@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/safe-bash/commands/metadata/index.browser.js

@@ -4,10 +4,9 @@ import {
   evalSyncStat,
   evalSyncTruncate,
   metadataCommands
-} from "../../chunks/chunk-VBTDHOWC.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-IOHH2GTI.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   createMetadataCommands,
   evalSyncMktemp,

package/dist/safe-bash/commands/metadata/index.d.ts

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import type { CommandDefinition, VirtualShellPlugin } from "../../contracts/index.js";
 import { type MetadataCommandsOptions } from "./internal.js";
 export type { MetadataCommandsOptions, MetadataLimits } from "./internal.js";

package/dist/safe-bash/commands/metadata/index.js

@@ -1,5 +1,5 @@
-import "../../portable-buffer.js";
 import { registerDefaultExecutors } from "../internal.js";
+import { createInstallCommand } from "../../../safe-bash-command-install/index.js";
 import { createChmodCommand } from "./chmod.js";
 import { createStatCommand } from "./stat.js";
 import { createMktempCommand } from "./mktemp.js";
@@ -7,7 +7,7 @@ import { truncateCommand } from "../truncate.js";
 import { settings } from "./internal.js";
 export function createMetadataCommands(options = {}) {
     settings(options);
-    return registerDefaultExecutors([createChmodCommand(options), createStatCommand(options), createMktempCommand(options), truncateCommand(options)], options);
+    return registerDefaultExecutors([createChmodCommand(options), createStatCommand(options), createMktempCommand(options), truncateCommand(options), createInstallCommand()], options);
 }
 export function metadataCommands(options = {}) {
     const commands = createMetadataCommands(options);

package/dist/safe-bash/commands/mktemp/index.browser.js

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/mktemp/index.ts
 init_platform();

package/dist/safe-bash/commands/network/curl.js

@@ -1,11 +1,9 @@
 import { createCurlCommand as createPortableCommand } from "../../../safe-bash-command-curl/index.js";
-import { createDefaultHttpTransport, requiresFiniteUrlLimits } from "#safe-bash-network-platform";
+import { createDefaultHttpTransport } from "#safe-bash-network-platform";
 import { limitsFor } from "./shared.js";
 export * from "../../../safe-bash-command-curl/curl.js";
 export function createCurlCommand(options = {}) {
     const limits = limitsFor(options.limits);
-    if (requiresFiniteUrlLimits && (!Number.isFinite(limits.maxUrls) || !Number.isFinite(limits.maxBufferBytes)))
-        throw new TypeError("Portable network commands require finite maxUrls and maxBufferBytes limits");
     return createPortableCommand({ ...options, transport: options.transport ?? createDefaultHttpTransport({ maxHeaderBytes: limits.maxHeaderBytes }) });
 }
 //# sourceMappingURL=curl.js.map

package/dist/safe-bash/commands/network/index.browser.js

@@ -12,10 +12,9 @@ import {
   evalSyncCurl,
   evalSyncWget,
   networkCommands
-} from "../../chunks/chunk-K6VCD7IY.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-HIIYIJ5G.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   CurlError,
   cloudflareWorkerNetworkLimits,

package/dist/safe-bash/commands/network/public.d.ts

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import type { CommandDefinition, VirtualShellPlugin } from "../../contracts/index.js";
 import type { NetworkCommandsOptions } from "./types.js";
 export * from "./types.js";

package/dist/safe-bash/commands/network/public.js

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import { syncCommandEvaluators } from "../internal.js";
 import { createWgetCommand } from "./wget.js";
 import { createCurlCommand } from "./curl.js";

package/dist/safe-bash/commands/network/transport.js

@@ -109,7 +109,7 @@ export function createNodeHttpTransport(options = {}) {
                     ...pinned,
                     ...(url.protocol === "https:" ? {
                         servername: isIP(hostname) ? "" : hostname,
-                        rejectUnauthorized: true,
+                        rejectUnauthorized: !input.insecure,
                         checkServerIdentity: (_servername, certificate) => checkServerIdentity(hostname, certificate),
                     } : {}),
                 }, response => {
@@ -167,6 +167,7 @@ export function createNodeHttpTransport(options = {}) {
     Object.defineProperty(transport, "supportsPrivateNetworkDeny", { value: true });
     Object.defineProperty(transport, "supportsConnectTimeout", { value: true });
     Object.defineProperty(transport, "supportsRequestCa", { value: true });
+    Object.defineProperty(transport, "supportsInsecureTls", { value: true });
     Object.defineProperty(transport, "supportedHttpVersions", { value: Object.freeze(["1.1"]) });
     return transport;
 }

package/dist/safe-bash/commands/network/wget.js

@@ -1,11 +1,9 @@
 import { createWgetCommand as createPortableCommand } from "../../../safe-bash-command-wget/index.js";
-import { createDefaultHttpTransport, requiresFiniteUrlLimits } from "#safe-bash-network-platform";
+import { createDefaultHttpTransport } from "#safe-bash-network-platform";
 import { limitsFor } from "./shared.js";
 export * from "../../../safe-bash-command-wget/wget.js";
 export function createWgetCommand(options = {}) {
     const limits = limitsFor(options.limits);
-    if (requiresFiniteUrlLimits && (!Number.isFinite(limits.maxUrls) || !Number.isFinite(limits.maxBufferBytes)))
-        throw new TypeError("Portable network commands require finite maxUrls and maxBufferBytes limits");
     return createPortableCommand({ ...options, transport: options.transport ?? createDefaultHttpTransport({ maxHeaderBytes: limits.maxHeaderBytes }) });
 }
 //# sourceMappingURL=wget.js.map

package/dist/safe-bash/commands/node/browser.d.ts

@@ -1,3 +1,2 @@
-import "../../portable-buffer.js";
 export { createSafeJsNodeCommand as createNodeCommand, createSafeJsNodeCommands as createNodeCommands, safeJsNodeCommands as nodeCommands, type SafeJsNodeCommandsOptions as NodeCommandsOptions, } from "./safejs.js";
 //# sourceMappingURL=browser.d.ts.map

package/dist/safe-bash/commands/node/browser.js

@@ -1,3 +1,2 @@
-import "../../portable-buffer.js";
 export { createSafeJsNodeCommand as createNodeCommand, createSafeJsNodeCommands as createNodeCommands, safeJsNodeCommands as nodeCommands, } from "./safejs.js";
 //# sourceMappingURL=browser.js.map

package/dist/safe-bash/commands/node/default-runtime.d.ts

@@ -0,0 +1,3 @@
+import type { CommandDefinition } from "../../contracts/command.js";
+export declare const defaultNodeCommand: CommandDefinition;
+//# sourceMappingURL=default-runtime.d.ts.map

package/dist/safe-bash/commands/node/default-runtime.js

@@ -0,0 +1,15 @@
+import { createSafeJsNodeCommand } from "./safejs.js";
+export const defaultNodeCommand = Object.freeze({
+    name: "node",
+    description: "Execute JavaScript with SafeJS and virtual I/O",
+    async execute(context) {
+        context.signal.throwIfAborted();
+        const { Budget, run, makeFsModule, declareHostOperation, parseSourceModule } = await import("@poe-platform/safe-js/core");
+        context.signal.throwIfAborted();
+        return createSafeJsNodeCommand({ runtime: {
+                run, makeFsModule, declareHostOperation, parseSourceModule,
+                createBudget: options => new Budget(options),
+            } }).execute(context);
+    },
+});
+//# sourceMappingURL=default-runtime.js.map

package/dist/safe-bash/commands/node/index.browser.js

@@ -2,14 +2,13 @@ import {
   createSafeJsNodeCommand,
   createSafeJsNodeCommands,
   safeJsNodeCommands
-} from "../../chunks/chunk-JMMEIDPF.js";
-import "../../chunks/chunk-PH63PLPZ.js";
-import "../../chunks/chunk-D3ANYGMC.js";
-import "../../chunks/chunk-5OHX7C2V.js";
-import "../../chunks/chunk-74GHTNJA.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-B2Z73HTZ.js";
+import "../../chunks/chunk-TC3F4UFF.js";
+import "../../chunks/chunk-UV4X32QU.js";
+import "../../chunks/chunk-62BOHHJT.js";
+import "../../chunks/chunk-4KTMKD5W.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   createSafeJsNodeCommand as createNodeCommand,
   createSafeJsNodeCommands as createNodeCommands,

package/dist/safe-bash/commands/node/index.js

@@ -6,14 +6,14 @@ import { NodeHost } from "./host.js";
 import { NodeOwner } from "./lifecycle.js";
 import { buildNodeProgram } from "./program.js";
 import { createSafeJsNodeCommand } from "./safejs.js";
-import { unconfiguredNodeCommand } from "./unconfigured.js";
+import { defaultNodeCommand } from "./default-runtime.js";
 import { NODE_PROFILE, NodeProfileError, NodeUsageError, nodeLimits, resolveNodeLimits } from "./types.js";
 import { environment, grants, record, text } from "./values.js";
 export { NODE_PROFILE, NodeProfileError, NodeUsageError, nodeLimits } from "./types.js";
 export { NODE_ENGINE_ABI } from "./worker-types.js";
 function commandConfiguration(options) {
     if (options === undefined)
-        return { definitions: Object.freeze([unconfiguredNodeCommand]), replace: false };
+        return { definitions: Object.freeze([defaultNodeCommand]), replace: false };
     const settings = record(options, [], ["provider", "grants", "runtime", "limits", "replace"]);
     if (Object.hasOwn(settings, "replace") && typeof settings.replace !== "boolean")
         throw new TypeError("node replace must be boolean");
@@ -45,7 +45,7 @@ function providerValue(value) {
 }
 export function createNodeCommand(options) {
     if (options === undefined)
-        return unconfiguredNodeCommand;
+        return defaultNodeCommand;
     const selected = record(options, [], ["provider", "grants", "runtime", "limits"]);
     if (Object.hasOwn(selected, "runtime")) {
         const settings = record(selected, ["runtime"], ["limits"]);

package/dist/safe-bash/commands/node/path.js

@@ -17,7 +17,7 @@ export function createNodePathModule(runtime, cwd) {
         return normalized.length > 1 && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
     };
     const path = {
-        ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, runtime.declareHostOperation(operation, "read-side-effect")])),
+        ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, typeof operation === "function" ? runtime.declareHostOperation(operation, "read-side-effect") : operation])),
         normalize: runtime.declareHostOperation((value) => {
             if (typeof value !== "string")
                 throw new TypeError("path must be a string");

package/dist/safe-bash/commands/node/preload.d.ts

@@ -1,2 +1,2 @@
-export declare const nodeRequireSource = "\nconst __safeBashModuleCache = new Map();\nconst __safeBashMakeRequire = base => name => {\n  const path = __safeBashModulePath(base, name);\n  if (path === null) return __safeBashRequire(name);\n  if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;\n  let source;\n  try { source = __safeBashModuleRead(path); }\n  catch (error) {\n    if (error.code !== \"ENOENT\") throw error;\n    const missing = new Error(\"Cannot find module '\" + name + \"'\");\n    missing.code = \"MODULE_NOT_FOUND\";\n    throw missing;\n  }\n  if (source.startsWith(\"\\uFEFF\")) source = source.slice(1);\n  const module = { exports: {} };\n  if (path.endsWith(\".json\")) {\n    module.exports = JSON.parse(source);\n    __safeBashModuleCache.set(path, module);\n    return module.exports;\n  }\n  if (source.startsWith(\"#!\")) {\n    const newline = source.indexOf(\"\\n\");\n    source = newline < 0 ? \"\" : source.slice(newline);\n  }\n  __safeBashModuleCache.set(path, module);\n  try {\n    const directory = path.slice(0, path.lastIndexOf(\"/\")) || \"/\";\n    (function(exports, require, module, __filename, __dirname) {\n      eval(source);\n    }).call(module.exports, module.exports, __safeBashMakeRequire(directory), module, path, directory);\n  } catch (error) {\n    __safeBashModuleCache.delete(path);\n    throw error;\n  }\n  return module.exports;\n};\nconst require = __safeBashMakeRequire(__safeBashEntryDirectory);\nfor (const name of __safeBashPreloads) __safeBashMakeRequire(__safeBashCwd)(name);\n";
+export declare const nodeRequireSource = "\nconst __safeBashModuleCache = new Map();\nconst __safeBashMakeRequire = base => name => {\n  const path = __safeBashModulePath(base, name);\n  if (path === null) {\n    if (!Object.hasOwn(__safeBashModules, name)) throw new TypeError(\"Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path\");\n    return __safeBashModules[name];\n  }\n  if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;\n  let source;\n  try { source = __safeBashModuleRead(path); }\n  catch (error) {\n    if (error.code !== \"ENOENT\") throw error;\n    const missing = new Error(\"Cannot find module '\" + name + \"'\");\n    missing.code = \"MODULE_NOT_FOUND\";\n    throw missing;\n  }\n  if (source.startsWith(\"\\uFEFF\")) source = source.slice(1);\n  const module = { exports: {} };\n  if (path.endsWith(\".json\")) {\n    module.exports = JSON.parse(source);\n    __safeBashModuleCache.set(path, module);\n    return module.exports;\n  }\n  if (source.startsWith(\"#!\")) {\n    const newline = source.indexOf(\"\\n\");\n    source = newline < 0 ? \"\" : source.slice(newline);\n  }\n  __safeBashModuleCache.set(path, module);\n  try {\n    const directory = path.slice(0, path.lastIndexOf(\"/\")) || \"/\";\n    (function(exports, require, module, __filename, __dirname) {\n      eval(source);\n    }).call(module.exports, module.exports, __safeBashMakeRequire(directory), module, path, directory);\n  } catch (error) {\n    __safeBashModuleCache.delete(path);\n    throw error;\n  }\n  return module.exports;\n};\nconst require = __safeBashMakeRequire(__safeBashEntryDirectory);\nfor (const name of __safeBashPreloads) __safeBashMakeRequire(__safeBashCwd)(name);\n";
 //# sourceMappingURL=preload.d.ts.map

package/dist/safe-bash/commands/node/preload.js

@@ -3,7 +3,10 @@ export const nodeRequireSource = `
 const __safeBashModuleCache = new Map();
 const __safeBashMakeRequire = base => name => {
   const path = __safeBashModulePath(base, name);
-  if (path === null) return __safeBashRequire(name);
+  if (path === null) {
+    if (!Object.hasOwn(__safeBashModules, name)) throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
+    return __safeBashModules[name];
+  }
   if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;
   let source;
   try { source = __safeBashModuleRead(path); }

package/dist/safe-bash/commands/node/quickjs.d.ts

@@ -0,0 +1,2 @@
+export * from "../../../safe-bash-command-node/index.js";
+//# sourceMappingURL=quickjs.d.ts.map

package/dist/safe-bash/commands/node/quickjs.js

@@ -0,0 +1,2 @@
+export * from "../../../safe-bash-command-node/index.js";
+//# sourceMappingURL=quickjs.js.map

package/dist/safe-bash/commands/node/safejs.js

@@ -12,10 +12,11 @@ import { createNodePathModule } from "./path.js";
 import { createSafeJsCommands } from "../safejs/runtime.js";
 import { commandLimits } from "../safejs/options.js";
 import { nodeEnvironment } from "./environment.js";
-import { unconfiguredNodeCommand } from "./unconfigured.js";
+import { defaultNodeCommand } from "./default-runtime.js";
+import { FsError } from "@poe-platform/safe-fs/core";
 export function createSafeJsNodeCommands(options) {
     if (options === undefined)
-        return Object.freeze([unconfiguredNodeCommand]);
+        return Object.freeze([defaultNodeCommand]);
     const settings = record(options, "node options");
     onlyKeys(settings, ["runtime", "limits", "replace"]);
     if (Object.hasOwn(settings, "replace") && typeof settings.replace !== "boolean")
@@ -134,7 +135,7 @@ function invocation(args, metadata) {
 }
 export function createSafeJsNodeCommand(options) {
     if (options === undefined)
-        return unconfiguredNodeCommand;
+        return defaultNodeCommand;
     const settings = record(options, "node options");
     onlyKeys(settings, ["runtime", "limits"]);
     if (settings.runtime === undefined || settings.runtime === null)
@@ -195,11 +196,29 @@ ${selected.check ? body : `eval(${JSON.stringify(body)});`}
             const nodeFs = {
                 ...fs,
                 promises: fs,
+                ...Object.fromEntries(["readFile", "writeFile", "appendFile", "mkdir", "readdir", "stat", "lstat", "rm", "rename", "copyFile"].filter(name => typeof fs[name] === "function").map(name => [
+                    name + "Sync", options.runtime.declareHostOperation(fs[name].bind(undefined), "read-side-effect", { awaitResult: true }),
+                ])),
+                existsSync: options.runtime.declareHostOperation(async (path) => {
+                    try {
+                        await fs.stat(path);
+                        return true;
+                    }
+                    catch {
+                        lifecycle.signal.throwIfAborted();
+                        return false;
+                    }
+                }, "read-side-effect", { awaitResult: true }),
+                unlinkSync: options.runtime.declareHostOperation(async (path) => {
+                    if (typeof path !== "string")
+                        throw new TypeError("path must be a string");
+                    lifecycle.signal.throwIfAborted();
+                    if (!lifecycle.fs.unlink)
+                        throw new FsError("ENOTSUP", { path, syscall: "unlink" });
+                    await lifecycle.fs.unlink(resolvePath(command.cwd, path), { signal: lifecycle.signal });
+                }, "read-side-effect", { awaitResult: true }),
                 ...(typeof fs.readFile === "function" ? {
                     readFile: nodeReadFile(options, fs, lifecycle.signal, lifecycle.fail, pending),
-                    readFileSync: options.runtime.declareHostOperation(
-                    // Give the synchronous facade its own declaration so readFile stays asynchronous.
-                    fs.readFile.bind(undefined), "read-side-effect", { awaitResult: true }),
                 } : {}),
             };
             modules.fs = { ...nodeFs, default: nodeFs };
@@ -245,12 +264,7 @@ ${selected.check ? body : `eval(${JSON.stringify(body)});`}
                         }
                         return resolvePath(base, name);
                     }, "read-side-effect"),
-                    __safeBashRequire: options.runtime.declareHostOperation((name) => {
-                        const module = typeof name === "string" ? requiredModules.get(name) : undefined;
-                        if (!module)
-                            throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
-                        return module;
-                    }, "read-side-effect"),
+                    __safeBashModules: Object.fromEntries(requiredModules),
                 },
             };
         },

package/dist/safe-bash/commands/op/index.browser.js

@@ -19,9 +19,8 @@ import {
   restoreEnvironment,
   selectOpBackendContext,
   selectOpGlobalFlags
-} from "../../chunks/chunk-UE5KZDEK.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-ZKYKJCZZ.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   captureEnvironment,
   createDocumentHandlers,

package/dist/safe-bash/commands/op/index.d.ts

@@ -1,13 +1,2 @@
-import type { CommandDefinition, VirtualShellPlugin } from "../../contracts/index.js";
-import { evalSyncOp, type OpCommandContext, type OpCommandsOptions } from "../../internal/op/index.js";
 export * from "../../internal/op/index.js";
-export { captureEnvironment, createDocumentHandlers, createEnvironmentHandlers, createItemHandlers, createObjectBackend, createOp, createOpTextCodec, createSecretHandlers, parseCommand, parseOpFileMode, parseSecretReference, renderOpHelp, renderOpOutput, restoreEnvironment, selectOpBackendContext, selectOpGlobalFlags, } from "../../internal/op/index.js";
-export { evalSyncOp };
-export declare function createOpCommand(options?: OpCommandsOptions): CommandDefinition & {
-    execute(context: OpCommandContext): Promise<{
-        exitCode: number;
-    }>;
-};
-export declare function createOpCommands(options?: OpCommandsOptions): readonly [CommandDefinition];
-export declare function opCommands(options?: OpCommandsOptions): VirtualShellPlugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/safe-bash/commands/op/index.js

@@ -1,86 +1,2 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-
-// packages/safe-bash/src/commands/internal.ts
-var internal_exports = {};
-__reExport(internal_exports, internal_star);
-import * as internal_star from "../../../safe-bash-io-engine/internal.js";
-
 // packages/safe-bash/src/commands/op/index.ts
-import {
-  createOpCommand as createRawOpCommand,
-  createOpCommands as createRawOpCommands,
-  evalSyncOp
-} from "../../../safe-bash-command-op/index.js";
 export * from "../../../safe-bash-command-op/index.js";
-import {
-  captureEnvironment,
-  createDocumentHandlers,
-  createEnvironmentHandlers,
-  createItemHandlers,
-  createObjectBackend,
-  createOp,
-  createOpTextCodec,
-  createSecretHandlers,
-  parseCommand,
-  parseOpFileMode,
-  parseSecretReference,
-  renderOpHelp,
-  renderOpOutput,
-  restoreEnvironment,
-  selectOpBackendContext,
-  selectOpGlobalFlags
-} from "../../../safe-bash-command-op/index.js";
-function createOpCommand(options = {}) {
-  const def = createRawOpCommand(options);
-  internal_exports.builtInDirectContextExecutors.add(def.execute);
-  return def;
-}
-function createOpCommands(options = {}) {
-  const defs = createRawOpCommands(options);
-  for (let i = 0; i < defs.length; i++) internal_exports.builtInDirectContextExecutors.add(defs[i].execute);
-  return defs;
-}
-function opCommands(options = {}) {
-  const commands = createOpCommands(options);
-  return {
-    name: "op-commands",
-    setup(host) {
-      for (const command of commands) host.commands.register(command, { replace: options.replace ?? false });
-    }
-  };
-}
-internal_exports.syncCommandEvaluators.evalSyncOp = evalSyncOp;
-export {
-  captureEnvironment,
-  createDocumentHandlers,
-  createEnvironmentHandlers,
-  createItemHandlers,
-  createObjectBackend,
-  createOp,
-  createOpCommand,
-  createOpCommands,
-  createOpTextCodec,
-  createSecretHandlers,
-  evalSyncOp,
-  opCommands,
-  parseCommand,
-  parseOpFileMode,
-  parseSecretReference,
-  renderOpHelp,
-  renderOpOutput,
-  restoreEnvironment,
-  selectOpBackendContext,
-  selectOpGlobalFlags
-};

package/dist/safe-bash/commands/pandoc/index.browser.js

@@ -0,0 +1,44 @@
+import {
+  createPandocCommand,
+  createPandocCommands,
+  pandocCommands
+} from "../../chunks/chunk-FAAIR6EJ.js";
+import "../../chunks/chunk-OHML2BEU.js";
+import {
+  init_platform
+} from "../../chunks/chunk-PTAEWLSE.js";
+
+// packages/safe-bash/src/commands/pandoc/index.ts
+init_platform();
+import { AstError, ExecutionContext, PandocError, assertNever, convert, convertSync, coreFormats, createCiteprocFilterCapability, createExecutionContext, createFormatInspectionCommand, createFormatRegistry, createJsonFilterCapability, createLuaFilterCapability, createStandalonePandocCommand, defaultLimits, evalSyncPandoc, formatCapabilities, inspectCommand, inspectFormats, normalizeDocument, normalizeDocumentCooperatively, parseConversionArgs, pdfReader, readDocument, resolveConversionArgs, writeDocument } from "../../../safe-bash-command-pandoc/index.js";
+export {
+  AstError,
+  ExecutionContext,
+  PandocError,
+  assertNever,
+  convert,
+  convertSync,
+  coreFormats,
+  createCiteprocFilterCapability,
+  createExecutionContext,
+  createFormatInspectionCommand,
+  createFormatRegistry,
+  createJsonFilterCapability,
+  createLuaFilterCapability,
+  createPandocCommand,
+  createPandocCommands,
+  createStandalonePandocCommand,
+  defaultLimits,
+  evalSyncPandoc,
+  formatCapabilities,
+  inspectCommand,
+  inspectFormats,
+  normalizeDocument,
+  normalizeDocumentCooperatively,
+  pandocCommands,
+  parseConversionArgs,
+  pdfReader,
+  readDocument,
+  resolveConversionArgs,
+  writeDocument
+};

package/dist/safe-bash/commands/pandoc/index.d.ts

@@ -1,4 +1,3 @@
 export * from "../../../safe-bash-command-pandoc/index.js";
-export * from "./implementation.js";
 export { createPandocCommand, createPandocCommands, pandocCommands } from "../../lazy-optional.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/safe-bash/commands/pandoc/index.js

@@ -1,4 +1,3 @@
 export * from "../../../safe-bash-command-pandoc/index.js";
-export * from "./implementation.js";
 export { createPandocCommand, createPandocCommands, pandocCommands } from "../../lazy-optional.js";
 //# sourceMappingURL=index.js.map

package/dist/safe-bash/commands/pr/index.browser.js

@@ -3,8 +3,8 @@ import {
   createPrCommands,
   evalSyncPr,
   prCommands
-} from "../../chunks/chunk-CHYGPFVM.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-22SX3F2R.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   createPrCommand,
   createPrCommands,

package/dist/safe-bash/commands/python/docker-runner.js

@@ -11,7 +11,7 @@ export async function runDockerPythonExecutor(options) {
     const input = process.stdin;
     const output = process.stdout;
     let buffered = new Uint8Array(0);
-    let limit = 16777216;
+    let limit = Infinity;
     let endpoint;
     let unsubscribe;
     let retirement;
@@ -52,9 +52,10 @@ export async function runDockerPythonExecutor(options) {
             return;
         }
         if (frame?.type !== 'start' || !Number.isSafeInteger(frame.maxTransferBytes) || frame.maxTransferBytes < 1 || frame.maxTransferBytes > 1048576
-            || !Number.isSafeInteger(frame.maxFrameBytes) || frame.maxFrameBytes < 65536 || frame.maxFrameBytes > 16777216)
+            || (frame.maxFrameBytes !== null && (!Number.isSafeInteger(frame.maxFrameBytes) || frame.maxFrameBytes < 65536)))
             throw new PythonFailure('transport-unavailable');
-        limit = frame.maxFrameBytes;
+        // JSON null explicitly represents an unlimited frame ceiling.
+        limit = frame.maxFrameBytes === null ? Infinity : frame.maxFrameBytes;
         const shared = new SharedArrayBuffer(8 + frame.maxTransferBytes * 6 + 65536);
         control = new Int32Array(shared, 0, 2);
         payload = new Uint8Array(shared, 8);

package/dist/safe-bash/commands/python/docker.d.ts

@@ -10,6 +10,7 @@ export interface DockerPythonExecutorOptions {
     readonly maxConcurrentExecutors: number;
     readonly temporaryBytes?: number;
     readonly controlTimeoutMs?: number;
+    /** Omitted or Infinity disables the frame-size ceiling. */
     readonly maxFrameBytes?: number;
 }
 export declare function createDockerPythonExecutorPool(options: DockerPythonExecutorOptions): Promise<PythonExecutorPool>;

package/dist/safe-bash/commands/python/docker.js

@@ -24,6 +24,9 @@ export async function createDockerPythonExecutorPool(options) {
     if (typeof options.image !== 'string' || !options.image.startsWith('sha256:') || options.image.length !== 71
         || [...options.image.slice(7)].some(character => !'0123456789abcdef'.includes(character)))
         throw new TypeError('An immutable Docker image ID is required');
+    const maxFrameBytes = options.maxFrameBytes ?? Infinity;
+    if (maxFrameBytes !== Infinity)
+        boundedInteger(maxFrameBytes, 65536, Number.MAX_SAFE_INTEGER);
     const configuration = Object.freeze({
         socketPath: options.socketPath, image: options.image,
         memoryBytes: boundedInteger(options.memoryBytes, 67108864, Number.MAX_SAFE_INTEGER),
@@ -32,7 +35,7 @@ export async function createDockerPythonExecutorPool(options) {
         maxConcurrentExecutors: boundedInteger(options.maxConcurrentExecutors, 1, Number.MAX_SAFE_INTEGER),
         temporaryBytes: boundedInteger(options.temporaryBytes ?? 16777216, 1, Number.MAX_SAFE_INTEGER),
         controlTimeoutMs: boundedInteger(options.controlTimeoutMs ?? 10000, 1, 300000),
-        maxFrameBytes: boundedInteger(options.maxFrameBytes ?? 8388608, 65536, 16777216),
+        maxFrameBytes,
     });
     if (!Number.isFinite(configuration.cpus) || configuration.cpus < 0.01 || configuration.cpus > 64)
         throw new RangeError('Invalid Python container CPU quota');
@@ -313,7 +316,7 @@ export async function createDockerPythonExecutorPool(options) {
                         if (retired || settled)
                             return;
                         await send({ type: 'start', invocation: start.invocation, runtimeMount: start.runtimeMount,
-                            maxTransferBytes: start.maxTransferBytes, maxFrameBytes: configuration.maxFrameBytes,
+                            maxTransferBytes: Math.min(start.maxTransferBytes, 65536), maxFrameBytes: configuration.maxFrameBytes === Infinity ? null : configuration.maxFrameBytes,
                             ...(start.packages ? { packages: start.packages } : {}), installOnly: !!start.installOnly,
                         }, true);
                     })().catch(error => fail(error instanceof PythonFailure || start.signal.aborted ? error : new PythonFailure('startup')));

package/dist/safe-bash/commands/python/index.browser.js

@@ -13,23 +13,25 @@ import {
   createPythonPackageEnvironment,
   createPythonPackageManifestStore,
   createPythonShellCapability,
+  installPythonLlmDependencies,
   pythonCommands,
   pythonDocumentPackages,
-  pythonHostFailureCode
-} from "../../chunks/chunk-EEEWOYEG.js";
-import "../../chunks/chunk-HZAMGT5I.js";
+  pythonHostFailureCode,
+  pythonLlmDependencies
+} from "../../chunks/chunk-S4RFUUXO.js";
+import "../../chunks/chunk-RUR6J33T.js";
+import "../../chunks/chunk-67WIFM3N.js";
 import {
   PythonFailure,
   inspectPythonCapabilities
-} from "../../chunks/chunk-LVOBFF4D.js";
-import "../../chunks/chunk-I5HZ4FGE.js";
-import "../../chunks/chunk-VTH3MLDU.js";
-import "../../chunks/chunk-5OHX7C2V.js";
-import "../../chunks/chunk-74GHTNJA.js";
-import "../../chunks/chunk-7R5BDCG7.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-Q4FNLOTI.js";
+import "../../chunks/chunk-CL2FCTTO.js";
+import "../../chunks/chunk-62BOHHJT.js";
+import "../../chunks/chunk-DUTAG6ZD.js";
+import "../../chunks/chunk-4KTMKD5W.js";
+import "../../chunks/chunk-OHML2BEU.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   PythonFailure,
   PythonPackageConflictError,
@@ -47,7 +49,9 @@ export {
   createPythonPackageManifestStore,
   createPythonShellCapability,
   inspectPythonCapabilities,
+  installPythonLlmDependencies,
   pythonCommands,
   pythonDocumentPackages,
-  pythonHostFailureCode
+  pythonHostFailureCode,
+  pythonLlmDependencies
 };

package/dist/safe-bash/commands/python/index.d.ts

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import type { CommandContext, CommandDefinition, VirtualShellPlugin } from '../../contracts/index.js';
 import { type PythonPackageOptions, type PythonPackageStart, type PythonPackageEnvironment } from './provisioning.js';
 import { type PythonDiagnosticObserver } from './diagnostics.js';
@@ -33,6 +32,7 @@ export interface PythonCommandsOptions {
     readonly onProgress?: (event: PythonInitializationProgress) => void;
     readonly onDiagnostic?: PythonDiagnosticObserver;
     readonly runtimeMount?: string;
+    /** Per-request I/O ceiling; omitted or Infinity disables it. Worker transports chunk independently. */
     readonly maxTransferBytes?: number;
     readonly maxOpenFiles?: number;
     readonly maxDirectoryEntries?: number;
@@ -81,6 +81,7 @@ export type { PythonExecutorPool, PythonExecutorPoolOptions } from './executor-p
 export { createPythonJspiExecutor } from './jspi.js';
 export type { PythonJspiExecutorOptions, PythonJspiRuntimeConfiguration } from './jspi.js';
 export { createPythonJspiAssets } from './jspi-assets.js';
+export { installPythonLlmDependencies, pythonLlmDependencies, type PythonLlmDependencyArchive } from './llm-dependencies.js';
 export type { PythonJspiAssetsOptions } from './jspi-assets.js';
 export { createPythonJspiTrampoline, createPythonJspiNativeCall, createPythonJspiStatResult } from './jspi-trampoline.js';
 export { PythonFailure, inspectPythonCapabilities } from './diagnostics.js';