@flaxia/node 0.3.7 → 0.5.1

package/dist/assets/container.js

@@ -1,4 +1,5 @@
-var e = class e {
+import { n as e, t } from "./egress-guard.js";
+var n = class e {
 	static read_bytes(t, n) {
 		let r = new e();
 		return r.buf = t.getUint32(n, !0), r.buf_len = t.getUint32(n + 4, !0), r;
@@ -8,7 +9,7 @@ var e = class e {
 		for (let a = 0; a < r; a++) i.push(e.read_bytes(t, n + 8 * a));
 		return i;
 	}
-}, t = class e {
+}, r = class e {
 	static read_bytes(t, n) {
 		let r = new e();
 		return r.buf = t.getUint32(n, !0), r.buf_len = t.getUint32(n + 4, !0), r;
@@ -18,7 +19,7 @@ var e = class e {
 		for (let a = 0; a < r; a++) i.push(e.read_bytes(t, n + 8 * a));
 		return i;
 	}
-}, n = class {
+}, i = class {
 	head_length() {
 		return 24;
 	}
@@ -35,52 +36,52 @@ var e = class e {
 		let i = new TextEncoder().encode(n);
 		this.d_next = e, this.d_ino = t, this.d_namlen = i.byteLength, this.d_type = r, this.dir_name = i;
 	}
-}, r = class {
+}, a = class {
 	write_bytes(e, t) {
 		e.setUint8(t, this.fs_filetype), e.setUint16(t + 2, this.fs_flags, !0), e.setBigUint64(t + 8, this.fs_rights_base, !0), e.setBigUint64(t + 16, this.fs_rights_inherited, !0);
 	}
 	constructor(e, t) {
 		this.fs_rights_base = 0n, this.fs_rights_inherited = 0n, this.fs_filetype = e, this.fs_flags = t;
 	}
-}, i = class {
+}, o = class {
 	write_bytes(e, t) {
 		e.setBigUint64(t, this.dev, !0), e.setBigUint64(t + 8, this.ino, !0), e.setUint8(t + 16, this.filetype), e.setBigUint64(t + 24, this.nlink, !0), e.setBigUint64(t + 32, this.size, !0), e.setBigUint64(t + 38, this.atim, !0), e.setBigUint64(t + 46, this.mtim, !0), e.setBigUint64(t + 52, this.ctim, !0);
 	}
 	constructor(e, t, n) {
 		this.dev = 0n, this.nlink = 0n, this.atim = 0n, this.mtim = 0n, this.ctim = 0n, this.ino = e, this.filetype = t, this.size = n;
 	}
-}, a = class e {
+}, s = class e {
 	static read_bytes(t, n) {
 		return new e(t.getBigUint64(n, !0), t.getUint8(n + 8), t.getUint32(n + 16, !0), t.getBigUint64(n + 24, !0), t.getUint16(n + 36, !0));
 	}
 	constructor(e, t, n, r, i) {
 		this.userdata = e, this.eventtype = t, this.clockid = n, this.timeout = r, this.flags = i;
 	}
-}, o = class {
+}, c = class {
 	write_bytes(e, t) {
 		e.setBigUint64(t, this.userdata, !0), e.setUint16(t + 8, this.error, !0), e.setUint8(t + 10, this.eventtype);
 	}
 	constructor(e, t, n) {
 		this.userdata = e, this.error = t, this.eventtype = n;
 	}
-}, s = class {
+}, l = class {
 	write_bytes(e, t) {
 		e.setUint32(t, this.pr_name.byteLength, !0);
 	}
 	constructor(e) {
 		this.pr_name = new TextEncoder().encode(e);
 	}
-}, c = class e {
+}, u = class e {
 	static dir(t) {
 		let n = new e();
-		return n.tag = 0, n.inner = new s(t), n;
+		return n.tag = 0, n.inner = new l(t), n;
 	}
 	write_bytes(e, t) {
 		e.setUint32(t, this.tag, !0), this.inner.write_bytes(e, t + 4);
 	}
-}, l = class {
+}, d = class {
 	enable(e) {
-		this.log = u(e === void 0 ? !0 : e, this.prefix);
+		this.log = f(e === void 0 ? !0 : e, this.prefix);
 	}
 	get enabled() {
 		return this.isEnabled;
@@ -89,61 +90,61 @@ var e = class e {
 		this.isEnabled = e, this.prefix = "wasi:", this.enable(e);
 	}
 };
-function u(e, t) {
+function f(e, t) {
 	return e ? console.log.bind(console, "%c%s", "color: #265BA0", t) : () => {};
 }
-var d = new l(!1), f = class extends Error {
+var p = new d(!1), m = class extends Error {
 	constructor(e) {
 		super("exit with exit code " + e), this.code = e;
 	}
-}, p = class {
+}, h = class {
 	start(e) {
 		this.inst = e;
 		try {
 			return e.exports._start(), 0;
 		} catch (e) {
-			if (e instanceof f) return e.code;
+			if (e instanceof m) return e.code;
 			throw e;
 		}
 	}
 	initialize(e) {
 		this.inst = e, e.exports._initialize && e.exports._initialize();
 	}
-	constructor(n, r, i, s = {}) {
-		this.args = [], this.env = [], this.fds = [], d.enable(s.debug), this.args = n, this.env = r, this.fds = i;
-		let c = this;
+	constructor(e, t, i, a = {}) {
+		this.args = [], this.env = [], this.fds = [], p.enable(a.debug), this.args = e, this.env = t, this.fds = i;
+		let o = this;
 		this.wasiImport = {
 			args_sizes_get(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer);
-				n.setUint32(e, c.args.length, !0);
+				let n = new DataView(o.inst.exports.memory.buffer);
+				n.setUint32(e, o.args.length, !0);
 				let r = 0;
-				for (let e of c.args) r += e.length + 1;
-				return n.setUint32(t, r, !0), d.log(n.getUint32(e, !0), n.getUint32(t, !0)), 0;
+				for (let e of o.args) r += e.length + 1;
+				return n.setUint32(t, r, !0), p.log(n.getUint32(e, !0), n.getUint32(t, !0)), 0;
 			},
 			args_get(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer), r = new Uint8Array(c.inst.exports.memory.buffer), i = t;
-				for (let i = 0; i < c.args.length; i++) {
+				let n = new DataView(o.inst.exports.memory.buffer), r = new Uint8Array(o.inst.exports.memory.buffer), i = t;
+				for (let i = 0; i < o.args.length; i++) {
 					n.setUint32(e, t, !0), e += 4;
-					let a = new TextEncoder().encode(c.args[i]);
+					let a = new TextEncoder().encode(o.args[i]);
 					r.set(a, t), n.setUint8(t + a.length, 0), t += a.length + 1;
 				}
-				return d.enabled && d.log(new TextDecoder("utf-8").decode(r.slice(i, t))), 0;
+				return p.enabled && p.log(new TextDecoder("utf-8").decode(r.slice(i, t))), 0;
 			},
 			environ_sizes_get(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer);
-				n.setUint32(e, c.env.length, !0);
+				let n = new DataView(o.inst.exports.memory.buffer);
+				n.setUint32(e, o.env.length, !0);
 				let r = 0;
-				for (let e of c.env) r += new TextEncoder().encode(e).length + 1;
-				return n.setUint32(t, r, !0), d.log(n.getUint32(e, !0), n.getUint32(t, !0)), 0;
+				for (let e of o.env) r += new TextEncoder().encode(e).length + 1;
+				return n.setUint32(t, r, !0), p.log(n.getUint32(e, !0), n.getUint32(t, !0)), 0;
 			},
 			environ_get(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer), r = new Uint8Array(c.inst.exports.memory.buffer), i = t;
-				for (let i = 0; i < c.env.length; i++) {
+				let n = new DataView(o.inst.exports.memory.buffer), r = new Uint8Array(o.inst.exports.memory.buffer), i = t;
+				for (let i = 0; i < o.env.length; i++) {
 					n.setUint32(e, t, !0), e += 4;
-					let a = new TextEncoder().encode(c.env[i]);
+					let a = new TextEncoder().encode(o.env[i]);
 					r.set(a, t), n.setUint8(t + a.length, 0), t += a.length + 1;
 				}
-				return d.enabled && d.log(new TextDecoder("utf-8").decode(r.slice(i, t))), 0;
+				return p.enabled && p.log(new TextDecoder("utf-8").decode(r.slice(i, t))), 0;
 			},
 			clock_res_get(e, t) {
 				let n;
@@ -156,10 +157,10 @@ var d = new l(!1), f = class extends Error {
 						break;
 					default: return 52;
 				}
-				return new DataView(c.inst.exports.memory.buffer).setBigUint64(t, n, !0), 0;
+				return new DataView(o.inst.exports.memory.buffer).setBigUint64(t, n, !0), 0;
 			},
 			clock_time_get(e, t, n) {
-				let r = new DataView(c.inst.exports.memory.buffer);
+				let r = new DataView(o.inst.exports.memory.buffer);
 				if (e === 0) r.setBigUint64(n, BigInt((/* @__PURE__ */ new Date()).getTime()) * 1000000n, !0);
 				else if (e == 1) {
 					let e;
@@ -173,256 +174,256 @@ var d = new l(!1), f = class extends Error {
 				return 0;
 			},
 			fd_advise(e, t, n, r) {
-				return c.fds[e] == null ? 8 : 0;
+				return o.fds[e] == null ? 8 : 0;
 			},
 			fd_allocate(e, t, n) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_allocate(t, n);
+				return o.fds[e] == null ? 8 : o.fds[e].fd_allocate(t, n);
 			},
 			fd_close(e) {
-				if (c.fds[e] != null) {
-					let t = c.fds[e].fd_close();
-					return c.fds[e] = void 0, t;
+				if (o.fds[e] != null) {
+					let t = o.fds[e].fd_close();
+					return o.fds[e] = void 0, t;
 				} else return 8;
 			},
 			fd_datasync(e) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_sync();
+				return o.fds[e] == null ? 8 : o.fds[e].fd_sync();
 			},
 			fd_fdstat_get(e, t) {
-				if (c.fds[e] != null) {
-					let { ret: n, fdstat: r } = c.fds[e].fd_fdstat_get();
-					return r?.write_bytes(new DataView(c.inst.exports.memory.buffer), t), n;
+				if (o.fds[e] != null) {
+					let { ret: n, fdstat: r } = o.fds[e].fd_fdstat_get();
+					return r?.write_bytes(new DataView(o.inst.exports.memory.buffer), t), n;
 				} else return 8;
 			},
 			fd_fdstat_set_flags(e, t) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_fdstat_set_flags(t);
+				return o.fds[e] == null ? 8 : o.fds[e].fd_fdstat_set_flags(t);
 			},
 			fd_fdstat_set_rights(e, t, n) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_fdstat_set_rights(t, n);
+				return o.fds[e] == null ? 8 : o.fds[e].fd_fdstat_set_rights(t, n);
 			},
 			fd_filestat_get(e, t) {
-				if (c.fds[e] != null) {
-					let { ret: n, filestat: r } = c.fds[e].fd_filestat_get();
-					return r?.write_bytes(new DataView(c.inst.exports.memory.buffer), t), n;
+				if (o.fds[e] != null) {
+					let { ret: n, filestat: r } = o.fds[e].fd_filestat_get();
+					return r?.write_bytes(new DataView(o.inst.exports.memory.buffer), t), n;
 				} else return 8;
 			},
 			fd_filestat_set_size(e, t) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_filestat_set_size(t);
+				return o.fds[e] == null ? 8 : o.fds[e].fd_filestat_set_size(t);
 			},
 			fd_filestat_set_times(e, t, n, r) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_filestat_set_times(t, n, r);
+				return o.fds[e] == null ? 8 : o.fds[e].fd_filestat_set_times(t, n, r);
 			},
-			fd_pread(t, n, r, i, a) {
-				let o = new DataView(c.inst.exports.memory.buffer), s = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[t] != null) {
-					let l = e.read_bytes_array(o, n, r), u = 0;
-					for (let e of l) {
-						let { ret: n, data: r } = c.fds[t].fd_pread(e.buf_len, i);
-						if (n != 0) return o.setUint32(a, u, !0), n;
-						if (s.set(r, e.buf), u += r.length, i += BigInt(r.length), r.length != e.buf_len) break;
+			fd_pread(e, t, r, i, a) {
+				let s = new DataView(o.inst.exports.memory.buffer), c = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let l = n.read_bytes_array(s, t, r), u = 0;
+					for (let t of l) {
+						let { ret: n, data: r } = o.fds[e].fd_pread(t.buf_len, i);
+						if (n != 0) return s.setUint32(a, u, !0), n;
+						if (c.set(r, t.buf), u += r.length, i += BigInt(r.length), r.length != t.buf_len) break;
 					}
-					return o.setUint32(a, u, !0), 0;
+					return s.setUint32(a, u, !0), 0;
 				} else return 8;
 			},
 			fd_prestat_get(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let { ret: r, prestat: i } = c.fds[e].fd_prestat_get();
+				let n = new DataView(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let { ret: r, prestat: i } = o.fds[e].fd_prestat_get();
 					return i?.write_bytes(n, t), r;
 				} else return 8;
 			},
 			fd_prestat_dir_name(e, t, n) {
-				if (c.fds[e] != null) {
-					let { ret: r, prestat: i } = c.fds[e].fd_prestat_get();
+				if (o.fds[e] != null) {
+					let { ret: r, prestat: i } = o.fds[e].fd_prestat_get();
 					if (i == null) return r;
 					let a = i.inner.pr_name;
-					return new Uint8Array(c.inst.exports.memory.buffer).set(a.slice(0, n), t), a.byteLength > n ? 37 : 0;
+					return new Uint8Array(o.inst.exports.memory.buffer).set(a.slice(0, n), t), a.byteLength > n ? 37 : 0;
 				} else return 8;
 			},
-			fd_pwrite(e, n, r, i, a) {
-				let o = new DataView(c.inst.exports.memory.buffer), s = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let l = t.read_bytes_array(o, n, r), u = 0;
+			fd_pwrite(e, t, n, i, a) {
+				let s = new DataView(o.inst.exports.memory.buffer), c = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let l = r.read_bytes_array(s, t, n), u = 0;
 					for (let t of l) {
-						let n = s.slice(t.buf, t.buf + t.buf_len), { ret: r, nwritten: l } = c.fds[e].fd_pwrite(n, i);
-						if (r != 0) return o.setUint32(a, u, !0), r;
+						let n = c.slice(t.buf, t.buf + t.buf_len), { ret: r, nwritten: l } = o.fds[e].fd_pwrite(n, i);
+						if (r != 0) return s.setUint32(a, u, !0), r;
 						if (u += l, i += BigInt(l), l != n.byteLength) break;
 					}
-					return o.setUint32(a, u, !0), 0;
+					return s.setUint32(a, u, !0), 0;
 				} else return 8;
 			},
-			fd_read(t, n, r, i) {
-				let a = new DataView(c.inst.exports.memory.buffer), o = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[t] != null) {
-					let s = e.read_bytes_array(a, n, r), l = 0;
-					for (let e of s) {
-						let { ret: n, data: r } = c.fds[t].fd_read(e.buf_len);
+			fd_read(e, t, r, i) {
+				let a = new DataView(o.inst.exports.memory.buffer), s = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let c = n.read_bytes_array(a, t, r), l = 0;
+					for (let t of c) {
+						let { ret: n, data: r } = o.fds[e].fd_read(t.buf_len);
 						if (n != 0) return a.setUint32(i, l, !0), n;
-						if (o.set(r, e.buf), l += r.length, r.length != e.buf_len) break;
+						if (s.set(r, t.buf), l += r.length, r.length != t.buf_len) break;
 					}
 					return a.setUint32(i, l, !0), 0;
 				} else return 8;
 			},
 			fd_readdir(e, t, n, r, i) {
-				let a = new DataView(c.inst.exports.memory.buffer), o = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let s = 0;
+				let a = new DataView(o.inst.exports.memory.buffer), s = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let c = 0;
 					for (;;) {
-						let { ret: l, dirent: u } = c.fds[e].fd_readdir_single(r);
-						if (l != 0) return a.setUint32(i, s, !0), l;
+						let { ret: l, dirent: u } = o.fds[e].fd_readdir_single(r);
+						if (l != 0) return a.setUint32(i, c, !0), l;
 						if (u == null) break;
-						if (n - s < u.head_length()) {
-							s = n;
+						if (n - c < u.head_length()) {
+							c = n;
 							break;
 						}
 						let d = new ArrayBuffer(u.head_length());
-						if (u.write_head_bytes(new DataView(d), 0), o.set(new Uint8Array(d).slice(0, Math.min(d.byteLength, n - s)), t), t += u.head_length(), s += u.head_length(), n - s < u.name_length()) {
-							s = n;
+						if (u.write_head_bytes(new DataView(d), 0), s.set(new Uint8Array(d).slice(0, Math.min(d.byteLength, n - c)), t), t += u.head_length(), c += u.head_length(), n - c < u.name_length()) {
+							c = n;
 							break;
 						}
-						u.write_name_bytes(o, t, n - s), t += u.name_length(), s += u.name_length(), r = u.d_next;
+						u.write_name_bytes(s, t, n - c), t += u.name_length(), c += u.name_length(), r = u.d_next;
 					}
-					return a.setUint32(i, s, !0), 0;
+					return a.setUint32(i, c, !0), 0;
 				} else return 8;
 			},
 			fd_renumber(e, t) {
-				if (c.fds[e] != null && c.fds[t] != null) {
-					let n = c.fds[t].fd_close();
-					return n == 0 ? (c.fds[t] = c.fds[e], c.fds[e] = void 0, 0) : n;
+				if (o.fds[e] != null && o.fds[t] != null) {
+					let n = o.fds[t].fd_close();
+					return n == 0 ? (o.fds[t] = o.fds[e], o.fds[e] = void 0, 0) : n;
 				} else return 8;
 			},
 			fd_seek(e, t, n, r) {
-				let i = new DataView(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let { ret: a, offset: o } = c.fds[e].fd_seek(t, n);
-					return i.setBigInt64(r, o, !0), a;
+				let i = new DataView(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let { ret: a, offset: s } = o.fds[e].fd_seek(t, n);
+					return i.setBigInt64(r, s, !0), a;
 				} else return 8;
 			},
 			fd_sync(e) {
-				return c.fds[e] == null ? 8 : c.fds[e].fd_sync();
+				return o.fds[e] == null ? 8 : o.fds[e].fd_sync();
 			},
 			fd_tell(e, t) {
-				let n = new DataView(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let { ret: r, offset: i } = c.fds[e].fd_tell();
+				let n = new DataView(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let { ret: r, offset: i } = o.fds[e].fd_tell();
 					return n.setBigUint64(t, i, !0), r;
 				} else return 8;
 			},
-			fd_write(e, n, r, i) {
-				let a = new DataView(c.inst.exports.memory.buffer), o = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let s = t.read_bytes_array(a, n, r), l = 0;
-					for (let t of s) {
-						let n = o.slice(t.buf, t.buf + t.buf_len), { ret: r, nwritten: s } = c.fds[e].fd_write(n);
+			fd_write(e, t, n, i) {
+				let a = new DataView(o.inst.exports.memory.buffer), s = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let c = r.read_bytes_array(a, t, n), l = 0;
+					for (let t of c) {
+						let n = s.slice(t.buf, t.buf + t.buf_len), { ret: r, nwritten: c } = o.fds[e].fd_write(n);
 						if (r != 0) return a.setUint32(i, l, !0), r;
-						if (l += s, s != n.byteLength) break;
+						if (l += c, c != n.byteLength) break;
 					}
 					return a.setUint32(i, l, !0), 0;
 				} else return 8;
 			},
 			path_create_directory(e, t, n) {
-				let r = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
+				let r = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
 					let i = new TextDecoder("utf-8").decode(r.slice(t, t + n));
-					return c.fds[e].path_create_directory(i);
+					return o.fds[e].path_create_directory(i);
 				} else return 8;
 			},
 			path_filestat_get(e, t, n, r, i) {
-				let a = new DataView(c.inst.exports.memory.buffer), o = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let s = new TextDecoder("utf-8").decode(o.slice(n, n + r)), { ret: l, filestat: u } = c.fds[e].path_filestat_get(t, s);
+				let a = new DataView(o.inst.exports.memory.buffer), s = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let c = new TextDecoder("utf-8").decode(s.slice(n, n + r)), { ret: l, filestat: u } = o.fds[e].path_filestat_get(t, c);
 					return u?.write_bytes(a, i), l;
 				} else return 8;
 			},
-			path_filestat_set_times(e, t, n, r, i, a, o) {
-				let s = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let l = new TextDecoder("utf-8").decode(s.slice(n, n + r));
-					return c.fds[e].path_filestat_set_times(t, l, i, a, o);
+			path_filestat_set_times(e, t, n, r, i, a, s) {
+				let c = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let l = new TextDecoder("utf-8").decode(c.slice(n, n + r));
+					return o.fds[e].path_filestat_set_times(t, l, i, a, s);
 				} else return 8;
 			},
-			path_link(e, t, n, r, i, a, o) {
-				let s = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null && c.fds[i] != null) {
-					let l = new TextDecoder("utf-8").decode(s.slice(n, n + r)), u = new TextDecoder("utf-8").decode(s.slice(a, a + o)), { ret: d, inode_obj: f } = c.fds[e].path_lookup(l, t);
-					return f == null ? d : c.fds[i].path_link(u, f, !1);
+			path_link(e, t, n, r, i, a, s) {
+				let c = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null && o.fds[i] != null) {
+					let l = new TextDecoder("utf-8").decode(c.slice(n, n + r)), u = new TextDecoder("utf-8").decode(c.slice(a, a + s)), { ret: d, inode_obj: f } = o.fds[e].path_lookup(l, t);
+					return f == null ? d : o.fds[i].path_link(u, f, !1);
 				} else return 8;
 			},
-			path_open(e, t, n, r, i, a, o, s, l) {
-				let u = new DataView(c.inst.exports.memory.buffer), f = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let p = new TextDecoder("utf-8").decode(f.slice(n, n + r));
-					d.log(p);
-					let { ret: m, fd_obj: h } = c.fds[e].path_open(t, p, i, a, o, s);
+			path_open(e, t, n, r, i, a, s, c, l) {
+				let u = new DataView(o.inst.exports.memory.buffer), d = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let f = new TextDecoder("utf-8").decode(d.slice(n, n + r));
+					p.log(f);
+					let { ret: m, fd_obj: h } = o.fds[e].path_open(t, f, i, a, s, c);
 					if (m != 0) return m;
-					c.fds.push(h);
-					let g = c.fds.length - 1;
+					o.fds.push(h);
+					let g = o.fds.length - 1;
 					return u.setUint32(l, g, !0), 0;
 				} else return 8;
 			},
 			path_readlink(e, t, n, r, i, a) {
-				let o = new DataView(c.inst.exports.memory.buffer), s = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
-					let l = new TextDecoder("utf-8").decode(s.slice(t, t + n));
-					d.log(l);
-					let { ret: u, data: f } = c.fds[e].path_readlink(l);
-					if (f != null) {
-						let e = new TextEncoder().encode(f);
-						if (e.length > i) return o.setUint32(a, 0, !0), 8;
-						s.set(e, r), o.setUint32(a, e.length, !0);
+				let s = new DataView(o.inst.exports.memory.buffer), c = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
+					let l = new TextDecoder("utf-8").decode(c.slice(t, t + n));
+					p.log(l);
+					let { ret: u, data: d } = o.fds[e].path_readlink(l);
+					if (d != null) {
+						let e = new TextEncoder().encode(d);
+						if (e.length > i) return s.setUint32(a, 0, !0), 8;
+						c.set(e, r), s.setUint32(a, e.length, !0);
 					}
 					return u;
 				} else return 8;
 			},
 			path_remove_directory(e, t, n) {
-				let r = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
+				let r = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
 					let i = new TextDecoder("utf-8").decode(r.slice(t, t + n));
-					return c.fds[e].path_remove_directory(i);
+					return o.fds[e].path_remove_directory(i);
 				} else return 8;
 			},
 			path_rename(e, t, n, r, i, a) {
-				let o = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null && c.fds[r] != null) {
-					let s = new TextDecoder("utf-8").decode(o.slice(t, t + n)), l = new TextDecoder("utf-8").decode(o.slice(i, i + a)), { ret: u, inode_obj: d } = c.fds[e].path_unlink(s);
+				let s = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null && o.fds[r] != null) {
+					let c = new TextDecoder("utf-8").decode(s.slice(t, t + n)), l = new TextDecoder("utf-8").decode(s.slice(i, i + a)), { ret: u, inode_obj: d } = o.fds[e].path_unlink(c);
 					if (d == null) return u;
-					if (u = c.fds[r].path_link(l, d, !0), u != 0 && c.fds[e].path_link(s, d, !0) != 0) throw "path_link should always return success when relinking an inode back to the original place";
+					if (u = o.fds[r].path_link(l, d, !0), u != 0 && o.fds[e].path_link(c, d, !0) != 0) throw "path_link should always return success when relinking an inode back to the original place";
 					return u;
 				} else return 8;
 			},
 			path_symlink(e, t, n, r, i) {
-				let a = new Uint8Array(c.inst.exports.memory.buffer);
-				return c.fds[n] == null ? 8 : (new TextDecoder("utf-8").decode(a.slice(e, e + t)), new TextDecoder("utf-8").decode(a.slice(r, r + i)), 58);
+				let a = new Uint8Array(o.inst.exports.memory.buffer);
+				return o.fds[n] == null ? 8 : (new TextDecoder("utf-8").decode(a.slice(e, e + t)), new TextDecoder("utf-8").decode(a.slice(r, r + i)), 58);
 			},
 			path_unlink_file(e, t, n) {
-				let r = new Uint8Array(c.inst.exports.memory.buffer);
-				if (c.fds[e] != null) {
+				let r = new Uint8Array(o.inst.exports.memory.buffer);
+				if (o.fds[e] != null) {
 					let i = new TextDecoder("utf-8").decode(r.slice(t, t + n));
-					return c.fds[e].path_unlink_file(i);
+					return o.fds[e].path_unlink_file(i);
 				} else return 8;
 			},
 			poll_oneoff(e, t, n) {
 				if (n === 0) return 28;
-				if (n > 1) return d.log("poll_oneoff: only a single subscription is supported"), 58;
-				let r = new DataView(c.inst.exports.memory.buffer), i = a.read_bytes(r, e), s = i.eventtype, l = i.clockid, u = i.timeout;
-				if (s !== 0) return d.log("poll_oneoff: only clock subscriptions are supported"), 58;
-				let f;
-				if (l === 1) f = () => BigInt(Math.round(performance.now() * 1e6));
-				else if (l === 0) f = () => BigInt((/* @__PURE__ */ new Date()).getTime()) * 1000000n;
+				if (n > 1) return p.log("poll_oneoff: only a single subscription is supported"), 58;
+				let r = new DataView(o.inst.exports.memory.buffer), i = s.read_bytes(r, e), a = i.eventtype, l = i.clockid, u = i.timeout;
+				if (a !== 0) return p.log("poll_oneoff: only clock subscriptions are supported"), 58;
+				let d;
+				if (l === 1) d = () => BigInt(Math.round(performance.now() * 1e6));
+				else if (l === 0) d = () => BigInt((/* @__PURE__ */ new Date()).getTime()) * 1000000n;
 				else return 28;
-				let p = i.flags & 1 ? u : f() + u;
-				for (; p > f(););
-				return new o(i.userdata, 0, s).write_bytes(r, t), 0;
+				let f = i.flags & 1 ? u : d() + u;
+				for (; f > d(););
+				return new c(i.userdata, 0, a).write_bytes(r, t), 0;
 			},
 			proc_exit(e) {
-				throw new f(e);
+				throw new m(e);
 			},
 			proc_raise(e) {
 				throw "raised signal " + e;
 			},
 			sched_yield() {},
 			random_get(e, t) {
-				let n = new Uint8Array(c.inst.exports.memory.buffer).subarray(e, e + t);
-				if ("crypto" in globalThis && (typeof SharedArrayBuffer > "u" || !(c.inst.exports.memory.buffer instanceof SharedArrayBuffer))) for (let e = 0; e < t; e += 65536) crypto.getRandomValues(n.subarray(e, e + 65536));
+				let n = new Uint8Array(o.inst.exports.memory.buffer).subarray(e, e + t);
+				if ("crypto" in globalThis && (typeof SharedArrayBuffer > "u" || !(o.inst.exports.memory.buffer instanceof SharedArrayBuffer))) for (let e = 0; e < t; e += 65536) crypto.getRandomValues(n.subarray(e, e + 65536));
 				else for (let e = 0; e < t; e++) n[e] = Math.random() * 256 | 0;
 			},
 			sock_recv(e, t, n) {
@@ -439,7 +440,7 @@ var d = new l(!1), f = class extends Error {
 			}
 		};
 	}
-}, m = class {
+}, g = class {
 	fd_allocate(e, t) {
 		return 58;
 	}
@@ -569,7 +570,7 @@ var d = new l(!1), f = class extends Error {
 	path_unlink_file(e) {
 		return 58;
 	}
-}, h = class e {
+}, _ = class e {
 	static issue_ino() {
 		return e.next_ino++;
 	}
@@ -580,10 +581,10 @@ var d = new l(!1), f = class extends Error {
 		this.ino = e.issue_ino();
 	}
 };
-h.next_ino = 1n;
+_.next_ino = 1n;
 //#endregion
 //#region ../../node_modules/@bjorn3/browser_wasi_shim/dist/fs_mem.js
-var g = class extends m {
+var v = class extends g {
 	fd_allocate(e, t) {
 		if (!(this.file.size > e + t)) {
 			let n = new Uint8Array(Number(e + t));
@@ -594,7 +595,7 @@ var g = class extends m {
 	fd_fdstat_get() {
 		return {
 			ret: 0,
-			fdstat: new r(4, 0)
+			fdstat: new a(4, 0)
 		};
 	}
 	fd_filestat_set_size(e) {
@@ -686,7 +687,7 @@ var g = class extends m {
 	constructor(e) {
 		super(), this.file_pos = 0n, this.file = e;
 	}
-}, _ = class extends m {
+}, y = class extends g {
 	fd_seek(e, t) {
 		return {
 			ret: 8,
@@ -705,30 +706,30 @@ var g = class extends m {
 	fd_fdstat_get() {
 		return {
 			ret: 0,
-			fdstat: new r(3, 0)
+			fdstat: new a(3, 0)
 		};
 	}
 	fd_readdir_single(e) {
-		if (d.enabled && (d.log("readdir_single", e), d.log(e, this.dir.contents.keys())), e == 0n) return {
+		if (p.enabled && (p.log("readdir_single", e), p.log(e, this.dir.contents.keys())), e == 0n) return {
 			ret: 0,
-			dirent: new n(1n, this.dir.ino, ".", 3)
+			dirent: new i(1n, this.dir.ino, ".", 3)
 		};
 		if (e == 1n) return {
 			ret: 0,
-			dirent: new n(2n, this.dir.parent_ino(), "..", 3)
+			dirent: new i(2n, this.dir.parent_ino(), "..", 3)
 		};
 		if (e >= BigInt(this.dir.contents.size) + 2n) return {
 			ret: 0,
 			dirent: null
 		};
-		let [t, r] = Array.from(this.dir.contents.entries())[Number(e - 2n)];
+		let [t, n] = Array.from(this.dir.contents.entries())[Number(e - 2n)];
 		return {
 			ret: 0,
-			dirent: new n(e + 1n, r.ino, t, r.stat().filetype)
+			dirent: new i(e + 1n, n.ino, t, n.stat().filetype)
 		};
 	}
 	path_filestat_get(e, t) {
-		let { ret: n, path: r } = b.from(t);
+		let { ret: n, path: r } = S.from(t);
 		if (r == null) return {
 			ret: n,
 			filestat: null
@@ -743,7 +744,7 @@ var g = class extends m {
 		};
 	}
 	path_lookup(e, t) {
-		let { ret: n, path: r } = b.from(e);
+		let { ret: n, path: r } = S.from(e);
 		if (r == null) return {
 			ret: n,
 			inode_obj: null
@@ -758,7 +759,7 @@ var g = class extends m {
 		};
 	}
 	path_open(e, t, n, r, i, a) {
-		let { ret: o, path: s } = b.from(t);
+		let { ret: o, path: s } = S.from(t);
 		if (s == null) return {
 			ret: o,
 			fd_obj: null
@@ -793,14 +794,14 @@ var g = class extends m {
 		return this.path_open(0, e, 3, 0n, 0n, 0).ret;
 	}
 	path_link(e, t, n) {
-		let { ret: r, path: i } = b.from(e);
+		let { ret: r, path: i } = S.from(e);
 		if (i == null) return r;
 		if (i.is_dir) return 44;
 		let { ret: a, parent_entry: o, filename: s, entry: c } = this.dir.get_parent_dir_and_entry_for_path(i, !0);
 		if (o == null || s == null) return a;
 		if (c != null) {
 			let e = t.stat().filetype == 3, r = c.stat().filetype == 3;
-			if (e && r) if (n && c instanceof x) {
+			if (e && r) if (n && c instanceof C) {
 				if (c.contents.size != 0) return 55;
 			} else return 20;
 			else if (e && !r) return 54;
@@ -810,7 +811,7 @@ var g = class extends m {
 		return !n && t.stat().filetype == 3 ? 63 : (o.contents.set(s, t), 0);
 	}
 	path_unlink(e) {
-		let { ret: t, path: n } = b.from(e);
+		let { ret: t, path: n } = S.from(e);
 		if (n == null) return {
 			ret: t,
 			inode_obj: null
@@ -828,16 +829,16 @@ var g = class extends m {
 		});
 	}
 	path_unlink_file(e) {
-		let { ret: t, path: n } = b.from(e);
+		let { ret: t, path: n } = S.from(e);
 		if (n == null) return t;
 		let { ret: r, parent_entry: i, filename: a, entry: o } = this.dir.get_parent_dir_and_entry_for_path(n, !1);
 		return i == null || a == null || o == null ? r : o.stat().filetype === 3 ? 31 : (i.contents.delete(a), 0);
 	}
 	path_remove_directory(e) {
-		let { ret: t, path: n } = b.from(e);
+		let { ret: t, path: n } = S.from(e);
 		if (n == null) return t;
 		let { ret: r, parent_entry: i, filename: a, entry: o } = this.dir.get_parent_dir_and_entry_for_path(n, !1);
-		return i == null || a == null || o == null ? r : !(o instanceof x) || o.stat().filetype !== 3 ? 54 : o.contents.size === 0 ? i.contents.delete(a) ? 0 : 44 : 55;
+		return i == null || a == null || o == null ? r : !(o instanceof C) || o.stat().filetype !== 3 ? 54 : o.contents.size === 0 ? i.contents.delete(a) ? 0 : 44 : 55;
 	}
 	fd_filestat_get() {
 		return {
@@ -875,17 +876,17 @@ var g = class extends m {
 	constructor(e) {
 		super(), this.dir = e;
 	}
-}, v = class extends _ {
+}, b = class extends y {
 	fd_prestat_get() {
 		return {
 			ret: 0,
-			prestat: c.dir(this.prestat_name)
+			prestat: u.dir(this.prestat_name)
 		};
 	}
 	constructor(e, t) {
-		super(new x(t)), this.prestat_name = e;
+		super(new C(t)), this.prestat_name = e;
 	}
-}, y = class extends h {
+}, x = class extends _ {
 	path_open(e, t, n) {
 		if (this.readonly && (t & BigInt(64)) == BigInt(64)) return {
 			ret: 63,
@@ -898,7 +899,7 @@ var g = class extends m {
 			};
 			this.data = new Uint8Array([]);
 		}
-		let r = new g(this);
+		let r = new v(this);
 		return n & 1 && r.fd_seek(0n, 2), {
 			ret: 0,
 			fd_obj: r
@@ -908,12 +909,12 @@ var g = class extends m {
 		return BigInt(this.data.byteLength);
 	}
 	stat() {
-		return new i(this.ino, 4, this.size);
+		return new o(this.ino, 4, this.size);
 	}
 	constructor(e, t) {
 		super(), this.data = new Uint8Array(e), this.readonly = !!t?.readonly;
 	}
-}, b = class e {
+}, S = class e {
 	static from(t) {
 		let n = new e();
 		if (n.is_dir = t.endsWith("/"), t.startsWith("/")) return {
@@ -946,18 +947,18 @@ var g = class extends m {
 	constructor() {
 		this.parts = [], this.is_dir = !1;
 	}
-}, x = class e extends h {
+}, C = class e extends _ {
 	parent_ino() {
-		return this.parent == null ? h.root_ino() : this.parent.ino;
+		return this.parent == null ? _.root_ino() : this.parent.ino;
 	}
 	path_open(e, t, n) {
 		return {
 			ret: 0,
-			fd_obj: new _(this)
+			fd_obj: new y(this)
 		};
 	}
 	stat() {
-		return new i(this.ino, 3, 0n);
+		return new o(this.ino, 3, 0n);
 	}
 	get_entry_for_path(t) {
 		let n = this;
@@ -968,7 +969,7 @@ var g = class extends m {
 			};
 			let t = n.contents.get(r);
 			if (t !== void 0) n = t;
-			else return d.log(r), {
+			else return p.log(r), {
 				ret: 44,
 				entry: null
 			};
@@ -1026,7 +1027,7 @@ var g = class extends m {
 		};
 	}
 	create_entry_for_path(t, n) {
-		let { ret: r, path: i } = b.from(t);
+		let { ret: r, path: i } = S.from(t);
 		if (i == null) return {
 			ret: r,
 			entry: null
@@ -1040,9 +1041,9 @@ var g = class extends m {
 			ret: 20,
 			entry: null
 		};
-		d.log("create", i);
+		p.log("create", i);
 		let l;
-		return l = n ? new e(/* @__PURE__ */ new Map()) : new y(/* @__PURE__ */ new ArrayBuffer(0)), o.contents.set(s, l), c = l, {
+		return l = n ? new e(/* @__PURE__ */ new Map()) : new x(/* @__PURE__ */ new ArrayBuffer(0)), o.contents.set(s, l), c = l, {
 			ret: 0,
 			entry: c
 		};
@@ -1051,81 +1052,188 @@ var g = class extends m {
 		super(), this.parent = null, t instanceof Array ? this.contents = new Map(t) : this.contents = t;
 		for (let t of this.contents.values()) t instanceof e && (t.parent = this);
 	}
-}, S = ["https:"], C = [
-	"127.0.0.1",
-	"localhost",
-	"0.0.0.0",
-	"[::1]",
-	"10.",
-	"172.16.",
-	"172.17.",
-	"172.18.",
-	"172.19.",
-	"172.20.",
-	"172.21.",
-	"172.22.",
-	"172.23.",
-	"172.24.",
-	"172.25.",
-	"172.26.",
-	"172.27.",
-	"172.28.",
-	"172.29.",
-	"172.30.",
-	"172.31.",
-	"192.168."
-];
-function w(e) {
-	let t;
+}, w = [], T = 128 * 1024 * 1024, E = ["application/wasm", "application/octet-stream"], D = ["application/octet-stream"], O = 4096, k = 4096, A = 65536;
+function j(e, n = w) {
+	let r;
 	try {
-		t = new URL(e);
+		r = new URL(e);
 	} catch {
 		throw Error(`Invalid image URL: ${e}`);
 	}
-	if (!S.includes(t.protocol)) throw Error(`Protocol not allowed: ${t.protocol}`);
-	let n = t.hostname.toLowerCase();
-	for (let e of C) if (n === e || n.startsWith(e)) throw Error(`Image URL host blocked: ${n}`);
-	if (!t.pathname.endsWith(".wasm")) throw Error(`Image URL must point to a .wasm file: ${t.pathname}`);
-	return t;
+	if (n.length === 0) throw Error("container workload disabled: no container image origins are configured (set containerImageOrigins on the node host)");
+	if (!n.includes(r.origin)) throw Error(`Container image origin not allowed: ${r.origin}`);
+	if (!r.pathname.endsWith(".wasm")) throw Error(`Image URL must point to a .wasm file: ${r.pathname}`);
+	return t(r);
+}
+function M(e) {
+	if (e.byteLength < 8) throw Error("Invalid WASM image: truncated header");
+	if (e[0] !== 0 || e[1] !== 97 || e[2] !== 115 || e[3] !== 109) throw Error("Invalid WASM image: bad magic number");
+	if (new DataView(e.buffer, e.byteOffset, e.byteLength).getUint32(4, !0) !== 1) throw Error("Unsupported WASM image version");
+	let t = 8;
+	for (; t < e.byteLength;) {
+		let n = e[t++], r = N(e, t);
+		t = r.next;
+		let i = t + r.value;
+		if (i > e.byteLength) throw Error("Invalid WASM image: truncated section");
+		if (n === 5) {
+			let n = t, r = N(e, n);
+			n = r.next;
+			let a = 0, o = null;
+			for (let t = 0; t < r.value; t++) {
+				let t = N(e, n);
+				n = t.next;
+				let r = N(e, n);
+				n = r.next;
+				let s = (t.value & 2) != 0, c = (t.value & 1) != 0 || s, l = null;
+				if (c) {
+					let t = N(e, n);
+					n = t.next, l = t.value;
+				}
+				if (n > i) throw Error("Invalid WASM image: malformed memory section");
+				if (a = Math.max(a, r.value * A), l !== null) {
+					let e = l * A;
+					o = o === null ? e : Math.max(o, e);
+				}
+			}
+			return {
+				initialBytes: a,
+				maximumBytes: o
+			};
+		}
+		t = i;
+	}
+	return {
+		initialBytes: 0,
+		maximumBytes: null
+	};
+}
+function N(e, t) {
+	let n = 0, r = 0, i = t;
+	for (;;) {
+		if (i >= e.byteLength) throw Error("Invalid WASM image: truncated LEB128 value");
+		let t = e[i++];
+		if (n |= (t & 127) << r, !(t & 128)) return {
+			value: n >>> 0,
+			next: i
+		};
+		if (r += 7, r > 28) throw Error("Invalid WASM image: oversized LEB128 value");
+	}
+}
+function P(e) {
+	let t = e ?? 512;
+	if (!Number.isFinite(t)) throw Error(`memoryLimitMb must be a finite number, got ${String(e)}`);
+	return Math.min(k, Math.max(32, Math.floor(t)));
+}
+function F(e, t) {
+	let n = t * 1024 * 1024, r = M(e);
+	if (r.initialBytes > n) throw Error(`Container image declares ${Math.round(r.initialBytes / 1024 / 1024)}MB of initial memory, above memoryLimitMb=${t}`);
+	if (r.maximumBytes === null) throw Error("Container image has no declared maximum memory; memoryLimitMb cannot be enforced");
+	if (r.maximumBytes > n) throw Error(`Container image may grow to ${Math.round(r.maximumBytes / 1024 / 1024)}MB, above memoryLimitMb=${t}`);
+	return r;
+}
+function I(e) {
+	if (!e || e.length > 255 || e.startsWith("/") || e.includes("\\") || /[\u0000-\u001f\u007f]/.test(e) || e.split("/").some((e) => !e || e === "." || e === "..")) throw Error(`Invalid container input mount name: ${e}`);
+}
+function L(e, n) {
+	let r;
+	try {
+		r = new URL(e);
+	} catch {
+		throw Error("Invalid container file-source URL");
+	}
+	if (r.search || r.hash) throw Error("Container file-source URLs cannot contain query strings or fragments");
+	if (r.username || r.password) throw Error("Container file-source URLs cannot contain credentials");
+	if (!n.includes(r.origin)) throw Error(`Container file-source origin not allowed: ${r.origin}`);
+	return t(r);
+}
+function R(e) {
+	if (!e || typeof e != "object" || Array.isArray(e)) return !1;
+	let t = e;
+	return typeof t.url == "string" && t.url.length <= 2048 && typeof t.token == "string" && t.token.length <= 4096 && /^[A-Za-z0-9_-]+\.[a-f0-9]{64}$/.test(t.token) && Number.isSafeInteger(t.size) && t.size >= 0 && t.size <= 26214400 && typeof t.sha256 == "string" && /^[a-f0-9]{64}$/.test(t.sha256);
+}
+async function z(t, n = []) {
+	let r = t.files ?? {}, i = t.fileSources ?? {};
+	if (!r || typeof r != "object" || Array.isArray(r)) throw Error("Container files must be a filename-to-base64 map");
+	if (!i || typeof i != "object" || Array.isArray(i)) throw Error("Container fileSources must be a filename-to-source map");
+	let a = Object.entries(r), o = Object.entries(i);
+	if (a.length + o.length > O) throw Error(`Container input file count exceeds ${O}`);
+	let s = /* @__PURE__ */ new Map(), c = 0;
+	for (let [e, t] of a) {
+		if (I(e), typeof t != "string") throw Error(`Container file ${e} must be base64 text`);
+		if (t.length > 8738134 * 4) throw Error(`Container file ${e} exceeds the 25 MiB input limit`);
+		let n;
+		try {
+			n = atob(t);
+		} catch {
+			throw Error(`Container file ${e} is not valid base64`);
+		}
+		let r = Uint8Array.from(n, (e) => e.charCodeAt(0));
+		if (c += r.byteLength, c > 26214400) throw Error("Container input files exceed the 25 MiB limit");
+		s.set(e, r);
+	}
+	for (let [t, r] of o) {
+		if (I(t), s.has(t)) throw Error(`Container input file is defined twice: ${t}`);
+		if (!R(r)) throw Error(`Container file source ${t} is malformed`);
+		let i = r;
+		if (c += i.size, c > 26214400) throw Error("Container input files exceed the 25 MiB limit");
+		let a = await e({
+			url: L(i.url, n),
+			allowContentTypes: D,
+			maxBytes: Math.max(1, i.size),
+			timeoutMs: 6e4,
+			headers: { Authorization: `Bearer ${i.token}` }
+		});
+		if (!a.ok || a.status !== 200) throw Error(`Failed to download container file source: HTTP ${a.status}`);
+		if (a.byteLength !== i.size) throw Error(`Container file source ${t} size mismatch: expected ${i.size}, got ${a.byteLength}`);
+		let o = await crypto.subtle.digest("SHA-256", a.bytes.slice().buffer);
+		if ([...new Uint8Array(o)].map((e) => e.toString(16).padStart(2, "0")).join("") !== i.sha256) throw Error(`Container file source ${t} SHA-256 mismatch`);
+		s.set(t, a.bytes);
+	}
+	return s;
 }
-var T = async (e) => {
-	let { image: t, command: n, files: r, memoryLimitMb: i = 512 } = e, a = w(t);
-	console.log(`Starting container: ${t} with command: ${n.join(" ")}`);
-	let o = [], s = [], c = { write: (e) => (o.push(new TextDecoder().decode(e)), e.length) }, l = { write: (e) => (s.push(new TextDecoder().decode(e)), e.length) }, u = /* @__PURE__ */ new Map();
-	for (let [e, t] of Object.entries(r)) {
-		let n = Uint8Array.from(atob(t), (e) => e.charCodeAt(0));
-		u.set(e, new y(n));
-	}
-	let d = new v("/", u), f = new p(n, [], [
-		new y(new Uint8Array()),
-		{ write: c.write },
-		{ write: l.write },
-		d
-	]), m = await (await fetch(a.toString())).arrayBuffer(), { instance: h } = await WebAssembly.instantiate(m, { wasi_snapshot_preview1: f.wasiImport });
+var B = async (t, n = [], r = w) => {
+	let { image: i, command: a, memoryLimitMb: o } = t, s = j(i, r), c = P(o), l = await z(t, n);
+	console.log(`Starting container: ${i} with command: ${a.join(" ")}`);
+	let u = [], d = [], f = { write: (e) => (u.push(new TextDecoder().decode(e)), e.length) }, p = { write: (e) => (d.push(new TextDecoder().decode(e)), e.length) }, m = /* @__PURE__ */ new Map();
+	for (let [e, t] of l) m.set(e, new x(t));
+	let g = new b("/", m), _ = new h(a, [], [
+		new x(new Uint8Array()),
+		{ write: f.write },
+		{ write: p.write },
+		g
+	]), v = await e({
+		url: s,
+		allowContentTypes: E,
+		maxBytes: T
+	});
+	if (!v.ok) throw Error(`Failed to download container image: ${s.toString()} (HTTP ${v.status})`);
+	let y = v.bytes, S = F(y, c);
+	console.log(`[flaxia-node] container: memory cap ${c}MB (declared initial=${Math.round(S.initialBytes / 1024 / 1024)}MB max=${S.maximumBytes === null ? "unbounded" : `${Math.round(S.maximumBytes / 1024 / 1024)}MB`})`);
+	let { instance: C } = await WebAssembly.instantiate(y.slice().buffer, { wasi_snapshot_preview1: _.wasiImport });
 	try {
-		let e = f.start(h);
+		let e = _.start(C);
 		return {
 			files: {},
-			stdout: o.join(""),
-			stderr: s.join(""),
+			stdout: u.join(""),
+			stderr: d.join(""),
 			exitCode: e
 		};
 	} catch {
 		return {
 			files: {},
-			stdout: o.join(""),
-			stderr: s.join(""),
+			stdout: u.join(""),
+			stderr: d.join(""),
 			exitCode: -1
 		};
 	}
-}, E = async (e) => {
-	let t = performance.now();
+}, V = async (e, t = [], n) => {
+	let r = performance.now();
 	try {
-		let n = await T(e);
-		return console.log(`[flaxia-node] container: done durationMs=${Math.round(performance.now() - t)} exitCode=${n.exitCode ?? "?"}`), n;
+		let i = await B(e, t, n);
+		return console.log(`[flaxia-node] container: done durationMs=${Math.round(performance.now() - r)} exitCode=${i.exitCode ?? "?"}`), i;
 	} catch (e) {
 		throw console.error(`[flaxia-node] container: failed error=${e instanceof Error ? e.message : String(e)}`), e;
 	}
 };
 //#endregion
-export { E as handleContainer };
+export { V as handleContainer };