secure-exec 0.1.1-rc.2 → 0.2.0-rc.1

package/dist/bridge-loader.d.ts

@@ -1 +1 @@
-export { getRawBridgeCode, getBridgeAttachCode } from "@secure-exec/node/internal/bridge-loader";
+export { getRawBridgeCode, getBridgeAttachCode } from "@secure-exec/nodejs/internal/bridge-loader";

package/dist/bridge-loader.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/bridge-loader.ts
-export { getRawBridgeCode, getBridgeAttachCode } from "@secure-exec/node/internal/bridge-loader";
+// Re-exported from @secure-exec/nodejs — canonical source is packages/nodejs/src/bridge-loader.ts
+export { getRawBridgeCode, getBridgeAttachCode } from "@secure-exec/nodejs/internal/bridge-loader";

package/dist/bridge-setup.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/core — canonical source is packages/secure-exec-core/src/bridge-setup.ts
+// Re-exported from @secure-exec/core — canonical source is packages/core/src/bridge-setup.ts
 export { getInitialBridgeGlobalsSetupCode } from "@secure-exec/core";

package/dist/esm-compiler.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/core — canonical source is packages/secure-exec-core/src/esm-compiler.ts
+// Re-exported from @secure-exec/core — canonical source moved to packages/nodejs/src/esm-compiler.ts (US-003)
 export { getStaticBuiltinWrapperSource, createBuiltinESMWrapper, getEmptyBuiltinESMWrapper, } from "@secure-exec/core";

package/dist/index.d.ts

@@ -1,10 +1,14 @@
 export { NodeRuntime } from "./runtime.js";
 export type { NodeRuntimeOptions } from "./runtime.js";
 export type { ResourceBudgets } from "./runtime-driver.js";
-export type { CommandExecutor, NodeRuntimeDriver, NodeRuntimeDriverFactory, NetworkAdapter, Permissions, RuntimeDriver, RuntimeDriverFactory, SharedRuntimeDriver, SystemDriver, VirtualFileSystem, } from "./types.js";
+export type { NodeRuntimeDriver, NodeRuntimeDriverFactory, NetworkAdapter, Permissions, VirtualFileSystem, } from "./types.js";
 export type { DirEntry, StatInfo } from "./fs-helpers.js";
 export type { StdioChannel, StdioEvent, StdioHook, ExecOptions, ExecResult, OSConfig, ProcessConfig, RunResult, TimingMitigation, } from "./shared/api-types.js";
-export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeExecutionDriver, NodeFileSystem, } from "@secure-exec/node";
-export type { ModuleAccessOptions, NodeRuntimeDriverFactoryOptions, } from "@secure-exec/node";
+export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeExecutionDriver, NodeFileSystem, } from "@secure-exec/nodejs";
+export type { ModuleAccessOptions, NodeRuntimeDriverFactoryOptions, } from "@secure-exec/nodejs";
+export { createKernel } from "@secure-exec/core";
+export type { Kernel, KernelInterface } from "@secure-exec/core";
+export { createNodeRuntime } from "@secure-exec/nodejs";
+export type { BindingTree, BindingFunction } from "@secure-exec/nodejs";
 export { createInMemoryFileSystem } from "./shared/in-memory-fs.js";
 export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "./shared/permissions.js";

package/dist/index.js

@@ -1,23 +1,10 @@
 // Re-export core runtime surface.
 export { NodeRuntime } from "./runtime.js";
 // Re-export Node driver factories.
-export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeExecutionDriver, NodeFileSystem, } from "@secure-exec/node";
-// TODO: Re-enable once @secure-exec/python is a reliable optional dependency
-// export {
-// 	createPyodideRuntimeDriverFactory,
-// 	PyodideRuntimeDriver,
-// } from "@secure-exec/python";
-// TODO: Re-enable once @secure-exec/browser is a reliable optional dependency
-// export {
-// 	createBrowserDriver,
-// 	createBrowserNetworkAdapter,
-// 	createBrowserRuntimeDriverFactory,
-// 	createOpfsFileSystem,
-// } from "@secure-exec/browser";
-// export type {
-// 	BrowserDriverOptions,
-// 	BrowserRuntimeDriverFactoryOptions,
-// 	BrowserRuntimeSystemOptions,
-// } from "@secure-exec/browser";
+export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeExecutionDriver, NodeFileSystem, } from "@secure-exec/nodejs";
+// Re-export kernel API.
+export { createKernel } from "@secure-exec/core";
+// Re-export kernel Node runtime factory.
+export { createNodeRuntime } from "@secure-exec/nodejs";
 export { createInMemoryFileSystem } from "./shared/in-memory-fs.js";
 export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "./shared/permissions.js";

package/dist/module-resolver.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/core — canonical source is packages/secure-exec-core/src/module-resolver.ts
+// Re-exported from @secure-exec/core — canonical source moved to packages/nodejs/src/builtin-modules.ts (US-003)
 export { BUILTIN_NAMED_EXPORTS, normalizeBuiltinSpecifier, getPathDir, } from "@secure-exec/core";

package/dist/node/bridge-setup.d.ts

@@ -1 +1 @@
-export { emitConsoleEvent, setupConsole, setupRequire, setupESMGlobals, } from "@secure-exec/node/internal/bridge-setup";
+export { emitConsoleEvent, stripDangerousEnv, createProcessConfigForExecution, } from "@secure-exec/nodejs";

package/dist/node/bridge-setup.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/bridge-setup.ts
-export { emitConsoleEvent, setupConsole, setupRequire, setupESMGlobals, } from "@secure-exec/node/internal/bridge-setup";
+// Re-exported from @secure-exec/nodejs
+export { emitConsoleEvent, stripDangerousEnv, createProcessConfigForExecution, } from "@secure-exec/nodejs";

package/dist/node/driver.d.ts

@@ -1,2 +1,2 @@
-export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeFileSystem, NodeExecutionDriver, filterEnv, isPrivateIp, } from "@secure-exec/node";
-export type { NodeDriverOptions, NodeRuntimeDriverFactoryOptions, ModuleAccessOptions, } from "@secure-exec/node";
+export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeFileSystem, NodeExecutionDriver, filterEnv, isPrivateIp, } from "@secure-exec/nodejs";
+export type { NodeDriverOptions, NodeRuntimeDriverFactoryOptions, ModuleAccessOptions, } from "@secure-exec/nodejs";

package/dist/node/driver.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/driver.ts
-export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeFileSystem, NodeExecutionDriver, filterEnv, isPrivateIp, } from "@secure-exec/node";
+// Re-exported from @secure-exec/nodejs — canonical source is packages/nodejs/src/driver.ts
+export { createDefaultNetworkAdapter, createNodeDriver, createNodeRuntimeDriverFactory, NodeFileSystem, NodeExecutionDriver, filterEnv, isPrivateIp, } from "@secure-exec/nodejs";

package/dist/node/execution-driver.d.ts

@@ -1,2 +1,2 @@
-export { NodeExecutionDriver } from "@secure-exec/node/internal/execution-driver";
-export type { NodeExecutionDriverOptions } from "@secure-exec/node/internal/isolate-bootstrap";
+export { NodeExecutionDriver } from "@secure-exec/nodejs/internal/execution-driver";
+export type { NodeExecutionDriverOptions } from "@secure-exec/nodejs/internal/isolate-bootstrap";

package/dist/node/execution-driver.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/execution-driver.ts
-export { NodeExecutionDriver } from "@secure-exec/node/internal/execution-driver";
+// Re-exported from @secure-exec/nodejs
+export { NodeExecutionDriver } from "@secure-exec/nodejs/internal/execution-driver";

package/dist/node/isolate-bootstrap.d.ts

@@ -1,2 +1,2 @@
-export type { NodeExecutionDriverOptions, BudgetState, DriverDeps, } from "@secure-exec/node/internal/isolate-bootstrap";
-export { DEFAULT_BRIDGE_BASE64_TRANSFER_BYTES, DEFAULT_ISOLATE_JSON_PAYLOAD_BYTES, MIN_CONFIGURED_PAYLOAD_BYTES, MAX_CONFIGURED_PAYLOAD_BYTES, PAYLOAD_LIMIT_ERROR_CODE, RESOURCE_BUDGET_ERROR_CODE, DEFAULT_SANDBOX_CWD, DEFAULT_SANDBOX_HOME, DEFAULT_SANDBOX_TMPDIR, PayloadLimitError, normalizePayloadLimit, getUtf8ByteLength, getBase64EncodedByteLength, assertPayloadByteLength, assertTextPayloadSize, createBudgetState, checkBridgeBudget, parseJsonWithLimit, getExecutionTimeoutMs, getTimingMitigation, polyfillCodeCache, polyfillNamedExportsCache, hostBuiltinNamedExportsCache, hostRequire, isValidExportName, getHostBuiltinNamedExports, } from "@secure-exec/node/internal/isolate-bootstrap";
+export type { NodeExecutionDriverOptions, BudgetState, DriverDeps, } from "@secure-exec/nodejs/internal/isolate-bootstrap";
+export { DEFAULT_BRIDGE_BASE64_TRANSFER_BYTES, DEFAULT_ISOLATE_JSON_PAYLOAD_BYTES, MIN_CONFIGURED_PAYLOAD_BYTES, MAX_CONFIGURED_PAYLOAD_BYTES, PAYLOAD_LIMIT_ERROR_CODE, RESOURCE_BUDGET_ERROR_CODE, DEFAULT_SANDBOX_CWD, DEFAULT_SANDBOX_HOME, DEFAULT_SANDBOX_TMPDIR, PayloadLimitError, normalizePayloadLimit, getUtf8ByteLength, getBase64EncodedByteLength, assertPayloadByteLength, assertTextPayloadSize, createBudgetState, checkBridgeBudget, parseJsonWithLimit, getExecutionTimeoutMs, getTimingMitigation, polyfillCodeCache, polyfillNamedExportsCache, hostBuiltinNamedExportsCache, hostRequire, isValidExportName, getHostBuiltinNamedExports, } from "@secure-exec/nodejs/internal/isolate-bootstrap";

package/dist/node/isolate-bootstrap.js

@@ -1 +1 @@
-export { DEFAULT_BRIDGE_BASE64_TRANSFER_BYTES, DEFAULT_ISOLATE_JSON_PAYLOAD_BYTES, MIN_CONFIGURED_PAYLOAD_BYTES, MAX_CONFIGURED_PAYLOAD_BYTES, PAYLOAD_LIMIT_ERROR_CODE, RESOURCE_BUDGET_ERROR_CODE, DEFAULT_SANDBOX_CWD, DEFAULT_SANDBOX_HOME, DEFAULT_SANDBOX_TMPDIR, PayloadLimitError, normalizePayloadLimit, getUtf8ByteLength, getBase64EncodedByteLength, assertPayloadByteLength, assertTextPayloadSize, createBudgetState, checkBridgeBudget, parseJsonWithLimit, getExecutionTimeoutMs, getTimingMitigation, polyfillCodeCache, polyfillNamedExportsCache, hostBuiltinNamedExportsCache, hostRequire, isValidExportName, getHostBuiltinNamedExports, } from "@secure-exec/node/internal/isolate-bootstrap";
+export { DEFAULT_BRIDGE_BASE64_TRANSFER_BYTES, DEFAULT_ISOLATE_JSON_PAYLOAD_BYTES, MIN_CONFIGURED_PAYLOAD_BYTES, MAX_CONFIGURED_PAYLOAD_BYTES, PAYLOAD_LIMIT_ERROR_CODE, RESOURCE_BUDGET_ERROR_CODE, DEFAULT_SANDBOX_CWD, DEFAULT_SANDBOX_HOME, DEFAULT_SANDBOX_TMPDIR, PayloadLimitError, normalizePayloadLimit, getUtf8ByteLength, getBase64EncodedByteLength, assertPayloadByteLength, assertTextPayloadSize, createBudgetState, checkBridgeBudget, parseJsonWithLimit, getExecutionTimeoutMs, getTimingMitigation, polyfillCodeCache, polyfillNamedExportsCache, hostBuiltinNamedExportsCache, hostRequire, isValidExportName, getHostBuiltinNamedExports, } from "@secure-exec/nodejs/internal/isolate-bootstrap";

package/dist/node/module-access.d.ts

@@ -1,2 +1,2 @@
-export { ModuleAccessFileSystem } from "@secure-exec/node/internal/module-access";
-export type { ModuleAccessOptions } from "@secure-exec/node/internal/module-access";
+export { ModuleAccessFileSystem } from "@secure-exec/nodejs/internal/module-access";
+export type { ModuleAccessOptions } from "@secure-exec/nodejs/internal/module-access";

package/dist/node/module-access.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/module-access.ts
-export { ModuleAccessFileSystem } from "@secure-exec/node/internal/module-access";
+// Re-exported from @secure-exec/nodejs — canonical source is packages/nodejs/src/module-access.ts
+export { ModuleAccessFileSystem } from "@secure-exec/nodejs/internal/module-access";

package/dist/node/module-resolver.d.ts

@@ -1 +1 @@
-export { getNearestPackageType, getModuleFormat, shouldRunAsESM, resolveReferrerDirectory, resolveESMPath, } from "@secure-exec/node/internal/module-resolver";
+export { getNearestPackageType, getModuleFormat, shouldRunAsESM, resolveReferrerDirectory, resolveESMPath, } from "@secure-exec/nodejs/internal/module-resolver";

package/dist/node/module-resolver.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/module-resolver.ts
-export { getNearestPackageType, getModuleFormat, shouldRunAsESM, resolveReferrerDirectory, resolveESMPath, } from "@secure-exec/node/internal/module-resolver";
+// Re-exported from @secure-exec/nodejs — canonical source is packages/nodejs/src/module-resolver.ts
+export { getNearestPackageType, getModuleFormat, shouldRunAsESM, resolveReferrerDirectory, resolveESMPath, } from "@secure-exec/nodejs/internal/module-resolver";

package/dist/polyfills.d.ts

@@ -1 +1 @@
-export { bundlePolyfill, getAvailableStdlib, hasPolyfill, prebundleAllPolyfills, } from "@secure-exec/node/internal/polyfills";
+export { bundlePolyfill, getAvailableStdlib, hasPolyfill, prebundleAllPolyfills, } from "@secure-exec/nodejs/internal/polyfills";

package/dist/polyfills.js

@@ -1,2 +1,2 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/polyfills.ts
-export { bundlePolyfill, getAvailableStdlib, hasPolyfill, prebundleAllPolyfills, } from "@secure-exec/node/internal/polyfills";
+// Re-exported from @secure-exec/nodejs — canonical source is packages/nodejs/src/polyfills.ts
+export { bundlePolyfill, getAvailableStdlib, hasPolyfill, prebundleAllPolyfills, } from "@secure-exec/nodejs/internal/polyfills";

package/dist/runtime.d.ts

@@ -1,2 +1,31 @@
-export { NodeRuntime } from "@secure-exec/core";
-export type { NodeRuntimeOptions } from "@secure-exec/core";
+import type { NetworkAdapter, NodeRuntimeDriverFactory, SystemDriver } from "@secure-exec/core";
+import type { StdioHook, ExecOptions, ExecResult, RunResult, TimingMitigation } from "@secure-exec/core";
+import type { ResourceBudgets } from "@secure-exec/core";
+export interface NodeRuntimeOptions {
+    systemDriver: SystemDriver;
+    runtimeDriverFactory: NodeRuntimeDriverFactory;
+    memoryLimit?: number;
+    cpuTimeLimitMs?: number;
+    timingMitigation?: TimingMitigation;
+    onStdio?: StdioHook;
+    payloadLimits?: {
+        base64TransferBytes?: number;
+        jsonPayloadBytes?: number;
+    };
+    resourceBudgets?: ResourceBudgets;
+}
+export declare class NodeRuntime {
+    private readonly runtimeDriver;
+    constructor(options: NodeRuntimeOptions);
+    get network(): Pick<NetworkAdapter, "fetch" | "dnsLookup" | "httpRequest">;
+    get __unsafeIsoalte(): unknown;
+    __unsafeCreateContext(options?: {
+        env?: Record<string, string>;
+        cwd?: string;
+        filePath?: string;
+    }): Promise<unknown>;
+    run<T = unknown>(code: string, filePath?: string): Promise<RunResult<T>>;
+    exec(code: string, options?: ExecOptions): Promise<ExecResult>;
+    dispose(): void;
+    terminate(): Promise<void>;
+}

package/dist/runtime.js

@@ -1,2 +1,69 @@
-// Re-exported from @secure-exec/core — canonical source is packages/secure-exec-core/src/runtime.ts
-export { NodeRuntime } from "@secure-exec/core";
+import { createNetworkStub, filterEnv } from "@secure-exec/core";
+const DEFAULT_SANDBOX_CWD = "/root";
+const DEFAULT_SANDBOX_HOME = "/root";
+const DEFAULT_SANDBOX_TMPDIR = "/tmp";
+export class NodeRuntime {
+    runtimeDriver;
+    constructor(options) {
+        const { systemDriver, runtimeDriverFactory } = options;
+        const processConfig = {
+            ...(systemDriver.runtime.process ?? {}),
+        };
+        processConfig.cwd ??= DEFAULT_SANDBOX_CWD;
+        processConfig.env = filterEnv(processConfig.env, systemDriver.permissions);
+        const osConfig = {
+            ...(systemDriver.runtime.os ?? {}),
+        };
+        osConfig.homedir ??= DEFAULT_SANDBOX_HOME;
+        osConfig.tmpdir ??= DEFAULT_SANDBOX_TMPDIR;
+        this.runtimeDriver = runtimeDriverFactory.createRuntimeDriver({
+            system: systemDriver,
+            runtime: {
+                process: processConfig,
+                os: osConfig,
+            },
+            memoryLimit: options.memoryLimit,
+            cpuTimeLimitMs: options.cpuTimeLimitMs,
+            timingMitigation: options.timingMitigation,
+            onStdio: options.onStdio,
+            payloadLimits: options.payloadLimits,
+            resourceBudgets: options.resourceBudgets,
+        });
+    }
+    get network() {
+        const adapter = this.runtimeDriver.network ?? createNetworkStub();
+        return {
+            fetch: (url, options) => adapter.fetch(url, options),
+            dnsLookup: (hostname) => adapter.dnsLookup(hostname),
+            httpRequest: (url, options) => adapter.httpRequest(url, options),
+        };
+    }
+    get __unsafeIsoalte() {
+        if (this.runtimeDriver.unsafeIsolate === undefined) {
+            throw new Error("Driver runtime does not expose unsafe isolate access");
+        }
+        return this.runtimeDriver.unsafeIsolate;
+    }
+    async __unsafeCreateContext(options = {}) {
+        if (!this.runtimeDriver.createUnsafeContext) {
+            throw new Error("Driver runtime does not expose unsafe context creation");
+        }
+        return this.runtimeDriver.createUnsafeContext(options);
+    }
+    async run(code, filePath) {
+        return this.runtimeDriver.run(code, filePath);
+    }
+    async exec(code, options) {
+        return this.runtimeDriver.exec(code, options);
+    }
+    dispose() {
+        this.runtimeDriver.dispose();
+    }
+    async terminate() {
+        if (this.runtimeDriver.terminate) {
+            await this.runtimeDriver.terminate();
+            return;
+        }
+        this.runtimeDriver.dispose();
+    }
+}

package/dist/shared/bridge-contract.d.ts

@@ -1,2 +1,2 @@
-export type { BridgeGlobalKey, ChildProcessKillBridgeRef, ChildProcessSpawnStartBridgeRef, ChildProcessSpawnSyncBridgeRef, ChildProcessStdinCloseBridgeRef, ChildProcessStdinWriteBridgeRef, CryptoRandomFillBridgeRef, CryptoRandomUuidBridgeRef, DynamicImportBridgeRef, FsChmodBridgeRef, FsChownBridgeRef, FsExistsBridgeRef, FsFacadeBridge, FsLinkBridgeRef, FsLstatBridgeRef, FsMkdirBridgeRef, FsReadDirBridgeRef, FsReadFileBinaryBridgeRef, FsReadFileBridgeRef, FsReadlinkBridgeRef, FsRenameBridgeRef, FsRmdirBridgeRef, FsStatBridgeRef, FsSymlinkBridgeRef, FsTruncateBridgeRef, FsUnlinkBridgeRef, FsUtimesBridgeRef, FsWriteFileBinaryBridgeRef, FsWriteFileBridgeRef, HostBridgeGlobalKey, LoadFileBridgeRef, LoadPolyfillBridgeRef, ModuleCacheBridgeRecord, NetworkDnsLookupRawBridgeRef, NetworkFetchRawBridgeRef, NetworkHttpRequestRawBridgeRef, NetworkHttpServerCloseRawBridgeRef, NetworkHttpServerListenRawBridgeRef, ProcessErrorBridgeRef, ProcessLogBridgeRef, RegisterHandleBridgeFn, RequireFromBridgeFn, ResolveModuleBridgeRef, RuntimeBridgeGlobalKey, ScheduleTimerBridgeRef, UnregisterHandleBridgeFn, ValueOf, } from "@secure-exec/core";
+export type { BridgeApplyRef, BridgeApplySyncPromiseRef, BridgeApplySyncRef, BridgeGlobalKey, ChildProcessKillBridgeRef, ChildProcessSpawnStartBridgeRef, ChildProcessSpawnSyncBridgeRef, ChildProcessStdinCloseBridgeRef, ChildProcessStdinWriteBridgeRef, CryptoRandomFillBridgeRef, CryptoRandomUuidBridgeRef, DynamicImportBridgeRef, FsChmodBridgeRef, FsChownBridgeRef, FsExistsBridgeRef, FsFacadeBridge, FsLinkBridgeRef, FsLstatBridgeRef, FsMkdirBridgeRef, FsReadDirBridgeRef, FsReadFileBinaryBridgeRef, FsReadFileBridgeRef, FsReadlinkBridgeRef, FsRenameBridgeRef, FsRmdirBridgeRef, FsStatBridgeRef, FsSymlinkBridgeRef, FsTruncateBridgeRef, FsUnlinkBridgeRef, FsUtimesBridgeRef, FsWriteFileBinaryBridgeRef, FsWriteFileBridgeRef, HostBridgeGlobalKey, LoadFileBridgeRef, LoadPolyfillBridgeRef, ModuleCacheBridgeRecord, NetworkDnsLookupRawBridgeRef, NetworkFetchRawBridgeRef, NetworkHttpRequestRawBridgeRef, NetworkHttpServerCloseRawBridgeRef, NetworkHttpServerListenRawBridgeRef, UpgradeSocketWriteRawBridgeRef, UpgradeSocketEndRawBridgeRef, UpgradeSocketDestroyRawBridgeRef, ProcessErrorBridgeRef, ProcessLogBridgeRef, RegisterHandleBridgeFn, RequireFromBridgeFn, ResolveModuleBridgeRef, RuntimeBridgeGlobalKey, ScheduleTimerBridgeRef, UnregisterHandleBridgeFn, ValueOf, } from "@secure-exec/core";
 export { BRIDGE_GLOBAL_KEY_LIST, HOST_BRIDGE_GLOBAL_KEY_LIST, HOST_BRIDGE_GLOBAL_KEYS, RUNTIME_BRIDGE_GLOBAL_KEY_LIST, RUNTIME_BRIDGE_GLOBAL_KEYS, } from "@secure-exec/core";

package/dist/types.d.ts

@@ -1,2 +1,3 @@
-export type { ChildProcessAccessRequest, CommandExecutor, EnvAccessRequest, FsAccessRequest, NetworkAccessRequest, NetworkAdapter, NetworkServerAddress, NetworkServerListenOptions, NetworkServerRequest, NetworkServerResponse, PermissionCheck, PermissionDecision, Permissions, SpawnedProcess, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "@secure-exec/core";
+export type { ChildProcessAccessRequest, EnvAccessRequest, FsAccessRequest, NetworkAccessRequest, PermissionCheck, PermissionDecision, Permissions, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "@secure-exec/core";
+export type { CommandExecutor, NetworkAdapter, NetworkServerAddress, NetworkServerListenOptions, NetworkServerRequest, NetworkServerResponse, SpawnedProcess, } from "@secure-exec/core";
 export type { DriverRuntimeConfig, NodeRuntimeDriver, NodeRuntimeDriverFactory, PythonRuntimeDriver, PythonRuntimeDriverFactory, RuntimeDriver, RuntimeDriverFactory, RuntimeDriverOptions, SharedRuntimeDriver, SystemDriver, } from "@secure-exec/core";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-exec",
-  "version": "0.1.1-rc.2",
+  "version": "0.2.0-rc.1",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -19,25 +19,15 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    },
-    "./browser": {
-      "types": "./dist/browser-runtime.d.ts",
-      "import": "./dist/browser-runtime.js",
-      "default": "./dist/browser-runtime.js"
-    },
-    "./python": {
-      "types": "./dist/python-runtime.d.ts",
-      "import": "./dist/python-runtime.js",
-      "default": "./dist/python-runtime.js"
     }
   },
   "dependencies": {
-    "@secure-exec/core": "0.1.1-rc.2",
-    "@secure-exec/node": "0.1.1-rc.2"
+    "@secure-exec/nodejs": "0.2.0-rc.1",
+    "@secure-exec/core": "0.2.0-rc.1"
   },
   "optionalDependencies": {
-    "@secure-exec/python": "0.1.1-rc.2",
-    "@secure-exec/browser": "0.1.1-rc.2"
+    "@secure-exec/browser": "0.2.0-rc.1",
+    "@secure-exec/python": "0.2.0-rc.1"
   },
   "devDependencies": {
     "@mariozechner/pi-coding-agent": "^0.60.0",
@@ -45,11 +35,12 @@
     "@types/node": "^22.10.2",
     "@vitest/browser": "^2.1.8",
     "@xterm/headless": "^6.0.0",
+    "minimatch": "^10.2.4",
     "playwright": "^1.52.0",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8",
-    "@secure-exec/v8": "0.1.1-rc.2"
+    "@secure-exec/v8": "0.2.0-rc.1"
   },
   "scripts": {
     "check-types": "tsc --noEmit",
@@ -60,6 +51,7 @@
     "test:integration:node": "pnpm run test:test-suite && pnpm run test:runtime-driver",
     "test:integration:browser": "vitest run --config vitest.browser.config.ts tests/test-suite/node.test.ts tests/runtime-driver/browser/runtime.test.ts",
     "test:project-matrix": "vitest run tests/project-matrix.test.ts",
+    "test:e2e-docker": "vitest run tests/e2e-docker.test.ts",
     "test": "vitest run",
     "test:watch": "vitest"
   }

package/dist/browser-runtime.d.ts

@@ -1,6 +0,0 @@
-export { NodeRuntime } from "@secure-exec/core";
-export type { NodeRuntimeOptions } from "@secure-exec/core";
-export { createBrowserDriver, createBrowserNetworkAdapter, createBrowserRuntimeDriverFactory, createOpfsFileSystem, } from "@secure-exec/browser";
-export type { BrowserDriverOptions, BrowserRuntimeDriverFactoryOptions, BrowserRuntimeSystemOptions, } from "@secure-exec/browser";
-export type { StdioChannel, StdioEvent, StdioHook, ExecOptions, ExecResult, OSConfig, PythonRunResult, ProcessConfig, RunResult, TimingMitigation, } from "@secure-exec/core";
-export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "@secure-exec/core";

package/dist/browser-runtime.js

@@ -1,4 +0,0 @@
-// Browser-safe entrypoint for NodeRuntime + browser driver factories.
-export { NodeRuntime } from "@secure-exec/core";
-export { createBrowserDriver, createBrowserNetworkAdapter, createBrowserRuntimeDriverFactory, createOpfsFileSystem, } from "@secure-exec/browser";
-export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "@secure-exec/core";

package/dist/execution.d.ts

@@ -1 +0,0 @@
-export { executeWithRuntime } from "@secure-exec/node/internal/execution";

package/dist/execution.js

@@ -1,2 +0,0 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/execution.ts
-export { executeWithRuntime } from "@secure-exec/node/internal/execution";

package/dist/isolate.d.ts

@@ -1 +0,0 @@
-export { DEFAULT_TIMING_MITIGATION, TIMEOUT_EXIT_CODE, TIMEOUT_ERROR_MESSAGE, ExecutionTimeoutError, createIsolate, getExecutionDeadlineMs, getExecutionRunOptions, runWithExecutionDeadline, isExecutionTimeoutError, } from "@secure-exec/node/internal/isolate";

package/dist/isolate.js

@@ -1,2 +0,0 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/isolate.ts
-export { DEFAULT_TIMING_MITIGATION, TIMEOUT_EXIT_CODE, TIMEOUT_ERROR_MESSAGE, ExecutionTimeoutError, createIsolate, getExecutionDeadlineMs, getExecutionRunOptions, runWithExecutionDeadline, isExecutionTimeoutError, } from "@secure-exec/node/internal/isolate";

package/dist/node/esm-compiler.d.ts

@@ -1 +0,0 @@
-export { compileESMModule, createESMResolver, runESM, isAlreadyInstantiatedModuleError, resolveDynamicImportNamespace, precompileDynamicImports, setupDynamicImport, } from "@secure-exec/node/internal/esm-compiler";

package/dist/node/esm-compiler.js

@@ -1,2 +0,0 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/esm-compiler.ts
-export { compileESMModule, createESMResolver, runESM, isAlreadyInstantiatedModuleError, resolveDynamicImportNamespace, precompileDynamicImports, setupDynamicImport, } from "@secure-exec/node/internal/esm-compiler";

package/dist/node/execution-lifecycle.d.ts

@@ -1 +0,0 @@
-export { applyExecutionOverrides, initCommonJsModuleGlobals, setCommonJsFileGlobals, applyCustomGlobalExposurePolicy, awaitScriptResult, overrideProcessConfig, setStdinData, } from "@secure-exec/node/internal/execution-lifecycle";

package/dist/node/execution-lifecycle.js

@@ -1,2 +0,0 @@
-// Re-exported from @secure-exec/node — canonical source is packages/secure-exec-node/src/execution-lifecycle.ts
-export { applyExecutionOverrides, initCommonJsModuleGlobals, setCommonJsFileGlobals, applyCustomGlobalExposurePolicy, awaitScriptResult, overrideProcessConfig, setStdinData, } from "@secure-exec/node/internal/execution-lifecycle";

package/dist/python-runtime.d.ts

@@ -1,5 +0,0 @@
-export { PythonRuntime } from "@secure-exec/core";
-export type { PythonRuntimeOptions } from "@secure-exec/core";
-export { createPyodideRuntimeDriverFactory, PyodideRuntimeDriver, } from "@secure-exec/python";
-export type { StdioChannel, StdioEvent, StdioHook, ExecOptions, ExecResult, OSConfig, PythonRunOptions, PythonRunResult, ProcessConfig, RunResult, TimingMitigation, } from "@secure-exec/core";
-export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "@secure-exec/core";

package/dist/python-runtime.js

@@ -1,4 +0,0 @@
-// Python-only entrypoint: import from "secure-exec/python".
-export { PythonRuntime } from "@secure-exec/core";
-export { createPyodideRuntimeDriverFactory, PyodideRuntimeDriver, } from "@secure-exec/python";
-export { allowAll, allowAllChildProcess, allowAllEnv, allowAllFs, allowAllNetwork, } from "@secure-exec/core";