sandboxedjs 0.1.50 → 0.1.52

package/dist/index.js

@@ -1,6 +1,6 @@
-import { ungzip, gzip as gzip$1, deflate as deflate$1, inflate as inflate$1, deflateRaw, inflateRaw } from 'pako';
-import { Buffer as Buffer$1 } from 'buffer/index.js';
+import { inflateRaw, ungzip, gzip as gzip$1, deflate as deflate$1, inflate as inflate$1, deflateRaw } from 'pako';
 import { sha256, sha224 } from '@noble/hashes/sha256';
+import { Buffer as Buffer$1 } from 'buffer/index.js';
 import { sha512, sha384 } from '@noble/hashes/sha512';
 import { sha1 } from '@noble/hashes/sha1';
 import { valid, maxSatisfying } from 'semver';
@@ -3331,7 +3331,7 @@ async function builtinRead({ shell, argv, io }) {
   if (timeoutSeconds !== void 0 && Number.isFinite(timeoutSeconds)) {
     line = await Promise.race([
       readOnce(),
-      new Promise((resolve2) => setTimeout(() => resolve2(null), timeoutSeconds * 1e3))
+      new Promise((resolve3) => setTimeout(() => resolve3(null), timeoutSeconds * 1e3))
     ]);
   } else {
     line = await readOnce();
@@ -3590,10 +3590,10 @@ function builtinType({ shell, argv, io }) {
 }
 async function builtinCommand({ shell, argv, io }) {
   const args = argv.slice(1);
-  const describe3 = args.includes("-v") || args.includes("-V");
+  const describe2 = args.includes("-v") || args.includes("-V");
   const verbose = args.includes("-V");
   const rest = args.filter((a) => a !== "-v" && a !== "-V" && a !== "-p");
-  if (describe3) {
+  if (describe2) {
     let status = 0;
     for (const name of rest) {
       if (isBuiltinName(name)) {
@@ -4057,6 +4057,94 @@ var init_builtins = __esm({
   }
 });
 
+// src/pkg/zip.ts
+var zip_exports = {};
+__export(zip_exports, {
+  ZipError: () => ZipError,
+  readZip: () => readZip
+});
+function readZip(archive) {
+  const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
+  const end = findEndOfCentralDirectory(archive);
+  let entryCount = view.getUint16(end + 10, true);
+  let directoryOffset = view.getUint32(end + 16, true);
+  if (entryCount === 65535 || directoryOffset === 4294967295) {
+    const locator = findSignature(archive, ZIP64_END_LOCATOR, end);
+    if (locator < 0) throw new ZipError("zip64 archive without an end locator");
+    const zip64End = Number(view.getBigUint64(locator + 8, true));
+    if (view.getUint32(zip64End, true) !== ZIP64_END_OF_CENTRAL_DIRECTORY) {
+      throw new ZipError("zip64 end record not found where the locator says");
+    }
+    entryCount = Number(view.getBigUint64(zip64End + 32, true));
+    directoryOffset = Number(view.getBigUint64(zip64End + 48, true));
+  }
+  const entries = [];
+  let at = directoryOffset;
+  for (let i = 0; i < entryCount; i += 1) {
+    if (view.getUint32(at, true) !== CENTRAL_FILE_HEADER) {
+      throw new ZipError(`central directory entry ${i} has a bad signature`);
+    }
+    const flags = view.getUint16(at + 8, true);
+    if (flags & 1) throw new ZipError("encrypted archives are not supported");
+    const method = view.getUint16(at + 10, true);
+    const compressedSize = view.getUint32(at + 20, true);
+    const uncompressedSize = view.getUint32(at + 24, true);
+    const nameLength = view.getUint16(at + 28, true);
+    const extraLength = view.getUint16(at + 30, true);
+    const commentLength = view.getUint16(at + 32, true);
+    const externalAttributes = view.getUint32(at + 38, true);
+    const localOffset = view.getUint32(at + 42, true);
+    const name = new TextDecoder().decode(archive.subarray(at + 46, at + 46 + nameLength));
+    entries.push({
+      name,
+      /* The high 16 bits are the Unix mode when the archive was made on Unix.
+       * pip relies on it for console scripts, which have to stay executable. */
+      mode: externalAttributes >>> 16,
+      isDirectory: name.endsWith("/"),
+      data: () => extract(archive, view, localOffset, method, compressedSize, uncompressedSize, name)
+    });
+    at += 46 + nameLength + extraLength + commentLength;
+  }
+  return entries;
+}
+function extract(archive, view, localOffset, method, compressedSize, uncompressedSize, name) {
+  const nameLength = view.getUint16(localOffset + 26, true);
+  const extraLength = view.getUint16(localOffset + 28, true);
+  const start2 = localOffset + 30 + nameLength + extraLength;
+  const body = archive.subarray(start2, start2 + compressedSize);
+  if (method === 0) return body.slice();
+  if (method !== 8) throw new ZipError(`${name}: unsupported compression method ${method}`);
+  const inflated = inflateRaw(body);
+  if (inflated.length !== uncompressedSize) {
+    throw new ZipError(`${name}: inflated to ${inflated.length} bytes, the directory says ${uncompressedSize}`);
+  }
+  return inflated;
+}
+function findEndOfCentralDirectory(archive, view) {
+  const at = findSignature(archive, END_OF_CENTRAL_DIRECTORY, archive.length);
+  if (at < 0) throw new ZipError("not a zip archive: no end-of-central-directory record");
+  return at;
+}
+function findSignature(archive, signature, before) {
+  const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
+  for (let at = Math.min(before, archive.length) - 4; at >= 0; at -= 1) {
+    if (view.getUint32(at, true) === signature) return at;
+  }
+  return -1;
+}
+var END_OF_CENTRAL_DIRECTORY, CENTRAL_FILE_HEADER, ZIP64_END_LOCATOR, ZIP64_END_OF_CENTRAL_DIRECTORY, ZipError;
+var init_zip = __esm({
+  "src/pkg/zip.ts"() {
+    END_OF_CENTRAL_DIRECTORY = 101010256;
+    CENTRAL_FILE_HEADER = 33639248;
+    ZIP64_END_LOCATOR = 117853008;
+    ZIP64_END_OF_CENTRAL_DIRECTORY = 101075792;
+    ZipError = class extends Error {
+      code = "ERR_ZIP";
+    };
+  }
+});
+
 // src/fs/vfs.ts
 init_errno();
 init_path();
@@ -4842,7 +4930,7 @@ var Pipe = class _Pipe {
   }
   waitForData() {
     if (this.buffered > 0 || this.writerClosed || this.readerClosed) return Promise.resolve();
-    return new Promise((resolve2) => this.wakers.push(resolve2));
+    return new Promise((resolve3) => this.wakers.push(resolve3));
   }
   async read(size = Infinity) {
     await this.waitForData();
@@ -5201,7 +5289,7 @@ var Process = class {
   }
   wait() {
     if (this.exitCode !== null) return Promise.resolve(this.exitCode);
-    return new Promise((resolve2) => this.exitWaiters.push(resolve2));
+    return new Promise((resolve3) => this.exitWaiters.push(resolve3));
   }
 };
 var ProcessTable = class {
@@ -6968,7 +7056,7 @@ var NetworkStack = class {
     try {
       const res = await Promise.race([
         this.pod.request(port, { path: "/", method: "GET" }),
-        new Promise((resolve2) => setTimeout(() => resolve2(null), timeoutMs))
+        new Promise((resolve3) => setTimeout(() => resolve3(null), timeoutMs))
       ]);
       if (res === null) return false;
       return res.statusCode !== 503;
@@ -10432,11 +10520,11 @@ var sleepCmd = defineCommand({
       const multiplier = { "": 1e3, s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[m[2] ?? ""];
       totalMs += value * multiplier;
     }
-    await new Promise((resolve2) => {
-      const timer = setTimeout(resolve2, totalMs);
+    await new Promise((resolve3) => {
+      const timer = setTimeout(resolve3, totalMs);
       ctx.signal.addEventListener("abort", () => {
         clearTimeout(timer);
-        resolve2();
+        resolve3();
       });
     });
     return ctx.signal.aborted ? 130 : 0;
@@ -17374,13 +17462,13 @@ async function execute(ctx, invocation) {
       })();
     }
     let onAbort;
-    const aborted = new Promise((resolve2) => {
+    const aborted = new Promise((resolve3) => {
       onAbort = () => {
         try {
           proc.kill();
         } catch {
         }
-        resolve2({ exitCode: 137 });
+        resolve3({ exitCode: 137 });
       };
       if (ctx.signal.aborted) onAbort();
       else ctx.signal.addEventListener("abort", onAbort, { once: true });
@@ -17789,10 +17877,10 @@ function validateManifest(value) {
 var bundledManifest = {
   format: "sandboxedjs-python-runtime",
   schemaVersion: 1,
-  runtimeId: "sbx-cpython-3.13.5-threaded-fixed",
+  runtimeId: "sbx-cpython-3.13.5-dynamic",
   engine: "cpython-wasm",
   pythonVersion: "3.13.5",
-  profile: "threaded-fixed",
+  profile: "dynamic",
   hostAbi: { name: "sbx_host_v1", version: 1 },
   artifacts: {
     moduleUrl: new URL(
@@ -17802,7 +17890,7 @@ var bundledManifest = {
   },
   capabilities: {
     threads: true,
-    nativeExtensions: "fixed",
+    nativeExtensions: "dynamic",
     networking: "none",
     processes: "none",
     persistence: "memory"
@@ -17810,6 +17898,7 @@ var bundledManifest = {
 };
 var config = { backend: "sbx-cpython-wasm", manifest: bundledManifest };
 function setPythonBackend(options) {
+  if (options.wheelIndex !== void 0) config.wheelIndex = options.wheelIndex;
   if (options.manifest !== void 0) config.manifest = validateManifest(options.manifest);
   if (options.workerUrl !== void 0) config.workerUrl = options.workerUrl;
   if (options.backend !== void 0) {
@@ -18117,10 +18206,10 @@ var PipeBuffer = class {
   wake() {
     const waiting = this.waiters;
     this.waiters = [];
-    for (const resolve2 of waiting) resolve2();
+    for (const resolve3 of waiting) resolve3();
   }
   whenReady() {
-    return new Promise((resolve2) => this.waiters.push(resolve2));
+    return new Promise((resolve3) => this.waiters.push(resolve3));
   }
 };
 var PipeReadEnd = class {
@@ -18274,7 +18363,7 @@ var StreamDescription = class {
     return true;
   }
   whenReady() {
-    return new Promise((resolve2) => this.waiters.push(resolve2));
+    return new Promise((resolve3) => this.waiters.push(resolve3));
   }
   close() {
     this.wake();
@@ -18282,7 +18371,7 @@ var StreamDescription = class {
   wake() {
     const waiting = this.waiters;
     this.waiters = [];
-    for (const resolve2 of waiting) resolve2();
+    for (const resolve3 of waiting) resolve3();
   }
 };
 function toPosixError(error) {
@@ -18633,7 +18722,7 @@ function createHostAbiServer(proc) {
       }
       /* ------------------------------------------------------------ files */
       case Op.openat: {
-        const path = resolve2(r.string());
+        const path = resolve3(r.string());
         const flags = r.u32();
         const mode = r.u32();
         const description = files.open(path, flags, mode);
@@ -18681,7 +18770,7 @@ function createHostAbiServer(proc) {
         return { status: 0, payload: encodeStat(proc.table.get(r.i32()).stat()) };
       }
       case Op.statat: {
-        const path = resolve2(r.string());
+        const path = resolve3(r.string());
         const followLinks = r.u32() !== 0;
         try {
           const st = followLinks ? proc.vfs.stat(path, { cred: proc.cred }) : proc.vfs.lstat(path);
@@ -18711,11 +18800,11 @@ function createHostAbiServer(proc) {
         return { status: 0 };
       }
       case Op.renameat: {
-        files.rename(resolve2(r.string()), resolve2(r.string()));
+        files.rename(resolve3(r.string()), resolve3(r.string()));
         return { status: 0 };
       }
       case Op.unlinkat: {
-        const path = resolve2(r.string());
+        const path = resolve3(r.string());
         const removeDirectory = r.u32() !== 0;
         if (removeDirectory) {
           try {
@@ -18729,7 +18818,7 @@ function createHostAbiServer(proc) {
         return { status: 0 };
       }
       case Op.mkdirat: {
-        const path = resolve2(r.string());
+        const path = resolve3(r.string());
         const mode = r.u32();
         try {
           proc.vfs.mkdir(path, { mode, cred: proc.cred });
@@ -18740,7 +18829,7 @@ function createHostAbiServer(proc) {
       }
       case Op.readlinkat: {
         try {
-          const target = proc.vfs.readlink(resolve2(r.string()), proc.cred);
+          const target = proc.vfs.readlink(resolve3(r.string()), proc.cred);
           return { status: 0, payload: new Writer().string(target).finish() };
         } catch (error) {
           throw toPosixError(error);
@@ -18749,7 +18838,7 @@ function createHostAbiServer(proc) {
       case Op.symlinkat: {
         const target = r.string();
         try {
-          proc.vfs.symlink(target, resolve2(r.string()), proc.cred);
+          proc.vfs.symlink(target, resolve3(r.string()), proc.cred);
         } catch (error) {
           throw toPosixError(error);
         }
@@ -18824,7 +18913,7 @@ function createHostAbiServer(proc) {
       case Op.getcwd:
         return { status: 0, payload: new Writer().string(proc.cwd).finish() };
       case Op.chdir: {
-        const path = resolve2(r.string());
+        const path = resolve3(r.string());
         let st;
         try {
           st = proc.vfs.stat(path, { cred: proc.cred });
@@ -18853,7 +18942,7 @@ function createHostAbiServer(proc) {
   function implemented(capability) {
     return ["files", "descriptors", "pipes", "readiness", "time", "identity", "entropy"].includes(capability);
   }
-  function resolve2(path) {
+  function resolve3(path) {
     if (path.startsWith("/")) return proc.vfs.resolvePath(path);
     return proc.vfs.resolvePath(`${proc.cwd.replace(/\/$/, "")}/${path}`);
   }
@@ -18915,11 +19004,11 @@ function createHostAbiServer(proc) {
   }
   function aborted() {
     if (proc.signal.aborted) return Promise.resolve();
-    return new Promise((resolve3) => proc.signal.addEventListener("abort", () => resolve3(), { once: true }));
+    return new Promise((resolve4) => proc.signal.addEventListener("abort", () => resolve4(), { once: true }));
   }
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, Math.max(0, ms)));
+  return new Promise((resolve3) => setTimeout(resolve3, Math.max(0, ms)));
 }
 function encodeStat(st) {
   return new Writer().u64(st.ino).u32(st.mode).u64(st.size).u32(st.uid).u32(st.gid).u32(st.nlink).i64(Math.round(st.atimeMs * 1e6)).i64(Math.round(st.mtimeMs * 1e6)).i64(Math.round(st.ctimeMs * 1e6)).finish();
@@ -19039,12 +19128,12 @@ async function startRuntimeWorker(options = {}) {
   const url = options.url ?? defaultWorkerUrl();
   const worker = hasDomWorker() ? await startDomWorker(url) : await startNodeWorker(url, options.workerData ?? {});
   try {
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => reject(new Error("the runtime worker did not start in time")), options.timeoutMs ?? 1e4);
       worker.onMessage((message) => {
         if (message?.type === "sandboxedjs:ready") {
           clearTimeout(timer);
-          resolve2();
+          resolve3();
         }
       });
       worker.onError((error) => {
@@ -19090,7 +19179,7 @@ async function startNodeWorker(url, workerData) {
     /* webpackIgnore: true */
     specifier
   );
-  const worker = new NodeWorker(url, { workerData });
+  const worker = new NodeWorker(url, { workerData, execArgv: [] });
   return {
     postMessage: (message) => worker.postMessage(message),
     onMessage: (listener) => worker.on("message", listener),
@@ -19138,8 +19227,8 @@ async function startPythonProcess(options) {
   };
   let blame = () => {
   };
-  const finished = new Promise((resolve2, reject) => {
-    settle = resolve2;
+  const finished = new Promise((resolve3, reject) => {
+    settle = resolve3;
     blame = reject;
   });
   let done = false;
@@ -19204,85 +19293,11 @@ async function startPythonProcess(options) {
     }
   };
 }
-var END_OF_CENTRAL_DIRECTORY = 101010256;
-var CENTRAL_FILE_HEADER = 33639248;
-var ZIP64_END_LOCATOR = 117853008;
-var ZIP64_END_OF_CENTRAL_DIRECTORY = 101075792;
-var ZipError = class extends Error {
-  code = "ERR_ZIP";
-};
-function readZip(archive) {
-  const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
-  const end = findEndOfCentralDirectory(archive);
-  let entryCount = view.getUint16(end + 10, true);
-  let directoryOffset = view.getUint32(end + 16, true);
-  if (entryCount === 65535 || directoryOffset === 4294967295) {
-    const locator = findSignature(archive, ZIP64_END_LOCATOR, end);
-    if (locator < 0) throw new ZipError("zip64 archive without an end locator");
-    const zip64End = Number(view.getBigUint64(locator + 8, true));
-    if (view.getUint32(zip64End, true) !== ZIP64_END_OF_CENTRAL_DIRECTORY) {
-      throw new ZipError("zip64 end record not found where the locator says");
-    }
-    entryCount = Number(view.getBigUint64(zip64End + 32, true));
-    directoryOffset = Number(view.getBigUint64(zip64End + 48, true));
-  }
-  const entries = [];
-  let at = directoryOffset;
-  for (let i = 0; i < entryCount; i += 1) {
-    if (view.getUint32(at, true) !== CENTRAL_FILE_HEADER) {
-      throw new ZipError(`central directory entry ${i} has a bad signature`);
-    }
-    const flags = view.getUint16(at + 8, true);
-    if (flags & 1) throw new ZipError("encrypted archives are not supported");
-    const method = view.getUint16(at + 10, true);
-    const compressedSize = view.getUint32(at + 20, true);
-    const uncompressedSize = view.getUint32(at + 24, true);
-    const nameLength = view.getUint16(at + 28, true);
-    const extraLength = view.getUint16(at + 30, true);
-    const commentLength = view.getUint16(at + 32, true);
-    const externalAttributes = view.getUint32(at + 38, true);
-    const localOffset = view.getUint32(at + 42, true);
-    const name = new TextDecoder().decode(archive.subarray(at + 46, at + 46 + nameLength));
-    entries.push({
-      name,
-      /* The high 16 bits are the Unix mode when the archive was made on Unix.
-       * pip relies on it for console scripts, which have to stay executable. */
-      mode: externalAttributes >>> 16,
-      isDirectory: name.endsWith("/"),
-      data: () => extract(archive, view, localOffset, method, compressedSize, uncompressedSize, name)
-    });
-    at += 46 + nameLength + extraLength + commentLength;
-  }
-  return entries;
-}
-function extract(archive, view, localOffset, method, compressedSize, uncompressedSize, name) {
-  const nameLength = view.getUint16(localOffset + 26, true);
-  const extraLength = view.getUint16(localOffset + 28, true);
-  const start2 = localOffset + 30 + nameLength + extraLength;
-  const body = archive.subarray(start2, start2 + compressedSize);
-  if (method === 0) return body.slice();
-  if (method !== 8) throw new ZipError(`${name}: unsupported compression method ${method}`);
-  const inflated = inflateRaw(body);
-  if (inflated.length !== uncompressedSize) {
-    throw new ZipError(`${name}: inflated to ${inflated.length} bytes, the directory says ${uncompressedSize}`);
-  }
-  return inflated;
-}
-function findEndOfCentralDirectory(archive, view) {
-  const at = findSignature(archive, END_OF_CENTRAL_DIRECTORY, archive.length);
-  if (at < 0) throw new ZipError("not a zip archive: no end-of-central-directory record");
-  return at;
-}
-function findSignature(archive, signature, before) {
-  const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
-  for (let at = Math.min(before, archive.length) - 4; at >= 0; at -= 1) {
-    if (view.getUint32(at, true) === signature) return at;
-  }
-  return -1;
-}
+
+// src/runtime/python/install.ts
+init_zip();
 
 // src/runtime/python/pypi.ts
-var ACCEPTED_TAGS = ["py3-none-any", "py2.py3-none-any", "py3-none-emscripten"];
 function parseRequirement(text2) {
   const cleaned = text2.replace(/#.*$/, "").trim();
   if (!cleaned) return null;
@@ -19356,56 +19371,280 @@ function compareRelease(left, right) {
   }
   return 0;
 }
-function isPreRelease(version) {
-  return /(a|b|rc|dev|post)\d*$/i.test(version.replace(/^\d+(\.\d+)*/, ""));
-}
-async function resolvePackageCandidates(client, requirement, environment) {
-  const index = await client.json(`https://pypi.org/pypi/${requirement.name}/json`);
-  const candidates = Object.keys(index.releases).filter((version) => requirement.specifiers.every((s) => compareVersions(version, s.version, s.op))).sort((a, b) => compareRelease(releaseOf(a), releaseOf(b)));
-  const stable = candidates.filter((version) => !isPreRelease(version));
-  const ordered = (stable.length > 0 ? stable : candidates).reverse();
-  let sawSourceOnly = false;
-  const resolved = [];
-  for (const version of ordered) {
-    const files = (index.releases[version] ?? []).filter((file3) => !file3.yanked);
-    const wheel = pickWheel(files);
-    if (wheel) {
-      resolved.push({
-        name: requirement.name,
+function splitOnce(text2, separator) {
+  const at = text2.indexOf(separator);
+  return at < 0 ? [text2] : [text2.slice(0, at), text2.slice(at + 1)];
+}
+
+// src/runtime/python/extension-abi.ts
+var EXTENSION_ABI = {
+  "abiId": "sbxabi1-c2637d04695ad927",
+  "wheelTag": "cp313-cp313-emscripten_5_0_6_wasm32",
+  "wheel": {
+    "acceptedPurePythonTags": [
+      "py3-none-any",
+      "py2.py3-none-any",
+      "cp313-none-any"
+    ]
+  }};
+var WHEEL_TAG = EXTENSION_ABI.wheelTag;
+var PURE_PYTHON_TAGS = EXTENSION_ABI.wheel.acceptedPurePythonTags;
+
+// src/runtime/python/resolver.ts
+var ResolutionError = class extends Error {
+  constructor(message, explanation = []) {
+    super(explanation.length > 0 ? `${message}
+  ${explanation.join("\n  ")}` : message);
+    this.explanation = explanation;
+    this.name = "ResolutionError";
+  }
+  explanation;
+};
+function classifyFile(file3, allowSourceBuilds) {
+  if (file3.packagetype === "sdist") return allowSourceBuilds ? "sdist" : null;
+  if (file3.packagetype !== "bdist_wheel") return null;
+  const stem = file3.filename.replace(/\.whl$/, "");
+  const parts = stem.split("-");
+  const tags = parts.slice(-3).join("-");
+  if (tags === WHEEL_TAG) return "sbx-wasm";
+  if (PURE_PYTHON_TAGS.includes(tags)) return "pure";
+  const [pythonTags = "", abiTags = "", platformTags = ""] = parts.slice(-3);
+  for (const python2 of pythonTags.split(".")) {
+    for (const abi of abiTags.split(".")) {
+      for (const platform of platformTags.split(".")) {
+        const tag2 = `${python2}-${abi}-${platform}`;
+        if (tag2 === WHEEL_TAG) return "sbx-wasm";
+        if (PURE_PYTHON_TAGS.includes(tag2)) return "pure";
+      }
+    }
+  }
+  return null;
+}
+function metadataUrlFor(file3) {
+  const declared = file3["core-metadata"] ?? file3.core_metadata;
+  return declared ? `${file3.url}.metadata` : null;
+}
+var KIND_RANK = { pure: 0, "sbx-wasm": 1, sdist: 2 };
+async function resolve2(options) {
+  const {
+    client,
+    environment,
+    signal,
+    deadlineMs = 18e4,
+    allowSourceBuilds = false,
+    progress
+  } = options;
+  const started = Date.now();
+  const checkBudget = () => {
+    if (signal?.aborted) throw new ResolutionError("dependency resolution was cancelled");
+    if (Date.now() - started > deadlineMs) {
+      throw new ResolutionError(
+        `dependency resolution exceeded its ${Math.round(deadlineMs / 1e3)}s budget. The graph explored so far is consistent but incomplete; constrain the requirements or raise the deadline.`
+      );
+    }
+  };
+  const releases = /* @__PURE__ */ new Map();
+  const dependencies = /* @__PURE__ */ new Map();
+  const nogoods = /* @__PURE__ */ new Map();
+  const candidatesFor = (name) => {
+    let pending = releases.get(name);
+    if (!pending) {
+      pending = fetchCandidates(client, name, allowSourceBuilds, options.index ?? null);
+      releases.set(name, pending);
+    }
+    return pending;
+  };
+  const requiresFor = (candidate) => {
+    const key = `${candidate.name}==${candidate.version}`;
+    let pending = dependencies.get(key);
+    if (!pending) {
+      pending = candidate.indexedRequires ? Promise.resolve(candidate.indexedRequires) : fetchRequires(client, candidate);
+      dependencies.set(key, pending);
+    }
+    return pending;
+  };
+  const roots = [];
+  for (const text2 of options.requirements) {
+    const requirement = parseRequirement(text2);
+    if (requirement) roots.push({ requirement, extras: requirement.extras, origin: "<root>" });
+  }
+  const skipped = [];
+  const signatureOf = (name, state) => {
+    const clauses = (state.constraints.get(name) ?? []).flatMap((entry) => entry.spec.map((s) => `${s.op}${s.version}`)).sort();
+    return `${name}|${[...new Set(clauses)].join(",")}`;
+  };
+  const search = async (queue, state) => {
+    checkBudget();
+    if (queue.length === 0) return state;
+    const [edge, ...rest] = queue;
+    const { requirement, extras, origin } = edge;
+    const name = requirement.name;
+    if (!markerApplies(requirement.marker, environment, extras)) {
+      if (requirement.marker) skipped.push({ name, marker: requirement.marker });
+      return search(rest, state);
+    }
+    const previous = state.constraints.get(name) ?? [];
+    const constraints = new Map(state.constraints);
+    constraints.set(name, [...previous, { spec: requirement.specifiers, origin }]);
+    const next = { chosen: state.chosen, constraints };
+    const already = next.chosen.get(name);
+    if (already) {
+      const satisfied = requirement.specifiers.every((s) => compareVersions(already.version, s.version, s.op));
+      if (!satisfied) {
+        throw new ResolutionError(
+          `cannot satisfy ${name}`,
+          explain(name, next.constraints, already.version)
+        );
+      }
+      return search(rest, next);
+    }
+    const signature = signatureOf(name, next);
+    const learned = nogoods.get(signature);
+    if (learned) throw learned;
+    progress?.collecting(name);
+    const all = await candidatesFor(name);
+    checkBudget();
+    const clauses = (next.constraints.get(name) ?? []).flatMap((entry) => entry.spec);
+    const viable = all.filter((candidate) => clauses.every((s) => compareVersions(candidate.version, s.version, s.op))).sort((a, b) => compareVersions(a.version, b.version, ">") ? -1 : compareVersions(b.version, a.version, ">") ? 1 : KIND_RANK[a.kind] - KIND_RANK[b.kind]);
+    if (viable.length === 0) {
+      const error2 = new ResolutionError(
+        all.length === 0 ? `no distribution of ${name} is usable by this runtime (it needs a pure-Python wheel or one tagged ${WHEEL_TAG})` : `no version of ${name} satisfies every requirement`,
+        explain(name, next.constraints, null, all)
+      );
+      nogoods.set(signature, error2);
+      throw error2;
+    }
+    let failure2 = null;
+    const seenVersions = /* @__PURE__ */ new Set();
+    for (const candidate of viable) {
+      if (seenVersions.has(candidate.version)) continue;
+      seenVersions.add(candidate.version);
+      checkBudget();
+      progress?.examining?.(candidate.name, candidate.version);
+      let requires;
+      try {
+        requires = await requiresFor(candidate);
+      } catch (error2) {
+        failure2 = new ResolutionError(
+          `could not read the dependencies of ${name} ${candidate.version}: ${error2.message}`
+        );
+        continue;
+      }
+      const edges = [];
+      for (const line of requires) {
+        const dependency = parseRequirement(line);
+        if (!dependency) continue;
+        if (!markerApplies(dependency.marker, environment, extras)) continue;
+        edges.push({
+          requirement: dependency,
+          extras: dependency.extras,
+          origin: `${name}==${candidate.version}`
+        });
+      }
+      const chosen = new Map(next.chosen);
+      chosen.set(name, { ...candidate, requires });
+      try {
+        return await search([...edges, ...rest], { chosen, constraints: next.constraints });
+      } catch (error2) {
+        if (!(error2 instanceof ResolutionError)) throw error2;
+        if (/cancelled|budget/.test(error2.message)) throw error2;
+        failure2 = error2;
+      }
+    }
+    const error = failure2 ?? new ResolutionError(`could not resolve ${name}`);
+    nogoods.set(signature, error);
+    throw error;
+  };
+  const solved = await search(roots, { chosen: /* @__PURE__ */ new Map(), constraints: /* @__PURE__ */ new Map() });
+  const distributions = [...solved.chosen.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return { distributions, skipped };
+}
+function explain(name, constraints, chosenVersion, available = []) {
+  const lines = [];
+  for (const entry of constraints.get(name) ?? []) {
+    if (entry.spec.length === 0) continue;
+    const text2 = entry.spec.map((s) => `${s.op}${s.version}`).join(", ");
+    lines.push(`${entry.origin} requires ${name} ${text2}`);
+  }
+  if (chosenVersion) lines.push(`but ${name} ${chosenVersion} is already selected`);
+  if (available.length > 0) {
+    const versions = [...new Set(available.map((c) => c.version))].slice(0, 8);
+    lines.push(`usable versions: ${versions.join(", ")}${available.length > 8 ? ", ..." : ""}`);
+  }
+  return lines;
+}
+async function fetchCandidates(client, name, allowSourceBuilds, prebuilt) {
+  const candidates = [];
+  for (const wheel of prebuilt?.wheels ?? []) {
+    if (normalize2(wheel.name) !== normalize2(name)) continue;
+    if (wheel.abiId !== EXTENSION_ABI.abiId) {
+      throw new ResolutionError(
+        `${wheel.filename} in the wheel index was built for ABI ${wheel.abiId}, but this runtime implements ${EXTENSION_ABI.abiId}; rebuild it`
+      );
+    }
+    candidates.push({
+      name: normalize2(wheel.name),
+      version: wheel.version,
+      kind: "sbx-wasm",
+      url: `${prebuilt.baseUrl.replace(/\/$/, "")}/${wheel.filename}`,
+      filename: wheel.filename,
+      sha256: wheel.sha256,
+      metadataUrl: null,
+      indexedRequires: wheel.requires
+    });
+  }
+  let index;
+  try {
+    index = await client.json(`https://pypi.org/pypi/${name}/json`, { timeoutMs: 3e4 });
+  } catch (error) {
+    if (candidates.length > 0) return candidates;
+    throw error;
+  }
+  for (const [version, files] of Object.entries(index.releases ?? {})) {
+    if (isPreRelease(version)) continue;
+    for (const file3 of files) {
+      if (file3.yanked) continue;
+      const kind = classifyFile(file3, allowSourceBuilds);
+      if (!kind) continue;
+      candidates.push({
+        name: normalize2(name),
         version,
-        url: wheel.url,
-        filename: wheel.filename,
-        sha256: wheel.digests?.sha256 ?? "",
-        requires: []
+        kind,
+        url: file3.url,
+        filename: file3.filename,
+        sha256: file3.digests?.sha256 ?? "",
+        metadataUrl: metadataUrlFor(file3)
       });
-      continue;
     }
-    if (files.some((file3) => file3.packagetype === "sdist")) sawSourceOnly = true;
   }
-  if (resolved.length > 0) return resolved;
-  if (ordered.length === 0) {
+  return candidates;
+}
+function isPreRelease(version) {
+  return /(a|b|rc|dev)\d*$/i.test(version.replace(/^\d+(\.\d+)*/, ""));
+}
+async function fetchRequires(client, candidate) {
+  if (candidate.metadataUrl) {
+    const text2 = await client.text(candidate.metadataUrl, { timeoutMs: 3e4 });
+    return requiresFromMetadata(text2);
+  }
+  if (candidate.kind === "sdist") {
     throw new Error(
-      `no version of ${requirement.name} matches ${describe(requirement)}`
+      `${candidate.name} ${candidate.version} is a source distribution and publishes no metadata sidecar, so its dependencies cannot be read without building it`
     );
   }
-  throw new Error(
-    sawSourceOnly ? `${requirement.name} ${ordered[0]} publishes only a source distribution, and this runtime cannot build one yet (source builds are a later milestone)` : `${requirement.name} ${ordered[0]} has no wheel this runtime can use; it needs one tagged ` + ACCEPTED_TAGS.join(" or ")
-  );
+  const { readZip: readZip2 } = await Promise.resolve().then(() => (init_zip(), zip_exports));
+  const entries = readZip2(await client.bytes(candidate.url, { timeoutMs: 12e4 }));
+  const metadata = entries.find((entry) => /\.dist-info\/METADATA$/.test(entry.name));
+  if (!metadata) return [];
+  return requiresFromMetadata(new TextDecoder().decode(metadata.data()));
 }
-function pickWheel(files) {
-  const wheels = files.filter((file3) => file3.packagetype === "bdist_wheel");
-  for (const tag2 of ACCEPTED_TAGS) {
-    const match2 = wheels.find((file3) => file3.filename.endsWith(`-${tag2}.whl`));
-    if (match2) return match2;
+function requiresFromMetadata(text2) {
+  const result = [];
+  for (const line of text2.split(/\r?\n/)) {
+    if (line === "") break;
+    if (line.startsWith("Requires-Dist:")) result.push(line.slice("Requires-Dist:".length).trim());
   }
-  return null;
-}
-function describe(requirement) {
-  return requirement.specifiers.length === 0 ? "any version" : requirement.specifiers.map((s) => `${s.op}${s.version}`).join(", ");
-}
-function splitOnce(text2, separator) {
-  const at = text2.indexOf(separator);
-  return at < 0 ? [text2] : [text2.slice(0, at), text2.slice(at + 1)];
+  return result;
 }
 
 // src/runtime/python/install.ts
@@ -19425,123 +19664,45 @@ function markerEnvironment(pythonVersion) {
 }
 async function installRequirements(options) {
   const environment = markerEnvironment(options.pythonVersion);
-  const report = { installed: [], skipped: [] };
-  const queue = [];
-  for (const text2 of options.requirements) {
-    const requirement = parseRequirement(text2);
-    if (requirement) queue.push({ requirement, extras: requirement.extras });
-  }
-  const archives = /* @__PURE__ */ new Map();
-  const unavailable2 = /* @__PURE__ */ new Set();
-  const candidateCache = /* @__PURE__ */ new Map();
-  const solve = async (pending, state) => {
-    if (pending.length === 0) return state;
-    const [first, ...tail2] = pending;
-    let { requirement, extras } = first;
-    const rest = [];
-    const mergedSpecifiers = [...requirement.specifiers];
-    const mergedExtras = new Set(extras);
-    for (const item of tail2) {
-      if (item.requirement.name === requirement.name && markerApplies(item.requirement.marker, environment, item.extras)) {
-        mergedSpecifiers.push(...item.requirement.specifiers);
-        for (const extra of item.extras) mergedExtras.add(extra);
-      } else {
-        rest.push(item);
-      }
-    }
-    requirement = { ...requirement, specifiers: mergedSpecifiers };
-    extras = [...mergedExtras];
-    if (!markerApplies(requirement.marker, environment, extras)) {
-      return solve(rest, {
-        ...state,
-        skipped: [...state.skipped, { name: requirement.name, marker: requirement.marker ?? "" }]
-      });
-    }
-    const already = state.chosen.get(requirement.name);
-    if (already) {
-      const satisfied = requirement.specifiers.every(
-        (s) => compareVersions(already.version, s.version, s.op)
+  const solved = await resolve2({
+    client: options.client,
+    requirements: options.requirements,
+    environment,
+    index: options.index ?? null,
+    ...options.deadlineMs === void 0 ? {} : { deadlineMs: options.deadlineMs },
+    ...options.signal === void 0 ? {} : { signal: options.signal },
+    allowSourceBuilds: options.allowSourceBuilds ?? false,
+    progress: { collecting: (name) => options.progress.collecting(name) }
+  });
+  const staged = [];
+  const installed2 = [];
+  for (const distribution of solved.distributions) {
+    if (distribution.kind === "sdist") {
+      throw new ResolutionError(
+        `${distribution.name} ${distribution.version} resolved to a source distribution, and no local builder is configured to build it for this runtime`
       );
-      if (!satisfied) {
-        throw new Error(
-          `${requirement.name} ${already.version} is already selected but another dependency needs ` + requirement.specifiers.map((s) => `${s.op}${s.version}`).join(", ")
-        );
-      }
-      return solve(rest, state);
-    }
-    options.progress.collecting(requirement.name);
-    if (unavailable2.has(requirement.name)) {
-      throw new Error(`${requirement.name} has no wheel this runtime can use`);
-    }
-    const candidateKey = `${requirement.name}:${requirement.specifiers.map((s) => `${s.op}${s.version}`).join(",")}`;
-    let candidatePromise = candidateCache.get(candidateKey);
-    if (!candidatePromise) {
-      candidatePromise = resolvePackageCandidates(options.client, requirement);
-      candidateCache.set(candidateKey, candidatePromise);
-    }
-    let candidates;
-    try {
-      candidates = await candidatePromise;
-    } catch (error) {
-      const anyKey = `${requirement.name}:`;
-      let anyPromise = candidateCache.get(anyKey);
-      if (!anyPromise) {
-        anyPromise = resolvePackageCandidates(
-          options.client,
-          { ...requirement, specifiers: [] });
-        candidateCache.set(anyKey, anyPromise);
-      }
-      try {
-        await anyPromise;
-      } catch {
-        unavailable2.add(requirement.name);
-      }
-      throw error;
-    }
-    let failure2;
-    for (const resolved of candidates) {
-      try {
-        let entries = archives.get(resolved.url);
-        if (!entries) {
-          options.progress.downloading(resolved.name, resolved.version);
-          entries = readZip(await options.client.bytes(resolved.url));
-          archives.set(resolved.url, entries);
-        }
-        const dependencies = [];
-        const metadata = entries.find((entry) => /\.dist-info\/METADATA$/.test(entry.name));
-        if (metadata) {
-          for (const line of new TextDecoder().decode(metadata.data()).split(/\r?\n/)) {
-            if (!line.startsWith("Requires-Dist:")) continue;
-            const dependency = parseRequirement(line.slice("Requires-Dist:".length));
-            if (dependency && markerApplies(dependency.marker, environment, extras)) {
-              dependencies.push({ requirement: dependency, extras: dependency.extras });
-            }
-          }
-        }
-        const chosen = new Map(state.chosen);
-        chosen.set(requirement.name, resolved);
-        return await solve([...dependencies, ...rest], {
-          chosen,
-          staged: [...state.staged, ...stageWheel(entries, resolved)],
-          installed: [...state.installed, { name: resolved.name, version: resolved.version }],
-          skipped: state.skipped
-        });
-      } catch (error) {
-        failure2 = error;
-      }
     }
-    throw failure2 instanceof Error ? failure2 : new Error(`could not resolve ${requirement.name}`);
-  };
-  const solved = await solve(queue, {
-    chosen: /* @__PURE__ */ new Map(),
-    staged: [],
-    installed: [],
-    skipped: []
-  });
-  report.installed = solved.installed;
-  report.skipped = solved.skipped;
-  commit(options.vfs, options.cred, solved.staged);
-  return report;
+    options.progress.downloading(distribution.name, distribution.version);
+    const bytes2 = await options.client.bytes(distribution.url, { timeoutMs: 12e4 });
+    verifyDigest(distribution, bytes2);
+    staged.push(...stageWheel(readZip(bytes2)));
+    installed2.push({ name: distribution.name, version: distribution.version });
+  }
+  commit(options.vfs, options.cred, staged);
+  return { installed: installed2, skipped: solved.skipped };
+}
+function verifyDigest(distribution, bytes2) {
+  if (!distribution.sha256) {
+    throw new Error(
+      `${distribution.filename} was published without a sha256 digest, so it cannot be verified`
+    );
+  }
+  const actual = [...sha256(bytes2)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (actual !== distribution.sha256) {
+    throw new Error(
+      `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}`
+    );
+  }
 }
 function stageWheel(entries, resolved) {
   const staged = [];
@@ -19764,34 +19925,52 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
         "outbound network access is disabled for this container (enable with network: { allowOutbound: true })"
       );
     }
-    const jsonCache = /* @__PURE__ */ new Map();
-    const bytesCache = /* @__PURE__ */ new Map();
-    const client = {
-      async json(url) {
-        let pending = jsonCache.get(url);
-        if (!pending) {
-          pending = fetch(url).then((response) => {
-            if (!response.ok) throw new Error(`${url} answered ${response.status}`);
-            return response.json();
-          });
-          jsonCache.set(url, pending);
-        }
-        return pending;
-      },
-      async bytes(url) {
-        let pending = bytesCache.get(url);
-        if (!pending) {
-          pending = fetch(url).then(async (response) => {
-            if (!response.ok) throw new Error(`${url} answered ${response.status}`);
-            return new Uint8Array(await response.arrayBuffer());
-          });
-          bytesCache.set(url, pending);
+    const cache = /* @__PURE__ */ new Map();
+    const request = async (url, timeoutMs, read) => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+      try {
+        const response = await fetch(url, { signal: controller.signal });
+        if (!response.ok) throw new Error(`${url} answered ${response.status}`);
+        return await read(response);
+      } catch (error) {
+        if (controller.signal.aborted) {
+          throw new Error(`${url} did not answer within ${Math.round(timeoutMs / 1e3)}s`);
         }
-        return pending;
+        throw error;
+      } finally {
+        clearTimeout(timer);
       }
     };
+    const once = (url, produce) => {
+      let pending = cache.get(url);
+      if (!pending) {
+        pending = produce();
+        cache.set(url, pending);
+      }
+      return pending;
+    };
+    const client = {
+      json: (url, o) => once(`json:${url}`, () => request(url, o?.timeoutMs ?? 3e4, (r) => r.json())),
+      text: (url, o) => once(`text:${url}`, () => request(url, o?.timeoutMs ?? 3e4, (r) => r.text())),
+      bytes: (url, o) => once(`bytes:${url}`, () => request(url, o?.timeoutMs ?? 12e4, async (r) => new Uint8Array(await r.arrayBuffer())))
+    };
+    let index = null;
+    const configured = pythonBackend().wheelIndex ?? null;
+    if (typeof configured === "string") {
+      try {
+        const url = configured.replace(/\/$/, "");
+        const loaded = await client.json(`${url}/index.json`);
+        index = { baseUrl: url, wheels: loaded.wheels ?? [] };
+      } catch (error) {
+        return ctx.fail(`could not read the wheel index at ${configured}: ${error.message}`);
+      }
+    } else if (configured) {
+      index = configured;
+    }
     try {
       const report = await installRequirements({
+        index,
         client,
         vfs: ctx.vfs,
         cred: ctx.cred,
@@ -21236,7 +21415,8 @@ function configurePython(options = {}) {
   setPythonBackend({
     ...options.backend !== void 0 ? { backend: options.backend } : {},
     ...options.manifest !== void 0 ? { manifest: options.manifest } : {},
-    ...options.workerUrl !== void 0 ? { workerUrl: options.workerUrl } : {}
+    ...options.workerUrl !== void 0 ? { workerUrl: options.workerUrl } : {},
+    ...options.wheelIndex !== void 0 ? { wheelIndex: options.wheelIndex } : {}
   });
 }
 var isPythonAvailable = isCPythonAvailable;
@@ -25166,10 +25346,10 @@ function promisify(original) {
   const override = original[promisifyCustom];
   if (typeof override === "function") return override;
   const wrapped = function(...args) {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       original.call(this, ...args, (error, ...values) => {
         if (error) reject(error);
-        else resolve2(values.length > 1 ? values : values[0]);
+        else resolve3(values.length > 1 ? values : values[0]);
       });
     });
   };
@@ -25367,14 +25547,14 @@ var AssertionError = class extends Error {
   code = "ERR_ASSERTION";
   constructor(options) {
     const generated = options.message === void 0;
-    super(options.message ?? describe2(options.actual, options.expected, options.operator));
+    super(options.message ?? describe(options.actual, options.expected, options.operator));
     this.actual = options.actual;
     this.expected = options.expected;
     this.operator = options.operator;
     this.generatedMessage = generated;
   }
 };
-function describe2(actual, expected, operator) {
+function describe(actual, expected, operator) {
   if (operator === "fail") return "Failed";
   const rendered = (value) => inspect(value, { depth: 2 });
   return `${rendered(actual)} ${operator} ${rendered(expected)}`;
@@ -25748,8 +25928,8 @@ var VirtualServerResponse = class extends streamModule4.Writable {
   constructor(request) {
     super();
     this.req = request;
-    this.completed = new Promise((resolve2) => {
-      this.resolve = resolve2;
+    this.completed = new Promise((resolve3) => {
+      this.resolve = resolve3;
     });
   }
   _write(chunk, encoding, callback) {
@@ -26926,7 +27106,7 @@ function createReadlineModule(defaultInput, defaultOutput = () => void 0) {
         this.pending.push(callback);
         return;
       }
-      return new Promise((resolve2) => this.pending.push(resolve2));
+      return new Promise((resolve3) => this.pending.push(resolve3));
     }
     prompt() {
       this.output?.write?.(this.promptText);
@@ -27083,14 +27263,14 @@ function createReadlineModule(defaultInput, defaultOutput = () => void 0) {
           yield line;
           continue;
         }
-        const next = await new Promise((resolve2) => {
+        const next = await new Promise((resolve3) => {
           const onLine = (value) => {
             cleanup();
-            resolve2(value);
+            resolve3(value);
           };
           const onClose = () => {
             cleanup();
-            resolve2(null);
+            resolve3(null);
           };
           const cleanup = () => {
             this.off("line", onLine);
@@ -27467,13 +27647,13 @@ var ASYNC_FS_METHODS = [
   "exists"
 ];
 function createPathModule(cwd) {
-  const resolve2 = (...segments2) => pathModule.resolve(cwd(), ...segments2);
+  const resolve3 = (...segments2) => pathModule.resolve(cwd(), ...segments2);
   const path = {
     ...pathModule,
-    resolve: resolve2,
+    resolve: resolve3,
     /* `relative` resolves both operands, and the implementation would do so
      * against the host cwd, so they are resolved here first. */
-    relative: (from, to) => pathModule.relative(resolve2(from), resolve2(to))
+    relative: (from, to) => pathModule.relative(resolve3(from), resolve3(to))
   };
   path.posix = path;
   path.win32 = pathModule.win32 ?? path;
@@ -28137,8 +28317,8 @@ function createTrackedTimers() {
 }
 function createTimerPromises(timers) {
   return {
-    setTimeout: (delay, value) => new Promise((resolve2) => timers.setTimeout(resolve2, delay, value)),
-    setImmediate: (value) => new Promise((resolve2) => timers.setImmediate(resolve2, value))
+    setTimeout: (delay, value) => new Promise((resolve3) => timers.setTimeout(resolve3, delay, value)),
+    setImmediate: (value) => new Promise((resolve3) => timers.setImmediate(resolve3, value))
   };
 }
 function createAsyncHooksModule() {
@@ -28217,12 +28397,12 @@ function createAsyncHooksModule() {
 }
 function createStreamPromises() {
   return {
-    pipeline: (...streams) => new Promise((resolve2, reject) => {
-      const callback = (error) => error ? reject(error) : resolve2();
+    pipeline: (...streams) => new Promise((resolve3, reject) => {
+      const callback = (error) => error ? reject(error) : resolve3();
       streamModule4.pipeline(...streams, callback);
     }),
-    finished: (stream) => new Promise((resolve2, reject) => {
-      streamModule4.finished(stream, (error) => error ? reject(error) : resolve2());
+    finished: (stream) => new Promise((resolve3, reject) => {
+      streamModule4.finished(stream, (error) => error ? reject(error) : resolve3());
     })
   };
 }
@@ -29286,8 +29466,8 @@ var LocalProcess = class extends EventEmitter4 {
     this.task = task;
     super.on("error", () => {
     });
-    this.completion = new Promise((resolve2) => {
-      this.resolveCompletion = resolve2;
+    this.completion = new Promise((resolve3) => {
+      this.resolveCompletion = resolve3;
     });
     setTimeout(() => void this.start(), 0);
   }
@@ -29304,8 +29484,8 @@ var LocalProcess = class extends EventEmitter4 {
   pendingInput = [];
   resolveKilled;
   cleanup;
-  killedPromise = new Promise((resolve2) => {
-    this.resolveKilled = resolve2;
+  killedPromise = new Promise((resolve3) => {
+    this.resolveKilled = resolve3;
   });
   on(event, listener) {
     return super.on(event, listener);
@@ -29735,7 +29915,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
       const busy = this.router.referencedPorts(owner).length > 0 || pendingHandles() > 0 || pendingRequests() > 0 || readingStdin();
       idleTurns = busy ? 0 : idleTurns + 1;
       if (idleTurns >= DRAIN_TURNS) return;
-      await new Promise((resolve2) => setTimeout(resolve2, busy ? 5 : 0));
+      await new Promise((resolve3) => setTimeout(resolve3, busy ? 5 : 0));
     }
   }
   async request(_port, _init = {}) {
@@ -29921,8 +30101,8 @@ var WorkerProcess = class extends EventEmitter4 {
     this.release = release;
     super.on("error", () => {
     });
-    this.completion = new Promise((resolve2) => {
-      this.resolveCompletion = resolve2;
+    this.completion = new Promise((resolve3) => {
+      this.resolveCompletion = resolve3;
     });
   }
   worker;
@@ -30164,7 +30344,7 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
   }
   /** Run a child to completion and collect it, for the guest's `spawnSync`. */
   runChildToCompletion(request, streamTo, owned) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let handle;
       try {
         handle = this.processManager.spawn({
@@ -30176,7 +30356,7 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
         });
       } catch (error) {
         const failure2 = error;
-        resolve2({ status: null, stdout: "", stderr: "", signal: null, error: { ...failure2.code ? { code: failure2.code } : {}, message: failure2.message } });
+        resolve3({ status: null, stdout: "", stderr: "", signal: null, error: { ...failure2.code ? { code: failure2.code } : {}, message: failure2.message } });
         return;
       }
       owned.add(handle);
@@ -30194,7 +30374,7 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
         stderr += text2;
         live?.error(text2);
       });
-      handle.on("exit", (code) => resolve2({ status: code, stdout, stderr, signal: null }));
+      handle.on("exit", (code) => resolve3({ status: code, stdout, stderr, signal: null }));
       handle.exec();
       if (request.input !== void 0) {
         handle.sendStdin?.(request.input);
@@ -30233,7 +30413,7 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
     for await (const chunk of request) chunks.push(chunk);
     const body = concat5(chunks);
     const id = this.nextRequestId++;
-    const answered = new Promise((resolve2) => this.waiting.set(id, resolve2));
+    const answered = new Promise((resolve3) => this.waiting.set(id, resolve3));
     worker.postMessage({
       type: "http-request",
       id,
@@ -30280,10 +30460,10 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
     });
   }
   settleProxied(id, response) {
-    const resolve2 = this.waiting.get(id);
-    if (!resolve2) return;
+    const resolve3 = this.waiting.get(id);
+    if (!resolve3) return;
     this.waiting.delete(id);
-    resolve2(response);
+    resolve3(response);
   }
   closeProxies(owner) {
     for (const [port, server] of [...this.proxies]) {
@@ -30495,7 +30675,7 @@ var Container = class _Container {
     try {
       exitCode = timeoutMs === void 0 ? await shell.execute(command, io) : await Promise.race([
         shell.execute(command, io),
-        new Promise((resolve2) => setTimeout(() => resolve2(137), timeoutMs + 500))
+        new Promise((resolve3) => setTimeout(() => resolve3(137), timeoutMs + 500))
       ]);
     } finally {
       if (timer) clearTimeout(timer);
@@ -30758,16 +30938,16 @@ var Container = class _Container {
     });
     const hostPort = opts.hostPort ?? 0;
     const hostname = opts.hostname ?? "127.0.0.1";
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       server.once("error", reject);
-      server.listen(hostPort, hostname, () => resolve2());
+      server.listen(hostPort, hostname, () => resolve3());
     });
     const address = server.address();
     const actualPort = typeof address === "object" && address ? address.port : hostPort;
     return {
       url: `http://${hostname}:${actualPort}`,
       port: actualPort,
-      close: () => new Promise((resolve2) => server.close(() => resolve2()))
+      close: () => new Promise((resolve3) => server.close(() => resolve3()))
     };
   }
   // ── persistence ───────────────────────────────────────────────────────────
@@ -31331,18 +31511,18 @@ async function createPreview(box, options = {}) {
   const worker = registration.active ?? registration.waiting ?? registration.installing;
   if (!worker) return null;
   if (worker.state !== "activated") {
-    const activated = await new Promise((resolve2) => {
+    const activated = await new Promise((resolve3) => {
       const check = () => {
         if (worker.state === "activated") {
           worker.removeEventListener("statechange", check);
-          resolve2(true);
+          resolve3(true);
         } else if (worker.state === "redundant") {
           worker.removeEventListener("statechange", check);
-          resolve2(false);
+          resolve3(false);
         }
       };
       worker.addEventListener("statechange", check);
-      setTimeout(() => resolve2(worker.state === "activated"), 1e4);
+      setTimeout(() => resolve3(worker.state === "activated"), 1e4);
       check();
     });
     if (!activated) return null;