sandboxedjs 0.1.48 → 0.1.49

package/dist/python-abi.cjs

@@ -0,0 +1,2892 @@
+'use strict';
+
+// src/runtime/python/host-abi.ts
+var SBX_HOST_ABI_VERSION = 1;
+var SBX_REQUEST_HEADER_BYTES = 16;
+var SBX_RESPONSE_HEADER_BYTES = 20;
+var Op = {
+  handshake: 0,
+  openat: 1,
+  close: 2,
+  read: 3,
+  write: 4,
+  pread: 5,
+  pwrite: 6,
+  lseek: 7,
+  fstat: 8,
+  statat: 9,
+  ftruncate: 10,
+  renameat: 11,
+  unlinkat: 12,
+  mkdirat: 13,
+  readlinkat: 14,
+  symlinkat: 15,
+  getdents: 16,
+  fsync: 17,
+  dup: 256,
+  dup2: 257,
+  get_flags: 258,
+  set_flags: 259,
+  pipe: 512,
+  poll: 768,
+  clock_gettime: 1024,
+  sleep: 1025,
+  getpid: 1280,
+  getcwd: 1281,
+  chdir: 1282,
+  environ: 1283,
+  getrandom: 1536
+};
+var Errno = {
+  EPERM: 1,
+  ENOENT: 2,
+  ESRCH: 3,
+  EINTR: 4,
+  EIO: 5,
+  ENXIO: 6,
+  E2BIG: 7,
+  EBADF: 9,
+  EAGAIN: 11,
+  ENOMEM: 12,
+  EACCES: 13,
+  EFAULT: 14,
+  EBUSY: 16,
+  EEXIST: 17,
+  EXDEV: 18,
+  ENODEV: 19,
+  ENOTDIR: 20,
+  EISDIR: 21,
+  EINVAL: 22,
+  ENFILE: 23,
+  EMFILE: 24,
+  ENOTTY: 25,
+  EFBIG: 27,
+  ENOSPC: 28,
+  ESPIPE: 29,
+  EROFS: 30,
+  EMLINK: 31,
+  EPIPE: 32,
+  ERANGE: 34,
+  ENAMETOOLONG: 36,
+  ENOSYS: 38,
+  ENOTEMPTY: 39,
+  ELOOP: 40,
+  ENODATA: 61,
+  EPROTO: 71,
+  EOVERFLOW: 75,
+  ETIMEDOUT: 110,
+  ECANCELED: 125,
+  EDQUOT: 122
+};
+var CAPABILITIES = ["files", "descriptors", "pipes", "readiness", "time", "identity", "entropy", "sockets", "processes", "signals", "storage", "services", "threads"];
+var OP_NAMES = Object.fromEntries(
+  Object.entries(Op).map(([name, code]) => [code, name])
+);
+var ERRNO_NAMES = Object.fromEntries(
+  Object.entries(Errno).map(([name, code]) => [code, name])
+);
+
+// src/runtime/python/protocol.ts
+var ProtocolError = class extends Error {
+  code = "ERR_SBX_ABI_PROTOCOL";
+};
+function encodeRequest(header, payload) {
+  const frame = new Uint8Array(SBX_REQUEST_HEADER_BYTES + payload.length);
+  const view = new DataView(frame.buffer);
+  view.setUint16(0, header.version, true);
+  view.setUint16(2, header.op, true);
+  view.setUint32(4, header.requestId, true);
+  view.setUint32(8, header.generation, true);
+  view.setUint32(12, payload.length, true);
+  frame.set(payload, SBX_REQUEST_HEADER_BYTES);
+  return frame;
+}
+function decodeRequest(frame) {
+  if (frame.length < SBX_REQUEST_HEADER_BYTES) throw new ProtocolError("short request frame");
+  const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+  const header = {
+    version: view.getUint16(0, true),
+    op: view.getUint16(2, true),
+    requestId: view.getUint32(4, true),
+    generation: view.getUint32(8, true)
+  };
+  const length = view.getUint32(12, true);
+  if (frame.length - SBX_REQUEST_HEADER_BYTES < length) {
+    throw new ProtocolError(`truncated payload for ${OP_NAMES[header.op] ?? header.op}`);
+  }
+  return {
+    header,
+    payload: frame.subarray(SBX_REQUEST_HEADER_BYTES, SBX_REQUEST_HEADER_BYTES + length)
+  };
+}
+function encodeResponse(header, status, payload) {
+  const frame = new Uint8Array(SBX_RESPONSE_HEADER_BYTES + payload.length);
+  const view = new DataView(frame.buffer);
+  view.setUint16(0, header.version, true);
+  view.setUint16(2, header.op, true);
+  view.setUint32(4, header.requestId, true);
+  view.setUint32(8, header.generation, true);
+  view.setInt32(12, status, true);
+  view.setUint32(16, payload.length, true);
+  frame.set(payload, SBX_RESPONSE_HEADER_BYTES);
+  return frame;
+}
+function decodeResponse(frame, expected) {
+  if (frame.length < SBX_RESPONSE_HEADER_BYTES) {
+    throw new ProtocolError("the host ABI transport returned an incomplete frame");
+  }
+  const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+  const header = {
+    version: view.getUint16(0, true),
+    op: view.getUint16(2, true),
+    requestId: view.getUint32(4, true),
+    generation: view.getUint32(8, true)
+  };
+  const status = view.getInt32(12, true);
+  const length = view.getUint32(16, true);
+  if (frame.length - SBX_RESPONSE_HEADER_BYTES < length) throw new ProtocolError("truncated response payload");
+  if (expected) {
+    if (header.requestId !== expected.requestId) throw new ProtocolError("stale response: request id mismatch");
+    if (header.generation !== expected.generation) throw new ProtocolError("stale response: process generation mismatch");
+    if (header.op !== expected.op) throw new ProtocolError("response answers a different operation");
+  }
+  if (header.version !== SBX_HOST_ABI_VERSION) {
+    throw new ProtocolError(`host ABI version ${header.version}, expected ${SBX_HOST_ABI_VERSION}`);
+  }
+  return {
+    header,
+    status,
+    payload: frame.subarray(SBX_RESPONSE_HEADER_BYTES, SBX_RESPONSE_HEADER_BYTES + length)
+  };
+}
+var Reader = class {
+  at = 0;
+  view;
+  bytes;
+  constructor(bytes) {
+    this.bytes = bytes;
+    this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  }
+  need(count) {
+    if (this.at + count > this.bytes.length) throw new ProtocolError("payload underrun");
+    const offset = this.at;
+    this.at += count;
+    return offset;
+  }
+  i32() {
+    return this.view.getInt32(this.need(4), true);
+  }
+  u32() {
+    return this.view.getUint32(this.need(4), true);
+  }
+  i64() {
+    return Number(this.view.getBigInt64(this.need(8), true));
+  }
+  u64() {
+    return Number(this.view.getBigUint64(this.need(8), true));
+  }
+  bytes32() {
+    const length = this.u32();
+    const offset = this.need(length);
+    return this.bytes.subarray(offset, offset + length);
+  }
+  string() {
+    return new TextDecoder().decode(this.bytes32());
+  }
+  get remaining() {
+    return this.bytes.length - this.at;
+  }
+};
+var Writer = class {
+  parts = [];
+  i32(value) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setInt32(0, value, true);
+    this.parts.push(b);
+    return this;
+  }
+  u32(value) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setUint32(0, value >>> 0, true);
+    this.parts.push(b);
+    return this;
+  }
+  i64(value) {
+    const b = new Uint8Array(8);
+    new DataView(b.buffer).setBigInt64(0, BigInt(Math.trunc(value)), true);
+    this.parts.push(b);
+    return this;
+  }
+  u64(value) {
+    const b = new Uint8Array(8);
+    new DataView(b.buffer).setBigUint64(0, BigInt(Math.trunc(value)), true);
+    this.parts.push(b);
+    return this;
+  }
+  bytes32(value) {
+    this.u32(value.length);
+    this.parts.push(value);
+    return this;
+  }
+  string(value) {
+    return this.bytes32(new TextEncoder().encode(value));
+  }
+  finish() {
+    const total = this.parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const part of this.parts) {
+      out.set(part, at);
+      at += part.length;
+    }
+    return out;
+  }
+};
+function failure(errno) {
+  return -Math.abs(errno);
+}
+
+// src/runtime/python/sync-transport.ts
+var STATE = 0;
+var LENGTH = 1;
+var MORE = 2;
+var CONTROL_WORDS = 4;
+var STATE_IDLE = 0;
+var STATE_REQUEST = 1;
+var STATE_RESPONSE = 2;
+var STATE_CONTINUE = 3;
+var STATE_CLOSED = 4;
+var WAIT_SLICE_MS = 200;
+function createHostTransportBuffers(windowBytes = 1 << 20) {
+  return {
+    control: new SharedArrayBuffer(CONTROL_WORDS * Int32Array.BYTES_PER_ELEMENT),
+    data: new SharedArrayBuffer(windowBytes)
+  };
+}
+var HostTransportError = class extends Error {
+  code = "ERR_SBX_HOST_TRANSPORT";
+};
+var HostCallClient = class {
+  control;
+  data;
+  capacity;
+  wake;
+  closed = false;
+  constructor(buffers, wake) {
+    this.control = new Int32Array(buffers.control);
+    this.data = new Uint8Array(buffers.data);
+    this.capacity = this.data.length;
+    this.wake = wake;
+  }
+  /** Send a frame and block until the whole answer is back. Never returns empty. */
+  call(request) {
+    if (this.closed || Atomics.load(this.control, STATE) === STATE_CLOSED) {
+      this.closed = true;
+      throw new HostTransportError("the host transport is closed");
+    }
+    this.send(request);
+    const response = this.receive();
+    if (response.length === 0) {
+      throw new HostTransportError("the host answered with no frame; the kernel side failed or went away");
+    }
+    return response;
+  }
+  send(request) {
+    let offset = 0;
+    for (; ; ) {
+      const size = Math.min(this.capacity, request.length - offset);
+      this.data.set(request.subarray(offset, offset + size), 0);
+      offset += size;
+      Atomics.store(this.control, LENGTH, size);
+      Atomics.store(this.control, MORE, offset < request.length ? 1 : 0);
+      this.publish(STATE_REQUEST);
+      const next = this.waitWhile(STATE_REQUEST);
+      if (next === STATE_RESPONSE) return;
+      if (next !== STATE_CONTINUE) {
+        this.closed = true;
+        throw new HostTransportError("the host went away mid-request");
+      }
+    }
+  }
+  receive() {
+    const parts = [];
+    let total = 0;
+    for (; ; ) {
+      const size = Atomics.load(this.control, LENGTH);
+      parts.push(this.data.slice(0, size));
+      total += size;
+      if (Atomics.load(this.control, MORE) === 0) break;
+      this.publish(STATE_CONTINUE);
+      if (this.waitWhile(STATE_CONTINUE) !== STATE_RESPONSE) {
+        this.closed = true;
+        throw new HostTransportError("the host went away mid-response");
+      }
+    }
+    Atomics.store(this.control, STATE, STATE_IDLE);
+    if (parts.length === 1) return parts[0];
+    const joined = new Uint8Array(total);
+    let at = 0;
+    for (const part of parts) {
+      joined.set(part, at);
+      at += part.length;
+    }
+    return joined;
+  }
+  publish(state) {
+    Atomics.store(this.control, STATE, state);
+    Atomics.notify(this.control, STATE);
+    this.wake();
+  }
+  waitWhile(state) {
+    for (; ; ) {
+      Atomics.wait(this.control, STATE, state, WAIT_SLICE_MS);
+      const current = Atomics.load(this.control, STATE);
+      if (current !== state) return current;
+    }
+  }
+};
+var HostCallServer = class {
+  control;
+  data;
+  capacity;
+  handle;
+  onFault;
+  incoming = [];
+  outgoing = null;
+  sent = 0;
+  closed = false;
+  constructor(buffers, handle, onFault = () => {
+  }) {
+    this.control = new Int32Array(buffers.control);
+    this.data = new Uint8Array(buffers.data);
+    this.capacity = this.data.length;
+    this.handle = handle;
+    this.onFault = onFault;
+  }
+  /** Call on each wake message from the client. */
+  async pump() {
+    if (this.closed) return;
+    const state = Atomics.load(this.control, STATE);
+    if (state === STATE_REQUEST) {
+      const size = Atomics.load(this.control, LENGTH);
+      this.incoming.push(this.data.slice(0, size));
+      if (Atomics.load(this.control, MORE) === 1) {
+        this.publish(STATE_CONTINUE);
+        return;
+      }
+      const request = concat(this.incoming);
+      this.incoming = [];
+      let response;
+      try {
+        response = await this.handle(request);
+      } catch (error) {
+        this.onFault(error);
+        this.close();
+        return;
+      }
+      if (this.closed) return;
+      this.outgoing = response;
+      this.sent = 0;
+      this.sendWindow();
+      return;
+    }
+    if (state === STATE_CONTINUE) this.sendWindow();
+  }
+  /** Release a blocked client — container teardown, or the worker being killed. */
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    Atomics.store(this.control, STATE, STATE_CLOSED);
+    Atomics.notify(this.control, STATE);
+  }
+  sendWindow() {
+    const payload = this.outgoing ?? new Uint8Array();
+    const size = Math.min(this.capacity, payload.length - this.sent);
+    this.data.set(payload.subarray(this.sent, this.sent + size), 0);
+    this.sent += size;
+    Atomics.store(this.control, LENGTH, size);
+    Atomics.store(this.control, MORE, this.sent < payload.length ? 1 : 0);
+    this.publish(STATE_RESPONSE);
+  }
+  publish(state) {
+    Atomics.store(this.control, STATE, state);
+    Atomics.notify(this.control, STATE);
+  }
+};
+function concat(parts) {
+  if (parts.length === 1) return parts[0];
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const joined = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    joined.set(part, at);
+    at += part.length;
+  }
+  return joined;
+}
+
+// src/kernel/open-file.ts
+var PosixError = class extends Error {
+  constructor(errno, message) {
+    super(message ?? `errno ${errno}`);
+    this.errno = errno;
+    this.name = "PosixError";
+  }
+  errno;
+};
+var O_RDONLY = 0;
+var O_WRONLY = 1;
+var O_RDWR = 2;
+var O_CREAT = 64;
+var O_EXCL = 128;
+var O_TRUNC = 512;
+var O_APPEND = 1024;
+var O_NONBLOCK = 2048;
+var O_DIRECTORY = 65536;
+var O_CLOEXEC = 524288;
+function accessMode(flags) {
+  return flags & 3;
+}
+var SEEK_SET = 0;
+var SEEK_CUR = 1;
+var SEEK_END = 2;
+var Inode = class {
+  constructor(ino, path, vfs, cred) {
+    this.ino = ino;
+    this.path = path;
+    this.vfs = vfs;
+    this.cred = cred;
+  }
+  ino;
+  path;
+  vfs;
+  cred;
+  detached = null;
+  refs = 0;
+  /** Read the whole file, wherever it currently lives. */
+  contents() {
+    if (this.detached) return this.detached;
+    try {
+      return this.vfs.readFile(this.path, this.cred);
+    } catch (error) {
+      throw toPosixError(error);
+    }
+  }
+  replace(data) {
+    if (this.detached) {
+      this.detached = data;
+      return;
+    }
+    try {
+      this.vfs.writeFile(this.path, data, { cred: this.cred });
+    } catch (error) {
+      throw toPosixError(error);
+    }
+  }
+  /** Called when the last name is about to be removed. */
+  detach() {
+    if (this.detached) return;
+    try {
+      this.detached = this.vfs.readFile(this.path, this.cred);
+    } catch {
+      this.detached = new Uint8Array();
+    }
+  }
+  size() {
+    return this.contents().length;
+  }
+  stat() {
+    if (this.detached) {
+      return {
+        ino: this.ino,
+        mode: 33188,
+        size: this.detached.length,
+        uid: this.cred.uid,
+        gid: this.cred.gid,
+        nlink: 0,
+        atimeMs: Date.now(),
+        mtimeMs: Date.now(),
+        ctimeMs: Date.now()
+      };
+    }
+    try {
+      const st = this.vfs.stat(this.path, { cred: this.cred });
+      return {
+        ino: st.ino,
+        mode: st.mode,
+        size: st.size,
+        uid: st.uid,
+        gid: st.gid,
+        nlink: st.nlink ?? 1,
+        atimeMs: st.atimeMs,
+        mtimeMs: st.mtimeMs,
+        ctimeMs: st.ctimeMs
+      };
+    } catch (error) {
+      throw toPosixError(error);
+    }
+  }
+};
+var FileDescription = class {
+  constructor(inode, flags) {
+    this.inode = inode;
+    this.flags = flags;
+    inode.refs += 1;
+  }
+  inode;
+  flags;
+  kind = "file";
+  offset = 0;
+  read(length) {
+    if (accessMode(this.flags) === O_WRONLY) throw new PosixError(Errno.EBADF);
+    const data = this.inode.contents();
+    const start = Math.min(this.offset, data.length);
+    const end = Math.min(start + length, data.length);
+    this.offset = end;
+    return data.slice(start, end);
+  }
+  pread(length, offset) {
+    if (accessMode(this.flags) === O_WRONLY) throw new PosixError(Errno.EBADF);
+    const data = this.inode.contents();
+    const start = Math.min(offset, data.length);
+    return data.slice(start, Math.min(start + length, data.length));
+  }
+  write(data) {
+    if (accessMode(this.flags) === O_RDONLY) throw new PosixError(Errno.EBADF);
+    const at = this.flags & O_APPEND ? this.inode.size() : this.offset;
+    const written = this.writeAt(data, at);
+    this.offset = at + written;
+    return written;
+  }
+  pwrite(data, offset) {
+    if (accessMode(this.flags) === O_RDONLY) throw new PosixError(Errno.EBADF);
+    return this.writeAt(data, offset);
+  }
+  writeAt(data, offset) {
+    const current = this.inode.contents();
+    const end = offset + data.length;
+    const next = new Uint8Array(Math.max(current.length, end));
+    next.set(current, 0);
+    next.set(data, offset);
+    this.inode.replace(next);
+    return data.length;
+  }
+  seek(offset, whence) {
+    const base = whence === SEEK_SET ? 0 : whence === SEEK_CUR ? this.offset : this.inode.size();
+    const next = base + offset;
+    if (next < 0) throw new PosixError(Errno.EINVAL);
+    this.offset = next;
+    return next;
+  }
+  truncate(length) {
+    const current = this.inode.contents();
+    const next = new Uint8Array(length);
+    next.set(current.subarray(0, Math.min(length, current.length)), 0);
+    this.inode.replace(next);
+  }
+  stat() {
+    return this.inode.stat();
+  }
+  readable() {
+    return true;
+  }
+  writable() {
+    return true;
+  }
+  whenReady() {
+    return Promise.resolve();
+  }
+  close() {
+    this.inode.refs -= 1;
+    if (this.inode.refs <= 0) this.inode.detached = null;
+  }
+};
+var DirectoryDescription = class {
+  constructor(path, flags, vfs, cred) {
+    this.path = path;
+    this.flags = flags;
+    this.vfs = vfs;
+    this.cred = cred;
+  }
+  path;
+  flags;
+  vfs;
+  cred;
+  kind = "dir";
+  entries = null;
+  index = 0;
+  /** Entry names, NUL-terminated, as many as fit in `length`. */
+  read(length) {
+    if (!this.entries) {
+      try {
+        this.entries = [".", "..", ...this.vfs.readdir(this.path, this.cred)];
+      } catch (error) {
+        throw toPosixError(error);
+      }
+    }
+    const encoder3 = new TextEncoder();
+    const parts = [];
+    let total = 0;
+    while (this.index < this.entries.length) {
+      const encoded = encoder3.encode(this.entries[this.index] + "\0");
+      if (total + encoded.length > length) break;
+      parts.push(encoded);
+      total += encoded.length;
+      this.index += 1;
+    }
+    const joined = new Uint8Array(total);
+    let at = 0;
+    for (const part of parts) {
+      joined.set(part, at);
+      at += part.length;
+    }
+    return joined;
+  }
+  write() {
+    throw new PosixError(Errno.EISDIR);
+  }
+  seek(offset, whence) {
+    if (whence === SEEK_SET && offset === 0) {
+      this.index = 0;
+      return 0;
+    }
+    throw new PosixError(Errno.EINVAL);
+  }
+  stat() {
+    try {
+      const st = this.vfs.stat(this.path, { cred: this.cred });
+      return {
+        ino: st.ino,
+        mode: st.mode,
+        size: st.size,
+        uid: st.uid,
+        gid: st.gid,
+        nlink: st.nlink ?? 2,
+        atimeMs: st.atimeMs,
+        mtimeMs: st.mtimeMs,
+        ctimeMs: st.ctimeMs
+      };
+    } catch (error) {
+      throw toPosixError(error);
+    }
+  }
+  readable() {
+    return true;
+  }
+  writable() {
+    return false;
+  }
+  whenReady() {
+    return Promise.resolve();
+  }
+  close() {
+  }
+};
+var PIPE_CAPACITY = 64 * 1024;
+var PipeBuffer = class {
+  chunks = [];
+  queued = 0;
+  readers = 0;
+  writers = 0;
+  waiters = [];
+  get available() {
+    return this.queued;
+  }
+  get space() {
+    return Math.max(0, PIPE_CAPACITY - this.queued);
+  }
+  push(data) {
+    this.chunks.push(data);
+    this.queued += data.length;
+    this.wake();
+  }
+  take(length) {
+    const out = new Uint8Array(Math.min(length, this.queued));
+    let at = 0;
+    while (at < out.length) {
+      const head = this.chunks[0];
+      const take = Math.min(head.length, out.length - at);
+      out.set(head.subarray(0, take), at);
+      at += take;
+      if (take === head.length) this.chunks.shift();
+      else this.chunks[0] = head.subarray(take);
+    }
+    this.queued -= out.length;
+    this.wake();
+    return out;
+  }
+  /** Anything that may have changed readiness for either end. */
+  wake() {
+    const waiting = this.waiters;
+    this.waiters = [];
+    for (const resolve2 of waiting) resolve2();
+  }
+  whenReady() {
+    return new Promise((resolve2) => this.waiters.push(resolve2));
+  }
+};
+var PipeReadEnd = class {
+  constructor(buffer, flags) {
+    this.buffer = buffer;
+    this.flags = flags;
+    buffer.readers += 1;
+  }
+  buffer;
+  flags;
+  kind = "pipe";
+  read(length) {
+    if (this.buffer.available === 0) {
+      if (this.buffer.writers === 0) return new Uint8Array();
+      throw new PosixError(Errno.EAGAIN);
+    }
+    return this.buffer.take(length);
+  }
+  write() {
+    throw new PosixError(Errno.EBADF);
+  }
+  stat() {
+    return pipeStat();
+  }
+  readable() {
+    return this.buffer.available > 0 || this.buffer.writers === 0;
+  }
+  writable() {
+    return false;
+  }
+  whenReady() {
+    return this.buffer.whenReady();
+  }
+  close() {
+    this.buffer.readers -= 1;
+    this.buffer.wake();
+  }
+};
+var PipeWriteEnd = class {
+  constructor(buffer, flags) {
+    this.buffer = buffer;
+    this.flags = flags;
+    buffer.writers += 1;
+  }
+  buffer;
+  flags;
+  kind = "pipe";
+  read() {
+    throw new PosixError(Errno.EBADF);
+  }
+  write(data) {
+    if (this.buffer.readers === 0) throw new PosixError(Errno.EPIPE);
+    const space = this.buffer.space;
+    if (space === 0) throw new PosixError(Errno.EAGAIN);
+    const accepted = data.subarray(0, space);
+    this.buffer.push(accepted.slice());
+    return accepted.length;
+  }
+  stat() {
+    return pipeStat();
+  }
+  readable() {
+    return false;
+  }
+  writable() {
+    return this.buffer.space > 0 || this.buffer.readers === 0;
+  }
+  whenReady() {
+    return this.buffer.whenReady();
+  }
+  close() {
+    this.buffer.writers -= 1;
+    this.buffer.wake();
+  }
+};
+function pipeStat() {
+  const now = Date.now();
+  return { ino: 0, mode: 4480, size: 0, uid: 0, gid: 0, nlink: 1, atimeMs: now, mtimeMs: now, ctimeMs: now };
+}
+function createPipe(flags = 0) {
+  const buffer = new PipeBuffer();
+  return [new PipeReadEnd(buffer, flags | O_RDONLY), new PipeWriteEnd(buffer, flags | O_WRONLY)];
+}
+var StreamDescription = class {
+  constructor(flags, sink, isTty = false) {
+    this.flags = flags;
+    this.sink = sink;
+    this.isTty = isTty;
+  }
+  flags;
+  sink;
+  isTty;
+  kind = "stream";
+  queue = [];
+  queued = 0;
+  ended = false;
+  waiters = [];
+  /** Host side: give the guest more input. */
+  push(data) {
+    if (data.length === 0) return;
+    this.queue.push(data);
+    this.queued += data.length;
+    this.wake();
+  }
+  /** Host side: no more input will arrive. */
+  end() {
+    this.ended = true;
+    this.wake();
+  }
+  read(length) {
+    if (this.queued === 0) {
+      if (this.ended) return new Uint8Array();
+      throw new PosixError(Errno.EAGAIN);
+    }
+    const out = new Uint8Array(Math.min(length, this.queued));
+    let at = 0;
+    while (at < out.length) {
+      const head = this.queue[0];
+      const take = Math.min(head.length, out.length - at);
+      out.set(head.subarray(0, take), at);
+      at += take;
+      if (take === head.length) this.queue.shift();
+      else this.queue[0] = head.subarray(take);
+    }
+    this.queued -= out.length;
+    return out;
+  }
+  write(data) {
+    if (!this.sink) throw new PosixError(Errno.EBADF);
+    this.sink(data);
+    return data.length;
+  }
+  stat() {
+    const now = Date.now();
+    return {
+      ino: 0,
+      mode: this.isTty ? 8592 : 4480,
+      size: 0,
+      uid: 0,
+      gid: 0,
+      nlink: 1,
+      atimeMs: now,
+      mtimeMs: now,
+      ctimeMs: now
+    };
+  }
+  readable() {
+    return this.queued > 0 || this.ended;
+  }
+  writable() {
+    return true;
+  }
+  whenReady() {
+    return new Promise((resolve2) => this.waiters.push(resolve2));
+  }
+  close() {
+    this.wake();
+  }
+  wake() {
+    const waiting = this.waiters;
+    this.waiters = [];
+    for (const resolve2 of waiting) resolve2();
+  }
+};
+function toPosixError(error) {
+  if (error instanceof PosixError) return error;
+  const code = error?.code;
+  const message = error?.message;
+  const mapped = {
+    ENOENT: Errno.ENOENT,
+    EEXIST: Errno.EEXIST,
+    ENOTDIR: Errno.ENOTDIR,
+    EISDIR: Errno.EISDIR,
+    EACCES: Errno.EACCES,
+    EPERM: Errno.EPERM,
+    ENOTEMPTY: Errno.ENOTEMPTY,
+    EINVAL: Errno.EINVAL,
+    ELOOP: Errno.ELOOP,
+    EXDEV: Errno.EXDEV,
+    ENOSPC: Errno.ENOSPC,
+    EMFILE: Errno.EMFILE,
+    ENAMETOOLONG: Errno.ENAMETOOLONG,
+    EBADF: Errno.EBADF,
+    EPIPE: Errno.EPIPE
+  };
+  return new PosixError(code && mapped[code] ? mapped[code] : Errno.EIO, message);
+}
+var DescriptorTable = class _DescriptorTable {
+  slots = /* @__PURE__ */ new Map();
+  /** Descriptions this table shares with others, so close counts correctly. */
+  static refs = /* @__PURE__ */ new WeakMap();
+  /** Install at a chosen number, closing whatever was there. */
+  set(fd, description, cloexec = false) {
+    if (fd < 0) throw new PosixError(Errno.EBADF);
+    const existing = this.slots.get(fd);
+    if (existing) this.release(existing.description);
+    this.slots.set(fd, { description, cloexec });
+    _DescriptorTable.refs.set(description, (_DescriptorTable.refs.get(description) ?? 0) + 1);
+    return fd;
+  }
+  /** Install at the lowest free number at or above `from`. */
+  add(description, cloexec = false, from = 0) {
+    let fd = from;
+    while (this.slots.has(fd)) fd += 1;
+    return this.set(fd, description, cloexec);
+  }
+  get(fd) {
+    const slot = this.slots.get(fd);
+    if (!slot) throw new PosixError(Errno.EBADF);
+    return slot.description;
+  }
+  has(fd) {
+    return this.slots.has(fd);
+  }
+  cloexec(fd) {
+    const slot = this.slots.get(fd);
+    if (!slot) throw new PosixError(Errno.EBADF);
+    return slot.cloexec;
+  }
+  setCloexec(fd, value) {
+    const slot = this.slots.get(fd);
+    if (!slot) throw new PosixError(Errno.EBADF);
+    slot.cloexec = value;
+  }
+  /** `dup`: a second name for one description, so the offset is shared. */
+  dup(fd, from = 0) {
+    return this.add(this.get(fd), false, from);
+  }
+  dup2(fd, target) {
+    const description = this.get(fd);
+    if (fd === target) return target;
+    return this.set(target, description, false);
+  }
+  close(fd) {
+    const slot = this.slots.get(fd);
+    if (!slot) throw new PosixError(Errno.EBADF);
+    this.slots.delete(fd);
+    this.release(slot.description);
+  }
+  /** Everything a child inherits: a spawn keeps all but the close-on-exec ones. */
+  inherit() {
+    const child = new _DescriptorTable();
+    for (const [fd, slot] of this.slots) {
+      if (slot.cloexec) continue;
+      child.set(fd, slot.description, false);
+    }
+    return child;
+  }
+  /** Drop every descriptor. Every resource has an owner and a cleanup path. */
+  closeAll() {
+    for (const fd of [...this.slots.keys()]) {
+      try {
+        this.close(fd);
+      } catch {
+      }
+    }
+  }
+  get openCount() {
+    return this.slots.size;
+  }
+  release(description) {
+    const refs = (_DescriptorTable.refs.get(description) ?? 1) - 1;
+    if (refs <= 0) {
+      _DescriptorTable.refs.delete(description);
+      description.close();
+    } else {
+      _DescriptorTable.refs.set(description, refs);
+    }
+  }
+};
+var FileService = class {
+  constructor(vfs, cred) {
+    this.vfs = vfs;
+    this.cred = cred;
+  }
+  vfs;
+  cred;
+  openInodes = /* @__PURE__ */ new Map();
+  open(path, flags, mode = 438) {
+    const exists = this.vfs.lexists(path);
+    if (flags & O_CREAT && flags & O_EXCL && exists) throw new PosixError(Errno.EEXIST);
+    if (!exists) {
+      if (!(flags & O_CREAT)) throw new PosixError(Errno.ENOENT);
+      if (accessMode(flags) === O_RDONLY) throw new PosixError(Errno.EACCES);
+      try {
+        this.vfs.writeFile(path, new Uint8Array(), { cred: this.cred, mode });
+      } catch (error) {
+        throw toPosixError(error);
+      }
+    }
+    let stat;
+    try {
+      stat = this.vfs.stat(path, { cred: this.cred });
+    } catch (error) {
+      throw toPosixError(error);
+    }
+    if (stat.isDirectory()) {
+      if (accessMode(flags) !== O_RDONLY) throw new PosixError(Errno.EISDIR);
+      return new DirectoryDescription(path, flags, this.vfs, this.cred);
+    }
+    if (flags & O_DIRECTORY) throw new PosixError(Errno.ENOTDIR);
+    const inode = this.inodeFor(stat.ino, path);
+    const description = new FileDescription(inode, flags);
+    if (flags & O_TRUNC && accessMode(flags) !== O_RDONLY) description.truncate(0);
+    return description;
+  }
+  /**
+   * Remove a name.
+   *
+   * If something still has the file open, its contents move into the open
+   * description first: POSIX guarantees a reader keeps reading, and a volume
+   * that only knows about paths cannot provide that on its own.
+   */
+  unlink(path) {
+    let ino = null;
+    try {
+      ino = this.vfs.lstat(path).ino;
+    } catch (error) {
+      throw toPosixError(error);
+    }
+    const inode = ino === null ? void 0 : this.openInodes.get(ino);
+    if (inode && inode.refs > 0 && inode.path === path) inode.detach();
+    try {
+      this.vfs.unlink(path, this.cred);
+    } catch (error) {
+      throw toPosixError(error);
+    }
+    if (inode && inode.refs <= 0) this.openInodes.delete(ino);
+  }
+  /** Rename a name. Anything already open follows the file to its new name. */
+  rename(from, to) {
+    let ino = null;
+    try {
+      ino = this.vfs.lstat(from).ino;
+    } catch {
+    }
+    try {
+      this.vfs.rename(from, to, this.cred);
+    } catch (error) {
+      throw toPosixError(error);
+    }
+    if (ino === null) return;
+    const inode = this.openInodes.get(ino);
+    if (inode) inode.path = to;
+  }
+  /** One {@link Inode} per file identity, shared by every open description. */
+  inodeFor(ino, path) {
+    const existing = this.openInodes.get(ino);
+    if (existing) {
+      existing.path = path;
+      return existing;
+    }
+    const created = new Inode(ino, path, this.vfs, this.cred);
+    this.openInodes.set(ino, created);
+    return created;
+  }
+};
+
+// src/runtime/python/syscall-server.ts
+var MAX_TRANSFER = 8 * 1024 * 1024;
+function createHostAbiServer(proc) {
+  const files = new FileService(proc.vfs, proc.cred);
+  const started = Date.now();
+  const monotonicBase = typeof performance === "object" ? performance.now() : 0;
+  return async (frame) => {
+    const { header, payload } = decodeRequest(frame);
+    if (header.version !== SBX_HOST_ABI_VERSION) {
+      return encodeResponse(header, failure(Errno.EPROTO), new Uint8Array());
+    }
+    if (header.generation !== proc.generation) {
+      return encodeResponse(header, failure(Errno.ESRCH), new Uint8Array());
+    }
+    try {
+      const { status, payload: out } = await dispatch(header, new Reader(payload));
+      return encodeResponse(header, status, out ?? new Uint8Array());
+    } catch (error) {
+      const posix = toPosixError(error);
+      return encodeResponse(header, failure(posix.errno), new Uint8Array());
+    }
+  };
+  async function dispatch(header, r) {
+    switch (header.op) {
+      case Op.handshake: {
+        const w = new Writer().u32(SBX_HOST_ABI_VERSION).u32(CAPABILITIES.length);
+        for (const capability of CAPABILITIES) {
+          w.string(capability).u32(implemented(capability) ? 1 : 0);
+        }
+        return { status: 0, payload: w.finish() };
+      }
+      /* ------------------------------------------------------------ files */
+      case Op.openat: {
+        const path = resolve2(r.string());
+        const flags = r.u32();
+        const mode = r.u32();
+        const description = files.open(path, flags, mode);
+        return { status: proc.table.add(description, (flags & O_CLOEXEC) !== 0) };
+      }
+      case Op.close: {
+        proc.table.close(r.i32());
+        return { status: 0 };
+      }
+      case Op.read: {
+        const description = proc.table.get(r.i32());
+        const length = clamp(r.u32());
+        const data = await readBlocking(description, length);
+        return { status: data.length, payload: data };
+      }
+      case Op.write: {
+        const description = proc.table.get(r.i32());
+        const data = r.bytes32();
+        const written = await writeBlocking(description, data);
+        return { status: written };
+      }
+      case Op.pread: {
+        const description = proc.table.get(r.i32());
+        const length = clamp(r.u32());
+        const offset = r.u64();
+        if (!description.pread) throw new PosixError(Errno.ESPIPE);
+        const data = description.pread(length, offset);
+        return { status: data.length, payload: data };
+      }
+      case Op.pwrite: {
+        const description = proc.table.get(r.i32());
+        const data = r.bytes32();
+        const offset = r.u64();
+        if (!description.pwrite) throw new PosixError(Errno.ESPIPE);
+        return { status: description.pwrite(data, offset) };
+      }
+      case Op.lseek: {
+        const description = proc.table.get(r.i32());
+        const offset = r.i64();
+        const whence = r.u32();
+        if (!description.seek) throw new PosixError(Errno.ESPIPE);
+        return { status: 0, payload: new Writer().i64(description.seek(offset, whence)).finish() };
+      }
+      case Op.fstat: {
+        return { status: 0, payload: encodeStat(proc.table.get(r.i32()).stat()) };
+      }
+      case Op.statat: {
+        const path = resolve2(r.string());
+        const followLinks = r.u32() !== 0;
+        try {
+          const st = followLinks ? proc.vfs.stat(path, { cred: proc.cred }) : proc.vfs.lstat(path);
+          return {
+            status: 0,
+            payload: encodeStat({
+              ino: st.ino,
+              mode: st.mode,
+              size: st.size,
+              uid: st.uid,
+              gid: st.gid,
+              nlink: st.nlink ?? 1,
+              atimeMs: st.atimeMs,
+              mtimeMs: st.mtimeMs,
+              ctimeMs: st.ctimeMs
+            })
+          };
+        } catch (error) {
+          throw toPosixError(error);
+        }
+      }
+      case Op.ftruncate: {
+        const description = proc.table.get(r.i32());
+        const length = r.u64();
+        if (!description.truncate) throw new PosixError(Errno.EINVAL);
+        description.truncate(length);
+        return { status: 0 };
+      }
+      case Op.renameat: {
+        files.rename(resolve2(r.string()), resolve2(r.string()));
+        return { status: 0 };
+      }
+      case Op.unlinkat: {
+        const path = resolve2(r.string());
+        const removeDirectory = r.u32() !== 0;
+        if (removeDirectory) {
+          try {
+            proc.vfs.rmdir(path, proc.cred);
+          } catch (error) {
+            throw toPosixError(error);
+          }
+        } else {
+          files.unlink(path);
+        }
+        return { status: 0 };
+      }
+      case Op.mkdirat: {
+        const path = resolve2(r.string());
+        const mode = r.u32();
+        try {
+          proc.vfs.mkdir(path, { mode, cred: proc.cred });
+        } catch (error) {
+          throw toPosixError(error);
+        }
+        return { status: 0 };
+      }
+      case Op.readlinkat: {
+        try {
+          const target = proc.vfs.readlink(resolve2(r.string()), proc.cred);
+          return { status: 0, payload: new Writer().string(target).finish() };
+        } catch (error) {
+          throw toPosixError(error);
+        }
+      }
+      case Op.symlinkat: {
+        const target = r.string();
+        try {
+          proc.vfs.symlink(target, resolve2(r.string()), proc.cred);
+        } catch (error) {
+          throw toPosixError(error);
+        }
+        return { status: 0 };
+      }
+      case Op.getdents: {
+        const description = proc.table.get(r.i32());
+        if (description.kind !== "dir") throw new PosixError(Errno.ENOTDIR);
+        const data = description.read(clamp(r.u32()));
+        return { status: data.length, payload: data };
+      }
+      case Op.fsync: {
+        proc.table.get(r.i32());
+        return { status: 0 };
+      }
+      /* ------------------------------------------------------ descriptors */
+      case Op.dup:
+        return { status: proc.table.dup(r.i32(), r.u32()) };
+      case Op.dup2:
+        return { status: proc.table.dup2(r.i32(), r.i32()) };
+      case Op.get_flags: {
+        const fd = r.i32();
+        const description = proc.table.get(fd);
+        return { status: 0, payload: new Writer().u32(description.flags).u32(proc.table.cloexec(fd) ? 1 : 0).finish() };
+      }
+      case Op.set_flags: {
+        const fd = r.i32();
+        const flags = r.u32();
+        const cloexec = r.u32();
+        const description = proc.table.get(fd);
+        description.flags = accessMode(description.flags) | flags & -4;
+        proc.table.setCloexec(fd, cloexec !== 0);
+        return { status: 0 };
+      }
+      /* ------------------------------------------------------------ pipes */
+      case Op.pipe: {
+        const flags = r.u32();
+        const [readEnd, writeEnd] = createPipe(flags & O_NONBLOCK);
+        const cloexec = (flags & O_CLOEXEC) !== 0;
+        const readFd = proc.table.add(readEnd, cloexec);
+        const writeFd = proc.table.add(writeEnd, cloexec);
+        return { status: 0, payload: new Writer().i32(readFd).i32(writeFd).finish() };
+      }
+      /* -------------------------------------------------------- readiness */
+      case Op.poll: {
+        const count = r.u32();
+        const requests = [];
+        for (let i = 0; i < count; i += 1) requests.push({ fd: r.i32(), events: r.u32() });
+        const timeoutMs = r.i64();
+        const ready = await poll(requests, timeoutMs);
+        const w = new Writer().u32(ready.length);
+        for (const entry of ready) w.i32(entry.fd).u32(entry.revents);
+        return { status: ready.length, payload: w.finish() };
+      }
+      /* ------------------------------------------------------------- time */
+      case Op.clock_gettime: {
+        const monotonic = r.u32() !== 0;
+        const now = monotonic ? (typeof performance === "object" ? performance.now() : Date.now() - started) - monotonicBase : Date.now();
+        const nanos = Math.round(now * 1e6);
+        return { status: 0, payload: new Writer().i64(Math.floor(nanos / 1e9)).u32(nanos % 1e9).finish() };
+      }
+      case Op.sleep: {
+        const nanos = r.u64();
+        await sleep(nanos / 1e6);
+        return { status: proc.signal.aborted ? failure(Errno.EINTR) : 0 };
+      }
+      /* --------------------------------------------------------- identity */
+      case Op.getpid: {
+        const w = new Writer().i32(proc.pid).i32(proc.ppid).u32(proc.cred.uid).u32(proc.cred.gid).u32(proc.cred.umask ?? 18);
+        return { status: 0, payload: w.finish() };
+      }
+      case Op.getcwd:
+        return { status: 0, payload: new Writer().string(proc.cwd).finish() };
+      case Op.chdir: {
+        const path = resolve2(r.string());
+        let st;
+        try {
+          st = proc.vfs.stat(path, { cred: proc.cred });
+        } catch (error) {
+          throw toPosixError(error);
+        }
+        if (!st.isDirectory()) throw new PosixError(Errno.ENOTDIR);
+        proc.cwd = path;
+        return { status: 0 };
+      }
+      case Op.environ: {
+        const joined = Object.entries(proc.env).map(([key, value]) => `${key}=${value}`).join("\0");
+        return { status: 0, payload: new Writer().string(joined).finish() };
+      }
+      /* ---------------------------------------------------------- entropy */
+      case Op.getrandom: {
+        const length = Math.min(r.u32(), 65536);
+        const bytes = new Uint8Array(length);
+        crypto.getRandomValues(bytes);
+        return { status: length, payload: bytes };
+      }
+      default:
+        return { status: failure(Errno.ENOSYS) };
+    }
+  }
+  function implemented(capability) {
+    return ["files", "descriptors", "pipes", "readiness", "time", "identity", "entropy"].includes(capability);
+  }
+  function resolve2(path) {
+    if (path.startsWith("/")) return proc.vfs.resolvePath(path);
+    return proc.vfs.resolvePath(`${proc.cwd.replace(/\/$/, "")}/${path}`);
+  }
+  function clamp(length) {
+    return Math.min(length, MAX_TRANSFER);
+  }
+  async function readBlocking(description, length) {
+    for (; ; ) {
+      try {
+        return description.read(length);
+      } catch (error) {
+        const posix = toPosixError(error);
+        if (posix.errno !== Errno.EAGAIN || description.flags & O_NONBLOCK) throw posix;
+      }
+      await Promise.race([description.whenReady(), aborted()]);
+      if (proc.signal.aborted) throw new PosixError(Errno.EINTR);
+    }
+  }
+  async function writeBlocking(description, data) {
+    for (; ; ) {
+      try {
+        return description.write(data);
+      } catch (error) {
+        const posix = toPosixError(error);
+        if (posix.errno !== Errno.EAGAIN || description.flags & O_NONBLOCK) throw posix;
+      }
+      await Promise.race([description.whenReady(), aborted()]);
+      if (proc.signal.aborted) throw new PosixError(Errno.EINTR);
+    }
+  }
+  const POLLIN = 1;
+  const POLLOUT = 4;
+  const POLLHUP = 16;
+  async function poll(requests, timeoutMs) {
+    const deadline = timeoutMs < 0 ? Infinity : Date.now() + timeoutMs;
+    for (; ; ) {
+      const ready = [];
+      const waits = [];
+      for (const { fd, events } of requests) {
+        let description;
+        try {
+          description = proc.table.get(fd);
+        } catch {
+          ready.push({ fd, revents: POLLHUP });
+          continue;
+        }
+        let revents = 0;
+        if (events & POLLIN && description.readable()) revents |= POLLIN;
+        if (events & POLLOUT && description.writable()) revents |= POLLOUT;
+        if (revents) ready.push({ fd, revents });
+        else waits.push(description.whenReady());
+      }
+      if (ready.length > 0) return ready;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) return [];
+      await Promise.race([...waits, sleep(Math.min(remaining, 50)), aborted()]);
+      if (proc.signal.aborted) throw new PosixError(Errno.EINTR);
+    }
+  }
+  function aborted() {
+    if (proc.signal.aborted) return Promise.resolve();
+    return new Promise((resolve3) => proc.signal.addEventListener("abort", () => resolve3(), { once: true }));
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, Math.max(0, ms)));
+}
+function encodeStat(st) {
+  return new Writer().u64(st.ino).u32(st.mode).u64(st.size).u32(st.uid).u32(st.gid).u32(st.nlink).i64(Math.round(st.atimeMs * 1e6)).i64(Math.round(st.mtimeMs * 1e6)).i64(Math.round(st.ctimeMs * 1e6)).finish();
+}
+
+// src/runtime/python/syscall-client.ts
+var HostAbiError = class extends Error {
+  errno;
+  code;
+  constructor(errno, op) {
+    const name = ERRNO_NAMES[errno] ?? String(errno);
+    super(`${OP_NAMES[op] ?? `op ${op}`} failed: ${name}`);
+    this.errno = errno;
+    this.code = name;
+  }
+};
+var HostAbiClient = class {
+  transport;
+  generation;
+  nextRequestId = 1;
+  constructor(transport, generation) {
+    this.transport = transport;
+    this.generation = generation;
+  }
+  /** Send one frame, blocking. Returns the status and payload verbatim. */
+  callRaw(op, payload) {
+    const header = {
+      version: SBX_HOST_ABI_VERSION,
+      op,
+      requestId: this.nextRequestId++,
+      generation: this.generation
+    };
+    const frame = this.transport.call(encodeRequest(header, payload));
+    const response = decodeResponse(frame, header);
+    return { status: response.status, payload: response.payload };
+  }
+  /** As {@link callRaw}, but a negative status becomes an exception. */
+  call(op, payload) {
+    const result = this.callRaw(op, payload);
+    if (result.status < 0) throw new HostAbiError(-result.status, op);
+    return result;
+  }
+  handshake() {
+    const { payload } = this.call(Op.handshake, new Uint8Array());
+    const r = new Reader(payload);
+    const version = r.u32();
+    const count = r.u32();
+    const capabilities = {};
+    for (let i = 0; i < count; i += 1) capabilities[r.string()] = r.u32() === 1;
+    return { version, capabilities };
+  }
+  open(path, flags, mode = 438) {
+    return this.call(Op.openat, new Writer().string(path).u32(flags).u32(mode).finish()).status;
+  }
+  close(fd) {
+    this.call(Op.close, new Writer().i32(fd).finish());
+  }
+  read(fd, length) {
+    return this.call(Op.read, new Writer().i32(fd).u32(length).finish()).payload;
+  }
+  write(fd, data) {
+    return this.call(Op.write, new Writer().i32(fd).bytes32(data).finish()).status;
+  }
+  /** Write every byte, looping over short writes the way a guest's libc must. */
+  writeAll(fd, data) {
+    let at = 0;
+    while (at < data.length) at += this.write(fd, data.subarray(at));
+  }
+  pread(fd, length, offset) {
+    return this.call(Op.pread, new Writer().i32(fd).u32(length).u64(offset).finish()).payload;
+  }
+  pwrite(fd, data, offset) {
+    return this.call(Op.pwrite, new Writer().i32(fd).bytes32(data).u64(offset).finish()).status;
+  }
+  seek(fd, offset, whence) {
+    const { payload } = this.call(Op.lseek, new Writer().i32(fd).i64(offset).u32(whence).finish());
+    return new Reader(payload).i64();
+  }
+  fstat(fd) {
+    return decodeStat(this.call(Op.fstat, new Writer().i32(fd).finish()).payload);
+  }
+  stat(path, followLinks = true) {
+    return decodeStat(
+      this.call(Op.statat, new Writer().string(path).u32(followLinks ? 1 : 0).finish()).payload
+    );
+  }
+  ftruncate(fd, length) {
+    this.call(Op.ftruncate, new Writer().i32(fd).u64(length).finish());
+  }
+  rename(from, to) {
+    this.call(Op.renameat, new Writer().string(from).string(to).finish());
+  }
+  unlink(path, removeDirectory = false) {
+    this.call(Op.unlinkat, new Writer().string(path).u32(removeDirectory ? 1 : 0).finish());
+  }
+  mkdir(path, mode = 511) {
+    this.call(Op.mkdirat, new Writer().string(path).u32(mode).finish());
+  }
+  readdir(fd, bufferSize = 4096) {
+    const { payload } = this.call(Op.getdents, new Writer().i32(fd).u32(bufferSize).finish());
+    const text = new TextDecoder().decode(payload);
+    return text.split("\0").filter((name) => name.length > 0);
+  }
+  dup(fd, from = 0) {
+    return this.call(Op.dup, new Writer().i32(fd).u32(from).finish()).status;
+  }
+  dup2(fd, target) {
+    return this.call(Op.dup2, new Writer().i32(fd).i32(target).finish()).status;
+  }
+  getFlags(fd) {
+    const r = new Reader(this.call(Op.get_flags, new Writer().i32(fd).finish()).payload);
+    return { flags: r.u32(), cloexec: r.u32() === 1 };
+  }
+  setFlags(fd, flags, cloexec) {
+    this.call(Op.set_flags, new Writer().i32(fd).u32(flags).u32(cloexec ? 1 : 0).finish());
+  }
+  pipe(flags = 0) {
+    const r = new Reader(this.call(Op.pipe, new Writer().u32(flags).finish()).payload);
+    return [r.i32(), r.i32()];
+  }
+  poll(entries, timeoutMs) {
+    const w = new Writer().u32(entries.length);
+    for (const entry of entries) w.i32(entry.fd).u32(entry.events);
+    w.i64(timeoutMs);
+    const r = new Reader(this.call(Op.poll, w.finish()).payload);
+    const count = r.u32();
+    const out = [];
+    for (let i = 0; i < count; i += 1) out.push({ fd: r.i32(), revents: r.u32() });
+    return out;
+  }
+  clockGettime(monotonic) {
+    const r = new Reader(this.call(Op.clock_gettime, new Writer().u32(monotonic ? 1 : 0).finish()).payload);
+    return { seconds: r.i64(), nanos: r.u32() };
+  }
+  sleep(nanos) {
+    this.call(Op.sleep, new Writer().u64(nanos).finish());
+  }
+  identity() {
+    const r = new Reader(this.call(Op.getpid, new Uint8Array()).payload);
+    return { pid: r.i32(), ppid: r.i32(), uid: r.u32(), gid: r.u32(), umask: r.u32() };
+  }
+  getcwd() {
+    return new Reader(this.call(Op.getcwd, new Uint8Array()).payload).string();
+  }
+  chdir(path) {
+    this.call(Op.chdir, new Writer().string(path).finish());
+  }
+  environ() {
+    const joined = new Reader(this.call(Op.environ, new Uint8Array()).payload).string();
+    const out = {};
+    for (const entry of joined.split("\0")) {
+      if (!entry) continue;
+      const split = entry.indexOf("=");
+      out[entry.slice(0, split)] = entry.slice(split + 1);
+    }
+    return out;
+  }
+  getrandom(length) {
+    return this.call(Op.getrandom, new Writer().u32(length).finish()).payload;
+  }
+};
+function decodeStat(payload) {
+  const r = new Reader(payload);
+  return {
+    ino: r.u64(),
+    mode: r.u32(),
+    size: r.u64(),
+    uid: r.u32(),
+    gid: r.u32(),
+    nlink: r.u32(),
+    atimeNs: r.i64(),
+    mtimeNs: r.i64(),
+    ctimeNs: r.i64()
+  };
+}
+
+// src/fs/errno.ts
+var ERRNO = {
+  EPERM: 1,
+  ENOENT: 2,
+  ESRCH: 3,
+  EINTR: 4,
+  EIO: 5,
+  ENXIO: 6,
+  E2BIG: 7,
+  ENOEXEC: 8,
+  EBADF: 9,
+  ECHILD: 10,
+  EAGAIN: 11,
+  ENOMEM: 12,
+  EACCES: 13,
+  EFAULT: 14,
+  ENOTBLK: 15,
+  EBUSY: 16,
+  EEXIST: 17,
+  EXDEV: 18,
+  ENODEV: 19,
+  ENOTDIR: 20,
+  EISDIR: 21,
+  EINVAL: 22,
+  ENFILE: 23,
+  EMFILE: 24,
+  ENOTTY: 25,
+  ETXTBSY: 26,
+  EFBIG: 27,
+  ENOSPC: 28,
+  ESPIPE: 29,
+  EROFS: 30,
+  EMLINK: 31,
+  EPIPE: 32,
+  EDOM: 33,
+  ERANGE: 34,
+  EDEADLK: 35,
+  ENAMETOOLONG: 36,
+  ENOLCK: 37,
+  ENOSYS: 38,
+  ENOTEMPTY: 39,
+  ELOOP: 40,
+  ENOMSG: 42,
+  ENOTSOCK: 88,
+  EADDRINUSE: 98,
+  EADDRNOTAVAIL: 99,
+  ENETDOWN: 100,
+  ECONNRESET: 104,
+  ENOTCONN: 107,
+  ETIMEDOUT: 110,
+  ECONNREFUSED: 111,
+  EHOSTUNREACH: 113,
+  ENOTSUP: 95
+};
+var STRERROR = {
+  EPERM: "Operation not permitted",
+  ENOENT: "No such file or directory",
+  ESRCH: "No such process",
+  EINTR: "Interrupted system call",
+  EIO: "Input/output error",
+  ENXIO: "No such device or address",
+  E2BIG: "Argument list too long",
+  ENOEXEC: "Exec format error",
+  EBADF: "Bad file descriptor",
+  ECHILD: "No child processes",
+  EAGAIN: "Resource temporarily unavailable",
+  ENOMEM: "Cannot allocate memory",
+  EACCES: "Permission denied",
+  EFAULT: "Bad address",
+  ENOTBLK: "Block device required",
+  EBUSY: "Device or resource busy",
+  EEXIST: "File exists",
+  EXDEV: "Invalid cross-device link",
+  ENODEV: "No such device",
+  ENOTDIR: "Not a directory",
+  EISDIR: "Is a directory",
+  EINVAL: "Invalid argument",
+  ENFILE: "Too many open files in system",
+  EMFILE: "Too many open files",
+  ENOTTY: "Inappropriate ioctl for device",
+  ETXTBSY: "Text file busy",
+  EFBIG: "File too large",
+  ENOSPC: "No space left on device",
+  ESPIPE: "Illegal seek",
+  EROFS: "Read-only file system",
+  EMLINK: "Too many links",
+  EPIPE: "Broken pipe",
+  EDOM: "Numerical argument out of domain",
+  ERANGE: "Numerical result out of range",
+  EDEADLK: "Resource deadlock avoided",
+  ENAMETOOLONG: "File name too long",
+  ENOLCK: "No locks available",
+  ENOSYS: "Function not implemented",
+  ENOTEMPTY: "Directory not empty",
+  ELOOP: "Too many levels of symbolic links",
+  ENOMSG: "No message of desired type",
+  ENOTSOCK: "Socket operation on non-socket",
+  EADDRINUSE: "Address already in use",
+  EADDRNOTAVAIL: "Cannot assign requested address",
+  ENETDOWN: "Network is down",
+  ECONNRESET: "Connection reset by peer",
+  ENOTCONN: "Transport endpoint is not connected",
+  ETIMEDOUT: "Connection timed out",
+  ECONNREFUSED: "Connection refused",
+  EHOSTUNREACH: "No route to host",
+  ENOTSUP: "Operation not supported"
+};
+var SysError = class extends Error {
+  code;
+  errno;
+  syscall;
+  path;
+  dest;
+  constructor(code, syscall, path, dest) {
+    const detail = path === void 0 ? "" : dest === void 0 ? ` '${path}'` : ` '${path}' -> '${dest}'`;
+    super(`${code}: ${STRERROR[code]}, ${syscall}${detail}`);
+    this.name = "SysError";
+    this.code = code;
+    this.errno = -ERRNO[code];
+    this.syscall = syscall;
+    if (path !== void 0) this.path = path;
+    if (dest !== void 0) this.dest = dest;
+  }
+  /** The message a coreutil prints: `ls: /nope: No such file or directory`. */
+  toUserMessage(program, subject = this.path) {
+    return subject ? `${program}: ${subject}: ${STRERROR[this.code]}` : `${program}: ${STRERROR[this.code]}`;
+  }
+};
+function toSysError(e, syscall, path, dest) {
+  if (e instanceof SysError) return e;
+  const code = e?.code;
+  if (code && code in ERRNO) return new SysError(code, syscall, path, dest);
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/not a directory/i.test(msg)) return new SysError("ENOTDIR", syscall, path);
+  if (/no such file|not found/i.test(msg)) return new SysError("ENOENT", syscall, path);
+  if (/exists/i.test(msg)) return new SysError("EEXIST", syscall, path);
+  if (/directory not empty/i.test(msg)) return new SysError("ENOTEMPTY", syscall, path);
+  if (/is a directory/i.test(msg)) return new SysError("EISDIR", syscall, path);
+  return new SysError("EIO", syscall, path);
+}
+
+// src/fs/path.ts
+function isAbsolute(p) {
+  return p.startsWith("/");
+}
+function segments(p) {
+  return p.split("/").filter((s) => s.length > 0);
+}
+function normalize(p) {
+  if (p === "") return ".";
+  const abs = isAbsolute(p);
+  const trailing = p.length > 1 && p.endsWith("/");
+  const out = [];
+  for (const seg of p.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (out.length > 0 && out[out.length - 1] !== "..") out.pop();
+      else if (!abs) out.push("..");
+      continue;
+    }
+    out.push(seg);
+  }
+  let result = out.join("/");
+  if (abs) result = "/" + result;
+  else if (result === "") result = ".";
+  if (trailing && !result.endsWith("/")) result += "/";
+  return result === "" ? "/" : result;
+}
+function join(...parts) {
+  const joined = parts.filter((p) => p !== "").join("/");
+  return joined === "" ? "." : normalize(joined);
+}
+function resolve(base, ...parts) {
+  let resolved = "";
+  let absolute = false;
+  for (let i = parts.length - 1; i >= 0 && !absolute; i--) {
+    const part = parts[i];
+    if (part === "") continue;
+    resolved = resolved === "" ? part : `${part}/${resolved}`;
+    absolute = isAbsolute(part);
+  }
+  if (!absolute) {
+    resolved = resolved === "" ? base : `${base}/${resolved}`;
+  }
+  const norm = normalize(resolved);
+  return isAbsolute(norm) ? stripTrailing(norm) : stripTrailing(normalize(`/${norm}`));
+}
+function stripTrailing(p) {
+  return p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+}
+function dirname(p) {
+  const norm = stripTrailing(normalize(p));
+  if (norm === "/") return "/";
+  const idx = norm.lastIndexOf("/");
+  if (idx < 0) return ".";
+  if (idx === 0) return "/";
+  return norm.slice(0, idx);
+}
+function basename(p, ext) {
+  const norm = stripTrailing(normalize(p));
+  if (norm === "/") return "/";
+  const idx = norm.lastIndexOf("/");
+  let base = idx < 0 ? norm : norm.slice(idx + 1);
+  return base;
+}
+function contains(parent, child) {
+  const p = stripTrailing(normalize(parent));
+  const c = stripTrailing(normalize(child));
+  if (p === "/") return true;
+  return c === p || c.startsWith(p + "/");
+}
+function clean(p) {
+  return stripTrailing(normalize(p));
+}
+
+// src/fs/mode.ts
+var S_IFMT = 61440;
+var S_IFSOCK = 49152;
+var S_IFLNK = 40960;
+var S_IFREG = 32768;
+var S_IFBLK = 24576;
+var S_IFDIR = 16384;
+var S_IFCHR = 8192;
+var S_IFIFO = 4096;
+var S_IRUSR = 256;
+var S_IWUSR = 128;
+var S_IXUSR = 64;
+var S_IRGRP = 32;
+var S_IWGRP = 16;
+var S_IXGRP = 8;
+var S_IROTH = 4;
+var S_IWOTH = 2;
+var S_IXOTH = 1;
+var PERM_MASK = 4095;
+var F_OK = 0;
+var X_OK = 1;
+var W_OK = 2;
+var R_OK = 4;
+function kindOf(mode) {
+  switch (mode & S_IFMT) {
+    case S_IFDIR:
+      return "directory";
+    case S_IFLNK:
+      return "symlink";
+    case S_IFCHR:
+      return "chardev";
+    case S_IFBLK:
+      return "blockdev";
+    case S_IFIFO:
+      return "fifo";
+    case S_IFSOCK:
+      return "socket";
+    default:
+      return "file";
+  }
+}
+function ifmtFor(kind) {
+  switch (kind) {
+    case "directory":
+      return S_IFDIR;
+    case "symlink":
+      return S_IFLNK;
+    case "chardev":
+      return S_IFCHR;
+    case "blockdev":
+      return S_IFBLK;
+    case "fifo":
+      return S_IFIFO;
+    case "socket":
+      return S_IFSOCK;
+    default:
+      return S_IFREG;
+  }
+}
+
+// src/fs/stat.ts
+var Stats = class {
+  mode;
+  size;
+  uid;
+  gid;
+  ino;
+  nlink;
+  dev;
+  rdev;
+  blksize;
+  atimeMs;
+  mtimeMs;
+  ctimeMs;
+  birthtimeMs;
+  constructor(init) {
+    this.mode = init.mode;
+    this.size = init.size;
+    this.uid = init.uid;
+    this.gid = init.gid;
+    this.ino = init.ino;
+    this.nlink = init.nlink;
+    this.dev = init.dev ?? 2049;
+    this.rdev = init.rdev ?? 0;
+    this.blksize = init.blksize ?? 4096;
+    this.atimeMs = init.atimeMs;
+    this.mtimeMs = init.mtimeMs;
+    this.ctimeMs = init.ctimeMs;
+    this.birthtimeMs = init.birthtimeMs ?? init.ctimeMs;
+  }
+  get blocks() {
+    return Math.ceil(this.size / 512);
+  }
+  get atime() {
+    return new Date(this.atimeMs);
+  }
+  get mtime() {
+    return new Date(this.mtimeMs);
+  }
+  get ctime() {
+    return new Date(this.ctimeMs);
+  }
+  get birthtime() {
+    return new Date(this.birthtimeMs);
+  }
+  get kind() {
+    return kindOf(this.mode);
+  }
+  isFile() {
+    return this.kind === "file";
+  }
+  isDirectory() {
+    return this.kind === "directory";
+  }
+  isSymbolicLink() {
+    return this.kind === "symlink";
+  }
+  isCharacterDevice() {
+    return this.kind === "chardev";
+  }
+  isBlockDevice() {
+    return this.kind === "blockdev";
+  }
+  isFIFO() {
+    return this.kind === "fifo";
+  }
+  isSocket() {
+    return this.kind === "socket";
+  }
+  /** Permission bits only, with the type bits masked off. */
+  get perms() {
+    return this.mode & ~S_IFMT & 4095;
+  }
+};
+
+// src/fs/vfs.ts
+var ROOT_CRED = { uid: 0, gid: 0, groups: [0], umask: 18 };
+function makeCred(uid, gid, groups = [], umask = 18) {
+  return { uid, gid, groups: groups.includes(gid) ? groups : [gid, ...groups], umask };
+}
+var MAX_SYMLINKS = 40;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var Vfs = class {
+  constructor(volume) {
+    this.volume = volume;
+  }
+  volume;
+  providers = [];
+  nextVirtualIno = 983040;
+  virtualInos = /* @__PURE__ */ new Map();
+  // ── virtual providers ────────────────────────────────────────────────────
+  addProvider(provider) {
+    this.providers.push(provider);
+    this.providers.sort((a, b) => b.root.length - a.root.length);
+  }
+  removeProvider(root) {
+    const i = this.providers.findIndex((p) => p.root === root);
+    if (i >= 0) this.providers.splice(i, 1);
+  }
+  /** The mount points currently served synthetically. */
+  get virtualRoots() {
+    return this.providers.map((p) => p.root);
+  }
+  lookupVirtual(abs) {
+    for (const provider of this.providers) {
+      if (abs === provider.root) return provider.resolve("");
+      if (abs.startsWith(provider.root === "/" ? "/" : provider.root + "/")) {
+        const rel = abs.slice(provider.root === "/" ? 1 : provider.root.length + 1);
+        const node = provider.resolve(rel);
+        if (node) return node;
+        if (provider.exclusive !== false) return null;
+      }
+    }
+    return null;
+  }
+  /** True when a miss at `abs` must be ENOENT rather than a volume lookup. */
+  isUnderProvider(abs) {
+    return this.providers.some(
+      (p) => p.exclusive !== false && (abs === p.root || abs.startsWith(p.root + "/"))
+    );
+  }
+  /** Synthetic children a non-exclusive provider contributes to a directory. */
+  virtualChildren(abs) {
+    const out = [];
+    for (const p of this.providers) {
+      if (p.exclusive !== false) continue;
+      if (abs !== p.root && !abs.startsWith(p.root + "/")) continue;
+      const rel = abs === p.root ? "" : abs.slice(p.root.length + 1);
+      const node = p.resolve(rel);
+      if (node?.kind === "directory") out.push(...node.list?.() ?? []);
+    }
+    return out;
+  }
+  virtualIno(abs) {
+    let ino = this.virtualInos.get(abs);
+    if (ino === void 0) {
+      ino = this.nextVirtualIno++;
+      this.virtualInos.set(abs, ino);
+    }
+    return ino;
+  }
+  // ── permission model ─────────────────────────────────────────────────────
+  /** True when `cred` may perform `mode` (R_OK/W_OK/X_OK) on a stat result. */
+  permitted(st, mode, cred) {
+    if (mode === F_OK) return true;
+    if (cred.uid === 0) {
+      if ((mode & X_OK) !== 0 && !st.isDirectory()) {
+        return (st.mode & (S_IXUSR | S_IXGRP | S_IXOTH)) !== 0;
+      }
+      return true;
+    }
+    let bits;
+    if (st.uid === cred.uid) bits = (st.mode & (S_IRUSR | S_IWUSR | S_IXUSR)) >> 6;
+    else if (cred.groups.includes(st.gid)) bits = (st.mode & (S_IRGRP | S_IWGRP | S_IXGRP)) >> 3;
+    else bits = st.mode & (S_IROTH | S_IWOTH | S_IXOTH);
+    return (bits & mode) === mode;
+  }
+  require(st, mode, cred, syscall, path) {
+    if (!cred) return;
+    if (!this.permitted(st, mode, cred)) throw new SysError("EACCES", syscall, path);
+  }
+  // ── path resolution ──────────────────────────────────────────────────────
+  /**
+   * Walk `abs` component by component, following symlinks and checking search
+   * (`+x`) permission on every directory along the way, exactly like `namei`.
+   *
+   * Returns the fully resolved absolute path. Does *not* require the final
+   * component to exist — callers decide whether a miss is fatal.
+   */
+  resolvePath(abs, opts = {}) {
+    const { cred, followFinal = true } = opts;
+    const parts = segments(normalize(abs));
+    let current = "";
+    let hops = 0;
+    for (let i = 0; i < parts.length; i++) {
+      const isFinal = i === parts.length - 1;
+      const next = `${current}/${parts[i]}`;
+      if (cred && current !== "") {
+        const parentStat = this.tryLstat(current);
+        if (parentStat && parentStat.isDirectory() && !this.permitted(parentStat, X_OK, cred)) {
+          throw new SysError("EACCES", "open", abs);
+        }
+      }
+      const st = this.tryLstat(next);
+      if (st?.isSymbolicLink() && (!isFinal || followFinal)) {
+        if (++hops > MAX_SYMLINKS) throw new SysError("ELOOP", "open", abs);
+        const target = this.readlinkRaw(next);
+        const resolved = isAbsolute(target) ? target : resolve(current === "" ? "/" : current, target);
+        const rest = parts.slice(i + 1);
+        const combined = rest.length ? `${resolved}/${rest.join("/")}` : resolved;
+        return this.resolvePath(combined, { ...opts, cred });
+      }
+      current = next;
+      if (!isFinal && st && !st.isDirectory()) throw new SysError("ENOTDIR", "open", abs);
+    }
+    return current === "" ? "/" : current;
+  }
+  /** lstat that returns null instead of throwing, for internal probing. */
+  tryLstat(abs) {
+    try {
+      return this.lstat(abs);
+    } catch {
+      return null;
+    }
+  }
+  readlinkRaw(abs) {
+    const virt = this.lookupVirtual(abs);
+    if (virt) {
+      if (virt.kind !== "symlink" || virt.target === void 0) throw new SysError("EINVAL", "readlink", abs);
+      return virt.target;
+    }
+    try {
+      return this.volume.readlinkSync(abs);
+    } catch (e) {
+      throw toSysError(e, "readlink", abs);
+    }
+  }
+  // ── metadata ─────────────────────────────────────────────────────────────
+  /** stat(2) — follows symlinks. */
+  stat(abs, opts = {}) {
+    const real = this.resolvePath(abs, { cred: opts.cred, followFinal: true });
+    return this.lstat(real);
+  }
+  /** lstat(2) — does not follow a symlink in the final position. */
+  lstat(abs) {
+    const path = clean(abs);
+    const virt = this.lookupVirtual(path);
+    if (virt) return this.statFromVirtual(path, virt);
+    if (this.isUnderProvider(path)) throw new SysError("ENOENT", "lstat", path);
+    let raw;
+    try {
+      raw = this.volume.lstatSync(path);
+    } catch (e) {
+      throw toSysError(e, "lstat", path);
+    }
+    const kind = raw.isSymbolicLink() ? "symlink" : raw.isDirectory() ? "directory" : "file";
+    return new Stats({
+      mode: ifmtFor(kind) | raw.mode & PERM_MASK,
+      size: raw.size,
+      uid: raw.uid ?? 0,
+      gid: raw.gid ?? 0,
+      ino: raw.ino,
+      nlink: raw.nlink,
+      atimeMs: raw.atimeMs,
+      mtimeMs: raw.mtimeMs,
+      ctimeMs: raw.ctimeMs,
+      birthtimeMs: raw.birthtimeMs
+    });
+  }
+  statFromVirtual(abs, node) {
+    let size = node.size ?? 0;
+    if (size === 0 && node.read && node.kind === "file") {
+      try {
+        const data = node.read();
+        size = typeof data === "string" ? encoder.encode(data).length : data.length;
+      } catch {
+        size = 0;
+      }
+    }
+    const now = node.mtimeMs ?? Date.now();
+    return new Stats({
+      mode: ifmtFor(node.kind) | node.mode & PERM_MASK,
+      size,
+      uid: node.uid ?? 0,
+      gid: node.gid ?? 0,
+      ino: this.virtualIno(abs),
+      nlink: node.kind === "directory" ? 2 : 1,
+      atimeMs: now,
+      mtimeMs: now,
+      ctimeMs: now
+    });
+  }
+  exists(abs, cred) {
+    try {
+      this.stat(abs, { cred });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  lexists(abs) {
+    try {
+      this.lstat(abs);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  access(abs, mode = F_OK, cred) {
+    const st = this.stat(abs, { cred });
+    if (cred && !this.permitted(st, mode, cred)) throw new SysError("EACCES", "access", abs);
+  }
+  realpath(abs, cred) {
+    const real = this.resolvePath(abs, { cred, followFinal: true });
+    this.lstat(real);
+    return real;
+  }
+  // ── reading ──────────────────────────────────────────────────────────────
+  readFile(abs, cred) {
+    const real = this.resolvePath(abs, { cred });
+    const virt = this.lookupVirtual(real);
+    if (virt) {
+      if (virt.kind === "directory") throw new SysError("EISDIR", "read", real);
+      if (!virt.read) throw new SysError("EACCES", "read", real);
+      this.require(this.statFromVirtual(real, virt), R_OK, cred, "open", real);
+      const data = virt.read();
+      return typeof data === "string" ? encoder.encode(data) : data;
+    }
+    if (this.isUnderProvider(real)) throw new SysError("ENOENT", "open", real);
+    const st = this.lstat(real);
+    if (st.isDirectory()) throw new SysError("EISDIR", "read", real);
+    this.require(st, R_OK, cred, "open", real);
+    try {
+      return this.volume.readFileSync(real);
+    } catch (e) {
+      throw toSysError(e, "open", real);
+    }
+  }
+  readText(abs, cred) {
+    return decoder.decode(this.readFile(abs, cred));
+  }
+  readdir(abs, cred) {
+    const real = this.resolvePath(abs, { cred });
+    const names = /* @__PURE__ */ new Set();
+    const virt = this.lookupVirtual(real);
+    if (virt) {
+      if (virt.kind !== "directory") throw new SysError("ENOTDIR", "scandir", real);
+      this.require(this.statFromVirtual(real, virt), R_OK, cred, "scandir", real);
+      for (const name of virt.list?.() ?? []) names.add(name);
+    } else if (this.isUnderProvider(real)) {
+      throw new SysError("ENOENT", "scandir", real);
+    }
+    const hasReal = this.volumeHasDir(real);
+    if (hasReal) {
+      const st = this.lstat(real);
+      if (!virt) {
+        if (!st.isDirectory()) throw new SysError("ENOTDIR", "scandir", real);
+        this.require(st, R_OK, cred, "scandir", real);
+      }
+      try {
+        for (const name of this.volume.readdirSync(real)) names.add(name);
+      } catch (e) {
+        if (!virt) throw toSysError(e, "scandir", real);
+      }
+    } else if (!virt) {
+      const st = this.lstat(real);
+      if (!st.isDirectory()) throw new SysError("ENOTDIR", "scandir", real);
+      throw new SysError("ENOENT", "scandir", real);
+    }
+    for (const p of this.providers) {
+      if (dirname(p.root) === real) names.add(basename(p.root));
+    }
+    for (const name of this.virtualChildren(real)) names.add(name);
+    return [...names].sort();
+  }
+  /** True when the volume itself has a real directory at `abs`. */
+  volumeHasDir(abs) {
+    try {
+      return this.volume.lstatSync(abs).isDirectory();
+    } catch {
+      return false;
+    }
+  }
+  readdirWithTypes(abs, cred) {
+    const real = this.resolvePath(abs, { cred });
+    return this.readdir(real, cred).map((name) => {
+      try {
+        return { name, kind: this.lstat(join(real, name)).kind };
+      } catch {
+        return { name, kind: "file" };
+      }
+    });
+  }
+  readlink(abs, cred) {
+    const real = this.resolvePath(abs, { cred, followFinal: false });
+    const st = this.lstat(real);
+    if (!st.isSymbolicLink()) throw new SysError("EINVAL", "readlink", real);
+    return this.readlinkRaw(real);
+  }
+  // ── writing ──────────────────────────────────────────────────────────────
+  writeFile(abs, data, opts = {}) {
+    const cred = opts.privileged ? void 0 : opts.cred;
+    const real = this.resolvePath(abs, { cred });
+    const bytes = typeof data === "string" ? encoder.encode(data) : data;
+    const virt = this.lookupVirtual(real);
+    if (virt) {
+      if (!virt.write) throw new SysError("EACCES", "write", real);
+      this.require(this.statFromVirtual(real, virt), W_OK, cred, "open", real);
+      virt.write(bytes, opts.append ?? false);
+      return;
+    }
+    if (this.isUnderProvider(real)) throw new SysError("ENOENT", "open", real);
+    const existing = this.tryLstat(real);
+    if (existing) {
+      if (existing.isDirectory()) throw new SysError("EISDIR", "open", real);
+      this.require(existing, W_OK, cred, "open", real);
+    } else {
+      const parent = dirname(real);
+      const pst = this.lstat(parent);
+      if (!pst.isDirectory()) throw new SysError("ENOTDIR", "open", real);
+      this.require(pst, W_OK | X_OK, cred, "open", real);
+    }
+    try {
+      if (opts.append && existing) this.volume.appendFileSync(real, bytes);
+      else this.volume.writeFileSync(real, bytes);
+    } catch (e) {
+      throw toSysError(e, "open", real);
+    }
+    if (!existing) {
+      const mode = (opts.mode ?? 438) & ~(opts.cred?.umask ?? 0);
+      this.volume.chmodSync(real, mode & PERM_MASK);
+      this.volume.chownSync(real, opts.cred?.uid ?? 0, opts.cred?.gid ?? 0);
+    } else if (opts.mode !== void 0) {
+      this.volume.chmodSync(real, opts.mode & PERM_MASK);
+    }
+  }
+  appendFile(abs, data, opts = {}) {
+    this.writeFile(abs, data, { ...opts, append: true });
+  }
+  truncate(abs, len = 0, cred) {
+    const real = this.resolvePath(abs, { cred });
+    const st = this.lstat(real);
+    if (st.isDirectory()) throw new SysError("EISDIR", "truncate", real);
+    this.require(st, W_OK, cred, "truncate", real);
+    try {
+      this.volume.truncateSync(real, len);
+    } catch (e) {
+      throw toSysError(e, "truncate", real);
+    }
+  }
+  mkdir(abs, opts = {}) {
+    const cred = opts.cred;
+    const mode = (opts.mode ?? 511) & ~(cred?.umask ?? 0) & PERM_MASK;
+    const real = this.resolvePath(abs, { cred, followFinal: false });
+    if (opts.recursive) {
+      const parts = segments(real);
+      let cur = "";
+      for (const part of parts) {
+        cur += "/" + part;
+        const st = this.tryLstat(cur);
+        if (st) {
+          if (!st.isDirectory()) throw new SysError("ENOTDIR", "mkdir", cur);
+          continue;
+        }
+        this.mkdirOne(cur, mode, cred);
+      }
+      return;
+    }
+    if (this.lexists(real)) throw new SysError("EEXIST", "mkdir", real);
+    this.mkdirOne(real, mode, cred);
+  }
+  mkdirOne(abs, mode, cred) {
+    const parent = dirname(abs);
+    const pst = this.lstat(parent);
+    if (!pst.isDirectory()) throw new SysError("ENOTDIR", "mkdir", abs);
+    this.require(pst, W_OK | X_OK, cred, "mkdir", abs);
+    try {
+      this.volume.mkdirSync(abs, { mode });
+    } catch (e) {
+      throw toSysError(e, "mkdir", abs);
+    }
+    this.volume.chmodSync(abs, mode);
+    this.volume.chownSync(abs, cred?.uid ?? 0, cred?.gid ?? 0);
+  }
+  rmdir(abs, cred) {
+    const real = this.resolvePath(abs, { cred, followFinal: false });
+    const st = this.lstat(real);
+    if (!st.isDirectory()) throw new SysError("ENOTDIR", "rmdir", real);
+    if (this.readdir(real).length > 0) throw new SysError("ENOTEMPTY", "rmdir", real);
+    this.requireParentWrite(real, cred, "rmdir");
+    try {
+      this.volume.rmdirSync(real);
+    } catch (e) {
+      throw toSysError(e, "rmdir", real);
+    }
+  }
+  unlink(abs, cred) {
+    const real = this.resolvePath(abs, { cred, followFinal: false });
+    const st = this.lstat(real);
+    if (st.isDirectory()) throw new SysError("EISDIR", "unlink", real);
+    this.requireParentWrite(real, cred, "unlink");
+    if (this.isUnderProvider(real)) throw new SysError("EPERM", "unlink", real);
+    try {
+      this.volume.unlinkSync(real);
+    } catch (e) {
+      throw toSysError(e, "unlink", real);
+    }
+  }
+  /** Recursive delete, the engine behind `rm -r`. */
+  rmrf(abs, cred) {
+    const real = this.resolvePath(abs, { cred, followFinal: false });
+    const st = this.lstat(real);
+    if (!st.isDirectory()) {
+      this.unlink(real, cred);
+      return;
+    }
+    for (const name of this.readdir(real, cred)) {
+      this.rmrf(join(real, name), cred);
+    }
+    this.rmdir(real, cred);
+  }
+  requireParentWrite(abs, cred, syscall) {
+    if (!cred) return;
+    const parent = dirname(abs);
+    const pst = this.lstat(parent);
+    this.require(pst, W_OK | X_OK, cred, syscall, abs);
+    if ((pst.mode & 512) !== 0 && cred.uid !== 0) {
+      const st = this.lstat(abs);
+      if (st.uid !== cred.uid && pst.uid !== cred.uid) throw new SysError("EPERM", syscall, abs);
+    }
+  }
+  rename(from, to, cred) {
+    const src = this.resolvePath(from, { cred, followFinal: false });
+    const dst = this.resolvePath(to, { cred, followFinal: false });
+    if (src === dst) return;
+    this.lstat(src);
+    if (contains(src, dst) && src !== dst) throw new SysError("EINVAL", "rename", src, dst);
+    this.requireParentWrite(src, cred, "rename");
+    const dstParent = dirname(dst);
+    const dpst = this.lstat(dstParent);
+    this.require(dpst, W_OK | X_OK, cred, "rename", dst);
+    try {
+      this.volume.renameSync(src, dst);
+    } catch (e) {
+      throw toSysError(e, "rename", src);
+    }
+  }
+  copyFile(from, to, cred) {
+    const data = this.readFile(from, cred);
+    const st = this.stat(from, { cred });
+    this.writeFile(to, data, { cred, mode: st.perms });
+    this.chmod(to, st.perms, cred);
+  }
+  symlink(target, linkPath, cred) {
+    const real = this.resolvePath(linkPath, { cred, followFinal: false });
+    if (this.lexists(real)) throw new SysError("EEXIST", "symlink", real);
+    const parent = dirname(real);
+    const pst = this.lstat(parent);
+    this.require(pst, W_OK | X_OK, cred, "symlink", real);
+    try {
+      this.volume.symlinkSync(target, real);
+    } catch (e) {
+      throw toSysError(e, "symlink", real);
+    }
+    this.volume.lchownSync(real, cred?.uid ?? 0, cred?.gid ?? 0);
+  }
+  link(existing, newPath, cred) {
+    const src = this.resolvePath(existing, { cred });
+    const dst = this.resolvePath(newPath, { cred, followFinal: false });
+    const st = this.lstat(src);
+    if (st.isDirectory()) throw new SysError("EPERM", "link", src);
+    if (this.lexists(dst)) throw new SysError("EEXIST", "link", dst);
+    const pst = this.lstat(dirname(dst));
+    this.require(pst, W_OK | X_OK, cred, "link", dst);
+    try {
+      this.volume.linkSync(src, dst);
+    } catch (e) {
+      throw toSysError(e, "link", src, dst);
+    }
+  }
+  chmod(abs, mode, cred, follow = true) {
+    const real = this.resolvePath(abs, { cred, followFinal: follow });
+    const st = this.lstat(real);
+    if (cred && cred.uid !== 0 && st.uid !== cred.uid) throw new SysError("EPERM", "chmod", real);
+    try {
+      if (st.isSymbolicLink()) this.volume.lchmodSync(real, mode & PERM_MASK);
+      else this.volume.chmodSync(real, mode & PERM_MASK);
+    } catch (e) {
+      throw toSysError(e, "chmod", real);
+    }
+  }
+  chown(abs, uid, gid, cred, follow = true) {
+    const real = this.resolvePath(abs, { cred, followFinal: follow });
+    const st = this.lstat(real);
+    if (cred && cred.uid !== 0) {
+      if (uid !== -1 && uid !== st.uid) throw new SysError("EPERM", "chown", real);
+      if (gid !== -1 && !cred.groups.includes(gid)) throw new SysError("EPERM", "chown", real);
+      if (st.uid !== cred.uid) throw new SysError("EPERM", "chown", real);
+    }
+    const nextUid = uid === -1 ? st.uid : uid;
+    const nextGid = gid === -1 ? st.gid : gid;
+    try {
+      if (st.isSymbolicLink()) this.volume.lchownSync(real, nextUid, nextGid);
+      else this.volume.chownSync(real, nextUid, nextGid);
+    } catch (e) {
+      throw toSysError(e, "chown", real);
+    }
+  }
+  utimes(abs, atimeMs, mtimeMs, cred) {
+    const real = this.resolvePath(abs, { cred });
+    try {
+      this.volume.utimesSync(real, new Date(atimeMs), new Date(mtimeMs));
+    } catch (e) {
+      throw toSysError(e, "utimes", real);
+    }
+  }
+  /** `touch` semantics: create when missing, otherwise bump the timestamps. */
+  touch(abs, cred, timeMs = Date.now()) {
+    if (this.lexists(abs)) this.utimes(abs, timeMs, timeMs, cred);
+    else this.writeFile(abs, new Uint8Array(0), { cred, mode: 438 });
+  }
+  // ── bulk helpers ─────────────────────────────────────────────────────────
+  /** Depth-first walk yielding absolute paths. Symlinks are not followed. */
+  *walk(abs, opts = {}) {
+    const { includeSelf = true, cred, maxDepth = Infinity } = opts;
+    const start = clean(abs);
+    if (includeSelf) yield start;
+    const recurse = (dir, depth) => {
+      if (depth > maxDepth) return [];
+      let names;
+      try {
+        names = this.readdir(dir, cred);
+      } catch {
+        return [];
+      }
+      const out = [];
+      for (const name of names) {
+        const child = join(dir, name);
+        out.push(child);
+        let st2 = null;
+        try {
+          st2 = this.lstat(child);
+        } catch {
+        }
+        if (st2?.isDirectory()) out.push(...recurse(child, depth + 1));
+      }
+      return out;
+    };
+    let st = null;
+    try {
+      st = this.lstat(start);
+    } catch {
+      return;
+    }
+    if (st.isDirectory()) yield* recurse(start, 1);
+  }
+  /** Recursive copy used by `cp -r` and the container's `copyIn` helper. */
+  copyTree(from, to, cred) {
+    const st = this.lstat(this.resolvePath(from, { cred, followFinal: false }));
+    if (st.isSymbolicLink()) {
+      this.symlink(this.readlink(from, cred), to, cred);
+      return;
+    }
+    if (!st.isDirectory()) {
+      this.copyFile(from, to, cred);
+      return;
+    }
+    if (!this.lexists(to)) this.mkdir(to, { cred, mode: st.perms, recursive: true });
+    for (const name of this.readdir(from, cred)) {
+      this.copyTree(join(from, name), join(to, name), cred);
+    }
+  }
+  /** Free/used byte accounting for `df` and `du`. */
+  usage(abs = "/") {
+    let files = 0;
+    let dirs = 0;
+    let bytes = 0;
+    for (const p of this.walk(abs)) {
+      let st = null;
+      try {
+        st = this.lstat(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) dirs++;
+      else {
+        files++;
+        bytes += st.size;
+      }
+    }
+    return { files, dirs, bytes };
+  }
+};
+
+// src/runtime/memory-volume.ts
+var VolumeError = class extends Error {
+  constructor(code, operation, path) {
+    super(`${code}: ${operation}, '${path}'`);
+    this.code = code;
+    this.name = "VolumeError";
+  }
+  code;
+};
+var MemoryStat = class {
+  constructor(inode) {
+    this.inode = inode;
+  }
+  inode;
+  get mode() {
+    return this.inode.mode;
+  }
+  get size() {
+    return this.inode.kind === "file" ? this.inode.data.length : this.inode.kind === "symlink" ? new TextEncoder().encode(this.inode.target).length : 0;
+  }
+  get uid() {
+    return this.inode.uid;
+  }
+  get gid() {
+    return this.inode.gid;
+  }
+  get ino() {
+    return this.inode.ino;
+  }
+  get nlink() {
+    return this.inode.nlink;
+  }
+  get atimeMs() {
+    return this.inode.atimeMs;
+  }
+  get mtimeMs() {
+    return this.inode.mtimeMs;
+  }
+  get ctimeMs() {
+    return this.inode.ctimeMs;
+  }
+  get birthtimeMs() {
+    return this.inode.birthtimeMs;
+  }
+  isFile() {
+    return this.inode.kind === "file";
+  }
+  isDirectory() {
+    return this.inode.kind === "directory";
+  }
+  isSymbolicLink() {
+    return this.inode.kind === "symlink";
+  }
+};
+var encoder2 = new TextEncoder();
+var MemoryVolume = class {
+  entries = /* @__PURE__ */ new Map();
+  nextIno = 2;
+  constructor() {
+    this.entries.set("/", this.inode("directory", 493));
+  }
+  readFileSync(path) {
+    const key = this.key(path);
+    const node = this.required(key, "open");
+    if (node.kind === "directory") throw new VolumeError("EISDIR", "read", key);
+    if (node.kind !== "file") throw new VolumeError("EINVAL", "read", key);
+    node.atimeMs = Date.now();
+    return node.data.slice();
+  }
+  writeFileSync(path, data) {
+    const key = this.key(path);
+    this.requireParent(key, "open");
+    const bytes = typeof data === "string" ? encoder2.encode(data) : data.slice();
+    const current = this.entries.get(key);
+    if (current?.kind === "directory") throw new VolumeError("EISDIR", "open", key);
+    if (current?.kind === "symlink") throw new VolumeError("EINVAL", "open", key);
+    if (current) {
+      current.data = bytes;
+      this.touchChanged(current, true);
+    } else {
+      this.entries.set(key, this.inode("file", 438, bytes));
+    }
+  }
+  appendFileSync(path, data) {
+    const key = this.key(path);
+    const bytes = typeof data === "string" ? encoder2.encode(data) : data;
+    const current = this.entries.get(key);
+    if (!current) return this.writeFileSync(key, bytes);
+    if (current.kind !== "file") throw new VolumeError(current.kind === "directory" ? "EISDIR" : "EINVAL", "open", key);
+    const next = new Uint8Array(current.data.length + bytes.length);
+    next.set(current.data);
+    next.set(bytes, current.data.length);
+    current.data = next;
+    this.touchChanged(current, true);
+  }
+  readdirSync(path) {
+    const key = this.key(path);
+    const node = this.required(key, "scandir");
+    if (node.kind !== "directory") throw new VolumeError("ENOTDIR", "scandir", key);
+    const prefix = key === "/" ? "/" : `${key}/`;
+    const names = /* @__PURE__ */ new Set();
+    for (const candidate of this.entries.keys()) {
+      if (!candidate.startsWith(prefix) || candidate === key) continue;
+      const rest = candidate.slice(prefix.length);
+      if (rest && !rest.includes("/")) names.add(rest);
+    }
+    node.atimeMs = Date.now();
+    return [...names].sort();
+  }
+  lstatSync(path) {
+    return new MemoryStat(this.required(this.key(path), "lstat"));
+  }
+  readlinkSync(path) {
+    const key = this.key(path);
+    const node = this.required(key, "readlink");
+    if (node.kind !== "symlink") throw new VolumeError("EINVAL", "readlink", key);
+    return node.target;
+  }
+  mkdirSync(path, options = {}) {
+    const key = this.key(path);
+    if (this.entries.has(key)) throw new VolumeError("EEXIST", "mkdir", key);
+    this.requireParent(key, "mkdir");
+    this.entries.set(key, this.inode("directory", options.mode ?? 511));
+  }
+  rmdirSync(path) {
+    const key = this.key(path);
+    if (key === "/") throw new VolumeError("EBUSY", "rmdir", key);
+    const node = this.required(key, "rmdir");
+    if (node.kind !== "directory") throw new VolumeError("ENOTDIR", "rmdir", key);
+    const prefix = `${key}/`;
+    if ([...this.entries.keys()].some((candidate) => candidate.startsWith(prefix))) {
+      throw new VolumeError("ENOTEMPTY", "rmdir", key);
+    }
+    this.entries.delete(key);
+  }
+  unlinkSync(path) {
+    const key = this.key(path);
+    const node = this.required(key, "unlink");
+    if (node.kind === "directory") throw new VolumeError("EISDIR", "unlink", key);
+    this.entries.delete(key);
+    node.nlink--;
+    node.ctimeMs = Date.now();
+  }
+  renameSync(from, to) {
+    const source = this.key(from);
+    const dest = this.key(to);
+    const node = this.required(source, "rename");
+    this.requireParent(dest, "rename");
+    if (source === "/") throw new VolumeError("EBUSY", "rename", source);
+    if (dest.startsWith(`${source}/`)) throw new VolumeError("EINVAL", "rename", source);
+    const existing = this.entries.get(dest);
+    if (existing?.kind === "directory" && this.readdirSync(dest).length > 0) {
+      throw new VolumeError("ENOTEMPTY", "rename", dest);
+    }
+    if (existing) {
+      this.entries.delete(dest);
+      existing.nlink--;
+    }
+    const moved = [...this.entries.entries()].filter(([path]) => path === source || path.startsWith(`${source}/`)).sort(([a], [b]) => a.length - b.length);
+    for (const [path] of moved) this.entries.delete(path);
+    for (const [path, value] of moved) {
+      this.entries.set(dest + path.slice(source.length), value);
+      value.ctimeMs = Date.now();
+    }
+    node.ctimeMs = Date.now();
+  }
+  symlinkSync(target, path) {
+    const key = this.key(path);
+    if (this.entries.has(key)) throw new VolumeError("EEXIST", "symlink", key);
+    this.requireParent(key, "symlink");
+    const node = this.inode("symlink", 511);
+    node.target = target;
+    this.entries.set(key, node);
+  }
+  linkSync(existing, path) {
+    const source = this.key(existing);
+    const dest = this.key(path);
+    const node = this.required(source, "link");
+    if (node.kind === "directory") throw new VolumeError("EPERM", "link", source);
+    if (this.entries.has(dest)) throw new VolumeError("EEXIST", "link", dest);
+    this.requireParent(dest, "link");
+    node.nlink++;
+    node.ctimeMs = Date.now();
+    this.entries.set(dest, node);
+  }
+  truncateSync(path, length = 0) {
+    const key = this.key(path);
+    const node = this.required(key, "truncate");
+    if (node.kind !== "file") throw new VolumeError(node.kind === "directory" ? "EISDIR" : "EINVAL", "truncate", key);
+    const data = new Uint8Array(length);
+    data.set(node.data.subarray(0, length));
+    node.data = data;
+    this.touchChanged(node, true);
+  }
+  chmodSync(path, mode) {
+    this.setMode(path, mode);
+  }
+  lchmodSync(path, mode) {
+    this.setMode(path, mode);
+  }
+  chownSync(path, uid, gid) {
+    this.setOwner(path, uid, gid);
+  }
+  lchownSync(path, uid, gid) {
+    this.setOwner(path, uid, gid);
+  }
+  utimesSync(path, atime, mtime) {
+    const node = this.required(this.key(path), "utimes");
+    node.atimeMs = atime.getTime();
+    node.mtimeMs = mtime.getTime();
+    node.ctimeMs = Date.now();
+  }
+  getStats() {
+    const seen = /* @__PURE__ */ new Set();
+    let totalBytes = 0;
+    let fileCount = 0;
+    let directoryCount = 0;
+    for (const node of this.entries.values()) {
+      if (seen.has(node.ino)) continue;
+      seen.add(node.ino);
+      if (node.kind === "directory") directoryCount++;
+      else {
+        fileCount++;
+        totalBytes += node.kind === "file" ? node.data.length : encoder2.encode(node.target).length;
+      }
+    }
+    return { totalBytes, fileCount, directoryCount, dirCount: directoryCount };
+  }
+  snapshot() {
+    return [...this.entries.entries()].map(([path, node]) => ({ path, ...node, data: [...node.data] }));
+  }
+  restore(snapshot) {
+    const inodes = /* @__PURE__ */ new Map();
+    const entries = /* @__PURE__ */ new Map();
+    for (const item of snapshot) {
+      let inode = inodes.get(item.ino);
+      if (!inode) {
+        inode = { ...item, data: new Uint8Array(item.data) };
+        inodes.set(item.ino, inode);
+      }
+      entries.set(this.key(item.path), inode);
+    }
+    if (!entries.has("/")) throw new VolumeError("EINVAL", "restore", "/");
+    this.entries.clear();
+    for (const [path, inode] of entries) this.entries.set(path, inode);
+    this.nextIno = Math.max(1, ...inodes.keys()) + 1;
+  }
+  /** Serializable representation used by RuntimePod snapshots. */
+  export() {
+    return [...this.entries.entries()].map(([path, node]) => ({
+      path,
+      kind: node.kind,
+      mode: node.mode,
+      uid: node.uid,
+      gid: node.gid,
+      ...node.kind === "file" ? { data: [...node.data] } : {},
+      ...node.kind === "symlink" ? { target: node.target } : {}
+    }));
+  }
+  setMode(path, mode) {
+    const node = this.required(this.key(path), "chmod");
+    node.mode = mode & 4095;
+    node.ctimeMs = Date.now();
+  }
+  setOwner(path, uid, gid) {
+    const node = this.required(this.key(path), "chown");
+    node.uid = uid;
+    node.gid = gid;
+    node.ctimeMs = Date.now();
+  }
+  key(path) {
+    const clean2 = clean(path);
+    if (!isAbsolute(clean2)) throw new VolumeError("EINVAL", "path", path);
+    return clean2;
+  }
+  required(path, operation) {
+    const node = this.entries.get(path);
+    if (!node) throw new VolumeError("ENOENT", operation, path);
+    return node;
+  }
+  requireParent(path, operation) {
+    const parent = this.required(dirname(path), operation);
+    if (parent.kind !== "directory") throw new VolumeError("ENOTDIR", operation, path);
+    return parent;
+  }
+  inode(kind, mode, data = new Uint8Array(0)) {
+    const now = Date.now();
+    return {
+      ino: kind === "directory" && this.entries.size === 0 ? 1 : this.nextIno++,
+      kind,
+      mode: mode & 4095,
+      uid: 0,
+      gid: 0,
+      nlink: 1,
+      data,
+      target: "",
+      atimeMs: now,
+      mtimeMs: now,
+      ctimeMs: now,
+      birthtimeMs: now
+    };
+  }
+  touchChanged(node, modified) {
+    const now = Date.now();
+    node.ctimeMs = now;
+    if (modified) node.mtimeMs = now;
+  }
+};
+
+exports.CAPABILITIES = CAPABILITIES;
+exports.DescriptorTable = DescriptorTable;
+exports.DirectoryDescription = DirectoryDescription;
+exports.ERRNO_NAMES = ERRNO_NAMES;
+exports.Errno = Errno;
+exports.FileDescription = FileDescription;
+exports.FileService = FileService;
+exports.HostAbiClient = HostAbiClient;
+exports.HostAbiError = HostAbiError;
+exports.HostCallClient = HostCallClient;
+exports.HostCallServer = HostCallServer;
+exports.HostTransportError = HostTransportError;
+exports.Inode = Inode;
+exports.MemoryVolume = MemoryVolume;
+exports.OP_NAMES = OP_NAMES;
+exports.O_APPEND = O_APPEND;
+exports.O_CLOEXEC = O_CLOEXEC;
+exports.O_CREAT = O_CREAT;
+exports.O_DIRECTORY = O_DIRECTORY;
+exports.O_EXCL = O_EXCL;
+exports.O_NONBLOCK = O_NONBLOCK;
+exports.O_RDONLY = O_RDONLY;
+exports.O_RDWR = O_RDWR;
+exports.O_TRUNC = O_TRUNC;
+exports.O_WRONLY = O_WRONLY;
+exports.Op = Op;
+exports.PipeReadEnd = PipeReadEnd;
+exports.PipeWriteEnd = PipeWriteEnd;
+exports.PosixError = PosixError;
+exports.ProtocolError = ProtocolError;
+exports.ROOT_CRED = ROOT_CRED;
+exports.Reader = Reader;
+exports.SBX_HOST_ABI_VERSION = SBX_HOST_ABI_VERSION;
+exports.SBX_REQUEST_HEADER_BYTES = SBX_REQUEST_HEADER_BYTES;
+exports.SBX_RESPONSE_HEADER_BYTES = SBX_RESPONSE_HEADER_BYTES;
+exports.SEEK_CUR = SEEK_CUR;
+exports.SEEK_END = SEEK_END;
+exports.SEEK_SET = SEEK_SET;
+exports.StreamDescription = StreamDescription;
+exports.Vfs = Vfs;
+exports.Writer = Writer;
+exports.accessMode = accessMode;
+exports.createHostAbiServer = createHostAbiServer;
+exports.createHostTransportBuffers = createHostTransportBuffers;
+exports.createPipe = createPipe;
+exports.decodeRequest = decodeRequest;
+exports.decodeResponse = decodeResponse;
+exports.encodeRequest = encodeRequest;
+exports.encodeResponse = encodeResponse;
+exports.failure = failure;
+exports.makeCred = makeCred;
+exports.toPosixError = toPosixError;
+//# sourceMappingURL=python-abi.cjs.map
+//# sourceMappingURL=python-abi.cjs.map