# Pinned upstream engine. This binary supplies an import/capability boundary;
# production execution additionally requires the qualified OS identity,
# namespace, syscall, cgroup and invocation-broker boundaries.
{ pkgs }:
let
  version = "1.20261005.1";
  platforms = {
    x86_64-linux = {
      name = "linux-64";
      hash = "sha256-zm0T3YLo49ORPwR4iwP+WkQBMkiZQYftc+ArBQEoNGY=";
    };
    aarch64-linux = {
      name = "linux-arm64";
      hash = "sha256-jkvHyexr8Sn2wyqmLJJEOOGfAkfaVPLI7llHOX+FbxU=";
    };
  };
  platform =
    platforms.${pkgs.stdenv.hostPlatform.system}
      or (throw "Restricted execution requires Linux x86_64 or aarch64");
in
pkgs.stdenvNoCC.mkDerivation {
  pname = "quixos-workerd";
  inherit version;
  src = pkgs.fetchurl {
    url = "https://registry.npmjs.org/@cloudflare/workerd-${platform.name}/-/workerd-${platform.name}-${version}.tgz";
    inherit (platform) hash;
  };
  nativeBuildInputs = [ pkgs.autoPatchelfHook ];
  buildInputs = [ pkgs.stdenv.cc.cc.lib ];
  sourceRoot = "package";
  installPhase = ''
    runHook preInstall
    install -Dm755 bin/workerd "$out/bin/workerd"
    runHook postInstall
  '';
  doInstallCheck = true;
  installCheckPhase = ''
    "$out/bin/workerd" --version | grep -Fx 'workerd 2026-10-05'
  '';
  meta = {
    description = "Pinned workerd engine for Quixos restricted execution";
    homepage = "https://github.com/cloudflare/workerd";
    license = pkgs.lib.licenses.asl20;
    platforms = builtins.attrNames platforms;
  };
}