sandboxedjs 0.2.22 → 0.2.23

package/dist/{memory-volume-meoRW8ST.d.ts → memory-volume-DhGUwDqX.d.ts}

@@ -1,4 +1,4 @@
-import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BHo4LdY2.js';
+import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BFG82pSs.js';
 
 type NodeKind = "file" | "directory" | "symlink";
 interface MemoryVolumeSnapshotEntry {

package/dist/{memory-volume-e-uJFRnG.d.cts → memory-volume-Din7xmmT.d.cts}

@@ -1,4 +1,4 @@
-import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BHo4LdY2.cjs';
+import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BFG82pSs.cjs';
 
 type NodeKind = "file" | "directory" | "symlink";
 interface MemoryVolumeSnapshotEntry {

package/dist/python-abi.d.cts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BHo4LdY2.cjs';
-export { m as ROOT_CRED, v as makeCred } from './contracts-BHo4LdY2.cjs';
-export { M as MemoryVolume } from './memory-volume-e-uJFRnG.cjs';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BFG82pSs.cjs';
+export { m as ROOT_CRED, x as makeCred } from './contracts-BFG82pSs.cjs';
+export { M as MemoryVolume } from './memory-volume-Din7xmmT.cjs';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.

package/dist/python-abi.d.ts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BHo4LdY2.js';
-export { m as ROOT_CRED, v as makeCred } from './contracts-BHo4LdY2.js';
-export { M as MemoryVolume } from './memory-volume-meoRW8ST.js';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BFG82pSs.js';
+export { m as ROOT_CRED, x as makeCred } from './contracts-BFG82pSs.js';
+export { M as MemoryVolume } from './memory-volume-DhGUwDqX.js';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.

package/dist/worker-entry.js

@@ -8659,10 +8659,10 @@ var require_buffer = __commonJS({
       return out;
     }
     function utf16leSlice(buf, start, end) {
-      const bytes2 = buf.slice(start, end);
+      const bytes3 = buf.slice(start, end);
       let res = "";
-      for (let i = 0; i < bytes2.length - 1; i += 2) {
-        res += String.fromCharCode(bytes2[i] + bytes2[i + 1] * 256);
+      for (let i = 0; i < bytes3.length - 1; i += 2) {
+        res += String.fromCharCode(bytes3[i] + bytes3[i + 1] * 256);
       }
       return res;
     }
@@ -9185,13 +9185,13 @@ var require_buffer = __commonJS({
           this[i] = val;
         }
       } else {
-        const bytes2 = Buffer3.isBuffer(val) ? val : Buffer3.from(val, encoding);
-        const len = bytes2.length;
+        const bytes3 = Buffer3.isBuffer(val) ? val : Buffer3.from(val, encoding);
+        const len = bytes3.length;
         if (len === 0) {
           throw new TypeError('The value "' + val + '" is invalid for argument "value"');
         }
         for (i = 0; i < end - start; ++i) {
-          this[i + start] = bytes2[i % len];
+          this[i + start] = bytes3[i % len];
         }
       }
       return this;
@@ -9326,50 +9326,50 @@ var require_buffer = __commonJS({
       let codePoint;
       const length = string.length;
       let leadSurrogate = null;
-      const bytes2 = [];
+      const bytes3 = [];
       for (let i = 0; i < length; ++i) {
         codePoint = string.charCodeAt(i);
         if (codePoint > 55295 && codePoint < 57344) {
           if (!leadSurrogate) {
             if (codePoint > 56319) {
-              if ((units -= 3) > -1) bytes2.push(239, 191, 189);
+              if ((units -= 3) > -1) bytes3.push(239, 191, 189);
               continue;
             } else if (i + 1 === length) {
-              if ((units -= 3) > -1) bytes2.push(239, 191, 189);
+              if ((units -= 3) > -1) bytes3.push(239, 191, 189);
               continue;
             }
             leadSurrogate = codePoint;
             continue;
           }
           if (codePoint < 56320) {
-            if ((units -= 3) > -1) bytes2.push(239, 191, 189);
+            if ((units -= 3) > -1) bytes3.push(239, 191, 189);
             leadSurrogate = codePoint;
             continue;
           }
           codePoint = (leadSurrogate - 55296 << 10 | codePoint - 56320) + 65536;
         } else if (leadSurrogate) {
-          if ((units -= 3) > -1) bytes2.push(239, 191, 189);
+          if ((units -= 3) > -1) bytes3.push(239, 191, 189);
         }
         leadSurrogate = null;
         if (codePoint < 128) {
           if ((units -= 1) < 0) break;
-          bytes2.push(codePoint);
+          bytes3.push(codePoint);
         } else if (codePoint < 2048) {
           if ((units -= 2) < 0) break;
-          bytes2.push(
+          bytes3.push(
             codePoint >> 6 | 192,
             codePoint & 63 | 128
           );
         } else if (codePoint < 65536) {
           if ((units -= 3) < 0) break;
-          bytes2.push(
+          bytes3.push(
             codePoint >> 12 | 224,
             codePoint >> 6 & 63 | 128,
             codePoint & 63 | 128
           );
         } else if (codePoint < 1114112) {
           if ((units -= 4) < 0) break;
-          bytes2.push(
+          bytes3.push(
             codePoint >> 18 | 240,
             codePoint >> 12 & 63 | 128,
             codePoint >> 6 & 63 | 128,
@@ -9379,7 +9379,7 @@ var require_buffer = __commonJS({
           throw new Error("Invalid code point");
         }
       }
-      return bytes2;
+      return bytes3;
     }
     function asciiToBytes(str) {
       const byteArray = [];
@@ -49702,18 +49702,18 @@ var import_events = __toESM(require_events(), 1);
 var import_stream_browserify3 = __toESM(require_stream_browserify(), 1);
 
 // src/net/proxy-fetch.ts
-function toBase64(bytes2) {
+function toBase64(bytes3) {
   let text = "";
-  for (let at2 = 0; at2 < bytes2.length; at2 += 32768) {
-    text += String.fromCharCode(...bytes2.subarray(at2, at2 + 32768));
+  for (let at2 = 0; at2 < bytes3.length; at2 += 32768) {
+    text += String.fromCharCode(...bytes3.subarray(at2, at2 + 32768));
   }
   return btoa(text);
 }
 function fromBase64(text) {
   const binary = atob(text);
-  const bytes2 = new Uint8Array(binary.length);
-  for (let at2 = 0; at2 < binary.length; at2 += 1) bytes2[at2] = binary.charCodeAt(at2);
-  return bytes2;
+  const bytes3 = new Uint8Array(binary.length);
+  for (let at2 = 0; at2 < binary.length; at2 += 1) bytes3[at2] = binary.charCodeAt(at2);
+  return bytes3;
 }
 async function proxyExchange(proxy, request, fetchImpl = fetch) {
   let answer2;
@@ -49800,6 +49800,93 @@ async function discoverEgress(fetchImpl = fetch) {
   return await found;
 }
 
+// src/net/secrets.ts
+var PLACEHOLDER = /\{\{secret:([A-Za-z_][A-Za-z0-9_]*)\}\}/g;
+var REDACTED = "[sealed]";
+var SecretRefused = class extends Error {
+  code = "EACCES";
+};
+function hostBound(secret, hostname) {
+  return secret.hosts.some((host) => hostname === host || hostname.endsWith(`.${host}`));
+}
+function mentionsSecret(text) {
+  PLACEHOLDER.lastIndex = 0;
+  return PLACEHOLDER.test(text);
+}
+function substituteSecrets(text, hostname, secrets) {
+  return text.replace(PLACEHOLDER, (_match, name) => {
+    const secret = Object.prototype.hasOwnProperty.call(secrets, name) ? secrets[name] : void 0;
+    if (!secret) {
+      throw new SecretRefused(`no sealed secret named ${name} is configured for this container`);
+    }
+    if (!hostBound(secret, hostname)) {
+      throw new SecretRefused(
+        `the sealed secret ${name} is not bound to ${hostname}; it may only be sent to ${secret.hosts.join(", ") || "no host"}`
+      );
+    }
+    return secret.value;
+  });
+}
+function sealRequest(request, secrets) {
+  const url = new URL(request.url);
+  if (mentionsSecret(decodeURIComponent(url.href))) {
+    throw new SecretRefused("a sealed secret can only be used in a request header, not in the URL");
+  }
+  const used = [];
+  let headers = null;
+  request.headers.forEach((value, name) => {
+    if (!mentionsSecret(value)) return;
+    headers ??= new Headers(request.headers);
+    headers.set(name, substituteSecrets(value, url.hostname, secrets));
+    PLACEHOLDER.lastIndex = 0;
+    for (const match3 of value.matchAll(PLACEHOLDER)) used.push(match3[1]);
+  });
+  return headers ? { request: new Request(request, { headers }), used } : { request, used };
+}
+function redactResponse(response, secrets) {
+  const values = Object.values(secrets).map((secret) => secret.value).filter((value) => value.length > 0);
+  if (values.length === 0) return response;
+  const headers = new Headers();
+  response.headers.forEach((value, name) => headers.set(name, redactText(value, values)));
+  const init = { status: response.status, statusText: response.statusText, headers };
+  if (!response.body) return new Response(null, init);
+  headers.delete("content-length");
+  return new Response(response.body.pipeThrough(redactingStream(values)), init);
+}
+function redactText(text, values) {
+  let out = text;
+  for (const value of values) out = out.split(value).join(REDACTED);
+  return out;
+}
+function redactingStream(values) {
+  const needles = values.map((value) => latin1(new TextEncoder().encode(value)));
+  const hold = Math.max(...needles.map((needle) => needle.length)) - 1;
+  let pending = "";
+  return new TransformStream({
+    transform(chunk, controller) {
+      pending = redactText(pending + latin1(chunk), needles);
+      if (pending.length <= hold) return;
+      controller.enqueue(bytes2(pending.slice(0, pending.length - hold)));
+      pending = pending.slice(pending.length - hold);
+    },
+    flush(controller) {
+      if (pending) controller.enqueue(bytes2(redactText(pending, needles)));
+    }
+  });
+}
+function latin1(chunk) {
+  let out = "";
+  for (let at2 = 0; at2 < chunk.length; at2 += 32768) {
+    out += String.fromCharCode(...chunk.subarray(at2, at2 + 32768));
+  }
+  return out;
+}
+function bytes2(text) {
+  const out = new Uint8Array(text.length);
+  for (let index = 0; index < text.length; index += 1) out[index] = text.charCodeAt(index);
+  return out;
+}
+
 // src/net/policy.ts
 function isLoopbackHostname(hostname) {
   const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -49837,6 +49924,24 @@ function requestUrl(input2) {
   return input2.url;
 }
 function policedFetch(policy, fetchImpl) {
+  const secrets = policy.secrets && Object.keys(policy.secrets).length > 0 ? policy.secrets : null;
+  if (!secrets) return policedPlainFetch(policy, fetchImpl);
+  const plain = policedPlainFetch(policy, fetchImpl);
+  return (async (input2, init) => {
+    const url = requestUrl(input2);
+    if (!outboundAllowed(policy, url)) {
+      throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
+    }
+    let sealed;
+    try {
+      sealed = sealRequest(new Request(input2, init), secrets).request;
+    } catch (error) {
+      throw Object.assign(new TypeError("fetch failed"), { cause: error });
+    }
+    return redactResponse(await plain(sealed), secrets);
+  });
+}
+function policedPlainFetch(policy, fetchImpl) {
   return (async (input2, init) => {
     const url = requestUrl(input2);
     if (!outboundAllowed(policy, url)) {
@@ -49961,6 +50066,8 @@ var VirtualServerResponse = class extends import_stream_browserify3.default.Writ
   completed;
   constructor(request) {
     super();
+    this.on("error", () => {
+    });
     this.req = request;
     this.completed = new Promise((resolve2) => {
       this.resolve = resolve2;
@@ -50090,9 +50197,9 @@ var VirtualSocket = class extends import_stream_browserify3.default.Duplex {
   _read() {
   }
   _write(chunk, encoding, callback) {
-    const bytes2 = Buffer2.isBuffer(chunk) ? chunk : Buffer2.from(chunk, encoding);
+    const bytes3 = Buffer2.isBuffer(chunk) ? chunk : Buffer2.from(chunk, encoding);
     try {
-      this.peer?.data(new Uint8Array(bytes2));
+      this.peer?.data(new Uint8Array(bytes3));
       callback();
     } catch (error) {
       callback(error);
@@ -50116,9 +50223,9 @@ var VirtualSocket = class extends import_stream_browserify3.default.Duplex {
     this.peer = null;
   }
   /** Bytes arriving from the far end. */
-  deliver(bytes2) {
+  deliver(bytes3) {
     if (this.destroyed || this.hungUp) return;
-    this.push(Buffer2.from(bytes2));
+    this.push(Buffer2.from(bytes3));
   }
   /** The far end went away; let the server's stream end cleanly. */
   peerClosed() {
@@ -50273,7 +50380,7 @@ var VirtualHttpRouter = class {
     request.socket = socket;
     item.server.emit("upgrade", request, socket, Buffer2.alloc(0));
     return {
-      send: (bytes2) => socket.deliver(bytes2),
+      send: (bytes3) => socket.deliver(bytes3),
       close: () => socket.peerClosed()
     };
   }
@@ -50499,9 +50606,9 @@ var VirtualClientRequest = class extends import_stream_browserify3.default.Writa
     }
     const result = remote ?? await this.router.request(this.target.port, init);
     const body_ = result.body;
-    const bytes2 = typeof body_ === "string" ? new TextEncoder().encode(body_) : body_ instanceof ArrayBuffer ? new Uint8Array(body_) : body_ ?? new Uint8Array();
+    const bytes3 = typeof body_ === "string" ? new TextEncoder().encode(body_) : body_ instanceof ArrayBuffer ? new Uint8Array(body_) : body_ ?? new Uint8Array();
     const status = result.statusCode ?? 200;
-    return new VirtualClientResponse(status, result.statusMessage ?? STATUS_CODES[status] ?? "", lowercaseHeaders(result.headers), bytes2);
+    return new VirtualClientResponse(status, result.statusMessage ?? STATUS_CODES[status] ?? "", lowercaseHeaders(result.headers), bytes3);
   }
   async viaFetch(body) {
     const fetchImpl = this.fetchImpl ?? globalThis.fetch;
@@ -50525,8 +50632,8 @@ var VirtualClientRequest = class extends import_stream_browserify3.default.Writa
     response.headers.forEach((value, key) => {
       received[key.toLowerCase()] = value;
     });
-    const bytes2 = new Uint8Array(await response.arrayBuffer());
-    return new VirtualClientResponse(response.status, response.statusText, received, bytes2);
+    const bytes3 = new Uint8Array(await response.arrayBuffer());
+    return new VirtualClientResponse(response.status, response.statusText, received, bytes3);
   }
 };
 function lowercaseHeaders(headers) {
@@ -50618,9 +50725,9 @@ function createVirtualFetch(router, options = {}) {
         for (const part of Array.isArray(value) ? value : [value]) responseHeaders.append(name, String(part));
       }
       const raw = result.body;
-      const bytes2 = typeof raw === "string" ? new TextEncoder().encode(raw) : raw instanceof ArrayBuffer ? new Uint8Array(raw) : raw ?? new Uint8Array();
+      const bytes3 = typeof raw === "string" ? new TextEncoder().encode(raw) : raw instanceof ArrayBuffer ? new Uint8Array(raw) : raw ?? new Uint8Array();
       const nullBody = status === 204 || status === 205 || status === 304 || request.method === "HEAD";
-      return new Response(nullBody ? null : new Uint8Array(bytes2), {
+      return new Response(nullBody ? null : new Uint8Array(bytes3), {
         status,
         statusText: result.statusMessage ?? STATUS_CODES[status] ?? "",
         headers: responseHeaders
@@ -52324,7 +52431,7 @@ var ChildProcess = class extends import_events2.default {
     this.stdin = new import_stream_browserify4.default.Writable({
       write: (chunk, _encoding, done) => {
         try {
-          handle.sendStdin(typeof chunk === "string" ? chunk : Buffer2.from(chunk).toString("utf8"));
+          handle.sendStdin(typeof chunk === "string" ? chunk : new Uint8Array(chunk));
         } catch {
         }
         done();
@@ -52343,8 +52450,8 @@ var ChildProcess = class extends import_events2.default {
       const pipe = this.stdio[event.fd];
       pipe?.push(Buffer2.from(event.text));
     });
-    handle.on("stdout", (text) => this.stdout.write(text));
-    handle.on("stderr", (text) => this.stderr.write(text));
+    handle.on("stdout", (value) => this.stdout.write(typeof value === "string" ? value : Buffer2.from(value)));
+    handle.on("stderr", (value) => this.stderr.write(typeof value === "string" ? value : Buffer2.from(value)));
     handle.on("exit", (code) => this.finish(code));
     referenceChanged(1);
     try {
@@ -53373,7 +53480,7 @@ function createCoreModules(options) {
   });
   processObject.stdin = stdin;
   Reflect.deleteProperty(processObject, "browser");
-  const fs = createFsModule(volume, () => cwd, options.stdinPath, defer);
+  const fs = createFsModule(volume, () => cwd, options.stdinPath, defer, stdin);
   processObject.loadEnvFile = (path2 = ".env") => {
     const parsed = parseEnv(fs.readFileSync(path2, "utf8"));
     for (const [key, value] of Object.entries(parsed)) {
@@ -53745,7 +53852,7 @@ function createPathModule(cwd) {
   path.default = path;
   return path;
 }
-function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
+function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask, stdin) {
   const fds = /* @__PURE__ */ new Map();
   let nextFd = 3;
   if (stdinPath) fds.set(0, { path: stdinPath, position: 0, flags: "r" });
@@ -53756,7 +53863,7 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
     if (typeof value !== "string") throw new TypeError("path must be a string, Buffer, or URL");
     return value.startsWith("/") ? clean(value) : resolve(cwd(), value);
   };
-  const bytes2 = (data2, encoding) => {
+  const bytes3 = (data2, encoding) => {
     if (typeof data2 === "string") return new Uint8Array(Buffer2.from(data2, encoding));
     if (Buffer2.isBuffer(data2) || data2 instanceof Uint8Array) return new Uint8Array(data2);
     if (data2 instanceof ArrayBuffer) return new Uint8Array(data2);
@@ -53818,12 +53925,12 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
     readFileSync: (path, options) => read(path, typeof options === "object" && options ? options.encoding : options),
     writeFileSync: (path, data2, options) => {
       const encoding = typeof options === "object" && options ? options.encoding : options === "buffer" ? void 0 : options ?? void 0;
-      volume.writeFileSync(abs(path), bytes2(data2, encoding ?? void 0));
+      volume.writeFileSync(abs(path), bytes3(data2, encoding ?? void 0));
       if (typeof options === "object" && options?.mode !== void 0) volume.chmodSync(abs(path), options.mode);
     },
     appendFileSync: (path, data2, options) => {
       const encoding = typeof options === "object" && options ? options.encoding : options === "buffer" ? void 0 : options ?? void 0;
-      volume.appendFileSync(abs(path), bytes2(data2, encoding ?? void 0));
+      volume.appendFileSync(abs(path), bytes3(data2, encoding ?? void 0));
     },
     existsSync: (path) => {
       try {
@@ -53914,7 +54021,7 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
         offset2 = 0;
         length = data2.length;
       }
-      const input2 = bytes2(data2);
+      const input2 = bytes3(data2);
       const chunk = input2.subarray(offset2 ?? 0, (offset2 ?? 0) + (length ?? input2.length));
       const size = volume.lstatSync(file.path).size;
       const append = file.flags.startsWith("a") || (position ?? file.position) >= size;
@@ -54039,9 +54146,9 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
     const self2 = this;
     const append = () => {
       try {
-        const bytes3 = typeof chunk === "string" ? Buffer2.from(chunk, encoding) : chunk;
-        volume.appendFileSync(self2.path, new Uint8Array(bytes3));
-        self2.bytesWritten += bytes3.length;
+        const bytes4 = typeof chunk === "string" ? Buffer2.from(chunk, encoding) : chunk;
+        volume.appendFileSync(self2.path, new Uint8Array(bytes4));
+        self2.bytesWritten += bytes4.length;
         done();
       } catch (error) {
         done(error);
@@ -54242,6 +54349,57 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
       ({ offset: offset2, length, position } = options);
     }
     const start = offset2 ?? 0;
+    if (fd === 0 && stdin) {
+      const requested = length ?? buffer.byteLength - start;
+      const finish = (chunk) => {
+        const source = Buffer2.isBuffer(chunk) ? chunk : Buffer2.from(chunk);
+        const count = Math.min(requested, source.byteLength);
+        buffer.set(source.subarray(0, count), start);
+        if (count < source.byteLength && typeof stdin.unshift === "function") {
+          stdin.unshift(source.subarray(count));
+        }
+        cb(null, count, buffer);
+      };
+      const available = stdin.read();
+      if (available !== null) {
+        defer(() => finish(available));
+        return;
+      }
+      if (stdin.readableEnded || stdin.destroyed) {
+        defer(() => cb(null, 0, buffer));
+        return;
+      }
+      let settled = false;
+      const cleanup = () => {
+        stdin.removeListener("readable", onReadable);
+        stdin.removeListener("end", onEnd);
+        stdin.removeListener("error", onError);
+      };
+      const onReadable = () => {
+        if (settled) return;
+        const chunk = stdin.read();
+        if (chunk === null) return;
+        settled = true;
+        cleanup();
+        finish(chunk);
+      };
+      const onEnd = () => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        cb(null, 0, buffer);
+      };
+      const onError = (error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        cb(error);
+      };
+      stdin.on("readable", onReadable);
+      stdin.once("end", onEnd);
+      stdin.once("error", onError);
+      return;
+    }
     runThenCall(() => [fs.readSync(fd, buffer, start, length ?? buffer.byteLength - start, position ?? null), buffer], cb);
   };
   fs.write = (fd, data2, ...rest) => {
@@ -54333,8 +54491,8 @@ function createBufferBuiltin() {
       }
     },
     isAscii: (input2) => {
-      const bytes2 = input2 instanceof ArrayBuffer ? new Uint8Array(input2) : new Uint8Array(input2.buffer, input2.byteOffset, input2.byteLength);
-      for (const byte of bytes2) if (byte > 127) return false;
+      const bytes3 = input2 instanceof ArrayBuffer ? new Uint8Array(input2) : new Uint8Array(input2.buffer, input2.byteOffset, input2.byteLength);
+      for (const byte of bytes3) if (byte > 127) return false;
       return true;
     }
   };
@@ -54955,12 +55113,12 @@ var RemoteVolume = class {
     return new Uint8Array(this.call("readFileSync", [path]).body);
   }
   writeFileSync(path, data2) {
-    const bytes2 = typeof data2 === "string" ? encoder.encode(data2) : data2;
-    this.call("writeFileSync", [path], bytes2);
+    const bytes3 = typeof data2 === "string" ? encoder.encode(data2) : data2;
+    this.call("writeFileSync", [path], bytes3);
   }
   appendFileSync(path, data2) {
-    const bytes2 = typeof data2 === "string" ? encoder.encode(data2) : data2;
-    this.call("appendFileSync", [path], bytes2);
+    const bytes3 = typeof data2 === "string" ? encoder.encode(data2) : data2;
+    this.call("appendFileSync", [path], bytes3);
   }
   readdirSync(path) {
     return this.call("readdirSync", [path]).value;
@@ -55083,6 +55241,7 @@ async function main() {
   port.postMessage({ type: "sandboxedjs:ready" });
 }
 async function run(port, start) {
+  const hostThreadProcess = globalThis.process;
   installPromiseContext();
   const channel = new SyncChannelClient(start.buffers, () => port.postMessage({ type: "wake" }));
   const volume = new RemoteVolume(channel);
@@ -55122,6 +55281,8 @@ async function run(port, start) {
     onRawMode: (enabled) => port.postMessage({ type: "rawmode", enabled })
   });
   const guestGlobals = globalThis;
+  guestGlobals.process = core.globals.process;
+  guestGlobals.Buffer = core.globals.Buffer;
   if (typeof core.globals.fetch === "function") guestGlobals.fetch = core.globals.fetch;
   if (typeof core.globals.WebSocket === "function") guestGlobals.WebSocket = core.globals.WebSocket;
   if (typeof self !== "undefined" && typeof self.addEventListener === "function") {
@@ -55135,9 +55296,8 @@ async function run(port, start) {
       core.reportUnhandledRejection(event.reason);
     });
   } else {
-    const threadProcess = globalThis.process;
-    threadProcess?.on?.("uncaughtException", (error) => core.reportUncaught(error));
-    threadProcess?.on?.("unhandledRejection", (reason) => core.reportUnhandledRejection(reason));
+    hostThreadProcess?.on?.("uncaughtException", (error) => core.reportUncaught(error));
+    hostThreadProcess?.on?.("unhandledRejection", (reason) => core.reportUnhandledRejection(reason));
   }
   const finish = (code) => {
     if (finished) return;
@@ -55210,7 +55370,7 @@ async function settle(router, owner, core, killed) {
 var sockets = /* @__PURE__ */ new Map();
 function openSocket(port, router, message) {
   const opened = router.connect(message.port, message.init, {
-    data: (bytes2) => port.postMessage({ type: "ws-data", id: message.id, data: bytes2 }),
+    data: (bytes3) => port.postMessage({ type: "ws-data", id: message.id, data: bytes3 }),
     close: () => {
       sockets.delete(message.id);
       port.postMessage({ type: "ws-close", id: message.id });

package/docs/nextjs-compatibility.md

@@ -0,0 +1,17 @@
+# Next.js capability probe
+
+Run `node examples/nextjs-probe.mjs` against a local build. It installs Next 16.3.8,
+React 19.2 and requests a genuine App Router page. Successful CLI startup alone is
+not sufficient: HTTP 200 and the rendered marker are required.
+
+Observed on 2026-10-04: package installation succeeds and the CLI prints its startup
+banner, but initialization fails with an undefined `typescript` property during
+dev-bundler setup. The probe therefore exits unsuccessfully. Full Next.js support
+is **not verified**. Do not publish a support claim or relabel a Vite app as Next.js.
+
+For an interactive course, keep the real Next.js application as the download and
+use a separately labeled Vite adapter importing the same React components for the
+browser preview. Keep FastAPI and API contracts unchanged. Next-specific routing,
+server components and builds still need a native Node environment until verified.
+
+The probe is diagnostic only; no npm version bump or publication is included.