import { z } from "zod";import type { NodeRuntimeCreateOptions } from "./node-runtime.js"; const permissionModeSchema = z.enum(["allow", "deny"]);const stringArray = z.array(z.string());const vmIdSchema = z.number().int().min(0).max(0xffffffff);const vmAccountNameSchema = z	.string()	.min(1)	.refine((value) => !/[:\s\0]/u.test(value), "Invalid account name");const vmGuestPathSchema = z.string().startsWith("/");const vmUserAccountSchema = z	.object({		uid: vmIdSchema,		gid: vmIdSchema,		username: vmAccountNameSchema,		homedir: vmGuestPathSchema,		shell: vmGuestPathSchema,		gecos: z.string().optional(),		supplementaryGids: z.array(vmIdSchema).max(64),	})	.strict();const vmGroupSchema = z	.object({		gid: vmIdSchema,		name: vmAccountNameSchema,		members: z.array(vmAccountNameSchema),	})	.strict();const vmUserConfigSchema = z	.object({		uid: vmIdSchema.optional(),		gid: vmIdSchema.optional(),		euid: vmIdSchema.optional(),		egid: vmIdSchema.optional(),		username: z.string().optional(),		homedir: z.string().optional(),		shell: z.string().optional(),		gecos: z.string().optional(),		groupName: z.string().optional(),		supplementaryGids: z.array(vmIdSchema).max(64).optional(),		accounts: z.array(vmUserAccountSchema).max(64).optional(),		groups: z.array(vmGroupSchema).max(128).optional(),	})	.strict(); const fsPermissionRuleSchema = z	.object({		mode: permissionModeSchema,		operations: stringArray.optional(),		paths: stringArray.optional(),	})	.strict(); const patternPermissionRuleSchema = z	.object({		mode: permissionModeSchema,		operations: stringArray.optional(),		patterns: stringArray.optional(),	})	.strict(); const fsRulePermissionsSchema = z	.object({		default: permissionModeSchema.optional(),		rules: z.array(fsPermissionRuleSchema),	})	.strict(); const patternRulePermissionsSchema = z	.object({		default: permissionModeSchema.optional(),		rules: z.array(patternPermissionRuleSchema),	})	.strict(); const fsPermissionsSchema = z.union([permissionModeSchema, fsRulePermissionsSchema]);const patternPermissionsSchema = z.union([	permissionModeSchema,	patternRulePermissionsSchema,]); export const nodeRuntimePermissionsSchema = z	.object({		fs: fsPermissionsSchema.optional(),		network: patternPermissionsSchema.optional(),		childProcess: patternPermissionsSchema.optional(),		process: patternPermissionsSchema.optional(),		env: patternPermissionsSchema.optional(),		binding: patternPermissionsSchema.optional(),	})	.strict(); const uint8ArraySchema = z.custom<Uint8Array>(	(value: unknown) => value instanceof Uint8Array,	{ message: "Expected Uint8Array" },); const hostDirectoryMountSchema = z	.object({		guestPath: z.string(),		hostPath: z.string(),		readOnly: z.boolean().optional(),	})	.strict(); const nodeModulesMountSchema = z	.object({		hostPath: z.string(),		guestPath: z.string().optional(),	})	.strict(); const jsRuntimeSchema = z	.object({		platform: z.enum(["node", "browser", "neutral", "bare"]).optional(),		moduleResolution: z.enum(["node", "relative", "none"]).optional(),		allowedBuiltins: stringArray.optional(),		highResolutionTime: z.boolean().optional(),	})	.strict(); const bindingExampleSchema = z	.object({		description: z.string(),		input: z.unknown(),	})	.strict(); const bindingDefinitionSchema = z	.object({		description: z.string(),		inputSchema: z.custom<object>(			(value: unknown) => typeof value === "object" && value !== null,			{ message: "Expected JSON Schema object" },		),		timeoutMs: z.number().int().nonnegative().optional(),		examples: z.array(bindingExampleSchema).optional(),		commandAliases: stringArray.optional(),		handler: z.custom<(input: unknown) => unknown | Promise<unknown>>(			(value: unknown) => typeof value === "function",			{ message: "Expected function" },		),	})	.strict(); /** * Runtime validation for the public `NodeRuntime.create(...)` API. * * This is the TS-side guard for the ergonomic options shape. The sidecar VM * JSON it eventually produces is still validated by * `crates/vm-config/src/lib.rs::CreateVmConfig` with `deny_unknown_fields`. * Keep these in sync when adding high-level create options that translate into * the Rust VM config. */export const nodeRuntimeCreateOptionsSchema = z	.object({		filesystem: z.custom<NodeRuntimeCreateOptions["filesystem"]>(			(value: unknown) => typeof value === "object" && value !== null,			{ message: "Expected caller-owned VirtualFileSystem object" },		),		env: z.record(z.string(), z.string()).optional(),		cwd: z.string().optional(),		user: vmUserConfigSchema.optional(),		permissions: nodeRuntimePermissionsSchema.optional(),		commandsDir: z.string().optional(),		wasmCommandDirs: stringArray.optional(),		sidecar: z			.custom((value: unknown) => typeof value === "object" && value !== null, {				message: "Expected SidecarProcess object",			})			.optional(),		onBootTiming: z			.custom<(timing: unknown) => void>(				(value: unknown) => typeof value === "function",				{ message: "Expected function" },			)			.optional(),		files: z			.record(z.string(), z.union([z.string(), uint8ArraySchema]))			.optional(),		mounts: z.array(hostDirectoryMountSchema).optional(),		nodeModules: z.union([z.string(), nodeModulesMountSchema]).optional(),		bindings: z.record(z.string(), bindingDefinitionSchema).optional(),		loopbackExemptPorts: z			.array(z.number().int().min(0).max(65535))			.optional(),		jsRuntime: jsRuntimeSchema.optional(),	})	.strict() as z.ZodType<NodeRuntimeCreateOptions>; export function parseNodeRuntimeCreateOptions(	options: NodeRuntimeCreateOptions,): NodeRuntimeCreateOptions {	return nodeRuntimeCreateOptionsSchema.parse(options);}