@wasm-oj/server 0.2.0

package/dist/index.js

@@ -0,0 +1,4393 @@
+import { constants } from "node:fs";
+import { access, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { deserialize, serialize } from "node:v8";
+import { gunzipSync } from "node:zlib";
+import { Runtime, init } from "@wasmer/sdk/node";
+import { WEIGHTED_METER_MODEL, asWasmOjError, assertCompilerCacheKey, assertValidBuildArtifact, assertValidProject, createDefaultDependencyManager, createDefaultRuntimeDrivers, createEngine, createExtendedCostBaselineRegistry, normalizeExecutionMetrics, prepareArtifactInteraction, prepareArtifactRun, prepareTrustedJudgeRun, toolchainAssetSource, toolchainCacheIdentity, toolchainProfileSource, unavailableExecutionMetrics, validateServerToolchainSources } from "@wasm-oj/core";
+import { WASM_OJ_CONTRACT_VERSION, WASM_OJ_SCHEMAS, WASM_OJ_STORAGE, assertLanguageIdentifier, isBuiltinLanguage } from "@wasm-oj/contracts";
+import { Directory, Wasmer } from "@wasmer/sdk";
+import { fileURLToPath } from "node:url";
+//#region src/core/toolchains.ts
+var CLANG_VERSION = "22.0.0-git20542-10";
+var CLANG_PACKAGE = `wasm-oj/clang@${CLANG_VERSION}`;
+var CLANG_PACKAGE_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.webc.gz.bin`;
+var CLANG_CC1_PINS_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.cc1-pins.json`;
+var CLANG_MANIFEST_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.manifest.json`;
+var CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.libcxx-pch.json`;
+var CLANG_LIBCXX_PCH_DEBUG_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.cpp-debug.pch.gz.bin`;
+var CLANG_LIBCXX_PCH_RELEASE_ASSET_PATH = `/toolchains/clang-${CLANG_VERSION}.cpp-release.pch.gz.bin`;
+var CLANG_COMPRESSED_PACKAGE_SHA256 = "7f10d90b8e52b270f04874641a1d0bf9e94e85b4f6c7573a774cebbc6d32552a";
+/** SHA-256 after browser-side gzip decompression. */
+var CLANG_PACKAGE_SHA256 = "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224";
+/** SHA-256 of the pinned cc1/wasm-ld argv manifest; regenerated by scripts/pin-clang-cc1-argv.mjs. */
+var CLANG_CC1_PINS_SHA256 = "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72";
+var CLANG_MANIFEST_SHA256 = "6382dcdfb6a2da49032a0e08da3b1fb490eb24432be85c3c12e3e871a5065273";
+/** Updated atomically with the generated toolchain-admitted PCH assets. */
+var CLANG_LIBCXX_PCH_MANIFEST_SHA256 = "d126c99e951a7302d4ea2b66da4ed64d3d74e9d319d562518867c8d8c97a06b8";
+var CLANG_LIBCXX_PCH = Object.freeze({
+	"cpp-debug": Object.freeze({
+		path: CLANG_LIBCXX_PCH_DEBUG_ASSET_PATH,
+		sha256: "05a4db721448ba33e65977cb4ac366908ea215ab377e3b6d09f1fd224d515b68",
+		compressedSha256: "a4152027d248412eca8aec3e7e23f6f7c81f95170cae9fd385bcf02e57e91fc9"
+	}),
+	"cpp-release": Object.freeze({
+		path: CLANG_LIBCXX_PCH_RELEASE_ASSET_PATH,
+		sha256: "aec9e778ac527c120ba369b9b0e142cf8206d11365801208847ba0e1c39daa1a",
+		compressedSha256: "18f4ca8ab8ca7888db572ba34146fc1acb213a7e7305000ea6285188f52f99f4"
+	})
+});
+var PYTHON_VERSION = "3.14.6";
+var PYTHON_PACKAGE_SHA256 = "454ffc53936aa13a0d7f4afbb5bd50ada339c8ebd04bbf27ea19e4104cf43207";
+var PYTHON_PACKAGE = `${`wasm-oj/cpython@${PYTHON_VERSION}`}#sha256:${PYTHON_PACKAGE_SHA256}`;
+var PYTHON_PACKAGE_ASSET_PATH = `/toolchains/python-${PYTHON_VERSION}-wasip1.webc.gz.bin`;
+var PYTHON_PACKAGE_MANIFEST_ASSET_PATH = `/toolchains/python-${PYTHON_VERSION}-wasip1.manifest.json`;
+var PYTHON_COMPRESSED_PACKAGE_SHA256 = "218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6";
+var PYTHON_PACKAGE_MANIFEST_SHA256 = "054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e";
+var PYTHON_RUNTIME_FILES_ARCHIVE_SHA256 = "44d894f91487f20c2bb04fe496a9343db37d8720fb706472c2b4a7f3300db039";
+var QUICKJS_VERSION = "0.15.1";
+var QUICKJS_PACKAGE = `wasm-oj/quickjs-ng@${QUICKJS_VERSION}`;
+var QUICKJS_ASSET_PATH = `/toolchains/quickjs-${QUICKJS_VERSION}.wasm.gz.bin`;
+var QUICKJS_ASSET_SHA256 = "8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8";
+var TYPESCRIPT_VERSION = "7.0.2";
+var TYPESCRIPT_ASSET_PATH = `/toolchains/typescript-${TYPESCRIPT_VERSION}.wasm.gz.bin`;
+var TYPESCRIPT_ASSET_SHA256 = "06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16";
+var RUST_VERSION = "1.91.1-dev";
+var RUST_PACKAGE_ASSET_PATH = `/toolchains/rust-${RUST_VERSION}.webc.gz.bin`;
+var RUST_PACKAGE_MANIFEST_ASSET_PATH = `/toolchains/rust-${RUST_VERSION}.manifest.json`;
+var RUST_COMPRESSED_PACKAGE_SHA256 = "cfbdadc67be1315e735aa55bdf8a5a0d00171982a023fefcf7ba586127753887";
+/** SHA-256 after browser-side gzip decompression. */
+var RUST_PACKAGE_SHA256 = "765de8d68d03078e79f69f49dec0dcab1ff96fe3bbe5e9eafebb2ce61a39d3ee";
+var RUST_PACKAGE_MANIFEST_SHA256 = "d5bbdca994e61888679c5738cb9420649c0854ed0eb5d65468bc67d5d550bce1";
+var GO_VERSION = "1.26.5";
+var GO_PACKAGE_ASSET_PATH = `/toolchains/go-${GO_VERSION}-wasip1.webc.gz.bin`;
+var GO_PACKAGE_MANIFEST_ASSET_PATH = `/toolchains/go-${GO_VERSION}-wasip1.manifest.json`;
+var GO_STANDARD_LIBRARY_ASSET_PATH = `/toolchains/go-${GO_VERSION}-wasip1.stdlib.gz.bin`;
+var GO_COMPRESSED_PACKAGE_SHA256 = "70a7e359884b09b2e1a622d6ac5cd6e31c334aab519e6dd80dff5e040a9e09e4";
+var GO_PACKAGE_SHA256 = "c3a97934b6a83fefdea5c31f99141f70f76189eedc9ec0fa9ccd41302e50963b";
+var GO_PACKAGE_MANIFEST_SHA256 = "5d784e9ca640b9525e84b598c0beb97ca110ae908568ca45f6441a441d99a262";
+var GO_COMPRESSED_STANDARD_LIBRARY_SHA256 = "aeffc384fdc624544f174ba5fc3c22395717fdbc3c4387d677d20855b6be80d8";
+var GO_STANDARD_LIBRARY_SHA256 = "e1ec64b08efd02b35b7ffdaf3970875aaae98325fa4795eafca94ebae2d0d192";
+var GO_COMPILER_SHA256 = "9e557f5b86961fd604217d7521461c5d2b7322e383fa30dead5669b77db12201";
+var GO_LINKER_SHA256 = "2eefca10af935a307ab7946447146bd30e0ea0fb5460be54dc1c55844d155580";
+var JAVA_VERSION = "teavm-0.13.1-wasi";
+var JAVA_COMPILER_PACKAGE = `wasm-oj/java-teavm@${JAVA_VERSION}`;
+var JAVA_COMPILER_ASSET_PATH = "/toolchains/java-teavm-0.13.1.wasi.compiler.webc.gz.bin";
+var JAVA_COMPILE_CLASSLIB_ASSET_PATH = "/toolchains/java-teavm-0.13.1.compile-classlib.bin";
+var JAVA_RUNTIME_CLASSLIB_ASSET_PATH = "/toolchains/java-teavm-0.13.1.runtime-classlib.bin";
+var JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256 = "129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722";
+var JAVA_COMPILER_PACKAGE_SHA256 = "f8f86761cf31062565187e4a66f73b6903f257fe84c0ce70ea1cd28441b6c2e9";
+var JAVA_COMPILER_SHA256 = "33a0d662395256f10a5d02ea305fc7b18007b2b8fe8996859017b084d3d19735";
+var JAVA_COMPILE_CLASSLIB_SHA256 = "acfe3fb09e5f2c0c7c8dc2339c66fcdadc1f8e1bf1c74be446926175ef770868";
+var JAVA_RUNTIME_CLASSLIB_SHA256 = "21a9394586e416af2fca4eb0ed08521cbc8924e1d1afaa07863a59a3cfae54ab";
+Object.freeze({
+	[CLANG_PACKAGE_ASSET_PATH]: CLANG_COMPRESSED_PACKAGE_SHA256,
+	[CLANG_CC1_PINS_ASSET_PATH]: CLANG_CC1_PINS_SHA256,
+	[CLANG_MANIFEST_ASSET_PATH]: CLANG_MANIFEST_SHA256,
+	[CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH]: CLANG_LIBCXX_PCH_MANIFEST_SHA256,
+	[CLANG_LIBCXX_PCH_DEBUG_ASSET_PATH]: CLANG_LIBCXX_PCH["cpp-debug"].compressedSha256,
+	[CLANG_LIBCXX_PCH_RELEASE_ASSET_PATH]: CLANG_LIBCXX_PCH["cpp-release"].compressedSha256,
+	[PYTHON_PACKAGE_ASSET_PATH]: PYTHON_COMPRESSED_PACKAGE_SHA256,
+	[PYTHON_PACKAGE_MANIFEST_ASSET_PATH]: PYTHON_PACKAGE_MANIFEST_SHA256,
+	[QUICKJS_ASSET_PATH]: QUICKJS_ASSET_SHA256,
+	[TYPESCRIPT_ASSET_PATH]: TYPESCRIPT_ASSET_SHA256,
+	[RUST_PACKAGE_ASSET_PATH]: RUST_COMPRESSED_PACKAGE_SHA256,
+	[RUST_PACKAGE_MANIFEST_ASSET_PATH]: RUST_PACKAGE_MANIFEST_SHA256,
+	[GO_PACKAGE_ASSET_PATH]: GO_COMPRESSED_PACKAGE_SHA256,
+	[GO_PACKAGE_MANIFEST_ASSET_PATH]: GO_PACKAGE_MANIFEST_SHA256,
+	[GO_STANDARD_LIBRARY_ASSET_PATH]: GO_COMPRESSED_STANDARD_LIBRARY_SHA256,
+	[JAVA_COMPILER_ASSET_PATH]: JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256,
+	[JAVA_COMPILE_CLASSLIB_ASSET_PATH]: JAVA_COMPILE_CLASSLIB_SHA256,
+	[JAVA_RUNTIME_CLASSLIB_ASSET_PATH]: JAVA_RUNTIME_CLASSLIB_SHA256
+});
+var TOOLCHAIN_CONTENT_SHA256 = Object.freeze({
+	c: Object.freeze([
+		CLANG_COMPRESSED_PACKAGE_SHA256,
+		CLANG_PACKAGE_SHA256,
+		CLANG_CC1_PINS_SHA256,
+		CLANG_MANIFEST_SHA256
+	]),
+	cpp: Object.freeze([
+		CLANG_COMPRESSED_PACKAGE_SHA256,
+		CLANG_PACKAGE_SHA256,
+		CLANG_CC1_PINS_SHA256,
+		CLANG_MANIFEST_SHA256
+	]),
+	rust: Object.freeze([
+		RUST_COMPRESSED_PACKAGE_SHA256,
+		RUST_PACKAGE_SHA256,
+		RUST_PACKAGE_MANIFEST_SHA256
+	]),
+	python: Object.freeze([
+		PYTHON_COMPRESSED_PACKAGE_SHA256,
+		PYTHON_PACKAGE_SHA256,
+		PYTHON_PACKAGE_MANIFEST_SHA256,
+		PYTHON_RUNTIME_FILES_ARCHIVE_SHA256
+	]),
+	javascript: Object.freeze([TYPESCRIPT_ASSET_SHA256, QUICKJS_ASSET_SHA256]),
+	typescript: Object.freeze([TYPESCRIPT_ASSET_SHA256, QUICKJS_ASSET_SHA256]),
+	go: Object.freeze([
+		GO_COMPRESSED_PACKAGE_SHA256,
+		GO_PACKAGE_SHA256,
+		GO_PACKAGE_MANIFEST_SHA256,
+		GO_COMPRESSED_STANDARD_LIBRARY_SHA256,
+		GO_STANDARD_LIBRARY_SHA256,
+		GO_COMPILER_SHA256,
+		GO_LINKER_SHA256
+	])
+});
+/** Exact executable/compiler content used by cache keys and cost calibration. */
+function toolchainContentIdentity(language) {
+	if (language === "java") return [
+		JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256,
+		JAVA_COMPILER_PACKAGE_SHA256,
+		JAVA_COMPILER_SHA256,
+		JAVA_COMPILE_CLASSLIB_SHA256,
+		JAVA_RUNTIME_CLASSLIB_SHA256
+	].join(".");
+	if (!isBuiltinLanguage(language)) throw new Error(`WASM-OJ has no built-in toolchain for '${language}'.`);
+	return TOOLCHAIN_CONTENT_SHA256[language].join(".");
+}
+function freezeToolchain(definition) {
+	return Object.freeze({
+		...definition,
+		compilerPackages: Object.freeze([...definition.compilerPackages]),
+		targets: Object.freeze([...definition.targets])
+	});
+}
+var TOOLCHAINS = Object.freeze({
+	c: freezeToolchain({
+		language: "c",
+		label: "Clang 22",
+		artifact: "wasm",
+		compilerPackages: [CLANG_PACKAGE],
+		targets: ["wasip1", "wasix"],
+		version: CLANG_VERSION,
+		note: "Native wasip1 module via Clang and LLD; directly executable by WASI and WASIX runtimes."
+	}),
+	cpp: freezeToolchain({
+		language: "cpp",
+		label: "Clang++ 22 (C++20)",
+		artifact: "wasm",
+		compilerPackages: [CLANG_PACKAGE],
+		targets: ["wasip1", "wasix"],
+		version: CLANG_VERSION,
+		note: "C++20/libc++ wasip1 module; directly executable by WASI and WASIX runtimes."
+	}),
+	rust: freezeToolchain({
+		language: "rust",
+		label: `Rust ${RUST_VERSION}`,
+		artifact: "wasm",
+		compilerPackages: [`rustc@${RUST_VERSION}#sha256:${RUST_PACKAGE_SHA256}`],
+		targets: ["wasip1"],
+		version: RUST_VERSION,
+		note: "Real rustc, its matching standard library, and a fresh deterministic wasm-ld stage execute as one pinned WebC under Wasmer."
+	}),
+	python: freezeToolchain({
+		language: "python",
+		label: `CPython ${PYTHON_VERSION}`,
+		artifact: "runtime-bundle",
+		compilerPackages: [PYTHON_PACKAGE],
+		runtimePackage: PYTHON_PACKAGE,
+		targets: ["wasip1"],
+		version: PYTHON_VERSION,
+		note: "Byte-compiled project bundled with the source-built CPython wasm32-wasip1 interpreter and standard library."
+	}),
+	javascript: freezeToolchain({
+		language: "javascript",
+		label: "QuickJS-ng",
+		artifact: "runtime-bundle",
+		compilerPackages: [`typescript@${TYPESCRIPT_VERSION}-wasi`],
+		runtimePackage: QUICKJS_PACKAGE,
+		targets: ["wasip1"],
+		version: QUICKJS_VERSION,
+		note: "JavaScript checked by TypeScript/WASI, then executed by the bundled QuickJS-ng/WASI runtime."
+	}),
+	typescript: freezeToolchain({
+		language: "typescript",
+		label: "TypeScript + QuickJS-ng",
+		artifact: "runtime-bundle",
+		compilerPackages: [`typescript@${TYPESCRIPT_VERSION}-wasi`],
+		runtimePackage: QUICKJS_PACKAGE,
+		targets: ["wasip1"],
+		version: TYPESCRIPT_VERSION,
+		note: "The native TypeScript compiler and QuickJS-ng runtime both execute as local WASI modules."
+	}),
+	go: freezeToolchain({
+		language: "go",
+		label: `Go ${GO_VERSION}`,
+		artifact: "wasm",
+		compilerPackages: [`go@${GO_VERSION}#sha256:${GO_PACKAGE_SHA256}`],
+		targets: ["wasip1"],
+		version: GO_VERSION,
+		note: "The standard Go compiler, linker, and pinned wasip1 standard library execute locally as one WebC under Wasmer."
+	})
+});
+function toolchainPackageIdentities(language) {
+	if (language === "java") return [JAVA_COMPILER_PACKAGE];
+	if (!isBuiltinLanguage(language)) throw new Error(`WASM-OJ has no built-in toolchain for '${language}'.`);
+	const toolchain = TOOLCHAINS[language];
+	return [.../* @__PURE__ */ new Set([...toolchain.compilerPackages, ...toolchain.runtimePackage ? [toolchain.runtimePackage] : []])];
+}
+//#endregion
+//#region src/core/project-files.ts
+var PROJECT_SOURCE_LIMITS = Object.freeze({
+	files: 256,
+	bytesPerFile: 4194304,
+	totalBytes: 16777216
+});
+var UTF8_ENCODER = new TextEncoder();
+/** Locale-independent ordering used anywhere file order can affect build output. */
+function compareCanonicalPaths(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertSafeRelativePath(path, label = "Project path") {
+	if (typeof path !== "string" || !path || path !== path.trim() || path.length > 4096) throw new Error(`${label} must be a non-empty, trimmed string of at most 4096 characters.`);
+	if (path.startsWith("/") || path.includes("\\") || path.includes("\0") || path.split("/").some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`${label} '${path}' must be a normalized relative path that cannot escape the project.`);
+}
+/**
+* Validates a project file set and returns a fresh, locale-independently sorted
+* array. Build hosts must use this order for filesystem creation and argv.
+*/
+function canonicalProjectFiles(files) {
+	if (!Array.isArray(files) || files.length === 0) throw new Error("A project must contain at least one source file.");
+	if (files.length > PROJECT_SOURCE_LIMITS.files) throw new Error(`A project cannot contain more than ${PROJECT_SOURCE_LIMITS.files} source files.`);
+	const seen = /* @__PURE__ */ new Set();
+	let totalBytes = 0;
+	return files.map((file, index) => {
+		if (!file || typeof file !== "object") throw new Error(`Project file ${index} is invalid.`);
+		assertSafeRelativePath(file.path, `Project file ${index} path`);
+		assertLanguageIdentifier(file.language);
+		if (typeof file.content !== "string") throw new Error(`Project file '${file.path}' content must be a string.`);
+		if (file.content.length > PROJECT_SOURCE_LIMITS.bytesPerFile) throw new Error(`Project file '${file.path}' exceeds the ${PROJECT_SOURCE_LIMITS.bytesPerFile} byte source limit.`);
+		const contentBytes = UTF8_ENCODER.encode(file.content).byteLength;
+		if (contentBytes > PROJECT_SOURCE_LIMITS.bytesPerFile) throw new Error(`Project file '${file.path}' exceeds the ${PROJECT_SOURCE_LIMITS.bytesPerFile} byte source limit.`);
+		totalBytes += contentBytes;
+		if (totalBytes > PROJECT_SOURCE_LIMITS.totalBytes) throw new Error(`Project sources exceed the ${PROJECT_SOURCE_LIMITS.totalBytes} byte total limit.`);
+		if (seen.has(file.path)) throw new Error(`Duplicate project path '${file.path}'.`);
+		seen.add(file.path);
+		return {
+			path: file.path,
+			language: file.language,
+			content: file.content
+		};
+	}).sort((left, right) => compareCanonicalPaths(left.path, right.path));
+}
+function canonicalFileEntries(files) {
+	if (!files || typeof files !== "object" || Array.isArray(files)) throw new Error("Runtime bundle files must be a record.");
+	return Object.entries(files).map(([path, contents]) => {
+		assertSafeRelativePath(path, "Runtime bundle path");
+		return [path, contents];
+	}).sort(([left], [right]) => compareCanonicalPaths(left, right));
+}
+function canonicalFileRecord(files) {
+	return Object.fromEntries(canonicalFileEntries(files));
+}
+//#endregion
+//#region src/core/sha256.ts
+async function sha256Hex(value) {
+	const source = typeof value === "string" ? new TextEncoder().encode(value) : value;
+	const bytes = new Uint8Array(source.byteLength);
+	bytes.set(source);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+//#region src/core/dependencies.ts
+var MIB = 1048576;
+/** Contract-level admission limits shared by dependency hosts and compilers. */
+var DEPENDENCY_RESOLUTION_LIMITS = Object.freeze({
+	requirements: 128,
+	sourceFiles: 128,
+	sourceTextBytes: 8 * MIB,
+	hosts: 32,
+	roots: 512,
+	packages: 512,
+	referencesPerPackage: 512,
+	concurrency: 16,
+	metadataBytes: 8 * MIB,
+	packageBytes: 256 * MIB,
+	totalDownloadBytes: 512 * MIB,
+	archiveFiles: 16384,
+	unpackedBytes: 512 * MIB
+});
+Object.freeze({
+	packages: DEPENDENCY_RESOLUTION_LIMITS.packages,
+	filesPerPackage: DEPENDENCY_RESOLUTION_LIMITS.archiveFiles,
+	bytesPerFile: 64 * MIB,
+	totalBytes: DEPENDENCY_RESOLUTION_LIMITS.unpackedBytes
+});
+//#endregion
+//#region src/compiler/clang-pins.ts
+var decoder$3 = new TextDecoder();
+async function decodeClangPins(bytes) {
+	const digest = await sha256Hex(bytes);
+	if (digest !== "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72") throw new Error(`The pinned cc1 manifest drifted from its contract: expected ${CLANG_CC1_PINS_SHA256}, received ${digest}. Regenerate it with scripts/pin-clang-cc1-argv.mjs and update CLANG_CC1_PINS_SHA256.`);
+	const parsed = JSON.parse(decoder$3.decode(bytes));
+	if (parsed.schema !== WASM_OJ_SCHEMAS.clangPins) throw new Error(`Unsupported cc1 pin schema '${parsed.schema}'.`);
+	for (const key of [
+		"input",
+		"output",
+		"mainFileName",
+		"objects"
+	]) if (typeof parsed.placeholders?.[key] !== "string") throw new Error(`The cc1 pin manifest is missing the '${key}' placeholder.`);
+	if (!parsed.command || !parsed.linkerCommand) throw new Error("The cc1 pin manifest is missing a compiler or linker command.");
+	if (!parsed.source || !/^[a-f0-9]{64}$/.test(parsed.sourceSha256)) throw new Error("The cc1 pin manifest is missing its source toolchain identity.");
+	for (const [key, config] of Object.entries(parsed.configs)) if (!Array.isArray(config.cc1) || !Array.isArray(config.link) || config.cc1[0] !== "-cc1") throw new Error(`The cc1 pin manifest entry '${key}' is malformed.`);
+	return parsed;
+}
+function instantiateClangCc1(template, placeholders, source, objectPath) {
+	const basename = source.slice(source.lastIndexOf("/") + 1);
+	const inputPath = source.startsWith("/") ? source : `/project/${source}`;
+	return template.map((token) => {
+		if (token === placeholders.input) return inputPath;
+		if (token === placeholders.output) return objectPath;
+		if (token === placeholders.mainFileName) return basename;
+		return token;
+	});
+}
+function instantiateClangPch(template, placeholders, header, outputPath) {
+	return instantiateClangCc1(template.map((token) => token === "-emit-obj" ? "-emit-pch" : token === "c++" ? "c++-header" : token), placeholders, header, outputPath);
+}
+function instantiateClangLink(template, placeholders, objectPaths, outputPath) {
+	const argv = [];
+	for (const token of template) if (token === placeholders.objects) argv.push(...objectPaths);
+	else if (token === placeholders.output) argv.push(outputPath);
+	else argv.push(token);
+	return argv;
+}
+//#endregion
+//#region src/compiler/incremental-build-graph.ts
+var BUILD_NODE_KINDS = Object.freeze([
+	"source",
+	"header",
+	"package",
+	"pch",
+	"object",
+	"link-result"
+]);
+/**
+* Content-addressed source → header/package → PCH/object → link-result graph.
+*
+* Logical manifests remember which inputs a tool actually observed. Reuse
+* rehashes every input and derives the structural node key again; no timestamp
+* or host path participates in identity.
+*/
+var IncrementalBuildGraph = class {
+	limitBytes;
+	logical = /* @__PURE__ */ new Map();
+	nodes = /* @__PURE__ */ new Map();
+	blobs = /* @__PURE__ */ new Map();
+	storedBytes = 0;
+	generation = 0;
+	constructor(limitBytes) {
+		if (!Number.isSafeInteger(limitBytes) || limitBytes <= 0) throw new RangeError("Incremental build graph limit must be a positive safe integer.");
+		this.limitBytes = limitBytes;
+	}
+	async lookup(logicalKey, availableInputs) {
+		const manifest = this.logical.get(logicalKey);
+		if (!manifest) return void 0;
+		const inputs = [];
+		for (const dependency of manifest.dependencies) {
+			const input = availableInputs.get(dependency.identity);
+			if (!input || input.kind !== dependency.kind) return void 0;
+			inputs.push(input);
+		}
+		return this.lookupExact(manifest.kind, logicalKey, inputs);
+	}
+	async lookupExact(kind, logicalKey, inputs) {
+		const key = await structuralKey(kind, logicalKey, (await this.internInputs(inputs)).map((item) => item.key));
+		const node = this.nodes.get(key);
+		if (!node) return void 0;
+		const blob = this.blobs.get(node.digest);
+		if (!blob) return void 0;
+		this.blobs.delete(node.digest);
+		this.blobs.set(node.digest, blob);
+		return blob.slice();
+	}
+	async store(kind, logicalKey, inputs, output) {
+		if (output.byteLength > this.limitBytes) return false;
+		const canonicalInputs = canonicalizeInputs(inputs);
+		const dependencies = await this.internInputs(canonicalInputs);
+		const key = await structuralKey(kind, logicalKey, dependencies.map((item) => item.key));
+		const bytes = output.slice();
+		const digest = await sha256Hex(bytes);
+		const previousManifest = this.logical.get(logicalKey);
+		const previousNode = previousManifest ? this.nodes.get(previousManifest.nodeKey) : void 0;
+		let changed = false;
+		if (previousNode && (previousNode.key !== key || previousNode.digest !== digest)) {
+			this.logical.delete(logicalKey);
+			this.nodes.delete(previousNode.key);
+			if (![...this.logical.values()].some((manifest) => this.nodes.get(manifest.nodeKey)?.digest === previousNode.digest)) {
+				const removed = this.blobs.get(previousNode.digest);
+				if (removed) {
+					this.blobs.delete(previousNode.digest);
+					this.storedBytes -= removed.byteLength;
+				}
+			}
+			changed = true;
+		}
+		changed = this.ensureCapacity(bytes.byteLength, digest) || changed;
+		if (!this.blobs.has(digest)) {
+			this.blobs.set(digest, bytes);
+			this.storedBytes += bytes.byteLength;
+			changed = true;
+		}
+		const nextNode = {
+			key,
+			kind,
+			identity: logicalKey,
+			digest,
+			dependencies: dependencies.map((item) => item.key),
+			byteLength: bytes.byteLength
+		};
+		const nextManifest = {
+			kind,
+			dependencies: canonicalInputs.map(({ kind: inputKind, identity }) => ({
+				kind: inputKind,
+				identity
+			})),
+			nodeKey: key
+		};
+		const currentNode = this.nodes.get(key);
+		const currentManifest = this.logical.get(logicalKey);
+		if (!sameNode(currentNode, nextNode) || !sameLogicalManifest(currentManifest, nextManifest)) changed = true;
+		this.nodes.set(key, nextNode);
+		this.logical.set(logicalKey, nextManifest);
+		if (changed) this.generation += 1;
+		return true;
+	}
+	exportState() {
+		const entries = [];
+		const referencedDigests = /* @__PURE__ */ new Set();
+		for (const [logicalKey, manifest] of this.logical) {
+			const node = this.nodes.get(manifest.nodeKey);
+			if (!node) continue;
+			const output = this.blobs.get(node.digest);
+			if (!output) continue;
+			const inputs = node.dependencies.map((key) => {
+				const dependency = this.nodes.get(key);
+				if (!dependency) throw new Error(`Build graph dependency '${key}' is missing.`);
+				return {
+					kind: dependency.kind,
+					identity: dependency.identity,
+					digest: dependency.digest
+				};
+			});
+			entries.push({
+				kind: manifest.kind,
+				logicalKey,
+				inputs,
+				outputDigest: node.digest,
+				outputByteLength: output.byteLength
+			});
+			referencedDigests.add(node.digest);
+		}
+		return {
+			manifest: {
+				schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+				version: 2,
+				generation: this.generation,
+				entries: entries.sort((left, right) => compareText(left.logicalKey, right.logicalKey))
+			},
+			blobs: [...referencedDigests].sort().map((digest) => ({
+				digest,
+				bytes: this.blobs.get(digest)
+			}))
+		};
+	}
+	async restoreState(state) {
+		if (!state || typeof state !== "object" || Array.isArray(state) || Object.keys(state).sort().join(",") !== "blobs,manifest") throw new Error("Incremental build graph state does not use the active WASM-OJ contract.");
+		const { manifest } = state;
+		if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || Object.keys(manifest).sort().join(",") !== "entries,generation,schema,version" || manifest.schema !== WASM_OJ_SCHEMAS.incrementalBuildGraph || manifest.version !== 2 || !Number.isSafeInteger(manifest.generation) || manifest.generation < 0 || !Array.isArray(manifest.entries) || !Array.isArray(state.blobs)) throw new Error("Incremental build graph manifest does not use the active WASM-OJ contract.");
+		const blobs = /* @__PURE__ */ new Map();
+		let totalBytes = 0;
+		let previousDigest = "";
+		for (const candidate of state.blobs) {
+			if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("Incremental build graph state contains a malformed blob.");
+			const blob = candidate;
+			if (Object.keys(blob).sort().join(",") !== "bytes,digest" || typeof blob.digest !== "string" || !/^[0-9a-f]{64}$/.test(blob.digest) || blob.digest <= previousDigest || !(blob.bytes instanceof Uint8Array) || await sha256Hex(blob.bytes) !== blob.digest) throw new Error("Incremental build graph state contains an invalid content-addressed blob.");
+			previousDigest = blob.digest;
+			totalBytes += blob.bytes.byteLength;
+			if (!Number.isSafeInteger(totalBytes) || totalBytes > this.limitBytes) throw new Error("Incremental build graph state exceeds its storage limit.");
+			blobs.set(blob.digest, blob.bytes);
+		}
+		const logicalKeys = /* @__PURE__ */ new Set();
+		const verified = [];
+		const referencedDigests = /* @__PURE__ */ new Set();
+		let previousLogicalKey = "";
+		for (const candidate of manifest.entries) {
+			if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("Incremental build graph manifest contains a malformed entry.");
+			const entry = candidate;
+			if (Object.keys(entry).sort().join(",") !== "inputs,kind,logicalKey,outputByteLength,outputDigest") throw new Error("Incremental build graph manifest entry has an invalid shape.");
+			if (entry.kind !== "pch" && entry.kind !== "object" && entry.kind !== "link-result") throw new Error("Incremental build graph manifest entry has an invalid node kind.");
+			if (typeof entry.logicalKey !== "string" || !entry.logicalKey || entry.logicalKey !== entry.logicalKey.trim() || entry.logicalKey.length > 16384 || previousLogicalKey !== "" && compareText(previousLogicalKey, entry.logicalKey) >= 0) throw new Error("Incremental build graph manifest has an invalid or non-canonical logical key.");
+			previousLogicalKey = entry.logicalKey;
+			if (logicalKeys.has(entry.logicalKey)) throw new Error(`Incremental build graph manifest repeats '${entry.logicalKey}'.`);
+			logicalKeys.add(entry.logicalKey);
+			if (typeof entry.outputDigest !== "string" || !/^[0-9a-f]{64}$/.test(entry.outputDigest) || !Number.isSafeInteger(entry.outputByteLength) || entry.outputByteLength < 0) throw new Error(`Incremental build graph output '${entry.logicalKey}' has invalid metadata.`);
+			const output = blobs.get(entry.outputDigest);
+			if (!output || output.byteLength !== entry.outputByteLength) throw new Error(`Incremental build graph output '${entry.logicalKey}' is missing or has the wrong size.`);
+			referencedDigests.add(entry.outputDigest);
+			if (!Array.isArray(entry.inputs)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' inputs must be an array.`);
+			const inputs = entry.inputs.map((input) => {
+				if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' has a malformed input.`);
+				const record = input;
+				if (Object.keys(record).sort().join(",") !== "digest,identity,kind" || !BUILD_NODE_KINDS.slice(0, 5).includes(record.kind) || typeof record.identity !== "string" || typeof record.digest !== "string") throw new Error(`Incremental build graph entry '${entry.logicalKey}' has an invalid input.`);
+				return {
+					kind: record.kind,
+					identity: record.identity,
+					digest: record.digest
+				};
+			});
+			if (canonicalizeInputs(inputs).some((input, index) => input.identity !== inputs[index]?.identity)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' inputs are not canonical.`);
+			verified.push({
+				kind: entry.kind,
+				logicalKey: entry.logicalKey,
+				inputs,
+				output
+			});
+		}
+		if (referencedDigests.size !== blobs.size) throw new Error("Incremental build graph state contains an unreferenced content-addressed blob.");
+		this.clear();
+		for (const entry of verified) if (!await this.store(entry.kind, entry.logicalKey, entry.inputs, entry.output)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' exceeds its storage limit.`);
+		this.generation = manifest.generation;
+	}
+	snapshot() {
+		return {
+			schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+			nodes: [...this.nodes.values()].map((node) => ({
+				...node,
+				dependencies: [...node.dependencies]
+			})).sort((left, right) => compareText(left.key, right.key)),
+			storedBytes: this.storedBytes
+		};
+	}
+	clear() {
+		const changed = this.logical.size > 0 || this.nodes.size > 0 || this.blobs.size > 0;
+		this.logical.clear();
+		this.nodes.clear();
+		this.blobs.clear();
+		this.storedBytes = 0;
+		if (changed) this.generation += 1;
+	}
+	async internInputs(inputs) {
+		return Promise.all(canonicalizeInputs(inputs).map(async (input) => {
+			const digest = await inputDigest(input);
+			const key = await sha256Hex(JSON.stringify({
+				schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+				kind: input.kind,
+				identity: input.identity,
+				digest
+			}));
+			const node = {
+				key,
+				kind: input.kind,
+				identity: input.identity,
+				digest,
+				dependencies: [],
+				byteLength: input.bytes?.byteLength ?? 0
+			};
+			this.nodes.set(key, node);
+			return node;
+		}));
+	}
+	ensureCapacity(incomingBytes, incomingDigest) {
+		if (this.blobs.has(incomingDigest)) return false;
+		let changed = false;
+		while (this.storedBytes + incomingBytes > this.limitBytes && this.blobs.size > 0) {
+			const oldestDigest = this.blobs.keys().next().value;
+			const oldest = this.blobs.get(oldestDigest);
+			this.blobs.delete(oldestDigest);
+			this.storedBytes -= oldest.byteLength;
+			changed = true;
+			for (const [key, node] of this.nodes) {
+				if (node.digest !== oldestDigest || node.dependencies.length === 0) continue;
+				this.nodes.delete(key);
+				for (const [logicalKey, manifest] of this.logical) if (manifest.nodeKey === key) this.logical.delete(logicalKey);
+			}
+		}
+		return changed;
+	}
+};
+function sameNode(left, right) {
+	return left?.key === right.key && left.kind === right.kind && left.identity === right.identity && left.digest === right.digest && left.byteLength === right.byteLength && left.dependencies.length === right.dependencies.length && left.dependencies.every((dependency, index) => dependency === right.dependencies[index]);
+}
+function sameLogicalManifest(left, right) {
+	return left?.kind === right.kind && left.nodeKey === right.nodeKey && left.dependencies.length === right.dependencies.length && left.dependencies.every((dependency, index) => dependency.kind === right.dependencies[index]?.kind && dependency.identity === right.dependencies[index]?.identity);
+}
+function canonicalizeInputs(inputs) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	for (const input of inputs) {
+		if (!input.identity || input.identity !== input.identity.trim() || input.identity.length > 16384) throw new Error("Build graph input identities must be non-empty, trimmed strings.");
+		if (byIdentity.has(input.identity)) throw new Error(`Duplicate build graph input '${input.identity}'.`);
+		if (input.bytes === void 0 === (input.digest === void 0)) throw new Error(`Build graph input '${input.identity}' must provide exactly one of bytes or digest.`);
+		byIdentity.set(input.identity, input);
+	}
+	return [...byIdentity.values()].sort((left, right) => compareText(left.identity, right.identity));
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+async function inputDigest(input) {
+	if (input.bytes) return sha256Hex(input.bytes);
+	if (!/^[0-9a-f]{64}$/.test(input.digest)) throw new Error(`Build graph input '${input.identity}' has an invalid digest.`);
+	return input.digest;
+}
+function structuralKey(kind, logicalKey, dependencies) {
+	return sha256Hex(JSON.stringify({
+		schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+		kind,
+		logicalKey,
+		dependencies
+	}));
+}
+//#endregion
+//#region src/compiler/clang-object-cache.ts
+var decoder$2 = new TextDecoder();
+/**
+* Content-addressed direct-mode cache for Clang translation units.
+*
+* Unit identity includes the frozen argv manifest and source digest. Every
+* project dependency from Clang's dependency file is rehashed before reuse.
+* System headers are covered by the pinned toolchain identity.
+*/
+var ClangObjectCache = class {
+	graph;
+	constructor(limitBytes) {
+		this.graph = new IncrementalBuildGraph(limitBytes);
+	}
+	async unitManifestKey(pins, configKey, source, sourceBytes) {
+		const config = pins.configs[configKey];
+		if (!config) throw new Error(`Unknown pinned Clang configuration '${configKey}'.`);
+		return sha256Hex(JSON.stringify({
+			schema: WASM_OJ_SCHEMAS.objectCache,
+			pinsSha256: CLANG_CC1_PINS_SHA256,
+			sourceToolchainSha256: pins.sourceSha256,
+			packageSha256: CLANG_PACKAGE_SHA256,
+			version: pins.version,
+			config: configKey,
+			cc1Argv: config.cc1,
+			unit: source,
+			source: await sha256Hex(sourceBytes)
+		}));
+	}
+	async lookup(manifestKey, projectFiles, additionalInputs = []) {
+		return this.graph.lookup(manifestKey, availableInputs(projectFiles, additionalInputs));
+	}
+	async store(manifestKey, dependencyPaths, projectFiles, object, additionalInputs = []) {
+		const normalized = normalizeProjectDependencies(dependencyPaths, projectFiles);
+		if (!normalized) return false;
+		return this.graph.store("object", manifestKey, [...graphInputs(normalized, projectFiles), ...additionalInputs], object);
+	}
+	async lookupPch(manifestKey, projectFiles) {
+		return this.graph.lookup(manifestKey, availableInputs(projectFiles));
+	}
+	async storePch(manifestKey, dependencyPaths, projectFiles, pch) {
+		const normalized = normalizeProjectDependencies(dependencyPaths, projectFiles);
+		if (!normalized) return false;
+		return this.graph.store("pch", manifestKey, graphInputs(normalized, projectFiles), pch);
+	}
+	lookupLink(manifestKey, objects) {
+		return this.graph.lookupExact("link-result", manifestKey, withToolchain(objects));
+	}
+	storeLink(manifestKey, objects, wasm) {
+		return this.graph.store("link-result", manifestKey, withToolchain(objects), wasm);
+	}
+	snapshot() {
+		return this.graph.snapshot();
+	}
+	exportState() {
+		return this.graph.exportState();
+	}
+	restoreState(state) {
+		return this.graph.restoreState(state);
+	}
+	clear() {
+		this.graph.clear();
+	}
+};
+function parseClangDependencyFile(bytes) {
+	const joined = decoder$2.decode(bytes).replace(/\\\r?\n/g, " ");
+	const colon = joined.indexOf(":");
+	if (colon < 0) return [];
+	const deps = [];
+	const pattern = /(?:\\.|[^\s\\])+/g;
+	const remainder = joined.slice(colon + 1);
+	for (let match = pattern.exec(remainder); match; match = pattern.exec(remainder)) deps.push(match[0].replace(/\\(.)/g, "$1"));
+	return deps;
+}
+function normalizeProjectDependencies(dependencyPaths, projectFiles) {
+	const normalized = /* @__PURE__ */ new Set();
+	for (const raw of dependencyPaths) {
+		if (raw.startsWith("/usr/") || raw.startsWith("/sysroot/") || raw.startsWith("/lib/")) continue;
+		const path = raw.startsWith("/project/") ? raw.slice(9) : raw.replace(/^\.\//, "");
+		if (!path || path.startsWith("/") || path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) return;
+		if (!projectFiles.has(path)) return void 0;
+		normalized.add(path);
+	}
+	if (normalized.size === 0) return void 0;
+	return [...normalized].sort();
+}
+function fileKind(path) {
+	return /\.(?:c|cc|cpp|cxx)$/i.test(path) ? "source" : "header";
+}
+function graphInputs(paths, projectFiles) {
+	return withToolchain(paths.map((path) => ({
+		kind: fileKind(path),
+		identity: path,
+		bytes: projectFiles.get(path)
+	})));
+}
+function withToolchain(inputs) {
+	return [...inputs, {
+		kind: "package",
+		identity: `cpp:clang@${CLANG_PACKAGE_SHA256}`,
+		digest: CLANG_PACKAGE_SHA256
+	}];
+}
+function availableInputs(projectFiles, additionalInputs = []) {
+	const inputs = new Map([...projectFiles].map(([path, bytes]) => [path, {
+		kind: fileKind(path),
+		identity: path,
+		bytes
+	}]));
+	inputs.set(`cpp:clang@${CLANG_PACKAGE_SHA256}`, {
+		kind: "package",
+		identity: `cpp:clang@${CLANG_PACKAGE_SHA256}`,
+		digest: CLANG_PACKAGE_SHA256
+	});
+	for (const input of additionalInputs) inputs.set(input.identity, input);
+	return inputs;
+}
+//#endregion
+//#region src/core/resources.ts
+/** The weighted meter defined by the active WASM-OJ contract. */
+var WEIGHTED_METER_MODEL$1 = "weighted";
+Math.floor(Number.MAX_SAFE_INTEGER / 1e6);
+Object.freeze({
+	instructionBudget: 1e10,
+	logicalTimeLimitMs: 6e4,
+	memoryLimitBytes: 268435456,
+	outputLimitBytes: 4194304,
+	filesystemWriteLimitBytes: 67108864,
+	filesystemEntryLimit: 4096,
+	wallTimeLimitMs: 6e4
+});
+new TextEncoder();
+Object.freeze({
+	runtimeCoreWasmSha256: "92500f3a2e65fe6979e893179d8000e12d66822c160eeb779b0d4fe0a6b55603",
+	runtimeSourceRootSha256: "3ef42cb2c70e7013e4a6f9d4d7457a7071101795fbd3753efcd20c1ac338ebd5",
+	wasmerNativeVersion: "7.2.1",
+	wasmerSdkVersion: "0.10.0",
+	wasmerSdkWasmSha256: "49a6646209f5ab5e7c737eac33407d87d9a9959ac83e5ecaaab9261b2323589e",
+	wasmerWasixVersion: "0.702.1"
+});
+/**
+* SHA-256 of `runtimeIdentityBytes()`.
+* Release verification independently checks the component bytes before this
+* identity is admitted into a calibrated release.
+*/
+var WASM_OJ_RUNTIME_IDENTITY_SHA256 = "24c0bcff9820fbfd1fd4db1c57e2a866b83041409dd22b5b725688739bd3e223";
+//#endregion
+//#region src/core/cost-profile.ts
+function coordinates(language, target, optimization) {
+	assertLanguageIdentifier(language);
+	return [
+		"wasm-oj-cost",
+		`contract-${WASM_OJ_CONTRACT_VERSION}`,
+		encodeURIComponent(language),
+		target,
+		optimization
+	];
+}
+/** Stable identity for one calibrated compiler/runtime overhead profile. */
+function costProfileId(language, target, optimization, downstreamToolchainContent) {
+	const content = isBuiltinLanguage(language) ? toolchainContentIdentity(language) : downstreamToolchainContent;
+	if (!content || !/^[A-Za-z0-9._-]+$/.test(content)) throw new Error(isBuiltinLanguage(language) ? `WASM-OJ toolchain content identity is invalid for '${language}'.` : `Downstream language '${language}' requires an explicit content identity using letters, digits, '.', '_' or '-'.`);
+	return [
+		...coordinates(language, target, optimization),
+		`content-${content}`,
+		`runtime-${WASM_OJ_RUNTIME_IDENTITY_SHA256}`,
+		WEIGHTED_METER_MODEL$1
+	].join(":");
+}
+//#endregion
+//#region src/core/diagnostics.ts
+function severity(value) {
+	if (value === "warning") return "warning";
+	if (value === "note" || value === "info") return "info";
+	return "error";
+}
+function projectPath(path) {
+	return path.replace(/^file:\/\//, "").replace(/^\/?(?:workspace|project|work)\//, "").replace(/^\.\//, "");
+}
+function parseClangDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?):(\d+):(\d+):\s+(fatal error|error|warning|note):\s+(.+?)(?:\s+\[([^\]]+)\])?$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3]),
+		severity: severity(match[4].replace("fatal ", "")),
+		message: match[5],
+		source: "clang",
+		code: match[6]
+	});
+	return diagnostics;
+}
+function parsePythonDiagnostics(output) {
+	const diagnostics = [];
+	const lines = output.split(/\r?\n/);
+	for (let index = 0; index < lines.length; index += 1) {
+		const location = lines[index].match(/^\s*File "([^"]+)", line (\d+)/);
+		if (!location) continue;
+		let column = 1;
+		let message = "Python compilation failed";
+		const caret = (lines[index + 2] ?? "").indexOf("^");
+		if (caret >= 0) column = caret + 1;
+		for (let cursor = index + 1; cursor < Math.min(lines.length, index + 6); cursor += 1) {
+			const error = lines[cursor].match(/^([A-Za-z]+(?:Error|Exception)):\s*(.+)$/);
+			if (error) {
+				message = `${error[1]}: ${error[2]}`;
+				break;
+			}
+		}
+		diagnostics.push({
+			file: projectPath(location[1]),
+			line: Number(location[2]),
+			column,
+			severity: "error",
+			message,
+			source: "python"
+		});
+	}
+	return diagnostics;
+}
+function parseTypeScriptDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?)\((\d+),(\d+)\):\s+(error|warning|message)\s+TS(\d+):\s+(.+)$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		severity: severity(match[4]),
+		message: match[6],
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3]),
+		source: "typescript",
+		code: `TS${match[5]}`
+	});
+	return diagnostics;
+}
+function parseRustDiagnostics(output) {
+	const diagnostics = [];
+	for (const line of output.split(/\r?\n/)) {
+		if (!line.startsWith("{")) continue;
+		let value;
+		try {
+			value = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (!value || typeof value !== "object") continue;
+		const record = value;
+		if (record.$message_type !== "diagnostic" || typeof record.message !== "string") continue;
+		const spans = Array.isArray(record.spans) ? record.spans : [];
+		const location = spans.find((candidate) => candidate && typeof candidate === "object" && candidate.is_primary === true) ?? spans.find((candidate) => candidate && typeof candidate === "object");
+		const code = record.code && typeof record.code === "object" ? record.code.code : void 0;
+		diagnostics.push({
+			severity: severity(typeof record.level === "string" ? record.level : "error"),
+			message: record.message,
+			file: projectPath(typeof location?.file_name === "string" ? location.file_name : "main.rs"),
+			line: typeof location?.line_start === "number" ? location.line_start : 1,
+			column: typeof location?.column_start === "number" ? location.column_start : 1,
+			endLine: typeof location?.line_end === "number" ? location.line_end : void 0,
+			endColumn: typeof location?.column_end === "number" ? location.column_end : void 0,
+			source: "rustc",
+			code: typeof code === "string" ? code : void 0
+		});
+	}
+	return diagnostics;
+}
+function parseGoDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?\.go):(\d+)(?::(\d+))?:\s*(.+)$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		severity: "error",
+		message: match[4],
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3] ?? 1),
+		source: "go"
+	});
+	return diagnostics;
+}
+function ensureFailureDiagnostic(diagnostics, summary) {
+	if (diagnostics.length > 0) return diagnostics;
+	return [{
+		severity: "error",
+		file: projectPath(summary.file),
+		line: 1,
+		column: 1,
+		source: summary.source,
+		message: summary.message
+	}];
+}
+//#endregion
+//#region src/compiler/libcxx-pch.ts
+var WASM_OJ_LIBCXX_PCH_HEADER = `#pragma once
+#include <algorithm>
+#include <array>
+#include <bitset>
+#include <cassert>
+#include <cctype>
+#include <cerrno>
+#include <cfloat>
+#include <charconv>
+#include <chrono>
+#include <climits>
+#include <cmath>
+#include <compare>
+#include <concepts>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <exception>
+#include <functional>
+#include <iomanip>
+#include <ios>
+#include <iostream>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <memory>
+#include <numeric>
+#include <optional>
+#include <queue>
+#include <random>
+#include <ranges>
+#include <set>
+#include <span>
+#include <sstream>
+#include <stack>
+#include <string>
+#include <string_view>
+#include <tuple>
+#include <type_traits>
+#include <unordered_map>
+#include <unordered_set>
+#include <utility>
+#include <variant>
+#include <vector>
+`;
+var decoder$1 = new TextDecoder();
+async function decodeLibcxxPchManifest(bytes) {
+	const digest = await sha256Hex(bytes);
+	if (digest !== "d126c99e951a7302d4ea2b66da4ed64d3d74e9d319d562518867c8d8c97a06b8") throw new Error(`Pinned libc++ PCH manifest digest mismatch: expected ${CLANG_LIBCXX_PCH_MANIFEST_SHA256}, received ${digest}.`);
+	let value;
+	try {
+		value = JSON.parse(decoder$1.decode(bytes));
+	} catch (error) {
+		throw new Error("Pinned libc++ PCH manifest is not valid JSON.", { cause: error });
+	}
+	if (!isRecord$1(value) || value.schema !== WASM_OJ_SCHEMAS.clangLibcxxPch || value.version !== "22.0.0-git20542-10" || value.clangPackageSha256 !== "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224" || value.clangPinsSha256 !== "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72" || value.header !== WASM_OJ_LIBCXX_PCH_HEADER || !isRecord$1(value.profiles)) throw new Error("Pinned libc++ PCH manifest is not admitted by the active Clang toolchain contract.");
+	if (value.headerSha256 !== await sha256Hex(WASM_OJ_LIBCXX_PCH_HEADER)) throw new Error("Pinned libc++ PCH header digest does not match its canonical source.");
+	const manifestProfiles = value.profiles;
+	const profiles = Object.fromEntries(await Promise.all(["cpp-debug", "cpp-release"].map(async (profile) => {
+		const asset = manifestProfiles[profile];
+		if (!isRecord$1(asset) || typeof asset.path !== "string" || !asset.path.endsWith(`.${profile}.pch.gz.bin`) || !isBytes(asset.byteLength) || !isBytes(asset.compressedByteLength) || !isSha256(asset.sha256) || !isSha256(asset.compressedSha256)) throw new Error(`Pinned libc++ PCH profile '${profile}' is malformed.`);
+		return [profile, {
+			path: asset.path,
+			byteLength: asset.byteLength,
+			sha256: asset.sha256,
+			compressedByteLength: asset.compressedByteLength,
+			compressedSha256: asset.compressedSha256
+		}];
+	})));
+	if (Object.keys(manifestProfiles).sort().join(",") !== "cpp-debug,cpp-release") throw new Error("Pinned libc++ PCH manifest has an unexpected profile set.");
+	return {
+		schema: WASM_OJ_SCHEMAS.clangLibcxxPch,
+		version: CLANG_VERSION,
+		clangPackageSha256: CLANG_PACKAGE_SHA256,
+		clangPinsSha256: CLANG_CC1_PINS_SHA256,
+		header: WASM_OJ_LIBCXX_PCH_HEADER,
+		headerSha256: value.headerSha256,
+		profiles
+	};
+}
+function isToolchainLibcxxPchHeader(contents) {
+	return contents === WASM_OJ_LIBCXX_PCH_HEADER;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSha256(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function isBytes(value) {
+	return Number.isSafeInteger(value) && value > 0;
+}
+Object.freeze({
+	randomSeed: 1592594996,
+	realtimeEpochMs: Date.UTC(2e3, 0, 1),
+	clockStepNs: 1e6
+});
+//#endregion
+//#region src/runtime/determinism.ts
+var DETERMINISTIC_NATIVE_SOURCE_PATH = ".wasm-oj/determinism.c";
+var PYTHON_RUNNER_PATH = ".wasm-oj/deterministic_runner.py";
+var DETERMINISTIC_NATIVE_RUNTIME = String.raw`
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+static uint32_t wasm_oj_random_state;
+static int wasm_oj_initialized;
+
+static uint64_t wasm_oj_parse_u64(const char *value) {
+    if (!value || !*value) abort();
+    uint64_t result = 0;
+    for (const unsigned char *cursor = (const unsigned char *)value; *cursor; ++cursor) {
+        if (*cursor < '0' || *cursor > '9') abort();
+        uint64_t digit = (uint64_t)(*cursor - '0');
+        if (result > (UINT64_MAX - digit) / 10) abort();
+        result = result * 10 + digit;
+    }
+    return result;
+}
+
+static void wasm_oj_initialize(void) {
+    if (wasm_oj_initialized) return;
+    uint64_t seed = wasm_oj_parse_u64(getenv("WASM_OJ_RANDOM_SEED"));
+    wasm_oj_random_state = (uint32_t)seed;
+    wasm_oj_initialized = 1;
+}
+
+static uint32_t wasm_oj_next_u32(void) {
+    wasm_oj_random_state += 0x9e3779b9u;
+    uint32_t value = wasm_oj_random_state;
+    value ^= value >> 16;
+    value *= 0x21f0aaadu;
+    value ^= value >> 15;
+    value *= 0x735a2d97u;
+    value ^= value >> 15;
+    return value;
+}
+
+uint32_t __imported_wasi_snapshot_preview1_random_get(uint8_t *buffer, size_t length) {
+    wasm_oj_initialize();
+    uint32_t word = 0;
+    for (size_t index = 0; index < length; ++index) {
+        if ((index & 3u) == 0) word = wasm_oj_next_u32();
+        buffer[index] = (uint8_t)(word >> ((index & 3u) * 8u));
+    }
+    return 0;
+}
+
+#ifdef __cplusplus
+}
+#endif
+`;
+var PYTHON_DETERMINISTIC_RUNNER = String.raw`
+import os as _os
+import runpy as _runpy
+import sys as _sys
+
+_random_state = None
+
+def _random_seed():
+    global _random_state
+    if _random_state is None:
+        _random_state = int(_os.environ["WASM_OJ_RANDOM_SEED"]) & 0xffffffff
+    return _random_state
+
+def _next_u32():
+    global _random_state
+    _random_seed()
+    _random_state = (_random_state + 0x9e3779b9) & 0xffffffff
+    value = _random_state
+    value ^= value >> 16
+    value = (value * 0x21f0aaad) & 0xffffffff
+    value ^= value >> 15
+    value = (value * 0x735a2d97) & 0xffffffff
+    value ^= value >> 15
+    return value & 0xffffffff
+
+def _urandom(length):
+    if not isinstance(length, int) or length < 0:
+        raise ValueError("negative argument not allowed")
+    output = bytearray(length)
+    word = 0
+    for index in range(length):
+        if index % 4 == 0:
+            word = _next_u32()
+        output[index] = (word >> ((index % 4) * 8)) & 0xff
+    return bytes(output)
+
+_os.urandom = _urandom
+if hasattr(_os, "getrandom"):
+    _os.getrandom = lambda size, flags=0: _urandom(size)
+
+_entry = _sys.argv[1]
+_sys.argv = [_entry, *_sys.argv[2:]]
+_runpy.run_path(_entry, run_name="__main__")
+`;
+/**
+* Accept a mounted output only after byte-identical snapshots have persisted for
+* the complete stability interval. This prevents a valid WebAssembly prefix
+* from being mistaken for the command's final output.
+*/
+var MountedOutputStabilityObserver = class {
+	#stabilityMs;
+	#candidate;
+	#candidateSince = 0;
+	constructor(stabilityMs = 75) {
+		if (!Number.isFinite(stabilityMs) || stabilityMs <= 0) throw new RangeError("Mounted-output stability interval must be positive and finite.");
+		this.#stabilityMs = stabilityMs;
+	}
+	observe(snapshot, monotonicMs) {
+		if (!Number.isFinite(monotonicMs)) throw new RangeError("Mounted-output observation time must be finite.");
+		if (!snapshot) {
+			this.#candidate = void 0;
+			this.#candidateSince = 0;
+			return;
+		}
+		if (!this.#candidate || !bytesEqual(this.#candidate, snapshot)) {
+			this.#candidate = snapshot.slice();
+			this.#candidateSince = monotonicMs;
+			return;
+		}
+		if (monotonicMs - this.#candidateSince < this.#stabilityMs) return void 0;
+		return snapshot.slice();
+	}
+};
+function bytesEqual(left, right) {
+	if (left.byteLength !== right.byteLength) return false;
+	for (let index = 0; index < left.byteLength; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+//#endregion
+//#region src/compiler/dependency-input.ts
+var ECOSYSTEM_BY_LANGUAGE = Object.freeze({
+	c: "cpp",
+	cpp: "cpp",
+	rust: "cargo",
+	python: "pypi",
+	javascript: "npm",
+	typescript: "npm",
+	go: "go"
+});
+function assertProjectDependencyEcosystem(project) {
+	if (!project.dependencies) return;
+	const expected = ECOSYSTEM_BY_LANGUAGE[project.config.language];
+	if (!expected) throw new Error(`Compiler '${project.config.language}' does not declare a dependency ecosystem.`);
+	const mismatch = project.dependencies.packages.find((item) => item.package.ecosystem !== expected);
+	if (mismatch) throw new Error(`${project.config.language} projects accept only '${expected}' dependencies; '${mismatch.package.id}' is '${mismatch.package.ecosystem}'.`);
+}
+function projectDependencyPackages(project, ecosystem) {
+	assertProjectDependencyEcosystem(project);
+	return project.dependencies?.packages.filter((item) => item.package.ecosystem === ecosystem) ?? [];
+}
+function pythonDependencyFiles(project) {
+	const sourceFiles = [];
+	const artifactFiles = {};
+	for (const item of projectDependencyPackages(project, "pypi")) for (const [path, bytes] of Object.entries(item.files)) {
+		const installedPath = `site-packages/${path}`;
+		artifactFiles[installedPath] = bytes.slice();
+		if (path.endsWith(".py")) sourceFiles.push({
+			path: installedPath,
+			language: "python",
+			content: decodeDependencyText(bytes, item.package.id, path)
+		});
+	}
+	return {
+		sourceFiles,
+		artifactFiles
+	};
+}
+function npmDependencyFiles(project) {
+	const files = {};
+	const names = /* @__PURE__ */ new Set();
+	const untyped = [];
+	for (const item of projectDependencyPackages(project, "npm")) {
+		if (names.has(item.package.name)) throw new Error(`npm dependency '${item.package.name}' resolves to multiple versions in a flat runtime graph.`);
+		names.add(item.package.name);
+		const manifestBytes = item.files["package.json"];
+		if (!manifestBytes) throw new Error(`npm dependency '${item.package.id}' omits package.json.`);
+		const manifestText = decodeDependencyText(manifestBytes, item.package.id, "package.json");
+		if (JSON.parse(manifestText).type === "module") throw new Error(`npm dependency '${item.package.id}' uses unsupported ESM package semantics.`);
+		if (!Object.keys(item.files).some((path) => path.endsWith(".d.ts"))) untyped.push(item.package.name);
+		for (const [path, bytes] of Object.entries(item.files)) {
+			const installedPath = `node_modules/${item.package.name}/${path}`;
+			files[installedPath] = isNpmTextPath(path) ? decodeDependencyText(bytes, item.package.id, path) : bytes.slice();
+		}
+	}
+	if (untyped.length > 0) files[".wasm-oj/npm-untyped-modules.d.ts"] = untyped.sort().flatMap((name) => [`declare module ${JSON.stringify(name)} { const value: any; export = value; }`, `declare module ${JSON.stringify(`${name}/*`)} { const value: any; export = value; }`]).join("\n");
+	return files;
+}
+function cppDependencyInput(project) {
+	const files = /* @__PURE__ */ new Map();
+	const includeDirectories = [];
+	const sources = [];
+	for (const [index, item] of projectDependencyPackages(project, "cpp").entries()) {
+		const root = `.wasm-oj/dependencies/cpp/${String(index).padStart(4, "0")}`;
+		includeDirectories.push(`/project/${root}`);
+		if (Object.keys(item.files).some((path) => path.startsWith("include/"))) includeDirectories.push(`/project/${root}/include`);
+		for (const [path, bytes] of Object.entries(item.files)) {
+			if (!isCppCompilerPath(path)) continue;
+			decodeDependencyText(bytes, item.package.id, path);
+			const installedPath = `${root}/${path}`;
+			files.set(installedPath, bytes.slice());
+			if (isCppSourcePath(path)) {
+				if (project.config.language === "c" && !path.endsWith(".c")) throw new Error(`C dependency '${item.package.id}' contains C++ source '${path}'.`);
+				sources.push(installedPath);
+			}
+		}
+	}
+	return {
+		files,
+		includeDirectories: Object.freeze(includeDirectories),
+		sources: Object.freeze(sources)
+	};
+}
+function rustDependencyInput(project) {
+	const packages = projectDependencyPackages(project, "cargo");
+	const packageById = new Map(packages.map((item) => [item.package.id, item]));
+	const ordered = topologicalPackages(packages);
+	const descriptorById = /* @__PURE__ */ new Map();
+	const files = [];
+	for (const [index, item] of ordered.entries()) {
+		const prefix = `.wasm-oj/dependencies/cargo/${String(index).padStart(4, "0")}`;
+		const manifestBytes = item.files["Cargo.toml"];
+		const manifest = decodeDependencyText(manifestBytes, item.package.id, "Cargo.toml");
+		if (/\bpackage\s*=\s*"/m.test(dependencySections(manifest))) throw new Error(`Cargo dependency '${item.package.id}' uses unsupported renamed dependencies.`);
+		const libSection = tomlSection(manifest, "lib");
+		const crateName = rustIdentifier(tomlString(libSection, "name") ?? item.package.name, item.package.id);
+		const rootRelative = tomlString(libSection, "path") ?? "src/lib.rs";
+		if (!item.files[rootRelative]) throw new Error(`Cargo dependency '${item.package.id}' omits '${rootRelative}'.`);
+		const edition = tomlString(tomlSection(manifest, "package"), "edition") ?? "2015";
+		if (!/^(?:2015|2018|2021|2024)$/.test(edition)) throw new Error(`Cargo dependency '${item.package.id}' has unsupported Rust edition '${edition}'.`);
+		const outputPath = `/work/build/deps/lib${String(index).padStart(4, "0")}_${crateName}.rlib`;
+		descriptorById.set(item.package.id, {
+			id: item.package.id,
+			crateName,
+			root: `${prefix}/${rootRelative}`,
+			edition,
+			outputPath,
+			features: Object.freeze([...item.package.features ?? []])
+		});
+		for (const [path, bytes] of Object.entries(item.files)) {
+			if (!isCargoCompilerText(path)) continue;
+			files.push({
+				path: `${prefix}/${path}`,
+				language: "rust",
+				content: decodeDependencyText(bytes, item.package.id, path)
+			});
+		}
+	}
+	const crates = ordered.map((item) => {
+		const descriptor = descriptorById.get(item.package.id);
+		return Object.freeze({
+			...descriptor,
+			externs: Object.freeze(item.package.dependencies.map((id) => {
+				const dependency = descriptorById.get(id);
+				if (!dependency) throw new Error(`Cargo dependency '${item.package.id}' refers to unavailable '${id}'.`);
+				return Object.freeze({
+					crateName: dependency.crateName,
+					path: dependency.outputPath
+				});
+			}))
+		});
+	});
+	const roots = project.dependencies?.lock.roots.map((id) => {
+		if (!packageById.has(id)) throw new Error(`Cargo root '${id}' is unavailable.`);
+		const descriptor = descriptorById.get(id);
+		return Object.freeze({
+			crateName: descriptor.crateName,
+			path: descriptor.outputPath
+		});
+	}) ?? [];
+	return {
+		files,
+		crates: Object.freeze(crates),
+		roots: Object.freeze(roots)
+	};
+}
+function goDependencyInput(project) {
+	const files = [];
+	const packages = [];
+	for (const [moduleIndex, item] of projectDependencyPackages(project, "go").entries()) {
+		const moduleRoot = `.wasm-oj/dependencies/go/${String(moduleIndex).padStart(4, "0")}`;
+		const directories = /* @__PURE__ */ new Map();
+		for (const [path, bytes] of Object.entries(item.files)) {
+			if (!path.endsWith(".go") || path.endsWith("_test.go") || path.split("/").includes("vendor")) continue;
+			const content = decodeDependencyText(bytes, item.package.id, path);
+			if (/^\s*\/\/(?:go:build|\s*\+build)\b/m.test(content)) throw new Error(`Go dependency '${item.package.id}' uses unsupported build constraints in '${path}'.`);
+			if (/import\s+(?:[._A-Za-z][A-Za-z0-9_]*\s+)?["`]C["`]/.test(content)) throw new Error(`Go dependency '${item.package.id}' uses unsupported cgo in '${path}'.`);
+			const directory = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+			const group = directories.get(directory) ?? [];
+			group.push({
+				path,
+				content
+			});
+			directories.set(directory, group);
+			files.push({
+				path: `${moduleRoot}/${path}`,
+				language: "go",
+				content
+			});
+		}
+		for (const [directory, sourceFiles] of [...directories].sort(([left], [right]) => left.localeCompare(right))) {
+			const packageNames = new Set(sourceFiles.map((file) => goPackageName(file.content, item.package.id, file.path)));
+			if (packageNames.size !== 1) throw new Error(`Go dependency '${item.package.id}' directory '${directory || "."}' contains multiple packages.`);
+			if ([...packageNames][0] === "main") continue;
+			const importPath = directory ? `${item.package.name}/${directory}` : item.package.name;
+			const index = packages.length;
+			packages.push(Object.freeze({
+				id: `${item.package.id}:${directory || "."}`,
+				importPath,
+				sourcePaths: Object.freeze(sourceFiles.map((file) => `${moduleRoot}/${file.path}`).sort()),
+				imports: Object.freeze([...new Set(sourceFiles.flatMap((file) => goImports(file.content)))].sort()),
+				archivePath: `/work/build/deps/${String(index).padStart(4, "0")}.a`
+			}));
+		}
+	}
+	return {
+		files,
+		packages: Object.freeze(packages)
+	};
+}
+function decodeDependencyText(bytes, id, path) {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		throw new Error(`Dependency '${id}' compiler file '${path}' is not valid UTF-8.`, { cause: error });
+	}
+}
+function isNpmTextPath(path) {
+	return /(?:^|\/)(?:package\.json)$/.test(path) || /\.(?:js|cjs|d\.ts|json)$/i.test(path);
+}
+function isCppCompilerPath(path) {
+	return /\.(?:h|hh|hpp|hxx|inc|c|cc|cpp|cxx)$/i.test(path);
+}
+function isCppSourcePath(path) {
+	return /\.(?:c|cc|cpp|cxx)$/i.test(path);
+}
+function topologicalPackages(packages) {
+	const byId = new Map(packages.map((item) => [item.package.id, item]));
+	const state = /* @__PURE__ */ new Map();
+	const ordered = [];
+	const visit = (id) => {
+		const current = state.get(id);
+		if (current === "visited") return;
+		if (current === "visiting") throw new Error(`Dependency graph contains a cycle at '${id}'.`);
+		const item = byId.get(id);
+		if (!item) throw new Error(`Dependency graph refers to unavailable package '${id}'.`);
+		state.set(id, "visiting");
+		for (const dependency of item.package.dependencies) visit(dependency);
+		state.set(id, "visited");
+		ordered.push(item);
+	};
+	for (const item of packages) visit(item.package.id);
+	return ordered;
+}
+function tomlSection(manifest, name) {
+	return manifest.match(new RegExp(`(?:^|\\n)\\[${name.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}\\]\\s*\\n([\\s\\S]*?)(?=\\n\\[|$)`))?.[1] ?? "";
+}
+function tomlString(section, key) {
+	return section.match(new RegExp(`^\\s*${key}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?$`, "m"))?.[1];
+}
+function dependencySections(manifest) {
+	return manifest.split(/\n(?=\[)/).filter((section) => /\bdependencies\]/.test(section.split("\n", 1)[0])).join("\n");
+}
+function rustIdentifier(name, id) {
+	const normalized = name.replaceAll("-", "_");
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(normalized)) throw new Error(`Cargo dependency '${id}' has unsupported crate name '${name}'.`);
+	return normalized;
+}
+function isCargoCompilerText(path) {
+	return path.endsWith(".rs") || path.endsWith(".md") || path.endsWith(".txt") || path === "Cargo.toml";
+}
+function goPackageName(source, id, path) {
+	const match = source.match(/^\s*package\s+([A-Za-z_][A-Za-z0-9_]*)\b/m);
+	if (!match) throw new Error(`Go dependency '${id}' source '${path}' has no package declaration.`);
+	return match[1];
+}
+function goImports(source) {
+	const imports = [];
+	const blockPattern = /\bimport\s*\(([\s\S]*?)\)/g;
+	for (const block of source.matchAll(blockPattern)) for (const match of block[1].matchAll(/(?:^|\n)\s*(?:[._A-Za-z][A-Za-z0-9_]*\s+)?["`]([^"`]+)["`]/g)) imports.push(match[1]);
+	const withoutBlocks = source.replace(blockPattern, "");
+	for (const match of withoutBlocks.matchAll(/\bimport\s+(?:[._A-Za-z][A-Za-z0-9_]*\s+)?["`]([^"`]+)["`]/g)) imports.push(match[1]);
+	return imports;
+}
+//#endregion
+//#region src/compiler/sdk-direct-clang.ts
+var loadedToolchain;
+var loadedLibcxxPchManifest;
+var loadedLibcxxPch = /* @__PURE__ */ new Map();
+var objectCache = new ClangObjectCache(67108864);
+var encoder$2 = new TextEncoder();
+var decoder = new TextDecoder();
+var STAGE_OUTPUT_TIMEOUT_MS = 55e3;
+/**
+* Browser compiler that drives the pinned cc1 and wasm-ld jobs through
+* the official SDK threadpool while keeping every command and project volume
+* isolated. No Clang driver or guest subprocess is involved.
+*/
+async function buildClangWithSdkDirect(project, cacheKey, requestId, host) {
+	if (project.config.target !== "wasip1" && project.config.target !== "wasix") throw new Error("The output-ready Clang compiler accepts only wasip1 or wasix targets.");
+	if (project.config.language !== "c" && project.config.language !== "cpp") throw new Error("The output-ready Clang compiler accepts only C and C++ projects.");
+	const started = performance.now();
+	host.progress(requestId, "loading-toolchain", "Loading pinned Clang 22 toolchain", .15);
+	const { pins, compiler, linker } = await ensureToolchain(requestId, host);
+	const configKey = `${project.config.language}-${project.config.optimization}`;
+	const config = pins.configs[configKey];
+	if (!config) throw new Error(`The pinned Clang manifest has no '${configKey}' configuration.`);
+	host.trace(requestId, "filesystemPrepare", "start");
+	const projectFiles = new Map(project.files.map((file) => [file.path, encoder$2.encode(file.content)]));
+	const dependencies = cppDependencyInput(project);
+	for (const [path, bytes] of dependencies.files) projectFiles.set(path, bytes);
+	projectFiles.set(DETERMINISTIC_NATIVE_SOURCE_PATH, encoder$2.encode(DETERMINISTIC_NATIVE_RUNTIME));
+	const directory = new Directory(Object.fromEntries([...projectFiles].map(([path, bytes]) => [`/${path}`, bytes])));
+	try {
+		await ensureDirectory(directory, "/build");
+		await ensureDirectory(directory, "/.wasm-oj");
+		host.trace(requestId, "filesystemPrepare", "end");
+		const isCpp = project.config.language === "cpp";
+		const extensions = isCpp ? /\.(?:cc|cpp|cxx)$/ : /\.c$/;
+		const sources = project.files.filter((file) => extensions.test(file.path)).map((file) => file.path);
+		if (!sources.includes(project.config.entry)) sources.unshift(project.config.entry);
+		const units = [
+			...sources,
+			...dependencies.sources,
+			DETERMINISTIC_NATIVE_SOURCE_PATH
+		];
+		let stdout = "";
+		let stderr = "";
+		const objectPaths = [];
+		const objectInputs = [];
+		let objectCacheHits = 0;
+		let objectCacheStores = 0;
+		let pchHits = 0;
+		let pchMisses = 0;
+		let pchStores = 0;
+		let linkHits = 0;
+		let linkMisses = 0;
+		let linkStores = 0;
+		const structuredDiagnostics = [];
+		const pchHeader = isCpp ? findPrecompiledHeader(project) : void 0;
+		const pchPath = "/project/build/wasm-oj.pch";
+		let pchInput;
+		let admittedPch = false;
+		if (pchHeader) {
+			const headerBytes = projectFiles.get(pchHeader);
+			let pch;
+			if (isToolchainLibcxxPchHeader(decoder.decode(headerBytes))) {
+				admittedPch = true;
+				const reservedHeader = "wasm-oj.libcxx.hpp";
+				if (projectFiles.has(reservedHeader)) throw new Error(`C++ projects using WASM-OJ's admitted libc++ PCH may not define reserved path '${reservedHeader}'.`);
+				projectFiles.set(reservedHeader, headerBytes);
+				await directory.writeFile(`/${reservedHeader}`, headerBytes);
+				pch = await loadLibcxxPch(configKey, requestId, host);
+				pchHits += 1;
+				await directory.writeFile(pchPath.slice(8), pch);
+			} else {
+				const baseKey = await objectCache.unitManifestKey(pins, configKey, pchHeader, headerBytes);
+				const pchManifestKey = await sha256Hex(JSON.stringify({
+					baseKey,
+					mode: "c++-header"
+				}));
+				const cached = await objectCache.lookupPch(pchManifestKey, projectFiles);
+				if (cached) {
+					pch = cached;
+					pchHits += 1;
+					await directory.writeFile(pchPath.slice(8), pch);
+				} else {
+					pchMisses += 1;
+					const dependencyPath = "/project/build/wasm-oj.pch.d";
+					const args = instantiateClangPch(config.cc1, pins.placeholders, pchHeader, pchPath);
+					args.splice(args.length - 1, 0, ...dependencies.includeDirectories.flatMap((directory) => ["-I", directory]));
+					args.push("-dependency-file", dependencyPath, "-MT", pchPath);
+					const output = await runPchStage(compiler, args, directory, host, requestId, pchPath, dependencyPath);
+					structuredDiagnostics.push(...output.diagnostics);
+					stdout += output.stdout;
+					stderr += output.stderr;
+					if (!output.pch || !output.dependency) return failedBuild(project, stdout, stderr, 1, "clang", structuredDiagnostics);
+					pch = output.pch;
+					if (await objectCache.storePch(pchManifestKey, parseClangDependencyFile(output.dependency), projectFiles, pch)) pchStores += 1;
+				}
+			}
+			pchInput = {
+				kind: "pch",
+				identity: `pch:${pchHeader}`,
+				digest: await sha256Hex(pch)
+			};
+		}
+		host.progress(requestId, "compiling", `Compiling ${units.length} translation units with SDK-direct cc1`, .35);
+		host.trace(requestId, "commandStart", "start");
+		host.trace(requestId, "commandStart", "end");
+		host.trace(requestId, "commandWait", "start");
+		host.trace(requestId, "projectCompile", "start");
+		for (const [index, source] of units.entries()) {
+			if (source === ".wasm-oj/determinism.c") {
+				host.trace(requestId, "projectCompile", "end");
+				host.trace(requestId, "runtimeShimCompile", "start");
+			}
+			const objectPath = `/project/build/${String(index).padStart(4, "0")}.o`;
+			const dependencyPath = `/project/build/${String(index).padStart(4, "0")}.d`;
+			const sourceBytes = projectFiles.get(source);
+			if (!sourceBytes) throw new Error(`SDK-direct Clang is missing source bytes for '${source}'.`);
+			const baseManifestKey = await objectCache.unitManifestKey(pins, configKey, source, sourceBytes);
+			const unitPchInput = source !== ".wasm-oj/determinism.c" ? pchInput : void 0;
+			const manifestKey = unitPchInput ? await sha256Hex(JSON.stringify({
+				baseManifestKey,
+				pch: unitPchInput.digest
+			})) : baseManifestKey;
+			const additionalInputs = unitPchInput ? [unitPchInput] : [];
+			const cached = await objectCache.lookup(manifestKey, projectFiles, additionalInputs);
+			if (cached) {
+				await directory.writeFile(objectPath.slice(8), cached);
+				objectCacheHits += 1;
+				objectPaths.push(objectPath);
+				objectInputs.push({
+					kind: "object",
+					identity: source,
+					bytes: cached
+				});
+				continue;
+			}
+			const args = instantiateClangCc1(config.cc1, pins.placeholders, source, objectPath);
+			args.splice(args.length - 1, 0, ...dependencies.includeDirectories.flatMap((directory) => ["-I", directory]));
+			if (unitPchInput) args.splice(args.length - 1, 0, "-include-pch", pchPath, ...admittedPch ? ["-fno-validate-pch"] : []);
+			args.push("-dependency-file", dependencyPath, "-MT", objectPath);
+			const output = await runClangStage(compiler, args, directory, host, requestId, source === ".wasm-oj/determinism.c" ? "runtimeShimSpawn" : "projectSpawn", source === ".wasm-oj/determinism.c" ? "runtimeShimWait" : "projectWait", source === ".wasm-oj/determinism.c" ? "runtimeShimOutputReady" : "projectOutputReady", objectPath, dependencyPath);
+			structuredDiagnostics.push(...output.diagnostics);
+			stdout += output.stdout;
+			stderr += output.stderr;
+			if (!output.object || !output.dependency) {
+				host.trace(requestId, source === ".wasm-oj/determinism.c" ? "runtimeShimCompile" : "projectCompile", "end");
+				host.trace(requestId, "commandWait", "end");
+				return failedBuild(project, stdout, stderr, 1, "clang", structuredDiagnostics);
+			}
+			if (output.diagnostics.length === 0 && await objectCache.store(manifestKey, parseClangDependencyFile(output.dependency), projectFiles, output.object, additionalInputs)) objectCacheStores += 1;
+			objectPaths.push(objectPath);
+			objectInputs.push({
+				kind: "object",
+				identity: source,
+				bytes: output.object
+			});
+		}
+		host.trace(requestId, "runtimeShimCompile", "end");
+		host.progress(requestId, "linking", "Linking SDK-direct Clang objects", .8);
+		host.trace(requestId, "link", "start");
+		const outputPath = "/project/build/app.wasm";
+		const linkArguments = instantiateClangLink(config.link, pins.placeholders, objectPaths, outputPath);
+		const linkManifestKey = await sha256Hex(JSON.stringify({
+			pins: pins.sourceSha256,
+			package: CLANG_PACKAGE_SHA256,
+			target: project.config.target,
+			arguments: config.link
+		}));
+		let bytes = await objectCache.lookupLink(linkManifestKey, objectInputs);
+		let linkedStdout = "";
+		let linkedStderr = "";
+		if (bytes) linkHits += 1;
+		else {
+			linkMisses += 1;
+			const linked = await runLinkStage(linker, linkArguments, directory, host, requestId, "linkSpawn", "linkWait", "linkOutputReady", outputPath);
+			linkedStdout = linked.stdout;
+			linkedStderr = linked.stderr;
+			bytes = linked.value;
+			if (bytes && await objectCache.storeLink(linkManifestKey, objectInputs, bytes)) linkStores += 1;
+		}
+		host.trace(requestId, "link", "end");
+		host.trace(requestId, "commandWait", "end");
+		stdout += linkedStdout;
+		stderr += linkedStderr;
+		if (!bytes) return failedBuild(project, stdout, stderr, 1, "wasm-ld", structuredDiagnostics);
+		host.progress(requestId, "linking", "Reading linked WebAssembly module", .95);
+		host.trace(requestId, "artifactReadback", "start");
+		host.trace(requestId, "artifactReadback", "end");
+		return {
+			success: true,
+			diagnostics: structuredDiagnostics,
+			artifact: {
+				kind: "wasm",
+				wasmOjContract: WASM_OJ_CONTRACT_VERSION,
+				id: crypto.randomUUID(),
+				projectId: project.id,
+				cacheKey,
+				name: `${project.name}.wasm`,
+				language: project.config.language,
+				target: project.config.target,
+				optimization: project.config.optimization,
+				createdAt: Date.now(),
+				durationMs: performance.now() - started,
+				size: bytes.byteLength,
+				toolchains: toolchainPackageIdentities(project.config.language),
+				costProfile: costProfileId(project.config.language, project.config.target, project.config.optimization),
+				...project.dependencies === void 0 ? {} : { dependencyLockSha256: project.dependencies.lockSha256 },
+				bytes
+			},
+			stdout,
+			stderr,
+			cacheHit: false,
+			buildGraph: {
+				hits: {
+					pch: pchHits,
+					object: objectCacheHits,
+					"link-result": linkHits
+				},
+				misses: {
+					pch: pchMisses,
+					object: units.length - objectCacheHits,
+					"link-result": linkMisses
+				},
+				stores: {
+					pch: pchStores,
+					object: objectCacheStores,
+					"link-result": linkStores
+				}
+			}
+		};
+	} finally {
+		directory.free();
+	}
+}
+async function clearSdkDirectClangCaches() {
+	await disposeSdkDirectClangToolchain();
+	loadedLibcxxPchManifest = void 0;
+	loadedLibcxxPch.clear();
+	objectCache.clear();
+}
+/** Release all SDK resources tied to one Runtime while preserving object-cache bytes. */
+async function disposeSdkDirectClangToolchain() {
+	const pending = loadedToolchain;
+	loadedToolchain = void 0;
+	if (!pending) return;
+	const { pkg, compiler, linker } = await pending;
+	compiler.free();
+	linker.free();
+	pkg.free();
+}
+async function ensureToolchain(requestId, host) {
+	if (loadedToolchain) {
+		for (const operation of [
+			"toolchainFetch",
+			"toolchainDecode",
+			"toolchainLoad"
+		]) {
+			host.trace(requestId, operation, "start");
+			host.trace(requestId, operation, "end");
+		}
+		return loadedToolchain;
+	}
+	loadedToolchain = (async () => {
+		host.trace(requestId, "toolchainFetch", "start");
+		const [packageBytes, pinsBytes] = await Promise.all([host.loadToolchainAsset(CLANG_PACKAGE_ASSET_PATH), host.loadToolchainFile(CLANG_CC1_PINS_ASSET_PATH)]);
+		host.trace(requestId, "toolchainFetch", "end");
+		host.trace(requestId, "toolchainDecode", "start");
+		const pins = await decodeClangPins(pinsBytes);
+		const packageSha256 = await sha256Hex(packageBytes);
+		if (packageSha256 !== "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224") throw new Error(`Pinned Clang package digest mismatch: received ${packageSha256}.`);
+		host.trace(requestId, "toolchainDecode", "end");
+		host.trace(requestId, "toolchainLoad", "start");
+		const pkg = await Wasmer.fromFile(packageBytes, host.runtime);
+		const compiler = requireCommand(pkg, pins.command);
+		const linker = requireCommand(pkg, pins.linkerCommand);
+		host.trace(requestId, "toolchainLoad", "end");
+		return {
+			pkg,
+			pins,
+			compiler,
+			linker
+		};
+	})();
+	try {
+		return await loadedToolchain;
+	} catch (error) {
+		loadedToolchain = void 0;
+		throw error;
+	}
+}
+function requireCommand(pkg, name) {
+	const selected = pkg.commands[name];
+	if (!selected) throw new Error(`The SDK-direct Clang package does not expose '${name}'.`);
+	return selected;
+}
+async function loadLibcxxPch(profile, requestId, host) {
+	loadedLibcxxPchManifest ??= host.loadToolchainFile(CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH).then(decodeLibcxxPchManifest);
+	let pending = loadedLibcxxPch.get(profile);
+	if (!pending) {
+		pending = loadedLibcxxPchManifest.then(async (manifest) => {
+			const asset = manifest.profiles[profile];
+			host.progress(requestId, "loading-toolchain", `Loading admitted libc++ PCH (${profile})`, .25);
+			const bytes = await host.loadToolchainAsset(`/toolchains/${asset.path}`);
+			if (bytes.byteLength !== asset.byteLength || await sha256Hex(bytes) !== asset.sha256) throw new Error(`Pinned libc++ PCH '${profile}' failed decompressed integrity verification.`);
+			return bytes;
+		});
+		loadedLibcxxPch.set(profile, pending);
+	}
+	try {
+		return await pending;
+	} catch (error) {
+		loadedLibcxxPch.delete(profile);
+		throw error;
+	}
+}
+function findPrecompiledHeader(project) {
+	const headers = project.files.map((file) => file.path).filter((path) => path.split("/").at(-1) === "wasm-oj.pch.hpp");
+	if (headers.length > 1) throw new Error(`C++ projects may contain at most one wasm-oj.pch.hpp; received ${headers.join(", ")}.`);
+	return headers[0];
+}
+function runPchStage(command, args, directory, host, requestId, outputPath, dependencyPath) {
+	const stability = new MountedOutputStabilityObserver();
+	return runUntilOutputReady(command, args, directory, host, requestId, "projectSpawn", "projectWait", "projectOutputReady", async (capturedStderr) => {
+		const [snapshot, dependency] = await Promise.all([readOptionalFile(directory, outputPath), readOptionalFile(directory, dependencyPath)]);
+		const pch = stability.observe(snapshot?.byteLength ? snapshot : void 0, performance.now());
+		if (pch && dependency?.byteLength && decoder.decode(dependency).endsWith("\n")) return {
+			pch,
+			dependency
+		};
+		return /\d+ errors? generated\.\s*$/.test(capturedStderr) ? {} : void 0;
+	}).then((observed) => ({
+		...observed.value,
+		diagnostics: parseClangDiagnostics(`${observed.stderr}\n${observed.stdout}`),
+		stdout: observed.stdout,
+		stderr: observed.stderr
+	}));
+}
+function runClangStage(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, outputPath, dependencyPath) {
+	return runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, async (capturedStderr) => {
+		const [object, dependency] = await Promise.all([readValidWasmFile(directory, outputPath), readOptionalFile(directory, dependencyPath)]);
+		if (object && dependency?.byteLength && decoder.decode(dependency).endsWith("\n")) return {
+			object,
+			dependency
+		};
+		return /\d+ errors? generated\.\s*$/.test(capturedStderr) ? {} : void 0;
+	}).then((observed) => ({
+		...observed.value,
+		diagnostics: parseClangDiagnostics(`${observed.stderr}\n${observed.stdout}`),
+		stdout: observed.stdout,
+		stderr: observed.stderr
+	}));
+}
+function runLinkStage(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, outputPath) {
+	return runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, async (capturedStderr) => {
+		const output = await readValidWasmFile(directory, outputPath);
+		if (output) return output;
+		return /(?:wasm-ld|lld): error:/i.test(capturedStderr) ? null : void 0;
+	}).then((observed) => ({
+		...observed,
+		value: observed.value ?? void 0
+	}));
+}
+async function runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, probe) {
+	host.trace(requestId, spawnOperation, "start");
+	const instance = await command.run({
+		args,
+		cwd: "/project",
+		env: {
+			PATH: "/bin",
+			SOURCE_DATE_EPOCH: "946684800",
+			TZ: "UTC",
+			LC_ALL: "C"
+		},
+		mount: { "/project": directory }
+	});
+	host.trace(requestId, spawnOperation, "end");
+	host.trace(requestId, waitOperation, "start");
+	host.trace(requestId, outputReadyOperation, "start");
+	const stdoutCapture = captureReadable(instance.stdout);
+	const stderrCapture = captureReadable(instance.stderr);
+	const deadline = performance.now() + STAGE_OUTPUT_TIMEOUT_MS;
+	try {
+		while (performance.now() < deadline) {
+			const result = await probe(stderrCapture.text());
+			if (result !== void 0) {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				return {
+					value: result,
+					stdout: stdoutCapture.text(),
+					stderr: stderrCapture.text()
+				};
+			}
+			await new Promise((resolve) => setTimeout(resolve, 5));
+		}
+		throw new Error(`Compiler stage did not produce a complete output within ${STAGE_OUTPUT_TIMEOUT_MS} ms.`);
+	} finally {
+		host.trace(requestId, outputReadyOperation, "end");
+		host.trace(requestId, waitOperation, "end");
+		await Promise.all([stdoutCapture.cancel(), stderrCapture.cancel()]);
+		instance.free();
+	}
+}
+function captureReadable(stream) {
+	const reader = stream.getReader();
+	const chunks = [];
+	(async () => {
+		try {
+			while (true) {
+				const result = await reader.read();
+				if (result.done) return;
+				const bytes = result.value instanceof Uint8Array ? result.value : new Uint8Array(result.value);
+				chunks.push(bytes.slice());
+			}
+		} catch {}
+	})();
+	return {
+		text: () => decoder.decode(concatenate(chunks)),
+		cancel: async () => {
+			try {
+				await reader.cancel();
+			} catch {}
+		}
+	};
+}
+function concatenate(chunks) {
+	const output = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return output;
+}
+async function readValidWasmFile(directory, guestPath) {
+	const bytes = await readOptionalFile(directory, guestPath);
+	if (!bytes || bytes.byteLength <= 8) return void 0;
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return WebAssembly.validate(copy.buffer) ? copy : void 0;
+}
+async function ensureDirectory(directory, path) {
+	try {
+		await directory.createDir(path);
+	} catch (error) {
+		if (!String(error).toLowerCase().includes("exist")) throw error;
+	}
+}
+async function readOptionalFile(directory, guestPath) {
+	const mountRelativePath = guestPath.startsWith("/project/") ? guestPath.slice(8) : guestPath;
+	try {
+		return await directory.readFile(mountRelativePath);
+	} catch {
+		return;
+	}
+}
+function failedBuild(project, stdout, stderr, code, source, providedDiagnostics) {
+	return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(providedDiagnostics ?? parseClangDiagnostics(`${stderr}\n${stdout}`), {
+			file: project.config.entry,
+			source,
+			message: stderr.trim() || `${source} exited with code ${code}.`
+		}),
+		stdout,
+		stderr,
+		cacheHit: false
+	};
+}
+new TextEncoder();
+Object.freeze({
+	python: "python",
+	javascript: "qjs",
+	typescript: "qjs"
+});
+function requiredTrimmedString(value, label, maximum = 16384) {
+	if (typeof value !== "string" || !value || value !== value.trim() || value.length > maximum) throw new Error(`${label} must be a non-empty, trimmed string of at most ${maximum} characters.`);
+}
+function serializeRuntimeBundleManifest(data) {
+	return JSON.stringify({
+		schema: WASM_OJ_SCHEMAS.runtimeBundle,
+		version: WASM_OJ_CONTRACT_VERSION,
+		name: data.name,
+		target: data.target,
+		language: data.language,
+		runtime: {
+			package: data.runtimePackage,
+			command: data.command
+		},
+		execution: {
+			deterministic: true,
+			contractVersion: WASM_OJ_CONTRACT_VERSION
+		},
+		entry: data.entry,
+		files: [...data.files]
+	}, null, 2);
+}
+/** Canonical WASM-OJ manifest constructor for built-in and downstream runtime bundles. */
+function createRuntimeBundleManifest(project, runtimePackage, command, entry) {
+	requiredTrimmedString(project.name, "Project name");
+	requiredTrimmedString(runtimePackage, "Runtime package");
+	requiredTrimmedString(command, "Runtime command", 128);
+	assertLanguageIdentifier(project.config.language);
+	assertSafeRelativePath(entry, "Runtime bundle entry");
+	return serializeRuntimeBundleManifest({
+		name: project.name,
+		target: project.config.target,
+		language: project.config.language,
+		runtimePackage,
+		command,
+		entry,
+		files: canonicalProjectFiles(project.files).map((file) => file.path)
+	});
+}
+/** Produces a new record whose insertion order is canonical and path-safe. */
+function canonicalRuntimeBundleFiles(files) {
+	return canonicalFileRecord(files);
+}
+//#endregion
+//#region src/core/quickjs-runtime.ts
+var QUICKJS_STD_MODULE_DECLARATION = String.raw`
+declare module "std" {
+  const std: {
+    err: { puts(value: string): void };
+    in: { readAsString(): string };
+    out: { puts(value: string): void };
+  };
+  export = std;
+}
+`;
+//#endregion
+//#region src/compiler/language-driver.ts
+/** Internal registry for WASM-OJ's built-in compiler pipelines. */
+var LanguageDriverRegistry = class {
+	drivers = /* @__PURE__ */ new Map();
+	ids = /* @__PURE__ */ new Set();
+	register(driver) {
+		if (!driver || typeof driver !== "object") throw new TypeError("Language drivers must be objects.");
+		if (typeof driver.id !== "string" || !driver.id || driver.id !== driver.id.trim() || driver.id.length > 128) throw new Error("Language driver IDs must be non-empty, trimmed, and at most 128 characters.");
+		if (this.ids.has(driver.id)) throw new Error(`Language driver '${driver.id}' is already registered.`);
+		if (!Array.isArray(driver.languages) || driver.languages.length === 0) throw new Error(`Language driver '${driver.id}' has no languages.`);
+		if (typeof driver.build !== "function") throw new TypeError(`Language driver '${driver.id}' must implement build().`);
+		const languages = /* @__PURE__ */ new Set();
+		for (const language of driver.languages) {
+			if (typeof language !== "string") throw new TypeError("Language identifiers must be strings.");
+			assertLanguageIdentifier(language);
+			if (languages.has(language)) throw new Error(`Language '${language}' is duplicated in driver '${driver.id}'.`);
+			languages.add(language);
+			const existing = this.drivers.get(language);
+			if (existing) throw new Error(`Language '${language}' is already owned by driver '${existing.id}'.`);
+		}
+		for (const language of languages) this.drivers.set(language, driver);
+		this.ids.add(driver.id);
+	}
+	driver(language) {
+		const driver = this.drivers.get(language);
+		if (!driver) throw new Error(`No language driver is registered for '${language}'.`);
+		return driver;
+	}
+	languages() {
+		return [...this.drivers.keys()];
+	}
+};
+//#endregion
+//#region src/compiler/java-toolchain.ts
+var JAVA_COMPILE_TIMEOUT_MS = 18e4;
+Object.freeze({
+	version: JAVA_VERSION,
+	package: JAVA_COMPILER_PACKAGE,
+	compilerAsset: JAVA_COMPILER_ASSET_PATH,
+	compilerCompressedSha256: JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256,
+	compilerPackageSha256: JAVA_COMPILER_PACKAGE_SHA256,
+	compileClasslibAsset: JAVA_COMPILE_CLASSLIB_ASSET_PATH,
+	compileClasslibSha256: JAVA_COMPILE_CLASSLIB_SHA256,
+	runtimeClasslibAsset: JAVA_RUNTIME_CLASSLIB_ASSET_PATH,
+	runtimeClasslibSha256: JAVA_RUNTIME_CLASSLIB_SHA256
+});
+function javaMainClass(entry, source) {
+	const className = entry.split("/").at(-1)?.replace(/\.java$/u, "") ?? "";
+	if (!/^[A-Za-z_$][\w$]*$/u.test(className)) throw new Error(`Java entry '${entry}' must name a valid .java class file.`);
+	const packageName = source.match(/^\s*package\s+([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*;/m)?.[1];
+	return packageName ? `${packageName}.${className}` : className;
+}
+//#endregion
+//#region src/compiler/wasmer-engine.ts
+var encoder = new TextEncoder();
+var typescriptCompilerBytes;
+var host;
+function configureWasmerCompilerHost(nextHost) {
+	host = nextHost;
+}
+function progress(requestId, phase, label, value) {
+	requireHost().progress(requestId, phase, label, value);
+}
+function requireHost() {
+	if (!host) throw new Error("Wasmer compiler host is not configured.");
+	return host;
+}
+function requireRuntime() {
+	return requireHost().getRuntime();
+}
+async function getTypeScriptCompiler() {
+	typescriptCompilerBytes ??= requireHost().loadToolchainAsset(TYPESCRIPT_ASSET_PATH);
+	try {
+		return Wasmer.fromWasm(await typescriptCompilerBytes, requireRuntime());
+	} catch (error) {
+		typescriptCompilerBytes = void 0;
+		throw error;
+	}
+}
+function createArtifactBase(project, cacheKey, started, size, toolchains, contentIdentity) {
+	return {
+		wasmOjContract: WASM_OJ_CONTRACT_VERSION,
+		id: crypto.randomUUID(),
+		projectId: project.id,
+		cacheKey,
+		name: `${project.name}.${project.config.target === "wasip1" ? "wasm" : "wasix.wasm"}`,
+		language: project.config.language,
+		target: project.config.target,
+		optimization: project.config.optimization,
+		createdAt: Date.now(),
+		durationMs: performance.now() - started,
+		size,
+		toolchains,
+		costProfile: costProfileId(project.config.language, project.config.target, project.config.optimization, contentIdentity),
+		...project.dependencies === void 0 ? {} : { dependencyLockSha256: project.dependencies.lockSha256 }
+	};
+}
+async function buildRust(project, cacheKey, requestId) {
+	const started = performance.now();
+	progress(requestId, "compiling", `Compiling with rustc ${RUST_VERSION}`, .2);
+	const dependencies = rustDependencyInput(project);
+	const compiled = await requireHost().compileRust({
+		entry: project.config.entry,
+		files: [...project.files, ...dependencies.files],
+		optimization: project.config.optimization,
+		dependencies: dependencies.crates,
+		rootExterns: dependencies.roots
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "rustc",
+			message: compiled.stderr.trim() || "rustc failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const bytes = compiled.wasm;
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, bytes.byteLength, toolchainPackageIdentities("rust")),
+		bytes
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+function sumFileSize(files) {
+	return Object.values(files).reduce((total, file) => total + (typeof file === "string" ? encoder.encode(file).byteLength : file.byteLength), 0);
+}
+async function buildPython(project, cacheKey, requestId) {
+	const started = performance.now();
+	const dependencies = pythonDependencyFiles(project);
+	const compilerFiles = [...project.files, ...dependencies.sourceFiles];
+	const pythonFiles = compilerFiles.filter((file) => file.path.endsWith(".py"));
+	progress(requestId, "compiling", `Byte-compiling ${pythonFiles.length} Python file${pythonFiles.length === 1 ? "" : "s"}`, .55);
+	const frontend = await requireHost().compilePython({ files: compilerFiles });
+	if (!frontend.success) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(frontend.diagnostics, {
+			file: project.config.entry,
+			source: "python",
+			message: frontend.stderr.trim() || "Python byte-compilation failed without a diagnostic."
+		}),
+		stdout: frontend.stdout,
+		stderr: frontend.stderr,
+		cacheHit: false
+	};
+	const files = Object.fromEntries(project.files.map((file) => [file.path, file.content]));
+	Object.assign(files, dependencies.artifactFiles);
+	files[PYTHON_RUNNER_PATH] = PYTHON_DETERMINISTIC_RUNNER;
+	for (const file of pythonFiles) {
+		const compiledPath = `build/${file.path.replace(/\.py$/, ".pyc")}`;
+		const bytecode = frontend.bytecode[compiledPath];
+		if (!bytecode) throw new Error(`Python stage omitted '${compiledPath}'.`);
+		files[compiledPath] = bytecode;
+	}
+	const entry = `build/${project.config.entry.replace(/\.py$/, ".pyc")}`;
+	const manifest = createRuntimeBundleManifest(project, PYTHON_PACKAGE, "python", entry);
+	files["wasm-oj.manifest.json"] = manifest;
+	const bundleFiles = canonicalRuntimeBundleFiles(files);
+	const artifact = {
+		kind: "runtime-bundle",
+		...createArtifactBase(project, cacheKey, started, sumFileSize(bundleFiles), toolchainPackageIdentities("python")),
+		name: `${project.name}.python-${project.config.target}.json`,
+		runtimePackage: PYTHON_PACKAGE,
+		command: "python",
+		entry,
+		files: bundleFiles,
+		manifest
+	};
+	return {
+		success: true,
+		diagnostics: frontend.diagnostics,
+		artifact,
+		stdout: frontend.stdout,
+		stderr: frontend.stderr,
+		cacheHit: false
+	};
+}
+async function buildGo(project, cacheKey, requestId) {
+	const started = performance.now();
+	progress(requestId, "compiling", `Compiling with Go ${GO_VERSION}`, .3);
+	const dependencies = goDependencyInput(project);
+	const compiled = await requireHost().compileGo({
+		entry: project.config.entry,
+		files: project.files,
+		dependencyFiles: dependencies.files,
+		optimization: project.config.optimization,
+		dependencies: dependencies.packages
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "go",
+			message: compiled.stderr.trim() || "Go compilation failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, compiled.wasm.byteLength, toolchainPackageIdentities("go")),
+		bytes: compiled.wasm
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+async function buildJava(project, cacheKey, requestId) {
+	const started = performance.now();
+	const entry = project.files.find((file) => file.path === project.config.entry);
+	if (!entry || !entry.path.endsWith(".java")) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: "The Java entry must be a .java source file.",
+			file: project.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	progress(requestId, "compiling", `Compiling Java ${javaMainClass(entry.path, entry.content)}`, .3);
+	const compiled = await requireHost().compileJava({
+		entry: project.config.entry,
+		files: project.files,
+		optimization: project.config.optimization
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "java",
+			message: compiled.stderr.trim() || "Java compilation failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, compiled.wasm.byteLength, toolchainPackageIdentities("java"), toolchainContentIdentity("java")),
+		bytes: compiled.wasm
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+function emittedScriptPath(path) {
+	if (path.endsWith(".ts")) return path.slice(0, -3) + ".js";
+	return path;
+}
+function scriptSourceFiles(project) {
+	const extension = project.config.language === "typescript" ? ".ts" : ".js";
+	return project.files.filter((file) => file.path.endsWith(extension));
+}
+function emittedSourceFiles(project) {
+	return scriptSourceFiles(project).filter((file) => !file.path.endsWith(".d.ts"));
+}
+async function transpileScriptProject(project, requestId) {
+	const scriptFiles = scriptSourceFiles(project);
+	const emittedFiles = emittedSourceFiles(project);
+	const dependencyFiles = npmDependencyFiles(project);
+	progress(requestId, "loading-toolchain", `Loading TypeScript ${TYPESCRIPT_VERSION}/WASI`);
+	const entrypoint = (await getTypeScriptCompiler()).entrypoint;
+	if (!entrypoint) throw new Error("The TypeScript/WASI compiler has no executable entrypoint.");
+	const outputPaths = emittedFiles.map((file) => emittedScriptPath(file.path));
+	const declarationPath = "/project/.wasm-oj/quickjs.d.ts";
+	const output = await (await entrypoint.run({ stdin: JSON.stringify({
+		files: {
+			...Object.fromEntries(project.files.map((file) => [`/project/${file.path}`, file.content])),
+			...Object.fromEntries(Object.entries(dependencyFiles).filter(([, contents]) => typeof contents === "string").map(([path, contents]) => [`/project/${path}`, contents])),
+			[declarationPath]: QUICKJS_STD_MODULE_DECLARATION
+		},
+		javascript: project.config.language === "javascript",
+		sources: [
+			declarationPath,
+			...scriptFiles.map((file) => `/project/${file.path}`),
+			...Object.entries(dependencyFiles).filter(([path, contents]) => path.endsWith(".d.ts") && typeof contents === "string").map(([path]) => `/project/${path}`)
+		],
+		outputs: outputPaths.map((path) => `/project/build/${path}`)
+	}) })).wait();
+	let response;
+	if (output.ok) try {
+		response = JSON.parse(output.stdout);
+	} catch {
+		response = void 0;
+	}
+	const files = {};
+	if (response) for (const outputPath of outputPaths) {
+		const contents = response.files[`/project/build/${outputPath}`];
+		if (contents !== void 0) files[outputPath] = contents;
+	}
+	Object.assign(files, dependencyFiles);
+	return {
+		files,
+		output,
+		response
+	};
+}
+async function buildScript(project, cacheKey, requestId) {
+	const started = performance.now();
+	if (!emittedSourceFiles(project).some((file) => file.path === project.config.entry)) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: `The ${project.config.language === "typescript" ? ".ts" : ".js"} entry file is not a supported executable source.`,
+			file: project.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	progress(requestId, "compiling", `Compiling ${project.config.language === "typescript" ? "TypeScript" : "JavaScript"} with TypeScript/WASI`, .5);
+	const { files, output, response } = await transpileScriptProject(project, requestId);
+	const diagnostics = parseTypeScriptDiagnostics(response?.diagnostics ?? "");
+	const emittedOutputsPresent = emittedSourceFiles(project).every((file) => Object.hasOwn(files, emittedScriptPath(file.path)));
+	if (!output.ok || !response || response.status !== 0 || !emittedOutputsPresent || diagnostics.some((diagnostic) => diagnostic.severity === "error")) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(diagnostics, {
+			file: project.config.entry,
+			source: "typescript",
+			message: output.stderr.trim() || response?.diagnostics.trim() || `TypeScript 7.0.2 did not return every compiled output.`
+		}),
+		stdout: "",
+		stderr: output.stderr,
+		cacheHit: false
+	};
+	const entry = emittedScriptPath(project.config.entry);
+	const manifest = createRuntimeBundleManifest(project, QUICKJS_PACKAGE, "qjs", entry);
+	files["wasm-oj.manifest.json"] = manifest;
+	const bundleFiles = canonicalRuntimeBundleFiles(files);
+	return {
+		success: true,
+		diagnostics,
+		artifact: {
+			kind: "runtime-bundle",
+			...createArtifactBase(project, cacheKey, started, sumFileSize(bundleFiles), toolchainPackageIdentities(project.config.language)),
+			name: `${project.name}.${project.config.language === "typescript" ? "typescript" : "javascript"}-${project.config.target}.json`,
+			runtimePackage: QUICKJS_PACKAGE,
+			command: "qjs",
+			entry,
+			files: bundleFiles,
+			manifest
+		},
+		stdout: "",
+		stderr: output.stderr,
+		cacheHit: false
+	};
+}
+async function buildProject(project, cacheKey, requestId) {
+	const canonicalProject = {
+		...project,
+		files: canonicalProjectFiles(project.files)
+	};
+	assertProjectDependencyEcosystem(canonicalProject);
+	progress(requestId, "checking", "Validating project configuration", .05);
+	if (!canonicalProject.files.some((file) => file.path === canonicalProject.config.entry)) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: "Configured entry file does not exist.",
+			file: canonicalProject.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	if (canonicalProject.config.language === "c" || canonicalProject.config.language === "cpp") {
+		const activeHost = requireHost();
+		return buildClangWithSdkDirect(canonicalProject, cacheKey, requestId, {
+			runtime: activeHost.getRuntime(),
+			loadToolchainAsset: activeHost.loadToolchainAsset,
+			loadToolchainFile: activeHost.loadToolchainFile,
+			progress: activeHost.progress,
+			trace: activeHost.trace
+		});
+	}
+	return languageDrivers.driver(canonicalProject.config.language).build({
+		project: canonicalProject,
+		cacheKey,
+		requestId
+	});
+}
+var languageDrivers = new LanguageDriverRegistry();
+languageDrivers.register({
+	id: "rustc",
+	languages: ["rust"],
+	build: ({ project, cacheKey, requestId }) => buildRust(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "cpython",
+	languages: ["python"],
+	build: ({ project, cacheKey, requestId }) => buildPython(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "typescript",
+	languages: ["javascript", "typescript"],
+	build: ({ project, cacheKey, requestId }) => buildScript(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "go",
+	languages: ["go"],
+	build: ({ project, cacheKey, requestId }) => buildGo(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "teavm-java",
+	languages: ["java"],
+	build: ({ project, cacheKey, requestId }) => buildJava(project, cacheKey, requestId)
+});
+function clearCompilerHostCaches() {
+	typescriptCompilerBytes = void 0;
+}
+//#endregion
+//#region src/compiler/python-toolchain.ts
+var PYTHON_COMPILE_TIMEOUT_MS = 18e4;
+//#endregion
+//#region src/compiler/rust-toolchain.ts
+var RUST_TARGET_TRIPLE = "wasm32-wasip1-threads";
+var RUST_EDITION = "2024";
+var RUST_COMPILE_TIMEOUT_MS = 18e4;
+Object.freeze(["wasi_snapshot_preview1.random_get", "wasi_snapshot_preview1.clock_time_get"]);
+var RUST_TOOLCHAIN = Object.freeze({
+	version: RUST_VERSION,
+	packageAsset: RUST_PACKAGE_ASSET_PATH,
+	packageCompressedSha256: RUST_COMPRESSED_PACKAGE_SHA256,
+	packageSha256: RUST_PACKAGE_SHA256,
+	manifestAsset: RUST_PACKAGE_MANIFEST_ASSET_PATH,
+	manifestSha256: RUST_PACKAGE_MANIFEST_SHA256,
+	target: RUST_TARGET_TRIPLE,
+	edition: RUST_EDITION
+});
+`${GO_VERSION.split(".").slice(0, 2).join(".")}`;
+var GO_COMPILE_TIMEOUT_MS = 18e4;
+var GO_TOOLCHAIN = Object.freeze({
+	version: GO_VERSION,
+	target: "wasip1/wasm",
+	packageAsset: GO_PACKAGE_ASSET_PATH,
+	packageCompressedSha256: GO_COMPRESSED_PACKAGE_SHA256,
+	packageSha256: GO_PACKAGE_SHA256,
+	manifestAsset: GO_PACKAGE_MANIFEST_ASSET_PATH,
+	manifestSha256: GO_PACKAGE_MANIFEST_SHA256,
+	standardLibraryAsset: GO_STANDARD_LIBRARY_ASSET_PATH,
+	standardLibraryCompressedSha256: GO_COMPRESSED_STANDARD_LIBRARY_SHA256,
+	standardLibrarySha256: GO_STANDARD_LIBRARY_SHA256,
+	compilerSha256: GO_COMPILER_SHA256,
+	linkerSha256: GO_LINKER_SHA256
+});
+//#endregion
+//#region src/server/wasmer-runtime.ts
+var initialization;
+async function initializeServerWasmerSdk() {
+	initialization ??= init({ log: "error" }).then(() => void 0);
+	try {
+		await initialization;
+	} catch (error) {
+		initialization = void 0;
+		throw error;
+	}
+}
+//#endregion
+//#region src/server/bounded-transport.ts
+/** Collects a child-process channel without permitting unbounded host memory growth. */
+var BoundedByteCollector = class {
+	chunks = [];
+	label;
+	maximumBytes;
+	onLimitExceeded;
+	totalBytes = 0;
+	limitError;
+	constructor(label, maximumBytes, onLimitExceeded) {
+		if (!Number.isSafeInteger(maximumBytes) || maximumBytes <= 0) throw new TypeError("A bounded transport limit must be a positive safe integer.");
+		this.label = label;
+		this.maximumBytes = maximumBytes;
+		this.onLimitExceeded = onLimitExceeded;
+	}
+	append(chunk) {
+		if (this.limitError) return;
+		this.totalBytes += chunk.byteLength;
+		if (this.totalBytes > this.maximumBytes) {
+			this.limitError = /* @__PURE__ */ new Error(`${this.label} exceeded the ${this.maximumBytes} byte transport boundary.`);
+			this.chunks.length = 0;
+			this.onLimitExceeded(this.limitError);
+			return;
+		}
+		this.chunks.push(Buffer.from(chunk));
+	}
+	bytes() {
+		if (this.limitError) throw this.limitError;
+		return Buffer.concat(this.chunks, this.totalBytes);
+	}
+	text() {
+		return this.bytes().toString();
+	}
+};
+/** Reads a private one-shot response through a stable descriptor and enforces a hard byte cap. */
+async function readBoundedRegularFile(filename, maximumBytes) {
+	if (!Number.isSafeInteger(maximumBytes) || maximumBytes <= 0) throw new TypeError("A bounded file limit must be a positive safe integer.");
+	const pathStatus = await lstat(filename);
+	if (!pathStatus.isFile()) throw new Error(`Transport response '${filename}' must be a regular file.`);
+	if (pathStatus.size > maximumBytes) throw new Error(`Transport response '${filename}' exceeds the ${maximumBytes} byte boundary.`);
+	const handle = await open(filename, "r");
+	try {
+		const descriptorStatus = await handle.stat();
+		if (!descriptorStatus.isFile() || descriptorStatus.dev !== pathStatus.dev || descriptorStatus.ino !== pathStatus.ino) throw new Error(`Transport response '${filename}' changed before it could be read.`);
+		const chunks = [];
+		let totalBytes = 0;
+		while (true) {
+			const chunk = Buffer.allocUnsafe(Math.min(65536, maximumBytes - totalBytes + 1));
+			const { bytesRead } = await handle.read(chunk, 0, chunk.byteLength, null);
+			if (bytesRead === 0) break;
+			totalBytes += bytesRead;
+			if (totalBytes > maximumBytes) throw new Error(`Transport response '${filename}' exceeds the ${maximumBytes} byte boundary.`);
+			chunks.push(chunk.subarray(0, bytesRead));
+		}
+		return Buffer.concat(chunks, totalBytes);
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
+//#region src/compiler/build-timeout-policy.ts
+var CLANG_BUILD_CONTROL_TIMEOUT_MS = 6e4;
+var DEFAULT_BUILD_CONTROL_TIMEOUT_MS = 12e4;
+var GO_BUILD_CONTROL_TIMEOUT_MS = GO_COMPILE_TIMEOUT_MS + 1e4;
+var RUST_BUILD_CONTROL_TIMEOUT_MS = RUST_COMPILE_TIMEOUT_MS + 1e4;
+/**
+* Hard host deadline for one complete compiler request. The server child and
+* browser Worker must use the same policy because an SDK call can block the
+* JavaScript event loop and therefore cannot enforce its own timer.
+*/
+function buildControlTimeoutMs(language) {
+	if (language === "java") return 19e4;
+	if (!isBuiltinLanguage(language)) throw new Error(`The built-in WASM-OJ compiler does not support language '${language}'.`);
+	if (language === "c" || language === "cpp") return CLANG_BUILD_CONTROL_TIMEOUT_MS;
+	if (language === "rust") return RUST_BUILD_CONTROL_TIMEOUT_MS;
+	if (language === "go") return GO_BUILD_CONTROL_TIMEOUT_MS;
+	return DEFAULT_BUILD_CONTROL_TIMEOUT_MS;
+}
+//#endregion
+//#region src/server/toolchain-sources.ts
+function snapshotServerToolchainSources(sources) {
+	validateServerToolchainSources(sources);
+	return Object.freeze(sources.map((source) => Object.freeze({
+		kind: "server",
+		descriptor: freezeDescriptor(source.descriptor),
+		directory: new URL(source.directory.href)
+	})));
+}
+function serializeServerToolchainSources(sources) {
+	return Object.freeze(sources.map((source) => Object.freeze({
+		kind: "server",
+		descriptor: source.descriptor,
+		directory: source.directory.href
+	})));
+}
+function serverToolchainAssetFile(sources, assetPath) {
+	const { source, asset } = toolchainAssetSource(sources, assetPath);
+	const filename = path.basename(asset.path);
+	const file = fileURLToPath(new URL(filename, source.directory));
+	const directory = fileURLToPath(source.directory);
+	const relative = path.relative(directory, file);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Toolchain asset escapes its package directory: '${assetPath}'.`);
+	return file;
+}
+function serverToolchainAssetFiles(sources, assetPaths) {
+	return Object.freeze(Object.fromEntries(assetPaths.map((assetPath) => [assetPath, serverToolchainAssetFile(sources, assetPath)])));
+}
+function serverToolchainDirectories(sources) {
+	return Object.freeze([...new Set(sources.map((source) => fileURLToPath(source.directory)))]);
+}
+function assertServerToolchainProfile(sources, language, target, optimization) {
+	toolchainProfileSource(sources, language, target, optimization);
+}
+function freezeDescriptor(descriptor) {
+	return Object.freeze({
+		...descriptor,
+		languages: Object.freeze([...descriptor.languages]),
+		profiles: Object.freeze(descriptor.profiles.map((profile) => Object.freeze({ ...profile }))),
+		assets: Object.freeze(descriptor.assets.map((asset) => Object.freeze({ ...asset })))
+	});
+}
+//#endregion
+//#region src/server/verified-distribution.ts
+var SHA256$1 = /^[0-9a-f]{64}$/u;
+var verifiedDistributions = /* @__PURE__ */ new WeakSet();
+/** @internal Create a process-local capability from already verified container inventory. */
+function createVerifiedServerDistribution(evidence) {
+	if (!SHA256$1.test(evidence.compilerSha256) || !SHA256$1.test(evidence.runnerSha256) || !SHA256$1.test(evidence.toolchainRootSha256)) throw new Error("Verified WASM-OJ distribution evidence contains an invalid digest.");
+	const toolchains = snapshotServerToolchainSources(evidence.toolchains);
+	const declaredAssets = toolchains.flatMap((source) => source.descriptor.assets);
+	const evidencePaths = Object.keys(evidence.toolchainAssets).sort();
+	const declaredPaths = declaredAssets.map((asset) => asset.path).sort();
+	if (evidencePaths.length !== declaredPaths.length || evidencePaths.some((assetPath, index) => assetPath !== declaredPaths[index])) throw new Error("Verified WASM-OJ distribution evidence does not exactly match its toolchain descriptors.");
+	for (const asset of declaredAssets) if (evidence.toolchainAssets[asset.path] !== asset.sha256) throw new Error(`Verified WASM-OJ distribution evidence does not bind toolchain asset '${asset.path}'.`);
+	const toolchainAssetFiles = serverToolchainAssetFiles(toolchains, declaredPaths);
+	const token = Object.freeze({
+		compilerExecutable: path.resolve(evidence.compilerExecutable),
+		runtimeExecutable: path.resolve(evidence.runtimeExecutable),
+		toolchainAssetFiles,
+		toolchainRootSha256: evidence.toolchainRootSha256
+	});
+	verifiedDistributions.add(token);
+	return token;
+}
+function assertVerifiedServerDistribution(token, paths, toolchains) {
+	if (!verifiedDistributions.has(token) || token.compilerExecutable !== path.resolve(paths.compilerExecutable) || token.runtimeExecutable !== path.resolve(paths.runtimeExecutable)) throw new Error("WASM-OJ verified-distribution token does not authorize the resolved server runtime.");
+	assertVerifiedToolchainDistribution(token, toolchains);
+}
+function assertVerifiedToolchainDistribution(token, toolchains) {
+	if (!verifiedDistributions.has(token)) throw new Error("WASM-OJ verified-distribution token is not process-authentic.");
+	const actual = serverToolchainAssetFiles(toolchains, toolchains.flatMap((source) => source.descriptor.assets.map((asset) => asset.path)));
+	if (!sameRecord(token.toolchainAssetFiles, actual)) throw new Error("WASM-OJ verified-distribution token does not authorize these toolchain sources.");
+}
+function sameRecord(expected, actual) {
+	const expectedEntries = Object.entries(expected).sort(([left], [right]) => left.localeCompare(right));
+	const actualEntries = Object.entries(actual).sort(([left], [right]) => left.localeCompare(right));
+	return expectedEntries.length === actualEntries.length && expectedEntries.every(([key, value], index) => {
+		const candidate = actualEntries[index];
+		return candidate?.[0] === key && candidate[1] === value;
+	});
+}
+//#endregion
+//#region src/server/stage-scripts.ts
+var SERVER_STAGE_SCRIPTS = Object.freeze([
+	"server-build-stage.mjs",
+	"server-runner-stage.mjs",
+	"python-stage.mjs",
+	"rustc-stage.mjs",
+	"go-stage.mjs",
+	"java-stage.mjs"
+]);
+var SERVER_STAGE_SCRIPT_SET = new Set(SERVER_STAGE_SCRIPTS);
+/** Resolve the one package-owned directory that contains every isolated server stage. */
+function resolveServerStageDirectory(moduleUrl = import.meta.url) {
+	const modulePath = fileURLToPath(moduleUrl);
+	const moduleDirectory = path.dirname(modulePath);
+	const moduleFilename = path.basename(modulePath);
+	if (moduleFilename === "stage-scripts.ts" && path.basename(moduleDirectory) === "server" && path.basename(path.dirname(moduleDirectory)) === "src") return moduleDirectory;
+	if ((moduleFilename === "index.js" || moduleFilename === "server-build-stage.mjs") && path.basename(moduleDirectory) === "dist") return moduleDirectory;
+	throw new Error(`Unsupported @wasm-oj/server module layout '${modulePath}'.`);
+}
+/** Resolve only a declared stage below an already-established package stage root. */
+function serverStageScript(stageDirectory, scriptName) {
+	if (!path.isAbsolute(stageDirectory)) throw new Error("The @wasm-oj/server stage directory must be absolute.");
+	if (!SERVER_STAGE_SCRIPT_SET.has(scriptName)) throw new Error(`Unknown isolated server stage '${scriptName}'.`);
+	return path.join(stageDirectory, scriptName);
+}
+//#endregion
+//#region src/server/server-compiler.ts
+var IN_PROCESS_STAGE = Symbol("wasm-oj-in-process-server-compiler");
+var SERVER_STAGE_LOG_LIMIT_BYTES = 1048576;
+var SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES = 1048576;
+var SERVER_BUILD_RESPONSE_LIMIT_BYTES = 268435456;
+var SERVER_BUILD_REQUEST_LIMIT_BYTES = 805306368;
+var SERVER_COMPILER_STAGE_RESPONSE_LIMIT_BYTES = 268435456;
+/**
+* Node/server compiler host using the exact language drivers and Wasmer
+* packages used by the browser Worker.
+*/
+var ServerCompiler = class {
+	progressListeners = /* @__PURE__ */ new Set();
+	compilerExecutable;
+	toolchains;
+	initialization;
+	generation = 0;
+	disposed = false;
+	inProcess;
+	verifiedToolchain;
+	stageDirectory;
+	activeChildren = /* @__PURE__ */ new Set();
+	activeOperation;
+	constructor(options, stage) {
+		this.compilerExecutable = path.resolve(options.compilerExecutable);
+		this.toolchains = snapshotServerToolchainSources(options.toolchains);
+		if (options.verifiedDistribution) assertVerifiedToolchainDistribution(options.verifiedDistribution, this.toolchains);
+		if (options.verifiedToolchain === true && stage !== IN_PROCESS_STAGE) throw new Error("Verified toolchain inheritance is reserved for the isolated compiler stage.");
+		this.verifiedToolchain = options.verifiedDistribution !== void 0 || options.verifiedToolchain === true;
+		this.inProcess = stage === IN_PROCESS_STAGE;
+		if (stage === IN_PROCESS_STAGE) {
+			const inheritedStageDirectory = options.stageDirectory;
+			if (typeof inheritedStageDirectory !== "string" || !path.isAbsolute(inheritedStageDirectory)) throw new Error("The inherited @wasm-oj/server stage directory must be absolute.");
+			this.stageDirectory = inheritedStageDirectory;
+		} else this.stageDirectory = resolveServerStageDirectory();
+	}
+	cacheIdentity(project) {
+		this.assertActive();
+		assertServerToolchainProfile(this.toolchains, project.config.language, project.config.target, project.config.optimization);
+		return JSON.stringify(toolchainCacheIdentity(project.config.language));
+	}
+	async ready() {
+		this.assertActive();
+		const generation = this.generation;
+		let initialization = this.initialization;
+		if (!initialization) {
+			initialization = this.initialize();
+			this.initialization = initialization;
+			initialization.catch(() => {
+				if (this.initialization === initialization) this.initialization = void 0;
+			});
+		}
+		await initialization;
+		this.assertActive();
+		if (generation !== this.generation) throw new Error("Server compiler initialization was superseded.");
+	}
+	async build(project, cacheKey) {
+		assertValidProject(project);
+		assertCompilerCacheKey(cacheKey);
+		const operation = this.beginOperation("build");
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server compilation was cancelled before initialization completed.");
+			if (!this.inProcess) return await this.buildIsolated(project, cacheKey, operation);
+			const runtime = new Runtime({ registry: null });
+			configureWasmerCompilerHost({
+				getRuntime: () => runtime,
+				loadToolchainAsset: (assetPath) => this.loadToolchainAsset(assetPath),
+				loadToolchainFile: (assetPath) => this.loadToolchainFile(assetPath),
+				compileRust: (request) => this.compileRust(request),
+				compilePython: (request) => this.compilePython(request),
+				compileGo: (request) => this.compileGo(request),
+				compileJava: (request) => this.compileJava(request),
+				progress: (_requestId, phase, label, value) => {
+					if (!this.isCurrent(operation)) return;
+					const progress = {
+						phase,
+						label,
+						progress: value
+					};
+					for (const listener of this.progressListeners) listener(progress);
+				},
+				trace: () => void 0
+			});
+			try {
+				const result = await buildProject(project, cacheKey, crypto.randomUUID());
+				this.assertCurrent(operation, "Server compilation was cancelled.");
+				return result;
+			} finally {
+				await clearSdkDirectClangCaches();
+				runtime.free();
+			}
+		} finally {
+			this.endOperation(operation);
+		}
+	}
+	onProgress(listener) {
+		this.assertActive();
+		this.progressListeners.add(listener);
+		return () => this.progressListeners.delete(listener);
+	}
+	async clearToolchainCache() {
+		const operation = this.beginOperation("cache-clear");
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server compiler cache clearing was superseded.");
+			if (this.inProcess) {
+				clearCompilerHostCaches();
+				await clearSdkDirectClangCaches();
+				this.assertCurrent(operation, "Server compiler cache clearing was superseded.");
+			}
+		} finally {
+			this.endOperation(operation);
+		}
+	}
+	cancel() {
+		if (this.disposed) return;
+		if (this.activeOperation?.kind === "cache-clear") return;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation = void 0;
+		}
+		this.terminateChildren();
+	}
+	restart() {
+		this.assertActive();
+		if (this.activeOperation?.kind === "cache-clear") throw new Error("Cannot restart ServerCompiler while clearing its cache.");
+		this.cancel();
+		if (this.inProcess) clearCompilerHostCaches();
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation = void 0;
+		}
+		this.terminateChildren();
+		this.progressListeners.clear();
+	}
+	async initialize() {
+		await Promise.all([
+			access(this.compilerExecutable, constants.X_OK),
+			...serverToolchainDirectories(this.toolchains).map((directory) => access(directory, constants.R_OK)),
+			this.inProcess ? initializeServerWasmerSdk() : Promise.resolve()
+		]);
+	}
+	async buildIsolated(project, cacheKey, operation) {
+		const transportDirectory = await mkdtemp(path.join(os.tmpdir(), "wasm-oj-build-response-"));
+		const responsePath = path.join(transportDirectory, "response.v8");
+		const requestPath = path.join(transportDirectory, "request.v8");
+		const timeoutMs = buildControlTimeoutMs(project.config.language);
+		try {
+			this.assertCurrent(operation, "Server compilation was cancelled before its isolated stage started.");
+			const encodedRequest = serialize({
+				compilerExecutable: this.compilerExecutable,
+				stageDirectory: this.stageDirectory,
+				toolchains: serializeServerToolchainSources(this.toolchains),
+				verifiedToolchain: this.verifiedToolchain,
+				project,
+				cacheKey
+			});
+			if (encodedRequest.byteLength > SERVER_BUILD_REQUEST_LIMIT_BYTES) throw new Error(`Server compiler request exceeds ${SERVER_BUILD_REQUEST_LIMIT_BYTES} bytes.`);
+			await writeFile(requestPath, encodedRequest, {
+				flag: "wx",
+				mode: 384
+			});
+			return await new Promise((resolve, reject) => {
+				const script = serverStageScript(this.stageDirectory, "server-build-stage.mjs");
+				const child = spawn(process.execPath, [
+					"--experimental-strip-types",
+					"--disable-warning=ExperimentalWarning",
+					script
+				], {
+					stdio: [
+						"pipe",
+						"pipe",
+						"pipe",
+						"pipe"
+					],
+					env: {
+						...process.env,
+						WASM_OJ_BUILD_REQUEST: requestPath,
+						WASM_OJ_BUILD_RESPONSE: responsePath
+					}
+				});
+				this.activeChildren.add(child);
+				let progressBuffer = "";
+				let timedOut = false;
+				let transportError;
+				const failTransport = (error) => {
+					transportError ??= error;
+					child.kill("SIGKILL");
+				};
+				const stdout = new BoundedByteCollector("Isolated server compiler stdout", SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+				const stderr = new BoundedByteCollector("Isolated server compiler stderr", SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+				child.stdout.on("data", (chunk) => stdout.append(chunk));
+				child.stderr.on("data", (chunk) => stderr.append(chunk));
+				child.on("error", (error) => {
+					transportError = error;
+				});
+				child.stdin.on("error", (error) => {
+					transportError ??= error;
+				});
+				const progressStream = child.stdio[3];
+				if (!progressStream || typeof progressStream === "number") {
+					child.kill("SIGKILL");
+					this.activeChildren.delete(child);
+					reject(/* @__PURE__ */ new Error("The isolated server compiler did not expose its progress channel."));
+					return;
+				}
+				progressStream.on("data", (chunk) => {
+					if (Buffer.byteLength(progressBuffer, "utf8") + chunk.byteLength > SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES) {
+						failTransport(/* @__PURE__ */ new Error(`Isolated server compiler progress exceeded the ${SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES} byte line boundary.`));
+						return;
+					}
+					progressBuffer += chunk.toString();
+					const lines = progressBuffer.split("\n");
+					progressBuffer = lines.pop() ?? "";
+					for (const line of lines) {
+						if (!line) continue;
+						try {
+							const progress = JSON.parse(line);
+							if (this.isCurrent(operation)) for (const listener of this.progressListeners) listener(progress);
+						} catch {}
+					}
+				});
+				const timer = setTimeout(() => {
+					timedOut = true;
+					child.kill("SIGKILL");
+				}, timeoutMs);
+				child.on("close", async () => {
+					clearTimeout(timer);
+					this.activeChildren.delete(child);
+					try {
+						this.assertCurrent(operation, "Server compilation was cancelled.");
+						if (timedOut) throw new Error(`Server compilation exceeded ${timeoutMs} ms.`);
+						if (transportError) throw transportError;
+						let encodedResponse;
+						try {
+							encodedResponse = await readBoundedRegularFile(responsePath, SERVER_BUILD_RESPONSE_LIMIT_BYTES);
+						} catch (error) {
+							const stageError = stderr.text().trim() || stdout.text().trim();
+							if (stageError) throw new Error(stageError, { cause: error });
+							throw error;
+						}
+						const response = deserialize(encodedResponse);
+						if (!response.ok || !response.result) throw new Error(response.error || stderr.text() || stdout.text() || "The isolated server compiler failed.");
+						resolve(response.result);
+					} catch (error) {
+						reject(error);
+					}
+				});
+				child.stdin.end();
+			});
+		} finally {
+			await rm(transportDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async compileRust(request) {
+		const result = await this.runCompilerStage("rustc-stage.mjs", { request }, RUST_COMPILE_TIMEOUT_MS, [RUST_TOOLCHAIN.packageAsset, RUST_TOOLCHAIN.manifestAsset]);
+		return {
+			...result,
+			diagnostics: parseRustDiagnostics(result.stderr),
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	async compilePython(request) {
+		const result = await this.runCompilerStage("python-stage.mjs", { request }, PYTHON_COMPILE_TIMEOUT_MS, [PYTHON_PACKAGE_ASSET_PATH]);
+		return {
+			...result,
+			bytecode: Object.fromEntries(Object.entries(result.bytecodeBase64).map(([path, base64]) => [path, new Uint8Array(Buffer.from(base64, "base64"))])),
+			diagnostics: parsePythonDiagnostics(`${result.stderr}\n${result.stdout}`)
+		};
+	}
+	async compileGo(request) {
+		const result = await this.runCompilerStage("go-stage.mjs", {
+			compilerExecutable: this.compilerExecutable,
+			compileBatchSchema: WASM_OJ_SCHEMAS.compileBatch,
+			request
+		}, GO_COMPILE_TIMEOUT_MS, [
+			GO_TOOLCHAIN.packageAsset,
+			GO_TOOLCHAIN.manifestAsset,
+			GO_TOOLCHAIN.standardLibraryAsset
+		]);
+		return {
+			...result,
+			diagnostics: parseGoDiagnostics(result.stderr),
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	async compileJava(request) {
+		const result = await this.runCompilerStage("java-stage.mjs", { request }, JAVA_COMPILE_TIMEOUT_MS, [
+			JAVA_COMPILER_ASSET_PATH,
+			JAVA_COMPILE_CLASSLIB_ASSET_PATH,
+			JAVA_RUNTIME_CLASSLIB_ASSET_PATH
+		]);
+		return {
+			...result,
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	runCompilerStage(scriptName, input, timeoutMs, assetPaths) {
+		const operation = this.activeOperation;
+		if (!operation || operation.kind !== "build") return Promise.reject(/* @__PURE__ */ new Error("Server compilation was cancelled before its compiler stage started."));
+		this.assertCurrent(operation, "Server compilation was cancelled before its compiler stage started.");
+		return new Promise((resolve, reject) => {
+			const script = serverStageScript(this.stageDirectory, scriptName);
+			const child = spawn(process.execPath, [
+				"--experimental-strip-types",
+				"--disable-warning=ExperimentalWarning",
+				script
+			], { stdio: [
+				"pipe",
+				"pipe",
+				"pipe",
+				"pipe"
+			] });
+			this.activeChildren.add(child);
+			let transportError;
+			let timedOut = false;
+			const failTransport = (error) => {
+				transportError ??= error;
+				child.kill("SIGKILL");
+			};
+			const stdout = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' stdout`, SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+			const stderr = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' stderr`, SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+			const responseBytes = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' response`, SERVER_COMPILER_STAGE_RESPONSE_LIMIT_BYTES, failTransport);
+			child.stdout.on("data", (chunk) => stdout.append(chunk));
+			child.stderr.on("data", (chunk) => stderr.append(chunk));
+			child.on("error", (error) => {
+				transportError = error;
+			});
+			child.stdin.on("error", (error) => {
+				transportError ??= error;
+			});
+			const responseStream = child.stdio[3];
+			if (!responseStream || typeof responseStream === "number") {
+				child.kill("SIGKILL");
+				this.activeChildren.delete(child);
+				reject(/* @__PURE__ */ new Error(`The isolated compiler stage '${scriptName}' did not expose its response channel.`));
+				return;
+			}
+			responseStream.on("data", (chunk) => responseBytes.append(chunk));
+			const timer = setTimeout(() => {
+				timedOut = true;
+				child.kill("SIGKILL");
+			}, timeoutMs + 5e3);
+			child.on("close", () => {
+				clearTimeout(timer);
+				this.activeChildren.delete(child);
+				try {
+					if (transportError) throw transportError;
+					if (timedOut) throw new Error(`The isolated compiler stage '${scriptName}' exceeded ${timeoutMs + 5e3} ms.`);
+					const response = JSON.parse(responseBytes.text());
+					if (!response.ok || !response.result) throw new Error(response.error || stderr.text() || stdout.text() || `The isolated compiler stage '${scriptName}' failed.`);
+					resolve(response.result);
+				} catch (error) {
+					reject(error);
+				}
+			});
+			child.stdin.end(JSON.stringify({
+				toolchainAssets: serverToolchainAssetFiles(this.toolchains, assetPaths),
+				verifiedToolchain: this.verifiedToolchain,
+				...input
+			}));
+		});
+	}
+	async loadToolchainAsset(assetPath) {
+		const resolved = serverToolchainAssetFile(this.toolchains, assetPath);
+		const compressed = await readFile(resolved);
+		if (!this.verifiedToolchain) this.verifyToolchainAsset(assetPath, compressed);
+		return uint8View(gunzipSync(compressed));
+	}
+	async loadToolchainFile(assetPath) {
+		const resolved = serverToolchainAssetFile(this.toolchains, assetPath);
+		const bytes = await readFile(resolved);
+		if (!this.verifiedToolchain) this.verifyToolchainAsset(assetPath, bytes);
+		return new Uint8Array(bytes);
+	}
+	verifyToolchainAsset(assetPath, bytes) {
+		const expected = toolchainAssetSource(this.toolchains, assetPath).asset.sha256;
+		const actual = createHash("sha256").update(bytes).digest("hex");
+		if (actual !== expected) throw new Error(`Pinned toolchain asset '${assetPath}' has digest ${actual}; expected ${expected}.`);
+	}
+	beginOperation(kind) {
+		this.assertActive();
+		if (this.activeOperation) throw new Error("ServerCompiler accepts one active operation at a time.");
+		const operation = {
+			kind,
+			generation: this.generation,
+			superseded: false
+		};
+		this.activeOperation = operation;
+		return operation;
+	}
+	endOperation(operation) {
+		if (this.activeOperation === operation) this.activeOperation = void 0;
+	}
+	assertCurrent(operation, message) {
+		this.assertActive();
+		if (!this.isCurrent(operation)) throw new Error(message);
+	}
+	isCurrent(operation) {
+		return !this.disposed && !operation.superseded && operation.generation === this.generation;
+	}
+	terminateChildren() {
+		for (const child of this.activeChildren) {
+			if (this.inProcess) {
+				child.kill("SIGKILL");
+				continue;
+			}
+			child.kill("SIGTERM");
+			setTimeout(() => {
+				if (this.activeChildren.has(child)) child.kill("SIGKILL");
+			}, 1e3).unref();
+		}
+	}
+	assertActive() {
+		if (this.disposed) throw new Error("ServerCompiler is disposed.");
+	}
+};
+function uint8View(bytes) {
+	return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+}
+//#endregion
+//#region src/runner/runtime-files.ts
+var MAGIC = new TextEncoder().encode("WOJFS002");
+var HEADER_BYTES = 12;
+`${WASM_OJ_STORAGE.runtimeFilesCache}`;
+String.raw`
+import io
+import os
+import sys
+import zipfile
+
+source_root = "/usr/local/lib/python3.14"
+guest_path = "/cpython/lib/python314.zip"
+output = sys.stdout.buffer
+output.write(b"WOJFS002")
+
+archive_buffer = io.BytesIO()
+with zipfile.ZipFile(archive_buffer, "w", compression=zipfile.ZIP_STORED) as archive:
+    for root, directories, files in os.walk(source_root):
+        directories[:] = sorted(
+            name for name in directories
+            if name != "__pycache__" and not os.path.islink(os.path.join(root, name))
+        )
+        for name in sorted(files):
+            source_path = os.path.join(root, name)
+            if os.path.islink(source_path) or name.endswith((".pyc", ".pyo")):
+                continue
+            archive_path = os.path.relpath(source_path, source_root).replace(os.sep, "/")
+            info = zipfile.ZipInfo(archive_path, date_time=(1980, 1, 1, 0, 0, 0))
+            info.compress_type = zipfile.ZIP_STORED
+            info.external_attr = 0o100644 << 16
+            with open(source_path, "rb") as source:
+                archive.writestr(info, source.read())
+
+encoded_path = guest_path.encode("utf-8")
+archive_data = archive_buffer.getvalue()
+output.write(len(encoded_path).to_bytes(4, "little"))
+output.write(len(archive_data).to_bytes(8, "little"))
+output.write(encoded_path)
+output.write(archive_data)
+
+output.write((0).to_bytes(4, "little"))
+output.write((0).to_bytes(8, "little"))
+`;
+function safeRuntimePath(path) {
+	return path.startsWith("/") && !path.includes("\\") && !path.includes("//") && !path.endsWith("/") && !path.split("/").some((component) => component === "." || component === "..");
+}
+function decodeRuntimeFiles(archive) {
+	if (archive.byteLength < MAGIC.byteLength + HEADER_BYTES) throw new Error("Runtime file archive is truncated.");
+	for (let index = 0; index < MAGIC.byteLength; index += 1) if (archive[index] !== MAGIC[index]) throw new Error("Runtime file archive has an invalid signature.");
+	const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	const files = {};
+	let offset = MAGIC.byteLength;
+	while (true) {
+		if (offset + HEADER_BYTES > archive.byteLength) throw new Error("Runtime file archive ended inside an entry header.");
+		const pathLength = view.getUint32(offset, true);
+		const dataLength = Number(view.getBigUint64(offset + 4, true));
+		offset += HEADER_BYTES;
+		if (pathLength === 0 && dataLength === 0) break;
+		if (pathLength === 0 || !Number.isSafeInteger(dataLength)) throw new Error("Runtime file archive contains an invalid entry size.");
+		const end = offset + pathLength + dataLength;
+		if (!Number.isSafeInteger(end) || end > archive.byteLength) throw new Error("Runtime file archive entry exceeds the archive boundary.");
+		const path = decoder.decode(archive.subarray(offset, offset + pathLength));
+		offset += pathLength;
+		if (!safeRuntimePath(path)) throw new Error(`Runtime file archive contains an unsafe path: '${path}'.`);
+		if (Object.hasOwn(files, path)) throw new Error(`Runtime file archive contains duplicate path '${path}'.`);
+		files[path] = archive.slice(offset, offset + dataLength);
+		offset += dataLength;
+	}
+	if (offset !== archive.byteLength) throw new Error("Runtime file archive contains trailing bytes.");
+	return files;
+}
+async function verifyAndDecodeRuntimeFiles(archive, expectedSha256) {
+	if (!/^[a-f0-9]{64}$/.test(expectedSha256)) throw new Error("Runtime file archive expected SHA-256 must be 64 lowercase hexadecimal characters.");
+	const actual = await sha256Hex(archive);
+	if (actual !== expectedSha256) throw new Error(`Runtime file archive has digest ${actual}; expected ${expectedSha256}.`);
+	return decodeRuntimeFiles(archive);
+}
+//#endregion
+//#region src/runner/preparation-timeout-policy.ts
+var DEFAULT_RUNTIME_PREPARATION_TIMEOUT_MS = 12e4;
+var PYTHON_RUNTIME_PREPARATION_TIMEOUT_MS = 3e5;
+/** Shared hard boundary for browser Worker and server-child runtime preparation. */
+function runtimePreparationTimeoutMs(artifact) {
+	return artifact.language === "python" ? PYTHON_RUNTIME_PREPARATION_TIMEOUT_MS : DEFAULT_RUNTIME_PREPARATION_TIMEOUT_MS;
+}
+//#endregion
+//#region src/server/server-runner.ts
+var WASM_OJ_RUNTIME_CACHE_FILE = /^[0-9a-f]{64}\.wasmojfs$/;
+var WASM_OJ_RUNTIME_CACHE_TEMPORARY_FILE = /^[0-9a-f]{64}\.wasmojfs\.[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.tmp$/;
+var SERVER_RUNNER_STAGE_SCRIPT = "server-runner-stage.mjs";
+var MAX_RUNNER_STAGE_RESPONSE_BYTES = 268435456;
+var MAX_RUNNER_STAGE_DIAGNOSTIC_BYTES = 1048576;
+var MAX_RUNTIME_CACHE_ARCHIVE_BYTES = 67108864;
+var MAX_NATIVE_CORE_DIAGNOSTIC_BYTES = 1048576;
+var NATIVE_CORE_RESPONSE_OVERHEAD_BYTES = 2097152;
+var ServerRunner = class {
+	runtimeExecutable;
+	toolchains;
+	cacheDirectory;
+	verifiedToolchain;
+	stageDirectory;
+	resolvedCacheDirectory;
+	runtimeDrivers;
+	packageCommands = /* @__PURE__ */ new Map();
+	packageFileSystems = /* @__PURE__ */ new Map();
+	progressListeners = /* @__PURE__ */ new Set();
+	streamListeners = /* @__PURE__ */ new Set();
+	initialization;
+	activeNativeRuns = /* @__PURE__ */ new Set();
+	activePreparationStages = /* @__PURE__ */ new Set();
+	inFlightRuns = /* @__PURE__ */ new Set();
+	activeOperation;
+	cacheClearActive = false;
+	generation = 0;
+	disposed = false;
+	constructor(options) {
+		this.runtimeExecutable = path.resolve(options.runtimeExecutable);
+		this.toolchains = snapshotServerToolchainSources(options.toolchains);
+		if (options.verifiedDistribution) assertVerifiedToolchainDistribution(options.verifiedDistribution, this.toolchains);
+		this.verifiedToolchain = options.verifiedDistribution !== void 0;
+		this.stageDirectory = resolveServerStageDirectory();
+		this.cacheDirectory = path.resolve(options.cacheDirectory);
+		assertCacheDirectoryIsNotFilesystemRoot(this.cacheDirectory);
+		if (options.runtimeDrivers && options.additionalCostBaselines) throw new Error("Provide either runtimeDrivers or additionalCostBaselines, not both.");
+		this.runtimeDrivers = options.runtimeDrivers ?? createDefaultRuntimeDrivers(createExtendedCostBaselineRegistry(options.additionalCostBaselines));
+	}
+	async ready() {
+		this.assertActive();
+		const generation = this.generation;
+		let initialization = this.initialization;
+		if (!initialization) {
+			initialization = this.initialize();
+			this.initialization = initialization;
+			initialization.catch(() => {
+				if (this.initialization === initialization) this.initialization = void 0;
+			});
+		}
+		await initialization;
+		this.assertActive();
+		if (generation !== this.generation) throw new Error("Server runner initialization was superseded.");
+	}
+	async run(artifact, config) {
+		this.assertActive();
+		this.assertArtifactToolchain(artifact);
+		if (this.activeOperation || this.cacheClearActive) throw new Error("ServerRunner accepts one active operation at a time.");
+		const operation = createServerRunOperation(this.generation);
+		this.activeOperation = operation;
+		this.inFlightRuns.add(operation);
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server execution was cancelled before runtime preparation completed.");
+			const started = performance.now();
+			this.progress({
+				phase: "loading-toolchain",
+				label: `Resolving runtime for ${artifact.name}`,
+				progress: .1
+			});
+			this.assertCurrent(operation, "Server execution was cancelled before runtime preparation started.");
+			const prepared = await this.prepareWithDeadline(operation, artifact, config);
+			this.assertCurrent(operation, "Server execution was cancelled during runtime preparation.");
+			this.progress({
+				phase: "running",
+				label: `Running ${artifact.name} with native deterministic Wasmer`,
+				progress: .25
+			});
+			this.assertCurrent(operation, "Server execution was cancelled before the native runtime started.");
+			const result = await this.runNativeCore(prepared, config, started);
+			this.assertCurrent(operation, "Server execution was cancelled before its result was delivered.");
+			if (result.stdout) {
+				this.stream("stdout", result.stdout);
+				this.assertCurrent(operation, "Server execution was cancelled while its output was delivered.");
+			}
+			if (result.stderr) {
+				this.stream("stderr", result.stderr);
+				this.assertCurrent(operation, "Server execution was cancelled while its output was delivered.");
+			}
+			return result;
+		} finally {
+			await operation.quiesce();
+			if (this.activeOperation === operation) this.activeOperation = void 0;
+			this.inFlightRuns.delete(operation);
+			operation.complete();
+		}
+	}
+	async runTrusted(program, config) {
+		this.assertActive();
+		if (this.activeOperation || this.cacheClearActive) throw new Error("ServerRunner accepts one active operation at a time.");
+		const operation = createServerRunOperation(this.generation);
+		this.activeOperation = operation;
+		this.inFlightRuns.add(operation);
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Trusted judge execution was cancelled before preparation completed.");
+			const started = performance.now();
+			const prepared = await this.prepareTrustedWithDeadline(operation, program, config);
+			this.assertCurrent(operation, "Trusted judge execution was cancelled during preparation.");
+			const result = await this.runNativeCore(prepared, config, started);
+			this.assertCurrent(operation, "Trusted judge execution was cancelled before its result was delivered.");
+			return result;
+		} finally {
+			await operation.quiesce();
+			if (this.activeOperation === operation) this.activeOperation = void 0;
+			this.inFlightRuns.delete(operation);
+			operation.complete();
+		}
+	}
+	async interact(contestantArtifact, interactorArtifact, config) {
+		this.assertActive();
+		this.assertArtifactToolchain(contestantArtifact);
+		this.assertArtifactToolchain(interactorArtifact);
+		if (this.activeOperation || this.cacheClearActive) throw new Error("ServerRunner accepts one active operation at a time.");
+		if (interactorArtifact.kind !== "wasm") throw new Error("Interactive judge artifacts must be standalone Wasm modules.");
+		const operation = createServerRunOperation(this.generation);
+		this.activeOperation = operation;
+		this.inFlightRuns.add(operation);
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server interaction was cancelled before runtime preparation completed.");
+			const started = performance.now();
+			this.progress({
+				phase: "loading-toolchain",
+				label: "Resolving contestant and interactor runtimes",
+				progress: .1
+			});
+			const [contestant, interactor] = await Promise.all([this.prepareInteractiveWithDeadline(operation, contestantArtifact, interactiveRunConfig(config.contestant, config.determinism)), this.prepareInteractiveWithDeadline(operation, interactorArtifact, interactiveRunConfig(config.interactor, config.determinism))]);
+			this.assertCurrent(operation, "Server interaction was cancelled during runtime preparation.");
+			this.progress({
+				phase: "running",
+				label: "Running interactive session with native deterministic Wasmer",
+				progress: .25
+			});
+			const result = await this.runNativeInteractive(contestant, interactor, config, started);
+			this.assertCurrent(operation, "Server interaction was cancelled before its result was delivered.");
+			return result;
+		} finally {
+			await operation.quiesce();
+			if (this.activeOperation === operation) this.activeOperation = void 0;
+			this.inFlightRuns.delete(operation);
+			operation.complete();
+		}
+	}
+	async interactTrusted(contestantArtifact, interactorProgram, config) {
+		this.assertActive();
+		this.assertArtifactToolchain(contestantArtifact);
+		if (this.activeOperation || this.cacheClearActive) throw new Error("ServerRunner accepts one active operation at a time.");
+		const operation = createServerRunOperation(this.generation);
+		this.activeOperation = operation;
+		this.inFlightRuns.add(operation);
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Trusted interaction was cancelled before preparation completed.");
+			const started = performance.now();
+			const [contestant, interactor] = await Promise.all([this.prepareInteractiveWithDeadline(operation, contestantArtifact, interactiveRunConfig(config.contestant, config.determinism)), this.prepareTrustedWithDeadline(operation, interactorProgram, interactiveRunConfig(config.interactor, config.determinism))]);
+			this.assertCurrent(operation, "Trusted interaction was cancelled during preparation.");
+			return await this.runNativeInteractive(contestant, interactor, config, started);
+		} finally {
+			await operation.quiesce();
+			if (this.activeOperation === operation) this.activeOperation = void 0;
+			this.inFlightRuns.delete(operation);
+			operation.complete();
+		}
+	}
+	onProgress(listener) {
+		this.assertActive();
+		this.progressListeners.add(listener);
+		return () => this.progressListeners.delete(listener);
+	}
+	onStream(listener) {
+		this.assertActive();
+		this.streamListeners.add(listener);
+		return () => this.streamListeners.delete(listener);
+	}
+	async clearRuntimeCache() {
+		this.assertActive();
+		if (this.cacheClearActive || this.activeOperation || this.inFlightRuns.size > 0) throw new Error("Cannot clear the runtime cache while execution is still in flight.");
+		this.cacheClearActive = true;
+		const generation = this.generation;
+		try {
+			await this.ready();
+			this.assertActive();
+			if (generation !== this.generation) throw new Error("Server runtime cache clearing was superseded.");
+			this.packageCommands.clear();
+			this.packageFileSystems.clear();
+			await removeWasmOjRuntimeCacheFiles(this.runtimeCacheDirectory());
+			this.assertActive();
+			if (generation !== this.generation) throw new Error("Server runtime cache clearing was superseded.");
+		} finally {
+			this.cacheClearActive = false;
+		}
+	}
+	cancel() {
+		if (this.disposed) return;
+		if (this.cacheClearActive) return;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation.cancel(/* @__PURE__ */ new Error("Server execution was superseded by cancellation."));
+			this.activeOperation = void 0;
+		}
+		this.abortPreparationStages(/* @__PURE__ */ new Error("Server runtime preparation was cancelled."));
+		this.terminateActiveNativeRuns(/* @__PURE__ */ new Error("Server execution was cancelled."));
+	}
+	async cancelAndWait() {
+		const completions = [...this.inFlightRuns].map((operation) => operation.completion);
+		this.cancel();
+		await Promise.all(completions);
+	}
+	restart() {
+		this.assertActive();
+		if (this.cacheClearActive) throw new Error("Cannot restart ServerRunner while clearing its cache.");
+		this.cancel();
+		this.packageCommands.clear();
+		this.packageFileSystems.clear();
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation.cancel(/* @__PURE__ */ new Error("Server execution was cancelled because its runner was disposed."));
+			this.activeOperation = void 0;
+		}
+		this.abortPreparationStages(/* @__PURE__ */ new Error("Server runtime preparation was cancelled because its runner was disposed."));
+		this.terminateActiveNativeRuns(/* @__PURE__ */ new Error("Server execution was cancelled because its runner was disposed."));
+		this.progressListeners.clear();
+		this.streamListeners.clear();
+		this.packageCommands.clear();
+		this.packageFileSystems.clear();
+	}
+	async initialize() {
+		await access(this.runtimeExecutable, constants.X_OK);
+		await mkdir(this.cacheDirectory, { recursive: true });
+		const resolvedCacheDirectory = await realpath(this.cacheDirectory);
+		assertCacheDirectoryIsNotFilesystemRoot(resolvedCacheDirectory);
+		this.resolvedCacheDirectory = resolvedCacheDirectory;
+		await Promise.all(serverToolchainDirectories(this.toolchains).map((directory) => access(directory, constants.R_OK)));
+	}
+	runtimeCacheDirectory() {
+		if (!this.resolvedCacheDirectory) throw new Error("ServerRunner runtime cache is not initialized.");
+		return this.resolvedCacheDirectory;
+	}
+	resolver(operation) {
+		return {
+			quickJs: () => operation.track(this.loadQuickJsForOperation(operation)),
+			packageCommand: (packageSpecifier, commandName) => this.packageCommand(operation, packageSpecifier, commandName),
+			packageFileSystem: (request) => this.packageFileSystem(operation, request)
+		};
+	}
+	async prepareWithDeadline(operation, artifact, config) {
+		const timeoutMs = runtimePreparationTimeoutMs(artifact);
+		let timer;
+		const deadline = new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				const error = /* @__PURE__ */ new Error(`Server runtime preparation exceeded ${timeoutMs} ms.`);
+				operation.superseded = true;
+				this.abortPreparationStages(error, operation);
+				reject(error);
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([
+				prepareArtifactRun(artifact, config, this.resolver(operation), this.runtimeDrivers),
+				operation.cancellation,
+				deadline
+			]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+	async prepareInteractiveWithDeadline(operation, artifact, config) {
+		const timeoutMs = runtimePreparationTimeoutMs(artifact);
+		let timer;
+		const deadline = new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				const error = /* @__PURE__ */ new Error(`Server interactive runtime preparation exceeded ${timeoutMs} ms.`);
+				operation.superseded = true;
+				this.abortPreparationStages(error, operation);
+				reject(error);
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([
+				prepareArtifactInteraction(artifact, config, this.resolver(operation), this.runtimeDrivers),
+				operation.cancellation,
+				deadline
+			]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+	async prepareTrustedWithDeadline(operation, program, config) {
+		let timer;
+		const deadline = new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				const error = /* @__PURE__ */ new Error(`Trusted judge runtime preparation exceeded ${DEFAULT_RUNTIME_PREPARATION_TIMEOUT_MS} ms.`);
+				operation.superseded = true;
+				this.abortPreparationStages(error, operation);
+				reject(error);
+			}, DEFAULT_RUNTIME_PREPARATION_TIMEOUT_MS);
+		});
+		try {
+			return await Promise.race([
+				Promise.resolve().then(() => prepareTrustedJudgeRun(program, config)),
+				operation.cancellation,
+				deadline
+			]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+	async loadQuickJsForOperation(operation) {
+		this.assertCurrent(operation, "Server execution was cancelled before QuickJS was loaded.");
+		const bytes = await this.loadQuickJs();
+		this.assertCurrent(operation, "Server execution was cancelled while QuickJS was loaded.");
+		return bytes;
+	}
+	async loadQuickJs() {
+		return this.loadCompressedToolchainAsset(QUICKJS_ASSET_PATH, QUICKJS_ASSET_SHA256);
+	}
+	packageCommand(operation, packageSpecifier, command) {
+		this.assertPinnedPackageCommand(packageSpecifier, command);
+		this.assertCurrent(operation, "Server execution was cancelled before its package command was loaded.");
+		const identity = `${packageSpecifier}\n${command}`;
+		let pending = this.packageCommands.get(identity);
+		if (!pending) {
+			pending = this.runPackageStage(operation, {
+				operation: "command-binary",
+				packageSpecifier,
+				command
+			}).then((result) => {
+				if (result.operation !== "command-binary") throw new Error(`Runner stage returned '${result.operation}' for a command-binary request.`);
+				const verifiedBytes = new Uint8Array(result.bytes.byteLength);
+				verifiedBytes.set(result.bytes);
+				if (!WebAssembly.validate(verifiedBytes)) throw new Error(`Package '${packageSpecifier}' command '${command}' returned invalid WebAssembly.`);
+				this.assertCurrent(operation, "Server execution was cancelled while its package command was loaded.");
+				return verifiedBytes;
+			}).catch((error) => {
+				if (this.packageCommands.get(identity) === pending) this.packageCommands.delete(identity);
+				throw error;
+			});
+			this.packageCommands.set(identity, pending);
+		}
+		return operation.track(pending.then((bytes) => bytes.slice()));
+	}
+	assertPinnedPackageCommand(packageSpecifier, command) {
+		if (packageSpecifier !== PYTHON_PACKAGE || command !== "python") throw new Error(`No pinned WASM-OJ runtime command is declared for '${packageSpecifier}:${command}'.`);
+	}
+	async loadCompressedToolchainAsset(assetPath, compressedSha256, expandedSha256) {
+		const file = serverToolchainAssetFile(this.toolchains, assetPath);
+		const compressed = await readFile(file);
+		if (!this.verifiedToolchain) this.verifyDigest(file, compressed, compressedSha256);
+		const expandedBuffer = gunzipSync(compressed);
+		const expanded = new Uint8Array(expandedBuffer.buffer, expandedBuffer.byteOffset, expandedBuffer.byteLength);
+		if (expandedSha256 && !this.verifiedToolchain) this.verifyDigest(file, expanded, expandedSha256);
+		return expanded;
+	}
+	verifyDigest(file, bytes, expected) {
+		const actual = createHash("sha256").update(bytes).digest("hex");
+		if (actual !== expected) throw new Error(`Pinned toolchain asset '${file}' has digest ${actual}; expected ${expected}.`);
+	}
+	packageFileSystem(operation, request) {
+		this.assertPinnedPackageCommand(request.packageSpecifier, request.command);
+		this.assertCurrent(operation, "Server execution was cancelled before its runtime files were loaded.");
+		const identity = `${request.packageSpecifier}\n${request.command}\n${request.cacheKey}\n${request.expectedSha256}`;
+		let pending = this.packageFileSystems.get(identity);
+		if (!pending) {
+			pending = this.loadOrExportPackageFileSystem(operation, identity, request).catch((error) => {
+				if (this.packageFileSystems.get(identity) === pending) this.packageFileSystems.delete(identity);
+				throw error;
+			});
+			this.packageFileSystems.set(identity, pending);
+		}
+		return operation.track(pending.then(cloneRuntimeFiles));
+	}
+	async loadOrExportPackageFileSystem(operation, identity, request) {
+		this.assertCurrent(operation, "Server execution was cancelled before its runtime cache was read.");
+		const digest = createHash("sha256").update(identity).digest("hex");
+		const cachePath = path.join(this.runtimeCacheDirectory(), `${digest}.wasmojfs`);
+		const cachedArchive = await this.readRuntimeCacheArchive(cachePath);
+		this.assertCurrent(operation, "Server execution was cancelled while its runtime cache was read.");
+		if (cachedArchive) try {
+			return await verifyAndDecodeRuntimeFiles(cachedArchive, request.expectedSha256);
+		} catch (error) {
+			this.reportRuntimeCacheIssue("Ignoring an invalid runtime cache archive", error);
+			await this.removeInvalidRuntimeCacheArchive(cachePath);
+			this.assertCurrent(operation, "Server execution was cancelled while invalid runtime cache data was removed.");
+		}
+		const result = await this.runPackageStage(operation, {
+			operation: "runtime-files",
+			packageSpecifier: request.packageSpecifier,
+			command: request.command,
+			args: [...request.args]
+		});
+		if (result.operation !== "runtime-files") throw new Error(`Runner stage returned '${result.operation}' for a runtime-files request.`);
+		this.assertCurrent(operation, "Server execution was cancelled while its runtime files were exported.");
+		const archive = result.bytes.slice();
+		const files = await verifyAndDecodeRuntimeFiles(archive, request.expectedSha256);
+		this.assertCurrent(operation, "Server execution was cancelled while its runtime files were verified.");
+		await this.persistVerifiedRuntimeCacheArchive(cachePath, archive);
+		this.assertCurrent(operation, "Server execution was cancelled while its runtime files were cached.");
+		return files;
+	}
+	async runPackageStage(operation, request) {
+		this.assertCurrent(operation, "Server execution was cancelled before its runtime stage started.");
+		const transportDirectory = await mkdtemp(path.join(os.tmpdir(), "wasm-oj-runner-response-"));
+		const responsePath = path.join(transportDirectory, "response.v8");
+		try {
+			this.assertCurrent(operation, "Server execution was cancelled before its runtime stage spawned.");
+			return await new Promise((resolve, reject) => {
+				const script = serverStageScript(this.stageDirectory, SERVER_RUNNER_STAGE_SCRIPT);
+				const child = spawn(process.execPath, [
+					"--experimental-strip-types",
+					"--disable-warning=ExperimentalWarning",
+					script
+				], {
+					stdio: [
+						"pipe",
+						"pipe",
+						"pipe"
+					],
+					env: {
+						...process.env,
+						WASM_OJ_RUNNER_STAGE_RESPONSE: responsePath
+					}
+				});
+				const stdout = [];
+				const stderr = [];
+				let stdoutBytes = 0;
+				let stderrBytes = 0;
+				let settled = false;
+				const cleanup = (ignoreLateChildError) => {
+					child.off("close", onClose);
+					child.off("error", onChildError);
+					child.stdin.off("error", onStdinError);
+					child.stdout.off("data", onStdout);
+					child.stderr.off("data", onStderr);
+					this.activePreparationStages.delete(active);
+					if (ignoreLateChildError) child.once("error", () => void 0);
+				};
+				const fail = (error, kill) => {
+					if (settled) return;
+					settled = true;
+					if (kill) try {
+						child.kill("SIGKILL");
+					} catch {}
+					cleanup(kill);
+					reject(error);
+				};
+				const succeed = (result) => {
+					if (settled) return;
+					settled = true;
+					cleanup(false);
+					resolve(result);
+				};
+				const capture = (chunks, chunk, currentBytes, stream) => {
+					const nextBytes = currentBytes + chunk.byteLength;
+					if (nextBytes > MAX_RUNNER_STAGE_DIAGNOSTIC_BYTES) {
+						fail(/* @__PURE__ */ new Error(`The isolated server runtime stage exceeded its ${MAX_RUNNER_STAGE_DIAGNOSTIC_BYTES}-byte ${stream} limit.`), true);
+						return currentBytes;
+					}
+					chunks.push(chunk);
+					return nextBytes;
+				};
+				const onStdout = (chunk) => {
+					stdoutBytes = capture(stdout, chunk, stdoutBytes, "stdout");
+				};
+				const onStderr = (chunk) => {
+					stderrBytes = capture(stderr, chunk, stderrBytes, "stderr");
+				};
+				const onChildError = (error) => fail(error, true);
+				const onStdinError = (error) => fail(error, true);
+				const onClose = (code, signal) => {
+					(async () => {
+						try {
+							const response = await readRunnerStageResponse(responsePath, request.operation);
+							this.assertCurrent(operation, "Server execution was cancelled while its runtime stage completed.");
+							if (code !== 0 || signal) throw new Error(runnerStageDiagnostic(stdout, stderr, `The isolated server runtime stage exited with ${signal ?? `code ${String(code)}`}.`));
+							succeed(response);
+						} catch (error) {
+							fail(new Error(runnerStageDiagnostic(stdout, stderr, error instanceof Error ? error.message : String(error)), { cause: error }), false);
+						}
+					})();
+				};
+				const active = {
+					operation,
+					abort: (error) => fail(error, true)
+				};
+				this.activePreparationStages.add(active);
+				child.stdout.on("data", onStdout);
+				child.stderr.on("data", onStderr);
+				child.on("error", onChildError);
+				child.stdin.on("error", onStdinError);
+				child.on("close", onClose);
+				child.stdin.end(JSON.stringify({
+					toolchainAsset: serverToolchainAssetFile(this.toolchains, PYTHON_PACKAGE_ASSET_PATH),
+					verifiedToolchain: this.verifiedToolchain,
+					request
+				}));
+			});
+		} finally {
+			await rm(transportDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async readRuntimeCacheArchive(cachePath) {
+		try {
+			const status = await lstat(cachePath);
+			if (!status.isFile()) {
+				this.progress({
+					phase: "restoring-cache",
+					label: `Ignoring non-regular runtime cache entry '${cachePath}'.`
+				});
+				return;
+			}
+			if (status.size > MAX_RUNTIME_CACHE_ARCHIVE_BYTES) {
+				this.progress({
+					phase: "restoring-cache",
+					label: `Removing oversized runtime cache archive '${cachePath}' (${status.size} bytes).`
+				});
+				await this.removeInvalidRuntimeCacheArchive(cachePath);
+				return;
+			}
+			return new Uint8Array(await readBoundedRegularFile(cachePath, MAX_RUNTIME_CACHE_ARCHIVE_BYTES));
+		} catch (error) {
+			if (isFileSystemError(error, "ENOENT")) return void 0;
+			this.reportRuntimeCacheIssue("Unable to read the runtime cache archive", error);
+			await this.removeInvalidRuntimeCacheArchive(cachePath);
+			return;
+		}
+	}
+	async removeInvalidRuntimeCacheArchive(cachePath) {
+		try {
+			if ((await lstat(cachePath)).isFile()) await unlink(cachePath);
+		} catch (error) {
+			if (!isFileSystemError(error, "ENOENT")) this.reportRuntimeCacheIssue("Unable to remove the invalid runtime cache archive", error);
+		}
+	}
+	async persistVerifiedRuntimeCacheArchive(cachePath, archive) {
+		const temporary = `${cachePath}.${crypto.randomUUID()}.tmp`;
+		try {
+			await writeFile(temporary, archive, { flag: "wx" });
+			await rename(temporary, cachePath);
+		} catch (error) {
+			this.reportRuntimeCacheIssue("Unable to persist the verified runtime cache archive", error);
+			try {
+				await unlink(temporary);
+			} catch (cleanupError) {
+				if (!isFileSystemError(cleanupError, "ENOENT")) this.reportRuntimeCacheIssue("Unable to remove a temporary runtime cache archive", cleanupError);
+			}
+		}
+	}
+	reportRuntimeCacheIssue(action, error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		this.progress({
+			phase: "restoring-cache",
+			label: `${action}: ${detail}`
+		});
+	}
+	runNativeCore(request, config, started) {
+		return new Promise((resolve, reject) => {
+			const child = spawn(this.runtimeExecutable, [], { stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			] });
+			let settled = false;
+			const cleanup = (ignoreLateChildError) => {
+				clearTimeout(timer);
+				child.off("close", onClose);
+				child.off("error", onChildError);
+				child.stdin.off("error", onStdinError);
+				child.stdout.off("data", onStdout);
+				child.stderr.off("data", onStderr);
+				this.activeNativeRuns.delete(active);
+				if (ignoreLateChildError) child.once("error", () => void 0);
+			};
+			const fail = (error, kill) => {
+				if (settled) return;
+				settled = true;
+				if (kill) try {
+					child.kill("SIGKILL");
+				} catch {}
+				cleanup(kill);
+				reject(error);
+			};
+			const succeed = (result, kill) => {
+				if (settled) return;
+				settled = true;
+				if (kill) try {
+					child.kill("SIGKILL");
+				} catch {}
+				cleanup(kill);
+				resolve(result);
+			};
+			const stdout = new BoundedByteCollector("Native runtime-core protocol stdout", nativeCoreResponseLimit(config.resources.outputLimitBytes), (error) => fail(error, true));
+			const stderr = new BoundedByteCollector("Native runtime-core diagnostic stderr", MAX_NATIVE_CORE_DIAGNOSTIC_BYTES, (error) => fail(error, true));
+			const onStdout = (chunk) => stdout.append(chunk);
+			const onStderr = (chunk) => stderr.append(chunk);
+			const onChildError = (error) => fail(error, true);
+			const onStdinError = (error) => fail(error, true);
+			const onClose = () => {
+				const durationMs = performance.now() - started;
+				try {
+					const output = stdout.text();
+					const response = JSON.parse(output);
+					if (!response.ok || !response.result) {
+						const error = response.error ?? {
+							code: "RUNTIME_ERROR",
+							message: stderr.text() || "Native runtime returned no result."
+						};
+						throw Object.assign(new Error(error.message), { code: error.code });
+					}
+					const trapMessage = response.result.trapMessage;
+					if (trapMessage !== void 0 && trapMessage !== null && typeof trapMessage !== "string") throw new Error("Native runtime returned an invalid trap message.");
+					succeed({
+						code: response.result.code,
+						stdout: Buffer.from(response.result.stdoutBase64, "base64").toString("utf8"),
+						stderr: Buffer.from(response.result.stderrBase64, "base64").toString("utf8"),
+						files: decodeNativeOutputFiles(response.result.filesBase64),
+						durationMs,
+						determinism: { ...config.determinism },
+						resources: { ...config.resources },
+						termination: response.result.termination,
+						...typeof trapMessage === "string" ? { trapMessage } : {},
+						metrics: normalizeExecutionMetrics(response.result.metrics, request.cost)
+					}, false);
+				} catch (error) {
+					fail(error instanceof Error ? error : new Error(String(error)), false);
+				}
+			};
+			const active = {
+				child,
+				abort: (error) => fail(error, true)
+			};
+			const timer = setTimeout(() => {
+				succeed({
+					code: 137,
+					stdout: "",
+					stderr: `Execution exceeded the ${config.resources.wallTimeLimitMs} ms wall deadline.`,
+					files: {},
+					durationMs: performance.now() - started,
+					determinism: { ...config.determinism },
+					resources: { ...config.resources },
+					termination: "wall-time-limit",
+					metrics: unavailableExecutionMetrics(request.cost, WEIGHTED_METER_MODEL)
+				}, true);
+			}, config.resources.wallTimeLimitMs);
+			this.activeNativeRuns.add(active);
+			child.stdout.on("data", onStdout);
+			child.stderr.on("data", onStderr);
+			child.on("error", onChildError);
+			child.stdin.on("error", onStdinError);
+			child.on("close", onClose);
+			child.stdin.end(JSON.stringify(encodeNativeRequest(request)));
+		});
+	}
+	runNativeInteractive(contestant, interactor, config, started) {
+		return new Promise((resolve, reject) => {
+			const child = spawn(this.runtimeExecutable, [], { stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			] });
+			let settled = false;
+			const cleanup = (ignoreLateChildError) => {
+				clearTimeout(timer);
+				child.off("close", onClose);
+				child.off("error", onChildError);
+				child.stdin.off("error", onStdinError);
+				child.stdout.off("data", onStdout);
+				child.stderr.off("data", onStderr);
+				this.activeNativeRuns.delete(active);
+				if (ignoreLateChildError) child.once("error", () => void 0);
+			};
+			const fail = (error, kill) => {
+				if (settled) return;
+				settled = true;
+				if (kill) child.kill("SIGKILL");
+				cleanup(kill);
+				reject(error);
+			};
+			const succeed = (result, kill) => {
+				if (settled) return;
+				settled = true;
+				if (kill) child.kill("SIGKILL");
+				cleanup(kill);
+				resolve(result);
+			};
+			const stdout = new BoundedByteCollector("Native interactive protocol stdout", nativeCoreResponseLimit(contestant.resources.outputLimitBytes + interactor.resources.outputLimitBytes), (error) => fail(error, true));
+			const stderr = new BoundedByteCollector("Native interactive diagnostic stderr", MAX_NATIVE_CORE_DIAGNOSTIC_BYTES, (error) => fail(error, true));
+			const onStdout = (chunk) => stdout.append(chunk);
+			const onStderr = (chunk) => stderr.append(chunk);
+			const onChildError = (error) => fail(error, true);
+			const onStdinError = (error) => fail(error, true);
+			const onClose = () => {
+				try {
+					const response = JSON.parse(stdout.text());
+					if (!response.ok || !response.result) {
+						const error = response.error ?? {
+							code: "RUNTIME_ERROR",
+							message: stderr.text() || "Native interactive runtime returned no result."
+						};
+						throw Object.assign(new Error(error.message), { code: error.code });
+					}
+					succeed({
+						contestant: nativeInteractiveProcess(response.result.contestant, contestant),
+						interactor: nativeInteractiveProcess(response.result.interactor, interactor),
+						contestantToInteractor: Buffer.from(response.result.contestantToInteractorBase64, "base64").toString("utf8"),
+						interactorToContestant: Buffer.from(response.result.interactorToContestantBase64, "base64").toString("utf8"),
+						durationMs: performance.now() - started,
+						determinism: { ...config.determinism }
+					}, false);
+				} catch (error) {
+					fail(error instanceof Error ? error : new Error(String(error)), false);
+				}
+			};
+			const active = {
+				child,
+				abort: (error) => fail(error, true)
+			};
+			const wallTimeLimitMs = Math.min(config.contestant.resources.wallTimeLimitMs, config.interactor.resources.wallTimeLimitMs);
+			const timer = setTimeout(() => {
+				const message = `Interactive execution exceeded the ${wallTimeLimitMs} ms wall deadline.`;
+				succeed({
+					contestant: {
+						code: 137,
+						stderr: message,
+						termination: "wall-time-limit",
+						metrics: unavailableExecutionMetrics(contestant.cost, WEIGHTED_METER_MODEL)
+					},
+					interactor: {
+						code: 137,
+						stderr: message,
+						termination: "wall-time-limit",
+						metrics: unavailableExecutionMetrics(interactor.cost, WEIGHTED_METER_MODEL)
+					},
+					contestantToInteractor: "",
+					interactorToContestant: "",
+					durationMs: performance.now() - started,
+					determinism: { ...config.determinism }
+				}, true);
+			}, wallTimeLimitMs);
+			this.activeNativeRuns.add(active);
+			child.stdout.on("data", onStdout);
+			child.stderr.on("data", onStderr);
+			child.on("error", onChildError);
+			child.stdin.on("error", onStdinError);
+			child.on("close", onClose);
+			child.stdin.end(JSON.stringify(encodeNativeInteractiveRequest(contestant, interactor, config)));
+		});
+	}
+	progress(progress) {
+		for (const listener of this.progressListeners) listener(progress);
+	}
+	stream(stream, chunk) {
+		for (const listener of this.streamListeners) listener(stream, chunk);
+	}
+	assertCurrent(operation, message) {
+		this.assertActive();
+		if (operation.superseded || operation.generation !== this.generation) throw new Error(message);
+	}
+	abortPreparationStages(error, operation) {
+		for (const active of [...this.activePreparationStages]) if (!operation || active.operation === operation) active.abort(error);
+	}
+	terminateActiveNativeRuns(error) {
+		for (const active of [...this.activeNativeRuns]) active.abort(error);
+	}
+	assertActive() {
+		if (this.disposed) throw new Error("ServerRunner is disposed.");
+	}
+	assertArtifactToolchain(artifact) {
+		assertServerToolchainProfile(this.toolchains, artifact.language, artifact.target, artifact.optimization);
+	}
+};
+function createServerRunOperation(generation) {
+	let rejectCancellation;
+	let resolveCompletion;
+	let cancelled = false;
+	let completed = false;
+	const tasks = /* @__PURE__ */ new Set();
+	const cancellation = new Promise((_resolve, reject) => {
+		rejectCancellation = reject;
+	});
+	cancellation.catch(() => void 0);
+	return {
+		generation,
+		superseded: false,
+		cancellation,
+		cancel(error) {
+			if (cancelled) return;
+			cancelled = true;
+			rejectCancellation(error);
+		},
+		track(task) {
+			const settled = task.then(() => void 0, () => void 0);
+			tasks.add(settled);
+			settled.then(() => tasks.delete(settled));
+			return task;
+		},
+		async quiesce() {
+			while (tasks.size > 0) await Promise.all([...tasks]);
+		},
+		completion: new Promise((resolve) => {
+			resolveCompletion = resolve;
+		}),
+		complete() {
+			if (completed) return;
+			completed = true;
+			resolveCompletion();
+		}
+	};
+}
+async function readRunnerStageResponse(responsePath, expectedOperation) {
+	const encoded = await readBoundedRegularFile(responsePath, MAX_RUNNER_STAGE_RESPONSE_BYTES);
+	if (encoded.byteLength === 0) throw new Error("The isolated server runtime stage returned an empty response.");
+	const response = deserialize(encoded);
+	if (!isRecord(response) || typeof response.ok !== "boolean") throw new Error("The isolated server runtime stage returned an invalid response envelope.");
+	if (!response.ok) {
+		if (typeof response.error !== "string" || response.error.length === 0) throw new Error("The isolated server runtime stage failed without an error message.");
+		throw new Error(response.error);
+	}
+	if (!isRecord(response.result)) throw new Error("The isolated server runtime stage returned no result.");
+	const operation = response.result.operation;
+	const bytes = response.result.bytes;
+	if (operation !== expectedOperation) throw new Error(`The isolated server runtime stage returned '${String(operation)}' for '${expectedOperation}'.`);
+	if (!(bytes instanceof Uint8Array)) throw new Error("The isolated server runtime stage returned non-binary result bytes.");
+	return {
+		operation: expectedOperation,
+		bytes: bytes.slice()
+	};
+}
+function nativeCoreResponseLimit(outputLimitBytes) {
+	return Math.ceil(outputLimitBytes / 3) * 4 + NATIVE_CORE_RESPONSE_OVERHEAD_BYTES;
+}
+function runnerStageDiagnostic(stdout, stderr, summary) {
+	const stageDiagnostic = Buffer.concat(stderr).toString("utf8").trim() || Buffer.concat(stdout).toString("utf8").trim();
+	return stageDiagnostic ? `${summary}\n${stageDiagnostic}` : summary;
+}
+function cloneRuntimeFiles(files) {
+	return Object.fromEntries(Object.entries(files).map(([filePath, contents]) => [filePath, contents.slice()]));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function encodeNativeRequest(request) {
+	return {
+		schema: WASM_OJ_SCHEMAS.runRequest,
+		wasmBase64: Buffer.from(request.wasm).toString("base64"),
+		args: request.args,
+		env: request.env,
+		stdinBase64: Buffer.from(request.stdin).toString("base64"),
+		filesBase64: Object.fromEntries(Object.entries(request.files).map(([filePath, contents]) => [filePath, Buffer.from(contents).toString("base64")])),
+		outputPaths: request.outputPaths,
+		cwd: request.cwd,
+		startupEntropyBytes: request.startupEntropyBytes,
+		determinism: request.determinism,
+		resources: request.resources
+	};
+}
+function interactiveRunConfig(program, determinism) {
+	return {
+		args: [...program.args],
+		stdin: "",
+		env: { ...program.env },
+		files: Object.fromEntries(Object.entries(program.files ?? {}).map(([path, contents]) => [path, contents.slice()])),
+		outputPaths: [],
+		...program.cwd === void 0 ? {} : { cwd: program.cwd },
+		determinism: { ...determinism },
+		resources: { ...program.resources }
+	};
+}
+function encodeNativeInteractiveRequest(contestant, interactor, config) {
+	return {
+		schema: WASM_OJ_SCHEMAS.interactiveRequest,
+		contestant: encodeNativeInteractiveProgram(contestant),
+		interactor: encodeNativeInteractiveProgram(interactor),
+		determinism: config.determinism
+	};
+}
+function encodeNativeInteractiveProgram(request) {
+	return {
+		wasmBase64: Buffer.from(request.wasm).toString("base64"),
+		args: request.args,
+		env: request.env,
+		filesBase64: Object.fromEntries(Object.entries(request.files).map(([filePath, contents]) => [filePath, Buffer.from(contents).toString("base64")])),
+		cwd: request.cwd,
+		startupEntropyBytes: request.startupEntropyBytes,
+		resources: request.resources
+	};
+}
+function nativeInteractiveProcess(result, prepared) {
+	const metrics = normalizeExecutionMetrics({
+		cost: result.metrics.cost,
+		costModel: WEIGHTED_METER_MODEL,
+		operations: result.metrics.operations,
+		memoryBytes: 0,
+		logicalTimeNs: result.metrics.logicalTimeNs,
+		filesystemBytes: result.metrics.filesystemBytes,
+		filesystemEntries: result.metrics.filesystemEntries,
+		stdoutBytes: result.metrics.protocolBytes,
+		stderrBytes: result.metrics.stderrBytes
+	}, prepared.cost);
+	return {
+		code: result.code,
+		stderr: Buffer.from(result.stderrBase64, "base64").toString("utf8"),
+		termination: result.termination,
+		metrics: {
+			...metrics,
+			memoryBytes: null
+		}
+	};
+}
+function decodeNativeOutputFiles(value) {
+	if (!isRecord(value) || Object.keys(value).length > 256) throw new Error("Native runtime returned an invalid output file record.");
+	const files = {};
+	for (const [path, encoded] of Object.entries(value).sort(([left], [right]) => left.localeCompare(right))) {
+		if (typeof encoded !== "string") throw new Error(`Native runtime output file '${path}' is not base64 text.`);
+		const bytes = Buffer.from(encoded, "base64");
+		if (bytes.toString("base64") !== encoded) throw new Error(`Native runtime output file '${path}' has non-canonical base64.`);
+		files[path] = new Uint8Array(bytes);
+	}
+	return files;
+}
+function assertCacheDirectoryIsNotFilesystemRoot(directory) {
+	if (directory === path.parse(directory).root) throw new Error("ServerRunner cacheDirectory must not be a filesystem root.");
+}
+function isWasmOjRuntimeCacheFile(name) {
+	return WASM_OJ_RUNTIME_CACHE_FILE.test(name) || WASM_OJ_RUNTIME_CACHE_TEMPORARY_FILE.test(name);
+}
+async function removeWasmOjRuntimeCacheFiles(directory) {
+	const entries = await readdir(directory, { withFileTypes: true });
+	entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+	for (const entry of entries) {
+		if (!entry.isFile() || !isWasmOjRuntimeCacheFile(entry.name)) continue;
+		const file = path.join(directory, entry.name);
+		try {
+			if (!(await lstat(file)).isFile()) continue;
+			await unlink(file);
+		} catch (error) {
+			if (!isFileSystemError(error, "ENOENT")) throw error;
+		}
+	}
+}
+function isFileSystemError(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+//#endregion
+//#region src/dependencies/filesystem-cache.ts
+var SHA256 = /^[0-9a-f]{64}$/;
+var MAX_PAYLOAD_BYTES = 536870912;
+/** Atomic server-side content-addressed dependency cache. */
+var FileSystemDependencyCache = class {
+	directory;
+	initialized;
+	constructor(directory) {
+		if (!path.isAbsolute(directory)) throw new Error("Dependency cache directory must be absolute.");
+		this.directory = directory;
+	}
+	async load(integritySha256) {
+		requireDigest(integritySha256);
+		await this.ready();
+		const file = this.pathFor(integritySha256);
+		let handle;
+		try {
+			handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+		} catch (error) {
+			if (error.code === "ENOENT") return void 0;
+			if (error.code === "ELOOP") {
+				await rm(file, { force: true });
+				throw new Error(`Cached dependency '${integritySha256}' must not be a symbolic link.`);
+			}
+			throw error;
+		}
+		try {
+			const metadata = await handle.stat();
+			if (!metadata.isFile() || metadata.size > MAX_PAYLOAD_BYTES) throw new Error(`Cached dependency '${integritySha256}' is not a bounded regular file.`);
+			const payload = new Uint8Array(await handle.readFile());
+			if (digest(payload) !== integritySha256) throw new Error(`Cached dependency '${integritySha256}' failed integrity verification.`);
+			return payload;
+		} catch (error) {
+			await rm(file, { force: true });
+			throw error;
+		} finally {
+			await handle.close();
+		}
+	}
+	async save(integritySha256, payload) {
+		requireDigest(integritySha256);
+		if (!(payload instanceof Uint8Array) || payload.byteLength > MAX_PAYLOAD_BYTES || digest(payload) !== integritySha256) throw new Error("Dependency cache payload digest mismatch or size limit exceeded.");
+		await this.ready();
+		const destination = this.pathFor(integritySha256);
+		const temporary = path.join(this.directory, `${integritySha256}.${randomUUID()}.tmp`);
+		try {
+			await writeFile(temporary, payload, {
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, destination);
+		} finally {
+			await rm(temporary, { force: true });
+		}
+	}
+	async delete(integritySha256) {
+		requireDigest(integritySha256);
+		await this.ready();
+		await rm(this.pathFor(integritySha256), { force: true });
+	}
+	async clear() {
+		await rm(this.directory, {
+			recursive: true,
+			force: true
+		});
+		this.initialized = void 0;
+		await this.ready();
+	}
+	ready() {
+		this.initialized ??= mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		}).then(async () => {
+			const metadata = await lstat(this.directory);
+			if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Dependency cache path must be a real directory, not a symbolic link.");
+		});
+		this.initialized.catch(() => {
+			this.initialized = void 0;
+		});
+		return this.initialized;
+	}
+	pathFor(integritySha256) {
+		return path.join(this.directory, `${integritySha256}.bin`);
+	}
+};
+function requireDigest(value) {
+	if (!SHA256.test(value)) throw new Error("Dependency integrity must be lowercase SHA-256 hexadecimal.");
+}
+function digest(payload) {
+	return createHash("sha256").update(payload).digest("hex");
+}
+//#endregion
+//#region src/server/artifact-store.ts
+var MAX_SERIALIZED_ARTIFACT_BYTES = 536870912;
+/** Atomic, content-addressed artifact storage for the Node/server host. */
+var FileSystemArtifactStore = class {
+	directory;
+	initialized;
+	constructor(directory) {
+		this.directory = directory;
+		if (!path.isAbsolute(directory)) throw new Error("Artifact cache directory must be absolute.");
+	}
+	async load(cacheKey) {
+		assertCompilerCacheKey(cacheKey);
+		await this.ready();
+		const file = this.pathFor(cacheKey);
+		let handle;
+		try {
+			handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+		} catch (error) {
+			if (error.code === "ENOENT") return void 0;
+			if (error.code === "ELOOP") {
+				await rm(file, { force: true });
+				throw new Error(`Cached artifact '${cacheKey}' must not be a symbolic link.`);
+			}
+			throw error;
+		}
+		try {
+			const metadata = await handle.stat();
+			if (!metadata.isFile() || metadata.size > MAX_SERIALIZED_ARTIFACT_BYTES) throw new Error(`Cached artifact '${cacheKey}' is not a bounded regular file.`);
+			const artifact = deserialize(await handle.readFile());
+			assertValidBuildArtifact(artifact);
+			if (artifact.cacheKey !== cacheKey) throw new Error("Cached artifact build identity does not match its key.");
+			return artifact;
+		} catch (error) {
+			await rm(file, { force: true });
+			throw error;
+		} finally {
+			await handle.close();
+		}
+	}
+	async save(artifact) {
+		assertValidBuildArtifact(artifact);
+		await this.ready();
+		const encoded = serialize(artifact);
+		if (encoded.byteLength > MAX_SERIALIZED_ARTIFACT_BYTES) throw new RangeError(`Serialized artifact exceeds ${MAX_SERIALIZED_ARTIFACT_BYTES} bytes.`);
+		const temporary = path.join(this.directory, `${cacheFileName(artifact.cacheKey)}.${randomUUID()}.tmp`);
+		try {
+			await writeFile(temporary, encoded, {
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, this.pathFor(artifact.cacheKey));
+		} finally {
+			await rm(temporary, { force: true });
+		}
+	}
+	async delete(cacheKey) {
+		assertCompilerCacheKey(cacheKey);
+		await this.ready();
+		await rm(this.pathFor(cacheKey), { force: true });
+	}
+	async clear() {
+		await rm(this.directory, {
+			recursive: true,
+			force: true
+		});
+		this.initialized = void 0;
+		await this.ready();
+	}
+	ready() {
+		this.initialized ??= mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		}).then(async () => {
+			const metadata = await lstat(this.directory);
+			if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Artifact cache path must be a real directory, not a symbolic link.");
+		});
+		this.initialized.catch(() => {
+			this.initialized = void 0;
+		});
+		return this.initialized;
+	}
+	pathFor(cacheKey) {
+		return path.join(this.directory, `${cacheFileName(cacheKey)}.wasm-oj-artifact`);
+	}
+};
+function cacheFileName(cacheKey) {
+	return createHash("sha256").update(cacheKey).digest("hex");
+}
+//#endregion
+//#region src/server/factory.ts
+/** Resolve an explicitly provisioned WASM-OJ distribution without performing I/O. */
+function resolveServerPaths(options) {
+	if (typeof options?.runtimeDirectory !== "string" || !options.runtimeDirectory.trim()) throw new Error("ServerEngineOptions.runtimeDirectory is required.");
+	const runtimeDirectory = path.resolve(options.runtimeDirectory);
+	const toolchains = snapshotServerToolchainSources(options.toolchains);
+	const suffix = process.platform === "win32" ? ".exe" : "";
+	return Object.freeze({
+		compilerExecutable: path.join(runtimeDirectory, `wasm-oj-compiler${suffix}`),
+		runtimeExecutable: path.join(runtimeDirectory, `wasm-oj-runner${suffix}`),
+		toolchains,
+		cacheDirectory: path.resolve(options.cacheDirectory ?? path.join(process.cwd(), ".wasm-oj"))
+	});
+}
+/** Verify the explicit local distribution and construct one ready server engine. */
+async function createServerEngine(options) {
+	const paths = resolveServerPaths(options);
+	try {
+		if (path.parse(paths.cacheDirectory).root === paths.cacheDirectory) throw new Error("WASM-OJ server cache directory cannot be a filesystem root.");
+		if (options.verifiedDistribution) assertVerifiedServerDistribution(options.verifiedDistribution, paths, paths.toolchains);
+		else {
+			await Promise.all([verifyExecutable(paths.compilerExecutable, "WASM-OJ compiler"), verifyExecutable(paths.runtimeExecutable, "WASM-OJ runner")]);
+			await verifyToolchainSources(paths.toolchains);
+		}
+		await mkdir(paths.cacheDirectory, {
+			recursive: true,
+			mode: 448
+		});
+		const compiler = new ServerCompiler({
+			compilerExecutable: paths.compilerExecutable,
+			toolchains: paths.toolchains,
+			verifiedDistribution: options.verifiedDistribution
+		});
+		const runner = new ServerRunner({
+			runtimeExecutable: paths.runtimeExecutable,
+			toolchains: paths.toolchains,
+			cacheDirectory: path.join(paths.cacheDirectory, "runtime"),
+			runtimeDrivers: options.runtimeDrivers,
+			additionalCostBaselines: options.additionalCostBaselines,
+			verifiedDistribution: options.verifiedDistribution
+		});
+		return await createEngine({
+			compiler,
+			runner,
+			artifactStore: options.artifactCache === false ? void 0 : new FileSystemArtifactStore(path.join(paths.cacheDirectory, "artifacts")),
+			judge: options.judge,
+			dependencyManager: createDefaultDependencyManager(new FileSystemDependencyCache(path.join(paths.cacheDirectory, "dependencies")))
+		});
+	} catch (error) {
+		throw asWasmOjError(error, {
+			code: "initialization-failure",
+			stage: "initialize",
+			retryable: false
+		});
+	}
+}
+async function verifyExecutable(file, label) {
+	const metadata = await lstat(file);
+	if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(`${label} must be a real regular file: '${file}'.`);
+	await access(file, constants.X_OK);
+}
+async function verifyToolchainSources(toolchains) {
+	for (const directory of serverToolchainDirectories(toolchains)) {
+		const metadata = await lstat(directory);
+		if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error(`Toolchain package path must be a real directory: '${directory}'.`);
+	}
+	for (const source of toolchains) for (const asset of source.descriptor.assets) {
+		const file = serverToolchainAssetFile(toolchains, asset.path);
+		const fileMetadata = await lstat(file);
+		if (!fileMetadata.isFile() || fileMetadata.isSymbolicLink()) throw new Error(`Pinned toolchain asset must be a real regular file: '${file}'.`);
+		if (fileMetadata.size !== asset.bytes) throw new Error(`Pinned toolchain asset '${file}' has ${fileMetadata.size} bytes; expected ${asset.bytes}.`);
+		const actual = await digestFile(file);
+		if (actual !== asset.sha256) throw new Error(`Pinned toolchain asset '${file}' has digest ${actual}; expected ${asset.sha256}.`);
+	}
+}
+async function digestFile(file) {
+	const digest = createHash("sha256");
+	const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		for await (const chunk of handle.createReadStream({ autoClose: false })) digest.update(chunk);
+		return digest.digest("hex");
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
+export { FileSystemArtifactStore, FileSystemDependencyCache, ServerCompiler, ServerRunner, createServerEngine, createVerifiedServerDistribution, resolveServerPaths };