sandboxedjs 0.1.73 → 0.1.74

package/dist/worker-entry.js

@@ -12496,7 +12496,7 @@ var require_object_inspect = __commonJS({
       if (depth >= maxDepth && maxDepth > 0 && typeof obj === "object") {
         return isArray2(obj) ? "[Array]" : "[Object]";
       }
-      var indent = getIndent(opts, depth);
+      var indent2 = getIndent(opts, depth);
       if (typeof seen === "undefined") {
         seen = [];
       } else if (indexOf(seen, obj) >= 0) {
@@ -12545,8 +12545,8 @@ var require_object_inspect = __commonJS({
           return "[]";
         }
         var xs = arrObjKeys(obj, inspect2);
-        if (indent && !singleLineValues(xs)) {
-          return "[" + indentedJoin(xs, indent) + "]";
+        if (indent2 && !singleLineValues(xs)) {
+          return "[" + indentedJoin(xs, indent2) + "]";
         }
         return "[ " + $join.call(xs, ", ") + " ]";
       }
@@ -12574,7 +12574,7 @@ var require_object_inspect = __commonJS({
             mapParts.push(inspect2(key, obj, true) + " => " + inspect2(value, obj));
           });
         }
-        return collectionOf("Map", mapSize.call(obj), mapParts, indent);
+        return collectionOf("Map", mapSize.call(obj), mapParts, indent2);
       }
       if (isSet(obj)) {
         var setParts = [];
@@ -12583,7 +12583,7 @@ var require_object_inspect = __commonJS({
             setParts.push(inspect2(value, obj));
           });
         }
-        return collectionOf("Set", setSize.call(obj), setParts, indent);
+        return collectionOf("Set", setSize.call(obj), setParts, indent2);
       }
       if (isWeakMap(obj)) {
         return weakCollectionOf("WeakMap");
@@ -12622,8 +12622,8 @@ var require_object_inspect = __commonJS({
         if (ys.length === 0) {
           return tag2 + "{}";
         }
-        if (indent) {
-          return tag2 + "{" + indentedJoin(ys, indent) + "}";
+        if (indent2) {
+          return tag2 + "{" + indentedJoin(ys, indent2) + "}";
         }
         return tag2 + "{ " + $join.call(ys, ", ") + " }";
       }
@@ -12834,8 +12834,8 @@ var require_object_inspect = __commonJS({
     function weakCollectionOf(type) {
       return type + " { ? }";
     }
-    function collectionOf(type, size, entries, indent) {
-      var joinedEntries = indent ? indentedJoin(entries, indent) : $join.call(entries, ", ");
+    function collectionOf(type, size, entries, indent2) {
+      var joinedEntries = indent2 ? indentedJoin(entries, indent2) : $join.call(entries, ", ");
       return type + " (" + size + ") {" + joinedEntries + "}";
     }
     function singleLineValues(xs) {
@@ -12860,12 +12860,12 @@ var require_object_inspect = __commonJS({
         prev: $join.call(Array(depth + 1), baseIndent)
       };
     }
-    function indentedJoin(xs, indent) {
+    function indentedJoin(xs, indent2) {
       if (xs.length === 0) {
         return "";
       }
-      var lineJoiner = "\n" + indent.prev + indent.base;
-      return lineJoiner + $join.call(xs, "," + lineJoiner) + "\n" + indent.prev;
+      var lineJoiner = "\n" + indent2.prev + indent2.base;
+      return lineJoiner + $join.call(xs, "," + lineJoiner) + "\n" + indent2.prev;
     }
     function arrObjKeys(obj, inspect2) {
       var isArr = isArray2(obj);
@@ -21669,6 +21669,7 @@ function f(e2, r2, t2) {
 
 // src/node/commonjs-engine.ts
 var EXTENSIONS = [".js", ".mjs", ".cjs", ".json", ".node"];
+var PREFIX_ONLY_BUILTINS = /* @__PURE__ */ new Set(["test", "test/reporters", "sea", "sqlite"]);
 var CONDITION_SETS = {
   import: [["node", "import", "module", "default"], ["node", "require", "default"], ["default"]],
   require: [["node", "require", "default"], ["node", "import", "module", "default"], ["default"]]
@@ -22008,7 +22009,8 @@ ${code}
   }
   builtin(specifier, importer) {
     const name = specifier.replace(/^node:/, "");
-    if (!Object.prototype.hasOwnProperty.call(this.builtins, name)) {
+    const prefixOnly = PREFIX_ONLY_BUILTINS.has(name) && !specifier.startsWith("node:");
+    if (prefixOnly || !Object.prototype.hasOwnProperty.call(this.builtins, name)) {
       return Object.prototype.hasOwnProperty.call(this.overrides, specifier) ? { found: true, value: this.overrides[specifier] } : { found: false, value: void 0 };
     }
     if (name === "module" && importer) {
@@ -27132,6 +27134,79 @@ var url_module_default = urlModule;
 // src/node/virtual-http.ts
 var import_events = __toESM(require_events());
 var import_stream_browserify2 = __toESM(require_stream_browserify());
+
+// src/net/policy.ts
+function isLoopbackHostname(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host === "0.0.0.0" || host === "::1" || host === "::" || host.startsWith("127.") || host.endsWith(".localhost");
+}
+function outboundAllowed(policy, url) {
+  if (!policy.allowOutbound) return false;
+  let hostname;
+  try {
+    hostname = new URL(url).hostname;
+  } catch {
+    return false;
+  }
+  if (isLoopbackHostname(hostname)) return false;
+  const hosts = policy.allowedHosts;
+  if (!hosts) return true;
+  return hosts.some((allowed) => hostname === allowed || hostname.endsWith(`.${allowed}`));
+}
+function outboundBlockedError(url) {
+  let host = url;
+  try {
+    host = new URL(url).host;
+  } catch {
+  }
+  return Object.assign(
+    new Error(
+      `connect ENETUNREACH ${host}: outbound network access is disabled for this container (allowed by the host with network.allowOutbound and network.allowedHosts)`
+    ),
+    { code: "ENETUNREACH", errno: -101, syscall: "connect", hostname: host }
+  );
+}
+function requestUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
+function policedFetch(policy, fetchImpl) {
+  return (async (input, init) => {
+    const url = requestUrl(input);
+    if (!outboundAllowed(policy, url)) {
+      throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
+    }
+    return fetchImpl(input, init);
+  });
+}
+function policedWebSocket(Native, policy) {
+  const Base = Native;
+  return class PolicedWebSocket extends Base {
+    constructor(url, protocols) {
+      const href = url instanceof URL ? url.href : String(url);
+      let parsed = null;
+      try {
+        parsed = new URL(href);
+      } catch {
+      }
+      if (parsed && isLoopbackHostname(parsed.hostname)) {
+        throw Object.assign(
+          new Error(
+            `WebSocket to ${parsed.host} is not available from a program inside the container; reach servers in the container over HTTP`
+          ),
+          { code: "ERR_UNSUPPORTED" }
+        );
+      }
+      if (parsed && !outboundAllowed(policy, href.replace(/^ws(s?):/i, "http$1:"))) {
+        throw outboundBlockedError(href);
+      }
+      super(url, protocols);
+    }
+  };
+}
+
+// src/node/virtual-http.ts
 var VirtualIncomingMessage = class extends import_stream_browserify2.default.Readable {
   method;
   url;
@@ -27527,21 +27602,23 @@ function resolveTarget(input, overrides, defaultProtocol) {
   };
 }
 function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "0.0.0.0" || hostname === "::1" || hostname === "::" || hostname.startsWith("127.") || hostname.endsWith(".localhost");
+  return isLoopbackHostname(hostname);
 }
 var VirtualClientRequest = class extends import_stream_browserify2.default.Writable {
-  constructor(target, router, fetchImpl, trackRequest) {
+  constructor(target, router, fetchImpl, trackRequest, loopback = void 0) {
     super();
     this.target = target;
     this.router = router;
     this.fetchImpl = fetchImpl;
     this.trackRequest = trackRequest;
+    this.loopback = loopback;
     for (const [name, value] of Object.entries(target.headers)) this.setHeader(name, value);
   }
   target;
   router;
   fetchImpl;
   trackRequest;
+  loopback;
   socket = socketStub();
   connection = this.socket;
   chunks = [];
@@ -27655,7 +27732,9 @@ var VirtualClientRequest = class extends import_stream_browserify2.default.Writa
     } catch (error) {
       clearTimeout(this.timer);
       if (this.destroyedByUser) return;
-      const failure = error instanceof Error ? error : new Error(String(error));
+      const thrown = error instanceof Error ? error : new Error(String(error));
+      const cause = thrown.cause;
+      const failure = cause instanceof Error && "code" in cause ? cause : thrown;
       if (!("code" in failure)) Object.assign(failure, { code: "ECONNREFUSED" });
       this.emit("error", failure);
     } finally {
@@ -27663,18 +27742,21 @@ var VirtualClientRequest = class extends import_stream_browserify2.default.Writa
     }
   }
   async viaRouter(body) {
-    if (!this.router.activePortsIncludes(this.target.port)) {
+    const init = {
+      method: this.target.method,
+      path: this.target.path,
+      headers: this.getHeaders(),
+      body: body.length ? new Uint8Array(body) : null
+    };
+    const local = this.router.activePortsIncludes(this.target.port);
+    const remote = local || !this.loopback ? null : await this.loopback(this.target.port, init);
+    if (!local && !remote) {
       throw Object.assign(
         new Error(`connect ECONNREFUSED ${this.target.hostname}:${this.target.port}`),
         { code: "ECONNREFUSED", errno: -61, syscall: "connect", address: this.target.hostname, port: this.target.port }
       );
     }
-    const result = await this.router.request(this.target.port, {
-      method: this.target.method,
-      path: this.target.path,
-      headers: this.getHeaders(),
-      body: body.length ? new Uint8Array(body) : null
-    });
+    const result = remote ?? await this.router.request(this.target.port, init);
     const body_ = result.body;
     const bytes2 = typeof body_ === "string" ? new TextEncoder().encode(body_) : body_ instanceof ArrayBuffer ? new Uint8Array(body_) : body_ ?? new Uint8Array();
     const status = result.statusCode ?? 200;
@@ -27714,7 +27796,13 @@ function createHttpModule(router, owner, options = {}, defaultProtocol = "http:"
   const request = (input, second, third) => {
     const overrides = second && typeof second === "object" && !(second instanceof Function) ? second : void 0;
     const callback = [second, third].find((value) => typeof value === "function");
-    const req = new VirtualClientRequest(resolveTarget(input, overrides, defaultProtocol), router, options.fetch, options.trackRequest);
+    const req = new VirtualClientRequest(
+      resolveTarget(input, overrides, defaultProtocol),
+      router,
+      options.fetch,
+      options.trackRequest,
+      options.loopback
+    );
     if (callback) req.on("response", callback);
     return req;
   };
@@ -27741,6 +27829,62 @@ function createHttpModule(router, owner, options = {}, defaultProtocol = "http:"
     }
   };
 }
+function createVirtualFetch(router, options = {}) {
+  return (async (input, init) => {
+    const request = new Request(input, init);
+    const url = new URL(request.url);
+    const release = options.trackRequest?.();
+    try {
+      if (!isLoopback(url.hostname)) {
+        if (!options.fetch) {
+          throw Object.assign(new TypeError("fetch failed"), {
+            cause: Object.assign(new Error(`getaddrinfo ENOTFOUND ${url.hostname}`), { code: "ENOTFOUND" })
+          });
+        }
+        return await options.fetch(request);
+      }
+      const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+      const headers = {};
+      request.headers.forEach((value, key) => {
+        headers[key] = value;
+      });
+      const bodyless = request.method === "GET" || request.method === "HEAD";
+      const loopbackRequest = {
+        method: request.method,
+        path: `${url.pathname}${url.search}`,
+        headers,
+        body: bodyless ? null : new Uint8Array(await request.arrayBuffer())
+      };
+      const result = router.activePortsIncludes(port) ? await router.request(port, loopbackRequest) : await options.loopback?.(port, loopbackRequest) ?? null;
+      if (!result) {
+        throw Object.assign(new TypeError("fetch failed"), {
+          cause: Object.assign(new Error(`connect ECONNREFUSED ${url.hostname}:${port}`), {
+            code: "ECONNREFUSED",
+            errno: -61,
+            syscall: "connect",
+            address: url.hostname,
+            port
+          })
+        });
+      }
+      const status = result.statusCode ?? 200;
+      const responseHeaders = new Headers();
+      for (const [name, value] of Object.entries(result.headers ?? {})) {
+        for (const part of Array.isArray(value) ? value : [value]) responseHeaders.append(name, String(part));
+      }
+      const raw = result.body;
+      const bytes2 = typeof raw === "string" ? new TextEncoder().encode(raw) : raw instanceof ArrayBuffer ? new Uint8Array(raw) : raw ?? new Uint8Array();
+      const nullBody = status === 204 || status === 205 || status === 304 || request.method === "HEAD";
+      return new Response(nullBody ? null : new Uint8Array(bytes2), {
+        status,
+        statusText: result.statusMessage ?? STATUS_CODES[status] ?? "",
+        headers: responseHeaders
+      });
+    } finally {
+      release?.();
+    }
+  });
+}
 function validateHeaderName(name) {
   if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) throw Object.assign(new TypeError(`Header name must be a valid HTTP token [${name}]`), { code: "ERR_INVALID_HTTP_TOKEN" });
 }
@@ -27761,6 +27905,492 @@ function socketStub() {
 var METHODS = ["ACL", "BIND", "CHECKOUT", "CONNECT", "COPY", "DELETE", "GET", "HEAD", "LINK", "LOCK", "M-SEARCH", "MERGE", "MKACTIVITY", "MKCALENDAR", "MKCOL", "MOVE", "NOTIFY", "OPTIONS", "PATCH", "POST", "PROPFIND", "PROPPATCH", "PURGE", "PUT", "REBIND", "REPORT", "SEARCH", "SOURCE", "SUBSCRIBE", "TRACE", "UNBIND", "UNLINK", "UNLOCK", "UNSUBSCRIBE"];
 var STATUS_CODES = { 100: "Continue", 200: "OK", 201: "Created", 202: "Accepted", 204: "No Content", 206: "Partial Content", 301: "Moved Permanently", 302: "Found", 304: "Not Modified", 307: "Temporary Redirect", 308: "Permanent Redirect", 400: "Bad Request", 401: "Unauthorized", 403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 409: "Conflict", 413: "Payload Too Large", 415: "Unsupported Media Type", 422: "Unprocessable Entity", 429: "Too Many Requests", 500: "Internal Server Error", 501: "Not Implemented", 502: "Bad Gateway", 503: "Service Unavailable" };
 
+// src/node/test-module.ts
+function parseArguments(args) {
+  let name = "<anonymous>";
+  let options = {};
+  let fn;
+  for (const arg of args) {
+    if (typeof arg === "string") name = arg;
+    else if (typeof arg === "function") {
+      fn = arg;
+      if (name === "<anonymous>" && arg.name) name = arg.name;
+    } else if (arg && typeof arg === "object") options = arg;
+  }
+  return { name, options, fn };
+}
+function errorText(error) {
+  if (error instanceof Error) {
+    const stack = error.stack ?? `${error.name}: ${error.message}`;
+    return stack.includes(error.message) ? stack : `${error.name}: ${error.message}
+${stack}`;
+  }
+  return String(error);
+}
+function indent(text, spaces) {
+  const pad = " ".repeat(spaces);
+  return text.split("\n").map((line) => line ? pad + line : line).join("\n");
+}
+function duration(started) {
+  return (performance.now() - started).toFixed(6).replace(/\.?0+$/, "");
+}
+function invoke(host, fn, context, timeout) {
+  const body = new Promise((resolve2, reject) => {
+    if (fn.length >= 2) {
+      let settled = false;
+      const done = (error) => {
+        if (settled) return;
+        settled = true;
+        if (error) reject(error);
+        else resolve2();
+      };
+      try {
+        const returned = fn(context, done);
+        if (returned && typeof returned.then === "function") {
+          reject(new Error("passed a callback but also returned a Promise"));
+        }
+      } catch (error) {
+        done(error);
+      }
+      return;
+    }
+    try {
+      Promise.resolve(fn(context)).then(() => resolve2(), reject);
+    } catch (error) {
+      reject(error);
+    }
+  });
+  if (timeout === void 0 || !Number.isFinite(timeout)) return body;
+  return new Promise((resolve2, reject) => {
+    const timer = host.setTimeout(() => reject(new Error(`test timed out after ${timeout}ms`)), timeout);
+    body.then(
+      () => {
+        host.clearTimeout(timer);
+        resolve2();
+      },
+      (error) => {
+        host.clearTimeout(timer);
+        reject(error);
+      }
+    );
+  });
+}
+function createMockTracker() {
+  const restorers = [];
+  const fn = (original = () => void 0, implementation = original) => {
+    let current2 = implementation;
+    const once = /* @__PURE__ */ new Map();
+    const calls = [];
+    const mocked = function(...args) {
+      const index = calls.length;
+      const chosen = once.get(index) ?? current2;
+      once.delete(index);
+      const call = { arguments: args, result: void 0, error: void 0, this: this };
+      calls.push(call);
+      try {
+        call.result = chosen.apply(this, args);
+        return call.result;
+      } catch (error) {
+        call.error = error;
+        throw error;
+      }
+    };
+    Object.defineProperty(mocked, "mock", {
+      value: {
+        calls,
+        callCount: () => calls.length,
+        resetCalls: () => {
+          calls.length = 0;
+        },
+        mockImplementation: (next) => {
+          current2 = next;
+        },
+        mockImplementationOnce: (next, onCall) => {
+          once.set(onCall ?? calls.length, next);
+        },
+        restore: () => {
+          current2 = original;
+        }
+      }
+    });
+    return mocked;
+  };
+  const method = (object, name, implementation) => {
+    const original = object[name];
+    if (typeof original !== "function") {
+      throw new TypeError(`The property '${name}' is not a function and cannot be mocked`);
+    }
+    const mocked = fn(original, implementation ?? original);
+    object[name] = mocked;
+    const restore = () => {
+      object[name] = original;
+    };
+    mocked.mock.restore = restore;
+    restorers.push(restore);
+    return mocked;
+  };
+  return {
+    fn,
+    method,
+    reset: () => {
+      for (const restore of restorers.splice(0)) restore();
+    },
+    restoreAll: () => {
+      for (const restore of restorers.splice(0)) restore();
+    }
+  };
+}
+function createTestModule(host) {
+  const root = {
+    kind: "suite",
+    name: "",
+    options: {},
+    parent: null,
+    children: [],
+    hooks: { before: [], after: [], beforeEach: [], afterEach: [] }
+  };
+  let collecting = root;
+  let scheduled = false;
+  let running = null;
+  const mock = createMockTracker();
+  const counts = { tests: 0, suites: 0, pass: 0, fail: 0, cancelled: 0, skipped: 0, todo: 0 };
+  const failures = [];
+  let tapIndex = 0;
+  let onlyWarned = false;
+  const settings = () => host.settings();
+  const tap = () => settings().reporter === "tap";
+  const schedule = () => {
+    if (scheduled) return;
+    scheduled = true;
+    host.setTimeout(() => {
+      running = runAll();
+    }, 0);
+  };
+  const fullName = (node) => {
+    const parts = [];
+    let cursor = node;
+    while (cursor && cursor !== root) {
+      parts.unshift(cursor.name);
+      cursor = cursor.parent;
+    }
+    return parts.join(" ");
+  };
+  const matchesPattern = (name) => {
+    const patterns = settings().namePatterns ?? [];
+    if (patterns.length === 0) return true;
+    return patterns.some((pattern) => {
+      try {
+        return new RegExp(pattern).test(name);
+      } catch {
+        return name.includes(pattern);
+      }
+    });
+  };
+  const hasOnly = (node) => Boolean(node.options.only) || node.kind === "suite" && node.children.some(hasOnly);
+  const report = (depth, outcome, name, started, detail) => {
+    if (tap()) {
+      tapIndex += 1;
+      const ok2 = outcome === "fail" ? "not ok" : "ok";
+      const directive = outcome === "skip" ? " # SKIP" : outcome === "todo" ? " # TODO" : outcome === "cancelled" ? " # CANCELLED" : "";
+      host.write(`${ok2} ${tapIndex} - ${name}${directive}
+`);
+      host.write(`  ---
+  duration_ms: ${duration(started)}
+`);
+      if (detail) host.write(`  error: |-
+${indent(detail, 4)}
+`);
+      host.write("  ...\n");
+      return;
+    }
+    const pad = "  ".repeat(depth);
+    const mark = outcome === "pass" ? "\u2714" : outcome === "fail" ? "\u2716" : outcome === "cancelled" ? "\u2716" : "\uFE63";
+    const suffix = outcome === "skip" ? " # SKIP" : outcome === "todo" ? " # TODO" : "";
+    host.write(`${pad}${mark} ${name} (${duration(started)}ms)${suffix}
+`);
+    if (detail) host.write(`${indent(detail, depth * 2 + 2)}
+`);
+  };
+  const record = (outcome, name, error) => {
+    counts.tests += 1;
+    if (outcome === "pass") counts.pass += 1;
+    else if (outcome === "fail") {
+      counts.fail += 1;
+      failures.push({ name, error });
+    } else if (outcome === "cancelled") {
+      counts.cancelled += 1;
+      failures.push({ name, error });
+    } else if (outcome === "skip") counts.skipped += 1;
+    else counts.todo += 1;
+  };
+  const ancestors = (suite) => {
+    const chain = [];
+    for (let cursor = suite; cursor; cursor = cursor.parent) chain.unshift(cursor);
+    return chain;
+  };
+  const runTest = async (name, display, options, fn, depth, suite, extraHooks, runOnly) => {
+    const started = performance.now();
+    if (!matchesPattern(display)) return true;
+    if (runOnly && !options.only) return true;
+    if (options.skip) {
+      record("skip", display);
+      report(depth, "skip", name, started);
+      return true;
+    }
+    if (!fn) {
+      const outcome = options.todo ? "todo" : "skip";
+      record(outcome, display);
+      report(depth, outcome, name, started);
+      return true;
+    }
+    const controller = new AbortController();
+    const subtests = [];
+    const ownHooks = { before: [], after: [], beforeEach: [], afterEach: [] };
+    let skipped = false;
+    let todo = options.todo ?? false;
+    const context = {
+      name,
+      fullName: display,
+      signal: controller.signal,
+      mock,
+      test: (...args) => {
+        const sub = parseArguments(args);
+        const promise = runTest(
+          sub.name,
+          `${display} ${sub.name}`,
+          sub.options,
+          sub.fn,
+          depth + 1,
+          suite,
+          ownHooks,
+          false
+        );
+        subtests.push(promise);
+        return promise.then(() => void 0);
+      },
+      skip: (message) => {
+        skipped = message ?? true;
+      },
+      todo: (message) => {
+        todo = message ?? true;
+      },
+      diagnostic: (message) => {
+        host.write(tap() ? `# ${message}
+` : `${"  ".repeat(depth + 1)}\u2139 ${message}
+`);
+      },
+      plan: () => {
+      },
+      before: (hook2) => ownHooks.before.push(hook2),
+      after: (hook2) => ownHooks.after.push(hook2),
+      beforeEach: (hook2) => ownHooks.beforeEach.push(hook2),
+      afterEach: (hook2) => ownHooks.afterEach.push(hook2)
+    };
+    let error;
+    try {
+      const chain = ancestors(suite);
+      for (const level of chain) for (const hook2 of level.hooks.beforeEach) await invoke(host, hook2, context, void 0);
+      for (const hook2 of extraHooks.beforeEach) await invoke(host, hook2, context, void 0);
+      await invoke(host, fn, context, options.timeout);
+      const results = await Promise.all(subtests);
+      for (const hook2 of ownHooks.after) await invoke(host, hook2, context, void 0);
+      if (results.includes(false)) error = new Error(`${results.filter((ok2) => !ok2).length} subtest(s) failed`);
+      for (const hook2 of extraHooks.afterEach) await invoke(host, hook2, context, void 0);
+      for (const level of [...chain].reverse()) for (const hook2 of level.hooks.afterEach) await invoke(host, hook2, context, void 0);
+    } catch (caught) {
+      error = caught;
+    } finally {
+      controller.abort();
+    }
+    if (skipped) {
+      record("skip", display);
+      report(depth, "skip", name, started);
+      return true;
+    }
+    if (error !== void 0) {
+      if (todo) {
+        record("todo", display);
+        report(depth, "todo", name, started);
+        return true;
+      }
+      record("fail", display, error);
+      report(depth, "fail", name, started, errorText(error));
+      return false;
+    }
+    record(todo ? "todo" : "pass", display);
+    report(depth, todo ? "todo" : "pass", name, started);
+    return true;
+  };
+  const runSuite = async (suite, depth, runOnly) => {
+    const started = performance.now();
+    const display = fullName(suite);
+    const isRoot = suite === root;
+    if (!isRoot) {
+      counts.suites += 1;
+      if (tap()) host.write(`# Subtest: ${suite.name}
+`);
+      else host.write(`${"  ".repeat(depth)}\u25B6 ${suite.name}
+`);
+      if (suite.options.skip) {
+        for (const child of suite.children) if (child.kind === "test") record("skip", fullName(child));
+        report(depth, "skip", suite.name, started);
+        return true;
+      }
+    }
+    const context = { name: suite.name, signal: new AbortController().signal };
+    let ok2 = true;
+    try {
+      for (const hook2 of suite.hooks.before) await invoke(host, hook2, context, void 0);
+    } catch (error) {
+      for (const child of suite.children) {
+        if (child.kind === "test") {
+          record("cancelled", fullName(child), error);
+          report(depth + (isRoot ? 0 : 1), "cancelled", child.name, started, errorText(error));
+        }
+      }
+      if (!isRoot) report(depth, "fail", suite.name, started);
+      return false;
+    }
+    const only = runOnly || settings().only === true && suite.children.some(hasOnly);
+    for (const child of suite.children) {
+      const childDepth = depth + (isRoot ? 0 : 1);
+      if (child.kind === "suite") {
+        if (only && !hasOnly(child) && !child.options.only) continue;
+        ok2 = await runSuite(child, childDepth, only && !child.options.only) && ok2;
+      } else {
+        ok2 = await runTest(
+          child.name,
+          fullName(child),
+          child.options,
+          child.fn,
+          childDepth,
+          suite,
+          { before: [], after: [], beforeEach: [], afterEach: [] },
+          only
+        ) && ok2;
+      }
+    }
+    try {
+      for (const hook2 of suite.hooks.after) await invoke(host, hook2, context, void 0);
+    } catch (error) {
+      ok2 = false;
+      failures.push({ name: `${display || "<root>"} (after hook)`, error });
+      host.write(`${indent(`\u2716 after hook failed
+${errorText(error)}`, depth * 2)}
+`);
+    }
+    if (!isRoot) {
+      if (tap()) host.write(`${ok2 ? "ok" : "not ok"} ${++tapIndex} - ${suite.name}
+`);
+      else host.write(`${"  ".repeat(depth)}${ok2 ? "\u25B6" : "\u2716"} ${suite.name} (${duration(started)}ms)
+`);
+    }
+    return ok2;
+  };
+  const runAll = async () => {
+    const release = host.keepAlive();
+    const started = performance.now();
+    if (tap()) host.write("TAP version 13\n");
+    if (!settings().only && !onlyWarned && root.children.some(hasOnly)) {
+      onlyWarned = true;
+      host.write("\u2139 'only' and 'runOnly' require the --test-only command-line option.\n");
+    }
+    let ok2 = true;
+    try {
+      ok2 = await runSuite(root, 0, false);
+    } catch (error) {
+      ok2 = false;
+      failures.push({ name: "<test runner>", error });
+    }
+    mock.restoreAll();
+    if (tap()) {
+      host.write(`1..${tapIndex}
+`);
+      for (const [key, value] of Object.entries(counts)) host.write(`# ${key} ${value}
+`);
+      host.write(`# duration_ms ${duration(started)}
+`);
+    } else {
+      for (const [key, value] of Object.entries(counts)) host.write(`\u2139 ${key} ${value}
+`);
+      host.write(`\u2139 duration_ms ${duration(started)}
+`);
+      if (failures.length > 0) {
+        host.write("\n\u2716 failing tests:\n\n");
+        for (const failure of failures) host.write(`test at ${failure.name}
+${indent(errorText(failure.error), 2)}
+
+`);
+      }
+    }
+    release();
+    host.exit(ok2 && counts.fail === 0 && counts.cancelled === 0 ? 0 : 1);
+  };
+  const declareTest = (extra) => (...args) => {
+    const { name, options, fn } = parseArguments(args);
+    if (running && collecting === root && scheduled) {
+      host.write(`\u2716 test "${name}" was declared after the run started and did not run
+`);
+      return Promise.resolve();
+    }
+    collecting.children.push({ kind: "test", name, options: { ...options, ...extra }, parent: collecting, fn });
+    schedule();
+    return Promise.resolve();
+  };
+  const declareSuite = (extra) => (...args) => {
+    const { name, options, fn } = parseArguments(args);
+    const suite = {
+      kind: "suite",
+      name,
+      options: { ...options, ...extra },
+      parent: collecting,
+      children: [],
+      hooks: { before: [], after: [], beforeEach: [], afterEach: [] }
+    };
+    collecting.children.push(suite);
+    schedule();
+    const previous = collecting;
+    collecting = suite;
+    try {
+      fn?.({ name, signal: new AbortController().signal });
+    } finally {
+      collecting = previous;
+    }
+    return Promise.resolve();
+  };
+  const withModifiers = (make) => {
+    const base2 = make({});
+    base2.skip = make({ skip: true });
+    base2.todo = make({ todo: true });
+    base2.only = make({ only: true });
+    return base2;
+  };
+  const test = withModifiers(declareTest);
+  const describe2 = withModifiers(declareSuite);
+  const hook = (kind) => (fn) => {
+    collecting.hooks[kind].push(fn);
+    schedule();
+  };
+  Object.assign(test, {
+    test,
+    it: test,
+    describe: describe2,
+    suite: describe2,
+    before: hook("before"),
+    after: hook("after"),
+    beforeEach: hook("beforeEach"),
+    afterEach: hook("afterEach"),
+    mock,
+    run: () => {
+      throw Object.assign(new Error("node:test run() is not available in this container; use `node --test`"), {
+        code: "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM"
+      });
+    }
+  });
+  Object.defineProperty(test, "default", { value: test, enumerable: false });
+  return test;
+}
+
 // node_modules/@noble/hashes/esm/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
@@ -29618,7 +30248,7 @@ function createCoreModules(options) {
   });
   const stderrWrite = options.stderr ?? (() => {
   });
-  const timers = createTrackedTimers();
+  const timers = createTrackedTimers((error) => reportUncaught(error));
   const processObject = Object.assign(new import_events4.default(), import_browser.default, {
     argv: options.argv?.slice() ?? ["/usr/bin/node"],
     argv0: "node",
@@ -29648,16 +30278,65 @@ function createCoreModules(options) {
     uptime: () => performance.now() / 1e3,
     memoryUsage: () => ({ rss: 0, heapTotal: 0, heapUsed: 0, external: 0, arrayBuffers: 0 }),
     cpuUsage: () => ({ user: 0, system: 0 }),
-    exit: (code = 0) => {
-      exitCode = code;
-      processObject.exitCode = code;
-      options.onExit?.(code);
+    /* A bare `process.exit()` ends with `process.exitCode`, as in Node. */
+    exit: (code) => {
+      const status = normalizeExitCode(code ?? processObject.exitCode);
+      exitCode = status;
+      processObject.exitCode = status;
+      emitExit(status);
+      options.onExit?.(status);
+    },
+    nextTick: (fn, ...args) => {
+      queueMicrotask(() => {
+        try {
+          fn(...args);
+        } catch (error) {
+          reportUncaught(error);
+        }
+      });
     },
     kill: () => true
   });
+  for (const method of EVENT_EMITTER_METHODS) {
+    const implementation = import_events4.default.prototype[method];
+    if (typeof implementation === "function") processObject[method] = implementation;
+  }
   const tty = options.tty === true;
   processObject.stdout = makeOutputStream(stdoutWrite, 1, tty);
   processObject.stderr = makeOutputStream(stderrWrite, 2, tty);
+  let exiting = false;
+  const emitExit = (status) => {
+    if (exiting) return;
+    exiting = true;
+    try {
+      processObject.emit("exit", status);
+    } catch {
+    }
+  };
+  const reportUncaught = (error, origin = "uncaughtException") => {
+    if (!exiting && processObject.listenerCount(origin) > 0) {
+      try {
+        processObject.emit(origin, error, origin === "uncaughtException" ? origin : void 0);
+        return;
+      } catch (handlerError) {
+        error = handlerError;
+      }
+    }
+    stderrWrite(formatUncaught(error));
+    try {
+      processObject.exit(1);
+    } catch {
+    }
+  };
+  const defer = (fn) => {
+    queueMicrotask(() => {
+      try {
+        fn();
+      } catch (error) {
+        reportUncaught(error);
+      }
+    });
+  };
   const stdin = options.interactiveStdin ? new import_stream_browserify4.default.PassThrough() : new import_stream_browserify4.default.Readable({ read() {
     this.push(null);
   } });
@@ -29677,7 +30356,7 @@ function createCoreModules(options) {
   });
   processObject.stdin = stdin;
   Reflect.deleteProperty(processObject, "browser");
-  const fs = createFsModule(volume, () => cwd, options.stdinPath);
+  const fs = createFsModule(volume, () => cwd, options.stdinPath, defer);
   const path = createPathModule(() => cwd);
   const consoleObject = new Console(stdoutWrite, stderrWrite);
   const os = createOsModule();
@@ -29690,20 +30369,24 @@ function createCoreModules(options) {
     }
   };
   let inFlightRequests = 0;
+  const trackRequest = () => {
+    inFlightRequests++;
+    return () => {
+      inFlightRequests--;
+    };
+  };
+  const ambientFetch = options.http?.fetch ?? (typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : void 0);
+  const outboundFetch = options.http?.policy && ambientFetch ? policedFetch(options.http.policy, ambientFetch) : ambientFetch;
   const httpOptions = {
-    ...options.http?.fetch ? { fetch: options.http.fetch } : {},
-    trackRequest: () => {
-      inFlightRequests++;
-      return () => {
-        inFlightRequests--;
-      };
-    }
+    ...outboundFetch ? { fetch: outboundFetch } : {},
+    ...options.http?.loopback ? { loopback: options.http.loopback } : {},
+    trackRequest
   };
   const http = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "http:") : createUnsupportedModule("http");
   const https = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "https:") : createUnsupportedModule("https");
   const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd, options.syncSpawn, () => ({ ...processObject.env })) : createUnsupportedModule("child_process");
   const readline = createReadlineModule(() => processObject.stdin, () => processObject.stdout);
-  const dns = createDnsModule();
+  const dns = createDnsModule(defer);
   const builtins = {
     assert: assert_module_default,
     "assert/strict": assert_module_default.strict ?? assert_module_default,
@@ -29739,7 +30422,27 @@ function createCoreModules(options) {
     url: url_module_default,
     util: util_module_default,
     "util/types": util_module_default.types ?? {},
-    zlib: zlib_module_default
+    zlib: zlib_module_default,
+    test: createTestModule({
+      write: stdoutWrite,
+      setTimeout: (fn, ms) => timers.api.setTimeout(fn, ms),
+      clearTimeout: (handle) => timers.api.clearTimeout(handle),
+      /* A pending interval is what keeps a process alive in this runtime; a test
+       * awaiting nothing but promises would otherwise be judged finished. */
+      keepAlive: () => {
+        const handle = timers.api.setInterval(() => {
+        }, 1 << 30);
+        return () => timers.api.clearInterval(handle);
+      },
+      exit: (code) => {
+        processObject.exitCode = code;
+        try {
+          processObject.exit(code);
+        } catch {
+        }
+      },
+      settings: () => parseTestSettings(env.SANDBOXEDJS_NODE_TEST)
+    })
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
   builtins.net = createNetModule();
@@ -29747,8 +30450,26 @@ function createCoreModules(options) {
     Buffer: Buffer2,
     console: consoleObject,
     process: processObject,
-    ...timers.api
+    ...timers.api,
+    queueMicrotask: (fn) => queueMicrotask(() => {
+      try {
+        fn();
+      } catch (error) {
+        reportUncaught(error);
+      }
+    })
   };
+  if (options.http) {
+    globals.fetch = createVirtualFetch(options.http.router, {
+      ...outboundFetch ? { fetch: outboundFetch } : {},
+      ...options.http.loopback ? { loopback: options.http.loopback } : {},
+      trackRequest
+    });
+    const NativeWebSocket = globalThis.WebSocket;
+    if (options.http.policy && NativeWebSocket) {
+      globals.WebSocket = policedWebSocket(NativeWebSocket, options.http.policy);
+    }
+  }
   const globalOverlay = new Proxy(globalThis, {
     get: (target, key) => typeof key === "string" && key in globals ? globals[key] : key === "global" || key === "globalThis" ? globalOverlay : Reflect.get(target, key),
     has: (target, key) => typeof key === "string" && key in globals || Reflect.has(target, key)
@@ -29764,6 +30485,10 @@ function createCoreModules(options) {
     /** Client requests sent but not yet read to completion. */
     pendingRequests: () => inFlightRequests,
     cancelTimers: timers.cancelAll,
+    reportUncaught: (error) => reportUncaught(error),
+    reportUnhandledRejection: (reason) => reportUncaught(reason, "unhandledRejection"),
+    exitStatus: () => normalizeExitCode(processObject.exitCode),
+    emitExit,
     writeStdin: (data2) => {
       if (options.interactiveStdin) stdin.write(data2);
     },
@@ -29825,7 +30550,7 @@ function createPathModule(cwd) {
   path.default = path;
   return path;
 }
-function createFsModule(volume, cwd, stdinPath) {
+function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
   const fds = /* @__PURE__ */ new Map();
   let nextFd = 3;
   if (stdinPath) fds.set(0, { path: stdinPath, position: 0, flags: "r" });
@@ -29865,12 +30590,15 @@ function createFsModule(volume, cwd, stdinPath) {
     volume.rmdirSync(path);
   };
   const callback = (operation, cb) => {
-    queueMicrotask(() => {
+    defer(() => {
+      let value;
       try {
-        cb(null, operation());
+        value = operation();
       } catch (error) {
         cb(error);
+        return;
       }
+      cb(null, value);
     });
   };
   const fs = {
@@ -30000,7 +30728,7 @@ function createFsModule(volume, cwd, stdinPath) {
       const slice = whole.subarray(start, Math.max(start, end));
       const stream = import_stream_browserify4.default.Readable.from([settings.encoding ? slice.toString(settings.encoding) : slice]);
       Object.assign(stream, { path: target, bytesRead: slice.length, close: () => stream.destroy() });
-      queueMicrotask(() => {
+      defer(() => {
         stream.emit("open", 0);
         stream.emit("ready");
       });
@@ -30068,7 +30796,7 @@ function createFsModule(volume, cwd, stdinPath) {
   }
   fs.realpath.native = fs.realpath;
   fs.exists = (path, cb) => {
-    queueMicrotask(() => cb(fs.existsSync(path)));
+    defer(() => cb(fs.existsSync(path)));
   };
   fs.promises = {
     ...Object.fromEntries(
@@ -30190,7 +30918,7 @@ var Console = class {
   timeLog = (_label = "default") => {
   };
 };
-function createDnsModule() {
+function createDnsModule(defer = queueMicrotask) {
   const LOOPBACK = {
     localhost: { address: "127.0.0.1", family: 4 },
     "127.0.0.1": { address: "127.0.0.1", family: 4 },
@@ -30210,7 +30938,7 @@ function createDnsModule() {
   const lookup = (hostname, options, callback) => {
     const done = typeof options === "function" ? options : callback;
     const all = typeof options === "object" && options !== null && options.all;
-    queueMicrotask(() => {
+    defer(() => {
       try {
         const entry = lookupSync(hostname);
         done?.(null, all ? [entry] : entry.address, entry.family);
@@ -30368,7 +31096,16 @@ var ERRNO_CONSTANTS = {
   EWOULDBLOCK: 11,
   EXDEV: 18
 };
-function createTrackedTimers() {
+function createTrackedTimers(onError = (error) => {
+  throw error;
+}) {
+  const run2 = (fn, args) => {
+    try {
+      fn(...args);
+    } catch (error) {
+      onError(error);
+    }
+  };
   const live = /* @__PURE__ */ new Set();
   const unrefed = /* @__PURE__ */ new Set();
   const states = /* @__PURE__ */ new WeakMap();
@@ -30411,7 +31148,7 @@ function createTrackedTimers() {
     const native = setTimeout(
       (...inner) => {
         complete(handle);
-        fn(...inner);
+        run2(fn, inner);
       },
       delay,
       ...args
@@ -30419,14 +31156,14 @@ function createTrackedTimers() {
     handle = track(native);
     return handle;
   };
-  const setIntervalTracked = (fn, delay, ...args) => track(setInterval(fn, delay, ...args));
+  const setIntervalTracked = (fn, delay, ...args) => track(setInterval((...inner) => run2(fn, inner), delay, ...args));
   const hostSetImmediate = globalThis.setImmediate;
   const setImmediateTracked = (fn, ...args) => {
     if (!hostSetImmediate) return setTimeoutTracked(fn, 0, ...args);
     let handle;
     const native = hostSetImmediate((...inner) => {
       complete(handle);
-      fn(...inner);
+      run2(fn, inner);
     }, ...args);
     handle = track(native);
     return handle;
@@ -30609,6 +31346,43 @@ function createNetModule() {
     isIP: (value) => isIPv4(value) ? 4 : isIPv6(value) ? 6 : 0
   });
 }
+function parseTestSettings(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var EVENT_EMITTER_METHODS = [
+  "on",
+  "addListener",
+  "once",
+  "off",
+  "removeListener",
+  "removeAllListeners",
+  "emit",
+  "prependListener",
+  "prependOnceListener",
+  "listeners",
+  "rawListeners",
+  "listenerCount",
+  "eventNames",
+  "setMaxListeners",
+  "getMaxListeners"
+];
+function normalizeExitCode(value) {
+  const code = typeof value === "string" && value.trim() !== "" ? Number(value) : value;
+  return typeof code === "number" && Number.isInteger(code) ? code & 255 : 0;
+}
+function formatUncaught(error) {
+  const text = error instanceof Error ? error.stack ?? `${error.name}: ${error.message}` : `Uncaught ${typeof error === "string" ? JSON.stringify(error) : String(error)}`;
+  return `${text}
+
+Node.js v22.12.0
+`;
+}
 var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames = [
   "assert",
@@ -30646,6 +31420,7 @@ var builtinNames = [
   "util",
   "util/types",
   "zlib",
+  "test",
   ...stubNames
 ];
 
@@ -30839,7 +31614,13 @@ async function run(port, start) {
   const owner = "worker";
   router.onListen = (listening) => port.postMessage({ type: "listen", port: listening });
   router.onClose = (closed) => port.postMessage({ type: "close-port", port: closed });
-  let requestedExit = 0;
+  const pendingLoopback = /* @__PURE__ */ new Map();
+  let nextLoopbackId = 1;
+  const loopback = (targetPort, request) => new Promise((resolve2) => {
+    const id = nextLoopbackId++;
+    pendingLoopback.set(id, resolve2);
+    port.postMessage({ type: "loopback-request", id, port: targetPort, request });
+  });
   let engine;
   let finished = false;
   const core = createCoreModules({
@@ -30850,11 +31631,10 @@ async function run(port, start) {
     stdout: (text) => port.postMessage({ type: "output", text }),
     stderr: (text) => port.postMessage({ type: "error", text }),
     onExit: (code) => {
-      requestedExit = code;
       finish(code);
       if (engine?.isEvaluating) throw new ProcessExit(code);
     },
-    http: { router, owner },
+    http: { router, owner, loopback, ...start.network ? { policy: start.network } : {} },
     /* Asynchronous children are the host's business: it owns the process table
      * and the PATH. Both forms end up in the same place, one blocking. */
     spawnChild: (config) => hostChildProcess(port, config),
@@ -30864,6 +31644,24 @@ async function run(port, start) {
     ...start.tty ? { tty: true } : {},
     onRawMode: (enabled) => port.postMessage({ type: "rawmode", enabled })
   });
+  const guestGlobals = globalThis;
+  if (typeof core.globals.fetch === "function") guestGlobals.fetch = core.globals.fetch;
+  if (typeof core.globals.WebSocket === "function") guestGlobals.WebSocket = core.globals.WebSocket;
+  if (typeof self !== "undefined" && typeof self.addEventListener === "function") {
+    const scope = self;
+    scope.addEventListener("error", (event) => {
+      event.preventDefault?.();
+      core.reportUncaught(event.error ?? new Error(String(event.message)));
+    });
+    scope.addEventListener("unhandledrejection", (event) => {
+      event.preventDefault?.();
+      core.reportUnhandledRejection(event.reason);
+    });
+  } else {
+    const threadProcess = globalThis.process;
+    threadProcess?.on?.("uncaughtException", (error) => core.reportUncaught(error));
+    threadProcess?.on?.("unhandledRejection", (reason) => core.reportUnhandledRejection(reason));
+  }
   const finish = (code) => {
     if (finished) return;
     finished = true;
@@ -30880,6 +31678,12 @@ async function run(port, start) {
       finish(137);
     }
     if (message?.type === "http-request") void answer(port, router, message);
+    if (message?.type === "loopback-response") {
+      const id = Number(message.id);
+      const settle2 = pendingLoopback.get(id);
+      pendingLoopback.delete(id);
+      settle2?.(message.response ?? null);
+    }
     if (message?.type === "ws-open") openSocket(port, router, message);
     if (message?.type === "ws-data") sockets.get(Number(message.id))?.send(new Uint8Array(message.data));
     if (message?.type === "ws-close") {
@@ -30897,7 +31701,9 @@ async function run(port, start) {
   try {
     await engine.run(start.script);
     await settle(router, owner, core, () => finished);
-    finish(requestedExit);
+    const status = core.exitStatus();
+    core.emitExit(status);
+    finish(status);
   } catch (error) {
     if (error instanceof ProcessExit) {
       finish(error.code);