@secure-exec/typescript 0.2.1-rc.1 → 0.3.0-rc.2

package/README.md

@@ -1,7 +1,50 @@
-# Secure Exec
+# @secure-exec/typescript
 
-Secure Node.js execution without a sandbox. V8 isolate-based code execution with full Node.js and npm compatibility.
+Run the TypeScript compiler **inside the secure-exec sandbox**. The compiler is
+projected into the VM and every compile and type-check happens in the guest, so
+untrusted TypeScript never executes (or compiles) on the host.
 
-- [Website](https://secureexec.dev)
-- [Documentation](https://secureexec.dev/docs)
-- [GitHub](https://github.com/rivet-dev/secure-exec)
+## Install
+
+```sh
+npm install @secure-exec/typescript secure-exec
+```
+
+## Usage
+
+```ts
+import { createTypeScriptTools } from "@secure-exec/typescript";
+
+const tools = createTypeScriptTools();
+
+// Compile TypeScript to JavaScript inside the sandbox.
+const compiled = await tools.compileSource({
+  sourceText: "const answer: number = 42;\nconsole.log(answer);",
+  compilerOptions: { module: "ESNext", target: "ES2022" },
+});
+console.log(compiled.outputText);
+
+// Type-check inside the sandbox and get structured diagnostics back.
+const checked = await tools.typecheckSource({
+  sourceText: `const total: number = "not a number";`,
+});
+console.log(checked.success, checked.diagnostics);
+```
+
+## API
+
+`createTypeScriptTools(options?)` returns:
+
+- `compileSource({ sourceText, filePath?, cwd?, configFilePath?, compilerOptions? })`
+  -> `{ success, diagnostics, outputText, sourceMapText }`
+- `typecheckSource({ sourceText, ... })` -> `{ success, diagnostics }`
+- `compileProject({ cwd?, configFilePath? })`
+  -> `{ success, diagnostics, emitSkipped, emittedFiles }`
+- `typecheckProject({ cwd?, configFilePath? })` -> `{ success, diagnostics }`
+
+Each diagnostic is `{ code, category, message, filePath?, line?, column? }`.
+
+Seed extra files into the VM with the `files` option, or project host
+directories with the `mounts` option, to compile whole projects.
+
+See the [documentation](https://secureexec.dev/docs) for details.

package/dist/index.d.ts

@@ -1,5 +1,16 @@
-import type { NodeRuntimeDriverFactory } from "secure-exec";
-import type { SystemDriver } from "@secure-exec/core";
+/**
+ * @secure-exec/typescript — run the TypeScript compiler inside the sandbox.
+ *
+ * The TypeScript compiler (`typescript.js`) is projected into the VM's virtual
+ * filesystem and the compile/type-check program is executed in-guest through
+ * the `secure-exec` `NodeRuntime`. The compiler never runs on the host: every
+ * `createSourceFile`/`createProgram`/`emit` call happens inside the kernel
+ * isolation boundary, over the VM's filesystem.
+ */
+import type { HostDirectoryMount, NodeRuntimeCreateOptions } from "secure-exec";
+/** VM permission policy, as accepted by `NodeRuntime.create`. */
+export type Permissions = NonNullable<NodeRuntimeCreateOptions["permissions"]>;
+/** A single TypeScript diagnostic, normalized for host consumption. */
 export interface TypeScriptDiagnostic {
     code: number;
     category: "error" | "warning" | "suggestion" | "message";
@@ -8,41 +19,79 @@ export interface TypeScriptDiagnostic {
     line?: number;
     column?: number;
 }
+/** Result of a type-check (no emit). */
 export interface TypeCheckResult {
     success: boolean;
     diagnostics: TypeScriptDiagnostic[];
 }
+/** Result of compiling a project (emit to the VM filesystem). */
 export interface ProjectCompileResult extends TypeCheckResult {
     emitSkipped: boolean;
     emittedFiles: string[];
 }
+/** Result of compiling a single source string (emit returned in-memory). */
 export interface SourceCompileResult extends TypeCheckResult {
     outputText?: string;
     sourceMapText?: string;
 }
+/** Options for the project-oriented tools. */
 export interface ProjectCompilerOptions {
+    /** Working directory inside the VM. Defaults to `/root`. */
     cwd?: string;
+    /** Explicit path to a `tsconfig.json` inside the VM. */
     configFilePath?: string;
 }
+/** Options for the single-source tools. */
 export interface SourceCompilerOptions {
+    /** TypeScript source text to compile or type-check. */
     sourceText: string;
+    /** Virtual path the source should appear at. Defaults to a temp `.ts` file. */
     filePath?: string;
+    /** Working directory inside the VM. Defaults to `/root`. */
     cwd?: string;
+    /** Optional `tsconfig.json` whose `compilerOptions` are applied. */
     configFilePath?: string;
+    /** Inline compiler options (esbuild/tsc JSON spelling). */
     compilerOptions?: Record<string, unknown>;
 }
+/** Options for {@link createTypeScriptTools}. */
 export interface TypeScriptToolsOptions {
-    systemDriver: SystemDriver;
-    runtimeDriverFactory: NodeRuntimeDriverFactory;
-    memoryLimit?: number;
-    cpuTimeLimitMs?: number;
-    compilerSpecifier?: string;
+    /**
+     * Host directory of the `typescript` npm package to project into the VM.
+     * Defaults to the `typescript` package resolved from this package. The
+     * directory is mounted (read lazily) into the VM; the compiler never runs
+     * on the host.
+     */
+    compilerPackageDir?: string;
+    /**
+     * Guest path the `typescript` package is mounted at. Defaults to
+     * `/root/node_modules/typescript` so it resolves as the `typescript`
+     * package inside the VM.
+     */
+    compilerGuestDir?: string;
+    /** Extra files to seed into the VM (e.g. a `tsconfig.json` or sources). */
+    files?: Record<string, string | Uint8Array>;
+    /** Extra host directories to project into the VM, Docker-style. */
+    mounts?: HostDirectoryMount[];
+    /** Permission policy forwarded to the VM. */
+    permissions?: Permissions;
+    /** Environment variables visible to the guest compiler. */
+    env?: Record<string, string>;
 }
-type CompilerTools = {
+/** The in-sandbox TypeScript tools returned by {@link createTypeScriptTools}. */
+export interface TypeScriptTools {
+    /** Type-check a `tsconfig.json` project inside the VM. */
     typecheckProject(options?: ProjectCompilerOptions): Promise<TypeCheckResult>;
+    /** Compile a `tsconfig.json` project, emitting into the VM filesystem. */
     compileProject(options?: ProjectCompilerOptions): Promise<ProjectCompileResult>;
+    /** Type-check a single TypeScript source string inside the VM. */
     typecheckSource(options: SourceCompilerOptions): Promise<TypeCheckResult>;
+    /** Compile a single TypeScript source string, returning the emitted JS. */
     compileSource(options: SourceCompilerOptions): Promise<SourceCompileResult>;
-};
-export declare function createTypeScriptTools(options: TypeScriptToolsOptions): CompilerTools;
-export {};
+}
+/**
+ * Create a set of TypeScript tools whose compiler runs entirely inside the
+ * secure-exec sandbox. The compiler bundle is read from the host and projected
+ * into the VM filesystem; all compilation happens in-guest.
+ */
+export declare function createTypeScriptTools(options?: TypeScriptToolsOptions): TypeScriptTools;

package/dist/index.js

@@ -1,58 +1,85 @@
+/**
+ * @secure-exec/typescript — run the TypeScript compiler inside the sandbox.
+ *
+ * The TypeScript compiler (`typescript.js`) is projected into the VM's virtual
+ * filesystem and the compile/type-check program is executed in-guest through
+ * the `secure-exec` `NodeRuntime`. The compiler never runs on the host: every
+ * `createSourceFile`/`createProgram`/`emit` call happens inside the kernel
+ * isolation boundary, over the VM's filesystem.
+ */
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
 import { NodeRuntime } from "secure-exec";
-const DEFAULT_COMPILER_RUNTIME_MEMORY_LIMIT = 512;
-const COMPILER_RUNTIME_FILE_PATH = "/root/__secure_exec_typescript_compiler__.js";
-const DEFAULT_COMPILER_SPECIFIER = "/root/node_modules/typescript/lib/typescript.js";
-export function createTypeScriptTools(options) {
+const DEFAULT_COMPILER_GUEST_DIR = "/root/node_modules/typescript";
+function resolveCompilerPackageDir(explicit) {
+    if (explicit) {
+        return explicit;
+    }
+    const require = createRequire(import.meta.url);
+    // `lib/typescript.js` is the full compiler bundle; its grandparent is the
+    // `typescript` package directory (containing package.json + lib/).
+    return dirname(dirname(require.resolve("typescript/lib/typescript.js")));
+}
+/**
+ * Create a set of TypeScript tools whose compiler runs entirely inside the
+ * secure-exec sandbox. The compiler bundle is read from the host and projected
+ * into the VM filesystem; all compilation happens in-guest.
+ */
+export function createTypeScriptTools(options = {}) {
+    const compilerPackageDir = resolveCompilerPackageDir(options.compilerPackageDir);
+    const compilerGuestDir = options.compilerGuestDir ?? DEFAULT_COMPILER_GUEST_DIR;
+    const compilerGuestPath = `${compilerGuestDir}/lib/typescript.js`;
+    const compilerMount = {
+        guestPath: compilerGuestDir,
+        hostPath: compilerPackageDir,
+        readOnly: true,
+    };
+    const run = (request) => runCompilerRequest(request, compilerGuestPath, options, compilerMount);
     return {
-        typecheckProject: async (requestOptions = {}) => runCompilerRequest(options, {
+        typecheckProject: (requestOptions = {}) => run({
             kind: "typecheckProject",
-            compilerSpecifier: options.compilerSpecifier ?? DEFAULT_COMPILER_SPECIFIER,
             options: requestOptions,
         }),
-        compileProject: async (requestOptions = {}) => runCompilerRequest(options, {
+        compileProject: (requestOptions = {}) => run({
             kind: "compileProject",
-            compilerSpecifier: options.compilerSpecifier ?? DEFAULT_COMPILER_SPECIFIER,
             options: requestOptions,
         }),
-        typecheckSource: async (requestOptions) => runCompilerRequest(options, {
-            kind: "typecheckSource",
-            compilerSpecifier: options.compilerSpecifier ?? DEFAULT_COMPILER_SPECIFIER,
-            options: requestOptions,
-        }),
-        compileSource: async (requestOptions) => runCompilerRequest(options, {
+        typecheckSource: (requestOptions) => run({ kind: "typecheckSource", options: requestOptions }),
+        compileSource: (requestOptions) => run({
             kind: "compileSource",
-            compilerSpecifier: options.compilerSpecifier ?? DEFAULT_COMPILER_SPECIFIER,
             options: requestOptions,
         }),
     };
 }
-async function runCompilerRequest(options, request) {
-    const runtime = new NodeRuntime({
-        systemDriver: options.systemDriver,
-        runtimeDriverFactory: options.runtimeDriverFactory,
-        memoryLimit: options.memoryLimit ?? DEFAULT_COMPILER_RUNTIME_MEMORY_LIMIT,
-        cpuTimeLimitMs: options.cpuTimeLimitMs,
-    });
+async function runCompilerRequest(request, compilerGuestPath, toolsOptions, compilerMount) {
+    const createOptions = {
+        files: toolsOptions.files,
+        mounts: [compilerMount, ...(toolsOptions.mounts ?? [])],
+        permissions: toolsOptions.permissions,
+        env: toolsOptions.env,
+    };
+    const rt = await NodeRuntime.create(createOptions);
     try {
-        const result = await runtime.run(buildCompilerRuntimeSource(request), COMPILER_RUNTIME_FILE_PATH);
-        if (result.code === 0 && result.exports) {
-            return result.exports;
+        const guestSource = buildCompilerGuestSource(request, compilerGuestPath);
+        const result = await rt.run(guestSource);
+        if (result.exitCode === 0 && result.value !== undefined) {
+            return result.value;
         }
-        return createFailureResult(request.kind, result.errorMessage);
+        return createFailureResult(request.kind, result.stderr.trim() || `compiler exited with code ${result.exitCode}`);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         return createFailureResult(request.kind, message);
     }
     finally {
-        runtime.dispose();
+        await rt.dispose();
     }
 }
 function createFailureResult(kind, errorMessage) {
     const diagnostic = {
         code: 0,
         category: "error",
-        message: normalizeCompilerFailureMessage(errorMessage),
+        message: errorMessage || "TypeScript compiler failed",
     };
     if (kind === "compileProject") {
         return {
@@ -62,57 +89,33 @@ function createFailureResult(kind, errorMessage) {
             emittedFiles: [],
         };
     }
-    if (kind === "compileSource") {
-        return {
-            success: false,
-            diagnostics: [diagnostic],
-        };
-    }
-    return {
-        success: false,
-        diagnostics: [diagnostic],
-    };
-}
-function normalizeCompilerFailureMessage(errorMessage) {
-    const message = (errorMessage ?? "TypeScript compiler failed").trim();
-    if (/memory limit/i.test(message)) {
-        return "TypeScript compiler exceeded sandbox memory limit";
-    }
-    if (/cpu time limit exceeded|timed out/i.test(message)) {
-        return "TypeScript compiler exceeded sandbox CPU time limit";
-    }
-    return message;
+    return { success: false, diagnostics: [diagnostic] };
 }
-function buildCompilerRuntimeSource(request) {
-    return `module.exports = (${compilerRuntimeMain.toString()})(${JSON.stringify(request)});`;
+/**
+ * Build the guest ES module that loads the projected compiler and runs the
+ * requested compile/type-check entirely inside the VM, then hands the result
+ * back to the host via `__return`.
+ */
+function buildCompilerGuestSource(request, compilerGuestPath) {
+    return [
+        `import { createRequire } from "node:module";`,
+        `import fs from "node:fs";`,
+        `import path from "node:path";`,
+        `const require = createRequire(${JSON.stringify(compilerGuestPath)});`,
+        `const ts = require(${JSON.stringify(compilerGuestPath)});`,
+        `const request = ${JSON.stringify(request)};`,
+        `const result = (${compilerGuestMain.toString()})(ts, fs, path, request);`,
+        `globalThis.__return(result);`,
+    ].join("\n");
 }
-function compilerRuntimeMain(request) {
-    const fs = require("node:fs");
-    const path = require("node:path");
-    const ts = loadCompiler(request.compilerSpecifier);
-    function loadCompiler(compilerSpecifier) {
-        const candidates = new Set([compilerSpecifier]);
-        if (compilerSpecifier === "typescript") {
-            candidates.add("/root/node_modules/typescript/lib/typescript.js");
-        }
-        if (compilerSpecifier === "/root/node_modules/typescript/lib/typescript.js") {
-            candidates.add("typescript");
-        }
-        let lastError;
-        for (const candidate of candidates) {
-            try {
-                return require(candidate);
-            }
-            catch (error) {
-                lastError = error;
-            }
-        }
-        throw lastError instanceof Error
-            ? lastError
-            : new Error(`Cannot load TypeScript compiler from '${compilerSpecifier}'`);
-    }
+// NOTE: This function is serialized with `.toString()` and executed INSIDE the
+// VM. It must be self-contained: it may only reference its parameters and the
+// in-guest globals. Do not capture host-side variables.
+function compilerGuestMain(ts, fs, path, request) {
     function toDiagnostic(diagnostic) {
-        const message = ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n").trim();
+        const message = ts
+            .flattenDiagnosticMessageText(diagnostic.messageText, "\n")
+            .trim();
         const result = {
             code: diagnostic.code,
             category: toDiagnosticCategory(diagnostic.category),
@@ -135,7 +138,6 @@ function compilerRuntimeMain(request) {
                 return "suggestion";
             case ts.DiagnosticCategory.Message:
                 return "message";
-            case ts.DiagnosticCategory.Error:
             default:
                 return "error";
         }
@@ -165,16 +167,10 @@ function compilerRuntimeMain(request) {
         }
         const configFile = ts.readConfigFile(configFilePath, ts.sys.readFile);
         if (configFile.error) {
-            return {
-                parsed: null,
-                diagnostics: [toDiagnostic(configFile.error)],
-            };
+            return { parsed: null, diagnostics: [toDiagnostic(configFile.error)] };
         }
         const parsed = ts.parseJsonConfigFileContent(configFile.config, ts.sys, path.dirname(configFilePath), overrideCompilerOptions, configFilePath);
-        return {
-            parsed,
-            diagnostics: parsed.errors.map(toDiagnostic),
-        };
+        return { parsed, diagnostics: parsed.errors.map(toDiagnostic) };
     }
     function createSourceProgram(options, overrideCompilerOptions = {}) {
         const cwd = path.resolve(options.cwd ?? "/root");
@@ -186,51 +182,32 @@ function compilerRuntimeMain(request) {
             return {
                 filePath,
                 program: null,
-                host: null,
                 diagnostics: projectCompilerOptions.diagnostics,
             };
         }
         const compilerOptions = {
             target: ts.ScriptTarget.ES2022,
-            module: ts.ModuleKind.CommonJS,
+            module: ts.ModuleKind.ESNext,
             ...projectCompilerOptions.parsed?.options,
             ...convertCompilerOptions(options.compilerOptions, cwd),
             ...overrideCompilerOptions,
         };
         const host = ts.createCompilerHost(compilerOptions);
-        const normalizedFilePath = ts.sys.useCaseSensitiveFileNames
-            ? filePath
-            : filePath.toLowerCase();
+        const normalize = (candidate) => ts.sys.useCaseSensitiveFileNames ? candidate : candidate.toLowerCase();
+        const normalizedFilePath = normalize(filePath);
         const defaultGetSourceFile = host.getSourceFile.bind(host);
         const defaultReadFile = host.readFile.bind(host);
         const defaultFileExists = host.fileExists.bind(host);
-        host.fileExists = (candidatePath) => {
-            const normalizedCandidate = ts.sys.useCaseSensitiveFileNames
-                ? candidatePath
-                : candidatePath.toLowerCase();
-            return normalizedCandidate === normalizedFilePath || defaultFileExists(candidatePath);
-        };
-        host.readFile = (candidatePath) => {
-            const normalizedCandidate = ts.sys.useCaseSensitiveFileNames
-                ? candidatePath
-                : candidatePath.toLowerCase();
-            if (normalizedCandidate === normalizedFilePath) {
-                return options.sourceText;
-            }
-            return defaultReadFile(candidatePath);
-        };
-        host.getSourceFile = (candidatePath, languageVersion, onError, shouldCreateNewSourceFile) => {
-            const normalizedCandidate = ts.sys.useCaseSensitiveFileNames
-                ? candidatePath
-                : candidatePath.toLowerCase();
-            if (normalizedCandidate === normalizedFilePath) {
-                return ts.createSourceFile(candidatePath, options.sourceText, languageVersion, true);
-            }
-            return defaultGetSourceFile(candidatePath, languageVersion, onError, shouldCreateNewSourceFile);
-        };
+        host.fileExists = (candidate) => normalize(candidate) === normalizedFilePath ||
+            defaultFileExists(candidate);
+        host.readFile = (candidate) => normalize(candidate) === normalizedFilePath
+            ? options.sourceText
+            : defaultReadFile(candidate);
+        host.getSourceFile = (candidate, languageVersion, onError, shouldCreate) => normalize(candidate) === normalizedFilePath
+            ? ts.createSourceFile(candidate, options.sourceText, languageVersion, true)
+            : defaultGetSourceFile(candidate, languageVersion, onError, shouldCreate);
         return {
             filePath,
-            host,
             program: ts.createProgram([filePath], compilerOptions, host),
             diagnostics: [],
         };
@@ -241,26 +218,20 @@ function compilerRuntimeMain(request) {
                 noEmit: true,
             });
             if (!parsed) {
-                return {
-                    success: false,
-                    diagnostics,
-                };
+                return { success: false, diagnostics };
             }
             const program = ts.createProgram({
                 rootNames: parsed.fileNames,
                 options: parsed.options,
                 projectReferences: parsed.projectReferences,
             });
-            const combinedDiagnostics = ts
+            const combined = ts
                 .sortAndDeduplicateDiagnostics([
                 ...parsed.errors,
                 ...ts.getPreEmitDiagnostics(program),
             ])
                 .map(toDiagnostic);
-            return {
-                success: !hasErrors(combinedDiagnostics),
-                diagnostics: combinedDiagnostics,
-            };
+            return { success: !hasErrors(combined), diagnostics: combined };
         }
         case "compileProject": {
             const { parsed, diagnostics } = resolveProjectConfig(request.options);
@@ -283,7 +254,7 @@ function compilerRuntimeMain(request) {
                 fs.writeFileSync(fileName, text, "utf8");
                 emittedFiles.push(fileName.replace(/\\/g, "/"));
             });
-            const combinedDiagnostics = ts
+            const combined = ts
                 .sortAndDeduplicateDiagnostics([
                 ...parsed.errors,
                 ...ts.getPreEmitDiagnostics(program),
@@ -291,8 +262,8 @@ function compilerRuntimeMain(request) {
             ])
                 .map(toDiagnostic);
             return {
-                success: !hasErrors(combinedDiagnostics),
-                diagnostics: combinedDiagnostics,
+                success: !hasErrors(combined),
+                diagnostics: combined,
                 emitSkipped: emitResult.emitSkipped,
                 emittedFiles,
             };
@@ -302,26 +273,17 @@ function compilerRuntimeMain(request) {
                 noEmit: true,
             });
             if (!program) {
-                return {
-                    success: false,
-                    diagnostics,
-                };
+                return { success: false, diagnostics };
             }
-            const combinedDiagnostics = ts
+            const combined = ts
                 .sortAndDeduplicateDiagnostics(ts.getPreEmitDiagnostics(program))
                 .map(toDiagnostic);
-            return {
-                success: !hasErrors(combinedDiagnostics),
-                diagnostics: combinedDiagnostics,
-            };
+            return { success: !hasErrors(combined), diagnostics: combined };
         }
         case "compileSource": {
             const { program, diagnostics } = createSourceProgram(request.options);
             if (!program) {
-                return {
-                    success: false,
-                    diagnostics,
-                };
+                return { success: false, diagnostics };
             }
             let outputText;
             let sourceMapText;
@@ -330,21 +292,20 @@ function compilerRuntimeMain(request) {
                     fileName.endsWith(".mjs") ||
                     fileName.endsWith(".cjs")) {
                     outputText = text;
-                    return;
                 }
-                if (fileName.endsWith(".map")) {
+                else if (fileName.endsWith(".map")) {
                     sourceMapText = text;
                 }
             });
-            const combinedDiagnostics = ts
+            const combined = ts
                 .sortAndDeduplicateDiagnostics([
                 ...ts.getPreEmitDiagnostics(program),
                 ...emitResult.diagnostics,
             ])
                 .map(toDiagnostic);
             return {
-                success: !hasErrors(combinedDiagnostics),
-                diagnostics: combinedDiagnostics,
+                success: !hasErrors(combined),
+                diagnostics: combined,
                 outputText,
                 sourceMapText,
             };

package/package.json

@@ -1,37 +1,36 @@
 {
-  "name": "@secure-exec/typescript",
-  "version": "0.2.1-rc.1",
-  "type": "module",
-  "license": "Apache-2.0",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/rivet-dev/secure-exec.git",
-    "directory": "packages/typescript"
-  },
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
-  },
-  "dependencies": {
-    "typescript": "^5.9.3",
-    "@secure-exec/core": "0.2.1-rc.1",
-    "secure-exec": "0.2.1-rc.1"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.2",
-    "vitest": "^2.1.8"
-  },
-  "scripts": {
-    "check-types": "tsc --noEmit",
-    "build": "tsc",
-    "test": "vitest run"
-  }
-}
+	"name": "@secure-exec/typescript",
+	"version": "0.3.0-rc.2",
+	"type": "module",
+	"license": "Apache-2.0",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist",
+		"README.md"
+	],
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/rivet-dev/secure-exec.git",
+		"directory": "packages/typescript"
+	},
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		}
+	},
+	"scripts": {
+		"build": "tsc",
+		"check-types": "tsc --noEmit"
+	},
+	"dependencies": {
+		"@secure-exec/core": "0.3.0-rc.2",
+		"secure-exec": "0.3.0-rc.2",
+		"typescript": "^5.9.3"
+	},
+	"devDependencies": {
+		"@types/node": "^22.10.2"
+	}
+}

package/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to the Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by the Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding any notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2025 Rivet Gaming, Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.