secure-exec 0.0.1 → 0.1.0-rc.1

package/dist/bridge/fs.js

@@ -0,0 +1,1572 @@
+// fs polyfill module for isolated-vm
+// This module runs inside the isolate and provides Node.js fs API compatibility
+// It communicates with the host via the _fs Reference object
+import { Buffer } from "buffer";
+// File descriptor table
+const fdTable = new Map();
+let nextFd = 3;
+const O_RDONLY = 0;
+const O_WRONLY = 1;
+const O_RDWR = 2;
+const O_ACCMODE = 3;
+const O_CREAT = 64;
+const O_EXCL = 128;
+const O_TRUNC = 512;
+const O_APPEND = 1024;
+// Stats class
+class Stats {
+    dev;
+    ino;
+    mode;
+    nlink;
+    uid;
+    gid;
+    rdev;
+    size;
+    blksize;
+    blocks;
+    atimeMs;
+    mtimeMs;
+    ctimeMs;
+    birthtimeMs;
+    atime;
+    mtime;
+    ctime;
+    birthtime;
+    constructor(init) {
+        this.dev = init.dev ?? 0;
+        this.ino = init.ino ?? 0;
+        this.mode = init.mode;
+        this.nlink = init.nlink ?? 1;
+        this.uid = init.uid ?? 0;
+        this.gid = init.gid ?? 0;
+        this.rdev = init.rdev ?? 0;
+        this.size = init.size;
+        this.blksize = init.blksize ?? 4096;
+        this.blocks = init.blocks ?? Math.ceil(init.size / 512);
+        this.atimeMs = init.atimeMs ?? Date.now();
+        this.mtimeMs = init.mtimeMs ?? Date.now();
+        this.ctimeMs = init.ctimeMs ?? Date.now();
+        this.birthtimeMs = init.birthtimeMs ?? Date.now();
+        this.atime = new Date(this.atimeMs);
+        this.mtime = new Date(this.mtimeMs);
+        this.ctime = new Date(this.ctimeMs);
+        this.birthtime = new Date(this.birthtimeMs);
+    }
+    isFile() {
+        return (this.mode & 61440) === 32768;
+    }
+    isDirectory() {
+        return (this.mode & 61440) === 16384;
+    }
+    isSymbolicLink() {
+        return (this.mode & 61440) === 40960;
+    }
+    isBlockDevice() {
+        return false;
+    }
+    isCharacterDevice() {
+        return false;
+    }
+    isFIFO() {
+        return false;
+    }
+    isSocket() {
+        return false;
+    }
+}
+// Dirent class for readdir with withFileTypes
+class Dirent {
+    name;
+    parentPath;
+    path; // Deprecated alias for parentPath
+    _isDir;
+    constructor(name, isDir, parentPath = "") {
+        this.name = name;
+        this._isDir = isDir;
+        this.parentPath = parentPath;
+        this.path = parentPath;
+    }
+    isFile() {
+        return !this._isDir;
+    }
+    isDirectory() {
+        return this._isDir;
+    }
+    isSymbolicLink() {
+        return false;
+    }
+    isBlockDevice() {
+        return false;
+    }
+    isCharacterDevice() {
+        return false;
+    }
+    isFIFO() {
+        return false;
+    }
+    isSocket() {
+        return false;
+    }
+}
+// ReadStream class for createReadStream
+// Provides a proper readable stream implementation that works with stream.pipeline
+class ReadStream {
+    _options;
+    // ReadStream-specific properties
+    bytesRead = 0;
+    path;
+    pending = true;
+    // Readable stream properties
+    readable = true;
+    readableAborted = false;
+    readableDidRead = false;
+    readableEncoding = null;
+    readableEnded = false;
+    readableFlowing = null;
+    readableHighWaterMark = 65536;
+    readableLength = 0;
+    readableObjectMode = false;
+    destroyed = false;
+    closed = false;
+    errored = null;
+    // Internal state
+    _content = null;
+    _position = 0;
+    _listeners = new Map();
+    _started = false;
+    constructor(filePath, _options) {
+        this._options = _options;
+        this.path = filePath;
+        if (_options?.encoding) {
+            this.readableEncoding = _options.encoding;
+        }
+        if (_options?.highWaterMark) {
+            this.readableHighWaterMark = _options.highWaterMark;
+        }
+    }
+    _loadContent() {
+        if (this._content === null) {
+            const pathStr = typeof this.path === 'string' ? this.path : this.path.toString();
+            // readFileSync already normalizes the path
+            this._content = fs.readFileSync(pathStr);
+            this.pending = false;
+        }
+        return this._content;
+    }
+    // Start reading - called when 'data' listener is added or resume() is called
+    _startReading() {
+        if (this._started || this.destroyed)
+            return;
+        this._started = true;
+        this.readableFlowing = true;
+        Promise.resolve().then(() => {
+            try {
+                const content = this._loadContent();
+                this.readableDidRead = true;
+                // Determine start/end positions
+                const start = this._options?.start ?? 0;
+                const end = this._options?.end ?? content.length;
+                const chunk = content.slice(start, end);
+                this.bytesRead = chunk.length;
+                // Emit data event
+                this.emit('data', chunk);
+                // Emit end and close
+                Promise.resolve().then(() => {
+                    this.readable = false;
+                    this.readableEnded = true;
+                    this.emit('end');
+                    Promise.resolve().then(() => {
+                        this.closed = true;
+                        this.emit('close');
+                    });
+                });
+            }
+            catch (err) {
+                this.errored = err;
+                this.emit('error', err);
+                this.destroy(err);
+            }
+        });
+    }
+    // Event handling
+    on(event, listener) {
+        if (!this._listeners.has(event)) {
+            this._listeners.set(event, []);
+        }
+        this._listeners.get(event).push(listener);
+        // Start reading when 'data' listener is added (flowing mode)
+        if (event === 'data' && !this._started) {
+            this._startReading();
+        }
+        return this;
+    }
+    once(event, listener) {
+        const wrapper = (...args) => {
+            this.off(event, wrapper);
+            listener(...args);
+        };
+        wrapper._originalListener = listener;
+        return this.on(event, wrapper);
+    }
+    off(event, listener) {
+        const listeners = this._listeners.get(event);
+        if (listeners) {
+            const idx = listeners.findIndex(fn => fn === listener || fn._originalListener === listener);
+            if (idx !== -1)
+                listeners.splice(idx, 1);
+        }
+        return this;
+    }
+    removeListener(event, listener) {
+        return this.off(event, listener);
+    }
+    removeAllListeners(event) {
+        if (event) {
+            this._listeners.delete(event);
+        }
+        else {
+            this._listeners.clear();
+        }
+        return this;
+    }
+    emit(event, ...args) {
+        const listeners = this._listeners.get(event);
+        if (listeners && listeners.length > 0) {
+            listeners.slice().forEach(fn => fn(...args));
+            return true;
+        }
+        return false;
+    }
+    // Readable methods
+    read(_size) {
+        if (this.readableEnded || this.destroyed)
+            return null;
+        try {
+            const content = this._loadContent();
+            const start = this._options?.start ?? 0;
+            const end = this._options?.end ?? content.length;
+            const chunk = content.slice(start, end);
+            this.bytesRead = chunk.length;
+            this.readableDidRead = true;
+            this.readable = false;
+            this.readableEnded = true;
+            // Schedule end event
+            Promise.resolve().then(() => {
+                this.emit('end');
+                Promise.resolve().then(() => {
+                    this.closed = true;
+                    this.emit('close');
+                });
+            });
+            return this.readableEncoding ? chunk.toString(this.readableEncoding) : chunk;
+        }
+        catch (err) {
+            this.errored = err;
+            this.emit('error', err);
+            return null;
+        }
+    }
+    pipe(destination, _options) {
+        const content = this._loadContent();
+        const start = this._options?.start ?? 0;
+        const end = this._options?.end ?? content.length;
+        const chunk = content.slice(start, end);
+        this.bytesRead = chunk.length;
+        this.readableDidRead = true;
+        if (typeof destination.write === 'function') {
+            destination.write(chunk);
+        }
+        if (typeof destination.end === 'function') {
+            Promise.resolve().then(() => destination.end());
+        }
+        this.readable = false;
+        this.readableEnded = true;
+        this.closed = true;
+        Promise.resolve().then(() => {
+            this.emit('end');
+            this.emit('close');
+        });
+        return destination;
+    }
+    unpipe(_destination) {
+        return this;
+    }
+    pause() {
+        this.readableFlowing = false;
+        return this;
+    }
+    resume() {
+        this.readableFlowing = true;
+        if (!this._started) {
+            this._startReading();
+        }
+        return this;
+    }
+    setEncoding(encoding) {
+        this.readableEncoding = encoding;
+        return this;
+    }
+    destroy(error) {
+        if (this.destroyed)
+            return this;
+        this.destroyed = true;
+        this.readable = false;
+        if (error) {
+            this.errored = error;
+            this.emit('error', error);
+        }
+        this.emit('close');
+        this.closed = true;
+        return this;
+    }
+    close(callback) {
+        if (this.closed) {
+            if (callback)
+                Promise.resolve().then(() => callback(null));
+            return;
+        }
+        this.closed = true;
+        this.readable = false;
+        this.destroyed = true;
+        Promise.resolve().then(() => {
+            this.emit('close');
+            if (callback)
+                callback(null);
+        });
+    }
+    // Symbol.asyncIterator for async iteration
+    async *[Symbol.asyncIterator]() {
+        const content = this._loadContent();
+        const start = this._options?.start ?? 0;
+        const end = this._options?.end ?? content.length;
+        const chunk = content.slice(start, end);
+        yield this.readableEncoding ? chunk.toString(this.readableEncoding) : chunk;
+    }
+}
+// WriteStream class for createWriteStream
+// This provides a type-safe implementation that satisfies nodeFs.WriteStream
+// We use 'as' assertion at the return site since the full interface is complex
+class WriteStream {
+    // WriteStream-specific properties
+    bytesWritten = 0;
+    path;
+    pending = false;
+    // Writable stream properties
+    writable = true;
+    writableAborted = false;
+    writableEnded = false;
+    writableFinished = false;
+    writableHighWaterMark = 16384;
+    writableLength = 0;
+    writableObjectMode = false;
+    writableCorked = 0;
+    destroyed = false;
+    closed = false;
+    errored = null;
+    writableNeedDrain = false;
+    // Internal state
+    _chunks = [];
+    _listeners = new Map();
+    constructor(filePath, _options) {
+        this.path = filePath;
+    }
+    // WriteStream-specific methods
+    close(callback) {
+        if (this.closed) {
+            if (callback)
+                Promise.resolve().then(() => callback(null));
+            return;
+        }
+        this.closed = true;
+        this.writable = false;
+        Promise.resolve().then(() => {
+            this.emit("close");
+            if (callback)
+                callback(null);
+        });
+    }
+    // Writable methods
+    write(chunk, encodingOrCallback, callback) {
+        if (this.writableEnded || this.destroyed) {
+            const err = new Error("write after end");
+            if (typeof encodingOrCallback === "function") {
+                Promise.resolve().then(() => encodingOrCallback(err));
+            }
+            else if (callback) {
+                Promise.resolve().then(() => callback(err));
+            }
+            return false;
+        }
+        let data;
+        if (typeof chunk === "string") {
+            data = Buffer.from(chunk, typeof encodingOrCallback === "string" ? encodingOrCallback : "utf8");
+        }
+        else if (Buffer.isBuffer(chunk)) {
+            data = new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+        }
+        else if (chunk instanceof Uint8Array) {
+            data = chunk;
+        }
+        else {
+            data = Buffer.from(String(chunk));
+        }
+        this._chunks.push(data);
+        this.bytesWritten += data.length;
+        this.writableLength += data.length;
+        const cb = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+        if (cb)
+            Promise.resolve().then(() => cb(null));
+        return true;
+    }
+    end(chunkOrCb, encodingOrCallback, callback) {
+        if (this.writableEnded)
+            return this;
+        let cb;
+        if (typeof chunkOrCb === "function") {
+            cb = chunkOrCb;
+        }
+        else if (typeof encodingOrCallback === "function") {
+            cb = encodingOrCallback;
+            if (chunkOrCb !== undefined && chunkOrCb !== null) {
+                this.write(chunkOrCb);
+            }
+        }
+        else {
+            cb = callback;
+            if (chunkOrCb !== undefined && chunkOrCb !== null) {
+                this.write(chunkOrCb, encodingOrCallback);
+            }
+        }
+        this.writableEnded = true;
+        // Concatenate and write all chunks
+        const totalLength = this._chunks.reduce((sum, c) => sum + c.length, 0);
+        const result = new Uint8Array(totalLength);
+        let offset = 0;
+        for (const c of this._chunks) {
+            result.set(c, offset);
+            offset += c.length;
+        }
+        // Write to filesystem
+        const pathStr = typeof this.path === "string" ? this.path : this.path.toString();
+        fs.writeFileSync(pathStr, result);
+        this.writable = false;
+        this.writableFinished = true;
+        this.writableLength = 0;
+        Promise.resolve().then(() => {
+            this.emit("finish");
+            this.emit("close");
+            this.closed = true;
+            if (cb)
+                cb();
+        });
+        return this;
+    }
+    setDefaultEncoding(_encoding) {
+        return this;
+    }
+    cork() {
+        this.writableCorked++;
+    }
+    uncork() {
+        if (this.writableCorked > 0)
+            this.writableCorked--;
+    }
+    destroy(error) {
+        if (this.destroyed)
+            return this;
+        this.destroyed = true;
+        this.writable = false;
+        if (error) {
+            this.errored = error;
+            Promise.resolve().then(() => {
+                this.emit("error", error);
+                this.emit("close");
+                this.closed = true;
+            });
+        }
+        else {
+            Promise.resolve().then(() => {
+                this.emit("close");
+                this.closed = true;
+            });
+        }
+        return this;
+    }
+    // Internal methods (required by Writable interface but not typically called directly)
+    _write(_chunk, _encoding, callback) {
+        callback();
+    }
+    _destroy(_error, callback) {
+        callback();
+    }
+    _final(callback) {
+        callback();
+    }
+    // EventEmitter methods
+    addListener(event, listener) {
+        return this.on(event, listener);
+    }
+    on(event, listener) {
+        const listeners = this._listeners.get(event) || [];
+        listeners.push(listener);
+        this._listeners.set(event, listeners);
+        return this;
+    }
+    once(event, listener) {
+        const wrapper = (...args) => {
+            this.removeListener(event, wrapper);
+            listener(...args);
+        };
+        return this.on(event, wrapper);
+    }
+    prependListener(event, listener) {
+        const listeners = this._listeners.get(event) || [];
+        listeners.unshift(listener);
+        this._listeners.set(event, listeners);
+        return this;
+    }
+    prependOnceListener(event, listener) {
+        const wrapper = (...args) => {
+            this.removeListener(event, wrapper);
+            listener(...args);
+        };
+        return this.prependListener(event, wrapper);
+    }
+    removeListener(event, listener) {
+        const listeners = this._listeners.get(event);
+        if (listeners) {
+            const idx = listeners.indexOf(listener);
+            if (idx !== -1)
+                listeners.splice(idx, 1);
+        }
+        return this;
+    }
+    off(event, listener) {
+        return this.removeListener(event, listener);
+    }
+    removeAllListeners(event) {
+        if (event !== undefined) {
+            this._listeners.delete(event);
+        }
+        else {
+            this._listeners.clear();
+        }
+        return this;
+    }
+    emit(event, ...args) {
+        const listeners = this._listeners.get(event);
+        if (listeners && listeners.length > 0) {
+            listeners.slice().forEach(l => l(...args));
+            return true;
+        }
+        return false;
+    }
+    listeners(event) {
+        return [...(this._listeners.get(event) || [])];
+    }
+    rawListeners(event) {
+        return this.listeners(event);
+    }
+    listenerCount(event) {
+        return (this._listeners.get(event) || []).length;
+    }
+    eventNames() {
+        return [...this._listeners.keys()];
+    }
+    getMaxListeners() {
+        return 10;
+    }
+    setMaxListeners(_n) {
+        return this;
+    }
+    // Pipe methods (minimal implementation)
+    pipe(destination, _options) {
+        return destination;
+    }
+    unpipe(_destination) {
+        return this;
+    }
+    // Additional required methods
+    compose(_stream, _options) {
+        throw new Error("compose not implemented in sandbox");
+    }
+    [Symbol.asyncDispose]() {
+        return Promise.resolve();
+    }
+}
+// Parse flags string to number
+function parseFlags(flags) {
+    if (typeof flags === "number")
+        return flags;
+    const flagMap = {
+        r: O_RDONLY,
+        "r+": O_RDWR,
+        w: O_WRONLY | O_CREAT | O_TRUNC,
+        "w+": O_RDWR | O_CREAT | O_TRUNC,
+        a: O_WRONLY | O_APPEND | O_CREAT,
+        "a+": O_RDWR | O_APPEND | O_CREAT,
+        wx: O_WRONLY | O_CREAT | O_TRUNC | O_EXCL,
+        xw: O_WRONLY | O_CREAT | O_TRUNC | O_EXCL,
+        "wx+": O_RDWR | O_CREAT | O_TRUNC | O_EXCL,
+        "xw+": O_RDWR | O_CREAT | O_TRUNC | O_EXCL,
+        ax: O_WRONLY | O_APPEND | O_CREAT | O_EXCL,
+        xa: O_WRONLY | O_APPEND | O_CREAT | O_EXCL,
+        "ax+": O_RDWR | O_APPEND | O_CREAT | O_EXCL,
+        "xa+": O_RDWR | O_APPEND | O_CREAT | O_EXCL,
+    };
+    if (flags in flagMap)
+        return flagMap[flags];
+    throw new Error("Unknown file flag: " + flags);
+}
+// Check if flags allow reading
+function canRead(flags) {
+    const mode = flags & O_ACCMODE;
+    return mode === 0 || mode === 2;
+}
+// Check if flags allow writing
+function canWrite(flags) {
+    const mode = flags & O_ACCMODE;
+    return mode === 1 || mode === 2;
+}
+// Helper to create fs errors
+function createFsError(code, message, syscall, path) {
+    const err = new Error(message);
+    err.code = code;
+    err.errno = code === "ENOENT" ? -2 : code === "EBADF" ? -9 : -1;
+    err.syscall = syscall;
+    if (path)
+        err.path = path;
+    return err;
+}
+// Helper to convert PathLike to string
+function toPathString(path) {
+    if (typeof path === "string")
+        return path;
+    if (Buffer.isBuffer(path))
+        return path.toString("utf8");
+    if (path instanceof URL)
+        return path.pathname;
+    return String(path);
+}
+// Note: Path normalization is handled by VirtualFileSystem, not here.
+// The VFS expects /data/* paths for Directory access, so we pass paths through unchanged.
+// The fs module implementation
+const fs = {
+    // Constants
+    constants: {
+        // File Access Constants
+        F_OK: 0,
+        R_OK: 4,
+        W_OK: 2,
+        X_OK: 1,
+        // File Copy Constants
+        COPYFILE_EXCL: 1,
+        COPYFILE_FICLONE: 2,
+        COPYFILE_FICLONE_FORCE: 4,
+        // File Open Constants
+        O_RDONLY,
+        O_WRONLY,
+        O_RDWR,
+        O_CREAT,
+        O_EXCL,
+        O_NOCTTY: 256,
+        O_TRUNC,
+        O_APPEND,
+        O_DIRECTORY: 65536,
+        O_NOATIME: 262144,
+        O_NOFOLLOW: 131072,
+        O_SYNC: 1052672,
+        O_DSYNC: 4096,
+        O_SYMLINK: 2097152,
+        O_DIRECT: 16384,
+        O_NONBLOCK: 2048,
+        // File Type Constants
+        S_IFMT: 61440,
+        S_IFREG: 32768,
+        S_IFDIR: 16384,
+        S_IFCHR: 8192,
+        S_IFBLK: 24576,
+        S_IFIFO: 4096,
+        S_IFLNK: 40960,
+        S_IFSOCK: 49152,
+        // File Mode Constants
+        S_IRWXU: 448,
+        S_IRUSR: 256,
+        S_IWUSR: 128,
+        S_IXUSR: 64,
+        S_IRWXG: 56,
+        S_IRGRP: 32,
+        S_IWGRP: 16,
+        S_IXGRP: 8,
+        S_IRWXO: 7,
+        S_IROTH: 4,
+        S_IWOTH: 2,
+        S_IXOTH: 1,
+        UV_FS_O_FILEMAP: 536870912,
+    },
+    Stats,
+    Dirent,
+    // Sync methods
+    readFileSync(path, options) {
+        const rawPath = typeof path === "number" ? fdTable.get(path)?.path : toPathString(path);
+        if (!rawPath)
+            throw createFsError("EBADF", "EBADF: bad file descriptor", "read");
+        const pathStr = rawPath;
+        const encoding = typeof options === "string" ? options : options?.encoding;
+        try {
+            if (encoding) {
+                // Text mode - use text read
+                const content = _fs.readFile.applySyncPromise(undefined, [pathStr]);
+                return content;
+            }
+            else {
+                // Binary mode - use binary read with base64 encoding
+                const base64Content = _fs.readFileBinary.applySyncPromise(undefined, [pathStr]);
+                return Buffer.from(base64Content, "base64");
+            }
+        }
+        catch (err) {
+            // Convert "entry not found" and similar errors to proper ENOENT
+            const errMsg = err.message || String(err);
+            if (errMsg.includes("entry not found") || errMsg.includes("not found")) {
+                throw createFsError("ENOENT", `ENOENT: no such file or directory, read '${rawPath}'`, "read", rawPath);
+            }
+            throw err;
+        }
+    },
+    writeFileSync(file, data, _options) {
+        const rawPath = typeof file === "number" ? fdTable.get(file)?.path : toPathString(file);
+        if (!rawPath)
+            throw createFsError("EBADF", "EBADF: bad file descriptor", "write");
+        const pathStr = rawPath;
+        if (typeof data === "string") {
+            // Text mode - use text write
+            _fs.writeFile.applySyncPromise(undefined, [pathStr, data]);
+        }
+        else if (ArrayBuffer.isView(data)) {
+            // Binary mode - convert to base64 and use binary write
+            const uint8 = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+            const base64 = Buffer.from(uint8).toString("base64");
+            _fs.writeFileBinary.applySyncPromise(undefined, [pathStr, base64]);
+        }
+        else {
+            // Fallback to text mode
+            _fs.writeFile.applySyncPromise(undefined, [pathStr, String(data)]);
+        }
+    },
+    appendFileSync(path, data, options) {
+        const existing = fs.existsSync(path)
+            ? fs.readFileSync(path, "utf8")
+            : "";
+        const content = typeof data === "string" ? data : String(data);
+        fs.writeFileSync(path, existing + content, options);
+    },
+    readdirSync(path, options) {
+        const rawPath = toPathString(path);
+        const pathStr = rawPath;
+        let entriesJson;
+        try {
+            entriesJson = _fs.readDir.applySyncPromise(undefined, [pathStr]);
+        }
+        catch (err) {
+            // Convert "entry not found" and similar errors to proper ENOENT
+            const errMsg = err.message || String(err);
+            if (errMsg.includes("entry not found") || errMsg.includes("not found")) {
+                throw createFsError("ENOENT", `ENOENT: no such file or directory, scandir '${rawPath}'`, "scandir", rawPath);
+            }
+            throw err;
+        }
+        const entries = JSON.parse(entriesJson);
+        if (options?.withFileTypes) {
+            return entries.map((e) => new Dirent(e.name, e.isDirectory, rawPath));
+        }
+        return entries.map((e) => e.name);
+    },
+    mkdirSync(path, options) {
+        const rawPath = toPathString(path);
+        const pathStr = rawPath;
+        const recursive = typeof options === "object" ? options?.recursive ?? false : false;
+        _fs.mkdir.applySyncPromise(undefined, [pathStr, recursive]);
+        return recursive ? rawPath : undefined;
+    },
+    rmdirSync(path, _options) {
+        const pathStr = toPathString(path);
+        _fs.rmdir.applySyncPromise(undefined, [pathStr]);
+    },
+    rmSync(path, options) {
+        const pathStr = toPathString(path);
+        const opts = options || {};
+        try {
+            const stats = fs.statSync(pathStr);
+            if (stats.isDirectory()) {
+                if (opts.recursive) {
+                    // Recursively remove directory contents
+                    const entries = fs.readdirSync(pathStr);
+                    for (const entry of entries) {
+                        const entryPath = pathStr.endsWith("/") ? pathStr + entry : pathStr + "/" + entry;
+                        const entryStats = fs.statSync(entryPath);
+                        if (entryStats.isDirectory()) {
+                            fs.rmSync(entryPath, { recursive: true });
+                        }
+                        else {
+                            fs.unlinkSync(entryPath);
+                        }
+                    }
+                    fs.rmdirSync(pathStr);
+                }
+                else {
+                    fs.rmdirSync(pathStr);
+                }
+            }
+            else {
+                fs.unlinkSync(pathStr);
+            }
+        }
+        catch (e) {
+            if (opts.force && e.code === "ENOENT") {
+                return; // Ignore ENOENT when force is true
+            }
+            throw e;
+        }
+    },
+    existsSync(path) {
+        const pathStr = toPathString(path);
+        return _fs.exists.applySyncPromise(undefined, [pathStr]);
+    },
+    statSync(path, _options) {
+        const rawPath = toPathString(path);
+        const pathStr = rawPath;
+        let statJson;
+        try {
+            statJson = _fs.stat.applySyncPromise(undefined, [pathStr]);
+        }
+        catch (err) {
+            // Convert various "not found" errors to proper ENOENT
+            const errMsg = err.message || String(err);
+            if (errMsg.includes("entry not found") ||
+                errMsg.includes("not found") ||
+                errMsg.includes("ENOENT") ||
+                errMsg.includes("no such file or directory")) {
+                throw createFsError("ENOENT", `ENOENT: no such file or directory, stat '${rawPath}'`, "stat", rawPath);
+            }
+            throw err;
+        }
+        const stat = JSON.parse(statJson);
+        return new Stats(stat);
+    },
+    lstatSync(path, _options) {
+        // In our virtual fs, lstat is the same as stat (no symlinks)
+        return fs.statSync(path);
+    },
+    unlinkSync(path) {
+        const pathStr = toPathString(path);
+        _fs.unlink.applySyncPromise(undefined, [pathStr]);
+    },
+    renameSync(oldPath, newPath) {
+        const oldPathStr = toPathString(oldPath);
+        const newPathStr = toPathString(newPath);
+        _fs.rename.applySyncPromise(undefined, [oldPathStr, newPathStr]);
+    },
+    copyFileSync(src, dest, _mode) {
+        // readFileSync and writeFileSync already normalize paths
+        const content = fs.readFileSync(src);
+        fs.writeFileSync(dest, content);
+    },
+    // File descriptor methods
+    openSync(path, flags, _mode) {
+        const rawPath = toPathString(path);
+        const pathStr = rawPath;
+        const numFlags = parseFlags(flags);
+        const fd = nextFd++;
+        // Check if file exists (existsSync already normalizes)
+        const exists = fs.existsSync(path);
+        // Handle O_CREAT - create file if it doesn't exist
+        if (numFlags & 64 && !exists) {
+            fs.writeFileSync(path, "");
+        }
+        else if (!exists && !(numFlags & 64)) {
+            throw createFsError("ENOENT", `ENOENT: no such file or directory, open '${rawPath}'`, "open", rawPath);
+        }
+        // Handle O_TRUNC - truncate file
+        if (numFlags & 512 && exists) {
+            fs.writeFileSync(path, "");
+        }
+        // Store normalized path in fd table for subsequent operations
+        fdTable.set(fd, { path: pathStr, flags: numFlags, position: 0 });
+        return fd;
+    },
+    closeSync(fd) {
+        if (!fdTable.has(fd)) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, close", "close");
+        }
+        fdTable.delete(fd);
+    },
+    readSync(fd, buffer, offset, length, position) {
+        const entry = fdTable.get(fd);
+        if (!entry) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, read", "read");
+        }
+        if (!canRead(entry.flags)) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, read", "read");
+        }
+        const content = fs.readFileSync(entry.path, "utf8");
+        const readOffset = offset ?? 0;
+        const readLength = length ?? (buffer.byteLength - readOffset);
+        const pos = position !== null && position !== undefined ? Number(position) : entry.position;
+        const toRead = content.slice(pos, pos + readLength);
+        const bytes = Buffer.from(toRead);
+        const targetBuffer = new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+        for (let i = 0; i < bytes.length && i < readLength; i++) {
+            targetBuffer[readOffset + i] = bytes[i];
+        }
+        if (position === null || position === undefined) {
+            entry.position += bytes.length;
+        }
+        return bytes.length;
+    },
+    writeSync(fd, buffer, offsetOrPosition, lengthOrEncoding, position) {
+        const entry = fdTable.get(fd);
+        if (!entry) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, write", "write");
+        }
+        // fs.writeSync
+        if (!canWrite(entry.flags)) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, write", "write");
+        }
+        // Handle string or buffer
+        let data;
+        let writePosition;
+        if (typeof buffer === "string") {
+            data = buffer;
+            writePosition = offsetOrPosition;
+        }
+        else {
+            const offset = offsetOrPosition ?? 0;
+            const length = (typeof lengthOrEncoding === "number" ? lengthOrEncoding : null) ?? (buffer.byteLength - offset);
+            const view = new Uint8Array(buffer.buffer, buffer.byteOffset + offset, length);
+            data = new TextDecoder().decode(view);
+            writePosition = position;
+        }
+        // Read existing content
+        let content = "";
+        if (fs.existsSync(entry.path)) {
+            content = fs.readFileSync(entry.path, "utf8");
+        }
+        // Determine write position
+        let writePos;
+        if (entry.flags & 1024) {
+            // O_APPEND
+            writePos = content.length;
+        }
+        else if (writePosition !== null && writePosition !== undefined) {
+            writePos = writePosition;
+        }
+        else {
+            writePos = entry.position;
+        }
+        // Pad with nulls if writing past end
+        while (content.length < writePos) {
+            content += "\0";
+        }
+        // Write data
+        const newContent = content.slice(0, writePos) + data + content.slice(writePos + data.length);
+        fs.writeFileSync(entry.path, newContent);
+        // Update position if not using explicit position
+        if (writePosition === null || writePosition === undefined) {
+            entry.position = writePos + data.length;
+        }
+        return data.length;
+    },
+    fstatSync(fd) {
+        const entry = fdTable.get(fd);
+        if (!entry) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, fstat", "fstat");
+        }
+        return fs.statSync(entry.path);
+    },
+    ftruncateSync(fd, len) {
+        const entry = fdTable.get(fd);
+        if (!entry) {
+            throw createFsError("EBADF", "EBADF: bad file descriptor, ftruncate", "ftruncate");
+        }
+        const content = fs.existsSync(entry.path)
+            ? fs.readFileSync(entry.path, "utf8")
+            : "";
+        const newLen = len ?? 0;
+        if (content.length > newLen) {
+            fs.writeFileSync(entry.path, content.slice(0, newLen));
+        }
+        else {
+            let padded = content;
+            while (padded.length < newLen)
+                padded += "\0";
+            fs.writeFileSync(entry.path, padded);
+        }
+    },
+    // Async methods - wrap sync methods in callbacks/promises
+    //
+    // IMPORTANT: Low-level fd operations (open, close, read, write) and operations commonly
+    // used by streaming libraries (stat, lstat, rename, unlink) must defer their callbacks
+    // using queueMicrotask(). This is critical for proper stream operation.
+    //
+    // Why: Node.js streams (like tar, minipass, fs-minipass) use callback chains where each
+    // callback triggers the next read/write operation. These streams also rely on events like
+    // 'drain' to know when to resume writing. If callbacks fire synchronously, the event loop
+    // never gets a chance to process these events, causing streams to stall after the first chunk.
+    //
+    // Example problem without queueMicrotask:
+    //   1. tar calls fs.read() with callback
+    //   2. Our sync implementation calls callback immediately
+    //   3. Callback writes to stream, stream buffer fills, returns false (needs drain)
+    //   4. Code sets up 'drain' listener and returns
+    //   5. But we never returned to event loop, so 'drain' never fires
+    //   6. Stream hangs forever
+    //
+    // With queueMicrotask, step 2 defers the callback, allowing the event loop to process
+    // pending events (including 'drain') before the next operation starts.
+    readFile(path, options, callback) {
+        if (typeof options === "function") {
+            callback = options;
+            options = undefined;
+        }
+        if (callback) {
+            try {
+                callback(null, fs.readFileSync(path, options));
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.readFileSync(path, options));
+        }
+    },
+    writeFile(path, data, options, callback) {
+        if (typeof options === "function") {
+            callback = options;
+            options = undefined;
+        }
+        if (callback) {
+            try {
+                fs.writeFileSync(path, data, options);
+                callback(null);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.writeFileSync(path, data, options));
+        }
+    },
+    appendFile(path, data, options, callback) {
+        if (typeof options === "function") {
+            callback = options;
+            options = undefined;
+        }
+        if (callback) {
+            try {
+                fs.appendFileSync(path, data, options);
+                callback(null);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.appendFileSync(path, data, options));
+        }
+    },
+    readdir(path, options, callback) {
+        if (typeof options === "function") {
+            callback = options;
+            options = undefined;
+        }
+        if (callback) {
+            try {
+                callback(null, fs.readdirSync(path, options));
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.readdirSync(path, options));
+        }
+    },
+    mkdir(path, options, callback) {
+        if (typeof options === "function") {
+            callback = options;
+            options = undefined;
+        }
+        if (callback) {
+            try {
+                fs.mkdirSync(path, options);
+                callback(null);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            fs.mkdirSync(path, options);
+            return Promise.resolve();
+        }
+    },
+    rmdir(path, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                fs.rmdirSync(path);
+                queueMicrotask(() => cb(null));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.rmdirSync(path));
+        }
+    },
+    // rm - remove files or directories (with recursive support)
+    rm(path, options, callback) {
+        let opts = {};
+        let cb;
+        if (typeof options === "function") {
+            cb = options;
+        }
+        else if (options) {
+            opts = options;
+            cb = callback;
+        }
+        else {
+            cb = callback;
+        }
+        const doRm = () => {
+            try {
+                const stats = fs.statSync(path);
+                if (stats.isDirectory()) {
+                    if (opts.recursive) {
+                        // Recursively remove directory contents
+                        const entries = fs.readdirSync(path);
+                        for (const entry of entries) {
+                            const entryPath = path.endsWith("/") ? path + entry : path + "/" + entry;
+                            const entryStats = fs.statSync(entryPath);
+                            if (entryStats.isDirectory()) {
+                                fs.rmSync(entryPath, { recursive: true });
+                            }
+                            else {
+                                fs.unlinkSync(entryPath);
+                            }
+                        }
+                        fs.rmdirSync(path);
+                    }
+                    else {
+                        fs.rmdirSync(path);
+                    }
+                }
+                else {
+                    fs.unlinkSync(path);
+                }
+            }
+            catch (e) {
+                if (opts.force && e.code === "ENOENT") {
+                    return; // Ignore ENOENT when force is true
+                }
+                throw e;
+            }
+        };
+        if (cb) {
+            // Defer callback to next tick to allow event loop to process stream events
+            try {
+                doRm();
+                queueMicrotask(() => cb(null));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            doRm();
+            return Promise.resolve();
+        }
+    },
+    exists(path, callback) {
+        if (callback) {
+            callback(fs.existsSync(path));
+        }
+        else {
+            return Promise.resolve(fs.existsSync(path));
+        }
+    },
+    stat(path, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                const stats = fs.statSync(path);
+                queueMicrotask(() => cb(null, stats));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.statSync(path));
+        }
+    },
+    lstat(path, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                const stats = fs.lstatSync(path);
+                queueMicrotask(() => cb(null, stats));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.lstatSync(path));
+        }
+    },
+    unlink(path, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                fs.unlinkSync(path);
+                queueMicrotask(() => cb(null));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.unlinkSync(path));
+        }
+    },
+    rename(oldPath, newPath, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                fs.renameSync(oldPath, newPath);
+                queueMicrotask(() => cb(null));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.renameSync(oldPath, newPath));
+        }
+    },
+    copyFile(src, dest, callback) {
+        if (callback) {
+            try {
+                fs.copyFileSync(src, dest);
+                callback(null);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.copyFileSync(src, dest));
+        }
+    },
+    open(path, flags, mode, callback) {
+        if (typeof mode === "function") {
+            callback = mode;
+            mode = undefined;
+        }
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                const fd = fs.openSync(path, flags, mode);
+                queueMicrotask(() => cb(null, fd));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.openSync(path, flags, mode));
+        }
+    },
+    close(fd, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                fs.closeSync(fd);
+                queueMicrotask(() => cb(null));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.closeSync(fd));
+        }
+    },
+    read(fd, buffer, offset, length, position, callback) {
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                const bytesRead = fs.readSync(fd, buffer, offset, length, position);
+                queueMicrotask(() => cb(null, bytesRead, buffer));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.readSync(fd, buffer, offset, length, position));
+        }
+    },
+    write(fd, buffer, offset, length, position, callback) {
+        if (typeof offset === "function") {
+            callback = offset;
+            offset = undefined;
+            length = undefined;
+            position = undefined;
+        }
+        else if (typeof length === "function") {
+            callback = length;
+            length = undefined;
+            position = undefined;
+        }
+        else if (typeof position === "function") {
+            callback = position;
+            position = undefined;
+        }
+        if (callback) {
+            // Defer callback to next tick to allow event loop to process stream events
+            const cb = callback;
+            try {
+                const bytesWritten = fs.writeSync(fd, buffer, offset, length, position);
+                queueMicrotask(() => cb(null, bytesWritten));
+            }
+            catch (e) {
+                queueMicrotask(() => cb(e));
+            }
+        }
+        else {
+            return Promise.resolve(fs.writeSync(fd, buffer, offset, length, position));
+        }
+    },
+    // writev - write multiple buffers to a file descriptor
+    writev(fd, buffers, position, callback) {
+        if (typeof position === "function") {
+            callback = position;
+            position = null;
+        }
+        if (callback) {
+            try {
+                const bytesWritten = fs.writevSync(fd, buffers, position);
+                callback(null, bytesWritten, buffers);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+    },
+    writevSync(fd, buffers, position) {
+        let totalBytesWritten = 0;
+        for (const buffer of buffers) {
+            const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+            totalBytesWritten += fs.writeSync(fd, bytes, 0, bytes.length, position);
+            if (position !== null && position !== undefined) {
+                position += bytes.length;
+            }
+        }
+        return totalBytesWritten;
+    },
+    fstat(fd, callback) {
+        if (callback) {
+            try {
+                callback(null, fs.fstatSync(fd));
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return Promise.resolve(fs.fstatSync(fd));
+        }
+    },
+    // fs.promises API
+    // Note: Using async functions to properly catch sync errors and return rejected promises
+    promises: {
+        async readFile(path, options) {
+            return fs.readFileSync(path, options);
+        },
+        async writeFile(path, data, options) {
+            return fs.writeFileSync(path, data, options);
+        },
+        async appendFile(path, data, options) {
+            return fs.appendFileSync(path, data, options);
+        },
+        async readdir(path, options) {
+            return fs.readdirSync(path, options);
+        },
+        async mkdir(path, options) {
+            return fs.mkdirSync(path, options);
+        },
+        async rmdir(path) {
+            return fs.rmdirSync(path);
+        },
+        async stat(path) {
+            return fs.statSync(path);
+        },
+        async lstat(path) {
+            return fs.lstatSync(path);
+        },
+        async unlink(path) {
+            return fs.unlinkSync(path);
+        },
+        async rename(oldPath, newPath) {
+            return fs.renameSync(oldPath, newPath);
+        },
+        async copyFile(src, dest) {
+            return fs.copyFileSync(src, dest);
+        },
+        async access(path) {
+            if (!fs.existsSync(path)) {
+                throw createFsError("ENOENT", `ENOENT: no such file or directory, access '${path}'`, "access", path);
+            }
+        },
+        async rm(path, options) {
+            return fs.rmSync(path, options);
+        },
+        async chmod() {
+            throw new Error("fs.chmod is not supported in sandbox");
+        },
+        async chown() {
+            throw new Error("fs.chown is not supported in sandbox");
+        },
+        async link() {
+            throw new Error("fs.link is not supported in sandbox");
+        },
+        async symlink() {
+            throw new Error("fs.symlink is not supported in sandbox");
+        },
+        async readlink() {
+            throw new Error("fs.readlink is not supported in sandbox");
+        },
+        async truncate() {
+            throw new Error("fs.truncate is not supported in sandbox");
+        },
+        async utimes() {
+            throw new Error("fs.utimes is not supported in sandbox");
+        },
+    },
+    // Compatibility methods
+    accessSync(path) {
+        // existsSync already normalizes the path
+        if (!fs.existsSync(path)) {
+            throw createFsError("ENOENT", `ENOENT: no such file or directory, access '${path}'`, "access", path);
+        }
+    },
+    access(path, mode, callback) {
+        if (typeof mode === "function") {
+            callback = mode;
+            mode = undefined;
+        }
+        if (callback) {
+            try {
+                fs.accessSync(path);
+                callback(null);
+            }
+            catch (e) {
+                callback(e);
+            }
+        }
+        else {
+            return fs.promises.access(path);
+        }
+    },
+    realpathSync: Object.assign(function realpathSync(path) {
+        // In our virtual fs, just normalize the path (keep /data prefix for consistency)
+        return toPathString(path)
+            .replace(/\/\/+/g, "/")
+            .replace(/\/$/, "") || "/";
+    }, {
+        native(path) {
+            return toPathString(path)
+                .replace(/\/\/+/g, "/")
+                .replace(/\/$/, "") || "/";
+        }
+    }),
+    realpath: Object.assign(function realpath(path, callback) {
+        if (callback) {
+            callback(null, fs.realpathSync(path));
+        }
+        else {
+            return Promise.resolve(fs.realpathSync(path));
+        }
+    }, {
+        native(path, callback) {
+            if (callback) {
+                callback(null, fs.realpathSync.native(path));
+            }
+            else {
+                return Promise.resolve(fs.realpathSync.native(path));
+            }
+        }
+    }),
+    createReadStream(path, options) {
+        const pathStr = typeof path === "string" ? path : path instanceof Buffer ? path.toString() : String(path);
+        const opts = typeof options === "string" ? { encoding: options } : options;
+        // Use type assertion since our ReadStream has all the methods npm needs
+        // but not all the complex overloaded signatures of the full Node.js interface
+        return new ReadStream(pathStr, opts);
+    },
+    createWriteStream(path, options) {
+        const pathStr = typeof path === "string" ? path : path instanceof Buffer ? path.toString() : String(path);
+        const opts = typeof options === "string" ? { encoding: options } : options;
+        // Use type assertion since our WriteStream has all the methods npm needs
+        // but not all the complex overloaded signatures of the full Node.js interface
+        return new WriteStream(pathStr, opts);
+    },
+    // Get unsupported fs APIs as deterministic errors
+    watch(..._args) {
+        throw new Error("fs.watch is not supported in sandbox");
+    },
+    watchFile(..._args) {
+        throw new Error("fs.watchFile is not supported in sandbox");
+    },
+    unwatchFile(..._args) {
+        throw new Error("fs.unwatchFile is not supported in sandbox");
+    },
+    chmod(..._args) {
+        throw new Error("fs.chmod is not supported in sandbox");
+    },
+    chown(..._args) {
+        throw new Error("fs.chown is not supported in sandbox");
+    },
+    link(..._args) {
+        throw new Error("fs.link is not supported in sandbox");
+    },
+    symlink(..._args) {
+        throw new Error("fs.symlink is not supported in sandbox");
+    },
+    readlink(..._args) {
+        throw new Error("fs.readlink is not supported in sandbox");
+    },
+    truncate(..._args) {
+        throw new Error("fs.truncate is not supported in sandbox");
+    },
+    utimes(..._args) {
+        throw new Error("fs.utimes is not supported in sandbox");
+    },
+};
+// Export the fs module
+export default fs;