@secure-exec/wasmvm 0.2.0-rc.1

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2025 Rivet Gaming, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/browser-driver.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Browser-compatible WasmVM runtime driver.
+ *
+ * Discovers commands from a JSON manifest fetched over the network.
+ * WASM binaries are fetched on demand and compiled via
+ * WebAssembly.compileStreaming() for streaming compilation.
+ * Compiled modules are cached in memory for fast re-instantiation.
+ * Persistent caching via Cache API (or IndexedDB fallback) stores
+ * binaries across page loads. SHA-256 integrity is verified from the
+ * manifest before any cached or fetched binary is used.
+ */
+import type { KernelRuntimeDriver as RuntimeDriver } from '@secure-exec/core';
+/** Metadata for a single command in the manifest. */
+export interface CommandManifestEntry {
+    /** Binary size in bytes. */
+    size: number;
+    /** SHA-256 hex digest of the binary. */
+    sha256: string;
+}
+/** JSON manifest mapping command names to binary metadata. */
+export interface CommandManifest {
+    /** Manifest schema version. */
+    version: number;
+    /** Base URL for fetching command binaries (trailing slash included). */
+    baseUrl: string;
+    /** Map of command name to metadata. */
+    commands: Record<string, CommandManifestEntry>;
+}
+/** Persistent storage for WASM binary bytes across page loads. */
+export interface BinaryStorage {
+    get(key: string): Promise<Uint8Array | null>;
+    put(key: string, bytes: Uint8Array): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Cache API-backed storage. */
+export declare class CacheApiBinaryStorage implements BinaryStorage {
+    private _cacheName;
+    constructor(cacheName?: string);
+    get(key: string): Promise<Uint8Array | null>;
+    put(key: string, bytes: Uint8Array): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** IndexedDB-backed storage (fallback when Cache API is unavailable). */
+export declare class IndexedDbBinaryStorage implements BinaryStorage {
+    private _dbName;
+    private _storeName;
+    constructor(dbName?: string);
+    private _open;
+    get(key: string): Promise<Uint8Array | null>;
+    put(key: string, bytes: Uint8Array): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Compute SHA-256 hex digest of binary data using Web Crypto API. */
+export declare function sha256Hex(data: Uint8Array): Promise<string>;
+export interface BrowserWasmVmRuntimeOptions {
+    /** URL to the command manifest JSON. */
+    registryUrl: string;
+    /** Optional custom fetch function (for testing). */
+    fetch?: typeof globalThis.fetch;
+    /** Optional persistent binary storage (auto-detected if omitted). */
+    binaryStorage?: BinaryStorage | null;
+}
+/**
+ * Create a browser-compatible WasmVM RuntimeDriver that fetches commands
+ * from a CDN using a JSON manifest.
+ */
+export declare function createBrowserWasmVmRuntime(options: BrowserWasmVmRuntimeOptions): RuntimeDriver;
+//# sourceMappingURL=browser-driver.d.ts.map

package/dist/browser-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-driver.d.ts","sourceRoot":"","sources":["../src/browser-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,mBAAmB,IAAI,aAAa,EAIrC,MAAM,mBAAmB,CAAC;AAM3B,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAChD;AAMD,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,gCAAgC;AAChC,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,UAAU,CAAS;gBAEf,SAAS,SAAoB;IAInC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAO5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIzC;AAED,yEAAyE;AACzE,qBAAa,sBAAuB,YAAW,aAAa;IAC1D,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAc;gBAEpB,MAAM,SAAoB;IAItC,OAAO,CAAC,KAAK;IAcP,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiB5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBlD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBzC;AAMD,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE;AAMD,MAAM,WAAW,2BAA2B;IAC1C,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,qEAAqE;IACrE,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAMD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,aAAa,CAEf"}

package/dist/browser-driver.js

@@ -0,0 +1,293 @@
+/**
+ * Browser-compatible WasmVM runtime driver.
+ *
+ * Discovers commands from a JSON manifest fetched over the network.
+ * WASM binaries are fetched on demand and compiled via
+ * WebAssembly.compileStreaming() for streaming compilation.
+ * Compiled modules are cached in memory for fast re-instantiation.
+ * Persistent caching via Cache API (or IndexedDB fallback) stores
+ * binaries across page loads. SHA-256 integrity is verified from the
+ * manifest before any cached or fetched binary is used.
+ */
+/** Cache API-backed storage. */
+export class CacheApiBinaryStorage {
+    _cacheName;
+    constructor(cacheName = 'wasmvm-binaries') {
+        this._cacheName = cacheName;
+    }
+    async get(key) {
+        const cache = await caches.open(this._cacheName);
+        const resp = await cache.match(key);
+        if (!resp)
+            return null;
+        return new Uint8Array(await resp.arrayBuffer());
+    }
+    async put(key, bytes) {
+        const cache = await caches.open(this._cacheName);
+        await cache.put(key, new Response(bytes));
+    }
+    async delete(key) {
+        const cache = await caches.open(this._cacheName);
+        await cache.delete(key);
+    }
+}
+/** IndexedDB-backed storage (fallback when Cache API is unavailable). */
+export class IndexedDbBinaryStorage {
+    _dbName;
+    _storeName = 'binaries';
+    constructor(dbName = 'wasmvm-binaries') {
+        this._dbName = dbName;
+    }
+    _open() {
+        return new Promise((resolve, reject) => {
+            const req = indexedDB.open(this._dbName, 1);
+            req.onupgradeneeded = () => {
+                const db = req.result;
+                if (!db.objectStoreNames.contains(this._storeName)) {
+                    db.createObjectStore(this._storeName);
+                }
+            };
+            req.onsuccess = () => resolve(req.result);
+            req.onerror = () => reject(req.error);
+        });
+    }
+    async get(key) {
+        const db = await this._open();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(this._storeName, 'readonly');
+            const store = tx.objectStore(this._storeName);
+            const req = store.get(key);
+            req.onsuccess = () => {
+                db.close();
+                resolve(req.result ? new Uint8Array(req.result) : null);
+            };
+            req.onerror = () => {
+                db.close();
+                reject(req.error);
+            };
+        });
+    }
+    async put(key, bytes) {
+        const db = await this._open();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(this._storeName, 'readwrite');
+            const store = tx.objectStore(this._storeName);
+            const req = store.put(bytes.buffer.slice(0), key);
+            req.onsuccess = () => {
+                db.close();
+                resolve();
+            };
+            req.onerror = () => {
+                db.close();
+                reject(req.error);
+            };
+        });
+    }
+    async delete(key) {
+        const db = await this._open();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(this._storeName, 'readwrite');
+            const store = tx.objectStore(this._storeName);
+            const req = store.delete(key);
+            req.onsuccess = () => {
+                db.close();
+                resolve();
+            };
+            req.onerror = () => {
+                db.close();
+                reject(req.error);
+            };
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// SHA-256 utility
+// ---------------------------------------------------------------------------
+/** Compute SHA-256 hex digest of binary data using Web Crypto API. */
+export async function sha256Hex(data) {
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashArray = new Uint8Array(hashBuffer);
+    return Array.from(hashArray)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ---------------------------------------------------------------------------
+// Driver
+// ---------------------------------------------------------------------------
+/**
+ * Create a browser-compatible WasmVM RuntimeDriver that fetches commands
+ * from a CDN using a JSON manifest.
+ */
+export function createBrowserWasmVmRuntime(options) {
+    return new BrowserWasmVmRuntimeDriver(options);
+}
+class BrowserWasmVmRuntimeDriver {
+    name = 'wasmvm';
+    _commands = [];
+    _manifest = null;
+    _kernel = null;
+    // Module cache: command name -> compiled WebAssembly.Module
+    _moduleCache = new Map();
+    // Dedup concurrent fetches/compilations
+    _pending = new Map();
+    _registryUrl;
+    _fetch;
+    _binaryStorage;
+    get commands() {
+        return this._commands;
+    }
+    constructor(options) {
+        this._registryUrl = options.registryUrl;
+        this._fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+        // Explicit null = no storage; undefined = auto-detect
+        this._binaryStorage =
+            options.binaryStorage !== undefined ? options.binaryStorage : null;
+    }
+    async init(kernel) {
+        this._kernel = kernel;
+        // Auto-detect persistent storage if not explicitly provided
+        if (this._binaryStorage === null && typeof caches !== 'undefined') {
+            this._binaryStorage = new CacheApiBinaryStorage();
+        }
+        else if (this._binaryStorage === null && typeof indexedDB !== 'undefined') {
+            this._binaryStorage = new IndexedDbBinaryStorage();
+        }
+        // Fetch manifest to discover available commands
+        const resp = await this._fetch(this._registryUrl);
+        if (!resp.ok) {
+            throw new Error(`Failed to fetch command manifest from ${this._registryUrl}: ${resp.status} ${resp.statusText}`);
+        }
+        this._manifest = (await resp.json());
+        this._commands = Object.keys(this._manifest.commands);
+    }
+    spawn(command, _args, _ctx) {
+        if (!this._kernel)
+            throw new Error('Browser WasmVM driver not initialized');
+        if (!this._manifest)
+            throw new Error('Manifest not loaded');
+        const entry = this._manifest.commands[command];
+        if (!entry) {
+            throw new Error(`command not found: ${command}`);
+        }
+        // Exit plumbing
+        let resolveExit;
+        let exitResolved = false;
+        const exitPromise = new Promise((resolve) => {
+            resolveExit = (code) => {
+                if (exitResolved)
+                    return;
+                exitResolved = true;
+                resolve(code);
+            };
+        });
+        const proc = {
+            onStdout: null,
+            onStderr: null,
+            onExit: null,
+            writeStdin: () => {
+                // Browser worker stdin not wired in this story
+            },
+            closeStdin: () => { },
+            kill: () => {
+                // Terminate would go here when workers are wired
+                resolveExit(137);
+            },
+            wait: () => exitPromise,
+        };
+        // Fetch, compile, and eventually launch worker (async)
+        this._resolveModule(command).then((_module) => {
+            // Module compiled successfully — actual worker launch is
+            // environment-specific and deferred to future integration.
+            // For now, signal successful compilation.
+            resolveExit(0);
+            proc.onExit?.(0);
+        }, (err) => {
+            const errMsg = err instanceof Error ? err.message : String(err);
+            const errBytes = new TextEncoder().encode(`wasmvm: ${errMsg}\n`);
+            proc.onStderr?.(errBytes);
+            resolveExit(127);
+            proc.onExit?.(127);
+        });
+        return proc;
+    }
+    /**
+     * Preload multiple commands concurrently during idle time.
+     * Fetches, verifies, caches, and compiles each command.
+     */
+    async preload(commands) {
+        if (!this._manifest)
+            throw new Error('Manifest not loaded');
+        const valid = commands.filter((cmd) => this._manifest.commands[cmd]);
+        await Promise.all(valid.map((cmd) => this._resolveModule(cmd)));
+    }
+    async dispose() {
+        this._moduleCache.clear();
+        this._pending.clear();
+        this._manifest = null;
+        this._kernel = null;
+        this._commands = [];
+    }
+    // -------------------------------------------------------------------------
+    // Module resolution with concurrent-compile deduplication
+    // -------------------------------------------------------------------------
+    /**
+     * Resolve a command to a compiled WebAssembly.Module.
+     * Uses in-memory cache and deduplicates concurrent fetches.
+     */
+    async resolveModule(command) {
+        return this._resolveModule(command);
+    }
+    async _resolveModule(command) {
+        // In-memory cache hit
+        const cached = this._moduleCache.get(command);
+        if (cached)
+            return cached;
+        // Dedup concurrent fetches
+        const inflight = this._pending.get(command);
+        if (inflight)
+            return inflight;
+        const promise = this._fetchAndCompile(command);
+        this._pending.set(command, promise);
+        try {
+            const module = await promise;
+            this._moduleCache.set(command, module);
+            return module;
+        }
+        finally {
+            this._pending.delete(command);
+        }
+    }
+    async _fetchAndCompile(command) {
+        if (!this._manifest)
+            throw new Error('Manifest not loaded');
+        const entry = this._manifest.commands[command];
+        const url = this._manifest.baseUrl + command;
+        // Check persistent cache
+        if (this._binaryStorage) {
+            const cachedBytes = await this._binaryStorage.get(command);
+            if (cachedBytes) {
+                const hash = await sha256Hex(cachedBytes);
+                if (hash === entry.sha256) {
+                    return WebAssembly.compile(cachedBytes);
+                }
+                // Hash mismatch — evict stale entry and re-fetch
+                await this._binaryStorage.delete(command);
+            }
+        }
+        // Fetch from network
+        const resp = await this._fetch(url);
+        const bytes = new Uint8Array(await resp.arrayBuffer());
+        // SHA-256 integrity check
+        const hash = await sha256Hex(bytes);
+        if (hash !== entry.sha256) {
+            throw new Error(`SHA-256 mismatch for ${command}: expected ${entry.sha256}, got ${hash}`);
+        }
+        // Store in persistent cache
+        if (this._binaryStorage) {
+            await this._binaryStorage.put(command, bytes);
+        }
+        // Compile module
+        return WebAssembly.compile(bytes);
+    }
+}
+//# sourceMappingURL=browser-driver.js.map

package/dist/browser-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-driver.js","sourceRoot":"","sources":["../src/browser-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA0CH,gCAAgC;AAChC,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAS;IAE3B,YAAY,SAAS,GAAG,iBAAiB;QACvC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB;QACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,KAA4B,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,sBAAsB;IACzB,OAAO,CAAS;IAChB,UAAU,GAAG,UAAU,CAAC;IAEhC,YAAY,MAAM,GAAG,iBAAiB;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC5C,GAAG,CAAC,eAAe,GAAG,GAAG,EAAE;gBACzB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnD,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC;YACF,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;gBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC,CAAC;YACF,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE;gBACjB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB;QACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;gBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE;gBACjB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;gBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE;gBACjB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB;IAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAoC,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAeD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAoC;IAEpC,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,0BAA0B;IACrB,IAAI,GAAG,QAAQ,CAAC;IAEjB,SAAS,GAAa,EAAE,CAAC;IACzB,SAAS,GAA2B,IAAI,CAAC;IACzC,OAAO,GAA2B,IAAI,CAAC;IAE/C,4DAA4D;IACpD,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,wCAAwC;IAChC,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;IAE1D,YAAY,CAAS;IACrB,MAAM,CAA0B;IAChC,cAAc,CAAuB;IAE7C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,YAAY,OAAoC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,sDAAsD;QACtD,IAAI,CAAC,cAAc;YACjB,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAuB;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,4DAA4D;QAC5D,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClE,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACpD,CAAC;aAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;YAC5E,IAAI,CAAC,cAAc,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACrD,CAAC;QAED,gDAAgD;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,KAAe,EAAE,IAAoB;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,gBAAgB;QAChB,IAAI,WAAoC,CAAC;QACzC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAClD,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;gBAC7B,IAAI,YAAY;oBAAE,OAAO;gBACzB,YAAY,GAAG,IAAI,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAkB;YAC1B,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,GAAG,EAAE;gBACf,+CAA+C;YACjD,CAAC;YACD,UAAU,EAAE,GAAG,EAAE,GAAE,CAAC;YACpB,IAAI,EAAE,GAAG,EAAE;gBACT,iDAAiD;gBACjD,WAAW,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW;SACxB,CAAC;QAEF,uDAAuD;QACvD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAC/B,CAAC,OAAO,EAAE,EAAE;YACV,yDAAyD;YACzD,2DAA2D;YAC3D,0CAA0C;YAC1C,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1B,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,QAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAE5E;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAAe;QAEf,sBAAsB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,OAAe;QAEf,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;QAE7C,yBAAyB;QACzB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC1C,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC1B,OAAO,WAAW,CAAC,OAAO,CAAC,WAA2B,CAAC,CAAC;gBAC1D,CAAC;gBACD,iDAAiD;gBACjD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEvD,0BAA0B;QAC1B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,cAAc,KAAK,CAAC,MAAM,SAAS,IAAI,EAAE,CACzE,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QAED,iBAAiB;QACjB,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/driver.d.ts

@@ -0,0 +1,43 @@
+/**
+ * WasmVM runtime driver for kernel integration.
+ *
+ * Discovers WASM command binaries from filesystem directories (commandDirs),
+ * validates them by WASM magic bytes, and loads them on demand. Each spawn()
+ * creates a Worker thread that loads the per-command binary and communicates
+ * with the main thread via SharedArrayBuffer-based RPC for synchronous
+ * WASI syscalls.
+ *
+ * proc_spawn from brush-shell routes through KernelInterface.spawn()
+ * so pipeline stages can dispatch to any runtime (WasmVM, Node, Python).
+ */
+import type { KernelRuntimeDriver as RuntimeDriver } from '@secure-exec/core';
+import { type PermissionTier } from './syscall-rpc.js';
+/**
+ * All commands available in the WasmVM runtime.
+ * Used as fallback when no commandDirs are configured (legacy mode).
+ * @deprecated Use commandDirs option instead — commands are discovered from filesystem.
+ */
+export declare const WASMVM_COMMANDS: readonly string[];
+/**
+ * Default permission tiers for known first-party commands.
+ * User-provided permissions override these defaults.
+ */
+export declare const DEFAULT_FIRST_PARTY_TIERS: Readonly<Record<string, PermissionTier>>;
+export interface WasmVmRuntimeOptions {
+    /**
+     * Path to a compiled WASM binary (legacy single-binary mode).
+     * @deprecated Use commandDirs instead. Triggers legacy mode.
+     */
+    wasmBinaryPath?: string;
+    /** Directories to scan for WASM command binaries, searched in order (PATH semantics). */
+    commandDirs?: string[];
+    /** Per-command permission tiers. Keys are command names, '*' sets the default. */
+    permissions?: Record<string, PermissionTier>;
+}
+/**
+ * Create a WasmVM RuntimeDriver that can be mounted into the kernel.
+ */
+export declare function createWasmVmRuntime(options?: WasmVmRuntimeOptions): RuntimeDriver;
+/** Map errors to WASI errno codes. Prefers structured .code, falls back to string matching. */
+export declare function mapErrorToErrno(err: unknown): number;
+//# sourceMappingURL=driver.d.ts.map

package/dist/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../src/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,mBAAmB,IAAI,aAAa,EAIrC,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAcL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AA4F1B;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EA4DnC,CAAC;AAGX;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CA0F9E,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,aAAa,CAEjF;AAqtCD,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAapD"}