@jerryan/just-bash 3.10.0 → 3.11.1

package/dist/commands/mktemp/mktemp.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeCommand } from "../../types.js";
+export declare const mktempCommand: RuntimeCommand;
+import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
+export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/registry.d.ts

@@ -1,6 +1,6 @@
 import type { RuntimeCommand } from "../types.js";
 /** All available built-in command names (excludes network commands) */
-export type CommandName = "echo" | "cat" | "printf" | "ls" | "mkdir" | "rmdir" | "touch" | "rm" | "cp" | "mv" | "ln" | "chmod" | "pwd" | "readlink" | "head" | "tail" | "wc" | "stat" | "grep" | "fgrep" | "egrep" | "rg" | "sed" | "awk" | "sort" | "uniq" | "comm" | "cut" | "paste" | "tr" | "rev" | "nl" | "fold" | "expand" | "unexpand" | "strings" | "split" | "column" | "join" | "tee" | "find" | "basename" | "dirname" | "tree" | "du" | "env" | "printenv" | "alias" | "unalias" | "history" | "xargs" | "true" | "false" | "clear" | "bash" | "sh" | "jq" | "base64" | "diff" | "date" | "sleep" | "timeout" | "seq" | "expr" | "md5sum" | "sha1sum" | "sha256sum" | "file" | "html-to-markdown" | "help" | "which" | "tac" | "hostname" | "od" | "gzip" | "gunzip" | "zcat" | "tar" | "yq" | "xan" | "sqlite3" | "time" | "whoami";
+export type CommandName = "echo" | "cat" | "printf" | "ls" | "mkdir" | "mktemp" | "rmdir" | "touch" | "rm" | "cp" | "mv" | "ln" | "chmod" | "pwd" | "readlink" | "head" | "tail" | "wc" | "stat" | "grep" | "fgrep" | "egrep" | "rg" | "sed" | "awk" | "sort" | "uniq" | "comm" | "cut" | "paste" | "tr" | "rev" | "nl" | "fold" | "expand" | "unexpand" | "strings" | "split" | "column" | "join" | "tee" | "find" | "basename" | "dirname" | "tree" | "du" | "env" | "printenv" | "alias" | "unalias" | "history" | "xargs" | "true" | "false" | "yes" | "clear" | "bash" | "sh" | "jq" | "base64" | "diff" | "date" | "sleep" | "timeout" | "seq" | "expr" | "md5sum" | "sha1sum" | "sha256sum" | "file" | "html-to-markdown" | "help" | "which" | "tac" | "hostname" | "od" | "gzip" | "gunzip" | "zcat" | "tar" | "yq" | "xan" | "sqlite3" | "time" | "whoami";
 /** Network command names (only available when network is configured) */
 export type NetworkCommandName = "curl";
 /** Python command names (only available when python is explicitly enabled) */

package/dist/commands/yes/yes.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeCommand } from "../../types.js";
+export declare const yesCommand: RuntimeCommand;
+import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
+export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/custom-commands.d.ts

@@ -66,5 +66,12 @@ export declare function defineCommand(name: string, execute: (args: string[], ct
 /**
  * Create a lazy-loaded wrapper for a custom command.
  * The command is only loaded when first executed.
+ *
+ * The load is shared, and waiters can detach from it. Both properties matter
+ * once an invocation can be cancelled: a cancelled waiter must not start a
+ * competing load, and it must not stay attached to a load that may never
+ * settle. Keeping only the waiter's own promise lets a cancelled waiter be
+ * collected instead of being retained by the shared load, so repeated
+ * cancellations cannot accumulate.
  */
 export declare function createLazyCustomCommand(lazy: LazyCommand): Command;

package/dist/fs/create-exclusive.d.ts

@@ -0,0 +1,30 @@
+import type { CreateExclusiveOptions, IFileSystem } from "./interface.js";
+/**
+ * Thrown when the filesystem cannot create an entry atomically, either
+ * because it does not implement `createExclusive` or because a delegating
+ * filesystem routes to a backend that does not.
+ *
+ * This is a type rather than an error message because backend errors embed
+ * the caller-supplied path: matching text would let a template containing the
+ * literal "ENOSYS" turn a genuine EEXIST into a spurious "unsupported".
+ */
+export declare class ExclusiveCreateUnsupportedError extends Error {
+    readonly code = "ENOSYS";
+    constructor(path: string, syscall: string);
+}
+/**
+ * Create a file or directory that must not already exist, with `mode` applied
+ * at creation time.
+ *
+ * There is deliberately no fallback for filesystems lacking
+ * `createExclusive`. Exclusivity and privacy cannot be synthesised from
+ * separate check, create and chmod calls: between them a concurrent actor can
+ * take the name and have its entry truncated, or install a symlink so the
+ * write lands on its target, and the entry is briefly readable at the
+ * backend's default mode either way. A caller asking for an exclusive private
+ * entry that silently received a racy one is worse off than a caller told the
+ * filesystem cannot provide it, so this fails loudly instead.
+ *
+ * @throws ExclusiveCreateUnsupportedError if the filesystem cannot do this
+ */
+export declare function createExclusiveOn(fs: Pick<IFileSystem, "createExclusive">, path: string, options: CreateExclusiveOptions): Promise<void>;

package/dist/fs/in-memory-fs/in-memory-fs.d.ts

@@ -1,5 +1,5 @@
 import { type ByteString } from "../../encoding.js";
-import type { BufferEncoding, CpOptions, DirectoryEntry, DirentEntry, FileContent, FileEntry, FsEntry, FsStat, IFileSystem, InitialFiles, LazyFileEntry, MkdirOptions, ReadFileOptions, RmOptions, SymlinkEntry, WriteFileOptions } from "../interface.js";
+import type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, DirentEntry, FileContent, FileEntry, FsEntry, FsStat, IFileSystem, InitialFiles, LazyFileEntry, MkdirOptions, ReadFileOptions, RmOptions, SymlinkEntry, WriteFileOptions } from "../interface.js";
 export type { BufferEncoding, FileContent, FileEntry, LazyFileEntry, DirectoryEntry, SymlinkEntry, FsEntry, FsStat, IFileSystem, };
 export interface FsData {
     [path: string]: FsEntry;
@@ -68,6 +68,13 @@ export declare class InMemoryFs implements IFileSystem {
      */
     private resolvePathWithSymlinks;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. Execution is single-threaded, so the existence check and the
+     * insert cannot be interleaved; `this.data` is keyed by normalized path, so
+     * a symlink occupying the name is seen as a collision rather than followed.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Synchronous version of mkdir
      */

package/dist/fs/interface.d.ts

@@ -77,6 +77,20 @@ export interface FsStat {
 export interface MkdirOptions {
     recursive?: boolean;
 }
+/**
+ * Options for createExclusive operation
+ */
+export interface CreateExclusiveOptions {
+    /**
+     * Permission bits applied at creation time, e.g. 0o600 for a private file
+     * or 0o700 for a private directory. Applied by the creating operation
+     * itself so the entry is never briefly visible with the
+     * backend's default mode.
+     */
+    mode: number;
+    /** Create a directory instead of an empty regular file. */
+    directory?: boolean;
+}
 /**
  * Options for rm operation
  */
@@ -164,6 +178,29 @@ export interface IFileSystem {
      * @throws Error if parent doesn't exist (unless recursive) or path exists
      */
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a file or directory that must not already exist, with
+     * `options.mode` applied by the creating operation itself.
+     *
+     * This is the primitive `mktemp`-style callers need: a plain
+     * `exists()`-then-`writeFile()` sequence is a TOCTOU race (a concurrent
+     * creator can win between the two calls and have its entry truncated), and
+     * a `writeFile()`-then-`chmod()` sequence exposes the entry with the
+     * backend's default mode (typically 0644/0755) until the chmod lands.
+     *
+     * The final path component is never followed: a symlink already occupying
+     * the name is a collision, not a target to write through.
+     *
+     * Optional for backwards compatibility with external `IFileSystem`
+     * implementations written before this method existed; all built-in
+     * filesystems implement it. Callers should route through
+     * `createExclusiveOn`, which reports a filesystem that cannot do this
+     * rather than substituting a non-atomic sequence.
+     *
+     * @throws Error with an `EEXIST` code if the path already exists
+     * @throws Error with an `ENOENT` code if the parent does not exist
+     */
+    createExclusive?(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Read directory contents
      * @returns Array of entry names (not full paths)

package/dist/fs/mountable-fs/mountable-fs.d.ts

@@ -1,5 +1,5 @@
 import { type ByteString } from "../../encoding.js";
-import type { BufferEncoding, CpOptions, FileContent, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { BufferEncoding, CpOptions, CreateExclusiveOptions, FileContent, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 import type { OverlayDiff } from "../overlay-fs/overlay-fs.js";
 /**
  * Configuration for a mount point
@@ -109,6 +109,13 @@ export declare class MountableFs implements IFileSystem {
     stat(path: string): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist, routed to the owning filesystem. A backend without
+     * `createExclusive` reports ENOSYS so callers can pick a fallback rather
+     * than silently getting non-exclusive creation.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     readdir(path: string): Promise<string[]>;
     rm(path: string, options?: RmOptions): Promise<void>;
     cp(src: string, dest: string, options?: CpOptions): Promise<void>;
@@ -134,5 +141,15 @@ export declare class MountableFs implements IFileSystem {
      * @param atime - Access time
      * @param mtime - Modification time
      */
+    /**
+     * Synchronous mkdir, routed to the filesystem that owns the path.
+     * @throws Error if that filesystem has no synchronous writes
+     */
+    mkdirSync(path: string, options?: MkdirOptions): void;
+    /**
+     * Synchronous writeFile, routed to the filesystem that owns the path.
+     * @throws Error if that filesystem has no synchronous writes
+     */
+    writeFileSync(path: string, content: string | Uint8Array): void;
     utimes(path: string, atime: Date, mtime: Date): Promise<void>;
 }

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -21,7 +21,7 @@
  */
 import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
-import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { CpOptions, CreateExclusiveOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 /** Kind of entry recorded in an {@link OverlayWrite}. */
 export type OverlayNodeType = "file" | "directory" | "symlink";
 /**
@@ -332,6 +332,24 @@ export declare class OverlayFs implements IFileSystem {
      */
     private realTargetToVirtual;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. A name is taken when a live entry shadows it in the upper layer
+     * or when the lower layer holds it without a covering whiteout; a
+     * whiteout means the name is free and is cleared by the create (attach
+     * for a file, resurrection via ensureDirs for a directory), so the new
+     * entry is visible to stat/exists/readdir.
+     *
+     * The final component is never followed: an upper symlink at the name is
+     * a live entry (EEXIST), and the lower-layer probe uses lstat. Symlinks
+     * in the parent ARE resolved, so the entry lands where later lookups —
+     * which resolve — will find it.
+     *
+     * Every await happens before the claim; from the final descend() to the
+     * attach() there is no yield, so two interleaved calls cannot both claim
+     * the name.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Core readdir implementation that returns entries with file types.
      * Both readdir and readdirWithFileTypes use this shared implementation.

package/dist/fs/read-write-fs/read-write-fs.d.ts

@@ -12,7 +12,7 @@
  */
 import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
-import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { CpOptions, CreateExclusiveOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 export interface ReadWriteFsOptions {
     /**
      * The root directory on the real filesystem.
@@ -65,6 +65,8 @@ export declare class ReadWriteFs implements IFileSystem {
      * Validate the parent directory of a path (for operations like lstat/readlink
      * that should not follow the final component's symlink).
      * Returns the canonical parent joined with the original basename.
+     * The root's parent is outside the sandbox and always fails this check,
+     * so callers that accept the root validate it with resolveAndValidate().
      */
     private validateParent;
     /**
@@ -95,6 +97,25 @@ export declare class ReadWriteFs implements IFileSystem {
     stat(path: string): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. `O_CREAT|O_EXCL` (and `mkdir`) are exclusive in the kernel, so a
+     * concurrent host process cannot win a race between a check and the create,
+     * and the mode is applied by the creating syscall rather than a later
+     * chmod — the entry is never on disk with the default 0644/0755. POSIX
+     * requires `O_EXCL` to fail on a symlink at the final component, so a
+     * pre-planted link is a collision instead of a write-through target.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
+    private createExclusiveUnlocked;
+    /**
+     * Verify that an entry just created at `canonical` is still the entry at
+     * that pathname. O_EXCL and O_NOFOLLOW bind only the final component, so a
+     * concurrent host process swapping an intermediate directory for a symlink
+     * could place the entry outside the root; compare device and inode of the
+     * created descriptor against a re-validated lstat to detect the swap.
+     */
+    private assertCreatedInsideRoot;
     private mkdirUnlocked;
     readdir(path: string): Promise<string[]>;
     readdirWithFileTypes(path: string): Promise<DirentEntry[]>;

package/dist/index.d.cts

@@ -10,7 +10,7 @@ export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { FsError, fsErrorCode, isFsErrorCode, toFsError, } from "./fs/fs-error.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
-export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
+export type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
 export { applyDiffToRealFs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { FsError, fsErrorCode, isFsErrorCode, toFsError, } from "./fs/fs-error.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
-export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
+export type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
 export { applyDiffToRealFs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";

package/dist/interpreter/expansion/array-prefix-suffix.d.ts

@@ -26,8 +26,9 @@ export type ExpandPartFn = (ctx: InterpreterContext, part: WordPart) => Promise<
  */
 export type ExpandWordPartsAsyncFn = (ctx: InterpreterContext, parts: WordPart[]) => Promise<string>;
 /**
- * Handle "${arr[@]:-${default[@]}}", "${arr[@]:+${alt[@]}}", and "${arr[@]:=default}"
+ * Handle "${arr[@]:-${default[@]}}" and "${arr[@]:+${alt[@]}}".
  * Also handles "${var:-${default[@]}}" where var is a scalar variable.
+ * Assignment defaults preserve existing array elements when no assignment is needed.
  * When the default value contains an array expansion, each element should become a separate word.
  */
 export declare function handleArrayDefaultValue(ctx: InterpreterContext, wordParts: WordPart[]): Promise<ArrayExpansionResult>;

package/dist/interpreter/expansion/parameter-ops.d.ts

@@ -39,6 +39,7 @@ export declare function handleDefaultValue(ctx: InterpreterContext, operation: {
     word?: WordNode;
     checkEmpty?: boolean;
 }, opCtx: ParameterOpContext, expandWordPartsAsync: ExpandWordPartsAsyncFn): Promise<string>;
+export declare function assertDefaultAssignmentTarget(parameter: string): void;
 /**
  * Handle AssignDefault operation: ${param:=word}
  */

package/dist/interpreter/expansion/pattern-removal.d.ts

@@ -3,7 +3,10 @@
  *
  * Functions for ${var#pattern}, ${var%pattern}, ${!prefix*} etc.
  */
+import type { WordNode } from "../../ast/types.js";
 import type { InterpreterContext } from "../types.js";
+import type { ExpandPartFn, ExpandWordPartsAsyncFn } from "./array-word-expansion.js";
+export declare function buildPatternRemovalRegex(ctx: InterpreterContext, pattern: WordNode, greedy: boolean, expandWordPartsAsync: ExpandWordPartsAsyncFn, expandPart: ExpandPartFn): Promise<string>;
 /**
  * Apply pattern removal (prefix or suffix strip) to a single value.
  * Used by both scalar and vectorized array operations.

package/dist/interpreter/expansion/variable.d.ts

@@ -26,7 +26,7 @@ export declare function isArray(ctx: InterpreterContext, name: string): boolean;
  * @param name - The variable name
  * @param checkNounset - Whether to check for nounset (default true)
  */
-export declare function getVariable(ctx: InterpreterContext, name: string, checkNounset?: boolean, _insideDoubleQuotes?: boolean): Promise<string>;
+export declare function getVariable(ctx: InterpreterContext, name: string, checkNounset?: boolean): Promise<string>;
 /**
  * Check if a variable is set (exists in the environment).
  * Properly handles array subscripts (e.g., arr[0] -> arr_0).

package/dist/interpreter/helpers/loop.d.ts

@@ -4,14 +4,46 @@
  * Consolidates the repeated error handling logic used in all loop constructs
  * (for, c-style for, while, until).
  */
+import type { InterpreterContext } from "../types.js";
 export type LoopAction = "break" | "continue" | "rethrow" | "error";
 export interface LoopErrorResult {
     action: LoopAction;
     stdout: string;
     stderr: string;
+    /**
+     * Status the loop should adopt as "last command executed".
+     *
+     * For "break"/"continue" this is 0: bash's `break` and `continue` are
+     * builtins that return 0, and they are the last command the body ran, so
+     * the loop must not report the status of whatever failed before them.
+     * For "error" it is the failure status.
+     */
     exitCode?: number;
     error?: unknown;
 }
+/**
+ * Exit status of the `break`/`continue` builtins themselves.
+ *
+ * A loop left via `break`/`continue` reports this, not the status of the
+ * last command that ran before it:
+ *
+ *   while :; do false; break; done; echo $?   # 0, not 1
+ */
+export declare const BREAK_CONTINUE_STATUS = 0;
+/**
+ * Adopt `status` as the loop's "last command executed" and publish it to `$?`.
+ *
+ * The loop tracks its own exit code for the value it finally returns, but `$?`
+ * has to move with it. A `for` loop runs nothing between the `continue` and
+ * the next iteration's first command, so leaving `$?` behind lets the failed
+ * command before the `continue` show up there:
+ *
+ *   for i in 1 2; do echo "$?"; false; continue; done   # 0 0, not 0 1
+ *
+ * `while`/`until` happen to hide this because their condition runs in between
+ * and resets `$?` - they are synchronised here all the same.
+ */
+export declare function adoptLoopStatus(ctx: InterpreterContext, status: number): number;
 /**
  * Handle errors thrown during loop body execution.
  *

package/dist/network/dns-pin.d.ts

@@ -1,15 +1,4 @@
-/**
- * Request-owned connection binding for DNS-reviewed HTTP requests.
- *
- * Each owner has a private Undici Agent whose connector resolves exactly one
- * hostname to exactly one preflight-reviewed address. The Agent is never
- * shared between requests or redirect hops, so an existing origin pool cannot
- * substitute a socket opened under a different DNS decision.
- *
- * The browser build removes the Node-only `undici` branch and edge runtimes
- * that cannot construct this owner fail closed when private-range denial is
- * enabled.
- */
+/** Types for the deprecated request-owned connection override. */
 export interface PinnedAddress {
     hostname: string;
     address: string;
@@ -20,23 +9,3 @@ export interface PinnedConnectionOwner {
     close(): Promise<void>;
 }
 export type PinnedConnectionOwnerFactory = (pinned: PinnedAddress) => Promise<PinnedConnectionOwner>;
-/**
- * Both shapes a dynamic `import("undici")` can resolve to.
- *
- * Node resolves the package and exposes its CommonJS exports as named ones. A
- * bundler that inlines the same module into its own graph cannot always do
- * that, and hands back a namespace carrying the module under `default` alone.
- */
-type UndiciNamespace = typeof import("undici") | Pick<typeof import("undici"), "default">;
-type UndiciExports = typeof import("undici") | typeof import("undici").default;
-/** @internal Pure namespace normalization used by focused interop tests. */
-export declare function _undiciExports(namespace: UndiciNamespace): UndiciExports;
-type PinnedLookup = import("node:net").LookupFunction;
-/** @internal Pure connector lookup used by focused binding tests. */
-export declare function _createPinnedLookup(pinned: PinnedAddress): PinnedLookup;
-/**
- * Create a disposable transport whose pool identity is the reviewed address.
- * The returned owner must be closed after the response body is consumed.
- */
-export declare const createPinnedConnectionOwner: PinnedConnectionOwnerFactory;
-export {};

package/dist/network/fetch.d.ts

@@ -8,7 +8,7 @@ import { type FetchResult, type NetworkConfig } from "./types.js";
 export interface SecureFetchOptions {
     method?: string;
     headers?: Headers | Record<string, string>;
-    body?: string;
+    body?: string | Uint8Array<ArrayBuffer>;
     followRedirects?: boolean;
     /** Override timeout for this request (capped at global timeout) */
     timeoutMs?: number;

package/dist/security/trusted-globals.d.ts

@@ -15,3 +15,11 @@ export declare const _performanceNow: () => number;
 export declare const _Headers: typeof globalThis.Headers;
 /** Internal capability revocation; never expose this constructor to commands. */
 export declare const _Proxy: ProxyConstructor;
+/**
+ * Intrinsic promise settlement for infrastructure that must keep observing a
+ * promise after the execution that created it has ended. The patched
+ * `Promise.prototype.then` blocks registered callbacks once an execution is
+ * deactivated, and calling a caller-supplied `then` would run that caller's code
+ * with the privileges of whatever registered it.
+ */
+export declare const _promiseThen: typeof Promise.prototype.then;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jerryan/just-bash",
-  "version": "3.10.0",
+  "version": "3.11.1",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",
@@ -91,11 +91,10 @@
     "quickjs-emscripten": "^0.32.0",
     "re2js": "^1.3.3",
     "seek-bzip": "^2.0.0",
-    "smol-toml": "^1.8.0",
+    "smol-toml": "^1.9.0",
     "sprintf-js": "^1.1.3",
     "sql.js": "^1.14.1",
     "turndown": "^7.2.4",
-    "undici": "^7.29.0",
     "yaml": "^2.9.0"
   },
   "optionalDependencies": {
@@ -108,7 +107,7 @@
     "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
     "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
     "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
-    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:undici --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
     "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",

package/dist/bin/chunks/awk2-NTRVFXRA.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b}from"./chunk-ZVG47PYA.js";import"./chunk-MROECM42.js";import"./chunk-42AMF6EE.js";import"./chunk-YXPSX3SI.js";import"./chunk-GR4ZHKXI.js";import"./chunk-HWI42GQO.js";import"./chunk-YERKK5B3.js";import"./chunk-I57EACSL.js";import"./chunk-FUT3X2GJ.js";import"./chunk-CPKBPQ2C.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as awkCommand2,b as flagsForFuzzing};

package/dist/bin/chunks/chunk-3PCPQIUD.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-function i(...s){let e=[...new Set(s.filter(n=>n!==void 0))];if(e.length===0)return{signal:void 0,cleanup(){}};if(e.length===1)return{signal:e[0],cleanup(){}};let r=new AbortController,o=[];for(let n of e){if(n.aborted){r.abort(n.reason);break}let t=()=>r.abort(n.reason);n.addEventListener("abort",t,{once:!0}),o.push([n,t])}return{signal:r.signal,cleanup(){for(let[n,t]of o)n.removeEventListener("abort",t)}}}export{i as a};

package/dist/bin/chunks/chunk-HWI42GQO.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import*as M from"node:async_hooks";import*as $ from"node:module";var v;function T(){return v||w(),v}function w(){let a=[{prop:"Function",target:globalThis,violationType:"function_constructor",strategy:"throw",reason:"Function constructor allows arbitrary code execution"},{prop:"eval",target:globalThis,violationType:"eval",strategy:"throw",reason:"eval() allows arbitrary code execution"},{prop:"setTimeout",target:globalThis,violationType:"setTimeout",strategy:"throw",reason:"setTimeout with string argument allows code execution"},{prop:"setInterval",target:globalThis,violationType:"setInterval",strategy:"throw",reason:"setInterval with string argument allows code execution"},{prop:"setImmediate",target:globalThis,violationType:"setImmediate",strategy:"throw",reason:"setImmediate could be used to escape sandbox context"},{prop:"env",target:process,violationType:"process_env",strategy:"throw",reason:"process.env could leak sensitive environment variables",allowedKeys:new Set(["NODE_V8_COVERAGE","NODE_DEBUG","NODE_DEBUG_NATIVE","NODE_COMPILE_CACHE","NODE_ENV","WATCH_REPORT_DEPENDENCIES","FORCE_COLOR","DEBUG","UNDICI_NO_FG","JEST_WORKER_ID","__MINIMATCH_TESTING_PLATFORM__","LOG_TOKENS","LOG_STREAM"])},{prop:"binding",target:process,violationType:"process_binding",strategy:"throw",reason:"process.binding provides access to native Node.js modules"},{prop:"_linkedBinding",target:process,violationType:"process_binding",strategy:"throw",reason:"process._linkedBinding provides access to native Node.js modules"},{prop:"dlopen",target:process,violationType:"process_dlopen",strategy:"throw",reason:"process.dlopen allows loading native addons"},{prop:"getBuiltinModule",target:process,violationType:"process_get_builtin_module",strategy:"throw",reason:"process.getBuiltinModule allows loading native Node.js modules (fs, child_process, vm)"},{prop:"exit",target:process,violationType:"process_exit",strategy:"throw",reason:"process.exit could terminate the interpreter"},{prop:"abort",target:process,violationType:"process_exit",strategy:"throw",reason:"process.abort could crash the interpreter"},{prop:"kill",target:process,violationType:"process_kill",strategy:"throw",reason:"process.kill could signal other processes"},{prop:"setuid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setuid could escalate privileges"},{prop:"setgid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setgid could escalate privileges"},{prop:"seteuid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.seteuid could escalate effective user privileges"},{prop:"setegid",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setegid could escalate effective group privileges"},{prop:"initgroups",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.initgroups could modify supplementary group IDs"},{prop:"setgroups",target:process,violationType:"process_setuid",strategy:"throw",reason:"process.setgroups could modify supplementary group IDs"},{prop:"umask",target:process,violationType:"process_umask",strategy:"throw",reason:"process.umask could modify file creation permissions"},{prop:"argv",target:process,violationType:"process_argv",strategy:"throw",reason:"process.argv may contain secrets in CLI arguments"},{prop:"cwd",target:process,violationType:"process_chdir",strategy:"throw",reason:"process.cwd could disclose real host working directory path"},{prop:"chdir",target:process,violationType:"process_chdir",strategy:"throw",reason:"process.chdir could confuse the interpreter's CWD tracking"},{prop:"report",target:process,violationType:"process_report",strategy:"throw",reason:"process.report could disclose full environment, host paths, and system info"},{prop:"loadEnvFile",target:process,violationType:"process_env",strategy:"throw",reason:"process.loadEnvFile could load env files bypassing env proxy"},{prop:"setUncaughtExceptionCaptureCallback",target:process,violationType:"process_exception_handler",strategy:"throw",reason:"setUncaughtExceptionCaptureCallback could intercept security errors"},...["on","once","addListener","prependListener","prependOnceListener"].map(t=>({prop:t,target:process,violationType:"process_exception_handler",strategy:"throw",reason:"process-global listeners can outlive the sandbox and lose its security context"})),{prop:"send",target:process,violationType:"process_send",strategy:"throw",reason:"process.send could communicate with parent process in IPC contexts"},{prop:"channel",target:process,violationType:"process_channel",strategy:"throw",reason:"process.channel could access IPC channel to parent process"},{prop:"cpuUsage",target:process,violationType:"process_timing",strategy:"throw",reason:"process.cpuUsage could enable timing side-channel attacks"},{prop:"memoryUsage",target:process,violationType:"process_timing",strategy:"throw",reason:"process.memoryUsage could enable timing side-channel attacks"},{prop:"hrtime",target:process,violationType:"process_timing",strategy:"throw",reason:"process.hrtime could enable timing side-channel attacks"},{prop:"WeakRef",target:globalThis,violationType:"weak_ref",strategy:"throw",reason:"WeakRef could be used to leak references outside sandbox"},{prop:"FinalizationRegistry",target:globalThis,violationType:"finalization_registry",strategy:"throw",reason:"FinalizationRegistry could be used to leak references outside sandbox"},{prop:"Reflect",target:globalThis,violationType:"reflect",strategy:"freeze",reason:"Reflect provides introspection capabilities"},{prop:"Proxy",target:globalThis,violationType:"proxy",strategy:"throw",reason:"Proxy allows intercepting and modifying object behavior"},{prop:"WebAssembly",target:globalThis,violationType:"webassembly",strategy:"throw",reason:"WebAssembly allows executing arbitrary compiled code"},{prop:"SharedArrayBuffer",target:globalThis,violationType:"shared_array_buffer",strategy:"throw",reason:"SharedArrayBuffer could enable side-channel communication or timing attacks"},{prop:"Atomics",target:globalThis,violationType:"atomics",strategy:"throw",reason:"Atomics could enable side-channel communication or timing attacks"},{prop:"performance",target:globalThis,violationType:"performance_timing",strategy:"throw",reason:"performance.now() provides sub-millisecond timing for side-channel attacks"},{prop:"stdout",target:process,violationType:"process_stdout",strategy:"throw",reason:"process.stdout could bypass interpreter output to write to host stdout"},{prop:"stderr",target:process,violationType:"process_stderr",strategy:"throw",reason:"process.stderr could bypass interpreter output to write to host stderr"},{prop:"__defineGetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__defineGetter__ allows prototype pollution via getter injection"},{prop:"__defineSetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__defineSetter__ allows prototype pollution via setter injection"},{prop:"__lookupGetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__lookupGetter__ enables introspection for prototype pollution attacks"},{prop:"__lookupSetter__",target:Object.prototype,violationType:"prototype_mutation",strategy:"throw",reason:"__lookupSetter__ enables introspection for prototype pollution attacks"},{prop:"JSON",target:globalThis,violationType:"json_mutation",strategy:"freeze",reason:"Freeze JSON to prevent mutation of parsing/serialization"},{prop:"Math",target:globalThis,violationType:"math_mutation",strategy:"freeze",reason:"Freeze Math to prevent mutation of math utilities"}];try{let t=Object.getPrototypeOf(async()=>{}).constructor;t&&t!==Function&&a.push({prop:"constructor",target:Object.getPrototypeOf(async()=>{}),violationType:"async_function_constructor",strategy:"throw",reason:"AsyncFunction constructor allows arbitrary async code execution"})}catch{}try{let t=Object.getPrototypeOf(function*(){}).constructor;t&&t!==Function&&a.push({prop:"constructor",target:Object.getPrototypeOf(function*(){}),violationType:"generator_function_constructor",strategy:"throw",reason:"GeneratorFunction constructor allows arbitrary generator code execution"})}catch{}try{let t=Object.getPrototypeOf(async function*(){}).constructor;t&&t!==Function&&t!==Object.getPrototypeOf(async()=>{}).constructor&&a.push({prop:"constructor",target:Object.getPrototypeOf(async function*(){}),violationType:"async_generator_function_constructor",strategy:"throw",reason:"AsyncGeneratorFunction constructor allows arbitrary async generator code execution"})}catch{}let e=a.filter(t=>{try{return t.target[t.prop]!==void 0}catch{return!1}});return v??=new Set(e.map(({violationType:t})=>t)),e}var j=performance.timeOrigin,V=performance.now.bind(performance);function k(){return Math.floor(j+V())}var E=new Set(["function_constructor","async_function_constructor","generator_function_constructor","async_generator_function_constructor"]);function D(a){let e=a?.find(t=>E.has(t));if(e)throw new RangeError(`defenseInDepth.excludeViolationTypes cannot disable the non-excludable "${e}" protection`)}var R=`
-
-This is a defense-in-depth measure and indicates a bug in just-bash. Please report this at security@vercel.com`;function O(a,e,t){let i=t&&!E.has(e)?`
-
-If this access is required by trusted host-runtime code, add "${e}" to defenseInDepth.excludeViolationTypes.`:"";return a+R+i}var f=typeof __BROWSER__<"u"&&__BROWSER__;function S(){return typeof crypto<"u"&&crypto.randomUUID?crypto.randomUUID():"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,a=>{let e=Math.random()*16|0;return(a==="x"?e:e&3|8).toString(16)})}var P=null,m=null,A=null;if(!f)try{P=M.AsyncLocalStorage,m=$,A=m.Module??m.default??null}catch{}var d=class extends Error{violation;constructor(e,t){super(O(e,t.type,t.type==="error_prepare_stack_trace"||T().has(t.type))),this.violation=t,this.name="SecurityViolationError"}},p=!f&&P?new P:null,L=1e3;function G(a,e,...t){return p.run(a,()=>e(...t))}var N={enabled:!0,auditMode:!1,processLifetimeIntrinsicHardening:!1};function I(){return!f&&typeof m?.registerHooks=="function"}function C(a){let e=typeof a=="boolean"?{enabled:a}:a??{};if(D(e.excludeViolationTypes),e.enabled!==void 0&&e.enabled!==!0&&e.enabled!==!1&&e.enabled!=="auto")throw new RangeError('defenseInDepth.enabled must be true, false, or "auto"');let t={...N,...e},i=t.enabled==="auto"?"auto":t.enabled?"enabled":"disabled",r={...t,enabled:i!=="disabled",requested:i};return r.excludeViolationTypes&&(r.excludeViolationTypes=[...new Set(r.excludeViolationTypes)].sort()),r}function H(a,e){if(a.enabled!==e.enabled||a.auditMode!==e.auditMode||a.processLifetimeIntrinsicHardening!==e.processLifetimeIntrinsicHardening||a.onViolation!==e.onViolation)return!1;let t=a.excludeViolationTypes??[],i=e.excludeViolationTypes??[];return t.length===i.length&&t.every((r,o)=>r===i[o])}var B=class a{static instance=null;static importHooksRegistered=!1;static trustedExecutionDepth=new Map;config;refCount=0;patchFailures=[];activeExecutionIds=new Set;contextCache=new Map;originalDescriptors=[];temporaryIntrinsicDescriptors=[];violations=[];activationTime=0;totalActiveTimeMs=0;constructor(e){this.config=e}static getInstance(e){let t=C(e);if(!a.instance)a.instance=new a(t);else{let i=a.instance.config;if(!H(t,i))throw new Error("DefenseInDepthBox config conflict: all resolved defense options, including exclusions and the violation callback, must match across Bash instances. Call DefenseInDepthBox.resetInstance() between incompatible configurations.")}return a.instance}static resetInstance(){a.instance&&(a.instance.forceDeactivate(),a.instance=null),a.trustedExecutionDepth.clear()}static isInSandboxedContext(){return p?p?.getStore()?.sandboxActive===!0:!1}static getCurrentExecutionId(){if(p)return p?.getStore()?.executionId}static enterTrustedScope(e){let t=a.trustedExecutionDepth.get(e)??0;a.trustedExecutionDepth.set(e,t+1)}static leaveTrustedScope(e){let t=a.trustedExecutionDepth.get(e);if(t){if(t===1){a.trustedExecutionDepth.delete(e);return}a.trustedExecutionDepth.set(e,t-1)}}static isTrustedScopeActive(e){return e?(a.trustedExecutionDepth.get(e)??0)>0:!1}static isTrustedContext(e){return!e||e.forceUntrusted?!1:e.trusted===!0||a.isTrustedScopeActive(e.executionId)}isExecutionIdActive(e){return this.activeExecutionIds.has(e)}getCachedContext(e){let t=this.contextCache.get(e);return t||(t={sandboxActive:!0,executionId:e},this.contextCache.set(e,t)),t}static bindCurrentContext(e){if(!p)return e;let t=p.getStore(),i=t?.sandboxActive===!0?t.executionId:void 0;if(!i)return e;let o=a.instance?.getCachedContext(i)??{sandboxActive:!0,executionId:i},n=t?.forceUntrusted?{...o,forceUntrusted:!0}:o;return((...s)=>{let c=a.instance;if(!(c&&!c.isExecutionIdActive(i)&&(c.recordViolation("bound_callback_after_deactivate","bound callback","Bound callback blocked after originating execution was deactivated"),!c.config.auditMode)))return G(n,e,...s)})}isEnabled(){return this.getStatus().state==="enabled"}getStatus(){let e=I();return this.config.requested==="disabled"?{requested:"disabled",state:"disabled",level:"none",contextualDynamicImportProtection:e,processLifetimeIntrinsicHardening:this.config.processLifetimeIntrinsicHardening===!0,intrinsicProtection:this.config.processLifetimeIntrinsicHardening?"process-lifetime":"scoped-best-effort"}:!p||f?{requested:this.config.requested,state:"unsupported",level:"none",contextualDynamicImportProtection:!1,processLifetimeIntrinsicHardening:this.config.processLifetimeIntrinsicHardening===!0,intrinsicProtection:this.config.processLifetimeIntrinsicHardening?"process-lifetime":"scoped-best-effort",reason:"context-aware ESM loader hooks (node:module.registerHooks) are unavailable"}:{requested:this.config.requested,state:"enabled",level:this.config.auditMode?"none":e?"full":"best-effort",contextualDynamicImportProtection:e,processLifetimeIntrinsicHardening:this.config.processLifetimeIntrinsicHardening===!0,intrinsicProtection:this.config.processLifetimeIntrinsicHardening?"process-lifetime":"scoped-best-effort",reason:this.config.auditMode?"audit mode records violations but does not block them":e?void 0:"best-effort protection; context-aware ESM loader hooks are unavailable"}}updateConfig(e){if(this.refCount>0)throw new Error("DefenseInDepthBox configuration cannot change while protection is active");this.config=C({...this.config,...e})}activate(){if(!f&&this.config.enabled&&!p)throw new Error("DefenseInDepthBox: enabled protection requires node:async_hooks and node:module");if(f||!this.config.enabled){let i=S(),r=!1;return{run:o=>r?Promise.reject(new Error("DefenseInDepthBox handle is deactivated and cannot run new work")):o(),deactivate:()=>{r=!0},executionId:i}}if(this.refCount++,this.refCount===1){try{this.applyPatches()}catch(i){throw this.restorePatches(),this.activeExecutionIds.clear(),this.contextCache.clear(),this.refCount=0,i}this.activationTime=Date.now()}let e=S(),t=!1;return{run:i=>t?Promise.reject(new Error("DefenseInDepthBox handle is deactivated and cannot run new work")):(this.activeExecutionIds.add(e),p.run({sandboxActive:!0,executionId:e},i)),deactivate:()=>{t||(t=!0,this.activeExecutionIds.delete(e),this.contextCache.delete(e),this.refCount--,this.refCount===0&&(this.restorePatches(),this.totalActiveTimeMs+=Date.now()-this.activationTime),this.refCount<0&&(this.refCount=0))},executionId:e}}forceDeactivate(){this.refCount>0&&(this.restorePatches(),this.totalActiveTimeMs+=Date.now()-this.activationTime),this.activeExecutionIds.clear(),this.contextCache.clear(),this.refCount=0}isActive(){return this.refCount>0}getStats(){return{violationsBlocked:this.violations.length,violations:[...this.violations],activeTimeMs:this.totalActiveTimeMs+(this.refCount>0?Date.now()-this.activationTime:0),refCount:this.refCount}}getPatchFailures(){return[...this.patchFailures]}clearViolations(){this.violations=[]}getPathForTarget(e,t){return e===globalThis?`globalThis.${t}`:e===process?`process.${t}`:e===Error?`Error.${t}`:e===Function.prototype?`Function.prototype.${t}`:e===Object.prototype?`Object.prototype.${t}`:`<object>.${t}`}static runTrusted(e){if(!p)return e();let t=p.getStore();if(!t)return e();let{executionId:i}=t;return p.run({...t,trusted:!0,forceUntrusted:!1},()=>{a.enterTrustedScope(i);try{let r=e();return typeof r=="object"&&r!==null&&"finally"in r&&typeof r.finally=="function"?r.finally(()=>{a.leaveTrustedScope(i)}):(a.leaveTrustedScope(i),r)}catch(r){throw a.leaveTrustedScope(i),r}})}static async runTrustedAsync(e){if(!p)return e();let t=p.getStore();if(!t)return e();let{executionId:i}=t;return p.run({...t,trusted:!0,forceUntrusted:!1},async()=>{a.enterTrustedScope(i);try{return await e()}finally{a.leaveTrustedScope(i)}})}static async runUntrustedAsync(e){if(!p)return e();let t=p.getStore();return t?p.run({...t,trusted:!1,forceUntrusted:!0},e):e()}shouldBlock(){if(f||this.config.auditMode||!p)return!1;let e=p?.getStore();return!(e?.sandboxActive!==!0||a.isTrustedContext(e))}shouldAudit(){if(!this.config.auditMode||!p)return!1;let e=p.getStore();return e?.sandboxActive===!0&&!a.isTrustedContext(e)}recordViolation(e,t,i){let r={timestamp:k(),type:e,message:i,path:t,stack:new Error().stack,executionId:p?.getStore()?.executionId};if(this.violations.length<L&&this.violations.push(r),this.config.onViolation)try{this.config.onViolation(r)}catch(o){console.debug("[DefenseInDepthBox] onViolation callback threw:",o instanceof Error?o.message:o)}return r}createBlockingProxy(e,t,i){let r=this;return new Proxy(e,{apply(o,n,s){if(r.shouldBlock()){let c=`${t} is blocked during script execution`,l=r.recordViolation(i,t,c);throw new d(c,l)}return r.shouldAudit()&&r.recordViolation(i,t,`${t} called (audit mode)`),Reflect.apply(o,n,s)},construct(o,n,s){if(r.shouldBlock()){let c=`${t} constructor is blocked during script execution`,l=r.recordViolation(i,t,c);throw new d(c,l)}return r.shouldAudit()&&r.recordViolation(i,t,`${t} constructor called (audit mode)`),Reflect.construct(o,n,s)}})}createBlockingObjectProxy(e,t,i,r){let o=this;return new Proxy(e,{get(n,s,c){if(o.shouldBlock()){if(r&&typeof s=="string"&&r.has(s))return Reflect.get(n,s,c);let l=`${t}.${String(s)}`,u=`${l} is blocked during script execution`,h=o.recordViolation(i,l,u);throw new d(u,h)}if(o.shouldAudit()){let l=`${t}.${String(s)}`;o.recordViolation(i,l,`${l} accessed (audit mode)`)}return Reflect.get(n,s,c)},set(n,s,c,l){if(o.shouldBlock()){let u=`${t}.${String(s)}`,h=`${u} modification is blocked during script execution`,y=o.recordViolation(i,u,h);throw new d(h,y)}return t==="process.env"&&s==="DEBUG"?Reflect.set(n,s,c):Reflect.set(n,s,c,l)},ownKeys(n){if(o.shouldBlock()){let s=`${t} enumeration is blocked during script execution`,c=o.recordViolation(i,t,s);throw new d(s,c)}return Reflect.ownKeys(n)},getOwnPropertyDescriptor(n,s){if(o.shouldBlock()){let c=`${t}.${String(s)}`,l=`${c} descriptor access is blocked during script execution`,u=o.recordViolation(i,c,l);throw new d(l,u)}return Reflect.getOwnPropertyDescriptor(n,s)},has(n,s){if(o.shouldBlock()){let c=`${t}.${String(s)}`,l=`${c} existence check is blocked during script execution`,u=o.recordViolation(i,c,l);throw new d(l,u)}return Reflect.has(n,s)},deleteProperty(n,s){if(o.shouldBlock()){let c=`${t}.${String(s)}`,l=`${c} deletion is blocked during script execution`,u=o.recordViolation(i,c,l);throw new d(l,u)}return Reflect.deleteProperty(n,s)},setPrototypeOf(n,s){if(o.shouldBlock()){let c=`${t} setPrototypeOf is blocked during script execution`,l=o.recordViolation(i,t,c);throw new d(c,l)}return Reflect.setPrototypeOf(n,s)},defineProperty(n,s,c){if(o.shouldBlock()){let l=`${t}.${String(s)}`,u=`${l} defineProperty is blocked during script execution`,h=o.recordViolation(i,l,u);throw new d(u,h)}return Reflect.defineProperty(n,s,c)}})}createReadonlyObjectProxy(e,t,i){let r=this,o=n=>{let s=`${t} ${n} is blocked during script execution`,c=r.recordViolation(i,t,s);throw new d(s,c)};return new Proxy(e,{set(n,s,c,l){return r.shouldBlock()&&o("modification"),Reflect.set(n,s,c,l)},defineProperty(n,s,c){return r.shouldBlock()&&o("defineProperty"),Reflect.defineProperty(n,s,c)},deleteProperty(n,s){return r.shouldBlock()&&o("deletion"),Reflect.deleteProperty(n,s)},setPrototypeOf(n,s){return r.shouldBlock()&&o("setPrototypeOf"),Reflect.setPrototypeOf(n,s)},preventExtensions(n){return r.shouldBlock()&&o("preventExtensions"),Reflect.preventExtensions(n)}})}applyPatches(){this.patchFailures=[];let e=w(),t=new Set(this.config.excludeViolationTypes??[]),i=new Set(["process_send","process_channel","process_stdout","process_stderr"]),r=[];for(let s of e)if(!t.has(s.violationType)&&!i.has(s.violationType)){if(s.strategy==="freeze"){r.push(s);continue}this.applyPatch(s)}this.protectConstructorChain(),t.has("error_prepare_stack_trace")||this.protectErrorPrepareStackTrace(),this.protectPromiseThen(),I()&&this.protectDynamicImport(),this.protectModuleLoad(),this.protectModuleResolveFilename(),this.protectProcessMainModule(),this.protectProcessExecPath(),this.protectProxyRevocable();let o=["Function.prototype.constructor","Module._load","Module._resolveFilename"],n=this.patchFailures.filter(s=>o.includes(s));if(n.length>0)throw this.restorePatches(),new Error(`DefenseInDepthBox: critical patches failed: ${n.join(", ")}`);this.config.processLifetimeIntrinsicHardening||this.protectReversibleIntrinsics(r);for(let s of r)this.applyPatch(s,this.config.processLifetimeIntrinsicHardening===!0);this.config.processLifetimeIntrinsicHardening&&this.lockWellKnownSymbols()}protectReversibleIntrinsics(e){let t=new Set,i=(n,s)=>{let c=Object.getOwnPropertyDescriptor(n,s);!c||!("value"in c)||c.writable!==!0||c.configurable!==!0||(this.temporaryIntrinsicDescriptors.push({target:n,prop:s,descriptor:c}),Object.defineProperty(n,s,{...c,writable:!1}))};for(let{target:n,prop:s}of e){let c=n[s];if(!(typeof c!="object"||c===null)){t.add(c);for(let l of Reflect.ownKeys(c))i(c,l)}}let r=[];for(let n of[Array,Map,Set,RegExp,Promise])r.push([n,Symbol.species]);for(let n of[Array.prototype,String.prototype,Map.prototype,Set.prototype])r.push([n,Symbol.iterator]);r.push([Symbol.prototype,Symbol.toPrimitive],[Date.prototype,Symbol.toPrimitive],[Function.prototype,Symbol.hasInstance],[Array.prototype,Symbol.unscopables]);for(let n of[Symbol.match,Symbol.matchAll,Symbol.replace,Symbol.search,Symbol.split])r.push([RegExp.prototype,n]);for(let n of[Map.prototype,Set.prototype,Promise.prototype,ArrayBuffer.prototype])r.push([n,Symbol.toStringTag]);for(let[n,s]of r)t.add(n),i(n,s);let o=(n,s,c)=>{let l=Object.getOwnPropertyDescriptor(n,s);if(!l||!("value"in l)||typeof l.value!="function"||l.configurable!==!0)return;let u=l.value,h=this,y=function(...b){let g=b[0];if(h.shouldBlock()&&typeof g=="object"&&g!==null&&t.has(g)){let x=`${c}.${s}`,_=`${x} is blocked for protected intrinsics during script execution`,F=h.recordViolation("prototype_mutation",x,_);throw new d(_,F)}return Reflect.apply(u,this,b)};this.temporaryIntrinsicDescriptors.push({target:n,prop:s,descriptor:l}),Object.defineProperty(n,s,{...l,value:y,writable:!1})};for(let n of["assign","defineProperties","defineProperty","freeze","preventExtensions","seal","setPrototypeOf"])o(Object,n,"Object");for(let n of["defineProperty","deleteProperty","preventExtensions","set","setPrototypeOf"])o(Reflect,n,"Reflect")}protectConstructorChain(){this.patchPrototypeConstructor(Function.prototype,"Function.prototype.constructor","function_constructor");try{let e=Object.getPrototypeOf(async()=>{}).constructor;e&&e!==Function&&this.patchPrototypeConstructor(e.prototype,"AsyncFunction.prototype.constructor","async_function_constructor")}catch(e){this.patchFailures.push("AsyncFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch AsyncFunction.prototype.constructor:",e instanceof Error?e.message:e)}try{let e=Object.getPrototypeOf(function*(){}).constructor;e&&e!==Function&&this.patchPrototypeConstructor(e.prototype,"GeneratorFunction.prototype.constructor","generator_function_constructor")}catch(e){this.patchFailures.push("GeneratorFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch GeneratorFunction.prototype.constructor:",e instanceof Error?e.message:e)}try{let e=Object.getPrototypeOf(async function*(){}).constructor,t=Object.getPrototypeOf(async()=>{}).constructor;e&&e!==Function&&e!==t&&this.patchPrototypeConstructor(e.prototype,"AsyncGeneratorFunction.prototype.constructor","async_generator_function_constructor")}catch(e){this.patchFailures.push("AsyncGeneratorFunction.prototype.constructor"),console.debug("[DefenseInDepthBox] Could not patch AsyncGeneratorFunction.prototype.constructor:",e instanceof Error?e.message:e)}}protectErrorPrepareStackTrace(){let e=this;try{let t=Object.getOwnPropertyDescriptor(Error,"prepareStackTrace");this.originalDescriptors.push({target:Error,prop:"prepareStackTrace",descriptor:t});let i=t?.value;Object.defineProperty(Error,"prepareStackTrace",{get(){return i},set(r){if(e.shouldBlock()){let o="Error.prepareStackTrace modification is blocked during script execution",n=e.recordViolation("error_prepare_stack_trace","Error.prepareStackTrace",o);throw new d(o,n)}e.shouldAudit()&&e.recordViolation("error_prepare_stack_trace","Error.prepareStackTrace","Error.prepareStackTrace set (audit mode)"),i=r},configurable:!0})}catch(t){this.patchFailures.push("Error.prepareStackTrace"),console.debug("[DefenseInDepthBox] Could not protect Error.prepareStackTrace:",t instanceof Error?t.message:t)}}protectPromiseThen(){let e=this;try{let o=function(...n){return p.run(this.captured,()=>{if(!this.box.isExecutionIdActive(this.executionId)){if(this.box.recordViolation("promise_then_after_deactivate","Promise.then","Promise.then callback is blocked after defense deactivation"),this.box.config.auditMode)return Reflect.apply(this.cb,void 0,n);if(this.kind==="fulfilled")return n[0];throw n[0]}return Reflect.apply(this.cb,void 0,n)})};var t=o;let i=Object.getOwnPropertyDescriptor(Promise.prototype,"then");this.originalDescriptors.push({target:Promise.prototype,prop:"then",descriptor:i});let r=i?.value;if(typeof r!="function")return;Object.defineProperty(Promise.prototype,"then",{value:function(s,c){if(!p)return Reflect.apply(r,this,[s,c]);let l=p.getStore(),u=l?.sandboxActive===!0&&l.trusted!==!0?l.executionId:void 0;if(!u)return Reflect.apply(r,this,[s,c]);let h=e.getCachedContext(u),y=l?.forceUntrusted?{...h,forceUntrusted:!0}:h,b=(g,x)=>typeof g!="function"?g:o.bind({box:e,executionId:u,captured:y,cb:g,kind:x});return Reflect.apply(r,this,[b(s,"fulfilled"),b(c,"rejected")])},writable:!0,configurable:!0})}catch(i){this.patchFailures.push("Promise.prototype.then"),console.debug("[DefenseInDepthBox] Could not protect Promise.prototype.then:",i instanceof Error?i.message:i)}}patchPrototypeConstructor(e,t,i){let r=this;try{let o=Object.getOwnPropertyDescriptor(e,"constructor");this.originalDescriptors.push({target:e,prop:"constructor",descriptor:o});let n=o?.value;Object.defineProperty(e,"constructor",{get(){if(r.shouldBlock()){let s=`${t} access is blocked during script execution`,c=r.recordViolation(i,t,s);throw new d(s,c)}return r.shouldAudit()&&r.recordViolation(i,t,`${t} accessed (audit mode)`),n},set(s){if(r.shouldBlock()){let c=`${t} modification is blocked during script execution`,l=r.recordViolation(i,t,c);throw new d(c,l)}Object.defineProperty(this,"constructor",{value:s,writable:!0,configurable:!0})},configurable:!0})}catch(o){this.patchFailures.push(t),console.debug(`[DefenseInDepthBox] Could not patch ${t}:`,o instanceof Error?o.message:o)}}protectProcessMainModule(){if(typeof process>"u")return;let e=this;try{let t=Object.getOwnPropertyDescriptor(process,"mainModule");this.originalDescriptors.push({target:process,prop:"mainModule",descriptor:t});let i=t?.value;i!==void 0&&Object.defineProperty(process,"mainModule",{get(){if(e.shouldBlock()){let r="process.mainModule access is blocked during script execution",o=e.recordViolation("process_main_module","process.mainModule",r);throw new d(r,o)}return e.shouldAudit()&&e.recordViolation("process_main_module","process.mainModule","process.mainModule accessed (audit mode)"),i},set(r){if(e.shouldBlock()){let o="process.mainModule modification is blocked during script execution",n=e.recordViolation("process_main_module","process.mainModule",o);throw new d(o,n)}Object.defineProperty(process,"mainModule",{value:r,writable:!0,configurable:!0})},configurable:!0})}catch(t){this.patchFailures.push("process.mainModule"),console.debug("[DefenseInDepthBox] Could not protect process.mainModule:",t instanceof Error?t.message:t)}}protectProcessExecPath(){if(typeof process>"u")return;let e=this;try{let t=Object.getOwnPropertyDescriptor(process,"execPath");this.originalDescriptors.push({target:process,prop:"execPath",descriptor:t});let i=t?.value??process.execPath;Object.defineProperty(process,"execPath",{get(){if(e.shouldBlock()){let r="process.execPath access is blocked during script execution",o=e.recordViolation("process_exec_path","process.execPath",r);throw new d(r,o)}return e.shouldAudit()&&e.recordViolation("process_exec_path","process.execPath","process.execPath accessed (audit mode)"),i},set(r){if(e.shouldBlock()){let o="process.execPath modification is blocked during script execution",n=e.recordViolation("process_exec_path","process.execPath",o);throw new d(o,n)}Object.defineProperty(process,"execPath",{value:r,writable:!0,configurable:!0})},configurable:!0})}catch(t){this.patchFailures.push("process.execPath"),console.debug("[DefenseInDepthBox] Could not protect process.execPath:",t instanceof Error?t.message:t)}}lockWellKnownSymbols(){let e=(t,i)=>{try{let r=Object.getOwnPropertyDescriptor(t,i);if(r?.configurable){if("value"in r){Object.defineProperty(t,i,{...r,configurable:!1,writable:!1});return}Object.defineProperty(t,i,{...r,configurable:!1})}}catch{}};for(let t of[Array,Map,Set,RegExp,Promise])e(t,Symbol.species);for(let t of[Array.prototype,String.prototype,Map.prototype,Set.prototype])e(t,Symbol.iterator);e(Symbol.prototype,Symbol.toPrimitive),e(Date.prototype,Symbol.toPrimitive);for(let t of[Symbol.match,Symbol.matchAll,Symbol.replace,Symbol.search,Symbol.split])e(RegExp.prototype,t);e(Function.prototype,Symbol.hasInstance),e(Array.prototype,Symbol.unscopables);for(let t of[Map.prototype,Set.prototype,Promise.prototype,ArrayBuffer.prototype])e(t,Symbol.toStringTag)}protectProxyRevocable(){let e=this;try{let t=Proxy.revocable;if(typeof t!="function")return;let i=Object.getOwnPropertyDescriptor(Proxy,"revocable");this.originalDescriptors.push({target:Proxy,prop:"revocable",descriptor:i}),Object.defineProperty(Proxy,"revocable",{value:function(o,n){if(e.shouldBlock()){let s="Proxy.revocable is blocked during script execution",c=e.recordViolation("proxy","Proxy.revocable",s);throw new d(s,c)}return e.shouldAudit()&&e.recordViolation("proxy","Proxy.revocable","Proxy.revocable called (audit mode)"),t(o,n)},writable:!1,configurable:!0})}catch(t){this.patchFailures.push("Proxy.revocable"),console.debug("[DefenseInDepthBox] Could not protect Proxy.revocable:",t instanceof Error?t.message:t)}}protectDynamicImport(){if(!(f||a.importHooksRegistered))try{let e=m;if(!e)throw new Error("node:module is unavailable");let t=new Set;for(let o of e.builtinModules??[]){let n=o.startsWith("node:")?o.slice(5):o;t.add(n);let s=n.indexOf("/");s>0&&t.add(n.slice(0,s))}let i=o=>{if(o.startsWith("./")||o.startsWith("../")||o.startsWith("/")||o.startsWith("file:")||o.startsWith("data:")||o.startsWith("blob:")||o.startsWith("http:")||o.startsWith("https:"))return!1;let n=o.startsWith("node:")?o.slice(5):o;if(!n)return!1;if(typeof e.isBuiltin=="function"&&e.isBuiltin(n)||t.has(n))return!0;let s=n.indexOf("/");return s>0&&t.has(n.slice(0,s))},r=o=>{let n=p?.getStore();return o.config.auditMode===!0&&n?.sandboxActive===!0&&!a.isTrustedContext(n)};if(typeof e.registerHooks=="function"){e.registerHooks({resolve(o,n,s){let c=a.instance;if(!c)return s(o,n);if((o.startsWith("data:")||o.startsWith("blob:"))&&c.shouldBlock()){let l=`import(${o.startsWith("data:")?"data:":"blob:"})`,u=`dynamic import of ${o.startsWith("data:")?"data:":"blob:"} URLs is blocked by defense-in-depth`,h=c.recordViolation("dynamic_import_builtin",l,u);throw new d(u,h)}if(i(o)){let l=`import(${o})`,u=`dynamic import of Node.js builtin '${o}' is blocked during script execution`;if(c.shouldBlock()){let h=c.recordViolation("dynamic_import_builtin",l,u);throw new d(u,h)}r(c)&&c.recordViolation("dynamic_import_builtin",l,`dynamic import of Node.js builtin '${o}' called (audit mode)`)}return s(o,n)}}),a.importHooksRegistered=!0;return}throw new Error("context-aware ESM loader hooks (node:module.registerHooks) are unavailable")}catch(e){throw new Error(`DefenseInDepthBox: could not register dynamic-import hooks: ${e instanceof Error?e.message:String(e)}`,{cause:e})}}protectModuleLoad(){this.protectModuleMethod("_load","module_load")}protectModuleResolveFilename(){this.protectModuleMethod("_resolveFilename","module_resolve_filename")}protectModuleMethod(e,t){if(f)return;let i=`Module.${e}`;try{let r=A,o=r?.[e];if(!r||typeof o!="function")throw new Error("node:module Module class or method is unavailable");let n=Object.getOwnPropertyDescriptor(r,e);if(!n)throw new Error("method has no own property descriptor");if(n.configurable===!1&&n.writable===!1)throw new Error("method is non-configurable and non-writable");let s=this.createBlockingProxy(o,i,t);this.originalDescriptors.push({target:r,prop:e,descriptor:n}),Object.defineProperty(r,e,{...n,value:s});let c=Object.getOwnPropertyDescriptor(r,e);if(r[e]!==s||c?.value!==s)throw new Error("installed patch failed verification")}catch{this.patchFailures.push(i)}}applyPatch(e,t=!1){let{target:i,prop:r,violationType:o,strategy:n}=e;try{let s=i[r];if(s===void 0)return;let c=Object.getOwnPropertyDescriptor(i,r);if(this.originalDescriptors.push({target:i,prop:r,descriptor:c}),n==="freeze"){if(typeof s=="object"&&s!==null){t&&Object.freeze(s);let l=this.getPathForTarget(i,r),u=this.createReadonlyObjectProxy(s,l,o);Object.defineProperty(i,r,{...c,value:u})}}else{let l=this.getPathForTarget(i,r),u=typeof s=="function"?this.createBlockingProxy(s,l,o):this.createBlockingObjectProxy(s,l,o,e.allowedKeys);Object.defineProperty(i,r,{value:u,writable:!0,configurable:!0})}}catch(s){let c=this.getPathForTarget(i,r);this.patchFailures.push(c),console.debug(`[DefenseInDepthBox] Could not patch ${c}:`,s instanceof Error?s.message:s)}}restorePatches(){for(let e=this.temporaryIntrinsicDescriptors.length-1;e>=0;e--){let{target:t,prop:i,descriptor:r}=this.temporaryIntrinsicDescriptors[e];try{Object.defineProperty(t,i,r)}catch(o){console.debug(`[DefenseInDepthBox] Could not restore temporary intrinsic ${String(i)}:`,o instanceof Error?o.message:o)}}this.temporaryIntrinsicDescriptors=[];for(let e=this.originalDescriptors.length-1;e>=0;e--){let{target:t,prop:i,descriptor:r}=this.originalDescriptors[e];try{r?Object.defineProperty(t,i,r):delete t[i]}catch(o){let n=this.getPathForTarget(t,i);console.debug(`[DefenseInDepthBox] Could not restore ${n}:`,o instanceof Error?o.message:o)}}this.originalDescriptors=[]}};export{d as a,B as b};

package/dist/bin/chunks/chunk-I57EACSL.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{l as o}from"./chunk-FUT3X2GJ.js";import{a as u}from"./chunk-CPKBPQ2C.js";function n(s,t){if(!Number.isSafeInteger(s)||s<0)throw new o(`${t}: invalid bounded allocation count`,"array_elements")}function c(s){return new o(`${s}: invalid bounded allocation count`,"array_elements")}function f(s,t,e){n(s,e),n(t,e);let i=s+t;if(!Number.isSafeInteger(i))throw c(e);return i}function p(s,t,e){if(n(s,e),n(t,e),s!==0&&t>Math.floor(Number.MAX_SAFE_INTEGER/s))throw c(e);return s*t}function m(s,t,e,i){let r=new a(e,i);for(let h=0;h<s.length;h++)h>0&&r.append(t),r.append(s[h]);return r.build()}var a=class{maxBytes;label;createLimitError;reservedBytes;chunks=[];usedBytes=0;constructor(t,e,i=void 0,r=0){this.maxBytes=t,this.label=e,this.createLimitError=i,this.reservedBytes=r,n(t,e),n(r,e),r>t&&this.fail()}fail(){throw this.createLimitError?.()??new o(`${this.label}: output size limit exceeded (${this.maxBytes} bytes)`,"output_size")}get byteLength(){return this.usedBytes}get remainingBytes(){return this.maxBytes-this.reservedBytes-this.usedBytes}reserve(t){n(t,this.label),t>this.remainingBytes&&this.fail()}append(t){let e=u(t);return this.reserve(e),t&&this.chunks.push(t),this.usedBytes+=e,this}repeat(t,e){n(e,this.label);let i=u(t);return i!==0&&e>Math.floor(this.remainingBytes/i)&&this.fail(),this.append(t.repeat(e))}reset(){this.chunks.length=0,this.usedBytes=0}build(){return this.chunks.join("")}};export{f as a,p as b,m as c,a as d};