+    }
+    async truncate(path, length) {
+        const virtualPath = normalizeOverlayPath(path);
+        if (this.isReadOnlyProjectionPath(virtualPath)) {
+            throw createEaccesError("truncate", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("truncate", virtualPath);
+        return this.baseFileSystem.truncate(virtualPath, length);
+    }
+    async realpath(pathValue) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        if (this.isSyntheticPath(virtualPath)) {
+            return virtualPath;
+        }
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "realpath");
+        if (hostPath) {
+            return virtualPath;
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("realpath", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("realpath", virtualPath);
+        return this.baseFileSystem.realpath(virtualPath);
+    }
+    async pread(pathValue, offset, length) {
+        const virtualPath = normalizeOverlayPath(pathValue);
+        const hostPath = await this.resolveOverlayHostPath(virtualPath, "open");
+        if (hostPath) {
+            const handle = await fs.open(hostPath, "r");
+            try {
+                const buf = new Uint8Array(length);
+                const { bytesRead } = await handle.read(buf, 0, length, offset);
+                return buf.slice(0, bytesRead);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        if (startsWithPath(virtualPath, SANDBOX_NODE_MODULES_ROOT)) {
+            throw createEnoentError("open", virtualPath);
+        }
+        if (!this.baseFileSystem)
+            throw createEnoentError("open", virtualPath);
+        return this.baseFileSystem.pread(virtualPath, offset, length);
+    }
+}

package/dist/module-resolver.d.ts

@@ -0,0 +1,8 @@
+import type { DriverDeps } from "./isolate-bootstrap.js";
+type ResolverDeps = Pick<DriverDeps, "filesystem" | "packageTypeCache" | "moduleFormatCache" | "isolateJsonPayloadLimitBytes" | "resolutionCache">;
+export declare function getNearestPackageType(deps: ResolverDeps, filePath: string): Promise<"module" | "commonjs" | null>;
+export declare function getModuleFormat(deps: ResolverDeps, filePath: string, sourceCode?: string): Promise<"esm" | "cjs" | "json">;
+export declare function shouldRunAsESM(deps: ResolverDeps, code: string, filePath?: string): Promise<boolean>;
+export declare function resolveReferrerDirectory(deps: Pick<DriverDeps, "filesystem">, referrerPath: string): Promise<string>;
+export declare function resolveESMPath(deps: Pick<DriverDeps, "filesystem" | "resolutionCache">, specifier: string, referrerPath: string): Promise<string | null>;
+export {};