{ pkgs, core }:
let
  workerd = import ./workerd.nix { inherit pkgs; };
  sandbox = import ./sandbox.nix {
    inherit pkgs;
    runtime = workerd;
    executable = "${workerd}/bin/workerd";
  };
  nativeProbe =
    pkgs.runCommand "quixos-restricted-native-probe"
      {
        nativeBuildInputs = [ pkgs.stdenv.cc ];
      }
      ''
        mkdir -p "$out/bin"
        $CC -O2 -Wall -Wextra -Werror ${./sandbox-probe.c} -o "$out/bin/probe"
      '';
  nativeProbeSandbox = import ./sandbox.nix {
    inherit pkgs;
    runtime = nativeProbe;
    executable = "${nativeProbe}/bin/probe";
  };
  identityLauncher =
    pkgs.runCommand "quixos-restricted-identity-launcher"
      {
        nativeBuildInputs = [ pkgs.stdenv.cc ];
      }
      ''
        mkdir -p "$out/bin"
        $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \
          -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \
          -o "$out/bin/quixos-restricted-engine"
      '';
  # Transaction-port/value adapters do not need the browser's CRDT/Wasm engine.
  # Keep this surface explicit; it is bundled into checked restricted handlers.
  sdk = pkgs.runCommand "quixos-restricted-sdk" { nativeBuildInputs = [ pkgs.esbuild ]; } ''
    mkdir -p "$out"
    cat > entry.mjs <<'JS'
    export {definePortableRegistry,QxReject} from '${core}/dist/portable.js';
    export {encodeArgument,decodeArgument,canonicalJson,parseJson,hashJson} from '${core}/dist/value.js';
    export {workspaceId,operationId,objectId,entryId,hashIdentity} from '${core}/dist/identity.js';
    export {reference} from '${core}/dist/references.js';
    export {CodecError,ExecutionError} from '${core}/dist/limits.js';
    JS
    esbuild entry.mjs --bundle --platform=neutral --format=esm --target=es2024 --outfile="$out/core.mjs"
  '';
  runtime =
    pkgs.runCommand "quixos-restricted-execution" { nativeBuildInputs = [ pkgs.makeWrapper ]; }
      ''
        mkdir -p "$out/lib" "$out/bin"
        cp ${./service.mjs} "$out/lib/service.mjs"
        cp ${./worker.mjs} "$out/lib/worker.mjs"
        makeWrapper ${pkgs.nodejs_24}/bin/node "$out/bin/quixos-restricted-registry" \
          --add-flags "$out/lib/service.mjs" \
          --set QUIXOS_RESTRICTED_WORKERD ${workerd}/bin/workerd \
          --set QUIXOS_RESTRICTED_SANDBOX ${sandbox}/bin/quixos-restricted-sandbox \
          --set QUIXOS_RESTRICTED_WORKER "$out/lib/worker.mjs"
      '';
  qualification =
    pkgs.runCommand "quixos-restricted-execution-qualification"
      {
        nativeBuildInputs = [ pkgs.nodejs_24 ];
        QUIXOS_TEST_WORKERD = "${workerd}/bin/workerd";
        QUIXOS_TEST_SDK = "${sdk}/core.mjs";
      }
      ''
        node --test ${./.}/service.test.mjs
        touch "$out"
      '';
in
{
  inherit
    workerd
    sandbox
    identityLauncher
    nativeProbeSandbox
    sdk
    runtime
    qualification
    ;
}