sandboxedjs 0.1.34 → 0.1.36

package/dist/index.js

@@ -17,6 +17,10 @@ import timersModule from 'timers-browserify';
 import legacyUrl from 'url/url.js';
 import { sha1 as sha1$1, md5 } from '@noble/hashes/legacy';
 import { hmac } from '@noble/hashes/hmac';
+import { createRequire } from 'module';
+import { readFileSync, existsSync } from 'fs';
+import { dirname as dirname$1, join as join$1 } from 'path';
+import { pathToFileURL as pathToFileURL$1, fileURLToPath as fileURLToPath$1 } from 'url';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -774,10 +778,10 @@ function globToRegexSource(pattern, opts = {}) {
       continue;
     }
     if (c === "[") {
-      const compiled2 = compileBracket(pattern, i);
-      if (compiled2) {
-        out += guardDot() + compiled2.source;
-        i = compiled2.next;
+      const compiled3 = compileBracket(pattern, i);
+      if (compiled3) {
+        out += guardDot() + compiled3.source;
+        i = compiled3.next;
         atSegmentStart = false;
         continue;
       }
@@ -5690,8 +5694,101 @@ function strerrorOf(e) {
 var EXIT_NOT_EXECUTABLE = 126;
 var EXIT_NOT_FOUND = 127;
 
+// src/wasi/constants.ts
+var WASI_ESUCCESS = 0;
+var WASI_EACCES = 2;
+var WASI_EAGAIN = 6;
+var WASI_EBADF = 8;
+var WASI_EBUSY = 10;
+var WASI_EEXIST = 20;
+var WASI_EFAULT = 21;
+var WASI_EFBIG = 22;
+var WASI_EINVAL = 28;
+var WASI_EIO = 29;
+var WASI_EISDIR = 31;
+var WASI_ELOOP = 32;
+var WASI_EMFILE = 34;
+var WASI_ENAMETOOLONG = 37;
+var WASI_ENOENT = 44;
+var WASI_ENOMEM = 48;
+var WASI_ENOSPC = 51;
+var WASI_ENOSYS = 52;
+var WASI_ENOTDIR = 54;
+var WASI_ENOTEMPTY = 55;
+var WASI_ENOTSUP = 58;
+var WASI_ENOTTY = 59;
+var WASI_EPERM = 63;
+var WASI_EPIPE = 64;
+var WASI_EROFS = 69;
+var WASI_ESPIPE = 70;
+var WASI_EXDEV = 75;
+var WASI_ENOTCAPABLE = 76;
+var WASI_ERRNO_BY_CODE = {
+  EPERM: WASI_EPERM,
+  ENOENT: WASI_ENOENT,
+  EIO: WASI_EIO,
+  EBADF: WASI_EBADF,
+  EAGAIN: WASI_EAGAIN,
+  ENOMEM: WASI_ENOMEM,
+  EACCES: WASI_EACCES,
+  EFAULT: WASI_EFAULT,
+  EBUSY: WASI_EBUSY,
+  EEXIST: WASI_EEXIST,
+  EXDEV: WASI_EXDEV,
+  ENOTDIR: WASI_ENOTDIR,
+  EISDIR: WASI_EISDIR,
+  EINVAL: WASI_EINVAL,
+  EMFILE: WASI_EMFILE,
+  ENOTTY: WASI_ENOTTY,
+  EFBIG: WASI_EFBIG,
+  ENOSPC: WASI_ENOSPC,
+  ESPIPE: WASI_ESPIPE,
+  EROFS: WASI_EROFS,
+  EPIPE: WASI_EPIPE,
+  ENAMETOOLONG: WASI_ENAMETOOLONG,
+  ENOSYS: WASI_ENOSYS,
+  ENOTEMPTY: WASI_ENOTEMPTY,
+  ELOOP: WASI_ELOOP,
+  ENOTSUP: WASI_ENOTSUP
+};
+var FILETYPE_UNKNOWN = 0;
+var FILETYPE_CHARACTER_DEVICE = 2;
+var FILETYPE_DIRECTORY = 3;
+var FILETYPE_REGULAR_FILE = 4;
+var FILETYPE_SYMBOLIC_LINK = 7;
+var O_CREAT = 1 << 0;
+var O_DIRECTORY = 1 << 1;
+var O_EXCL = 1 << 2;
+var O_TRUNC = 1 << 3;
+var FD_APPEND = 1 << 0;
+var LOOKUP_SYMLINK_FOLLOW = 1 << 0;
+var FST_ATIM = 1 << 0;
+var FST_ATIM_NOW = 1 << 1;
+var FST_MTIM = 1 << 2;
+var FST_MTIM_NOW = 1 << 3;
+var WHENCE_SET = 0;
+var WHENCE_CUR = 1;
+var WHENCE_END = 2;
+var EVENTTYPE_CLOCK = 0;
+var EVENTTYPE_FD_READ = 1;
+var EVENTTYPE_FD_WRITE = 2;
+var SUBSCRIPTION_CLOCK_ABSTIME = 1 << 0;
+var RIGHT_FD_READ = 1n << 1n;
+var RIGHT_FD_SEEK = 1n << 2n;
+var RIGHT_FD_WRITE = 1n << 6n;
+var RIGHTS_ALL = (1n << 30n) - 1n;
+var SIZEOF_FILESTAT = 64;
+var SIZEOF_FDSTAT = 24;
+var SIZEOF_DIRENT = 24;
+var SIZEOF_SUBSCRIPTION = 48;
+var SIZEOF_EVENT = 32;
+function isWasmBinary(bytes2) {
+  return bytes2.length >= 4 && bytes2[0] === 0 && bytes2[1] === 97 && bytes2[2] === 115 && bytes2[3] === 109;
+}
+
 // src/kernel/kernel.ts
 var BUILTIN_INTERPRETER = "/proc/self/exe";
+var WASI_INTERPRETER = "/usr/bin/wasi";
 var Kernel = class {
   vfs;
   procs = new ProcessTable();
@@ -5826,12 +5923,17 @@ var Kernel = class {
         if (command) return { kind: "builtin", path: candidate, command };
       }
       let head2 = "";
+      let magic;
       try {
         if (this.vfs.permitted(st, R_OK, cred)) {
-          head2 = new TextDecoder().decode(this.vfs.readFile(real, cred).subarray(0, 256));
+          magic = this.vfs.readFile(real, cred).subarray(0, 256);
+          head2 = new TextDecoder().decode(magic);
         }
       } catch {
       }
+      if (magic && isWasmBinary(magic)) {
+        return { kind: "script", path: real, interpreter: [WASI_INTERPRETER] };
+      }
       if (head2.startsWith("#!")) {
         const lineEnd = head2.indexOf("\n");
         const line = (lineEnd >= 0 ? head2.slice(2, lineEnd) : head2.slice(2)).trim();
@@ -5845,6 +5947,7 @@ var Kernel = class {
       const ext = extname(real);
       if (ext === ".js" || ext === ".mjs" || ext === ".cjs") return { kind: "script", path: real, interpreter: ["/usr/bin/node"] };
       if (ext === ".py") return { kind: "script", path: real, interpreter: ["/usr/bin/python3"] };
+      if (ext === ".wasm") return { kind: "script", path: real, interpreter: [WASI_INTERPRETER] };
       return { kind: "script", path: real, interpreter: ["/bin/sh"] };
     }
     return null;
@@ -15723,9 +15826,9 @@ function makeSum(name, algorithm, path) {
       if (args.has("check")) return checkSums(ctx, algorithm, args.positional, args.has("quiet") || args.has("status"));
       const { sources, ok: ok2 } = await readInputs(ctx, args.positional, { stdinName: "-" });
       for (const source of sources) {
-        const digest = await digestHex(algorithm, source.bytes);
-        if (args.has("tag")) ctx.line(`${algorithm.toUpperCase()} (${source.name}) = ${digest}`);
-        else ctx.line(`${digest}  ${source.name}`);
+        const digest2 = await digestHex(algorithm, source.bytes);
+        if (args.has("tag")) ctx.line(`${algorithm.toUpperCase()} (${source.name}) = ${digest2}`);
+        else ctx.line(`${digest2}  ${source.name}`);
       }
       return ok2 ? 0 : 1;
     }
@@ -18506,12 +18609,12 @@ function installSyscallBridge(py) {
 function bindProgram(py, binding) {
   py.__sbxSlot.current = binding;
   const { ctx, stdin } = binding;
-  const decoder8 = new TextDecoder();
+  const decoder9 = new TextDecoder();
   py.setStdout({
-    write: (buffer) => (ctx.write(decoder8.decode(buffer)), buffer.length)
+    write: (buffer) => (ctx.write(decoder9.decode(buffer)), buffer.length)
   });
   py.setStderr({
-    write: (buffer) => (ctx.stderr.write(decoder8.decode(buffer)), buffer.length)
+    write: (buffer) => (ctx.stderr.write(decoder9.decode(buffer)), buffer.length)
   });
   py.setStdin({
     read: (buffer) => {
@@ -18561,9 +18664,9 @@ async function resolveIndexUrl() {
   if (indexUrl) return indexUrl;
   if (!isNode2) return DEFAULT_BROWSER_INDEX_URL;
   try {
-    const { createRequire } = await nodeBuiltin("module");
+    const { createRequire: createRequire2 } = await nodeBuiltin("module");
     const path = await nodeBuiltin("path");
-    const require2 = createRequire(path.join(process.cwd(), "index.js"));
+    const require2 = createRequire2(path.join(process.cwd(), "index.js"));
     return `${path.dirname(require2.resolve("pyodide/package.json"))}/`;
   } catch {
     return void 0;
@@ -19028,15 +19131,15 @@ function pythonCommands() {
 var INSTALL_HINT = "ffmpeg is not installed in this container.\nThe FFmpeg runtime ships separately because it is a ~31MB WebAssembly build:\n  npm install @ffmpeg/core";
 var compiled = null;
 async function loadFactory() {
-  const { createRequire } = await nodeBuiltin("module");
+  const { createRequire: createRequire2 } = await nodeBuiltin("module");
   const fs = await nodeBuiltin("fs/promises");
   const path = await nodeBuiltin("path");
-  const packageRequire = createRequire(import.meta.url);
+  const packageRequire = createRequire2(import.meta.url);
   let require2 = packageRequire;
   try {
     require2.resolve("@ffmpeg/core/wasm");
   } catch {
-    require2 = createRequire(path.join(process.cwd(), "index.js"));
+    require2 = createRequire2(path.join(process.cwd(), "index.js"));
   }
   const wasmPath = require2.resolve("@ffmpeg/core/wasm");
   const wasm = await fs.readFile(wasmPath);
@@ -19125,6 +19228,1001 @@ var ffprobe = defineCommand({
 function ffmpegCommands() {
   return [ffmpeg, ffprobe];
 }
+
+// src/wasi/host.ts
+init_path();
+init_errno();
+init_mode();
+var WasiExit = class extends Error {
+  constructor(code) {
+    super(`wasi exit ${code}`);
+    this.code = code;
+    this.name = "WasiExit";
+  }
+  code;
+};
+var encoder6 = new TextEncoder();
+var decoder7 = new TextDecoder();
+var FIRST_PREOPEN = 3;
+var WasiHost = class {
+  memory;
+  fds = /* @__PURE__ */ new Map();
+  nextFd = FIRST_PREOPEN;
+  opts;
+  startTime;
+  /** Set once `proc_exit` has run, so the runner reports the guest's code. */
+  exitCode = null;
+  constructor(options) {
+    this.opts = {
+      now: Date.now,
+      hrtime: defaultHrtime,
+      random: defaultRandom,
+      sleep: defaultSleep,
+      aborted: () => false,
+      ...options
+    };
+    this.startTime = this.opts.hrtime();
+    this.fds.set(0, { kind: "stdin" });
+    this.fds.set(1, { kind: "stdout", stream: options.stdout });
+    this.fds.set(2, { kind: "stderr", stream: options.stderr });
+    const preopens = options.preopens ?? { "/": "/" };
+    for (const [name, path] of Object.entries(preopens)) {
+      const abs = resolve("/", path);
+      this.fds.set(this.nextFd++, {
+        kind: "dir",
+        path: abs,
+        root: abs,
+        preopen: name,
+        rights: RIGHTS_ALL
+      });
+    }
+  }
+  /** Attach the instance's memory. Called before `_start`. */
+  bind(instance) {
+    const exported = instance.exports.memory;
+    if (!(exported instanceof WebAssembly.Memory)) {
+      throw new Error("wasi: the module does not export a linear memory");
+    }
+    this.memory = exported;
+  }
+  /** Flush every buffered write. Called by the runner when the guest ends. */
+  flushAll() {
+    for (const fd of this.fds.values()) if (fd.kind === "file") this.writeBack(fd);
+  }
+  /**
+   * `wasi_snapshot_preview1`.
+   *
+   * Every entry returns an errno rather than throwing: a JavaScript exception
+   * crossing back into WebAssembly traps the instance, which turns a missing
+   * file into an unrecoverable crash instead of the `ENOENT` the guest is
+   * written to handle. `guard` is what enforces that.
+   */
+  get wasiImport() {
+    const g = (fn) => ((...args) => this.guard(() => fn.apply(this, args)));
+    return {
+      args_get: g(this.args_get),
+      args_sizes_get: g(this.args_sizes_get),
+      environ_get: g(this.environ_get),
+      environ_sizes_get: g(this.environ_sizes_get),
+      clock_res_get: g(this.clock_res_get),
+      clock_time_get: g(this.clock_time_get),
+      fd_advise: g(() => WASI_ESUCCESS),
+      fd_allocate: g(this.fd_allocate),
+      fd_close: g(this.fd_close),
+      fd_datasync: g(this.fd_sync),
+      fd_fdstat_get: g(this.fd_fdstat_get),
+      fd_fdstat_set_flags: g(this.fd_fdstat_set_flags),
+      fd_fdstat_set_rights: g(() => WASI_ESUCCESS),
+      fd_filestat_get: g(this.fd_filestat_get),
+      fd_filestat_set_size: g(this.fd_filestat_set_size),
+      fd_filestat_set_times: g(this.fd_filestat_set_times),
+      fd_pread: g(this.fd_pread),
+      fd_prestat_get: g(this.fd_prestat_get),
+      fd_prestat_dir_name: g(this.fd_prestat_dir_name),
+      fd_pwrite: g(this.fd_pwrite),
+      fd_read: g(this.fd_read),
+      fd_readdir: g(this.fd_readdir),
+      fd_renumber: g(this.fd_renumber),
+      fd_seek: g(this.fd_seek),
+      fd_sync: g(this.fd_sync),
+      fd_tell: g(this.fd_tell),
+      fd_write: g(this.fd_write),
+      path_create_directory: g(this.path_create_directory),
+      path_filestat_get: g(this.path_filestat_get),
+      path_filestat_set_times: g(this.path_filestat_set_times),
+      path_link: g(this.path_link),
+      path_open: g(this.path_open),
+      path_readlink: g(this.path_readlink),
+      path_remove_directory: g(this.path_remove_directory),
+      path_rename: g(this.path_rename),
+      path_symlink: g(this.path_symlink),
+      path_unlink_file: g(this.path_unlink_file),
+      poll_oneoff: g(this.poll_oneoff),
+      proc_exit: ((code) => {
+        this.exitCode = code;
+        throw new WasiExit(code);
+      }),
+      proc_raise: g(() => WASI_ENOSYS),
+      random_get: g(this.random_get),
+      sched_yield: g(() => WASI_ESUCCESS),
+      /* Sockets are the one part of WASI this container cannot honour: its
+       * network is an HTTP router, not a packet path. Saying so with ENOTSUP
+       * lets a guest fall back, where a trap would just kill it. */
+      sock_accept: g(() => WASI_ENOTSUP),
+      sock_recv: g(() => WASI_ENOTSUP),
+      sock_send: g(() => WASI_ENOTSUP),
+      sock_shutdown: g(() => WASI_ENOTSUP)
+    };
+  }
+  /**
+   * `wasi_unstable`, the preview0 name older toolchains still emit.
+   *
+   * Identical but for `fd_seek`, whose `whence` values were reordered before
+   * preview1 was frozen. Aliasing the table without this correction is a
+   * popular bug: every seek in an old binary lands somewhere plausible and
+   * wrong.
+   */
+  get wasiUnstableImport() {
+    const preview0Whence = [WHENCE_CUR, WHENCE_END, WHENCE_SET];
+    return {
+      ...this.wasiImport,
+      fd_seek: ((fd, offset, whence, out) => this.guard(
+        () => this.fd_seek(fd, offset, preview0Whence[whence] ?? WHENCE_SET, out)
+      ))
+    };
+  }
+  // ── memory access ────────────────────────────────────────────────────────
+  //
+  // Views are built per call rather than cached: `memory.grow` detaches every
+  // existing view, so a cached one turns into a silent zero-length buffer the
+  // first time the guest's allocator asks for another page.
+  get view() {
+    if (!this.memory) throw new Error("wasi: memory is not bound");
+    return new DataView(this.memory.buffer);
+  }
+  get bytes() {
+    if (!this.memory) throw new Error("wasi: memory is not bound");
+    return new Uint8Array(this.memory.buffer);
+  }
+  readString(ptr, len) {
+    return decoder7.decode(this.bytes.subarray(ptr, ptr + len));
+  }
+  /** The scatter/gather list `fd_read` and `fd_write` are given. */
+  iovecs(ptr, count) {
+    const view = this.view;
+    const out = [];
+    for (let i = 0; i < count; i++) {
+      const base2 = ptr + i * 8;
+      out.push({ offset: view.getUint32(base2, true), length: view.getUint32(base2 + 4, true) });
+    }
+    return out;
+  }
+  /**
+   * Turn anything thrown inside a syscall into an errno.
+   *
+   * `WasiExit` is re-thrown on purpose: it is the guest unwinding its own
+   * stack, not a failure to be reported through a return value.
+   */
+  guard(fn) {
+    try {
+      return fn();
+    } catch (error) {
+      if (error instanceof WasiExit) throw error;
+      return errnoOf(error);
+    }
+  }
+  // ── descriptors ──────────────────────────────────────────────────────────
+  get(fd) {
+    const found = this.fds.get(fd);
+    if (!found) throw new WasiError(WASI_EBADF);
+    return found;
+  }
+  dir(fd) {
+    const found = this.get(fd);
+    if (found.kind !== "dir") throw new WasiError(WASI_ENOTDIR);
+    return found;
+  }
+  file(fd) {
+    const found = this.get(fd);
+    if (found.kind !== "file") throw new WasiError(WASI_EBADF);
+    return found;
+  }
+  /**
+   * Resolve a guest path against a directory descriptor.
+   *
+   * The confinement check is the one place preopens are enforced: a path that
+   * climbs out of the directory the descriptor was derived from is
+   * `ENOTCAPABLE`, which is exactly the error a capability-oriented guest
+   * expects and knows how to report.
+   */
+  resolveAt(dirfd, path) {
+    const dir3 = this.dir(dirfd);
+    if (path === "") throw new WasiError(WASI_ENOENT);
+    const abs = isAbsolute(path) ? resolve("/", path) : resolve(dir3.path, path);
+    const root = dir3.root;
+    if (root !== "/" && abs !== root && !abs.startsWith(root.endsWith("/") ? root : `${root}/`)) {
+      throw new WasiError(WASI_ENOTCAPABLE);
+    }
+    return { abs, root };
+  }
+  allocate(descriptor) {
+    const fd = this.nextFd++;
+    this.fds.set(fd, descriptor);
+    return fd;
+  }
+  /**
+   * Push a buffered file back to the VFS.
+   *
+   * Called before every path-based call as well as on close, so a guest that
+   * writes a file and then stats or reopens it by name sees what it wrote —
+   * the alternative is a stale read that looks like data loss.
+   */
+  writeBack(fd) {
+    if (!fd.dirty) return;
+    this.opts.vfs.writeFile(fd.path, fd.data.subarray(0, fd.size), { cred: this.opts.cred });
+    fd.dirty = false;
+  }
+  syncPaths() {
+    for (const fd of this.fds.values()) if (fd.kind === "file" && fd.dirty) this.writeBack(fd);
+  }
+  // ── args and environment ─────────────────────────────────────────────────
+  args_get(argvPtr, bufPtr) {
+    return this.writeStringVector(this.opts.argv, argvPtr, bufPtr);
+  }
+  args_sizes_get(countPtr, sizePtr) {
+    return this.writeVectorSizes(this.opts.argv, countPtr, sizePtr);
+  }
+  get envStrings() {
+    return Object.entries(this.opts.env).map(([key, value]) => `${key}=${value}`);
+  }
+  environ_get(envPtr, bufPtr) {
+    return this.writeStringVector(this.envStrings, envPtr, bufPtr);
+  }
+  environ_sizes_get(countPtr, sizePtr) {
+    return this.writeVectorSizes(this.envStrings, countPtr, sizePtr);
+  }
+  writeStringVector(values, pointersPtr, bufPtr) {
+    const view = this.view;
+    const memory = this.bytes;
+    let cursor = bufPtr;
+    values.forEach((value, index) => {
+      view.setUint32(pointersPtr + index * 4, cursor, true);
+      const encoded = encoder6.encode(`${value}\0`);
+      memory.set(encoded, cursor);
+      cursor += encoded.length;
+    });
+    return WASI_ESUCCESS;
+  }
+  writeVectorSizes(values, countPtr, sizePtr) {
+    const view = this.view;
+    view.setUint32(countPtr, values.length, true);
+    view.setUint32(
+      sizePtr,
+      values.reduce((total, value) => total + encoder6.encode(value).length + 1, 0),
+      true
+    );
+    return WASI_ESUCCESS;
+  }
+  // ── clocks and randomness ────────────────────────────────────────────────
+  clock_res_get(_id, out) {
+    this.view.setBigUint64(out, 1000000n, true);
+    return WASI_ESUCCESS;
+  }
+  clock_time_get(id, _precision, out) {
+    this.view.setBigUint64(out, this.clockNow(id), true);
+    return WASI_ESUCCESS;
+  }
+  clockNow(id) {
+    if (id === 0) return BigInt(Math.round(this.opts.now())) * 1000000n;
+    return this.opts.hrtime() - this.startTime;
+  }
+  random_get(ptr, len) {
+    const into = new Uint8Array(len);
+    this.opts.random(into);
+    this.bytes.set(into, ptr);
+    return WASI_ESUCCESS;
+  }
+  // ── reading and writing ──────────────────────────────────────────────────
+  fd_read(fd, iovsPtr, iovsLen, out) {
+    const descriptor = this.get(fd);
+    const iovs = this.iovecs(iovsPtr, iovsLen);
+    let total = 0;
+    if (descriptor.kind === "stdin") {
+      for (const iov of iovs) {
+        if (iov.length === 0) continue;
+        const chunk = this.opts.stdin.read(iov.length);
+        if (chunk.length === 0) break;
+        this.bytes.set(chunk, iov.offset);
+        total += chunk.length;
+        if (chunk.length < iov.length) break;
+      }
+      this.view.setUint32(out, total, true);
+      return WASI_ESUCCESS;
+    }
+    if (descriptor.kind !== "file") throw new WasiError(WASI_EBADF);
+    if ((descriptor.rights & RIGHT_FD_READ) === 0n) throw new WasiError(WASI_EACCES);
+    for (const iov of iovs) {
+      const end = Math.min(descriptor.pos + iov.length, descriptor.size);
+      const chunk = descriptor.data.subarray(descriptor.pos, Math.max(end, descriptor.pos));
+      if (chunk.length === 0) break;
+      this.bytes.set(chunk, iov.offset);
+      descriptor.pos += chunk.length;
+      total += chunk.length;
+      if (chunk.length < iov.length) break;
+    }
+    this.view.setUint32(out, total, true);
+    return WASI_ESUCCESS;
+  }
+  fd_pread(fd, iovsPtr, iovsLen, offset, out) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind !== "file") throw new WasiError(WASI_ESPIPE);
+    const saved = descriptor.pos;
+    descriptor.pos = Number(offset);
+    try {
+      return this.fd_read(fd, iovsPtr, iovsLen, out);
+    } finally {
+      descriptor.pos = saved;
+    }
+  }
+  fd_write(fd, iovsPtr, iovsLen, out) {
+    const descriptor = this.get(fd);
+    const iovs = this.iovecs(iovsPtr, iovsLen);
+    let total = 0;
+    if (descriptor.kind === "stdout" || descriptor.kind === "stderr") {
+      for (const iov of iovs) {
+        const chunk = this.bytes.slice(iov.offset, iov.offset + iov.length);
+        try {
+          descriptor.stream.write(chunk);
+        } catch (error) {
+          if (isSysError(error) && error.code === "EPIPE") throw new WasiError(WASI_EPIPE);
+          throw error;
+        }
+        total += chunk.length;
+      }
+      this.view.setUint32(out, total, true);
+      return WASI_ESUCCESS;
+    }
+    if (descriptor.kind !== "file") throw new WasiError(WASI_EBADF);
+    if ((descriptor.rights & RIGHT_FD_WRITE) === 0n) throw new WasiError(WASI_EACCES);
+    if (descriptor.append) descriptor.pos = descriptor.size;
+    for (const iov of iovs) {
+      const chunk = this.bytes.subarray(iov.offset, iov.offset + iov.length);
+      reserve(descriptor, descriptor.pos + chunk.length);
+      descriptor.data.set(chunk, descriptor.pos);
+      descriptor.pos += chunk.length;
+      descriptor.size = Math.max(descriptor.size, descriptor.pos);
+      total += chunk.length;
+    }
+    descriptor.dirty = true;
+    this.view.setUint32(out, total, true);
+    return WASI_ESUCCESS;
+  }
+  fd_pwrite(fd, iovsPtr, iovsLen, offset, out) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind !== "file") throw new WasiError(WASI_ESPIPE);
+    const saved = descriptor.pos;
+    const appended = descriptor.append;
+    descriptor.pos = Number(offset);
+    descriptor.append = false;
+    try {
+      return this.fd_write(fd, iovsPtr, iovsLen, out);
+    } finally {
+      descriptor.pos = saved;
+      descriptor.append = appended;
+    }
+  }
+  fd_seek(fd, offset, whence, out) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind !== "file") throw new WasiError(WASI_ESPIPE);
+    if ((descriptor.rights & RIGHT_FD_SEEK) === 0n) throw new WasiError(WASI_EACCES);
+    const base2 = whence === WHENCE_SET ? 0 : whence === WHENCE_CUR ? descriptor.pos : descriptor.size;
+    const next = base2 + Number(offset);
+    if (next < 0) throw new WasiError(WASI_EINVAL);
+    descriptor.pos = next;
+    this.view.setBigUint64(out, BigInt(next), true);
+    return WASI_ESUCCESS;
+  }
+  fd_tell(fd, out) {
+    this.view.setBigUint64(out, BigInt(this.file(fd).pos), true);
+    return WASI_ESUCCESS;
+  }
+  fd_close(fd) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind === "file") this.writeBack(descriptor);
+    this.fds.delete(fd);
+    return WASI_ESUCCESS;
+  }
+  fd_sync(fd) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind === "file") this.writeBack(descriptor);
+    return WASI_ESUCCESS;
+  }
+  fd_renumber(from, to) {
+    const descriptor = this.get(from);
+    const replaced = this.fds.get(to);
+    if (replaced?.kind === "file") this.writeBack(replaced);
+    this.fds.set(to, descriptor);
+    this.fds.delete(from);
+    return WASI_ESUCCESS;
+  }
+  fd_allocate(fd, offset, len) {
+    const descriptor = this.file(fd);
+    const size = Number(offset + len);
+    if (descriptor.size < size) {
+      reserve(descriptor, size);
+      descriptor.data.fill(0, descriptor.size, size);
+      descriptor.size = size;
+      descriptor.dirty = true;
+    }
+    return WASI_ESUCCESS;
+  }
+  fd_filestat_set_size(fd, size) {
+    const descriptor = this.file(fd);
+    const length = Number(size);
+    reserve(descriptor, length);
+    if (length > descriptor.size) descriptor.data.fill(0, descriptor.size, length);
+    descriptor.size = length;
+    if (descriptor.pos > length) descriptor.pos = length;
+    descriptor.dirty = true;
+    return WASI_ESUCCESS;
+  }
+  // ── metadata ─────────────────────────────────────────────────────────────
+  fd_fdstat_get(fd, out) {
+    const descriptor = this.get(fd);
+    const view = this.view;
+    const [filetype, flags, rights] = (() => {
+      switch (descriptor.kind) {
+        case "dir":
+          return [FILETYPE_DIRECTORY, 0, descriptor.rights];
+        case "file":
+          return [FILETYPE_REGULAR_FILE, descriptor.flags, descriptor.rights];
+        default:
+          return [FILETYPE_CHARACTER_DEVICE, 0, RIGHTS_ALL];
+      }
+    })();
+    zero(this.bytes, out, SIZEOF_FDSTAT);
+    view.setUint8(out, filetype);
+    view.setUint16(out + 2, flags, true);
+    view.setBigUint64(out + 8, rights, true);
+    view.setBigUint64(out + 16, rights, true);
+    return WASI_ESUCCESS;
+  }
+  fd_fdstat_set_flags(fd, flags) {
+    const descriptor = this.file(fd);
+    descriptor.flags = flags;
+    descriptor.append = (flags & FD_APPEND) !== 0;
+    return WASI_ESUCCESS;
+  }
+  fd_filestat_get(fd, out) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind === "file" || descriptor.kind === "dir") {
+      this.syncPaths();
+      this.writeFilestat(out, this.opts.vfs.stat(descriptor.path, { cred: this.opts.cred }));
+      return WASI_ESUCCESS;
+    }
+    zero(this.bytes, out, SIZEOF_FILESTAT);
+    this.view.setUint8(out + 16, FILETYPE_CHARACTER_DEVICE);
+    return WASI_ESUCCESS;
+  }
+  fd_filestat_set_times(fd, atim, mtim, flags) {
+    const descriptor = this.get(fd);
+    if (descriptor.kind !== "file" && descriptor.kind !== "dir") return WASI_ESUCCESS;
+    return this.setTimes(descriptor.path, atim, mtim, flags);
+  }
+  path_filestat_get(dirfd, lookupFlags, pathPtr, pathLen, out) {
+    this.syncPaths();
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    const follow = (lookupFlags & LOOKUP_SYMLINK_FOLLOW) !== 0;
+    this.writeFilestat(
+      out,
+      follow ? this.opts.vfs.stat(abs, { cred: this.opts.cred }) : this.opts.vfs.lstat(abs)
+    );
+    return WASI_ESUCCESS;
+  }
+  path_filestat_set_times(dirfd, _lookupFlags, pathPtr, pathLen, atim, mtim, flags) {
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    return this.setTimes(abs, atim, mtim, flags);
+  }
+  setTimes(path, atim, mtim, flags) {
+    const current = this.opts.vfs.stat(path, { cred: this.opts.cred });
+    const now = this.opts.now();
+    const atime = flags & FST_ATIM_NOW ? now : flags & FST_ATIM ? Number(atim / 1000000n) : current.atimeMs;
+    const mtime = flags & FST_MTIM_NOW ? now : flags & FST_MTIM ? Number(mtim / 1000000n) : current.mtimeMs;
+    this.opts.vfs.utimes(path, atime, mtime, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  writeFilestat(out, stat2) {
+    const view = this.view;
+    zero(this.bytes, out, SIZEOF_FILESTAT);
+    view.setBigUint64(out, BigInt(stat2.dev), true);
+    view.setBigUint64(out + 8, BigInt(stat2.ino), true);
+    view.setUint8(out + 16, filetypeOf(stat2.mode));
+    view.setBigUint64(out + 24, BigInt(stat2.nlink), true);
+    view.setBigUint64(out + 32, BigInt(stat2.size), true);
+    view.setBigUint64(out + 40, msToNs(stat2.atimeMs), true);
+    view.setBigUint64(out + 48, msToNs(stat2.mtimeMs), true);
+    view.setBigUint64(out + 56, msToNs(stat2.ctimeMs), true);
+  }
+  // ── preopens ─────────────────────────────────────────────────────────────
+  fd_prestat_get(fd, out) {
+    const descriptor = this.fds.get(fd);
+    if (!descriptor || descriptor.kind !== "dir" || descriptor.preopen === void 0) {
+      throw new WasiError(WASI_EBADF);
+    }
+    const view = this.view;
+    view.setUint8(
+      out,
+      0
+      /* preopentype: dir */
+    );
+    view.setUint32(out + 4, encoder6.encode(descriptor.preopen).length, true);
+    return WASI_ESUCCESS;
+  }
+  fd_prestat_dir_name(fd, ptr, len) {
+    const descriptor = this.fds.get(fd);
+    if (!descriptor || descriptor.kind !== "dir" || descriptor.preopen === void 0) {
+      throw new WasiError(WASI_EBADF);
+    }
+    const name = encoder6.encode(descriptor.preopen);
+    if (name.length > len) throw new WasiError(WASI_EINVAL);
+    this.bytes.set(name, ptr);
+    return WASI_ESUCCESS;
+  }
+  // ── paths ────────────────────────────────────────────────────────────────
+  path_open(dirfd, _lookupFlags, pathPtr, pathLen, oflags, rightsBase, _rightsInheriting, fdflags, out) {
+    this.syncPaths();
+    const { abs, root } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    const vfs = this.opts.vfs;
+    const cred = this.opts.cred;
+    const exists = vfs.lexists(abs);
+    if (oflags & O_EXCL && oflags & O_CREAT && exists) throw new WasiError(WASI_EEXIST);
+    if (exists && vfs.stat(abs, { cred }).isDirectory()) {
+      if (rightsBase & RIGHT_FD_WRITE) throw new WasiError(WASI_EISDIR);
+      this.view.setUint32(out, this.allocate({ kind: "dir", path: abs, root, rights: RIGHTS_ALL }), true);
+      return WASI_ESUCCESS;
+    }
+    if (oflags & O_DIRECTORY) throw new WasiError(exists ? WASI_ENOTDIR : WASI_ENOENT);
+    if (!exists) {
+      if (!(oflags & O_CREAT)) throw new WasiError(WASI_ENOENT);
+      vfs.writeFile(abs, new Uint8Array(0), { cred, mode: 420 });
+    }
+    const truncate = (oflags & O_TRUNC) !== 0;
+    const data = truncate ? new Uint8Array(0) : vfs.readFile(abs, cred);
+    if (truncate) vfs.writeFile(abs, data, { cred });
+    const size = data.length;
+    const rights = rightsBase === 0n ? RIGHTS_ALL : rightsBase;
+    const append = (fdflags & FD_APPEND) !== 0;
+    this.view.setUint32(
+      out,
+      this.allocate({
+        kind: "file",
+        path: abs,
+        root,
+        data,
+        size,
+        pos: append ? size : 0,
+        dirty: false,
+        append,
+        rights,
+        flags: fdflags
+      }),
+      true
+    );
+    return WASI_ESUCCESS;
+  }
+  fd_readdir(fd, buf, bufLen, cookie, out) {
+    this.syncPaths();
+    const descriptor = this.dir(fd);
+    const vfs = this.opts.vfs;
+    const cred = this.opts.cred;
+    const entries = [
+      { name: ".", type: FILETYPE_DIRECTORY },
+      { name: "..", type: FILETYPE_DIRECTORY },
+      ...vfs.readdirWithTypes(descriptor.path, cred).map((entry) => ({
+        name: entry.name,
+        type: entry.kind === "directory" ? FILETYPE_DIRECTORY : entry.kind === "symlink" ? FILETYPE_SYMBOLIC_LINK : entry.kind === "file" ? FILETYPE_REGULAR_FILE : FILETYPE_UNKNOWN
+      }))
+    ];
+    const view = this.view;
+    const memory = this.bytes;
+    let written = 0;
+    for (let index = Number(cookie); index < entries.length; index++) {
+      const entry = entries[index];
+      const name = encoder6.encode(entry.name);
+      if (written + SIZEOF_DIRENT > bufLen) break;
+      const at = buf + written;
+      view.setBigUint64(at, BigInt(index + 1), true);
+      view.setBigUint64(at + 8, BigInt(inodeOf(descriptor.path, entry.name)), true);
+      view.setUint32(at + 16, name.length, true);
+      view.setUint8(at + 20, entry.type);
+      written += SIZEOF_DIRENT;
+      const room = Math.min(name.length, bufLen - written);
+      memory.set(name.subarray(0, room), buf + written);
+      written += room;
+      if (room < name.length) break;
+    }
+    view.setUint32(out, written, true);
+    return WASI_ESUCCESS;
+  }
+  path_create_directory(dirfd, pathPtr, pathLen) {
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    this.opts.vfs.mkdir(abs, { cred: this.opts.cred, mode: 493 });
+    return WASI_ESUCCESS;
+  }
+  path_remove_directory(dirfd, pathPtr, pathLen) {
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    this.opts.vfs.rmdir(abs, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  path_unlink_file(dirfd, pathPtr, pathLen) {
+    this.syncPaths();
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    this.opts.vfs.unlink(abs, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  path_rename(oldDirfd, oldPtr, oldLen, newDirfd, newPtr, newLen) {
+    this.syncPaths();
+    const from = this.resolveAt(oldDirfd, this.readString(oldPtr, oldLen));
+    const to = this.resolveAt(newDirfd, this.readString(newPtr, newLen));
+    this.opts.vfs.rename(from.abs, to.abs, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  path_symlink(targetPtr, targetLen, dirfd, pathPtr, pathLen) {
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    this.opts.vfs.symlink(this.readString(targetPtr, targetLen), abs, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  path_link(oldDirfd, _lookupFlags, oldPtr, oldLen, newDirfd, newPtr, newLen) {
+    this.syncPaths();
+    const from = this.resolveAt(oldDirfd, this.readString(oldPtr, oldLen));
+    const to = this.resolveAt(newDirfd, this.readString(newPtr, newLen));
+    this.opts.vfs.link(from.abs, to.abs, this.opts.cred);
+    return WASI_ESUCCESS;
+  }
+  path_readlink(dirfd, pathPtr, pathLen, buf, bufLen, out) {
+    const { abs } = this.resolveAt(dirfd, this.readString(pathPtr, pathLen));
+    const target = encoder6.encode(this.opts.vfs.readlink(abs, this.opts.cred));
+    const room = Math.min(target.length, bufLen);
+    this.bytes.set(target.subarray(0, room), buf);
+    this.view.setUint32(out, room, true);
+    return WASI_ESUCCESS;
+  }
+  // ── polling ──────────────────────────────────────────────────────────────
+  /**
+   * `poll_oneoff`, which is how a WASI guest sleeps and how it waits on I/O.
+   *
+   * Files and the standard streams are always ready here — nothing in this
+   * container can leave a read pending, since stdin was drained before the
+   * guest started. That leaves the clock, which is the case that matters:
+   * `sleep()` compiles to a lone clock subscription, and it is honoured by
+   * actually waiting, in slices, so that killing the process interrupts it.
+   */
+  poll_oneoff(inPtr, outPtr, count, nevents) {
+    if (count === 0) {
+      this.view.setUint32(nevents, 0, true);
+      return WASI_ESUCCESS;
+    }
+    const subscriptions = [];
+    for (let index = 0; index < count; index++) {
+      const at = inPtr + index * SIZEOF_SUBSCRIPTION;
+      const view2 = this.view;
+      subscriptions.push({
+        userdata: view2.getBigUint64(at, true),
+        type: view2.getUint8(at + 8),
+        fd: view2.getUint32(at + 16, true),
+        clockId: view2.getUint32(at + 16, true),
+        timeout: view2.getBigUint64(at + 24, true),
+        flags: view2.getUint16(at + 40, true)
+      });
+    }
+    const ready = subscriptions.filter((s) => s.type !== EVENTTYPE_CLOCK);
+    if (ready.length === 0) {
+      const delays = subscriptions.map((s) => {
+        const nanoseconds = (s.flags & SUBSCRIPTION_CLOCK_ABSTIME) !== 0 ? s.timeout - this.clockNow(s.clockId) : s.timeout;
+        return Number(nanoseconds < 0n ? 0n : nanoseconds) / 1e6;
+      });
+      this.sleepInterruptibly(Math.min(...delays));
+    }
+    const events = ready.length > 0 ? ready : subscriptions;
+    const view = this.view;
+    events.forEach((subscription, index) => {
+      const at = outPtr + index * SIZEOF_EVENT;
+      zero(this.bytes, at, SIZEOF_EVENT);
+      view.setBigUint64(at, subscription.userdata, true);
+      view.setUint16(at + 8, WASI_ESUCCESS, true);
+      view.setUint8(at + 10, subscription.type);
+      if (subscription.type === EVENTTYPE_FD_READ) {
+        const available = subscription.fd === 0 ? this.opts.stdin.available : this.bytesLeft(subscription.fd);
+        view.setBigUint64(at + 16, BigInt(available), true);
+      } else if (subscription.type === EVENTTYPE_FD_WRITE) {
+        view.setBigUint64(at + 16, BigInt(64 * 1024), true);
+      }
+    });
+    view.setUint32(nevents, events.length, true);
+    return WASI_ESUCCESS;
+  }
+  bytesLeft(fd) {
+    const descriptor = this.fds.get(fd);
+    return descriptor?.kind === "file" ? Math.max(0, descriptor.size - descriptor.pos) : 0;
+  }
+  /** Wait in slices so that a `SIGKILL` does not have to outlast the sleep. */
+  sleepInterruptibly(milliseconds) {
+    let remaining = milliseconds;
+    while (remaining > 0) {
+      if (this.opts.aborted()) return;
+      const slice = Math.min(remaining, 50);
+      this.opts.sleep(slice);
+      remaining -= slice;
+    }
+  }
+};
+var WasiError = class extends Error {
+  constructor(errno) {
+    super(`wasi errno ${errno}`);
+    this.errno = errno;
+    this.name = "WasiError";
+  }
+  errno;
+};
+function errnoOf(error) {
+  if (error instanceof WasiError) return error.errno;
+  if (isSysError(error)) return WASI_ERRNO_BY_CODE[error.code] ?? WASI_EIO;
+  if (error instanceof RangeError) return WASI_EFAULT;
+  return WASI_EIO;
+}
+function filetypeOf(mode) {
+  const kind = mode & 61440;
+  if (kind === S_IFDIR) return FILETYPE_DIRECTORY;
+  if (kind === S_IFREG) return FILETYPE_REGULAR_FILE;
+  if (kind === S_IFLNK) return FILETYPE_SYMBOLIC_LINK;
+  if (kind === S_IFCHR) return FILETYPE_CHARACTER_DEVICE;
+  return FILETYPE_UNKNOWN;
+}
+function msToNs(milliseconds) {
+  return BigInt(Math.round(milliseconds)) * 1000000n;
+}
+function zero(memory, at, length) {
+  memory.fill(0, at, at + length);
+}
+function reserve(descriptor, length) {
+  if (length <= descriptor.data.length) return;
+  const grown = new Uint8Array(Math.max(length, descriptor.data.length * 2, 1024));
+  grown.set(descriptor.data.subarray(0, descriptor.size));
+  descriptor.data = grown;
+}
+function inodeOf(dir3, name) {
+  let hash = 2166136261;
+  const path = `${dir3}/${name}`;
+  for (let index = 0; index < path.length; index++) {
+    hash ^= path.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
+function defaultHrtime() {
+  return BigInt(Math.round(performance.now() * 1e6));
+}
+function defaultRandom(into) {
+  crypto.getRandomValues(into);
+}
+function defaultSleep(milliseconds) {
+  try {
+    const buffer = new Int32Array(new SharedArrayBuffer(4));
+    Atomics.wait(buffer, 0, 0, milliseconds);
+  } catch {
+  }
+}
+
+// src/wasi/run.ts
+var compiled2 = /* @__PURE__ */ new Map();
+var MAX_CACHED_MODULES = 32;
+async function runWasi(ctx, bytes2, options = {}) {
+  if (!isWasmBinary(bytes2)) {
+    ctx.warn("cannot execute binary file: not a WebAssembly module");
+    return EXIT_NOT_EXECUTABLE;
+  }
+  const argv = options.argv ?? ctx.argv;
+  const host2 = new WasiHost({
+    argv,
+    /* `PWD` is set truthfully, but do not mistake it for a working directory:
+     * wasi-libc keeps its own cwd, fixed at `/`, and ignores this. A guest's
+     * relative path therefore resolves from the root — the same thing it does
+     * under wasmtime, and why programs run here are given absolute paths. */
+    env: { ...ctx.env, PWD: ctx.cwd },
+    vfs: ctx.vfs,
+    cred: ctx.cred,
+    cwd: ctx.cwd,
+    stdin: await primeStdin(ctx),
+    stdout: ctx.stdout,
+    stderr: ctx.stderr,
+    ...options.preopens ? { preopens: options.preopens } : {},
+    now: ctx.kernel.now,
+    aborted: () => ctx.signal.aborted
+  });
+  let instance;
+  try {
+    const module = await compile(bytes2);
+    instance = await WebAssembly.instantiate(module, {
+      ...options.imports,
+      wasi_snapshot_preview1: host2.wasiImport,
+      wasi_unstable: host2.wasiUnstableImport
+    });
+  } catch (error) {
+    ctx.warn(describeStartupFailure(error));
+    return EXIT_NOT_EXECUTABLE;
+  }
+  try {
+    host2.bind(instance);
+  } catch (error) {
+    ctx.warn(error instanceof Error ? error.message : String(error));
+    return EXIT_NOT_EXECUTABLE;
+  }
+  const start2 = instance.exports._start ?? instance.exports._initialize;
+  if (typeof start2 !== "function") {
+    ctx.warn("not a WASI command: the module exports neither _start nor _initialize");
+    return EXIT_NOT_EXECUTABLE;
+  }
+  try {
+    start2();
+    return host2.exitCode ?? 0;
+  } catch (error) {
+    if (error instanceof WasiExit) return error.code;
+    ctx.warn(error instanceof Error ? error.message : String(error));
+    return 134;
+  } finally {
+    try {
+      host2.flushAll();
+    } catch (error) {
+      ctx.warn(`failed to flush open files: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+async function compile(bytes2) {
+  const key = await digest(bytes2);
+  const hit = compiled2.get(key);
+  if (hit) {
+    compiled2.delete(key);
+    compiled2.set(key, hit);
+    return hit;
+  }
+  const module = await WebAssembly.compile(sliceForWasm(bytes2));
+  compiled2.set(key, module);
+  if (compiled2.size > MAX_CACHED_MODULES) {
+    const oldest = compiled2.keys().next().value;
+    if (oldest !== void 0) compiled2.delete(oldest);
+  }
+  return module;
+}
+async function digest(bytes2) {
+  const hash = await crypto.subtle.digest("SHA-256", sliceForWasm(bytes2));
+  return Array.from(new Uint8Array(hash, 0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function sliceForWasm(bytes2) {
+  return bytes2.buffer.slice(bytes2.byteOffset, bytes2.byteOffset + bytes2.byteLength);
+}
+async function primeStdin(ctx) {
+  let pending = new Uint8Array(0);
+  if (!ctx.stdin.isTTY) {
+    try {
+      pending = await ctx.stdin.readAll();
+    } catch {
+      pending = new Uint8Array(0);
+    }
+  }
+  return {
+    read(size) {
+      const chunk = pending.slice(0, Math.min(size, pending.length));
+      pending = pending.subarray(chunk.length);
+      return chunk;
+    },
+    get available() {
+      return pending.length;
+    },
+    isTTY: ctx.stdin.isTTY
+  };
+}
+function describeStartupFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (error instanceof WebAssembly.LinkError) {
+    return `${message} \u2014 the module needs imports this container does not provide. Build it for wasm32-wasi (a plain wasm32-unknown-unknown or emscripten build will not run here).`;
+  }
+  return message;
+}
+
+// src/wasi/command.ts
+var wasi = defineCommand({
+  name: "wasi",
+  path: "/usr/bin/wasi",
+  summary: "run a WebAssembly (wasm32-wasi) binary",
+  usage: "wasi [--dir PATH] [--mapdir GUEST=PATH] [--env K=V] MODULE.wasm [args...]",
+  manual: `Runs a WebAssembly module built for wasm32-wasi as a container
+process: it sees the container's filesystem, environment and standard streams,
+and can be piped and redirected like any other command.
+
+By default the module is given the whole filesystem, which is what an ordinary
+program compiled by clang, Rust, Zig or TinyGo expects. Passing --dir or
+--mapdir replaces that default with exactly what is listed, confining the
+module to those directories.
+
+A WASI program has no working directory: wasi-libc fixes its own at / and
+resolves relative paths from there, exactly as it does under wasmtime. Pass
+absolute paths, or preopen a directory with --mapdir to give the program a
+name for it.
+
+Executable .wasm files are dispatched here automatically, so ./tool.wasm runs
+without naming this command.
+
+Sockets are not available: this container's network is an HTTP router rather
+than a packet path, and socket calls report ENOTSUP.`,
+  async run(ctx) {
+    const preopens = {};
+    const env2 = {};
+    let module;
+    let rest = [];
+    const args = ctx.args;
+    for (let index = 0; index < args.length; index++) {
+      const arg = args[index];
+      if (arg === "--help" || arg === "-h") {
+        ctx.line(wasi.usage);
+        return 0;
+      }
+      if (arg === "--") {
+        module = args[index + 1];
+        rest = args.slice(index + 2);
+        break;
+      }
+      if (arg === "--dir") {
+        const dir3 = args[++index];
+        if (dir3 === void 0) return ctx.reportError(new UsageError("--dir needs a path"));
+        preopens[ctx.path(dir3)] = ctx.path(dir3);
+        continue;
+      }
+      if (arg === "--mapdir") {
+        const pair = args[++index];
+        const split2 = pair?.indexOf("=") ?? -1;
+        if (pair === void 0 || split2 < 0) {
+          return ctx.reportError(new UsageError("--mapdir needs GUEST=PATH"));
+        }
+        preopens[pair.slice(0, split2)] = ctx.path(pair.slice(split2 + 1));
+        continue;
+      }
+      if (arg === "--env") {
+        const pair = args[++index];
+        const split2 = pair?.indexOf("=") ?? -1;
+        if (pair === void 0 || split2 < 0) {
+          return ctx.reportError(new UsageError("--env needs KEY=VALUE"));
+        }
+        env2[pair.slice(0, split2)] = pair.slice(split2 + 1);
+        continue;
+      }
+      module = arg;
+      rest = args.slice(index + 1);
+      break;
+    }
+    if (module === void 0) return ctx.reportError(new UsageError("a module is required"));
+    const abs = ctx.path(module);
+    let bytes2;
+    try {
+      bytes2 = ctx.vfs.readFile(abs, ctx.cred);
+    } catch (error) {
+      ctx.reportError(error, abs);
+      return EXIT_NOT_FOUND;
+    }
+    if (!isWasmBinary(bytes2)) {
+      return ctx.fail(`${abs}: not a WebAssembly module`, 126);
+    }
+    Object.assign(ctx.env, env2);
+    return await runWasi(ctx, bytes2, {
+      /* argv[0] is the path as the user wrote it, not the resolved one: a
+       * program printing its own usage should echo what was typed. */
+      argv: [module, ...rest],
+      ...Object.keys(preopens).length > 0 ? { preopens } : {}
+    });
+  }
+});
+function wasiCommands() {
+  return [wasi];
+}
 var platformBuffer = globalThis.Buffer;
 var Buffer2 = platformBuffer ?? addBase64UrlSupport(Buffer$1);
 function addBase64UrlSupport(BufferClass) {
@@ -19315,8 +20413,8 @@ function verifyIntegrity(data, integrity, shasum, identity) {
       const dash = choice.indexOf("-");
       const algorithm = choice.slice(0, dash);
       const expected = choice.slice(dash + 1).replace(/\?.*$/, "");
-      const digest = algorithm === "sha512" ? sha512(data) : algorithm === "sha256" ? sha256(data) : null;
-      if (digest && Buffer2.from(digest).toString("base64") === expected) return;
+      const digest2 = algorithm === "sha512" ? sha512(data) : algorithm === "sha256" ? sha256(data) : null;
+      if (digest2 && Buffer2.from(digest2).toString("base64") === expected) return;
     }
     throw new Error(`Integrity check failed for ${identity}`);
   }
@@ -20286,6 +21384,7 @@ function allCommands() {
     ...nodeCommands(),
     ...pythonCommands(),
     ...ffmpegCommands(),
+    ...wasiCommands(),
     ...packageCommands()
   ];
 }
@@ -20445,15 +21544,15 @@ var Session = class {
   async run(command, opts = {}) {
     if (this.closed) throw new Error("session is closed");
     const combined = [];
-    const decoder8 = new TextDecoder();
+    const decoder9 = new TextDecoder();
     const stdout = new BufferSink((chunk) => {
-      const text2 = decoder8.decode(chunk, { stream: true });
+      const text2 = decoder9.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStdout?.(text2);
       this.hooks.onStdout?.(text2);
     });
     const stderr = new BufferSink((chunk) => {
-      const text2 = decoder8.decode(chunk, { stream: true });
+      const text2 = decoder9.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStderr?.(text2);
       this.hooks.onStderr?.(text2);
@@ -22907,8 +24006,8 @@ function createCryptoModule() {
       queueMicrotask(() => done?.(null, target));
     },
     hash(algorithm, data, encoding = "hex") {
-      const digest = Buffer2.from(hashFor(algorithm)(toBytes2(data)));
-      return encoding === "buffer" ? digest : digest.toString(encoding);
+      const digest2 = Buffer2.from(hashFor(algorithm)(toBytes2(data)));
+      return encoding === "buffer" ? digest2 : digest2.toString(encoding);
     },
     timingSafeEqual(a, b) {
       if (a.length !== b.length) throw new RangeError("Input buffers must have the same byte length");
@@ -23910,6 +25009,7 @@ function createCoreModules(options) {
     zlib: zlib_module_default
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
+  builtins.net = createNetModule();
   const globals = {
     Buffer: Buffer2,
     console: consoleObject,
@@ -24738,15 +25838,43 @@ function createStreamPromises() {
     })
   };
 }
-function createUnsupportedModule(name) {
+function createUnsupportedModule(name, supported = {}) {
   const unsupported = () => {
     const error = new Error(`${name} is unavailable in the browser runtime`);
     error.code = "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM";
     throw error;
   };
-  return new Proxy({ unsupported }, { get(target, key) {
-    return key in target ? target[key] : unsupported;
-  } });
+  const target = { unsupported, ...supported };
+  const module = new Proxy(target, {
+    get(object, key) {
+      if (key === "default") return module;
+      return key in object ? object[key] : unsupported;
+    }
+  });
+  return module;
+}
+function createNetModule() {
+  const isIPv4 = (value) => {
+    const parts = String(value).split(".");
+    return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+  };
+  const isIPv6 = (value) => {
+    const text2 = String(value);
+    if (!text2.includes(":")) return false;
+    const [head2, tail2] = [text2.slice(0, text2.lastIndexOf(":")), text2.slice(text2.lastIndexOf(":") + 1)];
+    const normalised = isIPv4(tail2) ? `${head2}:0:0` : text2;
+    const halves = normalised.split("::");
+    if (halves.length > 2) return false;
+    const groups = halves.map((half) => half === "" ? [] : half.split(":"));
+    if (groups.some((half) => half.some((group) => !/^[0-9a-fA-F]{1,4}$/.test(group)))) return false;
+    const count = groups.reduce((total, half) => total + half.length, 0);
+    return halves.length === 2 ? count <= 7 : count === 8;
+  };
+  return createUnsupportedModule("net", {
+    isIPv4,
+    isIPv6,
+    isIP: (value) => isIPv4(value) ? 4 : isIPv6(value) ? 6 : 0
+  });
 }
 var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames2 = [
@@ -24843,7 +25971,7 @@ var MemoryStat = class {
     return this.inode.kind === "symlink";
   }
 };
-var encoder6 = new TextEncoder();
+var encoder7 = new TextEncoder();
 var MemoryVolume = class {
   entries = /* @__PURE__ */ new Map();
   nextIno = 2;
@@ -24861,7 +25989,7 @@ var MemoryVolume = class {
   writeFileSync(path, data) {
     const key = this.key(path);
     this.requireParent(key, "open");
-    const bytes2 = typeof data === "string" ? encoder6.encode(data) : data.slice();
+    const bytes2 = typeof data === "string" ? encoder7.encode(data) : data.slice();
     const current = this.entries.get(key);
     if (current?.kind === "directory") throw new VolumeError("EISDIR", "open", key);
     if (current?.kind === "symlink") throw new VolumeError("EINVAL", "open", key);
@@ -24874,7 +26002,7 @@ var MemoryVolume = class {
   }
   appendFileSync(path, data) {
     const key = this.key(path);
-    const bytes2 = typeof data === "string" ? encoder6.encode(data) : data;
+    const bytes2 = typeof data === "string" ? encoder7.encode(data) : data;
     const current = this.entries.get(key);
     if (!current) return this.writeFileSync(key, bytes2);
     if (current.kind !== "file") throw new VolumeError(current.kind === "directory" ? "EISDIR" : "EINVAL", "open", key);
@@ -25012,7 +26140,7 @@ var MemoryVolume = class {
       if (node2.kind === "directory") directoryCount++;
       else {
         fileCount++;
-        totalBytes += node2.kind === "file" ? node2.data.length : encoder6.encode(node2.target).length;
+        totalBytes += node2.kind === "file" ? node2.data.length : encoder7.encode(node2.target).length;
       }
     }
     return { totalBytes, fileCount, directoryCount, dirCount: directoryCount };
@@ -25155,6 +26283,77 @@ var MirroringVolume = class {
     };
     copy(this.root);
   }
+  /**
+   * Bring back what the mirrored engine wrote.
+   *
+   * The mirror exists because Rolldown's resolver reads through WASI rather
+   * than through anything JavaScript can hand it — but Rolldown also *writes*
+   * through WASI, so `vite build` leaves its output in the mirror and the
+   * container sees an empty `dist/`. This is the return leg, and it is why the
+   * mirror is no longer strictly one-way.
+   *
+   * Called when a process ends rather than on a timer: that is the moment a
+   * build's output is complete, and a dev server — which serves from memory
+   * and writes nothing — pays for it only once, at exit.
+   */
+  absorb() {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !mirror.readFileSync || !mirror.lstatSync) return;
+    const visit = (path) => {
+      if (basename(path) === "node_modules") return;
+      let stat2;
+      try {
+        stat2 = mirror.lstatSync(path);
+      } catch {
+        return;
+      }
+      if (stat2.isSymbolicLink()) return;
+      if (stat2.isDirectory()) {
+        let names;
+        try {
+          names = mirror.readdirSync(path);
+        } catch {
+          return;
+        }
+        for (const name of names) visit(join(path, name));
+        return;
+      }
+      let produced;
+      try {
+        produced = mirror.readFileSync(path);
+      } catch {
+        return;
+      }
+      try {
+        const current = this.inner.readFileSync(path);
+        if (sameBytes(current, produced)) return;
+      } catch {
+      }
+      try {
+        this.ensureDirectory(dirname(path));
+        this.inner.writeFileSync(path, produced);
+      } catch {
+      }
+    };
+    visit(this.root);
+  }
+  /** `mkdir -p`, which the volume does not offer directly. */
+  ensureDirectory(path) {
+    const parts = clean(path).split("/").filter(Boolean);
+    let current = "";
+    for (const part of parts) {
+      current += `/${part}`;
+      try {
+        if (this.inner.lstatSync(current).isDirectory()) continue;
+        return;
+      } catch {
+      }
+      try {
+        this.inner.mkdirSync(current);
+      } catch {
+      }
+    }
+  }
   /** Is this path inside the mirrored subtree? */
   mirrored(path) {
     if (!this.mirror) return false;
@@ -25286,6 +26485,11 @@ var MirroringVolume = class {
     this.seed();
   }
 };
+function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  for (let index = 0; index < a.length; index++) if (a[index] !== b[index]) return false;
+  return true;
+}
 
 // src/runtime/host-esbuild.ts
 var ASYNC_API = ["transform", "build", "context", "formatMessages", "analyzeMetafile"];
@@ -25354,12 +26558,142 @@ function ensureProcessGlobal() {
     configurable: true
   });
 }
+var BINDING_PACKAGE = "@rolldown/binding-wasm32-wasi";
+var ASYNC_WORK_POOL_SIZE = 4;
+var WORKER_FILE = "rolldown-wasi-worker.js";
+async function loadNodeRolldownMemfsBinding() {
+  const require2 = createRequire(import.meta.url);
+  let packageDir;
+  try {
+    packageDir = dirname$1(require2.resolve(`${BINDING_PACKAGE}/package.json`));
+  } catch {
+    return null;
+  }
+  const fromBinding = createRequire(join$1(packageDir, "package.json"));
+  let runtime;
+  let fsModuleUrl;
+  let createContext2;
+  try {
+    runtime = fromBinding("@napi-rs/wasm-runtime");
+    fsModuleUrl = resolveSubpath(fromBinding, "@napi-rs/wasm-runtime", "./fs");
+    ({ createContext: createContext2 } = fromBinding("@emnapi/runtime"));
+  } catch {
+    return null;
+  }
+  const { memfs } = await import(fsModuleUrl);
+  const { Worker: Worker2 } = await import('worker_threads');
+  const { fs: memoryFs, vol } = memfs();
+  const wasi2 = new runtime.WASI({
+    version: "preview1",
+    fs: memoryFs,
+    preopens: { "/": "/" }
+  });
+  const wasmFile = readFileSync(join$1(packageDir, "rolldown-binding.wasm32-wasi.wasm"));
+  const sharedMemory = new WebAssembly.Memory({ initial: 16384, maximum: 65536, shared: true });
+  const workerPoolSize = Math.max(2, cpuCount());
+  const context = createContext2({ autoDestroy: false });
+  context.suppressDestroy();
+  const workerPath = resolveWorkerPath();
+  if (!workerPath) return null;
+  const runtimeAnchor = pathToFileURL$1(join$1(packageDir, "package.json")).href;
+  const workers = /* @__PURE__ */ new Set();
+  let started = false;
+  const { napiModule } = await runtime.instantiateNapiModule(wasmFile, {
+    context,
+    asyncWorkPoolSize: ASYNC_WORK_POOL_SIZE,
+    reuseWorker: { size: ASYNC_WORK_POOL_SIZE + workerPoolSize },
+    plugins: [runtime.emnapiAsyncWorkPlugin, runtime.emnapiTSFNPlugin],
+    wasi: wasi2,
+    onCreateWorker() {
+      const worker = new Worker2(workerPath, {
+        env: process.env,
+        workerData: { runtimeAnchor, fsModuleUrl },
+        /*
+         * Deliberately no `execArgv`.
+         *
+         * A worker inherits the parent's flags by default, and this worker is
+         * a plain JavaScript file we ship — it needs none of them. Inheriting
+         * them is actively harmful: under a host started with a module loader
+         * (`tsx`, `ts-node`, `--import`), the worker's module resolution then
+         * needs the main thread, which is at that moment blocked waiting for
+         * this very worker to report itself ready. The result is a deadlock at
+         * startup with no error, and it took a while to find.
+         */
+        execArgv: []
+      });
+      workers.add(worker);
+      const serveFsRequest = runtime.createOnMessage(memoryFs);
+      worker.on("message", (data) => serveFsRequest({ data }));
+      worker.on("exit", () => workers.delete(worker));
+      if (started) unreferenceWorker(worker);
+      return worker;
+    },
+    overwriteImports(importObject) {
+      importObject.env = {
+        ...importObject.env,
+        ...importObject.napi,
+        ...importObject.emnapi,
+        memory: sharedMemory
+      };
+      return importObject;
+    },
+    beforeInit({ instance }) {
+      for (const name of Object.keys(instance.exports)) {
+        if (name.startsWith("__napi_register__")) instance.exports[name]();
+      }
+    }
+  });
+  started = true;
+  for (const worker of workers) unreferenceWorker(worker);
+  return { ...napiModule.exports, __fs: memoryFs, __volume: vol };
+}
+function resolveWorkerPath() {
+  const here = dirname$1(fileURLToPath$1(import.meta.url));
+  const candidates = [
+    join$1(here, WORKER_FILE),
+    /* src/runtime → dist, for a checkout that has been built. */
+    join$1(here, "..", "..", "dist", WORKER_FILE)
+  ];
+  return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
+function resolveSubpath(require2, packageName, subpath) {
+  const packageDir = dirname$1(require2.resolve(packageName));
+  const manifest = JSON.parse(readFileSync(join$1(packageDir, "package.json"), "utf8"));
+  const entry = manifest?.exports?.[subpath];
+  const target = typeof entry === "string" ? entry : entry?.import ?? entry?.default;
+  if (typeof target !== "string") {
+    throw new Error(`${packageName} does not export ${subpath}`);
+  }
+  return pathToFileURL$1(join$1(packageDir, target)).href;
+}
+function cpuCount() {
+  try {
+    return process.availableParallelism?.() ?? 4;
+  } catch {
+    return 4;
+  }
+}
+function unreferenceWorker(worker) {
+  for (const key of Object.getOwnPropertySymbols(worker)) {
+    if (key.toString().includes("kPublicPort") || key.toString().includes("kHandle")) {
+      const handle = worker[key];
+      if (handle && typeof handle === "object") handle.ref = () => {
+      };
+    }
+  }
+  worker.unref();
+}
 
 // src/runtime/host-rolldown.ts
 var BUNDLER_HINT = "If this is a bundler pre-bundling the worker away, exclude the binding from dependency optimisation \u2014 in Vite:\n\n  optimizeDeps: { exclude: ['@rolldown/binding-wasm32-wasi'] }";
+var isNodeHost = typeof process !== "undefined" && Boolean(process.versions?.node);
 async function loadHostRolldownBinding() {
   const reason = syncChannelUnavailableReason();
   if (reason) throw new Error(`SandboxedJs threaded WASM unavailable: ${reason}`);
+  if (isNodeHost) {
+    const binding = await loadNodeRolldownMemfsBinding();
+    if (binding) return binding;
+  }
   try {
     const loaded = await import('@rolldown/binding-wasm32-wasi');
     return "__fs" in loaded ? { ...loaded } : loaded.default ?? loaded;
@@ -25759,6 +27093,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
         core.cancelTimers();
         untrack();
         this.router.closeOwner(owner);
+        this.volume.absorb();
       }
     });
     this.running.add(process2);
@@ -25894,10 +27229,10 @@ function attachRolldownMirror(binding, volume, root) {
 }
 
 // src/runtime/remote-volume.ts
-var encoder7 = new TextEncoder();
-var decoder7 = new TextDecoder();
+var encoder8 = new TextEncoder();
+var decoder8 = new TextDecoder();
 function encodeFrame(header, body) {
-  const json = encoder7.encode(JSON.stringify(header));
+  const json = encoder8.encode(JSON.stringify(header));
   const frame = new Uint8Array(4 + json.length + (body?.length ?? 0));
   new DataView(frame.buffer).setUint32(0, json.length, true);
   frame.set(json, 4);
@@ -25907,7 +27242,7 @@ function encodeFrame(header, body) {
 function decodeFrame(frame) {
   const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
   const headerLength = view.getUint32(0, true);
-  const header = JSON.parse(decoder7.decode(frame.subarray(4, 4 + headerLength)));
+  const header = JSON.parse(decoder8.decode(frame.subarray(4, 4 + headerLength)));
   return { header, body: frame.subarray(4 + headerLength) };
 }
 function flattenStat(stat2) {
@@ -26710,15 +28045,15 @@ var Container = class _Container {
   }
   makeStdio(opts) {
     const combined = [];
-    const decoder8 = new TextDecoder();
+    const decoder9 = new TextDecoder();
     const stdout = new BufferSink((chunk) => {
-      const text2 = decoder8.decode(chunk, { stream: true });
+      const text2 = decoder9.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStdout?.(text2);
       this.hooks.onStdout?.(text2);
     });
     const stderr = new BufferSink((chunk) => {
-      const text2 = decoder8.decode(chunk, { stream: true });
+      const text2 = decoder9.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStderr?.(text2);
       this.hooks.onStderr?.(text2);
@@ -27422,6 +28757,6 @@ async function renderInto(box, element, options = { port: 80 }) {
 // src/index.ts
 var src_default = createContainer;
 
-export { ArithError, BufferSink, CallbackSink, CleanPackageInstaller, CommandRegistry, CommonJsEngine, Container, ContainerFs, ERRNO, FileInput, FileOutput, IncompleteInputError, KERNEL_NAME, KERNEL_RELEASE, Kernel, LocalRuntimePod, MemoryVolume, NODE_VERSION, NPM_VERSION, NetworkStack, NullInput, NullOutput, OS_RELEASE, PYTHON_VERSION, Pipe, Process, ProcessTable, ROOT_CRED, SIGNALS, SIGNAL_NAMES, Session, Shell, ShellExit, Lexer as ShellLexer, ShellSyntaxError, Stats, SysError, TeeOutput, Terminal, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, VirtualServerResponse, WASM_ALIASES, WorkerRuntimePod, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, src_default as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path_exports as posixPath, renderInto, resetPidCounter, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo };
+export { ArithError, BufferSink, CallbackSink, CleanPackageInstaller, CommandRegistry, CommonJsEngine, Container, ContainerFs, ERRNO, FileInput, FileOutput, IncompleteInputError, KERNEL_NAME, KERNEL_RELEASE, Kernel, LocalRuntimePod, MemoryVolume, NODE_VERSION, NPM_VERSION, NetworkStack, NullInput, NullOutput, OS_RELEASE, PYTHON_VERSION, Pipe, Process, ProcessTable, ROOT_CRED, SIGNALS, SIGNAL_NAMES, Session, Shell, ShellExit, Lexer as ShellLexer, ShellSyntaxError, Stats, SysError, TeeOutput, Terminal, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, VirtualServerResponse, WASM_ALIASES, WasiError, WasiExit, WasiHost, WorkerRuntimePod, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, createPreview, src_default as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, isWasmBinary, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path_exports as posixPath, renderInto, resetPidCounter, runWasi, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo, wasi as wasiCommand };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map