@poe-platform/safe-bash 0.1.629 → 0.1.631

package/dist/safe-bash/commands/python/worker.browser.js

@@ -0,0 +1,736 @@
+import {
+  parsePythonInvocation
+} from "../../chunks/chunk-JZDO5MC3.js";
+import {
+  init_platform
+} from "../../chunks/chunk-O2EVBRKF.js";
+
+// packages/safe-bash/src/commands/python/worker.ts
+init_platform();
+import { mountPythonFileSystem } from "@poe-platform/safe-fs/core";
+
+// packages/safe-bash/src/commands/python/execution.ts
+init_platform();
+var pythonExecution = `
+import sys, os, json, runpy, traceback, types, warnings, textwrap, io, struct, linecache
+_safe_invocation = json.loads(_safe_invocation_json)
+os.environ.clear()
+os.environ.update(_safe_invocation['env'])
+_safe_args = list(_safe_invocation['args'])
+_safe_exit = 0
+
+class _SafeOptionError(ValueError):
+ pass
+
+def _safe_system_exit(_error):
+ if isinstance(_error.code, int):
+  _status = int.__index__(_error.code)
+  _long_bound = 1 << (8 * struct.calcsize('@l') - 1)
+  status = (_status & 255) if -_long_bound <= _status < _long_bound else 255
+ else:
+  status = 0 if _error.code is None else 1
+ if _error.code is not None and not isinstance(_error.code, int):
+  print(_error.code, file=sys.stderr)
+ return status
+
+def _safe_launch():
+ args = list(_safe_args)
+ unbuffered = False
+ ignore_env = bool(sys.flags.ignore_environment)
+ safe_path = bool(sys.flags.safe_path)
+ native_warning_options = list(sys.warnoptions)
+ warning_options = []
+ version_count = 0
+ options_terminated = False
+ while args and args[0].startswith('-') and args[0] != '-':
+  option = args.pop(0)
+  if option == '--':
+   options_terminated = True
+   break
+  if option in ('--help', '-h', '-?'):
+   print('usage: python [-uBEPOsSIbdvqR] [-W filter] [-X option] [-c code | -m module | file | -] [args ...]')
+   print('Dedicated Pyodide interpreter; stdin is noninteractive.')
+   print('-u: unbuffered binary output; -B: disable bytecode writes; -E: ignore PYTHON* settings')
+   print('-P: omit automatic unsafe sys.path entry; -W: Python warning filter')
+   print('-O/-OO, -S/-s/-I, -b/-bb, -d/-v/-q/-R: CPython startup flags')
+   print('-X: utf8, dev, warn_default_encoding, int_max_str_digits; interactive flags are unsupported.')
+   return
+  if option == '--version':
+   version_count += 1
+   continue
+  if option.startswith('--'):
+   raise _SafeOptionError('unsupported option ' + option)
+  index = 1
+  while index < len(option):
+   flag = option[index]
+   if flag in ('h', '?'):
+    args = ['--help']
+    break
+   if flag == 'V':
+    version_count += 1
+    index += 1
+    continue
+   if flag in ('c', 'm', 'W', 'X'):
+    operand = option[index + 1:] if index + 1 < len(option) else args.pop(0) if args else None
+    if operand is None:
+     raise _SafeOptionError('argument expected for -' + flag)
+    if flag in ('W', 'X'):
+     if flag == 'W': warning_options.append(operand)
+     break
+    args = ['-' + flag, operand] + args
+    break
+   elif flag in ('O', 'S', 's', 'I', 'b', 'd', 'v', 'q', 'R'):
+    pass # Applied by CPython startup configuration before bootstrap.
+   elif flag == 'u':
+    unbuffered = True
+   elif flag == 'B':
+    sys.dont_write_bytecode = True
+   elif flag == 'E':
+    ignore_env = True
+   elif flag == 'P':
+    safe_path = True
+   else:
+    raise _SafeOptionError('unsupported option -' + flag)
+   index += 1
+  if args and args[0] in ('-c', '-m'):
+   break
+ if version_count:
+  print('Python ' + (sys.version if version_count > 1 else sys.version.split()[0]))
+  return
+ if not ignore_env:
+  unbuffered = unbuffered or bool(os.environ.get('PYTHONUNBUFFERED'))
+  sys.dont_write_bytecode = sys.dont_write_bytecode or bool(os.environ.get('PYTHONDONTWRITEBYTECODE'))
+  safe_path = safe_path or bool(os.environ.get('PYTHONSAFEPATH'))
+  path = os.environ.get('PYTHONPATH')
+  if path:
+   sys.path[0:0] = [os.path.abspath(entry) for entry in path.split(os.pathsep)]
+  if os.environ.get('PYTHONWARNINGS'):
+   warning_options[0:0] = os.environ['PYTHONWARNINGS'].split(',')
+  encoding = os.environ.get('PYTHONIOENCODING')
+  if encoding:
+   name, separator, errors = encoding.partition(':')
+   for stream in (sys.stdin, sys.stdout):
+    stream.reconfigure(encoding=name or None, errors=(errors or 'strict'))
+   sys.stderr.reconfigure(encoding=name or None, errors='backslashreplace')
+ # CPython's -b/-bb filter follows environment and command-line -W filters.
+ byte_warning = ('error' if sys.flags.bytes_warning > 1 else 'default') + '::BytesWarning'
+ native_before = [value for value in native_warning_options if not (sys.flags.bytes_warning and value == byte_warning)]
+ warning_options = native_before + warning_options + ([byte_warning] if sys.flags.bytes_warning else [])
+ warnings._processoptions(warning_options)
+ sys.warnoptions[:] = warning_options
+ if unbuffered:
+  for name in ('stdout', 'stderr'):
+   stream = getattr(sys, name)
+   stream.flush()
+   encoding, errors = stream.encoding, stream.errors
+   binary = stream.detach()
+   raw = binary.detach() if hasattr(binary, 'detach') else binary
+   replacement = io.TextIOWrapper(raw, encoding=encoding, errors=errors, write_through=True)
+   setattr(sys, name, replacement)
+   setattr(sys, '__' + name + '__', replacement)
+ main = types.ModuleType('__main__')
+ main.__dict__.update(__package__=None, __spec__=None, __loader__=None, __builtins__=__builtins__)
+ sys.modules['__main__'] = main
+ if not options_terminated and args and args[0] == '-c':
+  sys.argv = ['-c'] + args[2:]
+  if not safe_path: sys.path.insert(0, '')
+  source = textwrap.dedent(args[1])
+  code = compile(source, '<string>', 'exec')
+  # CPython 3.14 retains -c source for both top-level and nested tracebacks.
+  linecache._register_code(code, source, '<string>')
+  exec(code, main.__dict__)
+ elif not options_terminated and args and args[0] == '-m':
+  sys.argv = args[1:]
+  if not safe_path: sys.path.insert(0, os.getcwd())
+  runpy._run_module_as_main(args[1], alter_argv=True)
+ elif not args or args[0] == '-':
+  sys.argv = (['-'] + args[1:]) if args else ['']
+  if not safe_path: sys.path.insert(0, '')
+  main.__file__ = '<stdin>'
+  exec(compile(sys.stdin.buffer.read(), '<stdin>', 'exec'), main.__dict__)
+ else:
+  sys.argv = args
+  # CPython makes __file__ absolute without collapsing ./ or ../ components.
+  path = args[0] if os.path.isabs(args[0]) else os.path.join(os.getcwd(), args[0])
+  importer = __import__('pkgutil').get_importer(path)
+  if importer is not None:
+   sys.path.insert(0, path)
+   runpy._run_module_as_main('__main__', alter_argv=False)
+  else:
+   if not safe_path: sys.path.insert(0, os.path.dirname(os.path.realpath(path)))
+   try:
+    with open(path, 'rb') as source:
+     code = source.read()
+   except OSError as error:
+    print("python: can't open file " + repr(path) + ': [Errno ' + str(error.errno) + '] ' + error.strerror, file=sys.stderr)
+    return 2
+   main.__file__ = path
+   main.__loader__ = __import__('importlib.machinery', fromlist=['SourceFileLoader']).SourceFileLoader('__main__', path)
+   exec(compile(code, path, 'exec'), main.__dict__)
+ return 0
+
+try:
+ _safe_exit = _safe_launch() or 0
+except SystemExit as _error:
+ _safe_exit = _safe_system_exit(_error)
+except _SafeOptionError as _error:
+ print('python: ' + str(_error), file=sys.stderr)
+ _safe_exit = 2
+except BaseException as _error:
+ # Hide bridge frames while preserving actual Python frames and chained errors.
+ _trace = _error.__traceback__
+ while _trace is not None and _trace.tb_frame.f_code.co_filename == '<exec>':
+  _trace = _trace.tb_next
+ _error.__traceback__ = _trace
+ sys.last_exc = _error
+ _safe_exit = 130 if isinstance(_error, KeyboardInterrupt) else 1
+ try:
+  sys.excepthook(type(_error), _error, _trace)
+ except SystemExit as _hook_error:
+  _safe_exit = _safe_system_exit(_hook_error)
+ except BaseException as _hook_error:
+  print('Error in sys.excepthook:', file=sys.stderr)
+  traceback.print_exception(type(_hook_error), _hook_error, _hook_error.__traceback__.tb_next)
+  print('\\nOriginal exception was:', file=sys.stderr)
+  sys.__excepthook__(type(_error), _error, _trace)
+finally:
+ for _stream in (sys.stdout, sys.stderr):
+  if _stream is not None and not getattr(_stream, 'closed', False):
+   try:
+    _stream.flush()
+   except BaseException:
+    _safe_exit = 120
+_safe_exit
+`;
+
+// packages/safe-bash/src/commands/python/provisioning-runtime.ts
+init_platform();
+async function installPythonPackages(supplied, start, request, maxTransferBytes) {
+  if (start.requirements.length === 0) return;
+  const runtime = supplied;
+  if (runtime.version !== "314.0.6" || !runtime._api?.packageManager || !runtime._api.lockfile_packages || typeof runtime.loadPackage !== "function" || typeof runtime.runPythonAsync !== "function") throw new Error("Python package installer ABI requires Pyodide 314.0.6");
+  const fetch = (url, expected) => {
+    const opened = request("package-open", start.session, url, expected);
+    try {
+      const bytes = new Uint8Array(opened.size);
+      for (let offset = 0; offset < bytes.length; ) {
+        const chunk = request("package-read", start.session, opened.key, offset, Math.min(maxTransferBytes, 65536, bytes.length - offset));
+        if (!Array.isArray(chunk) || chunk.length === 0 || offset + chunk.length > bytes.length) throw new Error("Invalid Python package chunk");
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+      }
+      return { bytes, headers: opened.headers };
+    } finally {
+      request("package-close", start.session, opened.key);
+    }
+  };
+  runtime._api.packageManager.downloadPackage = async (metadata) => {
+    if (metadata.channel === runtime._api.packageManager.defaultChannel) {
+      const pkg = runtime._api.lockfile_packages[metadata.normalizedName];
+      if (!pkg) throw new Error(`Missing matching Pyodide package: ${metadata.normalizedName}`);
+      return fetch(new URL(pkg.file_name, "https://cdn.jsdelivr.net/pyodide/v314.0.6/full/").href, pkg.sha256).bytes;
+    }
+    return fetch(metadata.channel).bytes;
+  };
+  const loadPackages = async (names) => {
+    const errors = [];
+    await runtime.loadPackage(names, { messageCallback() {
+    }, errorCallback(message) {
+      errors.push(message);
+    } });
+    if (errors.length) throw new Error(errors.join("\n"));
+  };
+  const installedGlobals = [];
+  try {
+    await loadPackages(["micropip"]);
+    runtime.globals.set("_safe_package_native", loadPackages);
+    installedGlobals.push("_safe_package_native");
+    runtime.globals.set("_safe_package_bytes", (url, hash) => fetch(url, hash).bytes);
+    installedGlobals.push("_safe_package_bytes");
+    runtime.globals.set("_safe_package_metadata", (url) => {
+      const result = fetch(url);
+      return JSON.stringify({ text: new TextDecoder().decode(result.bytes), headers: Object.fromEntries(result.headers.map(([name, value]) => [name.toLowerCase(), value])) });
+    });
+    installedGlobals.push("_safe_package_metadata");
+    runtime.globals.set("_safe_package_requirements_json", JSON.stringify(start.requirements));
+    installedGlobals.push("_safe_package_requirements_json");
+    await runtime.runPythonAsync(`
+import json as _safe_json
+import micropip as _safe_micropip
+from micropip._compat import compatibility_layer as _safe_compat
+from micropip.package_manager import PackageManager as _SafePackageManager
+from micropip.wheelinfo import WheelInfo as _SafeWheelInfo
+from micropip._utils import check_compatible as _safe_check_compatible
+from micropip._vendored.packaging.src.packaging.requirements import Requirement as _SafeRequirement, InvalidRequirement as _SafeInvalidRequirement
+from micropip._vendored.packaging.src.packaging.utils import canonicalize_name as _safe_name
+
+class _SafePackageCompatibility(_safe_compat):
+ @staticmethod
+ async def loadPackage(names):
+  return await _safe_package_native(names)
+ @staticmethod
+ async def fetch_bytes(url, kwargs):
+  return _safe_package_bytes(url).to_bytes()
+ @staticmethod
+ async def fetch_string_and_headers(url, kwargs):
+  value = _safe_json.loads(_safe_package_metadata(url))
+  return value['text'], value['headers']
+
+# Require index/URL digests before publishing wheel bytes to the host cache.
+# Local wheels are host-trusted inputs and receive a content digest on first read.
+async def _safe_wheel_fetch(self, url, kwargs, compat):
+ expected = self.sha256 if url == self.url else None
+ if url == self.metadata_url and isinstance(self.core_metadata, dict):
+  expected = self.core_metadata.get('sha256')
+ return _safe_package_bytes(url, expected).to_bytes()
+_SafeWheelInfo._fetch_bytes = _safe_wheel_fetch
+_safe_manager = _SafePackageManager(_SafePackageCompatibility)
+_safe_requirements = _safe_json.loads(_safe_package_requirements_json)
+# A persisted base wheel may be visited before a newly requested extra. Micropip
+# skips already locked names, so every occurrence must carry the requested extras.
+_safe_roots = []
+_safe_extras = {}
+for _safe_source in _safe_requirements:
+ try:
+  _safe_root = _SafeRequirement(_safe_source)
+  if _safe_root.name.endswith('.whl'):
+   raise _SafeInvalidRequirement(_safe_source)
+ except _SafeInvalidRequirement:
+  _safe_wheel = _SafeWheelInfo.from_url(_safe_source)
+  _safe_root = _SafeRequirement(_safe_wheel.name + ' @ ' + _safe_source)
+ _safe_roots.append(_safe_root)
+ if not _safe_root.marker or _safe_root.marker.evaluate({'extra': ''}):
+  # Named requirements may be skipped when already locked. Validate direct
+  # wheels even then, rather than letting an incompatible URL report success.
+  if _safe_root.url:
+   _safe_direct_wheel = _SafeWheelInfo.from_url(_safe_root.url)
+   _safe_check_compatible(_safe_direct_wheel.filename)
+   # Validate the actual archive and host-checked digest even if micropip's
+   # satisfied-name fast path will skip installing this explicit operand.
+   await _safe_direct_wheel.download({}, _SafePackageCompatibility)
+  _safe_extras.setdefault(_safe_name(_safe_root.name), set()).update(_safe_root.extras)
+for _safe_root in _safe_roots:
+ _safe_root.extras.update(_safe_extras.get(_safe_name(_safe_root.name), set()))
+await _safe_manager.install([str(root) for root in _safe_roots], deps=True)
+# Resolve selected extras from distribution metadata, including extras added to
+# an already satisfied transitive dependency. Micropip skips those names early.
+# Keep its installer and conflict policy; do not infer dependencies from imports.
+import importlib.metadata as _safe_metadata
+_safe_previous_pending = None
+while True:
+ _safe_distributions = [d for d in _safe_metadata.distributions() if d.metadata['Name']]
+ _safe_versions = {_safe_name(d.metadata['Name']): d.version for d in _safe_distributions}
+ while True:
+  _safe_changed = False
+  _safe_dependencies = []
+  for _safe_dist in _safe_distributions:
+   _safe_contexts = {''} | _safe_extras.get(_safe_name(_safe_dist.metadata['Name']), set())
+   for _safe_dep in _safe_dist.requires or []:
+    _safe_requirement = _SafeRequirement(_safe_dep)
+    if _safe_requirement.marker and not any(_safe_requirement.marker.evaluate({'extra': extra}) for extra in _safe_contexts):
+     continue
+    # The marker belongs to the requesting distribution's extra context, already
+    # evaluated above; a separate installer transaction must not reinterpret it.
+    _safe_requirement.marker = None
+    _safe_dependencies.append(_safe_requirement)
+    _safe_selected = _safe_extras.setdefault(_safe_name(_safe_requirement.name), set())
+    if not _safe_requirement.extras.issubset(_safe_selected):
+     _safe_selected.update(_safe_requirement.extras)
+     _safe_changed = True
+  if not _safe_changed:
+   break
+ _safe_pending = set()
+ for _safe_requirement in _safe_dependencies:
+  _safe_version = _safe_versions.get(_safe_name(_safe_requirement.name))
+  if _safe_version is None:
+   _safe_pending.add(str(_safe_requirement))
+  elif not _safe_requirement.specifier.contains(_safe_version, prereleases=True):
+   raise ValueError('Python package dependency conflict: ' + str(_safe_requirement))
+ if not _safe_pending:
+  break
+ if _safe_pending == _safe_previous_pending:
+  raise ValueError('Python package dependencies remain missing: ' + ', '.join(sorted(_safe_pending)))
+ _safe_previous_pending = _safe_pending
+ await _safe_manager.install(sorted(_safe_pending), deps=True)
+# Explicit roots also constrain the result: direct URLs can bypass micropip's
+# already-installed version check, including when another root pins that name.
+for _safe_root in _safe_roots:
+ if _safe_root.marker and not _safe_root.marker.evaluate({'extra': ''}):
+  continue
+ _safe_version = _safe_versions.get(_safe_name(_safe_root.name))
+ if _safe_version is None or not _safe_root.specifier.contains(_safe_version, prereleases=True):
+  raise ValueError('Python package version conflict: ' + str(_safe_root))
+ if _safe_root.url:
+  _safe_wheel = _SafeWheelInfo.from_url(_safe_root.url)
+  _safe_wheel_pin = _SafeRequirement(_safe_wheel.name + '==' + str(_safe_wheel.version))
+  if _safe_name(_safe_wheel.name) != _safe_name(_safe_root.name) or not _safe_wheel_pin.specifier.contains(_safe_version, prereleases=True):
+   raise ValueError('Python package wheel version conflict: ' + str(_safe_root))
+_safe_installed_json = _safe_json.dumps([name + '==' + version for name, version in sorted(_safe_versions.items())])
+`);
+    const pinned = JSON.parse(runtime.runPython("_safe_installed_json"));
+    request("package-commit", start.session, pinned);
+  } finally {
+    runtime._api.packageManager.downloadPackage = async () => {
+      throw new Error("Python package transport is only available during installation");
+    };
+    for (const name of installedGlobals) runtime.globals.delete(name);
+  }
+}
+
+// packages/safe-bash/src/commands/python/worker.ts
+function createPythonWorkerRequest(shared, postMessage, error) {
+  const control = new Int32Array(shared, 0, 2);
+  const payload = new Uint8Array(shared, 8);
+  return (op, ...args) => {
+    Atomics.store(control, 0, 0);
+    postMessage({ op, args });
+    while (Atomics.load(control, 0) === 0) Atomics.wait(control, 0, 0);
+    const length = Atomics.load(control, 1);
+    if (length < 0 || length > payload.length) throw error("EIO");
+    const result = JSON.parse(new TextDecoder().decode(payload.slice(0, length)));
+    if (Atomics.load(control, 0) !== 1) {
+      if (op.startsWith("package-") && typeof result.message === "string") throw new Error(result.message);
+      throw error(result.code ?? "EIO");
+    }
+    return result;
+  };
+}
+var relocateRuntime = `
+import sys, zipimport, importlib.machinery
+
+def _rebase_runtime_path(value):
+ return _safe_runtime_mount + value if isinstance(value, str) and (value == '/lib' or value.startswith('/lib/')) else value
+
+def _rebase_runtime_loader(loader):
+ if isinstance(loader, zipimport.zipimporter):
+  archive = _rebase_runtime_path(loader.archive)
+  if archive != loader.archive:
+   return zipimport.zipimporter(archive + '/' + loader.prefix)
+ elif isinstance(loader, (importlib.machinery.SourceFileLoader, importlib.machinery.SourcelessFileLoader, importlib.machinery.ExtensionFileLoader)):
+  path = _rebase_runtime_path(loader.path)
+  if path != loader.path:
+   return type(loader)(loader.name, path)
+ return loader
+sys.path[:] = [_rebase_runtime_path(value) for value in sys.path]
+for _module in list(sys.modules.values()):
+ if _module is None:
+  continue
+ for _attribute in ('__file__', '__cached__'):
+  if hasattr(_module, _attribute):
+   setattr(_module, _attribute, _rebase_runtime_path(getattr(_module, _attribute)))
+ if hasattr(_module, '__path__'):
+  _module.__path__ = [_rebase_runtime_path(value) for value in _module.__path__]
+ if hasattr(_module, '__loader__'):
+  _module.__loader__ = _rebase_runtime_loader(_module.__loader__)
+ _spec = getattr(_module, '__spec__', None)
+ if _spec is not None:
+  _spec.origin = _rebase_runtime_path(_spec.origin)
+  _spec.loader = _rebase_runtime_loader(_spec.loader)
+  if _spec.submodule_search_locations is not None:
+   _spec.submodule_search_locations = [_rebase_runtime_path(value) for value in _spec.submodule_search_locations]
+sys.path_importer_cache.clear()
+`;
+async function loadPythonRuntime(load) {
+  const wasm = globalThis.WebAssembly;
+  const instantiate = wasm.instantiate;
+  const instantiateStreaming = wasm.instantiateStreaming;
+  let protectedSystem = false;
+  let protectedSockets = false;
+  const restrict = (imports) => {
+    const env = imports?.env;
+    if (!env) return;
+    if (typeof env._emscripten_system === "function") {
+      env._emscripten_system = (command) => command === 0 ? 0 : -52;
+      protectedSystem = true;
+    }
+    if (typeof env.__syscall_socket === "function") protectedSockets = true;
+    for (const name of ["__syscall_socket", "__syscall_connect", "__syscall_bind", "__syscall_listen", "__syscall_accept4", "__syscall_sendto", "__syscall_sendmsg", "_maybe_connect_async"]) {
+      if (typeof env[name] === "function") env[name] = () => -52;
+    }
+  };
+  wasm.instantiate = ((source, imports) => {
+    restrict(imports);
+    return instantiate(source, imports);
+  });
+  if (instantiateStreaming) wasm.instantiateStreaming = (source, imports) => {
+    restrict(imports);
+    return instantiateStreaming(source, imports);
+  };
+  try {
+    const runtime = await load();
+    if (!protectedSystem || !protectedSockets) throw new Error("Python native syscall isolation ABI unavailable");
+    const unavailable = () => {
+      throw new Error("Host filesystem and native socket capabilities are unavailable");
+    };
+    const api = runtime;
+    for (const name of ["mountNodeFS", "mountNativeFS", "useNodeSockFS"]) {
+      if (name in api) api[name] = unavailable;
+    }
+    if (runtime.FS?.filesystems) delete runtime.FS.filesystems.NODEFS;
+    if (runtime._module) {
+      delete runtime._module.NODEFS;
+      if ("__emscripten_system" in runtime._module) runtime._module.__emscripten_system = (command) => command === 0 ? 0 : -52;
+      if (runtime._module.SOCKFS) runtime._module.SOCKFS.createSocket = unavailable;
+    }
+    return runtime;
+  } finally {
+    wasm.instantiate = instantiate;
+    if (instantiateStreaming) wasm.instantiateStreaming = instantiateStreaming;
+  }
+}
+async function runPythonWorker(options) {
+  const { start, postMessage } = options;
+  try {
+    const startupRequest = createPythonWorkerRequest(start.shared, postMessage, (code) => new Error(code));
+    const startupWrite = (stream, message) => {
+      const bytes = new TextEncoder().encode(message + "\n");
+      for (let offset = 0; offset < bytes.length; offset += start.maxTransferBytes) {
+        startupRequest(stream, Array.from(bytes.subarray(offset, offset + start.maxTransferBytes)));
+      }
+    };
+    let configuration;
+    try {
+      configuration = parsePythonInvocation(start.invocation.args, start.invocation.env);
+    } catch (error) {
+      startupWrite("stderr", "python: " + (error instanceof Error ? error.message : String(error)));
+      postMessage({ type: "exit", exitCode: 2 });
+      return;
+    }
+    const runtime = await loadPythonRuntime(() => options.loadRuntime({
+      jsglobals: /* @__PURE__ */ Object.create(null),
+      args: [...configuration.startupArgs],
+      env: { ...configuration.env },
+      stdout: (message) => {
+        startupWrite("stdout", message);
+      },
+      stderr: (message) => {
+        startupWrite("stderr", message);
+      }
+    }));
+    if (runtime.version !== "314.0.6") throw new Error("Python worker requires Pyodide 314.0.6");
+    if (start.packages) await installPythonPackages(runtime, start.packages, startupRequest, start.maxTransferBytes);
+    const unavailablePackage = () => {
+      throw new Error("Python package transport is only available during installation");
+    };
+    const publicRuntime = runtime;
+    if ("loadPackage" in publicRuntime) publicRuntime.loadPackage = unavailablePackage;
+    if (publicRuntime._api?.packageManager) publicRuntime._api.packageManager.downloadPackage = unavailablePackage;
+    if (start.installOnly) {
+      startupWrite("stdout", "Successfully installed requested Python packages");
+      postMessage({ type: "exit", exitCode: 0 });
+      return;
+    }
+    const errno = JSON.parse(runtime.runPython("__import__('json').dumps({k:v for k,v in vars(__import__('errno')).items() if k.startswith('E') and isinstance(v,int)})"));
+    const request = createPythonWorkerRequest(start.shared, postMessage, (code) => new runtime.FS.ErrnoError(errno[code] ?? errno.EIO));
+    const libraries = runtime._module?.LDSO?.loadedLibsByName;
+    if (!libraries) throw new Error("Python runtime native loader ABI unavailable");
+    if (typeof runtime._module._Py_FinalizeEx !== "function") throw new Error("Python runtime finalization ABI unavailable");
+    runtime.runPython("import sys, zipimport, importlib.machinery, json, os, runpy, traceback");
+    runtime.setStdin({ read(buffer) {
+      const bytes = request("stdin", Math.min(buffer.length, start.maxTransferBytes));
+      if (!Array.isArray(bytes) || bytes.length > buffer.length) throw new runtime.FS.ErrnoError(errno.EIO);
+      buffer.set(bytes);
+      return bytes.length;
+    } });
+    for (const [name, configure] of [
+      ["stdout", runtime.setStdout.bind(runtime)],
+      ["stderr", runtime.setStderr.bind(runtime)]
+    ]) {
+      configure({ write(buffer) {
+        let offset = 0;
+        while (offset < buffer.length) {
+          const chunk = Array.from(Uint8Array.from(buffer.subarray(offset, offset + start.maxTransferBytes)));
+          try {
+            request(name, chunk);
+          } catch (error) {
+            if (offset) return offset;
+            throw error;
+          }
+          offset += chunk.length;
+        }
+        return offset;
+      } });
+    }
+    mountPythonFileSystem(runtime.FS, {
+      request,
+      cwd: start.invocation.cwd,
+      runtimeMount: start.runtimeMount,
+      maxTransferBytes: start.maxTransferBytes,
+      errno,
+      runtimeModule: runtime._module,
+      synchronizationFlags: runtime.runPython("__import__('os').O_SYNC | __import__('os').O_DSYNC")
+    });
+    for (const [name, library] of Object.entries(libraries)) {
+      if (name.startsWith("/lib/")) libraries[start.runtimeMount + name] = library;
+    }
+    runtime.globals.set("_safe_runtime_mount", start.runtimeMount);
+    runtime.runPython(relocateRuntime);
+    runtime.globals.set("_safe_import_stat", (path) => {
+      try {
+        const stat = runtime.FS.stat(path);
+        return JSON.stringify({ mode: stat.mode, size: stat.size, mtimeMs: stat.mtimeMs ?? stat.mtime.getTime() });
+      } catch (error) {
+        return JSON.stringify({ errno: error.errno ?? errno.EIO });
+      }
+    });
+    runtime.runPython(`
+import importlib._bootstrap_external, types, json
+_safe_import_stat_callback = _safe_import_stat
+_safe_original_import_stat = importlib._bootstrap_external._path_stat
+def _safe_import_path_stat(path):
+ if path == _safe_runtime_mount or path.startswith(_safe_runtime_mount + '/'):
+  return _safe_original_import_stat(path)
+ value = json.loads(_safe_import_stat_callback(path))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'filesystem import metadata unavailable', path)
+ return types.SimpleNamespace(st_mode=value['mode'], st_size=value['size'], st_mtime=value['mtimeMs'] / 1000)
+importlib._bootstrap_external._path_stat = _safe_import_path_stat
+`);
+    runtime.globals.set("_safe_directory_entries", (path) => {
+      try {
+        return JSON.stringify({ entries: runtime.FS.readdir(path).filter((name) => name !== "." && name !== "..") });
+      } catch (error) {
+        return JSON.stringify({ errno: error.errno ?? errno.EIO });
+      }
+    });
+    runtime.runPython(`
+import os, json, errno
+_safe_directory_callback = _safe_directory_entries
+def _safe_listdir(path='.'):
+ if isinstance(path, int):
+  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')
+ original = os.fspath(path) if path is not None else '.'
+ value = json.loads(_safe_directory_callback(os.fsdecode(original)))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'directory enumeration failed', path)
+ return [os.fsencode(name) for name in value['entries']] if isinstance(original, bytes) else value['entries']
+os.listdir = _safe_listdir
+# The frozen importer holds the posix module separately from os.
+importlib._bootstrap_external._os.listdir = _safe_listdir
+`);
+    runtime.globals.set("_safe_stat_projection", (path, follow) => {
+      try {
+        const value = typeof path === "number" ? runtime.FS.fstat(path) : follow ? runtime.FS.stat(path) : runtime.FS.lstat(path);
+        return JSON.stringify({
+          mode: value.mode,
+          ino: value.ino,
+          dev: value.dev,
+          nlink: value.nlink,
+          uid: value.uid,
+          gid: value.gid,
+          size: value.size,
+          atimeMs: value.atimeMs ?? value.atime.getTime(),
+          mtimeMs: value.mtimeMs ?? value.mtime.getTime(),
+          ctimeMs: value.ctimeMs ?? value.ctime.getTime(),
+          blocks: value.blocks,
+          blksize: value.blksize,
+          rdev: value.rdev
+        });
+      } catch (error) {
+        return JSON.stringify({ errno: error.errno ?? errno.EIO });
+      }
+    });
+    runtime.runPython(`
+import os, json, errno
+_safe_stat_callback = _safe_stat_projection
+_safe_stat_type = os.stat_result
+_safe_fspath = os.fspath
+_safe_fsdecode = os.fsdecode
+
+def _safe_stat(path, *, dir_fd=None, follow_symlinks=True):
+ if dir_fd is not None:
+  raise OSError(errno.ENOTSUP, 'dir_fd metadata is unsupported')
+ if isinstance(path, int):
+  if not follow_symlinks:
+   raise ValueError('stat: cannot use fd and follow_symlinks together')
+ else:
+  path = _safe_fsdecode(_safe_fspath(path))
+ value = json.loads(_safe_stat_callback(path, follow_symlinks))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'filesystem metadata unavailable', path)
+ keys = ('mode','ino','dev','nlink','uid','gid','size')
+ if any(key not in value for key in keys):
+  raise OSError(errno.EOVERFLOW, 'canonical identity or required stat metadata unavailable', path)
+ times = [value[key] / 1000 for key in ('atimeMs','mtimeMs','ctimeMs')]
+ extras = dict(zip(('st_atime','st_mtime','st_ctime'), times))
+ for name, milliseconds in zip(('atime','mtime','ctime'), (value['atimeMs'],value['mtimeMs'],value['ctimeMs'])):
+  seconds = int(milliseconds // 1000)
+  extras['st_' + name + '_ns'] = seconds * 1000000000 + round((milliseconds - seconds * 1000) * 1000000)
+ for key in ('blocks','blksize','rdev'):
+  if key in value:
+   extras['st_' + key] = value[key]
+ return _safe_stat_type(tuple(value[key] for key in keys) + tuple(int(time // 1) for time in times), extras)
+
+def _safe_lstat(path, *, dir_fd=None):
+ return _safe_stat(path, dir_fd=dir_fd, follow_symlinks=False)
+
+def _safe_fstat(fd):
+ if not isinstance(fd, int):
+  raise TypeError('file descriptor must be an integer')
+ return _safe_stat(fd)
+os.stat = _safe_stat
+os.lstat = _safe_lstat
+os.fstat = _safe_fstat
+import stat as _safe_stat_module
+class _SafeDirEntry:
+ def __init__(self, root, name):
+  self.name = name
+  self.path = os.path.join(root, name)
+  self._cache = {}
+ def __fspath__(self):
+  return self.path
+ def stat(self, *, follow_symlinks=True):
+  if follow_symlinks not in self._cache:
+   self._cache[follow_symlinks] = os.stat(self.path, follow_symlinks=follow_symlinks)
+  return self._cache[follow_symlinks]
+ def inode(self):
+  return self.stat(follow_symlinks=False).st_ino
+ def is_dir(self, *, follow_symlinks=True):
+  try:
+   return _safe_stat_module.S_ISDIR(self.stat(follow_symlinks=follow_symlinks).st_mode)
+  except FileNotFoundError:
+   return False
+ def is_file(self, *, follow_symlinks=True):
+  try:
+   return _safe_stat_module.S_ISREG(self.stat(follow_symlinks=follow_symlinks).st_mode)
+  except FileNotFoundError:
+   return False
+ def is_symlink(self):
+  try:
+   return _safe_stat_module.S_ISLNK(self.stat(follow_symlinks=False).st_mode)
+  except FileNotFoundError:
+   return False
+class _SafeScandir:
+ def __init__(self, path):
+  self._entries = iter([_SafeDirEntry(path, name) for name in os.listdir(path)])
+ def __iter__(self):
+  return self
+ def __next__(self):
+  return next(self._entries)
+ def close(self):
+  self._entries = iter(())
+ def __enter__(self):
+  return self
+ def __exit__(self, *args):
+  self.close()
+def _safe_scandir(path='.'):
+ if isinstance(path, int):
+  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')
+ return _SafeScandir(os.fspath(path) if path is not None else '.')
+os.scandir = _safe_scandir
+
+`);
+    runtime.globals.set("_safe_invocation_json", JSON.stringify(start.invocation));
+    postMessage({ type: "ready" });
+    const exitCode = runtime.runPython(pythonExecution);
+    const finalized = runtime._module._Py_FinalizeEx();
+    postMessage({ type: "exit", exitCode: finalized < 0 ? 120 : Number(exitCode) & 255 });
+  } catch (error) {
+    postMessage({ type: "error", message: String(error) });
+  }
+}
+export {
+  createPythonWorkerRequest,
+  runPythonWorker
+};
+//# sourceMappingURL=worker.browser.js.map