@poe-platform/safe-bash 0.1.630 → 0.1.632

package/dist/safe-bash/chunks/chunk-GPV7ZFYS.js

@@ -0,0 +1,1528 @@
+import {
+  openCommandFile
+} from "./chunk-2E4KBFO6.js";
+import {
+  PythonInvocationError,
+  parsePythonInvocation
+} from "./chunk-JZDO5MC3.js";
+import {
+  createOutputOperation
+} from "./chunk-CDBQXRWL.js";
+import {
+  inheritYieldCheckpoint,
+  yieldTurn
+} from "./chunk-THXJ6CLF.js";
+import {
+  validateExitCode
+} from "./chunk-CHHAB5SS.js";
+import {
+  dirname,
+  resolvePath
+} from "./chunk-JLBIUYT3.js";
+import {
+  FsError,
+  readBytes,
+  writeBytes
+} from "./chunk-WPIOO4NX.js";
+import {
+  init_platform
+} from "./chunk-O2EVBRKF.js";
+
+// packages/safe-bash/src/commands/python/index.ts
+init_platform();
+import { PythonFileSystem, PythonStatTranslator } from "@poe-platform/safe-fs/core";
+
+// packages/safe-bash/src/commands/python/reply.ts
+init_platform();
+function encodePythonReply(value, maxBytes) {
+  let used = 0;
+  const ancestors = /* @__PURE__ */ new Set();
+  const reserve = (bytes) => {
+    used += bytes;
+    if (used > maxBytes) throw new FsError("EFBIG", { syscall: "python reply" });
+  };
+  const string = (text) => {
+    if (text.length + 2 > maxBytes - used) throw new FsError("EFBIG", { syscall: "python reply" });
+    reserve(2);
+    for (let index = 0; index < text.length; index++) {
+      const code = text.charCodeAt(index);
+      if (code < 32) reserve([8, 9, 10, 12, 13].includes(code) ? 2 : 6);
+      else if (code === 34 || code === 92) reserve(2);
+      else if (code < 128) reserve(1);
+      else if (code < 2048) reserve(2);
+      else if (code >= 55296 && code <= 56319 && text.charCodeAt(index + 1) >= 56320 && text.charCodeAt(index + 1) <= 57343) {
+        reserve(4);
+        index++;
+      } else reserve(code >= 55296 && code <= 57343 ? 6 : 3);
+    }
+    return text;
+  };
+  const own = (input, depth) => {
+    if (depth > 64) throw new FsError("EFBIG", { syscall: "python reply" });
+    if (input === null || input === void 0) {
+      reserve(4);
+      return null;
+    }
+    if (typeof input === "string") return string(input);
+    if (typeof input === "number") {
+      reserve(Number.isFinite(input) ? String(input).length : 4);
+      return input;
+    }
+    if (typeof input === "boolean") {
+      reserve(input ? 4 : 5);
+      return input;
+    }
+    if (typeof input !== "object") throw new TypeError("Invalid Python reply value");
+    if (ancestors.has(input)) throw new TypeError("Cyclic Python reply value");
+    ancestors.add(input);
+    try {
+      if (input instanceof Uint8Array || Array.isArray(input)) {
+        if (input.length > maxBytes - used) throw new FsError("EFBIG", { syscall: "python reply" });
+        reserve(2);
+        const output2 = [];
+        for (let index = 0; index < input.length; index++) {
+          if (index) reserve(1);
+          const descriptor = Object.getOwnPropertyDescriptor(input, String(index));
+          if (descriptor && !("value" in descriptor)) throw new TypeError("Accessor Python reply");
+          output2.push(own(descriptor?.value, depth + 1));
+        }
+        return output2;
+      }
+      reserve(2);
+      const output = /* @__PURE__ */ Object.create(null);
+      let count = 0;
+      let visited = 0;
+      for (const key in input) {
+        if (!Object.hasOwn(input, key)) continue;
+        if (++visited > maxBytes) throw new FsError("EFBIG", { syscall: "python reply" });
+        const descriptor = Object.getOwnPropertyDescriptor(input, key);
+        if (!("value" in descriptor)) throw new TypeError("Accessor Python reply");
+        if (descriptor.value === void 0 || typeof descriptor.value === "function") continue;
+        if (count++) reserve(1);
+        string(key);
+        reserve(1);
+        output[key] = own(descriptor.value, depth + 1);
+      }
+      return output;
+    } finally {
+      ancestors.delete(input);
+    }
+  };
+  const owned = own(value, 0);
+  return new TextEncoder().encode(JSON.stringify(owned));
+}
+
+// packages/safe-bash/src/commands/python/installation.ts
+init_platform();
+var pythonInstallationHelp = `Usage: python -m pip install [-r FILE | --requirement FILE] PACKAGE ...
+Installs compatible wheels and dependencies using the configured Pyodide installer.
+PACKAGE is a package requirement or a canonical filesystem wheel path.
+Supported options: -r, --requirement, -h, --help, --.
+All other pip options and commands are unsupported, including --upgrade,
+--force-reinstall, --no-index, --no-deps, --target, --user, --prefix, --root, --editable,
+--index-url, --extra-index-url, --find-links, --trusted-host, --require-hashes,
+--constraint, --dry-run, --quiet, --verbose and cache/build/configuration flags.
+Configure transport and integrity through the Python package SDK configuration.
+`;
+function parsePythonInstallation(args) {
+  let pipArgs;
+  scan: for (let index = 0; index < args.length; index++) {
+    const option = args[index];
+    if (option === "--" || option === "-" || !option.startsWith("-") || option.startsWith("--")) return void 0;
+    for (let offset = 1; offset < option.length; offset++) {
+      const flag = option[offset];
+      if ("h?V".includes(flag)) return void 0;
+      if ("cmWX".includes(flag)) {
+        const operand = option.slice(offset + 1) || args[++index];
+        if (flag === "c") return void 0;
+        if (flag === "m") {
+          if (operand !== "pip") return void 0;
+          pipArgs = args.slice(index + 1);
+          break scan;
+        }
+        break;
+      }
+    }
+  }
+  if (!pipArgs) return void 0;
+  const packages = [];
+  const requirements = [];
+  if (pipArgs.length === 0) return { packages, requirements, help: true };
+  if (pipArgs[0] === "--help" || pipArgs[0] === "-h") {
+    if (pipArgs.length > 1) throw new PythonInvocationError("unsupported pip option or argument after help: " + pipArgs[1]);
+    return { packages, requirements, help: true };
+  }
+  if (pipArgs[0] !== "install") throw new PythonInvocationError("unsupported pip command " + pipArgs[0]);
+  let operands = false;
+  let help = false;
+  for (let index = 1; index < pipArgs.length; index++) {
+    const option = pipArgs[index];
+    if (operands || !option.startsWith("-")) {
+      packages.push(option);
+      continue;
+    }
+    if (option === "--") {
+      operands = true;
+      continue;
+    }
+    if (option === "--help" || option === "-h") {
+      help = true;
+      continue;
+    }
+    if (option === "-r" || option === "--requirement" || option.startsWith("--requirement=") || option.startsWith("-r")) {
+      const path = option.startsWith("--requirement=") ? option.slice("--requirement=".length) : option !== "-r" && option.startsWith("-r") ? option.slice(2) : pipArgs[++index];
+      if (!path || path.startsWith("-")) throw new PythonInvocationError(option + " requires a path");
+      requirements.push(path);
+      continue;
+    }
+    throw new PythonInvocationError("unsupported pip option " + option);
+  }
+  if (!help && packages.length === 0 && requirements.length === 0) throw new PythonInvocationError("pip install requires at least one package or requirements file");
+  return { packages, requirements, help };
+}
+
+// packages/safe-bash/src/commands/python/provisioning.ts
+init_platform();
+
+// node_modules/@noble/hashes/sha2.js
+init_platform();
+
+// node_modules/@noble/hashes/_md.js
+init_platform();
+
+// node_modules/@noble/hashes/_u64.js
+init_platform();
+var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+// node_modules/@noble/hashes/utils.js
+init_platform();
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+var atitle = (title) => title ? `"${title}" ` : "";
+function anumber(n, title = "") {
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
+function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
+  const bytes = isBytes(value);
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("hash was destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("digest() was already called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "output");
+  const min = instance.outputLen;
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+function rotl(word, shift) {
+  return word << shift | word >>> 32 - shift >>> 0;
+}
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+function checkOpts(defaults, opts, title = "opts") {
+  aopts(defaults, "defaults");
+  if (opts !== void 0)
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
+  return merged;
+}
+function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    let processed = false;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        processed = true;
+        continue;
+      }
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+        processed = true;
+      }
+    }
+    this.length += data.length;
+    if (processed)
+      this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    buffer.fill(0, pos);
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      buffer.fill(0);
+    }
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
+    this.process(view, 0);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
+    const len = this.outputLen;
+    const outLen = len / 4;
+    const state = this.get();
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (pos)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+var SHA224_IV = /* @__PURE__ */ Uint32Array.from([
+  3238371032,
+  914150663,
+  812702999,
+  4144912697,
+  4290775857,
+  1750603025,
+  1694076839,
+  3204075428
+]);
+var SHA384_IV = /* @__PURE__ */ Uint32Array.from([
+  3418070365,
+  3238371032,
+  1654270250,
+  914150663,
+  2438529370,
+  812702999,
+  355462360,
+  4144912697,
+  1731405415,
+  4290775857,
+  2394180231,
+  1750603025,
+  3675008525,
+  1694076839,
+  1203062813,
+  3204075428
+]);
+var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]);
+
+// node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and makes sha256 3x slower (measured).
+  A = 0;
+  B = 0;
+  C = 0;
+  D = 0;
+  E = 0;
+  F = 0;
+  G = 0;
+  H = 0;
+  constructor(outputLen, IV) {
+    super(64, outputLen, 8, false);
+    this.A = IV[0] | 0;
+    this.B = IV[1] | 0;
+    this.C = IV[2] | 0;
+    this.D = IV[3] | 0;
+    this.E = IV[4] | 0;
+    this.F = IV[5] | 0;
+    this.G = IV[6] | 0;
+    this.H = IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  constructor() {
+    super(32, SHA256_IV);
+  }
+};
+var _SHA224 = class extends SHA2_32B {
+  constructor() {
+    super(28, SHA224_IV);
+  }
+};
+var K512 = /* @__PURE__ */ (() => split([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+var SHA2_64B = class extends HashMD {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // h -- high 32 bits, l -- low 32 bits
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and slows hashing down (measured on sha256).
+  Ah = 0;
+  Al = 0;
+  Bh = 0;
+  Bl = 0;
+  Ch = 0;
+  Cl = 0;
+  Dh = 0;
+  Dl = 0;
+  Eh = 0;
+  El = 0;
+  Fh = 0;
+  Fl = 0;
+  Gh = 0;
+  Gl = 0;
+  Hh = 0;
+  Hl = 0;
+  constructor(outputLen, IV) {
+    super(128, outputLen, 16, false);
+    this.Ah = IV[0] | 0;
+    this.Al = IV[1] | 0;
+    this.Bh = IV[2] | 0;
+    this.Bl = IV[3] | 0;
+    this.Ch = IV[4] | 0;
+    this.Cl = IV[5] | 0;
+    this.Dh = IV[6] | 0;
+    this.Dl = IV[7] | 0;
+    this.Eh = IV[8] | 0;
+    this.El = IV[9] | 0;
+    this.Fh = IV[10] | 0;
+    this.Fl = IV[11] | 0;
+    this.Gh = IV[12] | 0;
+    this.Gl = IV[13] | 0;
+    this.Hh = IV[14] | 0;
+    this.Hl = IV[15] | 0;
+  }
+  // prettier-ignore
+  get() {
+    const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
+  }
+  // prettier-ignore
+  set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+    this.Ah = Ah | 0;
+    this.Al = Al | 0;
+    this.Bh = Bh | 0;
+    this.Bl = Bl | 0;
+    this.Ch = Ch | 0;
+    this.Cl = Cl | 0;
+    this.Dh = Dh | 0;
+    this.Dl = Dl | 0;
+    this.Eh = Eh | 0;
+    this.El = El | 0;
+    this.Fh = Fh | 0;
+    this.Fl = Fl | 0;
+    this.Gh = Gh | 0;
+    this.Gl = Gl | 0;
+    this.Hh = Hh | 0;
+    this.Hl = Hl | 0;
+  }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4) {
+      SHA512_W_H[i] = view.getUint32(offset);
+      SHA512_W_L[i] = view.getUint32(offset += 4);
+    }
+    for (let i = 16; i < 80; i++) {
+      const W15h = SHA512_W_H[i - 15] | 0;
+      const W15l = SHA512_W_L[i - 15] | 0;
+      const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+      const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+      const W2h = SHA512_W_H[i - 2] | 0;
+      const W2l = SHA512_W_L[i - 2] | 0;
+      const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+      const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+      const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
+      SHA512_W_H[i] = SUMh | 0;
+      SHA512_W_L[i] = SUMl | 0;
+    }
+    let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    for (let i = 0; i < 80; i++) {
+      const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+      const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+      const CHIh = Eh & Fh ^ ~Eh & Gh;
+      const CHIl = El & Fl ^ ~El & Gl;
+      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+      const T1l = T1ll | 0;
+      const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+      const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+      const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+      const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+      Hh = Gh | 0;
+      Hl = Gl | 0;
+      Gh = Fh | 0;
+      Gl = Fl | 0;
+      Fh = Eh | 0;
+      Fl = El | 0;
+      ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+      Dh = Ch | 0;
+      Dl = Cl | 0;
+      Ch = Bh | 0;
+      Cl = Bl | 0;
+      Bh = Ah | 0;
+      Bl = Al | 0;
+      const All = add3L(T1l, sigma0l, MAJl);
+      Ah = add3H(All, T1h, sigma0h, MAJh);
+      Al = All | 0;
+    }
+    ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+    ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+    ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+    ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+    ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+    ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+    ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+    ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+    this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+  }
+  roundClean() {
+    clean(SHA512_W_H, SHA512_W_L);
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+};
+var _SHA512 = class extends SHA2_64B {
+  constructor() {
+    super(64, SHA512_IV);
+  }
+};
+var _SHA384 = class extends SHA2_64B {
+  constructor() {
+    super(48, SHA384_IV);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+var sha224 = /* @__PURE__ */ createHasher(
+  () => new _SHA224(),
+  /* @__PURE__ */ oidNist(4)
+);
+var sha512 = /* @__PURE__ */ createHasher(
+  () => new _SHA512(),
+  /* @__PURE__ */ oidNist(3)
+);
+var sha384 = /* @__PURE__ */ createHasher(
+  () => new _SHA384(),
+  /* @__PURE__ */ oidNist(2)
+);
+
+// packages/safe-bash/src/commands/python/provisioning.ts
+var pythonDocumentPackages = Object.freeze([
+  "lxml==6.0.2",
+  "pillow==12.2.0",
+  "python-docx==1.2.0",
+  "openpyxl==3.1.5",
+  "XlsxWriter==3.2.9",
+  "pypdf==6.18.1",
+  "fpdf2==2.8.8",
+  "fonttools==4.65.0",
+  "defusedxml==0.7.1",
+  "et-xmlfile==2.0.0",
+  "typing-extensions==4.16.0"
+]);
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var runtimeKey = "pyodide-314.0.6-cp314-emscripten-wasm32-v1";
+function digest(value) {
+  return Array.from(sha256(value), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function failure(message) {
+  return Object.assign(new Error(message), { code: "EPACKAGE" });
+}
+function missing(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function normalizeRequirement(value, cwd) {
+  const requirement = value.trim();
+  if (!requirement || requirement.startsWith("-")) throw failure(`Unsupported requirement: ${value}`);
+  if (requirement.endsWith(".whl") && !requirement.includes("://")) return "file://" + resolvePath(cwd, requirement).split("/").map(encodeURIComponent).join("/");
+  return requirement;
+}
+function checkSession(session) {
+  session.signal.throwIfAborted();
+  if (session.closed) throw failure("Python package session is closed");
+}
+function createPythonPackageEnvironment(options = {}) {
+  if (options.cache && options.cacheDirectory) throw new TypeError("Choose package cache or cacheDirectory, not both");
+  if (options.profile !== void 0 && options.profile !== "documents") throw new TypeError("Unknown Python package profile");
+  const maxBytes = options.maxDownloadBytes ?? 64 * 1024 * 1024;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) throw new RangeError("maxDownloadBytes must be a positive integer");
+  const maxCacheBytes = options.maxCacheBytes ?? 128 * 1024 * 1024;
+  if (!Number.isSafeInteger(maxCacheBytes) || maxCacheBytes < 1) throw new RangeError("maxCacheBytes must be a positive integer");
+  const memory = /* @__PURE__ */ new Map();
+  let memoryBytes = 0;
+  const defaultCache = {
+    async get(key) {
+      return memory.get(key)?.slice();
+    },
+    async set(key, value) {
+      const manifestKey = runtimeKey + "-environment";
+      if (key === manifestKey && value.length > maxCacheBytes) throw failure("Python package manifest exceeds maxCacheBytes");
+      const previous = memory.get(key);
+      if (previous) {
+        memoryBytes -= previous.length;
+        memory.delete(key);
+      }
+      if (value.length > maxCacheBytes) return;
+      while (memory.size && (memoryBytes + value.length > maxCacheBytes || memory.size >= 1024)) {
+        const oldest = Array.from(memory.keys()).find((entry) => entry !== manifestKey);
+        if (oldest === void 0) return;
+        memoryBytes -= memory.get(oldest).length;
+        memory.delete(oldest);
+      }
+      memory.set(key, value.slice());
+      memoryBytes += value.length;
+    }
+  };
+  const sessions = /* @__PURE__ */ new Map();
+  let counter = 0;
+  let committing = Promise.resolve();
+  async function prepare(context) {
+    context.signal.throwIfAborted();
+    const directory = options.cacheDirectory === void 0 ? void 0 : resolvePath(context.cwd, options.cacheDirectory, runtimeKey);
+    const cache = options.cache ?? (directory === void 0 ? defaultCache : {
+      async get(key) {
+        try {
+          return await context.fs.readFile(resolvePath(directory, key), { signal: context.signal, maxBytes });
+        } catch (error) {
+          if (missing(error)) return void 0;
+          throw error;
+        }
+      },
+      async set(key, bytes) {
+        await context.fs.mkdir(directory, { recursive: true, signal: context.signal });
+        await context.fs.writeFile(resolvePath(directory, key), bytes, { signal: context.signal });
+      }
+    });
+    const stored = await cache.get(runtimeKey + "-environment");
+    context.signal.throwIfAborted();
+    if (stored && stored.length > maxBytes) throw failure("Python package manifest exceeds maxDownloadBytes");
+    const manifest = stored === void 0 ? "" : decoder.decode(stored);
+    let previous;
+    try {
+      previous = stored === void 0 ? [] : JSON.parse(manifest);
+    } catch {
+      throw failure("Invalid Python package environment manifest");
+    }
+    if (!Array.isArray(previous) || previous.some((value) => typeof value !== "string")) throw failure("Invalid Python package environment manifest");
+    const requirements = [...previous, ...options.profile === "documents" ? pythonDocumentPackages : [], ...options.requirements ?? [], ...context.requirements ?? []].map((value) => normalizeRequirement(value, context.cwd));
+    for (const file of [...options.requirementFiles ?? [], ...context.requirementFiles ?? []]) {
+      const path = resolvePath(context.cwd, file);
+      let source;
+      try {
+        source = decoder.decode(await context.fs.readFile(path, { signal: context.signal, maxBytes: 1024 * 1024 }));
+      } catch (error) {
+        context.signal.throwIfAborted();
+        throw failure(`Cannot read Python requirements ${path}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      for (const line of source.split("\n")) {
+        const text = line.trim();
+        if (!text || text.startsWith("#")) continue;
+        if (text.endsWith("\\") || text.startsWith("-")) throw failure(`Unsupported requirements option or continuation in ${path}: ${text}`);
+        const comment = text.indexOf(" #");
+        requirements.push(normalizeRequirement(comment < 0 ? text : text.slice(0, comment), dirname(path)));
+      }
+    }
+    context.signal.throwIfAborted();
+    const session = String(++counter);
+    const unique = [...new Set(requirements)];
+    const aborted = () => {
+      const current = sessions.get(session);
+      if (current) {
+        current.closed = true;
+        current.opened.clear();
+      }
+      sessions.delete(session);
+    };
+    sessions.set(session, { ...context, cache, offline: context.offline ?? options.offline ?? false, requirements: unique, opened: /* @__PURE__ */ new Map(), opening: false, closed: false, manifest, aborted });
+    context.signal.addEventListener("abort", aborted, { once: true });
+    return { session, requirements: unique, offline: context.offline ?? options.offline ?? false };
+  }
+  async function dispatch(op, args, _context) {
+    _context.signal.throwIfAborted();
+    const session = sessions.get(String(args[0]));
+    if (!session) throw failure("Python package session is closed");
+    checkSession(session);
+    if (op === "package-commit") {
+      const pinned = args[1];
+      if (!Array.isArray(pinned) || pinned.some((value) => typeof value !== "string")) throw failure("Invalid installed package manifest");
+      const merged = [.../* @__PURE__ */ new Set([...session.requirements, ...pinned])];
+      const manifestBytes = encoder.encode(JSON.stringify(merged));
+      if (manifestBytes.length > maxBytes) throw failure("Python package manifest exceeds maxDownloadBytes");
+      const commit = committing.then(async () => {
+        checkSession(session);
+        const current = await session.cache.get(runtimeKey + "-environment");
+        checkSession(session);
+        if (current && current.length > maxBytes) throw failure("Python package manifest exceeds maxDownloadBytes");
+        if ((current === void 0 ? "" : decoder.decode(current)) !== session.manifest) throw failure("Python package environment changed during installation; retry the command");
+        await session.cache.set(runtimeKey + "-environment", manifestBytes);
+        checkSession(session);
+      });
+      committing = commit.catch(() => {
+      });
+      await commit;
+      options.onProgress?.({ phase: "installed" });
+      return null;
+    }
+    if (op === "package-read") {
+      const bytes = session.opened.get(String(args[1]));
+      const offset = args[2];
+      const length = args[3];
+      if (!bytes || !Number.isSafeInteger(offset) || !Number.isSafeInteger(length) || offset < 0 || length < 1 || length > 65536) throw failure("Invalid package chunk request");
+      return Array.from(bytes.subarray(offset, offset + length));
+    }
+    if (op === "package-close") {
+      session.opened.delete(String(args[1]));
+      return null;
+    }
+    if (op !== "package-open" || typeof args[1] !== "string") throw failure("Invalid package operation");
+    if (session.opening) throw failure("Package download already in progress");
+    session.opening = true;
+    session.opened.clear();
+    try {
+      const url = args[1];
+      const expected = args[2];
+      if (expected !== void 0 && expected !== null && (typeof expected !== "string" || expected.length !== 64 || Array.from(expected).some((c) => !"0123456789abcdef".includes(c)))) throw failure("Invalid SHA-256 package integrity value");
+      const address = runtimeKey + "-url-" + digest(encoder.encode(url));
+      const metadata = await session.cache.get(address);
+      checkSession(session);
+      let bytes;
+      let headers = [];
+      if (metadata) {
+        if (metadata.length > maxBytes) throw failure("Python package cache metadata exceeds maxDownloadBytes");
+        let record;
+        try {
+          record = JSON.parse(decoder.decode(metadata));
+        } catch {
+          throw failure(`Invalid package cache metadata: ${url}`);
+        }
+        if (typeof record !== "object" || record === null || typeof record.digest !== "string" || record.digest.length !== 64 || Array.from(record.digest).some((char) => !"0123456789abcdef".includes(char)) || !Array.isArray(record.headers) || record.headers.some((pair) => !Array.isArray(pair) || pair.length !== 2 || pair.some((value) => typeof value !== "string"))) throw failure(`Invalid package cache metadata: ${url}`);
+        bytes = await session.cache.get(runtimeKey + "-sha256-" + record.digest);
+        headers = record.headers;
+        checkSession(session);
+        if (bytes && bytes.length > maxBytes) throw failure("Cached package exceeds maxDownloadBytes");
+        if (bytes) bytes = Uint8Array.from(bytes);
+        if (bytes && digest(bytes) !== record.digest) throw failure(`Package cache integrity mismatch: ${url}`);
+        if (bytes) options.onProgress?.({ phase: "cached", url, bytes: bytes.length });
+      }
+      if (!bytes) {
+        if (url.startsWith("file:") || url.startsWith("emfs:")) {
+          const path = new URL(url);
+          if (path.host && path.host !== "localhost") throw failure("Local wheels must use the canonical filesystem");
+          try {
+            bytes = await session.fs.readFile(decodeURIComponent(path.pathname), { signal: session.signal, maxBytes });
+          } catch (error) {
+            checkSession(session);
+            throw failure(`Cannot read canonical Python wheel ${path.pathname}: ${error instanceof Error ? error.message : String(error)}`);
+          }
+        } else {
+          if (session.offline) throw failure(`Offline package cache miss: ${url}`);
+          if (!options.transport || !options.authorize) throw failure("Python package download requires configured transport and authorization");
+          let current = new URL(url);
+          let redirectFrom;
+          for (let redirect = 0; ; redirect++) {
+            if (current.protocol !== "https:" && current.protocol !== "http:") throw failure(`Unsupported package transport protocol: ${current.protocol}`);
+            if (current.username || current.password) throw failure("Package URLs with credentials are unsupported");
+            let denyPrivate = false;
+            const allowed = await options.authorize({ url: current.href, method: "GET", attempt: 0, signal: session.signal, ...redirectFrom === void 0 ? {} : { redirectFrom }, requirePrivateNetworkDeny() {
+              denyPrivate = true;
+            } });
+            checkSession(session);
+            if (!allowed) throw failure(`Python package download authorization denied: ${current.href}`);
+            if (denyPrivate && !options.transport.supportsPrivateNetworkDeny) throw failure("Package transport cannot enforce private network denial");
+            checkSession(session);
+            const response = await options.transport({ url: current.href, method: "GET", headers: [["accept", "application/vnd.pypi.simple.v1+json, application/json;q=0.9, */*;q=0.1"]], signal: session.signal, ...denyPrivate ? { denyPrivateNetworks: true } : {} });
+            try {
+              checkSession(session);
+              if ([301, 302, 303, 307, 308].includes(response.status)) {
+                if (redirect >= 5) throw failure("Too many package redirects");
+                const location = response.headers.find(([key2]) => key2.toLowerCase() === "location")?.[1];
+                if (!location) throw failure("Package redirect has no location");
+                redirectFrom = current.href;
+                current = new URL(location, current);
+                continue;
+              }
+              if (response.status < 200 || response.status >= 300) throw failure(`Package download failed: HTTP ${response.status} ${current.href}`);
+              headers = response.headers;
+              const encoding = headers.find(([key2]) => key2.toLowerCase() === "content-encoding")?.[1].trim().toLowerCase();
+              const length = headers.find(([key2]) => key2.toLowerCase() === "content-length")?.[1];
+              const total = length === void 0 || encoding !== void 0 && encoding !== "identity" ? void 0 : Number(length);
+              if (total !== void 0 && Number.isFinite(total) && total > maxBytes) throw failure("Package download exceeds maxDownloadBytes");
+              const chunks = [];
+              let count = 0;
+              for await (const chunk of response.body) {
+                checkSession(session);
+                if (chunk.length === 0) continue;
+                count += chunk.length;
+                if (count > maxBytes) throw failure("Package download exceeds maxDownloadBytes");
+                chunks.push(Uint8Array.from(chunk));
+                options.onProgress?.({ phase: "download", url, bytes: count, ...typeof total === "number" && Number.isSafeInteger(total) ? { totalBytes: total } : {} });
+              }
+              bytes = new Uint8Array(count);
+              let offset = 0;
+              for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.length;
+              }
+              break;
+            } finally {
+              await response.dispose();
+            }
+          }
+        }
+        checkSession(session);
+        if (expected && digest(bytes) !== expected) throw failure(`Package integrity mismatch: ${url}`);
+        const hash = digest(bytes);
+        const metadataBytes = encoder.encode(JSON.stringify({ digest: hash, headers }));
+        if (metadataBytes.length > maxBytes) throw failure("Python package cache metadata exceeds maxDownloadBytes");
+        await session.cache.set(runtimeKey + "-sha256-" + hash, Uint8Array.from(bytes));
+        checkSession(session);
+        await session.cache.set(address, metadataBytes);
+        checkSession(session);
+      }
+      checkSession(session);
+      if (expected && digest(bytes) !== expected) throw failure(`Package integrity mismatch: ${url}`);
+      const key = digest(bytes);
+      session.opened.set(key, bytes);
+      return { key, size: bytes.length, headers };
+    } finally {
+      session.opening = false;
+    }
+  }
+  return { prepare, dispatch, finish(start) {
+    const session = sessions.get(start.session);
+    if (session) {
+      session.closed = true;
+      session.opened.clear();
+      session.signal.removeEventListener("abort", session.aborted);
+    }
+    sessions.delete(start.session);
+  } };
+}
+
+// packages/safe-bash/src/commands/python/index.ts
+var PythonInputChunkError = class extends RangeError {
+};
+function createPythonCommands(options) {
+  if (typeof options?.createWorker !== "function") throw new TypeError("Python requires an explicit interpreter worker factory");
+  const maxTransferBytes = options.maxTransferBytes ?? 65536;
+  const maxOpenFiles = options.maxOpenFiles ?? 256;
+  const maxConcurrentWorkers = options.maxConcurrentWorkers ?? 4;
+  const maxInputChunkBytes = options.maxInputChunkBytes ?? 1048576;
+  if (!Number.isSafeInteger(maxConcurrentWorkers) || maxConcurrentWorkers < 1 || maxConcurrentWorkers > 64) throw new RangeError("Invalid Python worker concurrency limit");
+  if (!Number.isSafeInteger(maxInputChunkBytes) || maxInputChunkBytes < 1 || maxInputChunkBytes > 16777216) throw new RangeError("Invalid Python input chunk limit");
+  let activeWorkers = 0;
+  for (const size of [maxTransferBytes, maxOpenFiles]) if (!Number.isSafeInteger(size) || size < 1 || size > 1048576) throw new RangeError("Invalid Python resource limit");
+  const runtimeMount = options.runtimeMount ?? "/.pyodide-runtime";
+  if (!runtimeMount.startsWith("/") || runtimeMount === "/" || runtimeMount.slice(1).includes("/") || runtimeMount.includes("\0") || runtimeMount.split("/").some((part) => part === ".." || part === ".")) throw new TypeError("Python runtime mount must be an absolute top-level canonical path");
+  const environment = createPythonPackageEnvironment({
+    ...options.provisioning,
+    requirements: [...options.provisioning?.requirements ?? [], ...options.packages ?? []],
+    requirementFiles: [...options.provisioning?.requirementFiles ?? [], ...options.requirements ?? []],
+    ...options.packageProfile ? { profile: options.packageProfile } : {}
+  });
+  const execute = async (context) => {
+    let installation;
+    try {
+      parsePythonInvocation(context.args, context.env);
+      installation = parsePythonInstallation(context.args);
+    } catch (error) {
+      if (!(error instanceof PythonInvocationError)) throw error;
+      await writeBytes(context.stderr, new TextEncoder().encode("python: " + error.message + "\n"), context.signal);
+      return { exitCode: 2 };
+    }
+    if (installation?.help) {
+      await writeBytes(context.stdout, new TextEncoder().encode(pythonInstallationHelp), context.signal);
+      return { exitCode: 0 };
+    }
+    context.signal.throwIfAborted();
+    if (activeWorkers >= maxConcurrentWorkers) {
+      await writeBytes(context.stderr, new TextEncoder().encode("python: worker capacity exhausted\n"), context.signal);
+      return { exitCode: 1 };
+    }
+    const controller = new AbortController();
+    const signal = AbortSignal.any([context.signal, controller.signal]);
+    inheritYieldCheckpoint(context.signal, signal);
+    const fileContext = { ...context, descriptorCleanup: "caller" };
+    const metadata = new PythonStatTranslator();
+    const service = new PythonFileSystem(context.fs, {
+      cwd: context.cwd,
+      signal,
+      maxTransferBytes,
+      maxOpenFiles,
+      open: (path, settings) => openCommandFile(fileContext, path, settings)
+    });
+    let stdoutOperation;
+    let stderrOperation;
+    let endpoint;
+    let packages;
+    let unsubscribe;
+    let admitted = false;
+    let closed = false;
+    let closing;
+    const pending = /* @__PURE__ */ new Set();
+    const input = readBytes(context.stdin, signal)[Symbol.asyncIterator]();
+    let fragment;
+    let offset = 0;
+    let inputBytes = 0;
+    let rejectRun;
+    const close = () => {
+      if (closing) return closing;
+      let finish;
+      let fail;
+      closing = new Promise((resolve, reject) => {
+        finish = resolve;
+        fail = reject;
+      });
+      closed = true;
+      controller.abort(new Error("Python invocation retired"));
+      void (async () => {
+        signal.removeEventListener("abort", aborted);
+        const subscription = Promise.resolve().then(() => unsubscribe?.());
+        const termination = Promise.resolve().then(() => endpoint?.terminate());
+        const results = await Promise.allSettled([subscription, termination, service.close(), stdoutOperation?.close(), stderrOperation?.close(), ...pending]);
+        await input.return?.(void 0);
+        fragment = void 0;
+        if (packages) environment.finish(packages);
+        for (const result2 of results) if (result2.status === "rejected") throw result2.reason;
+      })().then(() => {
+        if (admitted) {
+          activeWorkers--;
+          admitted = false;
+        }
+        finish();
+      }, (reason) => {
+        fail(reason);
+      });
+      return closing;
+    };
+    const aborted = () => {
+      rejectRun?.(signal.reason);
+    };
+    context.registerCleanup?.(close);
+    let primary;
+    let result = 1;
+    try {
+      signal.throwIfAborted();
+      activeWorkers++;
+      admitted = true;
+      const outputContext = { signal, ...context.registerCleanup ? { registerCleanup: context.registerCleanup } : {} };
+      stdoutOperation = createOutputOperation(outputContext, context.stdout);
+      stderrOperation = createOutputOperation(outputContext, context.stderr);
+      if (typeof SharedArrayBuffer !== "function") throw new Error("Python worker filesystem requires SharedArrayBuffer");
+      const shared = new SharedArrayBuffer(8 + maxTransferBytes * 6 + 65536);
+      const control = new Int32Array(shared, 0, 2);
+      const payload = new Uint8Array(shared, 8);
+      const reply = (value, status) => {
+        if (closed) return;
+        let bytes;
+        try {
+          bytes = encodePythonReply(value, payload.length);
+        } catch (error) {
+          if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "EFBIG") throw error;
+          bytes = encodePythonReply({ code: "EFBIG" }, payload.length);
+          status = 2;
+        }
+        payload.set(bytes);
+        Atomics.store(control, 1, bytes.length);
+        Atomics.store(control, 0, status);
+        Atomics.notify(control, 0);
+      };
+      const dispatch = async (request) => {
+        signal.throwIfAborted();
+        if (request.op.startsWith("package-")) return environment.dispatch(request.op, request.args, { fs: context.fs, cwd: context.cwd, signal });
+        if (request.op === "stdin") {
+          const length = request.args[0];
+          if (!Number.isSafeInteger(length) || length < 1 || length > maxTransferBytes) throw new RangeError("Invalid Python input request");
+          let pulls = 0;
+          while (!fragment || offset === fragment.length) {
+            if (++pulls % 128 === 0) await yieldTurn(signal);
+            const next = await input.next();
+            if (next.done) return [];
+            inputBytes += next.value.length;
+            context.inputBudget?.check(inputBytes);
+            if (next.value.length > maxInputChunkBytes) throw new PythonInputChunkError("Python input chunk exceeds maxInputChunkBytes");
+            fragment = Uint8Array.from(next.value);
+            offset = 0;
+          }
+          const end = Math.min(fragment.length, offset + length);
+          const bytes = Array.from(fragment.subarray(offset, end));
+          offset = end;
+          return bytes;
+        }
+        if (request.op === "stdout" || request.op === "stderr") {
+          const bytes = request.args[0];
+          if (!Array.isArray(bytes) || bytes.length > maxTransferBytes || bytes.some((value2) => !Number.isInteger(value2) || value2 < 0 || value2 > 255)) throw new TypeError("Invalid Python output bytes");
+          const operation = request.op === "stdout" ? stdoutOperation : stderrOperation;
+          await writeBytes(operation.output, Uint8Array.from(bytes), signal);
+          return bytes.length;
+        }
+        const value = await service.dispatch(request);
+        return request.op === "stat" || request.op === "lstat" || request.op === "fstat" ? metadata.translate(value) : value;
+      };
+      options.onProgress?.({ phase: "initializing", command: context.command });
+      const preparation = environment.prepare({
+        fs: context.fs,
+        cwd: context.cwd,
+        signal,
+        ...installation ? { requirements: installation.packages, requirementFiles: installation.requirements } : {}
+      }).then((value) => {
+        packages = value;
+      });
+      pending.add(preparation);
+      try {
+        await preparation;
+      } finally {
+        pending.delete(preparation);
+      }
+      signal.throwIfAborted();
+      endpoint = options.createWorker();
+      signal.throwIfAborted();
+      result = await new Promise((resolve, reject) => {
+        let settled = false;
+        const fail = (reason) => {
+          settled = true;
+          reject(reason);
+        };
+        rejectRun = fail;
+        signal.addEventListener("abort", aborted, { once: true });
+        unsubscribe = endpoint.subscribe((value) => {
+          if (closed || settled) return;
+          if (typeof value !== "object" || value === null) {
+            fail(new TypeError("Invalid Python worker message"));
+            return;
+          }
+          const message = value;
+          if (message.type === "ready") {
+            try {
+              options.onProgress?.({ phase: "ready", command: context.command });
+            } catch (error) {
+              fail(error);
+            }
+            return;
+          }
+          if (message.type === "exit") {
+            if (pending.size) {
+              fail(new TypeError("Python worker exited with an outstanding request"));
+              return;
+            }
+            try {
+              const status = validateExitCode(message.exitCode);
+              settled = true;
+              resolve(status);
+            } catch (error) {
+              fail(error);
+            }
+            return;
+          }
+          if (message.type === "error") {
+            settled = true;
+            const diagnostic = "python: " + (typeof message.message === "string" ? message.message : "Python worker failed") + "\n";
+            const work2 = writeBytes(stderrOperation.output, new TextEncoder().encode(diagnostic), signal).then(
+              () => {
+                pending.delete(work2);
+                resolve(1);
+              },
+              (error) => {
+                pending.delete(work2);
+                reject(error);
+              }
+            );
+            pending.add(work2);
+            return;
+          }
+          if (typeof message.op !== "string" || !Array.isArray(message.args) || pending.size) {
+            fail(new TypeError("Invalid concurrent Python worker request"));
+            return;
+          }
+          const work = dispatch({ op: message.op, args: message.args }).then(
+            (value2) => {
+              pending.delete(work);
+              reply(value2, 1);
+            },
+            (error) => {
+              pending.delete(work);
+              if (signal.aborted) {
+                fail(signal.reason);
+                return;
+              }
+              if (typeof message.op === "string" && message.op.startsWith("package-")) {
+                reply({ code: "EPACKAGE", message: error instanceof Error ? error.message : String(error) }, 2);
+                return;
+              }
+              if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") {
+                fail(error);
+                return;
+              }
+              reply({ code: error.code }, 2);
+            }
+          );
+          pending.add(work);
+          void work.catch(fail);
+        }, fail);
+        if (settled) return;
+        const start = { type: "start", shared, invocation: { args: [...context.args], cwd: context.cwd, env: { ...context.env } }, runtimeMount, maxTransferBytes, ...packages ? { packages } : {}, installOnly: !!installation };
+        signal.throwIfAborted();
+        endpoint.postMessage(start);
+      });
+    } catch (reason) {
+      if (!signal.aborted && (reason instanceof PythonInputChunkError || reason instanceof Error && "code" in reason && reason.code === "EPACKAGE")) {
+        try {
+          await writeBytes(stderrOperation.output, new TextEncoder().encode("python: " + reason.message + "\n"), signal);
+        } catch (error) {
+          primary = { reason: error };
+        }
+      } else primary = { reason };
+    }
+    try {
+      await close();
+    } catch (reason) {
+      primary ??= { reason };
+    }
+    try {
+      options.onProgress?.({ phase: "finished", command: context.command });
+    } catch (reason) {
+      primary ??= { reason };
+    }
+    context.signal.throwIfAborted();
+    if (primary) throw primary.reason;
+    return { exitCode: result };
+  };
+  return ["python", "python3"].map((name) => ({ name, description: "Python with an explicit synchronous interpreter worker and canonical filesystem", execute }));
+}
+function pythonCommands(options) {
+  const commands = createPythonCommands(options);
+  return { name: "python-commands", setup(host) {
+    if (!options.replace) {
+      for (const command of commands) if (host.commands.has(command.name)) throw new Error(`Command already registered: ${command.name}`);
+    }
+    for (const command of commands) host.commands.register(command, { replace: options.replace ?? false });
+  } };
+}
+
+export {
+  clean,
+  rotl,
+  bytesToHex,
+  createHasher,
+  Chi,
+  Maj,
+  HashMD,
+  sha256,
+  sha224,
+  sha512,
+  sha384,
+  pythonDocumentPackages,
+  createPythonPackageEnvironment,
+  createPythonCommands,
+  pythonCommands
+};
+//# sourceMappingURL=chunk-GPV7ZFYS.js.map