@poe-platform/safe-bash 0.1.529 → 0.1.531

package/dist/safe-bash/core.browser.js

@@ -2,10 +2,9 @@ import {
   createXmlCommands,
   defaultXmlQueryLimits,
   xmlCommands
-} from "./chunks/chunk-5MSOBYRG.js";
+} from "./chunks/chunk-IKATLB4I.js";
 import {
   Interpreter,
-  createOutputOperation,
   createYqCommand,
   createYqCommands,
   jsonValues,
@@ -14,14 +13,43 @@ import {
   rawValues,
   stringify,
   yqCommands
-} from "./chunks/chunk-NYHAKXQ7.js";
+} from "./chunks/chunk-6MHYEBAJ.js";
 import {
   Budget,
+  JqError,
+  JqLimitError,
+  copyObject,
+  defaultJqLimits,
+  interruptible,
+  object,
+  put,
+  resolveJqLimits,
+  truth,
+  wellFormed
+} from "./chunks/chunk-54Z5EUCW.js";
+import {
+  CurlError,
+  bindFileOutputBudget,
+  cloudflareWorkerNetworkLimits,
+  createCurlCommand,
+  createCurlCommands,
+  createFetchTransport,
+  createNetworkCommands,
+  createOriginAuthorizer,
+  createWgetCommand,
+  curlCommands,
+  defaultNetworkLimits,
+  networkCommands,
+  openFileOutput,
+  writeFileOutput
+} from "./chunks/chunk-UGMUVHIY.js";
+import {
+  createOutputOperation
+} from "./chunks/chunk-2GV4WO7O.js";
+import {
   CommandArgumentIdentityError,
   CommandRegistry,
   FsError,
-  JqError,
-  JqLimitError,
   PublicDiagnostic,
   RecordBuffer,
   UsageError,
@@ -35,11 +63,9 @@ import {
   collectText,
   concatShellValues,
   concatenate,
-  copyObject,
   createBytePipe,
   createCommandArguments,
   decoder,
-  defaultJqLimits,
   define,
   diagnostic,
   dirname,
@@ -55,7 +81,6 @@ import {
   input,
   inputRequirements,
   integer,
-  interruptible,
   isAbsolutePath,
   isErrnoCode,
   isFsError,
@@ -63,7 +88,6 @@ import {
   joinPath,
   lines,
   monotonicNow,
-  object,
   options,
   output,
   outputFailure,
@@ -71,14 +95,12 @@ import {
   pipeBytes,
   predicateRequirements,
   publicDiagnosticMessage,
-  put,
   pwdRequirements,
   readBytes,
   registerYieldCheckpoint,
   relativePath,
   replaceArgument,
   requireOperands,
-  resolveJqLimits,
   resolvePath,
   scheduleTurn,
   shellValueByteLength,
@@ -89,16 +111,14 @@ import {
   textOutputRequirements,
   toByteSource,
   toFsError,
-  truth,
   validateExitCode,
   validatePath,
   value,
-  wellFormed,
   writeBytes,
   writeDiagnostic,
   writeText,
   yieldTurn
-} from "./chunks/chunk-5OCQTFXT.js";
+} from "./chunks/chunk-LUJYX5H5.js";
 
 // packages/safe-bash/src/core.browser.ts
 init_platform();
@@ -3442,182 +3462,6 @@ function filesystemCommands(maxDirectoryEntries) {
 // packages/safe-bash/src/commands/streams.ts
 init_platform();
 
-// packages/safe-bash/src/contracts/filesystem-output.ts
-init_platform();
-var filesystemOutputBudgets = /* @__PURE__ */ new WeakMap();
-function bindFileOutputBudget(context2, budget) {
-  if (!context2.registerCleanup) throw new TypeError("Shell output budgets require invocation cleanup ownership");
-  filesystemOutputBudgets.set(context2.registerCleanup, budget);
-}
-async function writeFileOutput(context2, bytes3, write2) {
-  context2.signal.throwIfAborted();
-  const budget = context2.registerCleanup && filesystemOutputBudgets.get(context2.registerCleanup);
-  let pending;
-  const destination2 = { write(chunk) {
-    context2.signal.throwIfAborted();
-    return pending = (async () => {
-      await write2(chunk);
-    })();
-  } };
-  try {
-    await (budget?.(destination2) ?? destination2).write(bytes3);
-  } catch (error) {
-    await pending?.catch(() => {
-    });
-    context2.signal.throwIfAborted();
-    throw error;
-  }
-  context2.signal.throwIfAborted();
-}
-async function openFileOutput(context2, path, flag, incremental) {
-  let pipe;
-  let task;
-  let completed = false;
-  let ended = false;
-  let closing = false;
-  let failure;
-  const consumer = new AbortController();
-  let writes = Promise.resolve();
-  let acknowledge;
-  const acknowledgeWrite = () => {
-    const accepted = acknowledge;
-    acknowledge = void 0;
-    accepted?.();
-  };
-  let ready;
-  const opened = new Promise((resolve) => {
-    ready = resolve;
-  });
-  const destination2 = {
-    [outputFailure]: (reason) => operation2.abort(reason),
-    async write(chunk) {
-      if (closing) throw new FsError("EBADF", { path, syscall: "write" });
-      const writing = writes.then(async () => {
-        for (let offset = 0; offset < chunk.byteLength; offset += 64 * 1024) {
-          const accepted = new Promise((resolve) => {
-            acknowledge = resolve;
-          });
-          await pipe.writable.write(chunk.subarray(offset, offset + 64 * 1024));
-          await accepted;
-          if (failure) throw failure.reason;
-          operation2.signal.throwIfAborted();
-        }
-      });
-      writes = writing.catch(() => {
-      });
-      await writing;
-    }
-  };
-  const budget = context2.registerCleanup && filesystemOutputBudgets.get(context2.registerCleanup);
-  const operation2 = createOutputOperation(context2, budget?.(destination2) ?? destination2);
-  operation2.registerCleanup(async () => {
-    closing = true;
-    if (!completed) {
-      void operation2.abort(operation2.signal.aborted ? operation2.signal.reason : new FsError("ECANCELED", { path, syscall: "write" }));
-      await pipe?.abort(operation2.signal.reason);
-    }
-    await task?.catch(() => {
-    });
-    await writes;
-  });
-  try {
-    pipe = createBytePipe({ highWaterMark: 1, signal: operation2.signal });
-    let reading = false;
-    const source2 = {
-      [Symbol.asyncIterator]() {
-        return (async function* () {
-          reading = true;
-          ready();
-          for await (const chunk of pipe.readable) {
-            yield chunk;
-            acknowledgeWrite();
-          }
-          operation2.signal.throwIfAborted();
-          ended = true;
-        })();
-      }
-    };
-    task = (async () => {
-      const { fs } = context2;
-      const signal = operation2.signal;
-      signal.throwIfAborted();
-      const capabilities = await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities;
-      if (capabilities.readOnly === true) throw new FsError("EROFS", { path, syscall: "write" });
-      try {
-        await fs.access(path, 2, { signal });
-      } catch (error) {
-        signal.throwIfAborted();
-        if (!(error instanceof FsError) || error.code !== "ENOENT" && error.code !== "ENOTSUP") throw error;
-      }
-      signal.throwIfAborted();
-      const streaming = flag === "a" ? capabilities.streamingAppend ?? capabilities.streamingWrite : capabilities.streamingWrite;
-      if ((!incremental || capabilities.descriptorWriteStream === true) && streaming !== false && fs.writeStream) {
-        try {
-          await fs.writeStream(path, source2, { flag, signal });
-          if (!ended) throw new FsError("EIO", { path, message: "Streaming writer returned before consuming output" });
-          return;
-        } catch (error) {
-          signal.throwIfAborted();
-          if (reading || !(error instanceof FsError) || error.code !== "ENOTSUP") throw error;
-        }
-      }
-      if (flag === "w" && capabilities.write === false) throw new FsError("ENOTSUP", { path, syscall: "writeFile" });
-      if ((!incremental || flag === "a") && capabilities.append === false) throw new FsError("ENOTSUP", { path, syscall: "appendFile" });
-      const sink = incremental ? await incremental() : await (async () => {
-        if (flag === "a") await fs.appendFile(path, new Uint8Array(), { signal });
-        else await fs.writeFile(path, new Uint8Array(), { flag, signal });
-        return { write: (chunk) => fs.appendFile(path, chunk, { signal }) };
-      })();
-      for await (const chunk of source2) {
-        signal.throwIfAborted();
-        await sink.write(chunk);
-      }
-    })();
-    void task.then(acknowledgeWrite, (error) => {
-      failure = { reason: error };
-      acknowledgeWrite();
-      if (!operation2.signal.aborted) consumer.abort(error);
-      void operation2.abort(error).catch(() => {
-      });
-    });
-    await Promise.race([opened, task]);
-    operation2.signal.throwIfAborted();
-    const write2 = async (chunk) => {
-      try {
-        await operation2.output.write(chunk);
-      } catch (error) {
-        throw failure ? failure.reason : error;
-      }
-    };
-    return {
-      signal: operation2.signal,
-      sink: {
-        [outputFailure]: destination2[outputFailure],
-        ownedOutput: { consumerClosed: consumer.signal, write: write2 },
-        write: write2
-      },
-      async finish() {
-        closing = true;
-        try {
-          await writes;
-          await pipe.close();
-          await task;
-          operation2.signal.throwIfAborted();
-          completed = true;
-        } catch (error) {
-          throw failure ? failure.reason : error;
-        } finally {
-          await operation2.close();
-        }
-      },
-      abort: (reason) => operation2.abort(reason)
-    };
-  } catch (error) {
-    await operation2.abort(error);
-    throw error;
-  }
-}
-
 // packages/safe-bash/src/commands/tail-follow.ts
 init_platform();
 var tailFollowScheduler = {
@@ -53001,182 +52845,6 @@ function safeJsCommands(options3 = {}) {
   } };
 }
 
-// packages/safe-bash/src/commands/network/fetch-transport.ts
-init_platform();
-
-// packages/safe-bash/src/commands/network/types.ts
-init_platform();
-var defaultNetworkLimits = Object.freeze({
-  maxUploadBytes: 64 * 1024 * 1024,
-  maxDownloadBytes: 64 * 1024 * 1024,
-  maxBufferBytes: 8 * 1024 * 1024,
-  maxHeaderBytes: 64 * 1024,
-  maxRedirects: 10,
-  maxRetries: 5,
-  maxUrls: 32,
-  maxTimeMs: 12e4,
-  maxTotalTimeMs: 12e4
-});
-var cloudflareWorkerNetworkLimits = Object.freeze({
-  maxUploadBytes: 4 * 1024 * 1024,
-  maxDownloadBytes: 4 * 1024 * 1024,
-  maxBufferBytes: 1024 * 1024,
-  maxHeaderBytes: 32 * 1024,
-  maxRedirects: 2,
-  maxRetries: 1,
-  maxUrls: 8,
-  maxTimeMs: 1e4,
-  maxTotalTimeMs: 1e4
-});
-var CurlError = class extends Error {
-  constructor(exitCode, message3) {
-    super(message3);
-    this.exitCode = exitCode;
-    this.name = "CurlError";
-  }
-  exitCode;
-};
-
-// packages/safe-bash/src/commands/network/fetch-transport.ts
-function requestBody(source2, signal) {
-  if (!source2) return void 0;
-  const iterator = source2[Symbol.asyncIterator]();
-  return new ReadableStream({
-    async pull(controller) {
-      try {
-        signal.throwIfAborted();
-        const next = await iterator.next();
-        if (next.done) controller.close();
-        else controller.enqueue(next.value);
-      } catch (error) {
-        controller.error(error);
-      }
-    },
-    async cancel(reason) {
-      await iterator.return?.(reason);
-    }
-  });
-}
-function createFetchTransport(options3 = {}) {
-  const fetchRequest = options3.fetch ?? globalThis.fetch;
-  if (typeof fetchRequest !== "function") throw new TypeError("Fetch is unavailable");
-  return async (input3) => {
-    input3.signal.throwIfAborted();
-    const url = new URL(input3.url);
-    if (url.protocol !== "http:" && url.protocol !== "https:") throw new CurlError(1, "Unsupported protocol");
-    if (input3.denyPrivateNetworks === true) throw new CurlError(7, "Fetch transport cannot enforce private-network denial");
-    const stopped = new AbortController();
-    const signal = AbortSignal.any([input3.signal, stopped.signal]);
-    const body = requestBody(input3.body, signal);
-    const headers = new Headers();
-    for (const [name2, value2] of input3.headers) headers.append(name2, value2);
-    const request = new Request(url, {
-      method: input3.method,
-      headers,
-      body,
-      credentials: "omit",
-      redirect: "manual",
-      signal,
-      ...body ? { duplex: "half" } : {}
-    });
-    let response;
-    const dispose = async () => {
-      stopped.abort();
-      if (response?.body) await response.body.cancel().catch(() => void 0);
-    };
-    input3.registerCleanup?.(dispose);
-    response = await fetchRequest(request);
-    const reader = response.body?.getReader();
-    const responseBody = reader ? (async function* () {
-      try {
-        while (true) {
-          input3.signal.throwIfAborted();
-          const next = await reader.read();
-          if (next.done) return;
-          yield next.value;
-        }
-      } finally {
-        reader.releaseLock();
-      }
-    })() : (async function* () {
-    })();
-    return {
-      status: response.status,
-      statusText: response.statusText,
-      headers: [...response.headers.entries()],
-      body: responseBody,
-      dispose
-    };
-  };
-}
-
-// packages/safe-bash/src/commands/network/authorizer.ts
-init_platform();
-
-// packages/safe-bash/src/commands/network/private-address.ts
-init_platform();
-function privateIPv4(first, second) {
-  return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31 || first === 100 && second >= 64 && second <= 127 || first === 198 && second >= 18 && second <= 19 || first >= 224;
-}
-function privateHostname(input3) {
-  const hostname = input3.toLowerCase().replace(/\.$/u, "").replace(/^\[|\]$/gu, "");
-  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1") return true;
-  if (hostname.includes(":")) {
-    const [prefix3, suffix2] = hostname.split("::");
-    const leading = prefix3 ? prefix3.split(":") : [];
-    const trailing = suffix2 ? suffix2.split(":") : [];
-    const hextets = new Array(8).fill(0);
-    for (let index = 0; index < leading.length; index++) hextets[index] = Number.parseInt(leading[index], 16);
-    for (let index = 0; index < trailing.length; index++) hextets[8 - trailing.length + index] = Number.parseInt(trailing[index], 16);
-    if (hextets.every((value2) => value2 === 0)) return true;
-    const mappedIPv4 = hextets.slice(0, 5).every((value2) => value2 === 0) && hextets[5] === 65535;
-    const translatedIPv4 = hextets.slice(0, 4).every((value2) => value2 === 0) && hextets[4] === 65535 && hextets[5] === 0;
-    const nat64IPv4 = hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((value2) => value2 === 0);
-    const compatibleIPv4 = hextets.slice(0, 6).every((value2) => value2 === 0);
-    if (mappedIPv4 || translatedIPv4 || nat64IPv4 || compatibleIPv4) {
-      return privateIPv4(hextets[6] >>> 8, hextets[6] & 255);
-    }
-    if (hextets[0] === 8194) return privateIPv4(hextets[1] >>> 8, hextets[1] & 255);
-    return (hextets[0] & 65024) === 64512 || (hextets[0] & 65472) === 65152 || (hextets[0] & 65472) === 65216 || (hextets[0] & 65280) === 65280 || hextets[0] === 100 && hextets[1] === 65435 && hextets[2] === 1;
-  }
-  const parts = hostname.split(".");
-  if (parts.length !== 4 || parts.some((part) => !part || Array.from(part).some((character) => character < "0" || character > "9"))) return false;
-  const octets = parts.map(Number);
-  if (octets.some((value2) => value2 < 0 || value2 > 255)) return false;
-  const [first, second] = octets;
-  return privateIPv4(first, second);
-}
-
-// packages/safe-bash/src/commands/network/authorizer.ts
-function createOriginAuthorizer(allowlist = "*", options3 = {}) {
-  const denyPrivateNetworks = options3.denyPrivateNetworks === true;
-  const origins = /* @__PURE__ */ new Set();
-  const hosts = /* @__PURE__ */ new Set();
-  for (const entry of allowlist === "*" ? [] : allowlist) {
-    const value2 = entry.trim();
-    if (!value2) throw new TypeError("Origin allowlist entries must not be empty");
-    if (value2.includes("://")) {
-      const url = new URL(value2);
-      if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
-        throw new TypeError(`Origin allowlist entry must be an origin: ${entry}`);
-      }
-      origins.add(url.origin);
-    } else {
-      if (value2.includes("/") || value2.includes("@")) throw new TypeError(`Invalid hostname allowlist entry: ${entry}`);
-      hosts.add(value2.toLowerCase().replace(/\.$/u, ""));
-    }
-  }
-  return (request) => {
-    const url = new URL(request.url);
-    const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
-    if (denyPrivateNetworks) {
-      request.requirePrivateNetworkDeny?.();
-      if (privateHostname(hostname)) return false;
-    }
-    return allowlist === "*" || origins.has(url.origin) || hosts.has(hostname);
-  };
-}
-
 // packages/safe-bash/src/commands/grep-aliases/index.ts
 init_platform();
 function createGrepAliasCommands(options3 = {}) {
@@ -53246,6 +52914,7 @@ export {
   ACCESS_MODES,
   CommandArgumentIdentityError,
   CommandRegistry,
+  CurlError,
   DEFAULT_ARCHIVE_LIMITS,
   EreLedger,
   EreProfileLimitError,
@@ -53287,6 +52956,8 @@ export {
   createColumnCommand,
   createColumnCommands,
   createCommandArguments,
+  createCurlCommand,
+  createCurlCommands,
   createDiffPatchCommands,
   createDuCommand,
   createDuCommands,
@@ -53301,6 +52972,7 @@ export {
   createMemoryFileSystem2 as createMemoryFileSystem,
   createMetadataCommands,
   createMountFileSystem2 as createMountFileSystem,
+  createNetworkCommands,
   createOriginAuthorizer,
   createOutputOperation,
   createOverlayFileSystem2 as createOverlayFileSystem,
@@ -53320,13 +52992,16 @@ export {
   createTimeoutCommands,
   createTreeCommand,
   createTreeCommands,
+  createWgetCommand,
   createWhichCommand,
   createWhichCommands,
   createXmlCommands,
   createYqCommand,
   createYqCommands,
+  curlCommands,
   defaultJqLimits,
   defaultMemoryFileSystemLimits2 as defaultMemoryFileSystemLimits,
+  defaultNetworkLimits,
   defaultSafeJsLimits,
   defaultXmlQueryLimits,
   diffPatchCommands,
@@ -53349,6 +53024,7 @@ export {
   makeSafeJsShellModule,
   matchEre,
   metadataCommands,
+  networkCommands,
   normalizePath2 as normalizePath,
   outputFailure,
   parseShell,