sandboxedjs 0.1.34 → 0.1.36

package/dist/index.d.cts

@@ -2642,6 +2642,13 @@ interface MirrorFs {
     }): void;
     unlinkSync?(path: string): void;
     rmdirSync?(path: string): void;
+    readdirSync?(path: string): string[];
+    readFileSync?(path: string): Uint8Array;
+    lstatSync?(path: string): {
+        isDirectory(): boolean;
+        isSymbolicLink(): boolean;
+        size?: number;
+    };
 }
 /**
  * A `RuntimeVolume` that forwards every mutation to an optional mirror.
@@ -2665,6 +2672,22 @@ declare class MirroringVolume implements RuntimeVolume {
     detach(): void;
     /** Copy the whole subtree across. The only bulk operation that remains. */
     private seed;
+    /**
+     * Bring back what the mirrored engine wrote.
+     *
+     * The mirror exists because Rolldown's resolver reads through WASI rather
+     * than through anything JavaScript can hand it — but Rolldown also *writes*
+     * through WASI, so `vite build` leaves its output in the mirror and the
+     * container sees an empty `dist/`. This is the return leg, and it is why the
+     * mirror is no longer strictly one-way.
+     *
+     * Called when a process ends rather than on a timer: that is the moment a
+     * build's output is complete, and a dev server — which serves from memory
+     * and writes nothing — pays for it only once, at exit.
+     */
+    absorb(): void;
+    /** `mkdir -p`, which the volume does not offer directly. */
+    private ensureDirectory;
     /** Is this path inside the mirrored subtree? */
     private mirrored;
     /**
@@ -2905,6 +2928,243 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
 }
 declare function extractNpmTarball(volume: RuntimeVolume, compressed: Uint8Array, destination: string): void;
 
+/**
+ * Running a `wasm32-wasi` binary as an ordinary container process.
+ *
+ * Everything a guest sees is taken from the `ExecContext` it was dispatched
+ * with — argv, environment, cwd, credentials, the three streams — so a wasm
+ * binary is pipelineable, redirectable and killable exactly like `grep` is.
+ * That is the whole point: `./tool.wasm < input | sort` has to work, or this
+ * is a demo rather than a runtime.
+ */
+
+interface RunWasiOptions {
+    /** Guest argv. Defaults to the context's own. */
+    argv?: string[];
+    /** Guest directory name → container path. */
+    preopens?: Record<string, string>;
+    /** Extra imports, for a module linked against more than WASI. */
+    imports?: WebAssembly.Imports;
+}
+/** Load, instantiate and run a WebAssembly binary; returns its exit code. */
+declare function runWasi(ctx: ExecContext, bytes: Uint8Array, options?: RunWasiOptions): Promise<number>;
+
+/**
+ * A `wasi_snapshot_preview1` host, implemented against this container's kernel.
+ *
+ * The point of this file is that "run a native app" stops being a special
+ * case. A program compiled to `wasm32-wasi` — by clang, Rust, Zig, Go's
+ * `GOOS=wasip1`, TinyGo — asks for files, arguments, environment, clocks and
+ * standard I/O through this one interface. Implement it against the VFS, the
+ * process table and the container's streams, and those programs run beside the
+ * coreutils with the same paths, the same permissions and the same pipes.
+ *
+ * Three constraints shape everything here.
+ *
+ * **Imports must be synchronous.** A WebAssembly import cannot await, but the
+ * kernel's stdin is a promise. So stdin is drained *before* the module starts
+ * (see `run.ts`) and served from a buffer; output streams are already
+ * synchronous. This is the same trade the Python bridge makes, for the same
+ * reason, and it is why an interactive `wasm` REPL reading a live terminal is
+ * out of scope until stack-switching is available here.
+ *
+ * **The VFS has no file descriptors.** It reads and writes whole files. So an
+ * open file is held as a buffer with a cursor, and written back on close, on
+ * sync, and before any path-based call that could otherwise observe a stale
+ * version of the file being written.
+ *
+ * **Capabilities are the VFS's, not a second model.** WASI's rights bitmask is
+ * carried and reported, but enforcement is the kernel's own uid/gid check
+ * running underneath every call. Preopens are enforced, because those *are*
+ * meaningful here: a descriptor cannot escape the directory it was derived
+ * from, so a caller that preopens only `/workspace` gets a program confined to
+ * it.
+ */
+
+/** Standard input, already reduced to something readable without waiting. */
+interface WasiStdin {
+    /** Up to `size` bytes; empty means end-of-file. Never blocks. */
+    read(size: number): Uint8Array;
+    /** Bytes that could be produced right now, for `poll_oneoff`. */
+    readonly available: number;
+    readonly isTTY: boolean;
+}
+interface WasiHostOptions {
+    /** Full guest argv, `argv[0]` included. */
+    argv: string[];
+    env: Record<string, string>;
+    vfs: Vfs;
+    cred: Cred;
+    /** Where relative guest paths resolve; published to the guest as `PWD`. */
+    cwd: string;
+    stdin: WasiStdin;
+    stdout: OutputStream;
+    stderr: OutputStream;
+    /**
+     * Guest path → container path. Defaults to the whole filesystem.
+     *
+     * Names are guest-visible *paths*, not labels: wasi-libc matches an open
+     * against the longest preopen prefix, so a preopen called `.` claims every
+     * absolute path as well and quietly turns `/work/out.txt` into
+     * `work/out.txt` under whatever `.` points at. Relative paths need no
+     * preopen of their own — libc joins them to `PWD` before it asks.
+     */
+    preopens?: Record<string, string>;
+    now?: () => number;
+    /** Monotonic nanosecond source, for `clock_time_get(MONOTONIC)`. */
+    hrtime?: () => bigint;
+    random?: (into: Uint8Array) => void;
+    /** Blocking sleep. Returning early is allowed; the guest re-polls. */
+    sleep?: (ms: number) => void;
+    /** Consulted between sleep slices so a killed process stops waiting. */
+    aborted?: () => boolean;
+}
+/** Thrown by `proc_exit` to unwind the guest's stack out to the runner. */
+declare class WasiExit extends Error {
+    readonly code: number;
+    constructor(code: number);
+}
+declare class WasiHost {
+    private memory;
+    private readonly fds;
+    private nextFd;
+    private readonly opts;
+    private readonly startTime;
+    /** Set once `proc_exit` has run, so the runner reports the guest's code. */
+    exitCode: number | null;
+    constructor(options: WasiHostOptions);
+    /** Attach the instance's memory. Called before `_start`. */
+    bind(instance: WebAssembly.Instance): void;
+    /** Flush every buffered write. Called by the runner when the guest ends. */
+    flushAll(): void;
+    /**
+     * `wasi_snapshot_preview1`.
+     *
+     * Every entry returns an errno rather than throwing: a JavaScript exception
+     * crossing back into WebAssembly traps the instance, which turns a missing
+     * file into an unrecoverable crash instead of the `ENOENT` the guest is
+     * written to handle. `guard` is what enforces that.
+     */
+    get wasiImport(): Record<string, (...args: never[]) => unknown>;
+    /**
+     * `wasi_unstable`, the preview0 name older toolchains still emit.
+     *
+     * Identical but for `fd_seek`, whose `whence` values were reordered before
+     * preview1 was frozen. Aliasing the table without this correction is a
+     * popular bug: every seek in an old binary lands somewhere plausible and
+     * wrong.
+     */
+    get wasiUnstableImport(): Record<string, (...args: never[]) => unknown>;
+    private get view();
+    private get bytes();
+    private readString;
+    /** The scatter/gather list `fd_read` and `fd_write` are given. */
+    private iovecs;
+    /**
+     * Turn anything thrown inside a syscall into an errno.
+     *
+     * `WasiExit` is re-thrown on purpose: it is the guest unwinding its own
+     * stack, not a failure to be reported through a return value.
+     */
+    private guard;
+    private get;
+    private dir;
+    private file;
+    /**
+     * Resolve a guest path against a directory descriptor.
+     *
+     * The confinement check is the one place preopens are enforced: a path that
+     * climbs out of the directory the descriptor was derived from is
+     * `ENOTCAPABLE`, which is exactly the error a capability-oriented guest
+     * expects and knows how to report.
+     */
+    private resolveAt;
+    private allocate;
+    /**
+     * Push a buffered file back to the VFS.
+     *
+     * Called before every path-based call as well as on close, so a guest that
+     * writes a file and then stats or reopens it by name sees what it wrote —
+     * the alternative is a stale read that looks like data loss.
+     */
+    private writeBack;
+    private syncPaths;
+    private args_get;
+    private args_sizes_get;
+    private get envStrings();
+    private environ_get;
+    private environ_sizes_get;
+    private writeStringVector;
+    private writeVectorSizes;
+    private clock_res_get;
+    private clock_time_get;
+    private clockNow;
+    private random_get;
+    private fd_read;
+    private fd_pread;
+    private fd_write;
+    private fd_pwrite;
+    private fd_seek;
+    private fd_tell;
+    private fd_close;
+    private fd_sync;
+    private fd_renumber;
+    private fd_allocate;
+    private fd_filestat_set_size;
+    private fd_fdstat_get;
+    private fd_fdstat_set_flags;
+    private fd_filestat_get;
+    private fd_filestat_set_times;
+    private path_filestat_get;
+    private path_filestat_set_times;
+    private setTimes;
+    private writeFilestat;
+    private fd_prestat_get;
+    private fd_prestat_dir_name;
+    private path_open;
+    private fd_readdir;
+    private path_create_directory;
+    private path_remove_directory;
+    private path_unlink_file;
+    private path_rename;
+    private path_symlink;
+    private path_link;
+    private path_readlink;
+    /**
+     * `poll_oneoff`, which is how a WASI guest sleeps and how it waits on I/O.
+     *
+     * Files and the standard streams are always ready here — nothing in this
+     * container can leave a read pending, since stdin was drained before the
+     * guest started. That leaves the clock, which is the case that matters:
+     * `sleep()` compiles to a lone clock subscription, and it is honoured by
+     * actually waiting, in slices, so that killing the process interrupts it.
+     */
+    private poll_oneoff;
+    private bytesLeft;
+    /** Wait in slices so that a `SIGKILL` does not have to outlast the sleep. */
+    private sleepInterruptibly;
+}
+/** An errno on its way back to the guest, rather than a JavaScript failure. */
+declare class WasiError extends Error {
+    readonly errno: number;
+    constructor(errno: number);
+}
+
+/** Whether `bytes` begins with the WebAssembly magic number. */
+declare function isWasmBinary(bytes: Uint8Array): boolean;
+
+/**
+ * `wasi` — the interpreter that stands behind every `.wasm` file in `$PATH`.
+ *
+ * It is invoked two ways, and they are the same code path. A user can run
+ * `wasi build/tool.wasm --flag`, or they can `chmod +x tool.wasm && ./tool.wasm
+ * --flag` and let the kernel dispatch it here the way it dispatches a `#!`
+ * script. The second is the one that matters: it is what makes a compiled
+ * binary indistinguishable from any other program on the system.
+ */
+
+declare const wasi: Command;
+
 /**
  * Starting the guest Worker, in whichever environment the host happens to be.
  *
@@ -3009,4 +3269,4 @@ declare function renderInto(box: Container, element: HTMLElement, options?: {
  * ```
  */
 
-export { ArithError, BufferSink, type CPythonOptions, CallbackSink, type ChildHandle, type ChildSpawnConfig, type CleanInstallerOptions, CleanPackageInstaller, type Command, CommandRegistry, CommonJsEngine, type CommonJsEngineOptions, type CommonJsModule, Container, ContainerFs, type ContainerOptions, type ContextInit, type CoreModulesOptions, type Cred, type DirEntry, ERRNO, type Env, type ErrnoCode, type EsmTransformResult, type ExecContext, type ExecOptions, type ExecResult, type FileData, FileInput, FileOutput, type GroupEntry, type HttpResponse, IncompleteInputError, type InputStream, type InstallOptions, type Job, KERNEL_NAME, KERNEL_RELEASE, Kernel, type KernelOptions, type ListeningPort, type LocalRuntimeOptions, LocalRuntimePod, MemoryVolume, type MountEntry, NODE_VERSION, NPM_VERSION, type NetInterface, type NetworkOptions, NetworkStack, NullInput, NullOutput, OS_RELEASE, type OutputStream, PYTHON_VERSION, type PasswdEntry, Pipe, type Preview, type PreviewOptions, Process, type ProcessKind, type ProcessOptions, type ProcessState, ProcessTable, type PythonOptions, ROOT_CRED, type ResolvedExecutable, type RootfsOptions, type RunOptions, type RunResult, type RuntimePackageInstaller, type RuntimePod, type RuntimeProcess, type RuntimeProcessManager, type RuntimeProcessResult, type RuntimeVolume, SIGNALS, SIGNAL_NAMES, Session, type SessionInit, type SessionResult, type SessionRunOptions, Shell, ShellExit, type ShellIO, type ShellInit, Lexer as ShellLexer, type ShellOptions, ShellSyntaxError, type SpawnChild, type SpawnHandle, Stats, type Stdio, SysError, TeeOutput, Terminal, type TerminalOptions, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, type VirtualNode, type VirtualProvider, VirtualServerResponse, WASM_ALIASES, type WorkerRuntimeOptions, WorkerRuntimePod, type WriteOptions, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, createContainer as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path as posixPath, renderInto, resetPidCounter, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo };
+export { ArithError, BufferSink, type CPythonOptions, CallbackSink, type ChildHandle, type ChildSpawnConfig, type CleanInstallerOptions, CleanPackageInstaller, type Command, CommandRegistry, CommonJsEngine, type CommonJsEngineOptions, type CommonJsModule, Container, ContainerFs, type ContainerOptions, type ContextInit, type CoreModulesOptions, type Cred, type DirEntry, ERRNO, type Env, type ErrnoCode, type EsmTransformResult, type ExecContext, type ExecOptions, type ExecResult, type FileData, FileInput, FileOutput, type GroupEntry, type HttpResponse, IncompleteInputError, type InputStream, type InstallOptions, type Job, KERNEL_NAME, KERNEL_RELEASE, Kernel, type KernelOptions, type ListeningPort, type LocalRuntimeOptions, LocalRuntimePod, MemoryVolume, type MountEntry, NODE_VERSION, NPM_VERSION, type NetInterface, type NetworkOptions, NetworkStack, NullInput, NullOutput, OS_RELEASE, type OutputStream, PYTHON_VERSION, type PasswdEntry, Pipe, type Preview, type PreviewOptions, Process, type ProcessKind, type ProcessOptions, type ProcessState, ProcessTable, type PythonOptions, ROOT_CRED, type ResolvedExecutable, type RootfsOptions, type RunOptions, type RunResult, type RunWasiOptions, type RuntimePackageInstaller, type RuntimePod, type RuntimeProcess, type RuntimeProcessManager, type RuntimeProcessResult, type RuntimeVolume, SIGNALS, SIGNAL_NAMES, Session, type SessionInit, type SessionResult, type SessionRunOptions, Shell, ShellExit, type ShellIO, type ShellInit, Lexer as ShellLexer, type ShellOptions, ShellSyntaxError, type SpawnChild, type SpawnHandle, Stats, type Stdio, SysError, TeeOutput, Terminal, type TerminalOptions, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, type VirtualNode, type VirtualProvider, VirtualServerResponse, WASM_ALIASES, WasiError, WasiExit, WasiHost, type WasiHostOptions, type WasiStdin, type WorkerRuntimeOptions, WorkerRuntimePod, type WriteOptions, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, createContainer as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, isWasmBinary, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path as posixPath, renderInto, resetPidCounter, runWasi, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo, wasi as wasiCommand };

package/dist/index.d.ts

@@ -2642,6 +2642,13 @@ interface MirrorFs {
     }): void;
     unlinkSync?(path: string): void;
     rmdirSync?(path: string): void;
+    readdirSync?(path: string): string[];
+    readFileSync?(path: string): Uint8Array;
+    lstatSync?(path: string): {
+        isDirectory(): boolean;
+        isSymbolicLink(): boolean;
+        size?: number;
+    };
 }
 /**
  * A `RuntimeVolume` that forwards every mutation to an optional mirror.
@@ -2665,6 +2672,22 @@ declare class MirroringVolume implements RuntimeVolume {
     detach(): void;
     /** Copy the whole subtree across. The only bulk operation that remains. */
     private seed;
+    /**
+     * Bring back what the mirrored engine wrote.
+     *
+     * The mirror exists because Rolldown's resolver reads through WASI rather
+     * than through anything JavaScript can hand it — but Rolldown also *writes*
+     * through WASI, so `vite build` leaves its output in the mirror and the
+     * container sees an empty `dist/`. This is the return leg, and it is why the
+     * mirror is no longer strictly one-way.
+     *
+     * Called when a process ends rather than on a timer: that is the moment a
+     * build's output is complete, and a dev server — which serves from memory
+     * and writes nothing — pays for it only once, at exit.
+     */
+    absorb(): void;
+    /** `mkdir -p`, which the volume does not offer directly. */
+    private ensureDirectory;
     /** Is this path inside the mirrored subtree? */
     private mirrored;
     /**
@@ -2905,6 +2928,243 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
 }
 declare function extractNpmTarball(volume: RuntimeVolume, compressed: Uint8Array, destination: string): void;
 
+/**
+ * Running a `wasm32-wasi` binary as an ordinary container process.
+ *
+ * Everything a guest sees is taken from the `ExecContext` it was dispatched
+ * with — argv, environment, cwd, credentials, the three streams — so a wasm
+ * binary is pipelineable, redirectable and killable exactly like `grep` is.
+ * That is the whole point: `./tool.wasm < input | sort` has to work, or this
+ * is a demo rather than a runtime.
+ */
+
+interface RunWasiOptions {
+    /** Guest argv. Defaults to the context's own. */
+    argv?: string[];
+    /** Guest directory name → container path. */
+    preopens?: Record<string, string>;
+    /** Extra imports, for a module linked against more than WASI. */
+    imports?: WebAssembly.Imports;
+}
+/** Load, instantiate and run a WebAssembly binary; returns its exit code. */
+declare function runWasi(ctx: ExecContext, bytes: Uint8Array, options?: RunWasiOptions): Promise<number>;
+
+/**
+ * A `wasi_snapshot_preview1` host, implemented against this container's kernel.
+ *
+ * The point of this file is that "run a native app" stops being a special
+ * case. A program compiled to `wasm32-wasi` — by clang, Rust, Zig, Go's
+ * `GOOS=wasip1`, TinyGo — asks for files, arguments, environment, clocks and
+ * standard I/O through this one interface. Implement it against the VFS, the
+ * process table and the container's streams, and those programs run beside the
+ * coreutils with the same paths, the same permissions and the same pipes.
+ *
+ * Three constraints shape everything here.
+ *
+ * **Imports must be synchronous.** A WebAssembly import cannot await, but the
+ * kernel's stdin is a promise. So stdin is drained *before* the module starts
+ * (see `run.ts`) and served from a buffer; output streams are already
+ * synchronous. This is the same trade the Python bridge makes, for the same
+ * reason, and it is why an interactive `wasm` REPL reading a live terminal is
+ * out of scope until stack-switching is available here.
+ *
+ * **The VFS has no file descriptors.** It reads and writes whole files. So an
+ * open file is held as a buffer with a cursor, and written back on close, on
+ * sync, and before any path-based call that could otherwise observe a stale
+ * version of the file being written.
+ *
+ * **Capabilities are the VFS's, not a second model.** WASI's rights bitmask is
+ * carried and reported, but enforcement is the kernel's own uid/gid check
+ * running underneath every call. Preopens are enforced, because those *are*
+ * meaningful here: a descriptor cannot escape the directory it was derived
+ * from, so a caller that preopens only `/workspace` gets a program confined to
+ * it.
+ */
+
+/** Standard input, already reduced to something readable without waiting. */
+interface WasiStdin {
+    /** Up to `size` bytes; empty means end-of-file. Never blocks. */
+    read(size: number): Uint8Array;
+    /** Bytes that could be produced right now, for `poll_oneoff`. */
+    readonly available: number;
+    readonly isTTY: boolean;
+}
+interface WasiHostOptions {
+    /** Full guest argv, `argv[0]` included. */
+    argv: string[];
+    env: Record<string, string>;
+    vfs: Vfs;
+    cred: Cred;
+    /** Where relative guest paths resolve; published to the guest as `PWD`. */
+    cwd: string;
+    stdin: WasiStdin;
+    stdout: OutputStream;
+    stderr: OutputStream;
+    /**
+     * Guest path → container path. Defaults to the whole filesystem.
+     *
+     * Names are guest-visible *paths*, not labels: wasi-libc matches an open
+     * against the longest preopen prefix, so a preopen called `.` claims every
+     * absolute path as well and quietly turns `/work/out.txt` into
+     * `work/out.txt` under whatever `.` points at. Relative paths need no
+     * preopen of their own — libc joins them to `PWD` before it asks.
+     */
+    preopens?: Record<string, string>;
+    now?: () => number;
+    /** Monotonic nanosecond source, for `clock_time_get(MONOTONIC)`. */
+    hrtime?: () => bigint;
+    random?: (into: Uint8Array) => void;
+    /** Blocking sleep. Returning early is allowed; the guest re-polls. */
+    sleep?: (ms: number) => void;
+    /** Consulted between sleep slices so a killed process stops waiting. */
+    aborted?: () => boolean;
+}
+/** Thrown by `proc_exit` to unwind the guest's stack out to the runner. */
+declare class WasiExit extends Error {
+    readonly code: number;
+    constructor(code: number);
+}
+declare class WasiHost {
+    private memory;
+    private readonly fds;
+    private nextFd;
+    private readonly opts;
+    private readonly startTime;
+    /** Set once `proc_exit` has run, so the runner reports the guest's code. */
+    exitCode: number | null;
+    constructor(options: WasiHostOptions);
+    /** Attach the instance's memory. Called before `_start`. */
+    bind(instance: WebAssembly.Instance): void;
+    /** Flush every buffered write. Called by the runner when the guest ends. */
+    flushAll(): void;
+    /**
+     * `wasi_snapshot_preview1`.
+     *
+     * Every entry returns an errno rather than throwing: a JavaScript exception
+     * crossing back into WebAssembly traps the instance, which turns a missing
+     * file into an unrecoverable crash instead of the `ENOENT` the guest is
+     * written to handle. `guard` is what enforces that.
+     */
+    get wasiImport(): Record<string, (...args: never[]) => unknown>;
+    /**
+     * `wasi_unstable`, the preview0 name older toolchains still emit.
+     *
+     * Identical but for `fd_seek`, whose `whence` values were reordered before
+     * preview1 was frozen. Aliasing the table without this correction is a
+     * popular bug: every seek in an old binary lands somewhere plausible and
+     * wrong.
+     */
+    get wasiUnstableImport(): Record<string, (...args: never[]) => unknown>;
+    private get view();
+    private get bytes();
+    private readString;
+    /** The scatter/gather list `fd_read` and `fd_write` are given. */
+    private iovecs;
+    /**
+     * Turn anything thrown inside a syscall into an errno.
+     *
+     * `WasiExit` is re-thrown on purpose: it is the guest unwinding its own
+     * stack, not a failure to be reported through a return value.
+     */
+    private guard;
+    private get;
+    private dir;
+    private file;
+    /**
+     * Resolve a guest path against a directory descriptor.
+     *
+     * The confinement check is the one place preopens are enforced: a path that
+     * climbs out of the directory the descriptor was derived from is
+     * `ENOTCAPABLE`, which is exactly the error a capability-oriented guest
+     * expects and knows how to report.
+     */
+    private resolveAt;
+    private allocate;
+    /**
+     * Push a buffered file back to the VFS.
+     *
+     * Called before every path-based call as well as on close, so a guest that
+     * writes a file and then stats or reopens it by name sees what it wrote —
+     * the alternative is a stale read that looks like data loss.
+     */
+    private writeBack;
+    private syncPaths;
+    private args_get;
+    private args_sizes_get;
+    private get envStrings();
+    private environ_get;
+    private environ_sizes_get;
+    private writeStringVector;
+    private writeVectorSizes;
+    private clock_res_get;
+    private clock_time_get;
+    private clockNow;
+    private random_get;
+    private fd_read;
+    private fd_pread;
+    private fd_write;
+    private fd_pwrite;
+    private fd_seek;
+    private fd_tell;
+    private fd_close;
+    private fd_sync;
+    private fd_renumber;
+    private fd_allocate;
+    private fd_filestat_set_size;
+    private fd_fdstat_get;
+    private fd_fdstat_set_flags;
+    private fd_filestat_get;
+    private fd_filestat_set_times;
+    private path_filestat_get;
+    private path_filestat_set_times;
+    private setTimes;
+    private writeFilestat;
+    private fd_prestat_get;
+    private fd_prestat_dir_name;
+    private path_open;
+    private fd_readdir;
+    private path_create_directory;
+    private path_remove_directory;
+    private path_unlink_file;
+    private path_rename;
+    private path_symlink;
+    private path_link;
+    private path_readlink;
+    /**
+     * `poll_oneoff`, which is how a WASI guest sleeps and how it waits on I/O.
+     *
+     * Files and the standard streams are always ready here — nothing in this
+     * container can leave a read pending, since stdin was drained before the
+     * guest started. That leaves the clock, which is the case that matters:
+     * `sleep()` compiles to a lone clock subscription, and it is honoured by
+     * actually waiting, in slices, so that killing the process interrupts it.
+     */
+    private poll_oneoff;
+    private bytesLeft;
+    /** Wait in slices so that a `SIGKILL` does not have to outlast the sleep. */
+    private sleepInterruptibly;
+}
+/** An errno on its way back to the guest, rather than a JavaScript failure. */
+declare class WasiError extends Error {
+    readonly errno: number;
+    constructor(errno: number);
+}
+
+/** Whether `bytes` begins with the WebAssembly magic number. */
+declare function isWasmBinary(bytes: Uint8Array): boolean;
+
+/**
+ * `wasi` — the interpreter that stands behind every `.wasm` file in `$PATH`.
+ *
+ * It is invoked two ways, and they are the same code path. A user can run
+ * `wasi build/tool.wasm --flag`, or they can `chmod +x tool.wasm && ./tool.wasm
+ * --flag` and let the kernel dispatch it here the way it dispatches a `#!`
+ * script. The second is the one that matters: it is what makes a compiled
+ * binary indistinguishable from any other program on the system.
+ */
+
+declare const wasi: Command;
+
 /**
  * Starting the guest Worker, in whichever environment the host happens to be.
  *
@@ -3009,4 +3269,4 @@ declare function renderInto(box: Container, element: HTMLElement, options?: {
  * ```
  */
 
-export { ArithError, BufferSink, type CPythonOptions, CallbackSink, type ChildHandle, type ChildSpawnConfig, type CleanInstallerOptions, CleanPackageInstaller, type Command, CommandRegistry, CommonJsEngine, type CommonJsEngineOptions, type CommonJsModule, Container, ContainerFs, type ContainerOptions, type ContextInit, type CoreModulesOptions, type Cred, type DirEntry, ERRNO, type Env, type ErrnoCode, type EsmTransformResult, type ExecContext, type ExecOptions, type ExecResult, type FileData, FileInput, FileOutput, type GroupEntry, type HttpResponse, IncompleteInputError, type InputStream, type InstallOptions, type Job, KERNEL_NAME, KERNEL_RELEASE, Kernel, type KernelOptions, type ListeningPort, type LocalRuntimeOptions, LocalRuntimePod, MemoryVolume, type MountEntry, NODE_VERSION, NPM_VERSION, type NetInterface, type NetworkOptions, NetworkStack, NullInput, NullOutput, OS_RELEASE, type OutputStream, PYTHON_VERSION, type PasswdEntry, Pipe, type Preview, type PreviewOptions, Process, type ProcessKind, type ProcessOptions, type ProcessState, ProcessTable, type PythonOptions, ROOT_CRED, type ResolvedExecutable, type RootfsOptions, type RunOptions, type RunResult, type RuntimePackageInstaller, type RuntimePod, type RuntimeProcess, type RuntimeProcessManager, type RuntimeProcessResult, type RuntimeVolume, SIGNALS, SIGNAL_NAMES, Session, type SessionInit, type SessionResult, type SessionRunOptions, Shell, ShellExit, type ShellIO, type ShellInit, Lexer as ShellLexer, type ShellOptions, ShellSyntaxError, type SpawnChild, type SpawnHandle, Stats, type Stdio, SysError, TeeOutput, Terminal, type TerminalOptions, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, type VirtualNode, type VirtualProvider, VirtualServerResponse, WASM_ALIASES, type WorkerRuntimeOptions, WorkerRuntimePod, type WriteOptions, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, createContainer as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path as posixPath, renderInto, resetPidCounter, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo };
+export { ArithError, BufferSink, type CPythonOptions, CallbackSink, type ChildHandle, type ChildSpawnConfig, type CleanInstallerOptions, CleanPackageInstaller, type Command, CommandRegistry, CommonJsEngine, type CommonJsEngineOptions, type CommonJsModule, Container, ContainerFs, type ContainerOptions, type ContextInit, type CoreModulesOptions, type Cred, type DirEntry, ERRNO, type Env, type ErrnoCode, type EsmTransformResult, type ExecContext, type ExecOptions, type ExecResult, type FileData, FileInput, FileOutput, type GroupEntry, type HttpResponse, IncompleteInputError, type InputStream, type InstallOptions, type Job, KERNEL_NAME, KERNEL_RELEASE, Kernel, type KernelOptions, type ListeningPort, type LocalRuntimeOptions, LocalRuntimePod, MemoryVolume, type MountEntry, NODE_VERSION, NPM_VERSION, type NetInterface, type NetworkOptions, NetworkStack, NullInput, NullOutput, OS_RELEASE, type OutputStream, PYTHON_VERSION, type PasswdEntry, Pipe, type Preview, type PreviewOptions, Process, type ProcessKind, type ProcessOptions, type ProcessState, ProcessTable, type PythonOptions, ROOT_CRED, type ResolvedExecutable, type RootfsOptions, type RunOptions, type RunResult, type RunWasiOptions, type RuntimePackageInstaller, type RuntimePod, type RuntimeProcess, type RuntimeProcessManager, type RuntimeProcessResult, type RuntimeVolume, SIGNALS, SIGNAL_NAMES, Session, type SessionInit, type SessionResult, type SessionRunOptions, Shell, ShellExit, type ShellIO, type ShellInit, Lexer as ShellLexer, type ShellOptions, ShellSyntaxError, type SpawnChild, type SpawnHandle, Stats, type Stdio, SysError, TeeOutput, Terminal, type TerminalOptions, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, type VirtualNode, type VirtualProvider, VirtualServerResponse, WASM_ALIASES, WasiError, WasiExit, WasiHost, type WasiHostOptions, type WasiStdin, type WorkerRuntimeOptions, WorkerRuntimePod, type WriteOptions, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, createContainer as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, isWasmBinary, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path as posixPath, renderInto, resetPidCounter, runWasi, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo, wasi as wasiCommand };