@poe-platform/safe-bash 0.1.530 → 0.1.531

package/dist/safe-bash/chunks/chunk-UGMUVHIY.js

@@ -0,0 +1,1603 @@
+import {
+  createOutputOperation
+} from "./chunk-2GV4WO7O.js";
+import {
+  FsError,
+  __toESM,
+  collectBytes,
+  createBytePipe,
+  getCommandArguments,
+  import_buffer,
+  init_platform,
+  normalizePath,
+  outputFailure,
+  pathOf,
+  posixPath,
+  readBytes,
+  require_buffer,
+  shellValueByteLength,
+  shellValueBytes,
+  toByteSource,
+  writeBytes,
+  writeDiagnostic,
+  yieldTurn
+} from "./chunk-LUJYX5H5.js";
+
+// packages/safe-bash/src/commands/network/public.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/wget.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/curl.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/aggregate.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/shared.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/types.ts
+init_platform();
+var defaultNetworkLimits = Object.freeze({
+  maxUploadBytes: 64 * 1024 * 1024,
+  maxDownloadBytes: 64 * 1024 * 1024,
+  maxBufferBytes: 8 * 1024 * 1024,
+  maxHeaderBytes: 64 * 1024,
+  maxRedirects: 10,
+  maxRetries: 5,
+  maxUrls: 32,
+  maxTimeMs: 12e4,
+  maxTotalTimeMs: 12e4
+});
+var cloudflareWorkerNetworkLimits = Object.freeze({
+  maxUploadBytes: 4 * 1024 * 1024,
+  maxDownloadBytes: 4 * 1024 * 1024,
+  maxBufferBytes: 1024 * 1024,
+  maxHeaderBytes: 32 * 1024,
+  maxRedirects: 2,
+  maxRetries: 1,
+  maxUrls: 8,
+  maxTimeMs: 1e4,
+  maxTotalTimeMs: 1e4
+});
+var CurlError = class extends Error {
+  constructor(exitCode, message) {
+    super(message);
+    this.exitCode = exitCode;
+    this.name = "CurlError";
+  }
+  exitCode;
+};
+
+// packages/safe-bash/src/commands/network/shared.ts
+var encode = (text) => new TextEncoder().encode(text);
+function limitsFor(overrides = {}) {
+  const result = { ...defaultNetworkLimits, ...overrides };
+  for (const [name, value] of Object.entries(result)) {
+    const minimum = name === "maxRedirects" || name === "maxRetries" ? 0 : 1;
+    if (!Number.isSafeInteger(value) || value < minimum || name === "maxTimeMs" && value > 2147483647) {
+      throw new RangeError(`Invalid network limit: ${name}`);
+    }
+  }
+  return Object.freeze(result);
+}
+async function withSignal(operation, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      reject(signal.reason);
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve().then(operation).then((value) => {
+      cleanup();
+      resolve(value);
+    }, (error) => {
+      cleanup();
+      reject(error);
+    });
+  });
+}
+async function delay(milliseconds, signal) {
+  let timer;
+  try {
+    await withSignal(() => new Promise((resolve) => {
+      timer = setTimeout(resolve, milliseconds);
+    }), signal);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function header(headers, name) {
+  return headers.find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
+}
+function networkError(error) {
+  if (error instanceof CurlError) return error;
+  const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+  if (["ENOTFOUND", "EAI_AGAIN"].includes(code)) return new CurlError(6, "Could not resolve host");
+  if (["ECONNREFUSED", "ENETUNREACH", "EHOSTUNREACH"].includes(code)) return new CurlError(7, "Failed to connect");
+  if (/CERT|SELF_SIGNED|UNABLE_TO_VERIFY/.test(code)) return new CurlError(60, "TLS certificate verification failed");
+  if (/TLS|SSL/.test(code)) return new CurlError(35, "TLS handshake failed");
+  return new CurlError(56, "Network transfer failed");
+}
+async function diagnostic(context, error) {
+  await writeDiagnostic(context.stderr, `${context.command}: (${error.exitCode}) ${error.message}
+`, context.signal);
+}
+
+// packages/safe-bash/src/commands/network/aggregate.ts
+function createDeadlineOutput(context, destination, remaining) {
+  const lifetime = new AbortController();
+  const signal = AbortSignal.any([context.signal, lifetime.signal]);
+  const operation = createOutputOperation({ ...context, signal }, destination);
+  if (operation.signal.aborted) return operation;
+  let timer;
+  operation.registerCleanup(() => {
+    clearTimeout(timer);
+    timer = void 0;
+  });
+  timer = setTimeout(() => lifetime.abort(new CurlError(28, "Operation timed out")), Math.max(0, remaining));
+  return operation;
+}
+async function deadlineDiagnostic(context, error, remaining) {
+  const operation = createDeadlineOutput(context, context.stderr, remaining);
+  try {
+    await diagnostic({ ...context, stderr: operation.output, signal: operation.signal }, error);
+  } finally {
+    await operation.close();
+  }
+}
+
+// packages/safe-bash/src/commands/network/args.ts
+init_platform();
+
+// packages/safe-bash/browser/network.mjs
+init_platform();
+var import_buffer2 = __toESM(require_buffer(), 1);
+function createDefaultHttpTransport() {
+  throw new TypeError("Portable network commands require an explicit HTTP transport; inject createFetchTransport() or a host transport");
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return import_buffer2.Buffer.from(bytes);
+}
+function validateHeaderName(name) {
+  if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) throw new TypeError("Invalid HTTP header name");
+}
+function validateHeaderValue(_name, value) {
+  if (/[^\t\x20-\x7e\x80-\xff]/.test(value)) throw new TypeError("Invalid HTTP header value");
+}
+
+// packages/safe-bash/src/commands/network/args.ts
+var values = {
+  X: "request",
+  d: "data",
+  H: "header",
+  u: "user",
+  A: "user-agent",
+  e: "referer",
+  o: "output",
+  D: "dump-header",
+  w: "write-out",
+  T: "upload-file",
+  m: "max-time",
+  F: "form"
+};
+var flags = {
+  L: "location",
+  I: "head",
+  i: "include",
+  f: "fail",
+  s: "silent",
+  S: "show-error",
+  G: "get",
+  O: "remote-name",
+  v: "verbose",
+  q: "disable",
+  N: "no-buffer",
+  g: "globoff",
+  h: "help",
+  V: "version"
+};
+var longValues = /* @__PURE__ */ new Set([
+  ...Object.values(values),
+  "data-ascii",
+  "data-raw",
+  "data-binary",
+  "data-urlencode",
+  "json",
+  "form-string",
+  "url",
+  "oauth2-bearer",
+  "max-redirs",
+  "max-filesize",
+  "retry",
+  "retry-delay"
+]);
+function number(value, integral = false) {
+  if (!(integral ? /^\d+$/ : /^\d+(?:\.\d+)?$/).test(value)) throw new CurlError(2, "Invalid numeric option");
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0 || parsed > Number.MAX_SAFE_INTEGER) throw new CurlError(2, "Invalid numeric option");
+  return parsed;
+}
+function addHeader(result, raw) {
+  const colon = raw.indexOf(":");
+  const semicolon = colon < 0 && raw.endsWith(";");
+  if (colon < 1 && !semicolon) throw new CurlError(2, "Invalid HTTP header");
+  const name = semicolon ? raw.slice(0, -1) : raw.slice(0, colon);
+  const value = semicolon ? "" : raw.slice(colon + 1).trim();
+  try {
+    validateHeaderName(name);
+    validateHeaderValue(name, value);
+  } catch {
+    throw new CurlError(2, "Invalid HTTP header");
+  }
+  if (["host", "content-length", "transfer-encoding", "connection", "proxy-authorization", "upgrade", "expect"].includes(name.toLowerCase())) {
+    throw new CurlError(2, "Transport-controlled HTTP header is not supported");
+  }
+  result.headers.push([name, value === "" && !semicolon ? null : value]);
+}
+function parseArguments(args, limits) {
+  const result = {
+    urls: [],
+    data: [],
+    headers: [],
+    include: false,
+    head: false,
+    get: false,
+    location: false,
+    remoteName: false,
+    fail: false,
+    failWithBody: false,
+    silent: false,
+    showError: false,
+    verbose: false,
+    globoff: false,
+    help: false,
+    version: false,
+    retries: 0,
+    retryDelayMs: 0,
+    maxTimeMs: limits.maxTimeMs,
+    maxRedirects: limits.maxRedirects,
+    maxFileSize: limits.maxDownloadBytes
+  };
+  const apply = (option, value) => {
+    switch (option) {
+      case "request":
+        if (!value || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(value) || ["CONNECT", "TRACE"].includes(value.toUpperCase())) {
+          throw new CurlError(2, "Invalid or unsupported HTTP method");
+        }
+        result.method = value;
+        break;
+      case "header":
+        addHeader(result, value);
+        break;
+      case "user-agent":
+        addHeader(result, `User-Agent: ${value}`);
+        break;
+      case "referer":
+        addHeader(result, `Referer: ${value}`);
+        break;
+      case "user":
+        if (!value.includes(":")) throw new CurlError(2, "Basic authentication requires user:password; prompting is unsupported");
+        result.user = value;
+        break;
+      case "oauth2-bearer":
+        result.bearer = value;
+        break;
+      case "data":
+      case "data-ascii":
+        result.data.push({ kind: "data", value });
+        break;
+      case "data-raw":
+        result.data.push({ kind: "raw", value });
+        break;
+      case "data-binary":
+        result.data.push({ kind: "binary", value });
+        break;
+      case "data-urlencode":
+        result.data.push({ kind: "urlencode", value });
+        break;
+      case "json":
+      case "form":
+      case "form-string":
+        result.data.push({ kind: option, value });
+        break;
+      case "output":
+        result.output = value;
+        result.remoteName = false;
+        break;
+      case "remote-name":
+        result.remoteName = true;
+        delete result.output;
+        break;
+      case "dump-header":
+        result.dumpHeader = value;
+        break;
+      case "write-out":
+        result.writeOut = value;
+        break;
+      case "upload-file":
+        result.upload = value;
+        break;
+      case "url":
+        result.urls.push(value);
+        break;
+      case "max-time": {
+        const milliseconds = number(value) * 1e3;
+        result.maxTimeMs = milliseconds === 0 ? limits.maxTimeMs : Math.min(milliseconds, limits.maxTimeMs);
+        break;
+      }
+      case "max-filesize":
+        result.maxFileSize = Math.min(number(value, true), limits.maxDownloadBytes);
+        break;
+      case "max-redirs":
+        result.maxRedirects = Math.min(number(value, true), limits.maxRedirects);
+        break;
+      case "retry":
+        result.retries = Math.min(number(value, true), limits.maxRetries);
+        break;
+      case "retry-delay":
+        result.retryDelayMs = Math.min(number(value) * 1e3, limits.maxTimeMs);
+        break;
+      case "location":
+        result.location = true;
+        break;
+      case "head":
+        result.head = true;
+        break;
+      case "include":
+      case "show-headers":
+        result.include = true;
+        break;
+      case "get":
+        result.get = true;
+        break;
+      case "fail":
+        result.fail = true;
+        break;
+      case "fail-with-body":
+        result.failWithBody = true;
+        break;
+      case "silent":
+        result.silent = true;
+        break;
+      case "show-error":
+        result.showError = true;
+        break;
+      case "verbose":
+        result.verbose = true;
+        break;
+      case "globoff":
+        result.globoff = true;
+        break;
+      case "help":
+        result.help = true;
+        break;
+      case "version":
+        result.version = true;
+        break;
+      case "disable":
+      case "no-buffer":
+      case "no-progress-meter":
+      case "basic":
+        break;
+      default:
+        throw new CurlError(2, "Unsupported curl option");
+    }
+  };
+  let ended = false;
+  for (let index = 0; index < args.length; index++) {
+    const argument = args[index];
+    if (ended || !argument.startsWith("-") || argument === "-") {
+      result.urls.push(argument);
+      continue;
+    }
+    if (argument === "--") {
+      ended = true;
+      continue;
+    }
+    if (argument.startsWith("--")) {
+      const equals = argument.indexOf("=");
+      const name = argument.slice(2, equals < 0 ? void 0 : equals);
+      let value = equals < 0 ? void 0 : argument.slice(equals + 1);
+      if (longValues.has(name)) {
+        value ??= args[++index];
+        if (value === void 0) throw new CurlError(2, "Option requires an argument");
+      } else if (value !== void 0) throw new CurlError(2, "Unexpected option argument");
+      apply(name, value);
+    } else {
+      for (let offset = 1; offset < argument.length; offset++) {
+        const name = argument[offset];
+        if (values[name]) {
+          const value = argument.slice(offset + 1) || args[++index];
+          if (value === void 0) throw new CurlError(2, "Option requires an argument");
+          apply(values[name], value);
+          break;
+        }
+        if (!flags[name]) throw new CurlError(2, "Unsupported curl option");
+        apply(flags[name]);
+      }
+    }
+  }
+  if (!result.help && !result.version && !result.urls.length) throw new CurlError(2, "No URL specified");
+  if (result.urls.length > limits.maxUrls) throw new CurlError(2, "URL count exceeds host limit");
+  if (result.fail && result.failWithBody) throw new CurlError(2, "--fail and --fail-with-body are mutually exclusive");
+  const form = result.data.some((part) => part.kind === "form" || part.kind === "form-string");
+  if (result.upload !== void 0 && result.data.length || form && result.data.some((part) => !part.kind.startsWith("form")) || result.get && (form || result.upload !== void 0) || result.head && (result.upload !== void 0 || result.data.length > 0) && !result.get) {
+    throw new CurlError(2, "Incompatible request body options");
+  }
+  if (result.data.some((part) => part.kind === "json") && result.data.some((part) => part.kind !== "json")) {
+    throw new CurlError(2, "Mixing JSON and other data modes is unsupported");
+  }
+  return result;
+}
+
+// packages/safe-bash/src/commands/network/body.ts
+init_platform();
+function percent(bytes) {
+  let output = "";
+  for (const byte of bytes) output += byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 || byte >= 48 && byte <= 57 || [45, 46, 95, 126].includes(byte) ? String.fromCharCode(byte) : byte === 32 ? "+" : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+  return encode(output);
+}
+function dataPart(argument) {
+  const value = argument.value;
+  if (argument.kind === "urlencode") {
+    const equals = value.indexOf("=");
+    if (equals >= 0) return [{ bytes: encode(equals ? `${value.slice(0, equals)}=` : "") }, { bytes: encode(value.slice(equals + 1)), urlencode: true }];
+    const at = value.indexOf("@");
+    if (at >= 0) return [{ bytes: encode(at ? `${value.slice(0, at)}=` : "") }, { file: value.slice(at + 1), urlencode: true }];
+    return [{ bytes: encode(value), urlencode: true }];
+  }
+  if (argument.kind !== "raw" && value.startsWith("@")) return [{ file: value.slice(1), strip: argument.kind === "data" }];
+  return [{ bytes: encode(value) }];
+}
+function quoted(value) {
+  if (/[\r\n\0]/.test(value)) throw new CurlError(2, "Invalid multipart field metadata");
+  return value.replace(/["\\]/g, "\\$&");
+}
+function multipart(argument, boundary) {
+  const equals = argument.value.indexOf("=");
+  if (equals < 1) throw new CurlError(2, "Multipart form requires name=value");
+  const name = quoted(argument.value.slice(0, equals));
+  let value = argument.value.slice(equals + 1);
+  let type;
+  let filename;
+  if (argument.kind === "form") {
+    const fields = value.split(";");
+    value = fields.shift();
+    for (const field of fields) {
+      if (field.startsWith("type=")) type = field.slice(5);
+      else if (field.startsWith("filename=")) filename = field.slice(9);
+      else throw new CurlError(2, "Unsupported multipart form attribute");
+    }
+  }
+  const isFile = argument.kind === "form" && /^[<@]/.test(value);
+  if (isFile && (value.slice(1).includes(",") || !value.slice(1))) throw new CurlError(2, "Unsupported multipart file list");
+  if (isFile && value.startsWith("@")) filename ??= posixPath.basename(value.slice(1));
+  if (type !== void 0 && !/^[\w!#$&^_.+-]+\/[\w!#$&^_.+-]+$/.test(type)) throw new CurlError(2, "Invalid multipart content type");
+  let preamble = `--${boundary}\r
+Content-Disposition: form-data; name="${name}"`;
+  if (filename !== void 0) preamble += `; filename="${quoted(filename)}"`;
+  preamble += "\r\n";
+  if (type || filename !== void 0) preamble += `Content-Type: ${type ?? "application/octet-stream"}\r
+`;
+  preamble += "\r\n";
+  return [{ bytes: encode(preamble) }, isFile ? { file: value.slice(1) } : { bytes: encode(value) }, { bytes: encode("\r\n") }];
+}
+function createBody(context, args, limits) {
+  if (!args.data.length && args.upload === void 0) return void 0;
+  const parts = [];
+  let contentType;
+  const form = args.data.some((part) => part.kind.startsWith("form"));
+  if (form) {
+    const boundary = `virtual-bash-${randomBytes(18).toString("hex")}`;
+    contentType = `multipart/form-data; boundary=${boundary}`;
+    for (const argument of args.data) parts.push(...multipart(argument, boundary));
+    parts.push({ bytes: encode(`--${boundary}--\r
+`) });
+  } else if (args.upload !== void 0) parts.push({ file: args.upload });
+  else {
+    const json = args.data[0]?.kind === "json";
+    contentType = json ? "application/json" : "application/x-www-form-urlencoded";
+    args.data.forEach((argument, index) => {
+      if (index && !json) parts.push({ bytes: encode("&") });
+      parts.push(...dataPart(argument));
+    });
+  }
+  const hasStdin = parts.some((part) => part.file === "-");
+  let opened = false;
+  let replayComplete = false;
+  let replayable = true;
+  let cachedBytes = 0;
+  let cache = [];
+  let stdinUsed = false;
+  const source = async function* (part, signal) {
+    if (part.bytes !== void 0) {
+      yield part.bytes;
+      return;
+    }
+    if (part.file === "-") {
+      if (!stdinUsed) {
+        stdinUsed = true;
+        yield* readBytes(context.stdin, signal);
+      }
+      return;
+    }
+    try {
+      const path = pathOf(context, part.file);
+      const capabilities = await context.fs.capabilitiesFor?.(path, { signal }) ?? context.fs.capabilities;
+      signal.throwIfAborted();
+      if (context.fs.readStream && capabilities.streamingRead !== false) yield* readBytes(context.fs.readStream(path, { signal }), signal);
+      else yield await context.fs.readFile(path, { signal, maxBytes: Math.min(limits.maxBufferBytes, limits.maxUploadBytes) });
+    } catch (error) {
+      signal.throwIfAborted();
+      if (error instanceof CurlError) throw error;
+      throw new CurlError(26, "Failed to read virtual upload file");
+    }
+  };
+  return {
+    ...contentType === void 0 ? {} : { contentType },
+    open(signal) {
+      return (async function* () {
+        if (hasStdin && opened) {
+          if (!replayComplete || !replayable) throw new CurlError(65, "Cannot replay stdin upload within the host buffer limit");
+          for (const chunk of cache) {
+            signal.throwIfAborted();
+            yield chunk.slice();
+          }
+          return;
+        }
+        opened = true;
+        let count = 0;
+        let chunks = 0;
+        for (const part of parts) for await (const raw of source(part, signal)) {
+          if (++chunks % 256 === 0) await yieldTurn(signal);
+          for (let offset = 0; offset < raw.length; offset += 16 * 1024) {
+            signal.throwIfAborted();
+            let chunk = raw.subarray(offset, offset + 16 * 1024);
+            if (part.strip) chunk = chunk.filter((byte) => byte !== 0 && byte !== 10 && byte !== 13);
+            if (part.urlencode) chunk = percent(chunk);
+            count += chunk.length;
+            if (count > limits.maxUploadBytes) throw new CurlError(63, "Upload exceeds host byte limit");
+            if (hasStdin && replayable) {
+              cachedBytes += chunk.length;
+              if (cachedBytes > limits.maxBufferBytes) {
+                replayable = false;
+                cache = [];
+              } else cache.push(new Uint8Array(chunk));
+            }
+            if (chunk.length) yield chunk;
+          }
+        }
+        replayComplete = true;
+      })();
+    }
+  };
+}
+async function queryData(body, signal, limits) {
+  try {
+    return import_buffer.Buffer.from(await collectBytes(body.open(signal), { signal, maxBytes: limits.maxBufferBytes })).toString("utf8");
+  } catch (error) {
+    signal.throwIfAborted();
+    if (error instanceof CurlError) throw error;
+    throw new CurlError(63, "Query data exceeds host buffer limit");
+  }
+}
+
+// packages/safe-bash/src/commands/network/output.ts
+init_platform();
+
+// packages/safe-bash/src/contracts/filesystem-output.ts
+init_platform();
+var filesystemOutputBudgets = /* @__PURE__ */ new WeakMap();
+function bindFileOutputBudget(context, budget) {
+  if (!context.registerCleanup) throw new TypeError("Shell output budgets require invocation cleanup ownership");
+  filesystemOutputBudgets.set(context.registerCleanup, budget);
+}
+async function writeFileOutput(context, bytes, write) {
+  context.signal.throwIfAborted();
+  const budget = context.registerCleanup && filesystemOutputBudgets.get(context.registerCleanup);
+  let pending;
+  const destination = { write(chunk) {
+    context.signal.throwIfAborted();
+    return pending = (async () => {
+      await write(chunk);
+    })();
+  } };
+  try {
+    await (budget?.(destination) ?? destination).write(bytes);
+  } catch (error) {
+    await pending?.catch(() => {
+    });
+    context.signal.throwIfAborted();
+    throw error;
+  }
+  context.signal.throwIfAborted();
+}
+async function openFileOutput(context, path, flag, incremental) {
+  let pipe;
+  let task;
+  let completed = false;
+  let ended = false;
+  let closing = false;
+  let failure;
+  const consumer = new AbortController();
+  let writes = Promise.resolve();
+  let acknowledge;
+  const acknowledgeWrite = () => {
+    const accepted = acknowledge;
+    acknowledge = void 0;
+    accepted?.();
+  };
+  let ready;
+  const opened = new Promise((resolve) => {
+    ready = resolve;
+  });
+  const destination = {
+    [outputFailure]: (reason) => operation.abort(reason),
+    async write(chunk) {
+      if (closing) throw new FsError("EBADF", { path, syscall: "write" });
+      const writing = writes.then(async () => {
+        for (let offset = 0; offset < chunk.byteLength; offset += 64 * 1024) {
+          const accepted = new Promise((resolve) => {
+            acknowledge = resolve;
+          });
+          await pipe.writable.write(chunk.subarray(offset, offset + 64 * 1024));
+          await accepted;
+          if (failure) throw failure.reason;
+          operation.signal.throwIfAborted();
+        }
+      });
+      writes = writing.catch(() => {
+      });
+      await writing;
+    }
+  };
+  const budget = context.registerCleanup && filesystemOutputBudgets.get(context.registerCleanup);
+  const operation = createOutputOperation(context, budget?.(destination) ?? destination);
+  operation.registerCleanup(async () => {
+    closing = true;
+    if (!completed) {
+      void operation.abort(operation.signal.aborted ? operation.signal.reason : new FsError("ECANCELED", { path, syscall: "write" }));
+      await pipe?.abort(operation.signal.reason);
+    }
+    await task?.catch(() => {
+    });
+    await writes;
+  });
+  try {
+    pipe = createBytePipe({ highWaterMark: 1, signal: operation.signal });
+    let reading = false;
+    const source = {
+      [Symbol.asyncIterator]() {
+        return (async function* () {
+          reading = true;
+          ready();
+          for await (const chunk of pipe.readable) {
+            yield chunk;
+            acknowledgeWrite();
+          }
+          operation.signal.throwIfAborted();
+          ended = true;
+        })();
+      }
+    };
+    task = (async () => {
+      const { fs } = context;
+      const signal = operation.signal;
+      signal.throwIfAborted();
+      const capabilities = await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities;
+      if (capabilities.readOnly === true) throw new FsError("EROFS", { path, syscall: "write" });
+      try {
+        await fs.access(path, 2, { signal });
+      } catch (error) {
+        signal.throwIfAborted();
+        if (!(error instanceof FsError) || error.code !== "ENOENT" && error.code !== "ENOTSUP") throw error;
+      }
+      signal.throwIfAborted();
+      const streaming = flag === "a" ? capabilities.streamingAppend ?? capabilities.streamingWrite : capabilities.streamingWrite;
+      if ((!incremental || capabilities.descriptorWriteStream === true) && streaming !== false && fs.writeStream) {
+        try {
+          await fs.writeStream(path, source, { flag, signal });
+          if (!ended) throw new FsError("EIO", { path, message: "Streaming writer returned before consuming output" });
+          return;
+        } catch (error) {
+          signal.throwIfAborted();
+          if (reading || !(error instanceof FsError) || error.code !== "ENOTSUP") throw error;
+        }
+      }
+      if (flag === "w" && capabilities.write === false) throw new FsError("ENOTSUP", { path, syscall: "writeFile" });
+      if ((!incremental || flag === "a") && capabilities.append === false) throw new FsError("ENOTSUP", { path, syscall: "appendFile" });
+      const sink = incremental ? await incremental() : await (async () => {
+        if (flag === "a") await fs.appendFile(path, new Uint8Array(), { signal });
+        else await fs.writeFile(path, new Uint8Array(), { flag, signal });
+        return { write: (chunk) => fs.appendFile(path, chunk, { signal }) };
+      })();
+      for await (const chunk of source) {
+        signal.throwIfAborted();
+        await sink.write(chunk);
+      }
+    })();
+    void task.then(acknowledgeWrite, (error) => {
+      failure = { reason: error };
+      acknowledgeWrite();
+      if (!operation.signal.aborted) consumer.abort(error);
+      void operation.abort(error).catch(() => {
+      });
+    });
+    await Promise.race([opened, task]);
+    operation.signal.throwIfAborted();
+    const write = async (chunk) => {
+      try {
+        await operation.output.write(chunk);
+      } catch (error) {
+        throw failure ? failure.reason : error;
+      }
+    };
+    return {
+      signal: operation.signal,
+      sink: {
+        [outputFailure]: destination[outputFailure],
+        ownedOutput: { consumerClosed: consumer.signal, write },
+        write
+      },
+      async finish() {
+        closing = true;
+        try {
+          await writes;
+          await pipe.close();
+          await task;
+          operation.signal.throwIfAborted();
+          completed = true;
+        } catch (error) {
+          throw failure ? failure.reason : error;
+        } finally {
+          await operation.close();
+        }
+      },
+      abort: (reason) => operation.abort(reason)
+    };
+  } catch (error) {
+    await operation.abort(error);
+    throw error;
+  }
+}
+
+// packages/safe-bash/src/commands/network/output.ts
+function responseHeaders(response, maxBytes) {
+  if (!Number.isInteger(response.status) || response.status < 100 || response.status > 599 || /[\r\n]/.test(response.statusText)) {
+    throw new CurlError(56, "Invalid HTTP response status");
+  }
+  const version = response.httpVersion ?? "1.1";
+  if (!/^\d(?:\.\d)?$/.test(version)) throw new CurlError(56, "Invalid HTTP response version");
+  let text = `HTTP/${version} ${response.status} ${response.statusText}\r
+`;
+  for (const [name, value] of response.headers) {
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name) || /[\r\n\0]/.test(value)) throw new CurlError(56, "Invalid HTTP response header");
+    text += `${name}: ${value}\r
+`;
+    if (import_buffer.Buffer.byteLength(text, "latin1") > maxBytes) throw new CurlError(63, "Response headers exceed host byte limit");
+  }
+  return new Uint8Array(import_buffer.Buffer.from(`${text}\r
+`, "latin1"));
+}
+async function writeOutput(context, path, source, signal) {
+  if (path === void 0 || path === "-") {
+    try {
+      for await (const chunk of readBytes(source, signal)) {
+        try {
+          await writeBytes(context.stdout, chunk, signal);
+        } catch {
+          signal.throwIfAborted();
+          throw new CurlError(23, "Failed writing output");
+        }
+      }
+    } catch (error) {
+      await context.stdout[outputFailure]?.(error);
+      throw error;
+    }
+    return;
+  }
+  try {
+    const target = await openFileOutput({ ...context, signal }, pathOf(context, path), "w");
+    try {
+      for await (const chunk of readBytes(source, target.signal)) await target.sink.write(chunk);
+      await target.finish();
+    } catch (error) {
+      await target.abort(error);
+      throw error;
+    }
+  } catch (error) {
+    signal.throwIfAborted();
+    if (error instanceof CurlError) throw error;
+    throw new CurlError(23, "Failed writing virtual output file");
+  }
+}
+async function dumpHeaders(context, path, bytes, append, signal) {
+  try {
+    if (path === "-") await writeBytes(context.stdout, bytes, signal);
+    else {
+      const target = await openFileOutput({ ...context, signal }, pathOf(context, path), append ? "a" : "w");
+      try {
+        await target.sink.write(bytes);
+        await target.finish();
+      } catch (error) {
+        await target.abort(error);
+        throw error;
+      }
+    }
+  } catch {
+    signal.throwIfAborted();
+    throw new CurlError(23, "Failed writing response headers");
+  }
+}
+function writeOutFormat(format, values2) {
+  let result = "";
+  for (let index = 0; index < format.length; index++) {
+    const character = format[index];
+    if (character === "\\") {
+      const next = format[++index];
+      result += next === "n" ? "\n" : next === "r" ? "\r" : next === "t" ? "	" : next === void 0 ? "\\" : `\\${next}`;
+    } else if (character === "%" && format[index + 1] === "%") {
+      result += "%";
+      index++;
+    } else if (character === "%" && format[index + 1] === "{") {
+      const end = format.indexOf("}", index + 2);
+      if (end < 0) throw new CurlError(2, "Invalid write-out format");
+      const name = format.slice(index + 2, end);
+      if (!Object.hasOwn(values2, name)) throw new CurlError(2, "Unsupported write-out variable");
+      result += values2[name];
+      index = end;
+    } else result += character;
+  }
+  return encode(result);
+}
+
+// packages/safe-bash/src/commands/network/curl.ts
+var retryStatuses = /* @__PURE__ */ new Set([408, 429, 500, 502, 503, 504]);
+var redirectStatuses = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var writeOutDefaults = Object.freeze({
+  http_code: "000",
+  response_code: "000",
+  url_effective: "",
+  redirect_url: "",
+  content_type: "",
+  size_download: "0",
+  size_upload: "0",
+  num_redirects: "0",
+  num_retries: "0",
+  time_total: "0.000000",
+  exitcode: "0",
+  errormsg: "",
+  filename_effective: "",
+  method: "GET",
+  http_version: ""
+});
+function parseUrl(text, globoff, redirect = false) {
+  if (/[\s\x00-\x1f\x7f]/.test(text)) throw new CurlError(3, "Malformed URL");
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new CurlError(3, "Malformed URL; explicit HTTP(S) scheme required");
+  }
+  if (!["http:", "https:"].includes(url.protocol)) throw new CurlError(1, "Only HTTP and HTTPS are supported");
+  if (!url.hostname) throw new CurlError(3, "Malformed URL");
+  if (!globoff && /[{}\[\]]/.test(url.pathname + url.search)) throw new CurlError(2, "URL glob expansion is unsupported; use --globoff for a literal URL");
+  let user;
+  if (url.username || url.password) {
+    if (redirect) throw new CurlError(3, "Redirect URLs may not supply credentials");
+    try {
+      user = `${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`;
+    } catch {
+      throw new CurlError(3, "Malformed URL credentials");
+    }
+    url.username = "";
+    url.password = "";
+  }
+  url.hash = "";
+  return { url, ...user === void 0 ? {} : { user } };
+}
+function requestHeaders(args, contentType, user, scoped, maxBytes) {
+  const defaults = [["Accept", args.data[0]?.kind === "json" ? "application/json" : "*/*"], ["User-Agent", args.agent ?? "virtual-bash-curl/0.0"]];
+  if (contentType !== void 0) defaults.push(["Content-Type", contentType]);
+  if (scoped && user !== void 0) defaults.push(["Authorization", `Basic ${import_buffer.Buffer.from(user).toString("base64")}`]);
+  if (scoped && args.bearer !== void 0) {
+    if (/[\r\n\0]/.test(args.bearer)) throw new CurlError(2, "Invalid bearer token");
+    defaults.push(["Authorization", `Bearer ${args.bearer}`]);
+  }
+  const custom = scoped ? args.headers : [];
+  const names = new Set(custom.map(([name]) => name.toLowerCase()));
+  const result = [
+    ...defaults.filter(([name]) => !names.has(name.toLowerCase())),
+    ...custom.filter((entry) => entry[1] !== null)
+  ];
+  if (result.reduce((size, [name, value]) => size + import_buffer.Buffer.byteLength(name + value) + 4, 0) > maxBytes) {
+    throw new CurlError(63, "Request headers exceed host byte limit");
+  }
+  return result;
+}
+async function stop(response, signal) {
+  if (!response) return;
+  const cleanup = Promise.resolve().then(() => response.dispose());
+  void cleanup.catch(() => {
+  });
+  if (!signal.aborted) await withSignal(() => cleanup, signal).catch(() => {
+  });
+}
+function pipeClosed(error) {
+  return error instanceof Error && "code" in error && error.code === "EPIPE";
+}
+function remoteFilename(url) {
+  const name = posixPath.basename(url.pathname);
+  if (!name || name === "/" || name === "." || name === "..") throw new CurlError(23, "URL has no safe remote filename");
+  return name;
+}
+function createCurlCommand(options) {
+  return createTransferCommand(options, {
+    name: "curl",
+    help: "Usage: curl [HTTP(S) URL] [-X METHOD] [-H HEADER] [-d DATA] [-L] [-o VFSFILE]\nExplicit host authorization is required. See network/README.md for supported flags and limits.\n",
+    version: "virtual-bash curl 0.0 (HTTP HTTPS; Node streaming transport)\n",
+    parse: (context, limits) => parseArguments(context.args, limits),
+    status: (code) => code
+  });
+}
+function createTransferCommand(options, profile) {
+  if (typeof options?.authorize !== "function") throw new TypeError(`${profile.name} requires an explicit network authorizer`);
+  const limits = limitsFor(options.limits);
+  const transport = options.transport ?? createDefaultHttpTransport({ maxHeaderBytes: limits.maxHeaderBytes });
+  if (typeof transport !== "function") throw new TypeError("Invalid HTTP transport");
+  const authorize = options.authorize;
+  const executions = /* @__PURE__ */ new WeakMap();
+  return {
+    name: profile.name,
+    async execute(context) {
+      context.signal.throwIfAborted();
+      let args;
+      try {
+        if (context.args.reduce((size, value) => size + import_buffer.Buffer.byteLength(value), 0) > limits.maxBufferBytes) throw new CurlError(2, "Arguments exceed host buffer limit");
+        args = await profile.parse(context, limits);
+        if (args.help || args.version) {
+          await writeBytes(context.stdout, encode(args.version ? profile.version : profile.help), context.signal);
+          return { exitCode: 0 };
+        }
+        for (const url of args.urls) parseUrl(url, args.globoff);
+        if (args.urls.length > 1 && (args.output !== void 0 || args.remoteName || args.dumpHeader !== void 0)) {
+          throw new CurlError(2, "Multiple URLs with file/header outputs are unsupported");
+        }
+      } catch (error) {
+        context.signal.throwIfAborted();
+        const failure = error instanceof CurlError ? error : new CurlError(2, `Invalid ${profile.name} arguments`);
+        await diagnostic(context, new CurlError(profile.status(failure.exitCode), failure.message));
+        return { exitCode: profile.status(failure.exitCode) };
+      }
+      const scope = context.executionScope ?? {};
+      let started = executions.get(scope);
+      if (started === void 0) {
+        started = performance.now();
+        executions.set(scope, started);
+      }
+      let exitCode = 0;
+      for (const url of args.urls) {
+        context.signal.throwIfAborted();
+        if (performance.now() - started >= limits.maxTotalTimeMs) {
+          const failure = new CurlError(28, "Operation timed out");
+          if (!args.silent || args.showError) {
+            try {
+              await deadlineDiagnostic(context, failure, 0);
+            } catch (error) {
+              context.signal.throwIfAborted();
+              if (!(error instanceof CurlError)) throw error;
+            }
+          }
+          return { exitCode: profile.status(failure.exitCode) };
+        }
+        exitCode = await transfer(context, args, url, limits, transport, authorize, started, profile.status);
+      }
+      return { exitCode };
+    }
+  };
+}
+async function transfer(context, args, input, limits, transport, authorize, started, status) {
+  const start = performance.now();
+  const remaining = () => Math.min(args.maxTimeMs - (performance.now() - start), limits.maxTotalTimeMs - (performance.now() - started));
+  const hasFileOutput = args.remoteName || args.output !== void 0 && args.output !== "-" || args.dumpHeader !== void 0 && args.dumpHeader !== "-";
+  const operation = createDeadlineOutput(context, hasFileOutput ? { write: (chunk) => context.stdout.write(chunk) } : context.stdout, remaining());
+  const signal = operation.signal;
+  const borrowed = context.stdout.ownedOutput ? { [Symbol.asyncIterator]() {
+    const iterator = context.stdin[Symbol.asyncIterator]();
+    return { next: () => iterator.next() };
+  } } : context.stdin;
+  let response;
+  let failure;
+  const values2 = { ...writeOutDefaults };
+  let format = args.writeOut;
+  let formatReady = false;
+  let dumped = false;
+  let downloaded = 0;
+  let uploaded = 0;
+  let included = [];
+  let closedOutput = false;
+  const publish = async (bytes) => {
+    const writing = createDeadlineOutput(context, context.stdout, remaining());
+    try {
+      await writeBytes(writing.output, bytes, writing.signal);
+    } catch (error) {
+      context.signal.throwIfAborted();
+      if (!pipeClosed(error)) throw error;
+      closedOutput = true;
+    } finally {
+      await writing.close();
+    }
+  };
+  try {
+    if (format?.startsWith("@")) {
+      try {
+        const bytes = format === "@-" ? await collectBytes(borrowed, { signal, maxBytes: limits.maxBufferBytes }) : await withSignal(() => context.fs.readFile(pathOf(context, format.slice(1)), { signal, maxBytes: limits.maxBufferBytes }), signal);
+        format = import_buffer.Buffer.from(bytes).toString("utf8");
+      } catch {
+        signal.throwIfAborted();
+        throw new CurlError(26, "Failed reading write-out format");
+      }
+    }
+    if (format !== void 0) {
+      writeOutFormat(format, values2);
+      formatReady = true;
+    }
+    const parsed = parseUrl(input, args.globoff);
+    const initial = parsed.url;
+    let body = createBody({ ...context, stdin: borrowed }, args, limits);
+    if (args.get && body) {
+      const query = await queryData(body, signal, limits);
+      if (/[^\x21-\x7e]/.test(query)) throw new CurlError(3, "GET data must be URL encoded");
+      initial.search += `${initial.search ? "&" : "?"}${query.replace(/%[0-9a-f]{2}/gi, (escape) => escape.toLowerCase())}`;
+      body = void 0;
+    }
+    const output = args.remoteName ? args.directoryIndex && initial.pathname.endsWith("/") ? args.directoryIndex : remoteFilename(initial) : args.output;
+    values2.filename_effective = output && output !== "-" ? output : "";
+    if (output && output !== "-" && args.dumpHeader && args.dumpHeader !== "-" && normalizePath(pathOf(context, output)) === normalizePath(pathOf(context, args.dumpHeader))) {
+      throw new CurlError(23, "Body and header output files must differ");
+    }
+    const initialMethod = args.method ?? (args.head ? "HEAD" : args.get ? "GET" : args.upload !== void 0 ? "PUT" : body ? "POST" : "GET");
+    requestHeaders(args, body?.contentType, args.user ?? parsed.user, true, limits.maxHeaderBytes);
+    attempts: for (let attempt = 0; attempt <= args.retries; attempt++) {
+      values2.num_retries = String(attempt);
+      downloaded = 0;
+      failure = void 0;
+      let current = new URL(initial);
+      let method = initialMethod;
+      let currentBody = body;
+      let credentialsInScope = true;
+      let previous;
+      let redirects = 0;
+      included = [];
+      let headerBytes = 0;
+      while (true) {
+        signal.throwIfAborted();
+        if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
+        values2.url_effective = current.href;
+        values2.method = method;
+        let denyPrivateNetworks = false;
+        let allowed;
+        try {
+          allowed = await withSignal(() => authorize({
+            url: current.href,
+            method,
+            attempt,
+            signal,
+            requirePrivateNetworkDeny() {
+              denyPrivateNetworks = true;
+            },
+            ...previous === void 0 ? {} : { redirectFrom: previous }
+          }), signal);
+        } catch {
+          signal.throwIfAborted();
+          throw new CurlError(7, "Network authorization failed");
+        }
+        if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
+        if (allowed !== true) throw new CurlError(7, "Network access denied by host policy");
+        const policy = denyPrivateNetworks ? { denyPrivateNetworks: true } : {};
+        if (policy.denyPrivateNetworks && transport.supportsPrivateNetworkDeny !== true) {
+          throw new CurlError(7, "Transport cannot enforce private network policy");
+        }
+        const headers = requestHeaders(args, currentBody?.contentType, args.user ?? parsed.user, credentialsInScope, limits.maxHeaderBytes);
+        if (args.verbose) await writeBytes(context.stderr, encode(`> ${method} ${current.origin}
+${headers.map(([name]) => `> ${name}: [redacted]
+`).join("")}`), signal);
+        const upload = currentBody && (async function* () {
+          for await (const chunk of currentBody.open(signal)) {
+            uploaded += chunk.length;
+            yield chunk;
+          }
+        })();
+        try {
+          response = await operation.acquire(async () => {
+            const acquired = await transport({
+              url: current.href,
+              method,
+              headers,
+              signal,
+              registerCleanup: operation.registerCleanup,
+              ...policy,
+              ...upload ? { body: upload } : {}
+            });
+            let cleanup;
+            return { ...acquired, dispose() {
+              cleanup ??= Promise.resolve().then(() => acquired.dispose());
+              return cleanup;
+            } };
+          }, (result) => result.dispose());
+        } catch (error) {
+          signal.throwIfAborted();
+          const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
+          if (args.retryTransport && (code === "ECONNRESET" || code === "ETIMEDOUT" || code === "EPIPE") && attempt < args.retries) {
+            await delay(args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5), signal);
+            continue attempts;
+          }
+          throw error;
+        }
+        const block = responseHeaders(response, limits.maxHeaderBytes);
+        headerBytes += block.length;
+        if (headerBytes > limits.maxHeaderBytes) throw new CurlError(63, "Combined response headers exceed host byte limit");
+        values2.http_code = values2.response_code = String(response.status).padStart(3, "0");
+        values2.content_type = header(response.headers, "content-type") ?? "";
+        values2.http_version = response.httpVersion ?? "1.1";
+        if (args.verbose) await writeBytes(context.stderr, encode(`< HTTP ${response.status}
+`), signal);
+        if (args.dumpHeader !== void 0) {
+          if (args.dumpHeader === "-") await publish(block);
+          else await dumpHeaders(context, args.dumpHeader, block, dumped, signal);
+          dumped = true;
+        }
+        if (args.head || args.include) included.push(block);
+        const location = header(response.headers, "location");
+        if (redirectStatuses.has(response.status) && location !== void 0) {
+          let target;
+          try {
+            target = parseUrl(new URL(location, current).href, true, true).url;
+          } catch (error) {
+            if (error instanceof CurlError) throw error;
+            throw new CurlError(3, "Malformed redirect URL");
+          }
+          values2.redirect_url = target.href;
+          if (args.location) {
+            if (redirects++ >= args.maxRedirects) throw new CurlError(47, "Maximum redirects exceeded");
+            if (current.protocol === "https:" && target.protocol === "http:") throw new CurlError(1, "HTTPS-to-HTTP redirects are disabled");
+            if (target.origin !== current.origin) credentialsInScope = false;
+            if (response.status === 303 && method !== "HEAD" || [301, 302].includes(response.status) && method === "POST") {
+              currentBody = void 0;
+              if (args.method === void 0) method = "GET";
+            }
+            previous = current.href;
+            current = target;
+            values2.num_redirects = String(redirects);
+            await stop(response, signal);
+            response = void 0;
+            continue;
+          }
+        }
+        break;
+      }
+      if (!response) throw new CurlError(56, "No HTTP response");
+      if (response.status >= 400 && (args.fail || args.failWithBody)) failure = new CurlError(22, `HTTP response status ${response.status}`);
+      const suppressBody = args.fail && failure !== void 0;
+      let published = 0;
+      if (!suppressBody || included.length) {
+        const length = header(response.headers, "content-length");
+        if (!args.head && !suppressBody && length && /^\d+$/.test(length) && Number(length) > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
+        const final = response;
+        const writing = output === void 0 || output === "-" ? createOutputOperation({ ...context, signal }, context.stdout) : void 0;
+        const bodySignal = writing?.signal ?? signal;
+        const source = (async function* () {
+          for (const bytes of included) {
+            published += bytes.length;
+            yield bytes;
+          }
+          if (!args.head && !suppressBody) {
+            let chunks = 0;
+            try {
+              for await (const chunk of readBytes(final.body, bodySignal)) {
+                if (++chunks % 256 === 0) {
+                  await yieldTurn(context.signal);
+                  bodySignal.throwIfAborted();
+                }
+                downloaded += chunk.length;
+                if (downloaded > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
+                published += chunk.length;
+                yield chunk;
+              }
+              if (length && /^\d+$/.test(length) && downloaded !== Number(length)) throw new CurlError(18, "Partial HTTP response body");
+            } catch (error) {
+              bodySignal.throwIfAborted();
+              if (!(error instanceof CurlError) && length && /^\d+$/.test(length) && downloaded < Number(length)) throw new CurlError(18, "Partial HTTP response body");
+              throw networkError(error);
+            }
+          }
+        })();
+        try {
+          await writeOutput(writing ? { ...context, stdout: writing.output } : context, output, source, bodySignal);
+        } catch (error) {
+          context.signal.throwIfAborted();
+          if (!pipeClosed(error)) throw error;
+          closedOutput = true;
+        } finally {
+          await writing?.close();
+        }
+      }
+      if (retryStatuses.has(response.status) && attempt < args.retries) {
+        if (failure && (!args.silent || args.showError)) await deadlineDiagnostic(context, new CurlError(status(failure.exitCode), failure.message), remaining());
+        const after = header(response.headers, "retry-after");
+        let wait = args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5);
+        if (after !== void 0) {
+          const parsed2 = /^\d+$/.test(after) ? Number(after) * 1e3 : Date.parse(after) - Date.now();
+          if (Number.isFinite(parsed2)) wait = Math.max(wait, parsed2);
+        }
+        await stop(response, signal);
+        response = void 0;
+        if (published && output !== void 0 && output !== "-") await writeOutput(context, output, toByteSource(""), signal);
+        await delay(Math.min(wait, limits.maxTimeMs), signal);
+        continue;
+      }
+      break;
+    }
+  } catch (error) {
+    if (context.signal.aborted) throw context.signal.reason;
+    if (pipeClosed(error)) closedOutput = true;
+    else if (!hasFileOutput && context.stdout.ownedOutput?.consumerClosed.aborted) failure = new CurlError(23, "Failed writing output");
+    else failure = signal.aborted && signal.reason instanceof CurlError ? signal.reason : networkError(error);
+  } finally {
+    try {
+      await operation.close();
+    } finally {
+      context.signal.throwIfAborted();
+    }
+  }
+  values2.size_download = String(downloaded);
+  values2.size_upload = String(uploaded);
+  values2.time_total = ((performance.now() - start) / 1e3).toFixed(6);
+  values2.exitcode = String(failure?.exitCode ?? 0);
+  values2.errormsg = failure?.message ?? "";
+  if (format !== void 0 && formatReady) {
+    try {
+      await publish(writeOutFormat(format, values2));
+    } catch (error) {
+      context.signal.throwIfAborted();
+      failure = error instanceof CurlError ? error : new CurlError(23, "Failed writing write-out result");
+    }
+  }
+  if (failure && (!args.silent || args.showError)) {
+    try {
+      await deadlineDiagnostic(context, new CurlError(status(failure.exitCode), failure.message), remaining());
+    } catch (error) {
+      context.signal.throwIfAborted();
+      if (!(error instanceof CurlError)) throw error;
+      failure = error;
+    }
+  }
+  return failure ? status(failure.exitCode) : closedOutput ? 141 : 0;
+}
+
+// packages/safe-bash/src/commands/network/wget.ts
+async function parseWget(context, limits) {
+  const carrier = getCommandArguments(context);
+  let argumentBytes = 0;
+  for (const value of carrier.values) {
+    if (typeof value === "string" && value.length > limits.maxBufferBytes) throw new CurlError(2, "Arguments exceed host buffer limit");
+    argumentBytes += shellValueByteLength(value);
+    if (argumentBytes > limits.maxBufferBytes) throw new CurlError(2, "Arguments exceed host buffer limit");
+    if (typeof value === "string") {
+      for (let index = 0; index < value.length; index++) {
+        if (index % 1024 === 0) await yieldTurn(context.signal);
+        const code = value.charCodeAt(index);
+        if (code >= 55296 && code <= 56319) {
+          const next = value.charCodeAt(++index);
+          if (!(next >= 56320 && next <= 57343)) throw new CurlError(2, "Arguments must be valid UTF-8");
+        } else if (code >= 56320 && code <= 57343) throw new CurlError(2, "Arguments must be valid UTF-8");
+      }
+      continue;
+    }
+    const bytes = shellValueBytes(value);
+    const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    for (let offset = 0; offset < bytes.length; offset += 1024) {
+      await yieldTurn(context.signal);
+      try {
+        decoder.decode(bytes.subarray(offset, offset + 1024), { stream: offset + 1024 < bytes.length });
+      } catch (error) {
+        context.signal.throwIfAborted();
+        if (!(error instanceof TypeError) || "code" in error && error.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
+        throw new CurlError(2, "Arguments must be valid UTF-8");
+      }
+    }
+  }
+  const result = {
+    urls: [],
+    data: [],
+    headers: [],
+    include: false,
+    head: false,
+    get: false,
+    location: true,
+    remoteName: true,
+    fail: true,
+    failWithBody: false,
+    silent: false,
+    showError: false,
+    verbose: false,
+    globoff: true,
+    help: false,
+    version: false,
+    retries: Math.min(19, limits.maxRetries),
+    retryDelayMs: 0,
+    maxTimeMs: limits.maxTimeMs,
+    maxRedirects: limits.maxRedirects,
+    maxFileSize: limits.maxDownloadBytes,
+    agent: "virtual-bash-wget/0.0",
+    retryTransport: true,
+    directoryIndex: "index.html"
+  };
+  const number2 = (value, integral) => {
+    if (!(integral ? /^\d+$/u : /^\d+(?:\.\d+)?$/u).test(value)) throw new CurlError(2, "Invalid numeric option");
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 0 || parsed > Number.MAX_SAFE_INTEGER) throw new CurlError(2, "Invalid numeric option");
+    return parsed;
+  };
+  let ended = false;
+  for (let index = 0; index < context.args.length; index++) {
+    if (index % 128 === 0) await yieldTurn(context.signal);
+    const argument = context.args[index];
+    if (ended || !argument.startsWith("-") || argument === "-") {
+      result.urls.push(argument);
+      continue;
+    }
+    if (argument === "--") {
+      ended = true;
+      continue;
+    }
+    if (!argument.startsWith("--")) {
+      for (let position = 1; position < argument.length; position++) {
+        if (position % 1024 === 0) await yieldTurn(context.signal);
+        const flag2 = argument[position];
+        if (flag2 === "q") result.silent = true;
+        else if (flag2 === "n" && argument[position + 1] === "v") position++;
+        else if (flag2 === "h") result.help = true;
+        else if (flag2 === "r") throw new CurlError(2, "Recursive mirroring is unsupported");
+        else if (flag2 === "O") {
+          const output = position + 1 < argument.length ? argument.slice(position + 1) : context.args[++index];
+          if (!output) throw new CurlError(2, "-O requires a nonempty output filename");
+          result.output = output;
+          result.remoteName = false;
+          break;
+        } else throw new CurlError(2, `Unsupported option: -${flag2}`);
+      }
+      continue;
+    }
+    if (argument === "--quiet") {
+      result.silent = true;
+      continue;
+    }
+    if (argument === "--no-verbose") continue;
+    if (argument === "--help") {
+      result.help = true;
+      continue;
+    }
+    if (argument === "--version") {
+      result.version = true;
+      continue;
+    }
+    if (argument === "--recursive") throw new CurlError(2, "Recursive mirroring is unsupported");
+    const equal = argument.indexOf("=");
+    const flag = equal < 0 ? argument : argument.slice(0, equal);
+    let operand;
+    let option;
+    if (["--output-document", "--timeout", "--tries"].includes(flag)) {
+      option = flag === "--output-document" ? "output" : flag === "--timeout" ? "timeout" : "tries";
+      operand = equal < 0 ? context.args[++index] : argument.slice(equal + 1);
+    } else throw new CurlError(2, `Unsupported option: ${argument}`);
+    if (operand === void 0) throw new CurlError(2, `${flag} requires an argument`);
+    if (option === "output") {
+      if (!operand) throw new CurlError(2, "Output filename must not be empty");
+      result.output = operand;
+      result.remoteName = false;
+    } else if (option === "timeout") {
+      const seconds = number2(operand, false);
+      result.maxTimeMs = seconds === 0 ? limits.maxTimeMs : Math.min(seconds * 1e3, limits.maxTimeMs);
+    } else {
+      const tries = number2(operand, true);
+      result.retries = tries === 0 ? limits.maxRetries : Math.min(tries - 1, limits.maxRetries);
+    }
+  }
+  if (!result.help && !result.version && result.urls.length !== 1) throw new CurlError(2, "Exactly one HTTP(S) URL is required");
+  return result;
+}
+function createWgetCommand(options) {
+  return createTransferCommand(options, {
+    name: "wget",
+    parse: parseWget,
+    help: "Usage: wget [-O FILE|-] [-q|-nv] [--timeout SECONDS] [--tries COUNT] URL\nVFS downloads require explicit host authorization. Recursive mirroring is unsupported.\nTimeout is aggregate and host-capped; --tries=0 remains host-capped.\n",
+    version: "virtual-bash wget 0.0 (bounded HTTP HTTPS)\n",
+    status: (code) => code === 0 ? 0 : [1, 2, 3].includes(code) ? 2 : [23, 26].includes(code) ? 3 : code === 60 ? 5 : code === 22 ? 8 : 4
+  });
+}
+
+// packages/safe-bash/src/commands/network/fetch-transport.ts
+init_platform();
+function requestBody(source, signal) {
+  if (!source) return void 0;
+  const iterator = source[Symbol.asyncIterator]();
+  return new ReadableStream({
+    async pull(controller) {
+      try {
+        signal.throwIfAborted();
+        const next = await iterator.next();
+        if (next.done) controller.close();
+        else controller.enqueue(next.value);
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      await iterator.return?.(reason);
+    }
+  });
+}
+function createFetchTransport(options = {}) {
+  const fetchRequest = options.fetch ?? globalThis.fetch;
+  if (typeof fetchRequest !== "function") throw new TypeError("Fetch is unavailable");
+  return async (input) => {
+    input.signal.throwIfAborted();
+    const url = new URL(input.url);
+    if (url.protocol !== "http:" && url.protocol !== "https:") throw new CurlError(1, "Unsupported protocol");
+    if (input.denyPrivateNetworks === true) throw new CurlError(7, "Fetch transport cannot enforce private-network denial");
+    const stopped = new AbortController();
+    const signal = AbortSignal.any([input.signal, stopped.signal]);
+    const body = requestBody(input.body, signal);
+    const headers = new Headers();
+    for (const [name, value] of input.headers) headers.append(name, value);
+    const request = new Request(url, {
+      method: input.method,
+      headers,
+      body,
+      credentials: "omit",
+      redirect: "manual",
+      signal,
+      ...body ? { duplex: "half" } : {}
+    });
+    let response;
+    const dispose = async () => {
+      stopped.abort();
+      if (response?.body) await response.body.cancel().catch(() => void 0);
+    };
+    input.registerCleanup?.(dispose);
+    response = await fetchRequest(request);
+    const reader = response.body?.getReader();
+    const responseBody = reader ? (async function* () {
+      try {
+        while (true) {
+          input.signal.throwIfAborted();
+          const next = await reader.read();
+          if (next.done) return;
+          yield next.value;
+        }
+      } finally {
+        reader.releaseLock();
+      }
+    })() : (async function* () {
+    })();
+    return {
+      status: response.status,
+      statusText: response.statusText,
+      headers: [...response.headers.entries()],
+      body: responseBody,
+      dispose
+    };
+  };
+}
+
+// packages/safe-bash/src/commands/network/authorizer.ts
+init_platform();
+
+// packages/safe-bash/src/commands/network/private-address.ts
+init_platform();
+function privateIPv4(first, second) {
+  return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31 || first === 100 && second >= 64 && second <= 127 || first === 198 && second >= 18 && second <= 19 || first >= 224;
+}
+function privateHostname(input) {
+  const hostname = input.toLowerCase().replace(/\.$/u, "").replace(/^\[|\]$/gu, "");
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1") return true;
+  if (hostname.includes(":")) {
+    const [prefix, suffix] = hostname.split("::");
+    const leading = prefix ? prefix.split(":") : [];
+    const trailing = suffix ? suffix.split(":") : [];
+    const hextets = new Array(8).fill(0);
+    for (let index = 0; index < leading.length; index++) hextets[index] = Number.parseInt(leading[index], 16);
+    for (let index = 0; index < trailing.length; index++) hextets[8 - trailing.length + index] = Number.parseInt(trailing[index], 16);
+    if (hextets.every((value) => value === 0)) return true;
+    const mappedIPv4 = hextets.slice(0, 5).every((value) => value === 0) && hextets[5] === 65535;
+    const translatedIPv4 = hextets.slice(0, 4).every((value) => value === 0) && hextets[4] === 65535 && hextets[5] === 0;
+    const nat64IPv4 = hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((value) => value === 0);
+    const compatibleIPv4 = hextets.slice(0, 6).every((value) => value === 0);
+    if (mappedIPv4 || translatedIPv4 || nat64IPv4 || compatibleIPv4) {
+      return privateIPv4(hextets[6] >>> 8, hextets[6] & 255);
+    }
+    if (hextets[0] === 8194) return privateIPv4(hextets[1] >>> 8, hextets[1] & 255);
+    return (hextets[0] & 65024) === 64512 || (hextets[0] & 65472) === 65152 || (hextets[0] & 65472) === 65216 || (hextets[0] & 65280) === 65280 || hextets[0] === 100 && hextets[1] === 65435 && hextets[2] === 1;
+  }
+  const parts = hostname.split(".");
+  if (parts.length !== 4 || parts.some((part) => !part || Array.from(part).some((character) => character < "0" || character > "9"))) return false;
+  const octets = parts.map(Number);
+  if (octets.some((value) => value < 0 || value > 255)) return false;
+  const [first, second] = octets;
+  return privateIPv4(first, second);
+}
+
+// packages/safe-bash/src/commands/network/authorizer.ts
+function createOriginAuthorizer(allowlist = "*", options = {}) {
+  const denyPrivateNetworks = options.denyPrivateNetworks === true;
+  const origins = /* @__PURE__ */ new Set();
+  const hosts = /* @__PURE__ */ new Set();
+  for (const entry of allowlist === "*" ? [] : allowlist) {
+    const value = entry.trim();
+    if (!value) throw new TypeError("Origin allowlist entries must not be empty");
+    if (value.includes("://")) {
+      const url = new URL(value);
+      if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
+        throw new TypeError(`Origin allowlist entry must be an origin: ${entry}`);
+      }
+      origins.add(url.origin);
+    } else {
+      if (value.includes("/") || value.includes("@")) throw new TypeError(`Invalid hostname allowlist entry: ${entry}`);
+      hosts.add(value.toLowerCase().replace(/\.$/u, ""));
+    }
+  }
+  return (request) => {
+    const url = new URL(request.url);
+    const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
+    if (denyPrivateNetworks) {
+      request.requirePrivateNetworkDeny?.();
+      if (privateHostname(hostname)) return false;
+    }
+    return allowlist === "*" || origins.has(url.origin) || hosts.has(hostname);
+  };
+}
+
+// packages/safe-bash/src/commands/network/public.ts
+function createNetworkCommands(options) {
+  return [createCurlCommand(options), createWgetCommand(options)];
+}
+function networkCommands(options) {
+  const definitions = createNetworkCommands(options);
+  return {
+    name: "network-commands",
+    setup(host) {
+      if (!options.replace) {
+        for (const definition of definitions) if (host.commands.has(definition.name)) throw new Error(`Command already registered: ${definition.name}`);
+      }
+      for (const definition of definitions) host.commands.register(definition, { replace: options.replace ?? false });
+    }
+  };
+}
+var createCurlCommands = createNetworkCommands;
+var curlCommands = networkCommands;
+
+export {
+  bindFileOutputBudget,
+  writeFileOutput,
+  openFileOutput,
+  defaultNetworkLimits,
+  cloudflareWorkerNetworkLimits,
+  CurlError,
+  createCurlCommand,
+  createWgetCommand,
+  createFetchTransport,
+  createOriginAuthorizer,
+  createNetworkCommands,
+  networkCommands,
+  createCurlCommands,
+  curlCommands
+};
+//# sourceMappingURL=chunk-UGMUVHIY.js.map