@wasm-oj/server 0.2.0

package/dist/server-build-stage.mjs

@@ -0,0 +1,2564 @@
+import { A as PYTHON_PACKAGE_ASSET_PATH, B as TYPESCRIPT_VERSION, C as JAVA_COMPILE_CLASSLIB_ASSET_PATH, H as toolchainPackageIdentities, M as QUICKJS_PACKAGE, R as RUST_VERSION, T as JAVA_RUNTIME_CLASSLIB_ASSET_PATH, V as toolchainContentIdentity, a as CLANG_PACKAGE_ASSET_PATH, i as CLANG_LIBCXX_PCH_MANIFEST_SHA256, k as PYTHON_PACKAGE, n as CLANG_CC1_PINS_SHA256, o as CLANG_PACKAGE_SHA256, r as CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH, s as CLANG_VERSION, t as CLANG_CC1_PINS_ASSET_PATH, v as GO_VERSION, y as JAVA_COMPILER_ASSET_PATH, z as TYPESCRIPT_ASSET_PATH } from "./chunks/toolchains-C6KuA1yM.js";
+import { f as MountedOutputStabilityObserver, n as RUST_TOOLCHAIN, t as RUST_COMPILE_TIMEOUT_MS } from "./chunks/rust-toolchain-CJ3sMxPE.js";
+import { _ as pythonDependencyFiles, g as npmDependencyFiles, h as goDependencyInput, i as GO_TOOLCHAIN, m as cppDependencyInput, n as GO_COMPILE_TIMEOUT_MS, p as assertProjectDependencyEcosystem, v as rustDependencyInput } from "./chunks/go-toolchain-Dbt-lp2L.js";
+import { n as javaMainClass, t as JAVA_COMPILE_TIMEOUT_MS } from "./chunks/java-toolchain-DajoRCHu.js";
+import { t as PYTHON_COMPILE_TIMEOUT_MS } from "./chunks/python-toolchain-Dx834o2A.js";
+import { constants, writeFileSync } from "node:fs";
+import { deserialize, serialize } from "node:v8";
+import { access, lstat, mkdtemp, open, readFile, rm, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { gunzipSync } from "node:zlib";
+import { Runtime, init } from "@wasmer/sdk/node";
+import { assertCompilerCacheKey, assertValidProject, toolchainAssetSource, toolchainCacheIdentity, toolchainProfileSource, validateServerToolchainSources } from "@wasm-oj/core";
+import { WASM_OJ_CONTRACT_VERSION, WASM_OJ_SCHEMAS, assertLanguageIdentifier, isBuiltinLanguage } from "@wasm-oj/contracts";
+import { Directory as Directory$1, Wasmer as Wasmer$1 } from "@wasmer/sdk";
+import { fileURLToPath } from "node:url";
+//#region src/core/project-files.ts
+var PROJECT_SOURCE_LIMITS = Object.freeze({
+	files: 256,
+	bytesPerFile: 4194304,
+	totalBytes: 16777216
+});
+var UTF8_ENCODER = new TextEncoder();
+/** Locale-independent ordering used anywhere file order can affect build output. */
+function compareCanonicalPaths(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertSafeRelativePath(path, label = "Project path") {
+	if (typeof path !== "string" || !path || path !== path.trim() || path.length > 4096) throw new Error(`${label} must be a non-empty, trimmed string of at most 4096 characters.`);
+	if (path.startsWith("/") || path.includes("\\") || path.includes("\0") || path.split("/").some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`${label} '${path}' must be a normalized relative path that cannot escape the project.`);
+}
+/**
+* Validates a project file set and returns a fresh, locale-independently sorted
+* array. Build hosts must use this order for filesystem creation and argv.
+*/
+function canonicalProjectFiles(files) {
+	if (!Array.isArray(files) || files.length === 0) throw new Error("A project must contain at least one source file.");
+	if (files.length > PROJECT_SOURCE_LIMITS.files) throw new Error(`A project cannot contain more than ${PROJECT_SOURCE_LIMITS.files} source files.`);
+	const seen = /* @__PURE__ */ new Set();
+	let totalBytes = 0;
+	return files.map((file, index) => {
+		if (!file || typeof file !== "object") throw new Error(`Project file ${index} is invalid.`);
+		assertSafeRelativePath(file.path, `Project file ${index} path`);
+		assertLanguageIdentifier(file.language);
+		if (typeof file.content !== "string") throw new Error(`Project file '${file.path}' content must be a string.`);
+		if (file.content.length > PROJECT_SOURCE_LIMITS.bytesPerFile) throw new Error(`Project file '${file.path}' exceeds the ${PROJECT_SOURCE_LIMITS.bytesPerFile} byte source limit.`);
+		const contentBytes = UTF8_ENCODER.encode(file.content).byteLength;
+		if (contentBytes > PROJECT_SOURCE_LIMITS.bytesPerFile) throw new Error(`Project file '${file.path}' exceeds the ${PROJECT_SOURCE_LIMITS.bytesPerFile} byte source limit.`);
+		totalBytes += contentBytes;
+		if (totalBytes > PROJECT_SOURCE_LIMITS.totalBytes) throw new Error(`Project sources exceed the ${PROJECT_SOURCE_LIMITS.totalBytes} byte total limit.`);
+		if (seen.has(file.path)) throw new Error(`Duplicate project path '${file.path}'.`);
+		seen.add(file.path);
+		return {
+			path: file.path,
+			language: file.language,
+			content: file.content
+		};
+	}).sort((left, right) => compareCanonicalPaths(left.path, right.path));
+}
+function canonicalFileEntries(files) {
+	if (!files || typeof files !== "object" || Array.isArray(files)) throw new Error("Runtime bundle files must be a record.");
+	return Object.entries(files).map(([path, contents]) => {
+		assertSafeRelativePath(path, "Runtime bundle path");
+		return [path, contents];
+	}).sort(([left], [right]) => compareCanonicalPaths(left, right));
+}
+function canonicalFileRecord(files) {
+	return Object.fromEntries(canonicalFileEntries(files));
+}
+//#endregion
+//#region src/core/sha256.ts
+async function sha256Hex(value) {
+	const source = typeof value === "string" ? new TextEncoder().encode(value) : value;
+	const bytes = new Uint8Array(source.byteLength);
+	bytes.set(source);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+//#region src/core/dependencies.ts
+var MIB = 1048576;
+/** Contract-level admission limits shared by dependency hosts and compilers. */
+var DEPENDENCY_RESOLUTION_LIMITS = Object.freeze({
+	requirements: 128,
+	sourceFiles: 128,
+	sourceTextBytes: 8 * MIB,
+	hosts: 32,
+	roots: 512,
+	packages: 512,
+	referencesPerPackage: 512,
+	concurrency: 16,
+	metadataBytes: 8 * MIB,
+	packageBytes: 256 * MIB,
+	totalDownloadBytes: 512 * MIB,
+	archiveFiles: 16384,
+	unpackedBytes: 512 * MIB
+});
+Object.freeze({
+	packages: DEPENDENCY_RESOLUTION_LIMITS.packages,
+	filesPerPackage: DEPENDENCY_RESOLUTION_LIMITS.archiveFiles,
+	bytesPerFile: 64 * MIB,
+	totalBytes: DEPENDENCY_RESOLUTION_LIMITS.unpackedBytes
+});
+//#endregion
+//#region src/compiler/clang-pins.ts
+var decoder$3 = new TextDecoder();
+async function decodeClangPins(bytes) {
+	const digest = await sha256Hex(bytes);
+	if (digest !== "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72") throw new Error(`The pinned cc1 manifest drifted from its contract: expected ${CLANG_CC1_PINS_SHA256}, received ${digest}. Regenerate it with scripts/pin-clang-cc1-argv.mjs and update CLANG_CC1_PINS_SHA256.`);
+	const parsed = JSON.parse(decoder$3.decode(bytes));
+	if (parsed.schema !== WASM_OJ_SCHEMAS.clangPins) throw new Error(`Unsupported cc1 pin schema '${parsed.schema}'.`);
+	for (const key of [
+		"input",
+		"output",
+		"mainFileName",
+		"objects"
+	]) if (typeof parsed.placeholders?.[key] !== "string") throw new Error(`The cc1 pin manifest is missing the '${key}' placeholder.`);
+	if (!parsed.command || !parsed.linkerCommand) throw new Error("The cc1 pin manifest is missing a compiler or linker command.");
+	if (!parsed.source || !/^[a-f0-9]{64}$/.test(parsed.sourceSha256)) throw new Error("The cc1 pin manifest is missing its source toolchain identity.");
+	for (const [key, config] of Object.entries(parsed.configs)) if (!Array.isArray(config.cc1) || !Array.isArray(config.link) || config.cc1[0] !== "-cc1") throw new Error(`The cc1 pin manifest entry '${key}' is malformed.`);
+	return parsed;
+}
+function instantiateClangCc1(template, placeholders, source, objectPath) {
+	const basename = source.slice(source.lastIndexOf("/") + 1);
+	const inputPath = source.startsWith("/") ? source : `/project/${source}`;
+	return template.map((token) => {
+		if (token === placeholders.input) return inputPath;
+		if (token === placeholders.output) return objectPath;
+		if (token === placeholders.mainFileName) return basename;
+		return token;
+	});
+}
+function instantiateClangPch(template, placeholders, header, outputPath) {
+	return instantiateClangCc1(template.map((token) => token === "-emit-obj" ? "-emit-pch" : token === "c++" ? "c++-header" : token), placeholders, header, outputPath);
+}
+function instantiateClangLink(template, placeholders, objectPaths, outputPath) {
+	const argv = [];
+	for (const token of template) if (token === placeholders.objects) argv.push(...objectPaths);
+	else if (token === placeholders.output) argv.push(outputPath);
+	else argv.push(token);
+	return argv;
+}
+//#endregion
+//#region src/compiler/incremental-build-graph.ts
+var BUILD_NODE_KINDS = Object.freeze([
+	"source",
+	"header",
+	"package",
+	"pch",
+	"object",
+	"link-result"
+]);
+/**
+* Content-addressed source → header/package → PCH/object → link-result graph.
+*
+* Logical manifests remember which inputs a tool actually observed. Reuse
+* rehashes every input and derives the structural node key again; no timestamp
+* or host path participates in identity.
+*/
+var IncrementalBuildGraph = class {
+	limitBytes;
+	logical = /* @__PURE__ */ new Map();
+	nodes = /* @__PURE__ */ new Map();
+	blobs = /* @__PURE__ */ new Map();
+	storedBytes = 0;
+	generation = 0;
+	constructor(limitBytes) {
+		if (!Number.isSafeInteger(limitBytes) || limitBytes <= 0) throw new RangeError("Incremental build graph limit must be a positive safe integer.");
+		this.limitBytes = limitBytes;
+	}
+	async lookup(logicalKey, availableInputs) {
+		const manifest = this.logical.get(logicalKey);
+		if (!manifest) return void 0;
+		const inputs = [];
+		for (const dependency of manifest.dependencies) {
+			const input = availableInputs.get(dependency.identity);
+			if (!input || input.kind !== dependency.kind) return void 0;
+			inputs.push(input);
+		}
+		return this.lookupExact(manifest.kind, logicalKey, inputs);
+	}
+	async lookupExact(kind, logicalKey, inputs) {
+		const key = await structuralKey(kind, logicalKey, (await this.internInputs(inputs)).map((item) => item.key));
+		const node = this.nodes.get(key);
+		if (!node) return void 0;
+		const blob = this.blobs.get(node.digest);
+		if (!blob) return void 0;
+		this.blobs.delete(node.digest);
+		this.blobs.set(node.digest, blob);
+		return blob.slice();
+	}
+	async store(kind, logicalKey, inputs, output) {
+		if (output.byteLength > this.limitBytes) return false;
+		const canonicalInputs = canonicalizeInputs(inputs);
+		const dependencies = await this.internInputs(canonicalInputs);
+		const key = await structuralKey(kind, logicalKey, dependencies.map((item) => item.key));
+		const bytes = output.slice();
+		const digest = await sha256Hex(bytes);
+		const previousManifest = this.logical.get(logicalKey);
+		const previousNode = previousManifest ? this.nodes.get(previousManifest.nodeKey) : void 0;
+		let changed = false;
+		if (previousNode && (previousNode.key !== key || previousNode.digest !== digest)) {
+			this.logical.delete(logicalKey);
+			this.nodes.delete(previousNode.key);
+			if (![...this.logical.values()].some((manifest) => this.nodes.get(manifest.nodeKey)?.digest === previousNode.digest)) {
+				const removed = this.blobs.get(previousNode.digest);
+				if (removed) {
+					this.blobs.delete(previousNode.digest);
+					this.storedBytes -= removed.byteLength;
+				}
+			}
+			changed = true;
+		}
+		changed = this.ensureCapacity(bytes.byteLength, digest) || changed;
+		if (!this.blobs.has(digest)) {
+			this.blobs.set(digest, bytes);
+			this.storedBytes += bytes.byteLength;
+			changed = true;
+		}
+		const nextNode = {
+			key,
+			kind,
+			identity: logicalKey,
+			digest,
+			dependencies: dependencies.map((item) => item.key),
+			byteLength: bytes.byteLength
+		};
+		const nextManifest = {
+			kind,
+			dependencies: canonicalInputs.map(({ kind: inputKind, identity }) => ({
+				kind: inputKind,
+				identity
+			})),
+			nodeKey: key
+		};
+		const currentNode = this.nodes.get(key);
+		const currentManifest = this.logical.get(logicalKey);
+		if (!sameNode(currentNode, nextNode) || !sameLogicalManifest(currentManifest, nextManifest)) changed = true;
+		this.nodes.set(key, nextNode);
+		this.logical.set(logicalKey, nextManifest);
+		if (changed) this.generation += 1;
+		return true;
+	}
+	exportState() {
+		const entries = [];
+		const referencedDigests = /* @__PURE__ */ new Set();
+		for (const [logicalKey, manifest] of this.logical) {
+			const node = this.nodes.get(manifest.nodeKey);
+			if (!node) continue;
+			const output = this.blobs.get(node.digest);
+			if (!output) continue;
+			const inputs = node.dependencies.map((key) => {
+				const dependency = this.nodes.get(key);
+				if (!dependency) throw new Error(`Build graph dependency '${key}' is missing.`);
+				return {
+					kind: dependency.kind,
+					identity: dependency.identity,
+					digest: dependency.digest
+				};
+			});
+			entries.push({
+				kind: manifest.kind,
+				logicalKey,
+				inputs,
+				outputDigest: node.digest,
+				outputByteLength: output.byteLength
+			});
+			referencedDigests.add(node.digest);
+		}
+		return {
+			manifest: {
+				schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+				version: 2,
+				generation: this.generation,
+				entries: entries.sort((left, right) => compareText(left.logicalKey, right.logicalKey))
+			},
+			blobs: [...referencedDigests].sort().map((digest) => ({
+				digest,
+				bytes: this.blobs.get(digest)
+			}))
+		};
+	}
+	async restoreState(state) {
+		if (!state || typeof state !== "object" || Array.isArray(state) || Object.keys(state).sort().join(",") !== "blobs,manifest") throw new Error("Incremental build graph state does not use the active WASM-OJ contract.");
+		const { manifest } = state;
+		if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || Object.keys(manifest).sort().join(",") !== "entries,generation,schema,version" || manifest.schema !== WASM_OJ_SCHEMAS.incrementalBuildGraph || manifest.version !== 2 || !Number.isSafeInteger(manifest.generation) || manifest.generation < 0 || !Array.isArray(manifest.entries) || !Array.isArray(state.blobs)) throw new Error("Incremental build graph manifest does not use the active WASM-OJ contract.");
+		const blobs = /* @__PURE__ */ new Map();
+		let totalBytes = 0;
+		let previousDigest = "";
+		for (const candidate of state.blobs) {
+			if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("Incremental build graph state contains a malformed blob.");
+			const blob = candidate;
+			if (Object.keys(blob).sort().join(",") !== "bytes,digest" || typeof blob.digest !== "string" || !/^[0-9a-f]{64}$/.test(blob.digest) || blob.digest <= previousDigest || !(blob.bytes instanceof Uint8Array) || await sha256Hex(blob.bytes) !== blob.digest) throw new Error("Incremental build graph state contains an invalid content-addressed blob.");
+			previousDigest = blob.digest;
+			totalBytes += blob.bytes.byteLength;
+			if (!Number.isSafeInteger(totalBytes) || totalBytes > this.limitBytes) throw new Error("Incremental build graph state exceeds its storage limit.");
+			blobs.set(blob.digest, blob.bytes);
+		}
+		const logicalKeys = /* @__PURE__ */ new Set();
+		const verified = [];
+		const referencedDigests = /* @__PURE__ */ new Set();
+		let previousLogicalKey = "";
+		for (const candidate of manifest.entries) {
+			if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("Incremental build graph manifest contains a malformed entry.");
+			const entry = candidate;
+			if (Object.keys(entry).sort().join(",") !== "inputs,kind,logicalKey,outputByteLength,outputDigest") throw new Error("Incremental build graph manifest entry has an invalid shape.");
+			if (entry.kind !== "pch" && entry.kind !== "object" && entry.kind !== "link-result") throw new Error("Incremental build graph manifest entry has an invalid node kind.");
+			if (typeof entry.logicalKey !== "string" || !entry.logicalKey || entry.logicalKey !== entry.logicalKey.trim() || entry.logicalKey.length > 16384 || previousLogicalKey !== "" && compareText(previousLogicalKey, entry.logicalKey) >= 0) throw new Error("Incremental build graph manifest has an invalid or non-canonical logical key.");
+			previousLogicalKey = entry.logicalKey;
+			if (logicalKeys.has(entry.logicalKey)) throw new Error(`Incremental build graph manifest repeats '${entry.logicalKey}'.`);
+			logicalKeys.add(entry.logicalKey);
+			if (typeof entry.outputDigest !== "string" || !/^[0-9a-f]{64}$/.test(entry.outputDigest) || !Number.isSafeInteger(entry.outputByteLength) || entry.outputByteLength < 0) throw new Error(`Incremental build graph output '${entry.logicalKey}' has invalid metadata.`);
+			const output = blobs.get(entry.outputDigest);
+			if (!output || output.byteLength !== entry.outputByteLength) throw new Error(`Incremental build graph output '${entry.logicalKey}' is missing or has the wrong size.`);
+			referencedDigests.add(entry.outputDigest);
+			if (!Array.isArray(entry.inputs)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' inputs must be an array.`);
+			const inputs = entry.inputs.map((input) => {
+				if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' has a malformed input.`);
+				const record = input;
+				if (Object.keys(record).sort().join(",") !== "digest,identity,kind" || !BUILD_NODE_KINDS.slice(0, 5).includes(record.kind) || typeof record.identity !== "string" || typeof record.digest !== "string") throw new Error(`Incremental build graph entry '${entry.logicalKey}' has an invalid input.`);
+				return {
+					kind: record.kind,
+					identity: record.identity,
+					digest: record.digest
+				};
+			});
+			if (canonicalizeInputs(inputs).some((input, index) => input.identity !== inputs[index]?.identity)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' inputs are not canonical.`);
+			verified.push({
+				kind: entry.kind,
+				logicalKey: entry.logicalKey,
+				inputs,
+				output
+			});
+		}
+		if (referencedDigests.size !== blobs.size) throw new Error("Incremental build graph state contains an unreferenced content-addressed blob.");
+		this.clear();
+		for (const entry of verified) if (!await this.store(entry.kind, entry.logicalKey, entry.inputs, entry.output)) throw new Error(`Incremental build graph entry '${entry.logicalKey}' exceeds its storage limit.`);
+		this.generation = manifest.generation;
+	}
+	snapshot() {
+		return {
+			schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+			nodes: [...this.nodes.values()].map((node) => ({
+				...node,
+				dependencies: [...node.dependencies]
+			})).sort((left, right) => compareText(left.key, right.key)),
+			storedBytes: this.storedBytes
+		};
+	}
+	clear() {
+		const changed = this.logical.size > 0 || this.nodes.size > 0 || this.blobs.size > 0;
+		this.logical.clear();
+		this.nodes.clear();
+		this.blobs.clear();
+		this.storedBytes = 0;
+		if (changed) this.generation += 1;
+	}
+	async internInputs(inputs) {
+		return Promise.all(canonicalizeInputs(inputs).map(async (input) => {
+			const digest = await inputDigest(input);
+			const key = await sha256Hex(JSON.stringify({
+				schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+				kind: input.kind,
+				identity: input.identity,
+				digest
+			}));
+			const node = {
+				key,
+				kind: input.kind,
+				identity: input.identity,
+				digest,
+				dependencies: [],
+				byteLength: input.bytes?.byteLength ?? 0
+			};
+			this.nodes.set(key, node);
+			return node;
+		}));
+	}
+	ensureCapacity(incomingBytes, incomingDigest) {
+		if (this.blobs.has(incomingDigest)) return false;
+		let changed = false;
+		while (this.storedBytes + incomingBytes > this.limitBytes && this.blobs.size > 0) {
+			const oldestDigest = this.blobs.keys().next().value;
+			const oldest = this.blobs.get(oldestDigest);
+			this.blobs.delete(oldestDigest);
+			this.storedBytes -= oldest.byteLength;
+			changed = true;
+			for (const [key, node] of this.nodes) {
+				if (node.digest !== oldestDigest || node.dependencies.length === 0) continue;
+				this.nodes.delete(key);
+				for (const [logicalKey, manifest] of this.logical) if (manifest.nodeKey === key) this.logical.delete(logicalKey);
+			}
+		}
+		return changed;
+	}
+};
+function sameNode(left, right) {
+	return left?.key === right.key && left.kind === right.kind && left.identity === right.identity && left.digest === right.digest && left.byteLength === right.byteLength && left.dependencies.length === right.dependencies.length && left.dependencies.every((dependency, index) => dependency === right.dependencies[index]);
+}
+function sameLogicalManifest(left, right) {
+	return left?.kind === right.kind && left.nodeKey === right.nodeKey && left.dependencies.length === right.dependencies.length && left.dependencies.every((dependency, index) => dependency.kind === right.dependencies[index]?.kind && dependency.identity === right.dependencies[index]?.identity);
+}
+function canonicalizeInputs(inputs) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	for (const input of inputs) {
+		if (!input.identity || input.identity !== input.identity.trim() || input.identity.length > 16384) throw new Error("Build graph input identities must be non-empty, trimmed strings.");
+		if (byIdentity.has(input.identity)) throw new Error(`Duplicate build graph input '${input.identity}'.`);
+		if (input.bytes === void 0 === (input.digest === void 0)) throw new Error(`Build graph input '${input.identity}' must provide exactly one of bytes or digest.`);
+		byIdentity.set(input.identity, input);
+	}
+	return [...byIdentity.values()].sort((left, right) => compareText(left.identity, right.identity));
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+async function inputDigest(input) {
+	if (input.bytes) return sha256Hex(input.bytes);
+	if (!/^[0-9a-f]{64}$/.test(input.digest)) throw new Error(`Build graph input '${input.identity}' has an invalid digest.`);
+	return input.digest;
+}
+function structuralKey(kind, logicalKey, dependencies) {
+	return sha256Hex(JSON.stringify({
+		schema: WASM_OJ_SCHEMAS.incrementalBuildGraph,
+		kind,
+		logicalKey,
+		dependencies
+	}));
+}
+//#endregion
+//#region src/compiler/clang-object-cache.ts
+var decoder$2 = new TextDecoder();
+/**
+* Content-addressed direct-mode cache for Clang translation units.
+*
+* Unit identity includes the frozen argv manifest and source digest. Every
+* project dependency from Clang's dependency file is rehashed before reuse.
+* System headers are covered by the pinned toolchain identity.
+*/
+var ClangObjectCache = class {
+	graph;
+	constructor(limitBytes) {
+		this.graph = new IncrementalBuildGraph(limitBytes);
+	}
+	async unitManifestKey(pins, configKey, source, sourceBytes) {
+		const config = pins.configs[configKey];
+		if (!config) throw new Error(`Unknown pinned Clang configuration '${configKey}'.`);
+		return sha256Hex(JSON.stringify({
+			schema: WASM_OJ_SCHEMAS.objectCache,
+			pinsSha256: CLANG_CC1_PINS_SHA256,
+			sourceToolchainSha256: pins.sourceSha256,
+			packageSha256: CLANG_PACKAGE_SHA256,
+			version: pins.version,
+			config: configKey,
+			cc1Argv: config.cc1,
+			unit: source,
+			source: await sha256Hex(sourceBytes)
+		}));
+	}
+	async lookup(manifestKey, projectFiles, additionalInputs = []) {
+		return this.graph.lookup(manifestKey, availableInputs(projectFiles, additionalInputs));
+	}
+	async store(manifestKey, dependencyPaths, projectFiles, object, additionalInputs = []) {
+		const normalized = normalizeProjectDependencies(dependencyPaths, projectFiles);
+		if (!normalized) return false;
+		return this.graph.store("object", manifestKey, [...graphInputs(normalized, projectFiles), ...additionalInputs], object);
+	}
+	async lookupPch(manifestKey, projectFiles) {
+		return this.graph.lookup(manifestKey, availableInputs(projectFiles));
+	}
+	async storePch(manifestKey, dependencyPaths, projectFiles, pch) {
+		const normalized = normalizeProjectDependencies(dependencyPaths, projectFiles);
+		if (!normalized) return false;
+		return this.graph.store("pch", manifestKey, graphInputs(normalized, projectFiles), pch);
+	}
+	lookupLink(manifestKey, objects) {
+		return this.graph.lookupExact("link-result", manifestKey, withToolchain(objects));
+	}
+	storeLink(manifestKey, objects, wasm) {
+		return this.graph.store("link-result", manifestKey, withToolchain(objects), wasm);
+	}
+	snapshot() {
+		return this.graph.snapshot();
+	}
+	exportState() {
+		return this.graph.exportState();
+	}
+	restoreState(state) {
+		return this.graph.restoreState(state);
+	}
+	clear() {
+		this.graph.clear();
+	}
+};
+function parseClangDependencyFile(bytes) {
+	const joined = decoder$2.decode(bytes).replace(/\\\r?\n/g, " ");
+	const colon = joined.indexOf(":");
+	if (colon < 0) return [];
+	const deps = [];
+	const pattern = /(?:\\.|[^\s\\])+/g;
+	const remainder = joined.slice(colon + 1);
+	for (let match = pattern.exec(remainder); match; match = pattern.exec(remainder)) deps.push(match[0].replace(/\\(.)/g, "$1"));
+	return deps;
+}
+function normalizeProjectDependencies(dependencyPaths, projectFiles) {
+	const normalized = /* @__PURE__ */ new Set();
+	for (const raw of dependencyPaths) {
+		if (raw.startsWith("/usr/") || raw.startsWith("/sysroot/") || raw.startsWith("/lib/")) continue;
+		const path = raw.startsWith("/project/") ? raw.slice(9) : raw.replace(/^\.\//, "");
+		if (!path || path.startsWith("/") || path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) return;
+		if (!projectFiles.has(path)) return void 0;
+		normalized.add(path);
+	}
+	if (normalized.size === 0) return void 0;
+	return [...normalized].sort();
+}
+function fileKind(path) {
+	return /\.(?:c|cc|cpp|cxx)$/i.test(path) ? "source" : "header";
+}
+function graphInputs(paths, projectFiles) {
+	return withToolchain(paths.map((path) => ({
+		kind: fileKind(path),
+		identity: path,
+		bytes: projectFiles.get(path)
+	})));
+}
+function withToolchain(inputs) {
+	return [...inputs, {
+		kind: "package",
+		identity: `cpp:clang@${CLANG_PACKAGE_SHA256}`,
+		digest: CLANG_PACKAGE_SHA256
+	}];
+}
+function availableInputs(projectFiles, additionalInputs = []) {
+	const inputs = new Map([...projectFiles].map(([path, bytes]) => [path, {
+		kind: fileKind(path),
+		identity: path,
+		bytes
+	}]));
+	inputs.set(`cpp:clang@${CLANG_PACKAGE_SHA256}`, {
+		kind: "package",
+		identity: `cpp:clang@${CLANG_PACKAGE_SHA256}`,
+		digest: CLANG_PACKAGE_SHA256
+	});
+	for (const input of additionalInputs) inputs.set(input.identity, input);
+	return inputs;
+}
+//#endregion
+//#region src/core/resources.ts
+/** The weighted meter defined by the active WASM-OJ contract. */
+var WEIGHTED_METER_MODEL = "weighted";
+Math.floor(Number.MAX_SAFE_INTEGER / 1e6);
+Object.freeze({
+	instructionBudget: 1e10,
+	logicalTimeLimitMs: 6e4,
+	memoryLimitBytes: 268435456,
+	outputLimitBytes: 4194304,
+	filesystemWriteLimitBytes: 67108864,
+	filesystemEntryLimit: 4096,
+	wallTimeLimitMs: 6e4
+});
+new TextEncoder();
+Object.freeze({
+	runtimeCoreWasmSha256: "92500f3a2e65fe6979e893179d8000e12d66822c160eeb779b0d4fe0a6b55603",
+	runtimeSourceRootSha256: "3ef42cb2c70e7013e4a6f9d4d7457a7071101795fbd3753efcd20c1ac338ebd5",
+	wasmerNativeVersion: "7.2.1",
+	wasmerSdkVersion: "0.10.0",
+	wasmerSdkWasmSha256: "49a6646209f5ab5e7c737eac33407d87d9a9959ac83e5ecaaab9261b2323589e",
+	wasmerWasixVersion: "0.702.1"
+});
+/**
+* SHA-256 of `runtimeIdentityBytes()`.
+* Release verification independently checks the component bytes before this
+* identity is admitted into a calibrated release.
+*/
+var WASM_OJ_RUNTIME_IDENTITY_SHA256 = "24c0bcff9820fbfd1fd4db1c57e2a866b83041409dd22b5b725688739bd3e223";
+//#endregion
+//#region src/core/cost-profile.ts
+function coordinates(language, target, optimization) {
+	assertLanguageIdentifier(language);
+	return [
+		"wasm-oj-cost",
+		`contract-${WASM_OJ_CONTRACT_VERSION}`,
+		encodeURIComponent(language),
+		target,
+		optimization
+	];
+}
+/** Stable identity for one calibrated compiler/runtime overhead profile. */
+function costProfileId(language, target, optimization, downstreamToolchainContent) {
+	const content = isBuiltinLanguage(language) ? toolchainContentIdentity(language) : downstreamToolchainContent;
+	if (!content || !/^[A-Za-z0-9._-]+$/.test(content)) throw new Error(isBuiltinLanguage(language) ? `WASM-OJ toolchain content identity is invalid for '${language}'.` : `Downstream language '${language}' requires an explicit content identity using letters, digits, '.', '_' or '-'.`);
+	return [
+		...coordinates(language, target, optimization),
+		`content-${content}`,
+		`runtime-${WASM_OJ_RUNTIME_IDENTITY_SHA256}`,
+		WEIGHTED_METER_MODEL
+	].join(":");
+}
+//#endregion
+//#region src/core/diagnostics.ts
+function severity(value) {
+	if (value === "warning") return "warning";
+	if (value === "note" || value === "info") return "info";
+	return "error";
+}
+function projectPath(path) {
+	return path.replace(/^file:\/\//, "").replace(/^\/?(?:workspace|project|work)\//, "").replace(/^\.\//, "");
+}
+function parseClangDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?):(\d+):(\d+):\s+(fatal error|error|warning|note):\s+(.+?)(?:\s+\[([^\]]+)\])?$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3]),
+		severity: severity(match[4].replace("fatal ", "")),
+		message: match[5],
+		source: "clang",
+		code: match[6]
+	});
+	return diagnostics;
+}
+function parsePythonDiagnostics(output) {
+	const diagnostics = [];
+	const lines = output.split(/\r?\n/);
+	for (let index = 0; index < lines.length; index += 1) {
+		const location = lines[index].match(/^\s*File "([^"]+)", line (\d+)/);
+		if (!location) continue;
+		let column = 1;
+		let message = "Python compilation failed";
+		const caret = (lines[index + 2] ?? "").indexOf("^");
+		if (caret >= 0) column = caret + 1;
+		for (let cursor = index + 1; cursor < Math.min(lines.length, index + 6); cursor += 1) {
+			const error = lines[cursor].match(/^([A-Za-z]+(?:Error|Exception)):\s*(.+)$/);
+			if (error) {
+				message = `${error[1]}: ${error[2]}`;
+				break;
+			}
+		}
+		diagnostics.push({
+			file: projectPath(location[1]),
+			line: Number(location[2]),
+			column,
+			severity: "error",
+			message,
+			source: "python"
+		});
+	}
+	return diagnostics;
+}
+function parseTypeScriptDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?)\((\d+),(\d+)\):\s+(error|warning|message)\s+TS(\d+):\s+(.+)$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		severity: severity(match[4]),
+		message: match[6],
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3]),
+		source: "typescript",
+		code: `TS${match[5]}`
+	});
+	return diagnostics;
+}
+function parseRustDiagnostics(output) {
+	const diagnostics = [];
+	for (const line of output.split(/\r?\n/)) {
+		if (!line.startsWith("{")) continue;
+		let value;
+		try {
+			value = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (!value || typeof value !== "object") continue;
+		const record = value;
+		if (record.$message_type !== "diagnostic" || typeof record.message !== "string") continue;
+		const spans = Array.isArray(record.spans) ? record.spans : [];
+		const location = spans.find((candidate) => candidate && typeof candidate === "object" && candidate.is_primary === true) ?? spans.find((candidate) => candidate && typeof candidate === "object");
+		const code = record.code && typeof record.code === "object" ? record.code.code : void 0;
+		diagnostics.push({
+			severity: severity(typeof record.level === "string" ? record.level : "error"),
+			message: record.message,
+			file: projectPath(typeof location?.file_name === "string" ? location.file_name : "main.rs"),
+			line: typeof location?.line_start === "number" ? location.line_start : 1,
+			column: typeof location?.column_start === "number" ? location.column_start : 1,
+			endLine: typeof location?.line_end === "number" ? location.line_end : void 0,
+			endColumn: typeof location?.column_end === "number" ? location.column_end : void 0,
+			source: "rustc",
+			code: typeof code === "string" ? code : void 0
+		});
+	}
+	return diagnostics;
+}
+function parseGoDiagnostics(output) {
+	const diagnostics = [];
+	const pattern = /^(.*?\.go):(\d+)(?::(\d+))?:\s*(.+)$/gm;
+	let match;
+	while ((match = pattern.exec(output)) !== null) diagnostics.push({
+		severity: "error",
+		message: match[4],
+		file: projectPath(match[1]),
+		line: Number(match[2]),
+		column: Number(match[3] ?? 1),
+		source: "go"
+	});
+	return diagnostics;
+}
+function ensureFailureDiagnostic(diagnostics, summary) {
+	if (diagnostics.length > 0) return diagnostics;
+	return [{
+		severity: "error",
+		file: projectPath(summary.file),
+		line: 1,
+		column: 1,
+		source: summary.source,
+		message: summary.message
+	}];
+}
+//#endregion
+//#region src/compiler/libcxx-pch.ts
+var WASM_OJ_LIBCXX_PCH_HEADER = `#pragma once
+#include <algorithm>
+#include <array>
+#include <bitset>
+#include <cassert>
+#include <cctype>
+#include <cerrno>
+#include <cfloat>
+#include <charconv>
+#include <chrono>
+#include <climits>
+#include <cmath>
+#include <compare>
+#include <concepts>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <exception>
+#include <functional>
+#include <iomanip>
+#include <ios>
+#include <iostream>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <memory>
+#include <numeric>
+#include <optional>
+#include <queue>
+#include <random>
+#include <ranges>
+#include <set>
+#include <span>
+#include <sstream>
+#include <stack>
+#include <string>
+#include <string_view>
+#include <tuple>
+#include <type_traits>
+#include <unordered_map>
+#include <unordered_set>
+#include <utility>
+#include <variant>
+#include <vector>
+`;
+var decoder$1 = new TextDecoder();
+async function decodeLibcxxPchManifest(bytes) {
+	const digest = await sha256Hex(bytes);
+	if (digest !== "d126c99e951a7302d4ea2b66da4ed64d3d74e9d319d562518867c8d8c97a06b8") throw new Error(`Pinned libc++ PCH manifest digest mismatch: expected ${CLANG_LIBCXX_PCH_MANIFEST_SHA256}, received ${digest}.`);
+	let value;
+	try {
+		value = JSON.parse(decoder$1.decode(bytes));
+	} catch (error) {
+		throw new Error("Pinned libc++ PCH manifest is not valid JSON.", { cause: error });
+	}
+	if (!isRecord(value) || value.schema !== WASM_OJ_SCHEMAS.clangLibcxxPch || value.version !== "22.0.0-git20542-10" || value.clangPackageSha256 !== "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224" || value.clangPinsSha256 !== "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72" || value.header !== WASM_OJ_LIBCXX_PCH_HEADER || !isRecord(value.profiles)) throw new Error("Pinned libc++ PCH manifest is not admitted by the active Clang toolchain contract.");
+	if (value.headerSha256 !== await sha256Hex(WASM_OJ_LIBCXX_PCH_HEADER)) throw new Error("Pinned libc++ PCH header digest does not match its canonical source.");
+	const manifestProfiles = value.profiles;
+	const profiles = Object.fromEntries(await Promise.all(["cpp-debug", "cpp-release"].map(async (profile) => {
+		const asset = manifestProfiles[profile];
+		if (!isRecord(asset) || typeof asset.path !== "string" || !asset.path.endsWith(`.${profile}.pch.gz.bin`) || !isBytes(asset.byteLength) || !isBytes(asset.compressedByteLength) || !isSha256(asset.sha256) || !isSha256(asset.compressedSha256)) throw new Error(`Pinned libc++ PCH profile '${profile}' is malformed.`);
+		return [profile, {
+			path: asset.path,
+			byteLength: asset.byteLength,
+			sha256: asset.sha256,
+			compressedByteLength: asset.compressedByteLength,
+			compressedSha256: asset.compressedSha256
+		}];
+	})));
+	if (Object.keys(manifestProfiles).sort().join(",") !== "cpp-debug,cpp-release") throw new Error("Pinned libc++ PCH manifest has an unexpected profile set.");
+	return {
+		schema: WASM_OJ_SCHEMAS.clangLibcxxPch,
+		version: CLANG_VERSION,
+		clangPackageSha256: CLANG_PACKAGE_SHA256,
+		clangPinsSha256: CLANG_CC1_PINS_SHA256,
+		header: WASM_OJ_LIBCXX_PCH_HEADER,
+		headerSha256: value.headerSha256,
+		profiles
+	};
+}
+function isToolchainLibcxxPchHeader(contents) {
+	return contents === WASM_OJ_LIBCXX_PCH_HEADER;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSha256(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function isBytes(value) {
+	return Number.isSafeInteger(value) && value > 0;
+}
+Object.freeze({
+	randomSeed: 1592594996,
+	realtimeEpochMs: Date.UTC(2e3, 0, 1),
+	clockStepNs: 1e6
+});
+//#endregion
+//#region src/runtime/determinism.ts
+var DETERMINISTIC_NATIVE_SOURCE_PATH = ".wasm-oj/determinism.c";
+var PYTHON_RUNNER_PATH = ".wasm-oj/deterministic_runner.py";
+var DETERMINISTIC_NATIVE_RUNTIME = String.raw`
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+static uint32_t wasm_oj_random_state;
+static int wasm_oj_initialized;
+
+static uint64_t wasm_oj_parse_u64(const char *value) {
+    if (!value || !*value) abort();
+    uint64_t result = 0;
+    for (const unsigned char *cursor = (const unsigned char *)value; *cursor; ++cursor) {
+        if (*cursor < '0' || *cursor > '9') abort();
+        uint64_t digit = (uint64_t)(*cursor - '0');
+        if (result > (UINT64_MAX - digit) / 10) abort();
+        result = result * 10 + digit;
+    }
+    return result;
+}
+
+static void wasm_oj_initialize(void) {
+    if (wasm_oj_initialized) return;
+    uint64_t seed = wasm_oj_parse_u64(getenv("WASM_OJ_RANDOM_SEED"));
+    wasm_oj_random_state = (uint32_t)seed;
+    wasm_oj_initialized = 1;
+}
+
+static uint32_t wasm_oj_next_u32(void) {
+    wasm_oj_random_state += 0x9e3779b9u;
+    uint32_t value = wasm_oj_random_state;
+    value ^= value >> 16;
+    value *= 0x21f0aaadu;
+    value ^= value >> 15;
+    value *= 0x735a2d97u;
+    value ^= value >> 15;
+    return value;
+}
+
+uint32_t __imported_wasi_snapshot_preview1_random_get(uint8_t *buffer, size_t length) {
+    wasm_oj_initialize();
+    uint32_t word = 0;
+    for (size_t index = 0; index < length; ++index) {
+        if ((index & 3u) == 0) word = wasm_oj_next_u32();
+        buffer[index] = (uint8_t)(word >> ((index & 3u) * 8u));
+    }
+    return 0;
+}
+
+#ifdef __cplusplus
+}
+#endif
+`;
+var PYTHON_DETERMINISTIC_RUNNER = String.raw`
+import os as _os
+import runpy as _runpy
+import sys as _sys
+
+_random_state = None
+
+def _random_seed():
+    global _random_state
+    if _random_state is None:
+        _random_state = int(_os.environ["WASM_OJ_RANDOM_SEED"]) & 0xffffffff
+    return _random_state
+
+def _next_u32():
+    global _random_state
+    _random_seed()
+    _random_state = (_random_state + 0x9e3779b9) & 0xffffffff
+    value = _random_state
+    value ^= value >> 16
+    value = (value * 0x21f0aaad) & 0xffffffff
+    value ^= value >> 15
+    value = (value * 0x735a2d97) & 0xffffffff
+    value ^= value >> 15
+    return value & 0xffffffff
+
+def _urandom(length):
+    if not isinstance(length, int) or length < 0:
+        raise ValueError("negative argument not allowed")
+    output = bytearray(length)
+    word = 0
+    for index in range(length):
+        if index % 4 == 0:
+            word = _next_u32()
+        output[index] = (word >> ((index % 4) * 8)) & 0xff
+    return bytes(output)
+
+_os.urandom = _urandom
+if hasattr(_os, "getrandom"):
+    _os.getrandom = lambda size, flags=0: _urandom(size)
+
+_entry = _sys.argv[1]
+_sys.argv = [_entry, *_sys.argv[2:]]
+_runpy.run_path(_entry, run_name="__main__")
+`;
+//#endregion
+//#region src/compiler/sdk-direct-clang.ts
+var loadedToolchain;
+var loadedLibcxxPchManifest;
+var loadedLibcxxPch = /* @__PURE__ */ new Map();
+var objectCache = new ClangObjectCache(67108864);
+var encoder$2 = new TextEncoder();
+var decoder = new TextDecoder();
+var STAGE_OUTPUT_TIMEOUT_MS = 55e3;
+/**
+* Browser compiler that drives the pinned cc1 and wasm-ld jobs through
+* the official SDK threadpool while keeping every command and project volume
+* isolated. No Clang driver or guest subprocess is involved.
+*/
+async function buildClangWithSdkDirect(project, cacheKey, requestId, host) {
+	if (project.config.target !== "wasip1" && project.config.target !== "wasix") throw new Error("The output-ready Clang compiler accepts only wasip1 or wasix targets.");
+	if (project.config.language !== "c" && project.config.language !== "cpp") throw new Error("The output-ready Clang compiler accepts only C and C++ projects.");
+	const started = performance.now();
+	host.progress(requestId, "loading-toolchain", "Loading pinned Clang 22 toolchain", .15);
+	const { pins, compiler, linker } = await ensureToolchain(requestId, host);
+	const configKey = `${project.config.language}-${project.config.optimization}`;
+	const config = pins.configs[configKey];
+	if (!config) throw new Error(`The pinned Clang manifest has no '${configKey}' configuration.`);
+	host.trace(requestId, "filesystemPrepare", "start");
+	const projectFiles = new Map(project.files.map((file) => [file.path, encoder$2.encode(file.content)]));
+	const dependencies = cppDependencyInput(project);
+	for (const [path, bytes] of dependencies.files) projectFiles.set(path, bytes);
+	projectFiles.set(DETERMINISTIC_NATIVE_SOURCE_PATH, encoder$2.encode(DETERMINISTIC_NATIVE_RUNTIME));
+	const directory = new Directory$1(Object.fromEntries([...projectFiles].map(([path, bytes]) => [`/${path}`, bytes])));
+	try {
+		await ensureDirectory(directory, "/build");
+		await ensureDirectory(directory, "/.wasm-oj");
+		host.trace(requestId, "filesystemPrepare", "end");
+		const isCpp = project.config.language === "cpp";
+		const extensions = isCpp ? /\.(?:cc|cpp|cxx)$/ : /\.c$/;
+		const sources = project.files.filter((file) => extensions.test(file.path)).map((file) => file.path);
+		if (!sources.includes(project.config.entry)) sources.unshift(project.config.entry);
+		const units = [
+			...sources,
+			...dependencies.sources,
+			DETERMINISTIC_NATIVE_SOURCE_PATH
+		];
+		let stdout = "";
+		let stderr = "";
+		const objectPaths = [];
+		const objectInputs = [];
+		let objectCacheHits = 0;
+		let objectCacheStores = 0;
+		let pchHits = 0;
+		let pchMisses = 0;
+		let pchStores = 0;
+		let linkHits = 0;
+		let linkMisses = 0;
+		let linkStores = 0;
+		const structuredDiagnostics = [];
+		const pchHeader = isCpp ? findPrecompiledHeader(project) : void 0;
+		const pchPath = "/project/build/wasm-oj.pch";
+		let pchInput;
+		let admittedPch = false;
+		if (pchHeader) {
+			const headerBytes = projectFiles.get(pchHeader);
+			let pch;
+			if (isToolchainLibcxxPchHeader(decoder.decode(headerBytes))) {
+				admittedPch = true;
+				const reservedHeader = "wasm-oj.libcxx.hpp";
+				if (projectFiles.has(reservedHeader)) throw new Error(`C++ projects using WASM-OJ's admitted libc++ PCH may not define reserved path '${reservedHeader}'.`);
+				projectFiles.set(reservedHeader, headerBytes);
+				await directory.writeFile(`/${reservedHeader}`, headerBytes);
+				pch = await loadLibcxxPch(configKey, requestId, host);
+				pchHits += 1;
+				await directory.writeFile(pchPath.slice(8), pch);
+			} else {
+				const baseKey = await objectCache.unitManifestKey(pins, configKey, pchHeader, headerBytes);
+				const pchManifestKey = await sha256Hex(JSON.stringify({
+					baseKey,
+					mode: "c++-header"
+				}));
+				const cached = await objectCache.lookupPch(pchManifestKey, projectFiles);
+				if (cached) {
+					pch = cached;
+					pchHits += 1;
+					await directory.writeFile(pchPath.slice(8), pch);
+				} else {
+					pchMisses += 1;
+					const dependencyPath = "/project/build/wasm-oj.pch.d";
+					const args = instantiateClangPch(config.cc1, pins.placeholders, pchHeader, pchPath);
+					args.splice(args.length - 1, 0, ...dependencies.includeDirectories.flatMap((directory) => ["-I", directory]));
+					args.push("-dependency-file", dependencyPath, "-MT", pchPath);
+					const output = await runPchStage(compiler, args, directory, host, requestId, pchPath, dependencyPath);
+					structuredDiagnostics.push(...output.diagnostics);
+					stdout += output.stdout;
+					stderr += output.stderr;
+					if (!output.pch || !output.dependency) return failedBuild(project, stdout, stderr, 1, "clang", structuredDiagnostics);
+					pch = output.pch;
+					if (await objectCache.storePch(pchManifestKey, parseClangDependencyFile(output.dependency), projectFiles, pch)) pchStores += 1;
+				}
+			}
+			pchInput = {
+				kind: "pch",
+				identity: `pch:${pchHeader}`,
+				digest: await sha256Hex(pch)
+			};
+		}
+		host.progress(requestId, "compiling", `Compiling ${units.length} translation units with SDK-direct cc1`, .35);
+		host.trace(requestId, "commandStart", "start");
+		host.trace(requestId, "commandStart", "end");
+		host.trace(requestId, "commandWait", "start");
+		host.trace(requestId, "projectCompile", "start");
+		for (const [index, source] of units.entries()) {
+			if (source === ".wasm-oj/determinism.c") {
+				host.trace(requestId, "projectCompile", "end");
+				host.trace(requestId, "runtimeShimCompile", "start");
+			}
+			const objectPath = `/project/build/${String(index).padStart(4, "0")}.o`;
+			const dependencyPath = `/project/build/${String(index).padStart(4, "0")}.d`;
+			const sourceBytes = projectFiles.get(source);
+			if (!sourceBytes) throw new Error(`SDK-direct Clang is missing source bytes for '${source}'.`);
+			const baseManifestKey = await objectCache.unitManifestKey(pins, configKey, source, sourceBytes);
+			const unitPchInput = source !== ".wasm-oj/determinism.c" ? pchInput : void 0;
+			const manifestKey = unitPchInput ? await sha256Hex(JSON.stringify({
+				baseManifestKey,
+				pch: unitPchInput.digest
+			})) : baseManifestKey;
+			const additionalInputs = unitPchInput ? [unitPchInput] : [];
+			const cached = await objectCache.lookup(manifestKey, projectFiles, additionalInputs);
+			if (cached) {
+				await directory.writeFile(objectPath.slice(8), cached);
+				objectCacheHits += 1;
+				objectPaths.push(objectPath);
+				objectInputs.push({
+					kind: "object",
+					identity: source,
+					bytes: cached
+				});
+				continue;
+			}
+			const args = instantiateClangCc1(config.cc1, pins.placeholders, source, objectPath);
+			args.splice(args.length - 1, 0, ...dependencies.includeDirectories.flatMap((directory) => ["-I", directory]));
+			if (unitPchInput) args.splice(args.length - 1, 0, "-include-pch", pchPath, ...admittedPch ? ["-fno-validate-pch"] : []);
+			args.push("-dependency-file", dependencyPath, "-MT", objectPath);
+			const output = await runClangStage(compiler, args, directory, host, requestId, source === ".wasm-oj/determinism.c" ? "runtimeShimSpawn" : "projectSpawn", source === ".wasm-oj/determinism.c" ? "runtimeShimWait" : "projectWait", source === ".wasm-oj/determinism.c" ? "runtimeShimOutputReady" : "projectOutputReady", objectPath, dependencyPath);
+			structuredDiagnostics.push(...output.diagnostics);
+			stdout += output.stdout;
+			stderr += output.stderr;
+			if (!output.object || !output.dependency) {
+				host.trace(requestId, source === ".wasm-oj/determinism.c" ? "runtimeShimCompile" : "projectCompile", "end");
+				host.trace(requestId, "commandWait", "end");
+				return failedBuild(project, stdout, stderr, 1, "clang", structuredDiagnostics);
+			}
+			if (output.diagnostics.length === 0 && await objectCache.store(manifestKey, parseClangDependencyFile(output.dependency), projectFiles, output.object, additionalInputs)) objectCacheStores += 1;
+			objectPaths.push(objectPath);
+			objectInputs.push({
+				kind: "object",
+				identity: source,
+				bytes: output.object
+			});
+		}
+		host.trace(requestId, "runtimeShimCompile", "end");
+		host.progress(requestId, "linking", "Linking SDK-direct Clang objects", .8);
+		host.trace(requestId, "link", "start");
+		const outputPath = "/project/build/app.wasm";
+		const linkArguments = instantiateClangLink(config.link, pins.placeholders, objectPaths, outputPath);
+		const linkManifestKey = await sha256Hex(JSON.stringify({
+			pins: pins.sourceSha256,
+			package: CLANG_PACKAGE_SHA256,
+			target: project.config.target,
+			arguments: config.link
+		}));
+		let bytes = await objectCache.lookupLink(linkManifestKey, objectInputs);
+		let linkedStdout = "";
+		let linkedStderr = "";
+		if (bytes) linkHits += 1;
+		else {
+			linkMisses += 1;
+			const linked = await runLinkStage(linker, linkArguments, directory, host, requestId, "linkSpawn", "linkWait", "linkOutputReady", outputPath);
+			linkedStdout = linked.stdout;
+			linkedStderr = linked.stderr;
+			bytes = linked.value;
+			if (bytes && await objectCache.storeLink(linkManifestKey, objectInputs, bytes)) linkStores += 1;
+		}
+		host.trace(requestId, "link", "end");
+		host.trace(requestId, "commandWait", "end");
+		stdout += linkedStdout;
+		stderr += linkedStderr;
+		if (!bytes) return failedBuild(project, stdout, stderr, 1, "wasm-ld", structuredDiagnostics);
+		host.progress(requestId, "linking", "Reading linked WebAssembly module", .95);
+		host.trace(requestId, "artifactReadback", "start");
+		host.trace(requestId, "artifactReadback", "end");
+		return {
+			success: true,
+			diagnostics: structuredDiagnostics,
+			artifact: {
+				kind: "wasm",
+				wasmOjContract: WASM_OJ_CONTRACT_VERSION,
+				id: crypto.randomUUID(),
+				projectId: project.id,
+				cacheKey,
+				name: `${project.name}.wasm`,
+				language: project.config.language,
+				target: project.config.target,
+				optimization: project.config.optimization,
+				createdAt: Date.now(),
+				durationMs: performance.now() - started,
+				size: bytes.byteLength,
+				toolchains: toolchainPackageIdentities(project.config.language),
+				costProfile: costProfileId(project.config.language, project.config.target, project.config.optimization),
+				...project.dependencies === void 0 ? {} : { dependencyLockSha256: project.dependencies.lockSha256 },
+				bytes
+			},
+			stdout,
+			stderr,
+			cacheHit: false,
+			buildGraph: {
+				hits: {
+					pch: pchHits,
+					object: objectCacheHits,
+					"link-result": linkHits
+				},
+				misses: {
+					pch: pchMisses,
+					object: units.length - objectCacheHits,
+					"link-result": linkMisses
+				},
+				stores: {
+					pch: pchStores,
+					object: objectCacheStores,
+					"link-result": linkStores
+				}
+			}
+		};
+	} finally {
+		directory.free();
+	}
+}
+async function clearSdkDirectClangCaches() {
+	await disposeSdkDirectClangToolchain();
+	loadedLibcxxPchManifest = void 0;
+	loadedLibcxxPch.clear();
+	objectCache.clear();
+}
+/** Release all SDK resources tied to one Runtime while preserving object-cache bytes. */
+async function disposeSdkDirectClangToolchain() {
+	const pending = loadedToolchain;
+	loadedToolchain = void 0;
+	if (!pending) return;
+	const { pkg, compiler, linker } = await pending;
+	compiler.free();
+	linker.free();
+	pkg.free();
+}
+async function ensureToolchain(requestId, host) {
+	if (loadedToolchain) {
+		for (const operation of [
+			"toolchainFetch",
+			"toolchainDecode",
+			"toolchainLoad"
+		]) {
+			host.trace(requestId, operation, "start");
+			host.trace(requestId, operation, "end");
+		}
+		return loadedToolchain;
+	}
+	loadedToolchain = (async () => {
+		host.trace(requestId, "toolchainFetch", "start");
+		const [packageBytes, pinsBytes] = await Promise.all([host.loadToolchainAsset(CLANG_PACKAGE_ASSET_PATH), host.loadToolchainFile(CLANG_CC1_PINS_ASSET_PATH)]);
+		host.trace(requestId, "toolchainFetch", "end");
+		host.trace(requestId, "toolchainDecode", "start");
+		const pins = await decodeClangPins(pinsBytes);
+		const packageSha256 = await sha256Hex(packageBytes);
+		if (packageSha256 !== "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224") throw new Error(`Pinned Clang package digest mismatch: received ${packageSha256}.`);
+		host.trace(requestId, "toolchainDecode", "end");
+		host.trace(requestId, "toolchainLoad", "start");
+		const pkg = await Wasmer$1.fromFile(packageBytes, host.runtime);
+		const compiler = requireCommand(pkg, pins.command);
+		const linker = requireCommand(pkg, pins.linkerCommand);
+		host.trace(requestId, "toolchainLoad", "end");
+		return {
+			pkg,
+			pins,
+			compiler,
+			linker
+		};
+	})();
+	try {
+		return await loadedToolchain;
+	} catch (error) {
+		loadedToolchain = void 0;
+		throw error;
+	}
+}
+function requireCommand(pkg, name) {
+	const selected = pkg.commands[name];
+	if (!selected) throw new Error(`The SDK-direct Clang package does not expose '${name}'.`);
+	return selected;
+}
+async function loadLibcxxPch(profile, requestId, host) {
+	loadedLibcxxPchManifest ??= host.loadToolchainFile(CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH).then(decodeLibcxxPchManifest);
+	let pending = loadedLibcxxPch.get(profile);
+	if (!pending) {
+		pending = loadedLibcxxPchManifest.then(async (manifest) => {
+			const asset = manifest.profiles[profile];
+			host.progress(requestId, "loading-toolchain", `Loading admitted libc++ PCH (${profile})`, .25);
+			const bytes = await host.loadToolchainAsset(`/toolchains/${asset.path}`);
+			if (bytes.byteLength !== asset.byteLength || await sha256Hex(bytes) !== asset.sha256) throw new Error(`Pinned libc++ PCH '${profile}' failed decompressed integrity verification.`);
+			return bytes;
+		});
+		loadedLibcxxPch.set(profile, pending);
+	}
+	try {
+		return await pending;
+	} catch (error) {
+		loadedLibcxxPch.delete(profile);
+		throw error;
+	}
+}
+function findPrecompiledHeader(project) {
+	const headers = project.files.map((file) => file.path).filter((path) => path.split("/").at(-1) === "wasm-oj.pch.hpp");
+	if (headers.length > 1) throw new Error(`C++ projects may contain at most one wasm-oj.pch.hpp; received ${headers.join(", ")}.`);
+	return headers[0];
+}
+function runPchStage(command, args, directory, host, requestId, outputPath, dependencyPath) {
+	const stability = new MountedOutputStabilityObserver();
+	return runUntilOutputReady(command, args, directory, host, requestId, "projectSpawn", "projectWait", "projectOutputReady", async (capturedStderr) => {
+		const [snapshot, dependency] = await Promise.all([readOptionalFile(directory, outputPath), readOptionalFile(directory, dependencyPath)]);
+		const pch = stability.observe(snapshot?.byteLength ? snapshot : void 0, performance.now());
+		if (pch && dependency?.byteLength && decoder.decode(dependency).endsWith("\n")) return {
+			pch,
+			dependency
+		};
+		return /\d+ errors? generated\.\s*$/.test(capturedStderr) ? {} : void 0;
+	}).then((observed) => ({
+		...observed.value,
+		diagnostics: parseClangDiagnostics(`${observed.stderr}\n${observed.stdout}`),
+		stdout: observed.stdout,
+		stderr: observed.stderr
+	}));
+}
+function runClangStage(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, outputPath, dependencyPath) {
+	return runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, async (capturedStderr) => {
+		const [object, dependency] = await Promise.all([readValidWasmFile(directory, outputPath), readOptionalFile(directory, dependencyPath)]);
+		if (object && dependency?.byteLength && decoder.decode(dependency).endsWith("\n")) return {
+			object,
+			dependency
+		};
+		return /\d+ errors? generated\.\s*$/.test(capturedStderr) ? {} : void 0;
+	}).then((observed) => ({
+		...observed.value,
+		diagnostics: parseClangDiagnostics(`${observed.stderr}\n${observed.stdout}`),
+		stdout: observed.stdout,
+		stderr: observed.stderr
+	}));
+}
+function runLinkStage(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, outputPath) {
+	return runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, async (capturedStderr) => {
+		const output = await readValidWasmFile(directory, outputPath);
+		if (output) return output;
+		return /(?:wasm-ld|lld): error:/i.test(capturedStderr) ? null : void 0;
+	}).then((observed) => ({
+		...observed,
+		value: observed.value ?? void 0
+	}));
+}
+async function runUntilOutputReady(command, args, directory, host, requestId, spawnOperation, waitOperation, outputReadyOperation, probe) {
+	host.trace(requestId, spawnOperation, "start");
+	const instance = await command.run({
+		args,
+		cwd: "/project",
+		env: {
+			PATH: "/bin",
+			SOURCE_DATE_EPOCH: "946684800",
+			TZ: "UTC",
+			LC_ALL: "C"
+		},
+		mount: { "/project": directory }
+	});
+	host.trace(requestId, spawnOperation, "end");
+	host.trace(requestId, waitOperation, "start");
+	host.trace(requestId, outputReadyOperation, "start");
+	const stdoutCapture = captureReadable(instance.stdout);
+	const stderrCapture = captureReadable(instance.stderr);
+	const deadline = performance.now() + STAGE_OUTPUT_TIMEOUT_MS;
+	try {
+		while (performance.now() < deadline) {
+			const result = await probe(stderrCapture.text());
+			if (result !== void 0) {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				return {
+					value: result,
+					stdout: stdoutCapture.text(),
+					stderr: stderrCapture.text()
+				};
+			}
+			await new Promise((resolve) => setTimeout(resolve, 5));
+		}
+		throw new Error(`Compiler stage did not produce a complete output within ${STAGE_OUTPUT_TIMEOUT_MS} ms.`);
+	} finally {
+		host.trace(requestId, outputReadyOperation, "end");
+		host.trace(requestId, waitOperation, "end");
+		await Promise.all([stdoutCapture.cancel(), stderrCapture.cancel()]);
+		instance.free();
+	}
+}
+function captureReadable(stream) {
+	const reader = stream.getReader();
+	const chunks = [];
+	(async () => {
+		try {
+			while (true) {
+				const result = await reader.read();
+				if (result.done) return;
+				const bytes = result.value instanceof Uint8Array ? result.value : new Uint8Array(result.value);
+				chunks.push(bytes.slice());
+			}
+		} catch {}
+	})();
+	return {
+		text: () => decoder.decode(concatenate(chunks)),
+		cancel: async () => {
+			try {
+				await reader.cancel();
+			} catch {}
+		}
+	};
+}
+function concatenate(chunks) {
+	const output = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return output;
+}
+async function readValidWasmFile(directory, guestPath) {
+	const bytes = await readOptionalFile(directory, guestPath);
+	if (!bytes || bytes.byteLength <= 8) return void 0;
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return WebAssembly.validate(copy.buffer) ? copy : void 0;
+}
+async function ensureDirectory(directory, path) {
+	try {
+		await directory.createDir(path);
+	} catch (error) {
+		if (!String(error).toLowerCase().includes("exist")) throw error;
+	}
+}
+async function readOptionalFile(directory, guestPath) {
+	const mountRelativePath = guestPath.startsWith("/project/") ? guestPath.slice(8) : guestPath;
+	try {
+		return await directory.readFile(mountRelativePath);
+	} catch {
+		return;
+	}
+}
+function failedBuild(project, stdout, stderr, code, source, providedDiagnostics) {
+	return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(providedDiagnostics ?? parseClangDiagnostics(`${stderr}\n${stdout}`), {
+			file: project.config.entry,
+			source,
+			message: stderr.trim() || `${source} exited with code ${code}.`
+		}),
+		stdout,
+		stderr,
+		cacheHit: false
+	};
+}
+new TextEncoder();
+Object.freeze({
+	python: "python",
+	javascript: "qjs",
+	typescript: "qjs"
+});
+function requiredTrimmedString(value, label, maximum = 16384) {
+	if (typeof value !== "string" || !value || value !== value.trim() || value.length > maximum) throw new Error(`${label} must be a non-empty, trimmed string of at most ${maximum} characters.`);
+}
+function serializeRuntimeBundleManifest(data) {
+	return JSON.stringify({
+		schema: WASM_OJ_SCHEMAS.runtimeBundle,
+		version: WASM_OJ_CONTRACT_VERSION,
+		name: data.name,
+		target: data.target,
+		language: data.language,
+		runtime: {
+			package: data.runtimePackage,
+			command: data.command
+		},
+		execution: {
+			deterministic: true,
+			contractVersion: WASM_OJ_CONTRACT_VERSION
+		},
+		entry: data.entry,
+		files: [...data.files]
+	}, null, 2);
+}
+/** Canonical WASM-OJ manifest constructor for built-in and downstream runtime bundles. */
+function createRuntimeBundleManifest(project, runtimePackage, command, entry) {
+	requiredTrimmedString(project.name, "Project name");
+	requiredTrimmedString(runtimePackage, "Runtime package");
+	requiredTrimmedString(command, "Runtime command", 128);
+	assertLanguageIdentifier(project.config.language);
+	assertSafeRelativePath(entry, "Runtime bundle entry");
+	return serializeRuntimeBundleManifest({
+		name: project.name,
+		target: project.config.target,
+		language: project.config.language,
+		runtimePackage,
+		command,
+		entry,
+		files: canonicalProjectFiles(project.files).map((file) => file.path)
+	});
+}
+/** Produces a new record whose insertion order is canonical and path-safe. */
+function canonicalRuntimeBundleFiles(files) {
+	return canonicalFileRecord(files);
+}
+//#endregion
+//#region src/core/quickjs-runtime.ts
+var QUICKJS_STD_MODULE_DECLARATION = String.raw`
+declare module "std" {
+  const std: {
+    err: { puts(value: string): void };
+    in: { readAsString(): string };
+    out: { puts(value: string): void };
+  };
+  export = std;
+}
+`;
+//#endregion
+//#region src/compiler/language-driver.ts
+/** Internal registry for WASM-OJ's built-in compiler pipelines. */
+var LanguageDriverRegistry = class {
+	drivers = /* @__PURE__ */ new Map();
+	ids = /* @__PURE__ */ new Set();
+	register(driver) {
+		if (!driver || typeof driver !== "object") throw new TypeError("Language drivers must be objects.");
+		if (typeof driver.id !== "string" || !driver.id || driver.id !== driver.id.trim() || driver.id.length > 128) throw new Error("Language driver IDs must be non-empty, trimmed, and at most 128 characters.");
+		if (this.ids.has(driver.id)) throw new Error(`Language driver '${driver.id}' is already registered.`);
+		if (!Array.isArray(driver.languages) || driver.languages.length === 0) throw new Error(`Language driver '${driver.id}' has no languages.`);
+		if (typeof driver.build !== "function") throw new TypeError(`Language driver '${driver.id}' must implement build().`);
+		const languages = /* @__PURE__ */ new Set();
+		for (const language of driver.languages) {
+			if (typeof language !== "string") throw new TypeError("Language identifiers must be strings.");
+			assertLanguageIdentifier(language);
+			if (languages.has(language)) throw new Error(`Language '${language}' is duplicated in driver '${driver.id}'.`);
+			languages.add(language);
+			const existing = this.drivers.get(language);
+			if (existing) throw new Error(`Language '${language}' is already owned by driver '${existing.id}'.`);
+		}
+		for (const language of languages) this.drivers.set(language, driver);
+		this.ids.add(driver.id);
+	}
+	driver(language) {
+		const driver = this.drivers.get(language);
+		if (!driver) throw new Error(`No language driver is registered for '${language}'.`);
+		return driver;
+	}
+	languages() {
+		return [...this.drivers.keys()];
+	}
+};
+//#endregion
+//#region src/compiler/wasmer-engine.ts
+var encoder = new TextEncoder();
+var typescriptCompilerBytes;
+var host;
+function configureWasmerCompilerHost(nextHost) {
+	host = nextHost;
+}
+function progress(requestId, phase, label, value) {
+	requireHost().progress(requestId, phase, label, value);
+}
+function requireHost() {
+	if (!host) throw new Error("Wasmer compiler host is not configured.");
+	return host;
+}
+function requireRuntime() {
+	return requireHost().getRuntime();
+}
+async function getTypeScriptCompiler() {
+	typescriptCompilerBytes ??= requireHost().loadToolchainAsset(TYPESCRIPT_ASSET_PATH);
+	try {
+		return Wasmer$1.fromWasm(await typescriptCompilerBytes, requireRuntime());
+	} catch (error) {
+		typescriptCompilerBytes = void 0;
+		throw error;
+	}
+}
+function createArtifactBase(project, cacheKey, started, size, toolchains, contentIdentity) {
+	return {
+		wasmOjContract: WASM_OJ_CONTRACT_VERSION,
+		id: crypto.randomUUID(),
+		projectId: project.id,
+		cacheKey,
+		name: `${project.name}.${project.config.target === "wasip1" ? "wasm" : "wasix.wasm"}`,
+		language: project.config.language,
+		target: project.config.target,
+		optimization: project.config.optimization,
+		createdAt: Date.now(),
+		durationMs: performance.now() - started,
+		size,
+		toolchains,
+		costProfile: costProfileId(project.config.language, project.config.target, project.config.optimization, contentIdentity),
+		...project.dependencies === void 0 ? {} : { dependencyLockSha256: project.dependencies.lockSha256 }
+	};
+}
+async function buildRust(project, cacheKey, requestId) {
+	const started = performance.now();
+	progress(requestId, "compiling", `Compiling with rustc ${RUST_VERSION}`, .2);
+	const dependencies = rustDependencyInput(project);
+	const compiled = await requireHost().compileRust({
+		entry: project.config.entry,
+		files: [...project.files, ...dependencies.files],
+		optimization: project.config.optimization,
+		dependencies: dependencies.crates,
+		rootExterns: dependencies.roots
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "rustc",
+			message: compiled.stderr.trim() || "rustc failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const bytes = compiled.wasm;
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, bytes.byteLength, toolchainPackageIdentities("rust")),
+		bytes
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+function sumFileSize(files) {
+	return Object.values(files).reduce((total, file) => total + (typeof file === "string" ? encoder.encode(file).byteLength : file.byteLength), 0);
+}
+async function buildPython(project, cacheKey, requestId) {
+	const started = performance.now();
+	const dependencies = pythonDependencyFiles(project);
+	const compilerFiles = [...project.files, ...dependencies.sourceFiles];
+	const pythonFiles = compilerFiles.filter((file) => file.path.endsWith(".py"));
+	progress(requestId, "compiling", `Byte-compiling ${pythonFiles.length} Python file${pythonFiles.length === 1 ? "" : "s"}`, .55);
+	const frontend = await requireHost().compilePython({ files: compilerFiles });
+	if (!frontend.success) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(frontend.diagnostics, {
+			file: project.config.entry,
+			source: "python",
+			message: frontend.stderr.trim() || "Python byte-compilation failed without a diagnostic."
+		}),
+		stdout: frontend.stdout,
+		stderr: frontend.stderr,
+		cacheHit: false
+	};
+	const files = Object.fromEntries(project.files.map((file) => [file.path, file.content]));
+	Object.assign(files, dependencies.artifactFiles);
+	files[PYTHON_RUNNER_PATH] = PYTHON_DETERMINISTIC_RUNNER;
+	for (const file of pythonFiles) {
+		const compiledPath = `build/${file.path.replace(/\.py$/, ".pyc")}`;
+		const bytecode = frontend.bytecode[compiledPath];
+		if (!bytecode) throw new Error(`Python stage omitted '${compiledPath}'.`);
+		files[compiledPath] = bytecode;
+	}
+	const entry = `build/${project.config.entry.replace(/\.py$/, ".pyc")}`;
+	const manifest = createRuntimeBundleManifest(project, PYTHON_PACKAGE, "python", entry);
+	files["wasm-oj.manifest.json"] = manifest;
+	const bundleFiles = canonicalRuntimeBundleFiles(files);
+	const artifact = {
+		kind: "runtime-bundle",
+		...createArtifactBase(project, cacheKey, started, sumFileSize(bundleFiles), toolchainPackageIdentities("python")),
+		name: `${project.name}.python-${project.config.target}.json`,
+		runtimePackage: PYTHON_PACKAGE,
+		command: "python",
+		entry,
+		files: bundleFiles,
+		manifest
+	};
+	return {
+		success: true,
+		diagnostics: frontend.diagnostics,
+		artifact,
+		stdout: frontend.stdout,
+		stderr: frontend.stderr,
+		cacheHit: false
+	};
+}
+async function buildGo(project, cacheKey, requestId) {
+	const started = performance.now();
+	progress(requestId, "compiling", `Compiling with Go ${GO_VERSION}`, .3);
+	const dependencies = goDependencyInput(project);
+	const compiled = await requireHost().compileGo({
+		entry: project.config.entry,
+		files: project.files,
+		dependencyFiles: dependencies.files,
+		optimization: project.config.optimization,
+		dependencies: dependencies.packages
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "go",
+			message: compiled.stderr.trim() || "Go compilation failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, compiled.wasm.byteLength, toolchainPackageIdentities("go")),
+		bytes: compiled.wasm
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+async function buildJava(project, cacheKey, requestId) {
+	const started = performance.now();
+	const entry = project.files.find((file) => file.path === project.config.entry);
+	if (!entry || !entry.path.endsWith(".java")) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: "The Java entry must be a .java source file.",
+			file: project.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	progress(requestId, "compiling", `Compiling Java ${javaMainClass(entry.path, entry.content)}`, .3);
+	const compiled = await requireHost().compileJava({
+		entry: project.config.entry,
+		files: project.files,
+		optimization: project.config.optimization
+	});
+	if (!compiled.success || !compiled.wasm) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(compiled.diagnostics, {
+			file: project.config.entry,
+			source: "java",
+			message: compiled.stderr.trim() || "Java compilation failed without a diagnostic."
+		}),
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+	const artifact = {
+		kind: "wasm",
+		...createArtifactBase(project, cacheKey, started, compiled.wasm.byteLength, toolchainPackageIdentities("java"), toolchainContentIdentity("java")),
+		bytes: compiled.wasm
+	};
+	return {
+		success: true,
+		diagnostics: compiled.diagnostics,
+		artifact,
+		stdout: compiled.stdout,
+		stderr: compiled.stderr,
+		cacheHit: false
+	};
+}
+function emittedScriptPath(path) {
+	if (path.endsWith(".ts")) return path.slice(0, -3) + ".js";
+	return path;
+}
+function scriptSourceFiles(project) {
+	const extension = project.config.language === "typescript" ? ".ts" : ".js";
+	return project.files.filter((file) => file.path.endsWith(extension));
+}
+function emittedSourceFiles(project) {
+	return scriptSourceFiles(project).filter((file) => !file.path.endsWith(".d.ts"));
+}
+async function transpileScriptProject(project, requestId) {
+	const scriptFiles = scriptSourceFiles(project);
+	const emittedFiles = emittedSourceFiles(project);
+	const dependencyFiles = npmDependencyFiles(project);
+	progress(requestId, "loading-toolchain", `Loading TypeScript ${TYPESCRIPT_VERSION}/WASI`);
+	const entrypoint = (await getTypeScriptCompiler()).entrypoint;
+	if (!entrypoint) throw new Error("The TypeScript/WASI compiler has no executable entrypoint.");
+	const outputPaths = emittedFiles.map((file) => emittedScriptPath(file.path));
+	const declarationPath = "/project/.wasm-oj/quickjs.d.ts";
+	const output = await (await entrypoint.run({ stdin: JSON.stringify({
+		files: {
+			...Object.fromEntries(project.files.map((file) => [`/project/${file.path}`, file.content])),
+			...Object.fromEntries(Object.entries(dependencyFiles).filter(([, contents]) => typeof contents === "string").map(([path, contents]) => [`/project/${path}`, contents])),
+			[declarationPath]: QUICKJS_STD_MODULE_DECLARATION
+		},
+		javascript: project.config.language === "javascript",
+		sources: [
+			declarationPath,
+			...scriptFiles.map((file) => `/project/${file.path}`),
+			...Object.entries(dependencyFiles).filter(([path, contents]) => path.endsWith(".d.ts") && typeof contents === "string").map(([path]) => `/project/${path}`)
+		],
+		outputs: outputPaths.map((path) => `/project/build/${path}`)
+	}) })).wait();
+	let response;
+	if (output.ok) try {
+		response = JSON.parse(output.stdout);
+	} catch {
+		response = void 0;
+	}
+	const files = {};
+	if (response) for (const outputPath of outputPaths) {
+		const contents = response.files[`/project/build/${outputPath}`];
+		if (contents !== void 0) files[outputPath] = contents;
+	}
+	Object.assign(files, dependencyFiles);
+	return {
+		files,
+		output,
+		response
+	};
+}
+async function buildScript(project, cacheKey, requestId) {
+	const started = performance.now();
+	if (!emittedSourceFiles(project).some((file) => file.path === project.config.entry)) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: `The ${project.config.language === "typescript" ? ".ts" : ".js"} entry file is not a supported executable source.`,
+			file: project.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	progress(requestId, "compiling", `Compiling ${project.config.language === "typescript" ? "TypeScript" : "JavaScript"} with TypeScript/WASI`, .5);
+	const { files, output, response } = await transpileScriptProject(project, requestId);
+	const diagnostics = parseTypeScriptDiagnostics(response?.diagnostics ?? "");
+	const emittedOutputsPresent = emittedSourceFiles(project).every((file) => Object.hasOwn(files, emittedScriptPath(file.path)));
+	if (!output.ok || !response || response.status !== 0 || !emittedOutputsPresent || diagnostics.some((diagnostic) => diagnostic.severity === "error")) return {
+		success: false,
+		diagnostics: ensureFailureDiagnostic(diagnostics, {
+			file: project.config.entry,
+			source: "typescript",
+			message: output.stderr.trim() || response?.diagnostics.trim() || `TypeScript 7.0.2 did not return every compiled output.`
+		}),
+		stdout: "",
+		stderr: output.stderr,
+		cacheHit: false
+	};
+	const entry = emittedScriptPath(project.config.entry);
+	const manifest = createRuntimeBundleManifest(project, QUICKJS_PACKAGE, "qjs", entry);
+	files["wasm-oj.manifest.json"] = manifest;
+	const bundleFiles = canonicalRuntimeBundleFiles(files);
+	return {
+		success: true,
+		diagnostics,
+		artifact: {
+			kind: "runtime-bundle",
+			...createArtifactBase(project, cacheKey, started, sumFileSize(bundleFiles), toolchainPackageIdentities(project.config.language)),
+			name: `${project.name}.${project.config.language === "typescript" ? "typescript" : "javascript"}-${project.config.target}.json`,
+			runtimePackage: QUICKJS_PACKAGE,
+			command: "qjs",
+			entry,
+			files: bundleFiles,
+			manifest
+		},
+		stdout: "",
+		stderr: output.stderr,
+		cacheHit: false
+	};
+}
+async function buildProject(project, cacheKey, requestId) {
+	const canonicalProject = {
+		...project,
+		files: canonicalProjectFiles(project.files)
+	};
+	assertProjectDependencyEcosystem(canonicalProject);
+	progress(requestId, "checking", "Validating project configuration", .05);
+	if (!canonicalProject.files.some((file) => file.path === canonicalProject.config.entry)) return {
+		success: false,
+		diagnostics: [{
+			severity: "error",
+			message: "Configured entry file does not exist.",
+			file: canonicalProject.config.entry,
+			line: 1,
+			column: 1,
+			source: "project"
+		}],
+		stdout: "",
+		stderr: "",
+		cacheHit: false
+	};
+	if (canonicalProject.config.language === "c" || canonicalProject.config.language === "cpp") {
+		const activeHost = requireHost();
+		return buildClangWithSdkDirect(canonicalProject, cacheKey, requestId, {
+			runtime: activeHost.getRuntime(),
+			loadToolchainAsset: activeHost.loadToolchainAsset,
+			loadToolchainFile: activeHost.loadToolchainFile,
+			progress: activeHost.progress,
+			trace: activeHost.trace
+		});
+	}
+	return languageDrivers.driver(canonicalProject.config.language).build({
+		project: canonicalProject,
+		cacheKey,
+		requestId
+	});
+}
+var languageDrivers = new LanguageDriverRegistry();
+languageDrivers.register({
+	id: "rustc",
+	languages: ["rust"],
+	build: ({ project, cacheKey, requestId }) => buildRust(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "cpython",
+	languages: ["python"],
+	build: ({ project, cacheKey, requestId }) => buildPython(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "typescript",
+	languages: ["javascript", "typescript"],
+	build: ({ project, cacheKey, requestId }) => buildScript(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "go",
+	languages: ["go"],
+	build: ({ project, cacheKey, requestId }) => buildGo(project, cacheKey, requestId)
+});
+languageDrivers.register({
+	id: "teavm-java",
+	languages: ["java"],
+	build: ({ project, cacheKey, requestId }) => buildJava(project, cacheKey, requestId)
+});
+function clearCompilerHostCaches() {
+	typescriptCompilerBytes = void 0;
+}
+//#endregion
+//#region src/server/wasmer-runtime.ts
+var initialization;
+async function initializeServerWasmerSdk() {
+	initialization ??= init({ log: "error" }).then(() => void 0);
+	try {
+		await initialization;
+	} catch (error) {
+		initialization = void 0;
+		throw error;
+	}
+}
+//#endregion
+//#region src/server/bounded-transport.ts
+/** Collects a child-process channel without permitting unbounded host memory growth. */
+var BoundedByteCollector = class {
+	chunks = [];
+	label;
+	maximumBytes;
+	onLimitExceeded;
+	totalBytes = 0;
+	limitError;
+	constructor(label, maximumBytes, onLimitExceeded) {
+		if (!Number.isSafeInteger(maximumBytes) || maximumBytes <= 0) throw new TypeError("A bounded transport limit must be a positive safe integer.");
+		this.label = label;
+		this.maximumBytes = maximumBytes;
+		this.onLimitExceeded = onLimitExceeded;
+	}
+	append(chunk) {
+		if (this.limitError) return;
+		this.totalBytes += chunk.byteLength;
+		if (this.totalBytes > this.maximumBytes) {
+			this.limitError = /* @__PURE__ */ new Error(`${this.label} exceeded the ${this.maximumBytes} byte transport boundary.`);
+			this.chunks.length = 0;
+			this.onLimitExceeded(this.limitError);
+			return;
+		}
+		this.chunks.push(Buffer.from(chunk));
+	}
+	bytes() {
+		if (this.limitError) throw this.limitError;
+		return Buffer.concat(this.chunks, this.totalBytes);
+	}
+	text() {
+		return this.bytes().toString();
+	}
+};
+/** Reads a private one-shot response through a stable descriptor and enforces a hard byte cap. */
+async function readBoundedRegularFile(filename, maximumBytes) {
+	if (!Number.isSafeInteger(maximumBytes) || maximumBytes <= 0) throw new TypeError("A bounded file limit must be a positive safe integer.");
+	const pathStatus = await lstat(filename);
+	if (!pathStatus.isFile()) throw new Error(`Transport response '${filename}' must be a regular file.`);
+	if (pathStatus.size > maximumBytes) throw new Error(`Transport response '${filename}' exceeds the ${maximumBytes} byte boundary.`);
+	const handle = await open(filename, "r");
+	try {
+		const descriptorStatus = await handle.stat();
+		if (!descriptorStatus.isFile() || descriptorStatus.dev !== pathStatus.dev || descriptorStatus.ino !== pathStatus.ino) throw new Error(`Transport response '${filename}' changed before it could be read.`);
+		const chunks = [];
+		let totalBytes = 0;
+		while (true) {
+			const chunk = Buffer.allocUnsafe(Math.min(65536, maximumBytes - totalBytes + 1));
+			const { bytesRead } = await handle.read(chunk, 0, chunk.byteLength, null);
+			if (bytesRead === 0) break;
+			totalBytes += bytesRead;
+			if (totalBytes > maximumBytes) throw new Error(`Transport response '${filename}' exceeds the ${maximumBytes} byte boundary.`);
+			chunks.push(chunk.subarray(0, bytesRead));
+		}
+		return Buffer.concat(chunks, totalBytes);
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
+//#region src/compiler/build-timeout-policy.ts
+var CLANG_BUILD_CONTROL_TIMEOUT_MS = 6e4;
+var DEFAULT_BUILD_CONTROL_TIMEOUT_MS = 12e4;
+var GO_BUILD_CONTROL_TIMEOUT_MS = GO_COMPILE_TIMEOUT_MS + 1e4;
+var RUST_BUILD_CONTROL_TIMEOUT_MS = RUST_COMPILE_TIMEOUT_MS + 1e4;
+/**
+* Hard host deadline for one complete compiler request. The server child and
+* browser Worker must use the same policy because an SDK call can block the
+* JavaScript event loop and therefore cannot enforce its own timer.
+*/
+function buildControlTimeoutMs(language) {
+	if (language === "java") return 19e4;
+	if (!isBuiltinLanguage(language)) throw new Error(`The built-in WASM-OJ compiler does not support language '${language}'.`);
+	if (language === "c" || language === "cpp") return CLANG_BUILD_CONTROL_TIMEOUT_MS;
+	if (language === "rust") return RUST_BUILD_CONTROL_TIMEOUT_MS;
+	if (language === "go") return GO_BUILD_CONTROL_TIMEOUT_MS;
+	return DEFAULT_BUILD_CONTROL_TIMEOUT_MS;
+}
+//#endregion
+//#region src/server/toolchain-sources.ts
+function snapshotServerToolchainSources(sources) {
+	validateServerToolchainSources(sources);
+	return Object.freeze(sources.map((source) => Object.freeze({
+		kind: "server",
+		descriptor: freezeDescriptor(source.descriptor),
+		directory: new URL(source.directory.href)
+	})));
+}
+function serializeServerToolchainSources(sources) {
+	return Object.freeze(sources.map((source) => Object.freeze({
+		kind: "server",
+		descriptor: source.descriptor,
+		directory: source.directory.href
+	})));
+}
+function deserializeServerToolchainSources(sources) {
+	if (!Array.isArray(sources)) throw new Error("The isolated server stage did not receive toolchain sources.");
+	return snapshotServerToolchainSources(sources.map((source) => {
+		if (typeof source !== "object" || source === null || Array.isArray(source) || source.kind !== "server" || typeof source.directory !== "string") throw new Error("The isolated server stage received an invalid toolchain source.");
+		return {
+			kind: "server",
+			descriptor: source.descriptor,
+			directory: new URL(source.directory)
+		};
+	}));
+}
+function serverToolchainAssetFile(sources, assetPath) {
+	const { source, asset } = toolchainAssetSource(sources, assetPath);
+	const filename = path.basename(asset.path);
+	const file = fileURLToPath(new URL(filename, source.directory));
+	const directory = fileURLToPath(source.directory);
+	const relative = path.relative(directory, file);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Toolchain asset escapes its package directory: '${assetPath}'.`);
+	return file;
+}
+function serverToolchainAssetFiles(sources, assetPaths) {
+	return Object.freeze(Object.fromEntries(assetPaths.map((assetPath) => [assetPath, serverToolchainAssetFile(sources, assetPath)])));
+}
+function serverToolchainDirectories(sources) {
+	return Object.freeze([...new Set(sources.map((source) => fileURLToPath(source.directory)))]);
+}
+function assertServerToolchainProfile(sources, language, target, optimization) {
+	toolchainProfileSource(sources, language, target, optimization);
+}
+function freezeDescriptor(descriptor) {
+	return Object.freeze({
+		...descriptor,
+		languages: Object.freeze([...descriptor.languages]),
+		profiles: Object.freeze(descriptor.profiles.map((profile) => Object.freeze({ ...profile }))),
+		assets: Object.freeze(descriptor.assets.map((asset) => Object.freeze({ ...asset })))
+	});
+}
+//#endregion
+//#region src/server/verified-distribution.ts
+var verifiedDistributions = /* @__PURE__ */ new WeakSet();
+function assertVerifiedToolchainDistribution(token, toolchains) {
+	if (!verifiedDistributions.has(token)) throw new Error("WASM-OJ verified-distribution token is not process-authentic.");
+	const actual = serverToolchainAssetFiles(toolchains, toolchains.flatMap((source) => source.descriptor.assets.map((asset) => asset.path)));
+	if (!sameRecord(token.toolchainAssetFiles, actual)) throw new Error("WASM-OJ verified-distribution token does not authorize these toolchain sources.");
+}
+function sameRecord(expected, actual) {
+	const expectedEntries = Object.entries(expected).sort(([left], [right]) => left.localeCompare(right));
+	const actualEntries = Object.entries(actual).sort(([left], [right]) => left.localeCompare(right));
+	return expectedEntries.length === actualEntries.length && expectedEntries.every(([key, value], index) => {
+		const candidate = actualEntries[index];
+		return candidate?.[0] === key && candidate[1] === value;
+	});
+}
+//#endregion
+//#region src/server/stage-scripts.ts
+var SERVER_STAGE_SCRIPTS = Object.freeze([
+	"server-build-stage.mjs",
+	"server-runner-stage.mjs",
+	"python-stage.mjs",
+	"rustc-stage.mjs",
+	"go-stage.mjs",
+	"java-stage.mjs"
+]);
+var SERVER_STAGE_SCRIPT_SET = new Set(SERVER_STAGE_SCRIPTS);
+/** Resolve the one package-owned directory that contains every isolated server stage. */
+function resolveServerStageDirectory(moduleUrl = import.meta.url) {
+	const modulePath = fileURLToPath(moduleUrl);
+	const moduleDirectory = path.dirname(modulePath);
+	const moduleFilename = path.basename(modulePath);
+	if (moduleFilename === "stage-scripts.ts" && path.basename(moduleDirectory) === "server" && path.basename(path.dirname(moduleDirectory)) === "src") return moduleDirectory;
+	if ((moduleFilename === "index.js" || moduleFilename === "server-build-stage.mjs") && path.basename(moduleDirectory) === "dist") return moduleDirectory;
+	throw new Error(`Unsupported @wasm-oj/server module layout '${modulePath}'.`);
+}
+/** Resolve only a declared stage below an already-established package stage root. */
+function serverStageScript(stageDirectory, scriptName) {
+	if (!path.isAbsolute(stageDirectory)) throw new Error("The @wasm-oj/server stage directory must be absolute.");
+	if (!SERVER_STAGE_SCRIPT_SET.has(scriptName)) throw new Error(`Unknown isolated server stage '${scriptName}'.`);
+	return path.join(stageDirectory, scriptName);
+}
+//#endregion
+//#region src/server/server-compiler.ts
+var IN_PROCESS_STAGE = Symbol("wasm-oj-in-process-server-compiler");
+var SERVER_STAGE_LOG_LIMIT_BYTES = 1048576;
+var SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES = 1048576;
+var SERVER_BUILD_RESPONSE_LIMIT_BYTES = 268435456;
+var SERVER_BUILD_REQUEST_LIMIT_BYTES$1 = 805306368;
+var SERVER_COMPILER_STAGE_RESPONSE_LIMIT_BYTES = 268435456;
+/**
+* Node/server compiler host using the exact language drivers and Wasmer
+* packages used by the browser Worker.
+*/
+var ServerCompiler = class {
+	progressListeners = /* @__PURE__ */ new Set();
+	compilerExecutable;
+	toolchains;
+	initialization;
+	generation = 0;
+	disposed = false;
+	inProcess;
+	verifiedToolchain;
+	stageDirectory;
+	activeChildren = /* @__PURE__ */ new Set();
+	activeOperation;
+	constructor(options, stage) {
+		this.compilerExecutable = path.resolve(options.compilerExecutable);
+		this.toolchains = snapshotServerToolchainSources(options.toolchains);
+		if (options.verifiedDistribution) assertVerifiedToolchainDistribution(options.verifiedDistribution, this.toolchains);
+		if (options.verifiedToolchain === true && stage !== IN_PROCESS_STAGE) throw new Error("Verified toolchain inheritance is reserved for the isolated compiler stage.");
+		this.verifiedToolchain = options.verifiedDistribution !== void 0 || options.verifiedToolchain === true;
+		this.inProcess = stage === IN_PROCESS_STAGE;
+		if (stage === IN_PROCESS_STAGE) {
+			const inheritedStageDirectory = options.stageDirectory;
+			if (typeof inheritedStageDirectory !== "string" || !path.isAbsolute(inheritedStageDirectory)) throw new Error("The inherited @wasm-oj/server stage directory must be absolute.");
+			this.stageDirectory = inheritedStageDirectory;
+		} else this.stageDirectory = resolveServerStageDirectory();
+	}
+	cacheIdentity(project) {
+		this.assertActive();
+		assertServerToolchainProfile(this.toolchains, project.config.language, project.config.target, project.config.optimization);
+		return JSON.stringify(toolchainCacheIdentity(project.config.language));
+	}
+	async ready() {
+		this.assertActive();
+		const generation = this.generation;
+		let initialization = this.initialization;
+		if (!initialization) {
+			initialization = this.initialize();
+			this.initialization = initialization;
+			initialization.catch(() => {
+				if (this.initialization === initialization) this.initialization = void 0;
+			});
+		}
+		await initialization;
+		this.assertActive();
+		if (generation !== this.generation) throw new Error("Server compiler initialization was superseded.");
+	}
+	async build(project, cacheKey) {
+		assertValidProject(project);
+		assertCompilerCacheKey(cacheKey);
+		const operation = this.beginOperation("build");
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server compilation was cancelled before initialization completed.");
+			if (!this.inProcess) return await this.buildIsolated(project, cacheKey, operation);
+			const runtime = new Runtime({ registry: null });
+			configureWasmerCompilerHost({
+				getRuntime: () => runtime,
+				loadToolchainAsset: (assetPath) => this.loadToolchainAsset(assetPath),
+				loadToolchainFile: (assetPath) => this.loadToolchainFile(assetPath),
+				compileRust: (request) => this.compileRust(request),
+				compilePython: (request) => this.compilePython(request),
+				compileGo: (request) => this.compileGo(request),
+				compileJava: (request) => this.compileJava(request),
+				progress: (_requestId, phase, label, value) => {
+					if (!this.isCurrent(operation)) return;
+					const progress = {
+						phase,
+						label,
+						progress: value
+					};
+					for (const listener of this.progressListeners) listener(progress);
+				},
+				trace: () => void 0
+			});
+			try {
+				const result = await buildProject(project, cacheKey, crypto.randomUUID());
+				this.assertCurrent(operation, "Server compilation was cancelled.");
+				return result;
+			} finally {
+				await clearSdkDirectClangCaches();
+				runtime.free();
+			}
+		} finally {
+			this.endOperation(operation);
+		}
+	}
+	onProgress(listener) {
+		this.assertActive();
+		this.progressListeners.add(listener);
+		return () => this.progressListeners.delete(listener);
+	}
+	async clearToolchainCache() {
+		const operation = this.beginOperation("cache-clear");
+		try {
+			await this.ready();
+			this.assertCurrent(operation, "Server compiler cache clearing was superseded.");
+			if (this.inProcess) {
+				clearCompilerHostCaches();
+				await clearSdkDirectClangCaches();
+				this.assertCurrent(operation, "Server compiler cache clearing was superseded.");
+			}
+		} finally {
+			this.endOperation(operation);
+		}
+	}
+	cancel() {
+		if (this.disposed) return;
+		if (this.activeOperation?.kind === "cache-clear") return;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation = void 0;
+		}
+		this.terminateChildren();
+	}
+	restart() {
+		this.assertActive();
+		if (this.activeOperation?.kind === "cache-clear") throw new Error("Cannot restart ServerCompiler while clearing its cache.");
+		this.cancel();
+		if (this.inProcess) clearCompilerHostCaches();
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.generation += 1;
+		if (this.activeOperation) {
+			this.activeOperation.superseded = true;
+			this.activeOperation = void 0;
+		}
+		this.terminateChildren();
+		this.progressListeners.clear();
+	}
+	async initialize() {
+		await Promise.all([
+			access(this.compilerExecutable, constants.X_OK),
+			...serverToolchainDirectories(this.toolchains).map((directory) => access(directory, constants.R_OK)),
+			this.inProcess ? initializeServerWasmerSdk() : Promise.resolve()
+		]);
+	}
+	async buildIsolated(project, cacheKey, operation) {
+		const transportDirectory = await mkdtemp(path.join(os.tmpdir(), "wasm-oj-build-response-"));
+		const responsePath = path.join(transportDirectory, "response.v8");
+		const requestPath = path.join(transportDirectory, "request.v8");
+		const timeoutMs = buildControlTimeoutMs(project.config.language);
+		try {
+			this.assertCurrent(operation, "Server compilation was cancelled before its isolated stage started.");
+			const encodedRequest = serialize({
+				compilerExecutable: this.compilerExecutable,
+				stageDirectory: this.stageDirectory,
+				toolchains: serializeServerToolchainSources(this.toolchains),
+				verifiedToolchain: this.verifiedToolchain,
+				project,
+				cacheKey
+			});
+			if (encodedRequest.byteLength > SERVER_BUILD_REQUEST_LIMIT_BYTES$1) throw new Error(`Server compiler request exceeds ${SERVER_BUILD_REQUEST_LIMIT_BYTES$1} bytes.`);
+			await writeFile(requestPath, encodedRequest, {
+				flag: "wx",
+				mode: 384
+			});
+			return await new Promise((resolve, reject) => {
+				const script = serverStageScript(this.stageDirectory, "server-build-stage.mjs");
+				const child = spawn(process.execPath, [
+					"--experimental-strip-types",
+					"--disable-warning=ExperimentalWarning",
+					script
+				], {
+					stdio: [
+						"pipe",
+						"pipe",
+						"pipe",
+						"pipe"
+					],
+					env: {
+						...process.env,
+						WASM_OJ_BUILD_REQUEST: requestPath,
+						WASM_OJ_BUILD_RESPONSE: responsePath
+					}
+				});
+				this.activeChildren.add(child);
+				let progressBuffer = "";
+				let timedOut = false;
+				let transportError;
+				const failTransport = (error) => {
+					transportError ??= error;
+					child.kill("SIGKILL");
+				};
+				const stdout = new BoundedByteCollector("Isolated server compiler stdout", SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+				const stderr = new BoundedByteCollector("Isolated server compiler stderr", SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+				child.stdout.on("data", (chunk) => stdout.append(chunk));
+				child.stderr.on("data", (chunk) => stderr.append(chunk));
+				child.on("error", (error) => {
+					transportError = error;
+				});
+				child.stdin.on("error", (error) => {
+					transportError ??= error;
+				});
+				const progressStream = child.stdio[3];
+				if (!progressStream || typeof progressStream === "number") {
+					child.kill("SIGKILL");
+					this.activeChildren.delete(child);
+					reject(/* @__PURE__ */ new Error("The isolated server compiler did not expose its progress channel."));
+					return;
+				}
+				progressStream.on("data", (chunk) => {
+					if (Buffer.byteLength(progressBuffer, "utf8") + chunk.byteLength > SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES) {
+						failTransport(/* @__PURE__ */ new Error(`Isolated server compiler progress exceeded the ${SERVER_STAGE_PROGRESS_LINE_LIMIT_BYTES} byte line boundary.`));
+						return;
+					}
+					progressBuffer += chunk.toString();
+					const lines = progressBuffer.split("\n");
+					progressBuffer = lines.pop() ?? "";
+					for (const line of lines) {
+						if (!line) continue;
+						try {
+							const progress = JSON.parse(line);
+							if (this.isCurrent(operation)) for (const listener of this.progressListeners) listener(progress);
+						} catch {}
+					}
+				});
+				const timer = setTimeout(() => {
+					timedOut = true;
+					child.kill("SIGKILL");
+				}, timeoutMs);
+				child.on("close", async () => {
+					clearTimeout(timer);
+					this.activeChildren.delete(child);
+					try {
+						this.assertCurrent(operation, "Server compilation was cancelled.");
+						if (timedOut) throw new Error(`Server compilation exceeded ${timeoutMs} ms.`);
+						if (transportError) throw transportError;
+						let encodedResponse;
+						try {
+							encodedResponse = await readBoundedRegularFile(responsePath, SERVER_BUILD_RESPONSE_LIMIT_BYTES);
+						} catch (error) {
+							const stageError = stderr.text().trim() || stdout.text().trim();
+							if (stageError) throw new Error(stageError, { cause: error });
+							throw error;
+						}
+						const response = deserialize(encodedResponse);
+						if (!response.ok || !response.result) throw new Error(response.error || stderr.text() || stdout.text() || "The isolated server compiler failed.");
+						resolve(response.result);
+					} catch (error) {
+						reject(error);
+					}
+				});
+				child.stdin.end();
+			});
+		} finally {
+			await rm(transportDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async compileRust(request) {
+		const result = await this.runCompilerStage("rustc-stage.mjs", { request }, RUST_COMPILE_TIMEOUT_MS, [RUST_TOOLCHAIN.packageAsset, RUST_TOOLCHAIN.manifestAsset]);
+		return {
+			...result,
+			diagnostics: parseRustDiagnostics(result.stderr),
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	async compilePython(request) {
+		const result = await this.runCompilerStage("python-stage.mjs", { request }, PYTHON_COMPILE_TIMEOUT_MS, [PYTHON_PACKAGE_ASSET_PATH]);
+		return {
+			...result,
+			bytecode: Object.fromEntries(Object.entries(result.bytecodeBase64).map(([path, base64]) => [path, new Uint8Array(Buffer.from(base64, "base64"))])),
+			diagnostics: parsePythonDiagnostics(`${result.stderr}\n${result.stdout}`)
+		};
+	}
+	async compileGo(request) {
+		const result = await this.runCompilerStage("go-stage.mjs", {
+			compilerExecutable: this.compilerExecutable,
+			compileBatchSchema: WASM_OJ_SCHEMAS.compileBatch,
+			request
+		}, GO_COMPILE_TIMEOUT_MS, [
+			GO_TOOLCHAIN.packageAsset,
+			GO_TOOLCHAIN.manifestAsset,
+			GO_TOOLCHAIN.standardLibraryAsset
+		]);
+		return {
+			...result,
+			diagnostics: parseGoDiagnostics(result.stderr),
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	async compileJava(request) {
+		const result = await this.runCompilerStage("java-stage.mjs", { request }, JAVA_COMPILE_TIMEOUT_MS, [
+			JAVA_COMPILER_ASSET_PATH,
+			JAVA_COMPILE_CLASSLIB_ASSET_PATH,
+			JAVA_RUNTIME_CLASSLIB_ASSET_PATH
+		]);
+		return {
+			...result,
+			wasm: result.wasmBase64 ? new Uint8Array(Buffer.from(result.wasmBase64, "base64")) : void 0
+		};
+	}
+	runCompilerStage(scriptName, input, timeoutMs, assetPaths) {
+		const operation = this.activeOperation;
+		if (!operation || operation.kind !== "build") return Promise.reject(/* @__PURE__ */ new Error("Server compilation was cancelled before its compiler stage started."));
+		this.assertCurrent(operation, "Server compilation was cancelled before its compiler stage started.");
+		return new Promise((resolve, reject) => {
+			const script = serverStageScript(this.stageDirectory, scriptName);
+			const child = spawn(process.execPath, [
+				"--experimental-strip-types",
+				"--disable-warning=ExperimentalWarning",
+				script
+			], { stdio: [
+				"pipe",
+				"pipe",
+				"pipe",
+				"pipe"
+			] });
+			this.activeChildren.add(child);
+			let transportError;
+			let timedOut = false;
+			const failTransport = (error) => {
+				transportError ??= error;
+				child.kill("SIGKILL");
+			};
+			const stdout = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' stdout`, SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+			const stderr = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' stderr`, SERVER_STAGE_LOG_LIMIT_BYTES, failTransport);
+			const responseBytes = new BoundedByteCollector(`Isolated compiler stage '${scriptName}' response`, SERVER_COMPILER_STAGE_RESPONSE_LIMIT_BYTES, failTransport);
+			child.stdout.on("data", (chunk) => stdout.append(chunk));
+			child.stderr.on("data", (chunk) => stderr.append(chunk));
+			child.on("error", (error) => {
+				transportError = error;
+			});
+			child.stdin.on("error", (error) => {
+				transportError ??= error;
+			});
+			const responseStream = child.stdio[3];
+			if (!responseStream || typeof responseStream === "number") {
+				child.kill("SIGKILL");
+				this.activeChildren.delete(child);
+				reject(/* @__PURE__ */ new Error(`The isolated compiler stage '${scriptName}' did not expose its response channel.`));
+				return;
+			}
+			responseStream.on("data", (chunk) => responseBytes.append(chunk));
+			const timer = setTimeout(() => {
+				timedOut = true;
+				child.kill("SIGKILL");
+			}, timeoutMs + 5e3);
+			child.on("close", () => {
+				clearTimeout(timer);
+				this.activeChildren.delete(child);
+				try {
+					if (transportError) throw transportError;
+					if (timedOut) throw new Error(`The isolated compiler stage '${scriptName}' exceeded ${timeoutMs + 5e3} ms.`);
+					const response = JSON.parse(responseBytes.text());
+					if (!response.ok || !response.result) throw new Error(response.error || stderr.text() || stdout.text() || `The isolated compiler stage '${scriptName}' failed.`);
+					resolve(response.result);
+				} catch (error) {
+					reject(error);
+				}
+			});
+			child.stdin.end(JSON.stringify({
+				toolchainAssets: serverToolchainAssetFiles(this.toolchains, assetPaths),
+				verifiedToolchain: this.verifiedToolchain,
+				...input
+			}));
+		});
+	}
+	async loadToolchainAsset(assetPath) {
+		const resolved = serverToolchainAssetFile(this.toolchains, assetPath);
+		const compressed = await readFile(resolved);
+		if (!this.verifiedToolchain) this.verifyToolchainAsset(assetPath, compressed);
+		return uint8View(gunzipSync(compressed));
+	}
+	async loadToolchainFile(assetPath) {
+		const resolved = serverToolchainAssetFile(this.toolchains, assetPath);
+		const bytes = await readFile(resolved);
+		if (!this.verifiedToolchain) this.verifyToolchainAsset(assetPath, bytes);
+		return new Uint8Array(bytes);
+	}
+	verifyToolchainAsset(assetPath, bytes) {
+		const expected = toolchainAssetSource(this.toolchains, assetPath).asset.sha256;
+		const actual = createHash("sha256").update(bytes).digest("hex");
+		if (actual !== expected) throw new Error(`Pinned toolchain asset '${assetPath}' has digest ${actual}; expected ${expected}.`);
+	}
+	beginOperation(kind) {
+		this.assertActive();
+		if (this.activeOperation) throw new Error("ServerCompiler accepts one active operation at a time.");
+		const operation = {
+			kind,
+			generation: this.generation,
+			superseded: false
+		};
+		this.activeOperation = operation;
+		return operation;
+	}
+	endOperation(operation) {
+		if (this.activeOperation === operation) this.activeOperation = void 0;
+	}
+	assertCurrent(operation, message) {
+		this.assertActive();
+		if (!this.isCurrent(operation)) throw new Error(message);
+	}
+	isCurrent(operation) {
+		return !this.disposed && !operation.superseded && operation.generation === this.generation;
+	}
+	terminateChildren() {
+		for (const child of this.activeChildren) {
+			if (this.inProcess) {
+				child.kill("SIGKILL");
+				continue;
+			}
+			child.kill("SIGTERM");
+			setTimeout(() => {
+				if (this.activeChildren.has(child)) child.kill("SIGKILL");
+			}, 1e3).unref();
+		}
+	}
+	assertActive() {
+		if (this.disposed) throw new Error("ServerCompiler is disposed.");
+	}
+};
+function uint8View(bytes) {
+	return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+}
+/** @internal Entry point used only by the isolated Node compiler process. */
+async function buildServerProjectInProcess(options, project, cacheKey, onProgress) {
+	const compiler = new ServerCompiler(options, IN_PROCESS_STAGE);
+	const removeProgress = compiler.onProgress(onProgress);
+	const terminate = () => compiler.dispose();
+	process.once("SIGTERM", terminate);
+	try {
+		return await compiler.build(project, cacheKey);
+	} finally {
+		process.off("SIGTERM", terminate);
+		removeProgress();
+		compiler.dispose();
+	}
+}
+//#endregion
+//#region src/server/process-keepalive.mjs
+/**
+* Keep Node alive while a promise is backed only by a foreign async runtime.
+* Top-level await does not itself create a referenced libuv handle, so Node can
+* otherwise exit with code 13 while a Wasmer SDK operation is still pending.
+*/
+async function withProcessKeepalive(promise) {
+	const keepalive = setInterval(() => void 0, 6e4);
+	try {
+		return await promise;
+	} finally {
+		clearInterval(keepalive);
+	}
+}
+//#endregion
+//#region src/server/server-build-stage.mjs
+var SERVER_BUILD_REQUEST_LIMIT_BYTES = 805306368;
+try {
+	const responsePath = requiredResponsePath();
+	const encoded = deserialize(await readBoundedRegularFile(requiredRequestPath(), SERVER_BUILD_REQUEST_LIMIT_BYTES));
+	const result = await withProcessKeepalive(buildServerProjectInProcess({
+		compilerExecutable: encoded.compilerExecutable,
+		stageDirectory: encoded.stageDirectory,
+		toolchains: deserializeServerToolchainSources(encoded.toolchains),
+		verifiedToolchain: encoded.verifiedToolchain === true
+	}, encoded.project, encoded.cacheKey, (progress) => writeFileSync(3, `${JSON.stringify(progress)}\n`)));
+	writeFileSync(responsePath, serialize({
+		ok: true,
+		result
+	}), { flag: "wx" });
+	setTimeout(() => process.exit(0), 10);
+} catch (error) {
+	writeFileSync(requiredResponsePath(), serialize({
+		ok: false,
+		error: error instanceof Error ? error.message : String(error)
+	}), { flag: "wx" });
+	setTimeout(() => process.exit(1), 10);
+}
+function requiredResponsePath() {
+	const value = process.env.WASM_OJ_BUILD_RESPONSE;
+	if (!value) throw new Error("WASM_OJ_BUILD_RESPONSE is required.");
+	return value;
+}
+function requiredRequestPath() {
+	const value = process.env.WASM_OJ_BUILD_REQUEST;
+	if (!value) throw new Error("WASM_OJ_BUILD_REQUEST is required.");
+	return value;
+}
+//#endregion
+export {};