@poe-platform/safe-bash 0.1.825 → 0.1.827

package/dist/safe-bash/command-chunks/chunk-RZOHZGEZ.js

@@ -1,772 +0,0 @@
-import {
-  openPythonPackageFile
-} from "./chunk-NXCJNPL3.js";
-
-// packages/safe-bash-command-python/src/build-wheel.ts
-import { FsError as FsError2 } from "../../safe-bash-contracts/index.js";
-import { resolvePath as resolvePath2, basename } from "../../safe-bash-contracts/path.js";
-
-// packages/safe-bash-command-python/src/package-download.ts
-import { FsError } from "../../safe-bash-contracts/index.js";
-import { resolvePath } from "../../safe-bash-contracts/path.js";
-import { interruptible } from "../../safe-bash-contracts/runtime-control.js";
-import { yieldTurn } from "../../safe-bash-contracts/yield.js";
-var serial = 0;
-async function stagePythonPackage(context, directory, body, maxBytes, progress, verify, publish) {
-  const { fs, signal } = context, settings = { signal };
-  const caps = await fs.capabilitiesFor?.(directory, settings) ?? fs.capabilities;
-  if (!caps.retainedStagingWrite || !caps.retainedStagingCleanup || !caps.retainedRead || !fs.createStagedFile || !fs.openReadFile || publish && (!caps.atomicFileStaging || !fs.publishStagedFile)) return void 0;
-  const parent = await fs.stat(directory, settings);
-  let stage;
-  for (let attempt = 0; attempt < 16; attempt++) {
-    try {
-      stage = await fs.createStagedFile(resolvePath(directory, ".python-package-" + ++serial), "wheel", { type: "file", data: new Uint8Array(0) }, { parent, mode: 384, retainCleanup: true, signal });
-      break;
-    } catch (error) {
-      signal.throwIfAborted();
-      if (!(error instanceof FsError) || error.code !== "EEXIST") throw error;
-    }
-  }
-  if (!stage) throw new Error("Python package staging names exhausted");
-  const owner = stage;
-  let artifact;
-  let closing;
-  const close = () => closing ??= (async () => {
-    try {
-      await artifact?.close();
-    } finally {
-      try {
-        await owner.cleanup?.remove();
-      } finally {
-        await owner.cleanup?.close();
-      }
-    }
-  })();
-  try {
-    if (!owner.cleanup || !owner.writer) throw new Error("Python package staging handles missing");
-    let count = 0;
-    const iterator = body[Symbol.asyncIterator]();
-    let ended = false;
-    try {
-      while (true) {
-        const next = await interruptible(Promise.resolve().then(() => {
-          signal.throwIfAborted();
-          return iterator.next();
-        }), signal);
-        signal.throwIfAborted();
-        if (next.done) {
-          ended = true;
-          break;
-        }
-        const bytes = next.value;
-        if (!(bytes instanceof Uint8Array)) throw new TypeError("Python package body must yield bytes");
-        if (count + bytes.length > maxBytes) throw new Error("Package download exceeds maxDownloadBytes");
-        for (let offset = 0; offset < bytes.length; offset += 65536) {
-          const chunk = Uint8Array.from(bytes.subarray(offset, offset + 65536));
-          await owner.writer.write(chunk, settings);
-          count += chunk.length;
-          await yieldTurn(signal);
-        }
-        if (bytes.length) progress(count);
-      }
-    } finally {
-      if (!ended) {
-        const returned = Promise.resolve().then(() => iterator.return?.());
-        if (signal.aborted) void returned.catch(() => {
-        });
-        else await interruptible(returned, signal);
-      }
-    }
-    const stat = await owner.writer.finish(settings);
-    if (stat.size !== count) throw new Error("Python package staging size mismatch");
-    artifact = await openPythonPackageFile(context, owner.file.path, maxBytes, stat);
-    if (!artifact) throw new Error("Python package retained reads unavailable");
-    verify(artifact.key);
-    if (publish) {
-      const key = artifact.key, path = publish(key);
-      await artifact.close();
-      artifact = void 0;
-      let destination = null;
-      try {
-        destination = await fs.lstat(path, settings);
-      } catch (error) {
-        if (!(error instanceof FsError) || error.code !== "ENOENT") throw error;
-      }
-      await fs.publishStagedFile({ ...owner, file: { ...owner.file, stat } }, path, { parent, destination, signal });
-      artifact = await openPythonPackageFile(context, path, maxBytes);
-      if (!artifact || artifact.key !== key) throw new Error("Published Python package integrity mismatch");
-    }
-    return { ...artifact, close };
-  } catch (error) {
-    try {
-      await close();
-    } catch (cleanup) {
-      throw new AggregateError([error, cleanup], error instanceof Error ? error.message : "Python package download failed");
-    }
-    throw error;
-  }
-}
-
-// packages/safe-bash-command-python/src/build-wheel.ts
-async function publishPythonBuildWheel(source, directory, maxBytes, context) {
-  const { fs, signal } = context, settings = { signal };
-  let artifact = typeof source === "string" ? void 0 : source.artifact;
-  let reading;
-  try {
-    signal.throwIfAborted();
-    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new RangeError("Invalid Python wheel size limit");
-    const filename = typeof source === "string" ? basename(source) : source.filename;
-    if (basename(filename) !== filename || !filename.endsWith(".whl") || filename.includes("\\") || filename.includes("\0")) throw new TypeError("Invalid Python build wheel filename");
-    const root = await fs.realpath(resolvePath2(context.cwd, directory), settings);
-    const caps = await fs.capabilitiesFor?.(root, settings) ?? fs.capabilities;
-    if (!fs.confineExtraction || !fs.prepareDirectory || !caps.retainedStagingWrite || !caps.retainedStagingCleanup || !caps.retainedRead || !caps.atomicFileStaging) throw new Error("Python wheel publication requires confined retained atomic staging");
-    if (typeof source === "string") artifact = await openPythonPackageFile(context, resolvePath2(context.cwd, source), maxBytes);
-    if (!artifact) throw new Error("Python wheel publication requires retained source reads");
-    if (artifact.size > maxBytes) throw new Error("Canonical package exceeds maxDownloadBytes");
-    const retained = artifact;
-    const confined = await fs.confineExtraction([root], settings);
-    const destination = new Proxy(confined, { get(target, key) {
-      const owner = key === "openReadFile" ? fs : target, value = Reflect.get(owner, key);
-      return typeof value === "function" ? value.bind(owner) : value;
-    } });
-    const parent = await destination.stat(root, settings), path = resolvePath2(root, artifact.key);
-    try {
-      await destination.prepareDirectory(path, { parent, expected: null, mode: 448, signal });
-    } catch (error) {
-      if (!(error instanceof FsError2) || !["EEXIST", "EAGAIN"].includes(error.code)) throw error;
-    }
-    if ((await destination.lstat(path, settings)).type !== "directory") throw new Error("Python wheel publication directory changed");
-    const output = resolvePath2(path, filename);
-    const body = async function* () {
-      for (let offset = 0; offset < retained.size; ) {
-        const bytes = await (reading = Promise.resolve(retained.read(offset, Math.min(65536, retained.size - offset))));
-        if (!bytes.length || bytes.length > Math.min(65536, retained.size - offset)) throw new Error("Invalid Python wheel read");
-        offset += bytes.length;
-        yield bytes;
-      }
-    };
-    const published = await stagePythonPackage({ ...context, fs: destination }, path, body(), maxBytes, () => {
-    }, (key) => {
-      if (key !== retained.key) throw new Error("Built Python wheel integrity mismatch");
-    }, () => output);
-    if (!published) throw new Error("Python wheel publication requires retained atomic staging");
-    try {
-      return { url: "file://" + output.split("/").map(encodeURIComponent).join("/"), digest: published.key, size: published.size };
-    } finally {
-      await published.close();
-    }
-  } finally {
-    try {
-      await reading?.catch(() => {
-      });
-    } finally {
-      await artifact?.close?.();
-    }
-  }
-}
-
-// packages/safe-bash-command-python/src/provisioning.ts
-import { sha256 } from "@noble/hashes/sha2.js";
-import { resolvePath as resolve, dirname, basename as basename2 } from "../../safe-bash-contracts/path.js";
-import { inheritYieldCheckpoint } from "../../safe-bash-contracts/yield.js";
-
-// packages/safe-bash-command-python/src/manifest.ts
-function readPackageManifest(value) {
-  const strings = (values) => Array.isArray(values) && values.every((item) => typeof item === "string");
-  if (Array.isArray(value)) return strings(value) ? value : void 0;
-  if (!value || typeof value !== "object") return;
-  const record = value, version = record.version;
-  if (![1, 2, 3].includes(version) || Object.keys(value).length !== (version === 1 ? 2 : 3)) return;
-  if (version !== 1 && (!Array.isArray(record.records) || !record.records.every((row) => Array.isArray(row) && row.length === version + 3 && row.every((part, index) => index > 2 && index < 5 ? strings(part) : typeof part === "string" || index === 5 && part === null)))) return;
-  return strings(record.installed) ? record.installed : void 0;
-}
-var PythonPackageConflictError = class extends Error {
-  code = "EPACKAGECONFLICT";
-  retryable = true;
-  constructor() {
-    super("Python package environment changed during installation; retry the command");
-    this.name = "PythonPackageConflictError";
-  }
-};
-function createPythonPackageManifestStore(options = {}) {
-  const maxBytes = options.maxBytes ?? Infinity;
-  const maxEntries = options.maxEntries ?? Infinity;
-  const maxScopeLength = options.maxScopeLength ?? Infinity;
-  for (const [name, value] of Object.entries({ maxBytes, maxEntries, maxScopeLength })) {
-    if (value !== Infinity && (!Number.isSafeInteger(value) || value < 1)) {
-      throw new RangeError(`Python manifest ${name} must be a positive safe integer or Infinity`);
-    }
-  }
-  const manifests = /* @__PURE__ */ new Map();
-  let retainedBytes = 0;
-  let revision = 0n;
-  let disposed = false;
-  const check = (scope, signal) => {
-    signal.throwIfAborted();
-    if (disposed) throw new Error("Python manifest store is disposed");
-    if (typeof scope !== "string" || !scope) throw new TypeError("Invalid Python manifest scope");
-    if (scope.length > maxScopeLength) throw new RangeError("Python manifest scope budget exhausted");
-  };
-  return {
-    async get(scope, { signal }) {
-      check(scope, signal);
-      const value = manifests.get(scope);
-      return value ? { revision: value.revision, bytes: value.bytes.slice() } : void 0;
-    },
-    async compareAndSet(scope, expected, bytes, { signal }) {
-      check(scope, signal);
-      const current = manifests.get(scope);
-      if (current?.revision !== expected) return false;
-      if (!(bytes instanceof Uint8Array)) throw new TypeError("Python manifest must contain bytes");
-      const nextBytes = retainedBytes - (current?.bytes.length ?? 0) + bytes.length;
-      if (nextBytes > maxBytes || !current && manifests.size >= maxEntries) {
-        throw new RangeError("Python manifest store budget exhausted");
-      }
-      manifests.set(scope, { revision: String(++revision), bytes: Uint8Array.from(bytes) });
-      retainedBytes = nextBytes;
-      return true;
-    },
-    dispose() {
-      disposed = true;
-      manifests.clear();
-      retainedBytes = 0;
-    }
-  };
-}
-
-// packages/safe-bash-command-python/src/cache.ts
-var pythonPackageRuntimeKey = "pyodide-314.0.6-cp314-emscripten-wasm32-v1";
-function createPythonPackageCache(options = {}) {
-  const maxBytes = options.maxBytes ?? Infinity;
-  if (options.maxBytes !== void 0 && (!Number.isSafeInteger(maxBytes) || maxBytes < 1)) throw new RangeError("Python cache maxBytes must be a positive integer");
-  const values = /* @__PURE__ */ new Map();
-  const manifestKey = pythonPackageRuntimeKey + "-environment";
-  let retainedBytes = 0;
-  let disposed = false;
-  return {
-    async get(key) {
-      if (disposed) throw new Error("Python package cache is disposed");
-      return values.get(key)?.slice();
-    },
-    async set(key, bytes) {
-      if (disposed) throw new Error("Python package cache is disposed");
-      if (key === manifestKey && bytes.length > maxBytes) throw new RangeError("Python package manifest exceeds maxCacheBytes");
-      const previous = values.get(key);
-      if (previous) {
-        retainedBytes -= previous.length;
-        values.delete(key);
-      }
-      if (bytes.length > maxBytes) return;
-      while (values.size && retainedBytes + bytes.length > maxBytes) {
-        const oldest = [...values.keys()].find((entry) => entry !== manifestKey);
-        if (oldest === void 0) return;
-        retainedBytes -= values.get(oldest).length;
-        values.delete(oldest);
-      }
-      values.set(key, Uint8Array.from(bytes));
-      retainedBytes += bytes.length;
-    },
-    dispose() {
-      disposed = true;
-      values.clear();
-      retainedBytes = 0;
-    }
-  };
-}
-
-// packages/safe-bash-command-python/src/provisioning.ts
-var pythonDocumentPackages = Object.freeze([
-  "lxml==6.0.2",
-  "pillow==12.2.0",
-  "python-docx==1.2.0",
-  "openpyxl==3.1.5",
-  "XlsxWriter==3.2.9",
-  "pypdf==6.18.1",
-  "fpdf2==2.8.8",
-  "fonttools==4.65.0",
-  "defusedxml==0.7.1",
-  "et-xmlfile==2.0.0",
-  "typing-extensions==4.16.0"
-]);
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-function digest(value) {
-  return Array.from(sha256(value), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function validDigest(value) {
-  if (typeof value !== "string" || value.length !== 64) return false;
-  for (const char of value) if (!"0123456789abcdef".includes(char)) return false;
-  return true;
-}
-function failure(message, cause) {
-  return Object.assign(new Error(message, { cause }), { code: "EPACKAGE" });
-}
-function missing(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function normalizeRequirement(value, cwd) {
-  const requirement = value.trim();
-  if (!requirement || requirement.startsWith("-")) throw failure(`Unsupported requirement: ${value}`);
-  if (requirement.endsWith(".whl") && !requirement.includes("://")) return "file://" + resolve(cwd, requirement).split("/").map(encodeURIComponent).join("/");
-  return requirement;
-}
-function checkSession(session) {
-  session.signal.throwIfAborted();
-  if (session.closed) throw failure("Python package session is closed");
-}
-function createPythonPackageEnvironment(options = {}) {
-  if (options.cache && options.cacheDirectory) throw new TypeError("Choose package cache or cacheDirectory, not both");
-  if (options.manifestStore && (typeof options.scope !== "string" || !options.scope.trim())) throw new TypeError("Shared Python manifests require an explicit nonempty scope");
-  if (options.scope !== void 0 && !options.manifestStore) throw new TypeError("Python scope requires a manifestStore");
-  const manifestKey = options.manifestStore ? pythonPackageRuntimeKey + "-environment-" + digest(encoder.encode(JSON.stringify(options.scope))) : pythonPackageRuntimeKey + "-environment";
-  if (options.profile !== void 0 && options.profile !== "documents") throw new TypeError("Unknown Python package profile");
-  const maxBytes = options.maxDownloadBytes ?? Infinity;
-  const maxManifestBytes = options.maxManifestBytes ?? Infinity;
-  const maxMetadataBytes = options.maxMetadataBytes ?? Infinity;
-  for (const name of ["maxDownloadBytes", "maxManifestBytes", "maxMetadataBytes", "maxRequirementBytes", "maxCacheBytes"]) {
-    const value = options[name];
-    if (value !== void 0 && (!Number.isSafeInteger(value) || value < 1)) throw new RangeError(`${name} must be a positive integer`);
-  }
-  const cacheRecord = (key, headers, url) => {
-    const bytes = encoder.encode(JSON.stringify({ digest: key, headers, url }));
-    if (bytes.length > maxMetadataBytes) throw failure("Python package cache metadata exceeds maxMetadataBytes");
-    return bytes;
-  };
-  const maxCacheBytes = options.maxCacheBytes;
-  const defaultCache = createPythonPackageCache(maxCacheBytes === void 0 ? {} : { maxBytes: maxCacheBytes });
-  const sessions = /* @__PURE__ */ new Map();
-  const controller = new AbortController();
-  const pending = /* @__PURE__ */ new Set();
-  let cleanupFailure;
-  const track = (work, cleanup = false) => {
-    pending.add(work);
-    void work.then(() => pending.delete(work), (error) => {
-      if (cleanup) cleanupFailure ??= { error };
-      pending.delete(work);
-    });
-    return work;
-  };
-  function release(session, all = false) {
-    const artifacts = all ? [...session.retained.values()] : [];
-    if (all) session.retained.clear();
-    if (session.opened) {
-      artifacts.push(session.opened);
-      session.opened = void 0;
-    }
-    if (!artifacts.length) return session.retiring ?? Promise.resolve();
-    return track(session.retiring = Promise.allSettled([session.retiring, ...artifacts.map((artifact) => Promise.resolve().then(() => artifact.close?.()))]).then((results) => {
-      for (const result of results) if (result.status === "rejected") throw result.reason;
-    }), true);
-  }
-  let disposed = false;
-  let disposing;
-  const admit = (operation) => (...args) => track(Promise.resolve().then(() => {
-    if (disposed) throw failure("Python package environment is disposed");
-    return operation(...args);
-  }));
-  let counter = 0;
-  let committing = Promise.resolve();
-  async function prepare(input) {
-    const invocation = new AbortController();
-    const signal = AbortSignal.any([input.signal, controller.signal, invocation.signal]);
-    inheritYieldCheckpoint(input.signal, signal);
-    const context = { ...input, signal };
-    signal.throwIfAborted();
-    const directory = options.cacheDirectory === void 0 ? void 0 : resolve(context.cwd, options.cacheDirectory, pythonPackageRuntimeKey);
-    const noCache = context.noCache ?? options.noCache ?? false;
-    const artifactDirectory = directory ?? (!options.cache && !noCache ? resolve(context.cwd, ".python-packages", "cache", pythonPackageRuntimeKey) : void 0);
-    const cache = options.cache ?? (artifactDirectory === void 0 ? defaultCache : {
-      async get(key) {
-        try {
-          return await context.fs.readFile(resolve(artifactDirectory, key), { signal });
-        } catch (error) {
-          if (missing(error)) return void 0;
-          throw error;
-        }
-      },
-      async set(key, bytes) {
-        await context.fs.mkdir(artifactDirectory, { recursive: true, signal });
-        await context.fs.writeFile(resolve(artifactDirectory, key), bytes, { signal });
-      }
-    });
-    const manifestCache = options.cacheDirectory === void 0 ? defaultCache : cache;
-    let snapshot;
-    if (options.manifestStore) {
-      try {
-        snapshot = await options.manifestStore.get(manifestKey, context);
-      } catch (error) {
-        signal.throwIfAborted();
-        throw failure("Cannot read Python package environment manifest", error);
-      }
-    }
-    signal.throwIfAborted();
-    if (snapshot !== void 0 && (typeof snapshot !== "object" || snapshot === null || typeof snapshot.revision !== "string" || !snapshot.revision || snapshot.revision.length > 1024 || !(snapshot.bytes instanceof Uint8Array))) throw failure("Invalid Python package manifest snapshot");
-    const manifestRevision = snapshot?.revision;
-    const stored = options.manifestStore ? snapshot?.bytes : await manifestCache.get(manifestKey);
-    signal.throwIfAborted();
-    if (stored && stored.length > maxManifestBytes) throw failure("Python package manifest exceeds maxManifestBytes");
-    const manifest = stored === void 0 ? "" : decoder.decode(stored);
-    let previous;
-    try {
-      previous = stored === void 0 ? [] : JSON.parse(manifest);
-    } catch {
-      throw failure("Invalid Python package environment manifest");
-    }
-    const saved = readPackageManifest(previous);
-    if (!saved) throw failure("Invalid Python package environment manifest");
-    const legacy = Array.isArray(previous);
-    const restore = saved.map((value) => normalizeRequirement(value, context.cwd));
-    const requirements = [...options.profile === "documents" ? pythonDocumentPackages : [], ...options.requirements ?? [], ...context.requirements ?? []].map((value) => normalizeRequirement(value, context.cwd));
-    for (const file of [...options.requirementFiles ?? [], ...context.requirementFiles ?? []]) {
-      const path = resolve(context.cwd, file);
-      let source;
-      try {
-        source = decoder.decode(await context.fs.readFile(path, { signal, ...options.maxRequirementBytes === void 0 ? {} : { maxBytes: options.maxRequirementBytes } }));
-      } catch (error) {
-        signal.throwIfAborted();
-        throw failure(`Cannot read Python requirements ${path}: ${error instanceof Error ? error.message : String(error)}`);
-      }
-      for (const line of source.split("\n")) {
-        let comment = line.indexOf("#");
-        while (comment > 0 && line[comment - 1].trim()) comment = line.indexOf("#", comment + 1);
-        const text = (comment < 0 ? line : line.slice(0, comment)).trim();
-        if (!text) continue;
-        if (text.endsWith("\\")) throw failure(`Unsupported requirements continuation in ${path}: ${text}`);
-        requirements.push(text[0] === "-" && options.prepareRequirements ? text : normalizeRequirement(text, dirname(path)));
-      }
-    }
-    if ((options.editable?.length || context.editable?.length) && !options.prepareRequirements) throw failure("Editable packages require a source package environment");
-    const requested = [...new Set(await options.prepareRequirements?.(requirements, context) ?? requirements)];
-    signal.throwIfAborted();
-    const session = String(++counter);
-    const unique = [.../* @__PURE__ */ new Set([...restore, ...requested])];
-    const aborted = () => {
-      const current = sessions.get(session);
-      if (current) {
-        current.closed = true;
-        void release(current, true);
-      }
-    };
-    const offline = context.offline ?? options.offline ?? false;
-    sessions.set(session, { ...context, cacheDirectory: directory, artifactDirectory, noCache, cache, manifestCache, manifestRevision, controller: invocation, offline, requirements: unique, opening: false, retained: /* @__PURE__ */ new Map(), closed: false, manifest, aborted });
-    signal.addEventListener("abort", aborted, { once: true });
-    const controls = {};
-    for (const key of ["pre", "upgrade", "forceReinstall"]) if (context[key] ?? options[key]) controls[key] = true;
-    return { session, requirements: unique, restore, requested, legacy, records: previous.records, ...controls, ...input.uninstall ? { uninstall: input.uninstall } : {}, offline };
-  }
-  async function dispatch(op, args, _context) {
-    _context.signal.throwIfAborted();
-    const session = sessions.get(String(args[0]));
-    if (!session) throw failure("Python package session is closed");
-    checkSession(session);
-    if (op === "package-commit") {
-      await release(session, true);
-      checkSession(session);
-      const pinned = args[1];
-      const saved = readPackageManifest(pinned);
-      if (!saved) throw failure("Invalid installed package manifest");
-      const state = Array.isArray(pinned) ? [.../* @__PURE__ */ new Set([...session.requirements, ...saved])] : { ...pinned, installed: [...new Set(saved)] };
-      const manifestBytes = encoder.encode(JSON.stringify(state));
-      if (manifestBytes.length > maxManifestBytes) throw failure("Python package manifest exceeds maxManifestBytes");
-      const commit = committing.then(async () => {
-        checkSession(session);
-        if (options.manifestStore) {
-          const committed = await options.manifestStore.compareAndSet(manifestKey, session.manifestRevision, manifestBytes, { signal: session.signal });
-          checkSession(session);
-          if (typeof committed !== "boolean") throw failure("Invalid Python package manifest publication result");
-          if (!committed) throw new PythonPackageConflictError();
-        } else {
-          const current = await session.manifestCache.get(manifestKey);
-          checkSession(session);
-          if (current && current.length > maxManifestBytes) throw failure("Python package manifest exceeds maxManifestBytes");
-          if ((current === void 0 ? "" : decoder.decode(current)) !== session.manifest) throw new PythonPackageConflictError();
-          await session.manifestCache.set(manifestKey, manifestBytes);
-        }
-        checkSession(session);
-      });
-      committing = commit.catch(() => {
-      });
-      await commit;
-      options.onProgress?.({ phase: "installed" });
-      return null;
-    }
-    if (op === "package-read" || op === "package-read-retained") {
-      const artifact = op === "package-read" ? session.opened : session.retained.get(String(args[1])), offset = args[2], length = args[3];
-      if (!artifact || op === "package-read" && artifact.key !== String(args[1]) || !Number.isSafeInteger(offset) || !Number.isSafeInteger(length) || offset < 0 || length < 1 || length > 65536) throw failure("Invalid package chunk request");
-      const bytes = await artifact.read(offset, length);
-      checkSession(session);
-      return Array.from(bytes);
-    }
-    if (op === "package-retain") {
-      let artifact = session.opened;
-      if (!artifact || artifact.key !== String(args[1])) throw failure("Invalid package retention request");
-      if (artifact.url && artifact.close) {
-        const source = artifact;
-        const retaining = (async () => {
-          const path = decodeURIComponent(new URL(source.url).pathname);
-          const directory = resolve(session.cacheDirectory ?? resolve(session.cwd, ".python-packages"), "installed");
-          const capabilities = await session.fs.capabilitiesFor?.(directory, { signal: session.signal }) ?? session.fs.capabilities;
-          if (!session.fs.confineExtraction || !session.fs.prepareDirectory || !capabilities.retainedStagingWrite || !capabilities.retainedStagingCleanup || !capabilities.retainedRead || !capabilities.atomicFileStaging) return;
-          const target = resolve(directory, source.key, basename2(path));
-          if (path !== target) {
-            await session.fs.mkdir(directory, { recursive: true, signal: session.signal });
-            checkSession(session);
-            session.opened = void 0;
-            const published = await publishPythonBuildWheel({ filename: basename2(path), artifact: source }, directory, maxBytes, session);
-            artifact = await openPythonPackageFile(session, decodeURIComponent(new URL(published.url).pathname), maxBytes);
-            if (!artifact) throw failure("Installed Python wheels require retained reads");
-            if (artifact.key !== published.digest) {
-              await artifact.close?.();
-              throw failure("Installed Python wheel changed");
-            }
-            session.opened = artifact;
-            artifact.url = published.url;
-            try {
-              checkSession(session);
-            } catch (error) {
-              await release(session);
-              throw error;
-            }
-          }
-          const durable = new URL(artifact.url);
-          durable.hash = "sha256=" + artifact.key;
-          artifact.url = durable.href;
-        })();
-        session.retaining = retaining;
-        try {
-          await retaining;
-        } finally {
-          session.retaining = void 0;
-        }
-      }
-      checkSession(session);
-      if (!artifact) throw failure("Installed Python wheel unavailable");
-      const token = String(++counter);
-      session.retained.set(token, artifact);
-      session.opened = void 0;
-      return { token, key: artifact.key, size: artifact.size, ...artifact.url ? { url: artifact.url } : {} };
-    }
-    if (op === "package-close") {
-      if (session.opened?.key === String(args[1])) await release(session);
-      return null;
-    }
-    if (op !== "package-open" || typeof args[1] !== "string") throw failure("Invalid package operation");
-    if (session.opening || session.retaining) throw failure("Package download already in progress");
-    session.opening = true;
-    try {
-      await release(session);
-      checkSession(session);
-      const url = args[1], { artifactDirectory: cacheDirectory, noCache } = session;
-      const expected = args[2];
-      let responseUrl = url;
-      const verifyIntegrity = (key2) => {
-        if (expected && key2 !== expected) throw failure(`Package integrity mismatch: ${url}`);
-      };
-      if (expected !== void 0 && expected !== null && !validDigest(expected)) throw failure("Invalid SHA-256 package integrity value");
-      const address = pythonPackageRuntimeKey + "-url-" + digest(encoder.encode(url));
-      const canonicalWheel = url.startsWith("file:") || url.startsWith("emfs:");
-      const metadata = canonicalWheel || noCache || args[3] === "metadata" && !session.offline ? void 0 : await session.cache.get(address);
-      checkSession(session);
-      let key = "", bytes;
-      let headers = [];
-      const adopt = async (artifact, ready) => {
-        session.opened = artifact;
-        if (canonicalWheel) artifact.url = url;
-        try {
-          checkSession(session);
-          await ready();
-          checkSession(session);
-          return { key: artifact.key, size: artifact.size, headers, url: responseUrl };
-        } catch (error) {
-          await release(session);
-          throw error;
-        }
-      };
-      if (metadata) {
-        if (metadata.length > maxMetadataBytes) throw failure("Python package cache metadata exceeds maxMetadataBytes");
-        let record;
-        try {
-          record = JSON.parse(decoder.decode(metadata));
-        } catch {
-        }
-        if (typeof record !== "object" || record === null || !validDigest(record.digest) || record.url !== void 0 && typeof record.url !== "string" || !Array.isArray(record.headers) || record.headers.some((pair) => !Array.isArray(pair) || pair.length !== 2 || pair.some((value2) => typeof value2 !== "string"))) throw failure(`Invalid package cache metadata: ${url}`);
-        headers = record.headers;
-        responseUrl = record.url ?? url;
-        let absent = false;
-        if (cacheDirectory) {
-          let artifact;
-          try {
-            artifact = await openPythonPackageFile(session, resolve(cacheDirectory, pythonPackageRuntimeKey + "-sha256-" + record.digest), maxBytes);
-          } catch (error) {
-            if (!missing(error)) throw error;
-            absent = true;
-          }
-          if (artifact) {
-            return await adopt(artifact, () => {
-              if (artifact.key !== record.digest) throw failure(`Package cache integrity mismatch: ${url}`);
-              verifyIntegrity(artifact.key);
-              options.onProgress?.({ phase: "cached", url, bytes: artifact.size });
-            });
-          }
-        }
-        bytes = absent ? void 0 : await session.cache.get(pythonPackageRuntimeKey + "-sha256-" + record.digest);
-        checkSession(session);
-        if (bytes && bytes.length > maxBytes) throw failure("Cached package exceeds maxDownloadBytes");
-        if (bytes) bytes = Uint8Array.from(bytes);
-        if (bytes && (key = digest(bytes)) !== record.digest) throw failure(`Package cache integrity mismatch: ${url}`);
-        if (bytes) options.onProgress?.({ phase: "cached", url, bytes: bytes.length });
-      }
-      if (!bytes) {
-        if (canonicalWheel) {
-          const path = new URL(url);
-          if (path.host && path.host !== "localhost") throw failure("Local wheels must use the canonical filesystem");
-          try {
-            const artifact = await openPythonPackageFile(session, decodeURIComponent(path.pathname), maxBytes);
-            if (artifact) {
-              return await adopt(artifact, () => verifyIntegrity(artifact.key));
-            }
-            bytes = Uint8Array.from(await session.fs.readFile(decodeURIComponent(path.pathname), { signal: session.signal, ...Number.isFinite(maxBytes) ? { maxBytes } : {} }));
-          } catch (error) {
-            checkSession(session);
-            throw failure(`Cannot read canonical Python wheel ${path.pathname}: ${error instanceof Error ? error.message : String(error)}`);
-          }
-        } else {
-          if (session.offline) throw failure(`Offline package cache miss: ${url}`);
-          if (!options.transport || !options.authorize) throw failure("Python package download requires configured transport and authorization");
-          let current = new URL(url);
-          let redirectFrom;
-          for (let redirect = 0; ; redirect++) {
-            if (current.protocol !== "https:" && current.protocol !== "http:") throw failure(`Unsupported package transport protocol: ${current.protocol}`);
-            if (current.username || current.password) throw failure("Package URLs with credentials are unsupported");
-            let denyPrivate = false;
-            const allowed = await options.authorize({ url: current.href, method: "GET", attempt: 0, signal: session.signal, ...redirectFrom === void 0 ? {} : { redirectFrom }, requirePrivateNetworkDeny() {
-              denyPrivate = true;
-            } });
-            checkSession(session);
-            if (!allowed) throw failure(`Python package download authorization denied: ${current.href}`);
-            if (denyPrivate && !options.transport.supportsPrivateNetworkDeny) throw failure("Package transport cannot enforce private network denial");
-            checkSession(session);
-            const response = await options.transport({ url: current.href, method: "GET", headers: [["accept", "application/vnd.pypi.simple.v1+json, application/json;q=0.9, */*;q=0.1"]], signal: session.signal, ...denyPrivate ? { denyPrivateNetworks: true } : {} });
-            try {
-              checkSession(session);
-              if ([301, 302, 303, 307, 308].includes(response.status)) {
-                if (redirect >= 5) throw failure("Too many package redirects");
-                const location = response.headers.find(([key2]) => key2.toLowerCase() === "location")?.[1];
-                if (!location) throw failure("Package redirect has no location");
-                redirectFrom = current.href;
-                current = new URL(location, current);
-                continue;
-              }
-              if (response.status < 200 || response.status >= 300) throw failure(`Package download failed: HTTP ${response.status} ${current.href}`);
-              headers = response.headers;
-              responseUrl = current.href;
-              const encoding = headers.find(([key2]) => key2.toLowerCase() === "content-encoding")?.[1].trim().toLowerCase();
-              const length = headers.find(([key2]) => key2.toLowerCase() === "content-length")?.[1];
-              const total = length === void 0 || encoding !== void 0 && encoding !== "identity" ? void 0 : Number(length);
-              if (total !== void 0 && Number.isFinite(total) && total > maxBytes) throw failure("Package download exceeds maxDownloadBytes");
-              const progress = (count2) => options.onProgress?.({ phase: "download", url, bytes: count2, ...typeof total === "number" && Number.isSafeInteger(total) ? { totalBytes: total } : {} });
-              if (cacheDirectory || noCache) {
-                const directory = cacheDirectory ?? session.cwd;
-                if (cacheDirectory) await session.fs.mkdir(directory, { recursive: true, signal: session.signal });
-                let metadataBytes;
-                const artifact = await stagePythonPackage(
-                  session,
-                  directory,
-                  response.body,
-                  maxBytes,
-                  progress,
-                  (key2) => {
-                    verifyIntegrity(key2);
-                    if (!noCache) metadataBytes = cacheRecord(key2, headers, responseUrl);
-                  },
-                  noCache ? void 0 : (key2) => resolve(directory, pythonPackageRuntimeKey + "-sha256-" + key2)
-                );
-                if (artifact) {
-                  return await adopt(artifact, async () => {
-                    if (!noCache) await session.cache.set(address, metadataBytes);
-                  });
-                }
-              }
-              const chunks = [];
-              let count = 0;
-              for await (const chunk of response.body) {
-                checkSession(session);
-                if (chunk.length === 0) continue;
-                count += chunk.length;
-                if (count > maxBytes) throw failure("Package download exceeds maxDownloadBytes");
-                chunks.push(Uint8Array.from(chunk));
-                progress(count);
-              }
-              bytes = new Uint8Array(count);
-              let offset = 0;
-              for (const chunk of chunks) {
-                bytes.set(chunk, offset);
-                offset += chunk.length;
-              }
-              break;
-            } finally {
-              await response.dispose();
-            }
-          }
-        }
-        checkSession(session);
-        verifyIntegrity(key = digest(bytes));
-        if (!noCache) {
-          const metadataBytes = cacheRecord(key, headers, responseUrl);
-          await session.cache.set(pythonPackageRuntimeKey + "-sha256-" + key, Uint8Array.from(bytes));
-          checkSession(session);
-          if (!canonicalWheel) await session.cache.set(address, metadataBytes);
-        }
-      }
-      checkSession(session);
-      verifyIntegrity(key);
-      const value = bytes;
-      session.opened = { key, size: bytes.length, ...canonicalWheel ? { url } : {}, read: (offset, length) => value.subarray(offset, offset + length) };
-      return { key, size: bytes.length, headers, url: responseUrl };
-    } finally {
-      session.opening = false;
-    }
-  }
-  return {
-    prepare: admit(prepare),
-    dispatch: admit(dispatch),
-    finish(start) {
-      const session = sessions.get(start.session);
-      if (session) {
-        session.closed = true;
-        session.signal.removeEventListener("abort", session.aborted);
-        session.controller.abort(failure("Python package session is closed"));
-        sessions.delete(start.session);
-        const retired = release(session, true);
-        return Promise.allSettled([session.retaining, retired]).then(async () => {
-          try {
-            await retired;
-          } finally {
-            await release(session, true);
-          }
-        });
-      }
-    },
-    dispose() {
-      if (!disposing) {
-        disposed = true;
-        controller.abort(failure("Python package environment is disposed"));
-        disposing = Promise.allSettled([...pending]).then(() => {
-          sessions.clear();
-          defaultCache.dispose();
-          if (cleanupFailure) throw cleanupFailure.error;
-        });
-      }
-      return disposing;
-    }
-  };
-}
-
-export {
-  publishPythonBuildWheel,
-  PythonPackageConflictError,
-  createPythonPackageManifestStore,
-  createPythonPackageCache,
-  pythonDocumentPackages,
-  createPythonPackageEnvironment
-};