@poe-platform/safe-bash 0.1.616 → 0.1.618

package/dist/safe-bash/core.browser.js

@@ -34,7 +34,7 @@ import {
   createLineEndingCommands,
   createUnix2dosCommand,
   lineEndingCommands
-} from "./chunks/chunk-F5TCC4UG.js";
+} from "./chunks/chunk-X55AMTNM.js";
 import {
   createLlmCommands,
   llmCommands
@@ -86,7 +86,7 @@ import {
   curlCommands,
   defaultNetworkLimits,
   networkCommands
-} from "./chunks/chunk-PFMSKAFQ.js";
+} from "./chunks/chunk-KYNRHYHP.js";
 import {
   RecordBuffer,
   UsageError,
@@ -138,12 +138,12 @@ import {
   exprMatchCeilings,
   matchEre,
   withRegexSession
-} from "./chunks/chunk-PW4WQSCS.js";
+} from "./chunks/chunk-3M5F7LD5.js";
 import {
   bindFileOutputBudget,
   openFileOutput,
   writeFileOutput
-} from "./chunks/chunk-CEPNDODE.js";
+} from "./chunks/chunk-4DBWBEU7.js";
 import {
   createOutputOperation
 } from "./chunks/chunk-RNKTWFEM.js";
@@ -26614,6 +26614,106 @@ init_platform();
 
 // packages/safe-bash/src/commands/archive/zip-format.ts
 init_platform();
+
+// packages/safe-bash/src/commands/archive/zip/zip64.ts
+init_platform();
+function wide(view, offset) {
+  if (offset < 0 || offset + 8 > view.byteLength) fail("ZIP64 truncated numeric field");
+  const value2 = view.getBigUint64(offset, true);
+  if (value2 > BigInt(Number.MAX_SAFE_INTEGER)) fail("ZIP64 unsafe numeric field");
+  return Number(value2);
+}
+function zip64Directory(view, end, limits) {
+  let members = view.getUint16(end + 10, true);
+  let centralSize = view.getUint32(end + 12, true);
+  let centralStart = view.getUint32(end + 16, true);
+  let centralEnd = end;
+  const diskMembers = view.getUint16(end + 8, true);
+  if (view.getUint16(end + 4, true) || view.getUint16(end + 6, true)) fail("ZIP multi-disk archive is unsupported");
+  const locator = end >= 20 && view.getUint32(end - 20, true) === 117853008;
+  if (locator) {
+    if (view.getUint32(end - 16, true) || view.getUint32(end - 4, true) !== 1) fail("ZIP64 multi-disk locator is unsupported");
+    centralEnd = wide(view, end - 12);
+    if (centralEnd + 56 > end - 20 || view.getUint32(centralEnd, true) !== 101075792) fail("ZIP64 invalid end-record span");
+    const length = wide(view, centralEnd + 4);
+    if (length < 44 || length - 44 > limits.maxPaxBytes || centralEnd + 12 + length !== end - 20) fail("ZIP64 invalid end-record length");
+    if (view.getUint16(centralEnd + 14, true) !== 45) fail("ZIP64 unsupported end-record extraction version");
+    if (view.getUint32(centralEnd + 16, true) || view.getUint32(centralEnd + 20, true)) fail("ZIP64 multi-disk archive is unsupported");
+    const count2 = wide(view, centralEnd + 32);
+    if (wide(view, centralEnd + 24) !== count2 || members !== 65535 && members !== count2 || diskMembers !== 65535 && diskMembers !== count2) fail("ZIP64 inconsistent member count");
+    const size = wide(view, centralEnd + 40);
+    const start = wide(view, centralEnd + 48);
+    if (centralSize !== 4294967295 && centralSize !== size || centralStart !== 4294967295 && centralStart !== start) fail("ZIP64 inconsistent central directory");
+    members = count2;
+    centralSize = size;
+    centralStart = start;
+  } else if (members === 65535 || centralSize === 4294967295 || centralStart === 4294967295) fail("ZIP64 missing end record and locator");
+  else if (diskMembers !== members) fail("ZIP inconsistent member count");
+  if (members > limits.maxMembers) fail("ZIP member limit exceeded");
+  if (centralStart > limits.maxArchiveBytes || centralSize > limits.maxArchiveBytes || centralStart + centralSize !== centralEnd) fail("ZIP invalid central directory span");
+  return { members, centralStart, centralSize, centralEnd };
+}
+function zip64Fields(data2, values) {
+  let offset = 0;
+  const view = data2 && new DataView(data2.buffer, data2.byteOffset, data2.byteLength);
+  return values.map((value2, index) => {
+    if (value2 !== 4294967295) return value2;
+    if (!view) fail("ZIP64 missing required extra field");
+    const width = index === 3 ? 4 : 8;
+    if (offset + width > view.byteLength) fail("ZIP64 truncated extra field");
+    const resolved = width === 4 ? view.getUint32(offset, true) : wide(view, offset);
+    offset += width;
+    return resolved;
+  });
+}
+function stripZip64(bytes3) {
+  const view = new DataView(bytes3.buffer, bytes3.byteOffset, bytes3.byteLength);
+  const retained = [];
+  let length = 0;
+  for (let offset2 = 0; offset2 < bytes3.length; ) {
+    if (offset2 + 4 > bytes3.length) fail("ZIP truncated extra field");
+    const next = offset2 + 4 + view.getUint16(offset2 + 2, true);
+    if (next > bytes3.length) fail("ZIP truncated extra field payload");
+    if (view.getUint16(offset2, true) !== 1) {
+      retained.push(bytes3.subarray(offset2, next));
+      length += next - offset2;
+    }
+    offset2 = next;
+  }
+  const result = new Uint8Array(length);
+  let offset = 0;
+  for (const field2 of retained) {
+    result.set(field2, offset);
+    offset += field2.length;
+  }
+  return result;
+}
+function zip64Extra(values, retained) {
+  if (retained.length + 4 + values.length * 8 > 65535) fail("ZIP64 extra field limit exceeded");
+  const bytes3 = new Uint8Array(4 + values.length * 8 + retained.length);
+  const view = new DataView(bytes3.buffer);
+  view.setUint16(0, 1, true);
+  view.setUint16(2, values.length * 8, true);
+  values.forEach((value2, index) => view.setBigUint64(4 + index * 8, BigInt(value2), true));
+  bytes3.set(retained, 4 + values.length * 8);
+  return bytes3;
+}
+function writeZip64End(view, offset, count2, size, start, recordOffset = offset) {
+  view.setUint32(offset, 101075792, true);
+  view.setBigUint64(offset + 4, 44n, true);
+  view.setUint16(offset + 12, 813, true);
+  view.setUint16(offset + 14, 45, true);
+  view.setBigUint64(offset + 24, BigInt(count2), true);
+  view.setBigUint64(offset + 32, BigInt(count2), true);
+  view.setBigUint64(offset + 40, BigInt(size), true);
+  view.setBigUint64(offset + 48, BigInt(start), true);
+  view.setUint32(offset + 56, 117853008, true);
+  view.setBigUint64(offset + 64, BigInt(recordOffset), true);
+  view.setUint32(offset + 72, 1, true);
+  return offset + 76;
+}
+
+// packages/safe-bash/src/commands/archive/zip-format.ts
 var encoder2 = new TextEncoder();
 var cp437 = "\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557\u255D\u255C\u255B\u2510\u2514\u2534\u252C\u251C\u2500\u253C\u255E\u255F\u255A\u2554\u2569\u2566\u2560\u2550\u256C\u2567\u2568\u2564\u2565\u2559\u2558\u2552\u2553\u256B\u256A\u2518\u250C\u2588\u2584\u258C\u2590\u2580\u03B1\xDF\u0393\u03C0\u03A3\u03C3\xB5\u03C4\u03A6\u0398\u03A9\u03B4\u221E\u03C6\u03B5\u2229\u2261\xB1\u2265\u2264\u2320\u2321\xF7\u2248\xB0\u2219\xB7\u221A\u207F\xB2\u25A0\xA0";
 var crcTable4 = Uint32Array.from({ length: 256 }, (_, index) => {
@@ -26670,7 +26770,10 @@ function extras(bytes3, rawName, comment2, central, limits) {
     if (offset + length > bytes3.length) fail("ZIP truncated extra field payload");
     if (seen.has(identifier)) fail("ZIP duplicate extra field");
     seen.add(identifier);
-    if (identifier === 1) fail("ZIP64 is unsupported");
+    if (identifier === 1) {
+      if (!length || length > 28 || length % 4) fail("ZIP64 invalid extra field length");
+      result.zip64 = bytes3.subarray(offset, offset + length);
+    }
     if (identifier === 39169 || identifier === 23 || identifier === 24 || identifier === 25) fail("ZIP encryption is unsupported");
     if (identifier === 28789 || identifier === 25461) {
       if (length < 5 || bytes3[offset] !== 1) fail("ZIP unsupported or truncated Unicode extra field");
@@ -26706,7 +26809,7 @@ function format(method, flags3, version) {
   if (flags3 & (1 | 64 | 8192)) fail("ZIP encryption is unsupported");
   if (flags3 & ~2062 || method === 0 && flags3 & 6) fail("ZIP unsupported general purpose flags");
   if (method !== 0 && method !== 8) fail("ZIP unsupported compression method");
-  if (version < (method === 8 || flags3 & 8 ? 20 : 10) || version > 20) fail("ZIP unsupported extraction version (including ZIP64)");
+  if (version < (method === 8 || flags3 & 8 ? 20 : 10) || version > 20 && version !== 45) fail("ZIP unsupported extraction version (including ZIP64)");
 }
 function dosModified(date2, time) {
   if (!date2 && !time) return new Date(1980, 0, 1);
@@ -26758,13 +26861,7 @@ async function readZipArchive(bytes3, limits, signal) {
     }
   }
   if (end === -1) fail("ZIP truncated or missing end of central directory");
-  const members = view.getUint16(end + 10, true);
-  const centralSize = view.getUint32(end + 12, true);
-  const centralStart = view.getUint32(end + 16, true);
-  if (members === 65535 || centralSize === 4294967295 || centralStart === 4294967295) fail("ZIP64 is unsupported");
-  if (view.getUint16(end + 4, true) || view.getUint16(end + 6, true) || view.getUint16(end + 8, true) !== members) fail("ZIP multi-disk or inconsistent member count is unsupported");
-  if (centralStart + centralSize !== end) fail("ZIP invalid central directory span or unsupported ZIP64/trailing records");
-  number3(members, limits.maxMembers, "member");
+  const { members, centralStart, centralEnd } = zip64Directory(view, end, limits);
   number3(bytes3.length - end - 22, limits.maxTextBytes, "archive comment");
   const entries2 = [];
   const spans = [];
@@ -26772,7 +26869,7 @@ async function readZipArchive(bytes3, limits, signal) {
   let total = 0;
   for (let index = 0; index < members; index++) {
     await yieldTurn(signal);
-    if (offset + 46 > end || view.getUint32(offset, true) !== 33639248) fail("ZIP truncated or invalid central header");
+    if (offset + 46 > centralEnd || view.getUint32(offset, true) !== 33639248) fail("ZIP truncated or invalid central header");
     const versionMadeBy = view.getUint16(offset + 4, true);
     const version = view.getUint16(offset + 6, true);
     const flags3 = view.getUint16(offset + 8, true);
@@ -26781,29 +26878,32 @@ async function readZipArchive(bytes3, limits, signal) {
     const dosTime = view.getUint16(offset + 12, true);
     const dosDate = view.getUint16(offset + 14, true);
     const checksum = view.getUint32(offset + 16, true);
-    const compressedSize = view.getUint32(offset + 20, true);
-    const size = view.getUint32(offset + 24, true);
+    let compressedSize = view.getUint32(offset + 20, true);
+    let size = view.getUint32(offset + 24, true);
     const nameLength = view.getUint16(offset + 28, true);
     const extraLength = view.getUint16(offset + 30, true);
     const commentLength = view.getUint16(offset + 32, true);
     const internalAttributes = view.getUint16(offset + 36, true);
     if (internalAttributes & ~1) fail("ZIP unsupported internal attributes");
     const externalAttributes = view.getUint32(offset + 38, true);
-    const local = view.getUint32(offset + 42, true);
-    if (view.getUint16(offset + 34, true)) fail("ZIP multi-disk member is unsupported");
-    if (compressedSize === 4294967295 || size === 4294967295 || local === 4294967295) fail("ZIP64 is unsupported");
-    number3(size, limits.maxEntryBytes, "entry byte");
-    if (method === 0 && compressedSize !== size) fail("ZIP stored size mismatch");
-    total += size;
-    number3(total, limits.maxTotalBytes, "total byte");
+    let local = view.getUint32(offset + 42, true);
+    const disk = view.getUint16(offset + 34, true);
     const next = offset + 46 + nameLength + extraLength + commentLength;
-    if (next > end) fail("ZIP truncated central metadata");
+    if (next > centralEnd) fail("ZIP truncated central metadata");
     number3(commentLength, limits.maxTextBytes, "entry comment");
     const rawName = bytes3.subarray(offset + 46, offset + 46 + nameLength);
     const centralExtra = bytes3.subarray(offset + 46 + nameLength, next - commentLength);
     const comment2 = bytes3.subarray(next - commentLength, next);
     if (flags3 & 2048) text2(comment2);
     const centralMetadata = extras(centralExtra, rawName, comment2, true, limits);
+    const resolved = zip64Fields(centralMetadata.zip64, [size, compressedSize, local, disk === 65535 ? 4294967295 : disk]);
+    [size, compressedSize, local] = resolved;
+    if (resolved[3]) fail("ZIP multi-disk member is unsupported");
+    number3(size, limits.maxEntryBytes, "entry byte");
+    number3(compressedSize, limits.maxArchiveBytes, "compressed entry byte");
+    if (method === 0 && compressedSize !== size) fail("ZIP stored size mismatch");
+    total += size;
+    number3(total, limits.maxTotalBytes, "total byte");
     const name2 = nameFrom(rawName, flags3, centralMetadata, limits);
     if (local + 30 > centralStart || view.getUint32(local, true) !== 67324752) fail("ZIP invalid local header span");
     if (view.getUint16(local + 4, true) !== version || view.getUint16(local + 6, true) !== flags3 || view.getUint16(local + 8, true) !== method || view.getUint16(local + 10, true) !== dosTime || view.getUint16(local + 12, true) !== dosDate) fail("ZIP central/local metadata mismatch");
@@ -26819,15 +26919,22 @@ async function readZipArchive(bytes3, limits, signal) {
     const localEffective = nameFrom(localName, flags3, localMetadata, limits);
     if (localMetadata.name !== void 0 && localEffective !== name2) fail("ZIP central/local Unicode name mismatch");
     if (centralMetadata.modified !== void 0 && localMetadata.modified !== void 0 && centralMetadata.modified !== localMetadata.modified) fail("ZIP central/local timestamp mismatch");
-    for (const [position, expected] of [[14, checksum], [18, compressedSize], [22, size]]) {
-      const actual = view.getUint32(local + position, true);
+    const rawLocalSize = view.getUint32(local + 22, true);
+    const rawLocalCompressed = view.getUint32(local + 18, true);
+    const [localSize, localCompressed] = zip64Fields(localMetadata.zip64, [rawLocalSize, rawLocalCompressed]);
+    for (const [actual, expected] of [[view.getUint32(local + 14, true), checksum], [localCompressed, compressedSize], [localSize, size]]) {
       if (actual !== expected && (!(flags3 & 8) || actual !== 0)) fail("ZIP central/local size or CRC mismatch");
     }
     if (flags3 & 8) {
       const matches2 = [];
       for (const signed2 of [false, true]) {
         const descriptor = payloadEnd + (signed2 ? 4 : 0);
-        if (descriptor + 12 <= centralStart && (!signed2 || view.getUint32(payloadEnd, true) === 134695760) && view.getUint32(descriptor, true) === checksum && view.getUint32(descriptor + 4, true) === compressedSize && view.getUint32(descriptor + 8, true) === size) matches2.push(descriptor + 12);
+        const wide2 = rawLocalSize === 4294967295 || rawLocalCompressed === 4294967295;
+        const length = wide2 ? 20 : 12;
+        if (descriptor + length > centralStart || signed2 && view.getUint32(payloadEnd, true) !== 134695760 || view.getUint32(descriptor, true) !== checksum) continue;
+        const compressed2 = wide2 ? view.getBigUint64(descriptor + 4, true) : BigInt(view.getUint32(descriptor + 4, true));
+        const expanded = wide2 ? view.getBigUint64(descriptor + 12, true) : BigInt(view.getUint32(descriptor + 8, true));
+        if (compressed2 === BigInt(compressedSize) && expanded === BigInt(size)) matches2.push(descriptor + length);
       }
       if (matches2.length !== 1) fail("ZIP truncated, ambiguous or mismatched data descriptor");
       payloadEnd = matches2[0];
@@ -26847,7 +26954,7 @@ async function readZipArchive(bytes3, limits, signal) {
     spans.push({ start: local, end: payloadEnd });
     offset = next;
   }
-  if (offset !== end) fail("ZIP central directory size or member count mismatch");
+  if (offset !== centralEnd) fail("ZIP central directory size or member count mismatch");
   spans.sort((first, second) => first.start - second.start);
   let covered = 0;
   for (const span of spans) {
@@ -26948,11 +27055,43 @@ function timestampExtra(modified) {
   view.setInt32(5, seconds, true);
   return bytes3;
 }
-async function writeZipArchive(archive, limits, signal, descriptors = false) {
+function updateZipExtras(entry, previous, mode, limits) {
+  const fresh = mode === "strip" ? new Uint8Array() : timestampExtra(entry.modified);
+  const retained = [];
+  for (const [original, central] of [[previous?.localExtra, false], [previous?.centralExtra, true]]) {
+    const fields3 = [];
+    let length = fresh.length;
+    if (mode === "all" && original) {
+      extras(original, previous.rawName ?? pathBytes(previous.name, limits), previous.comment ?? new Uint8Array(), central, limits);
+      const view = new DataView(original.buffer, original.byteOffset, original.byteLength);
+      for (let offset2 = 0; offset2 < original.length; ) {
+        const identifier = view.getUint16(offset2, true);
+        const next = offset2 + 4 + view.getUint16(offset2 + 2, true);
+        if (identifier !== 1 && identifier !== 21589 && identifier !== 28789 && identifier !== 25461) {
+          fields3.push(original.subarray(offset2, next));
+          length += next - offset2;
+        }
+        offset2 = next;
+      }
+    }
+    number3(length, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    const bytes3 = new Uint8Array(length);
+    let offset = 0;
+    for (const field2 of fields3) {
+      bytes3.set(field2, offset);
+      offset += field2.length;
+    }
+    bytes3.set(fresh, offset);
+    retained.push(bytes3);
+  }
+  return { ...entry, localExtra: retained[0], centralExtra: retained[1] };
+}
+async function* streamZipArchive(archive, limits, signal, descriptors = false, forceZip64 = false) {
   const chunkSize2 = admit(limits, signal);
   number3(archive.entries.length, Math.min(limits.maxMembers, 65534), "member");
   number3(archive.comment.length, Math.min(limits.maxTextBytes, 65535), "archive comment");
-  let length = 22 + archive.comment.length;
+  const wideArchive = forceZip64 || archive.entries.some((entry) => entry.zip64);
+  let length = 22 + archive.comment.length + (wideArchive ? 76 : 0);
   let localLength = 0;
   let total = 0;
   const encoded2 = [];
@@ -26968,8 +27107,13 @@ async function writeZipArchive(archive, limits, signal, descriptors = false) {
     const comment2 = entry.comment ?? new Uint8Array();
     number3(comment2.length, Math.min(limits.maxTextBytes, 65535), "entry comment");
     if (flags3 & 2048) text2(comment2);
-    const localExtra = entry.localExtra ?? timestampExtra(entry.modified);
-    const centralExtra = entry.centralExtra ?? timestampExtra(entry.modified);
+    const originalLocalExtra = entry.localExtra ?? timestampExtra(entry.modified);
+    extras(originalLocalExtra, rawName, comment2, false, limits);
+    const wide2 = forceZip64 || entry.zip64 === true;
+    const localExtra = wide2 ? zip64Extra([descriptor ? 0 : entry.size, descriptor ? 0 : entry.data.length], stripZip64(originalLocalExtra)) : stripZip64(originalLocalExtra);
+    const originalCentralExtra = entry.centralExtra ?? timestampExtra(entry.modified);
+    extras(originalCentralExtra, rawName, comment2, true, limits);
+    const centralExtra = wide2 ? zip64Extra([entry.size, entry.data.length, localLength], stripZip64(originalCentralExtra)) : stripZip64(originalCentralExtra);
     const localMetadata = extras(localExtra, rawName, comment2, false, limits);
     const centralMetadata = extras(centralExtra, rawName, comment2, true, limits);
     if (nameFrom(rawName, flags3, centralMetadata, limits) !== entry.name || localMetadata.name !== void 0 && nameFrom(rawName, flags3, localMetadata, limits) !== entry.name || entry.localName && !equal(rawName, entry.localName)) fail("ZIP retained filename metadata mismatch");
@@ -26991,71 +27135,101 @@ async function writeZipArchive(archive, limits, signal, descriptors = false) {
       const mode = unixMode || (entry.directory ? 16877 : 33188);
       if (mode !== entry.mode || Boolean(entry.externalAttributes & 16) && !entry.directory) fail("ZIP retained file attributes mismatch");
     }
-    encoded2.push({ entry, rawName, flags: flags3, localExtra, centralExtra, comment: comment2, date: date2, time, offset: localLength });
-    localLength += 30 + rawName.length + localExtra.length + entry.data.length + (descriptor ? 16 : 0);
-    length += 76 + 2 * rawName.length + localExtra.length + centralExtra.length + comment2.length + entry.data.length + (descriptor ? 16 : 0);
+    encoded2.push({ entry, rawName, wide: wide2, flags: flags3, localExtra, centralExtra, comment: comment2, date: date2, time, offset: localLength });
+    localLength += 30 + rawName.length + localExtra.length + entry.data.length + (descriptor ? wide2 ? 24 : 16 : 0);
+    length += 76 + 2 * rawName.length + localExtra.length + centralExtra.length + comment2.length + entry.data.length + (descriptor ? wide2 ? 24 : 16 : 0);
     number3(length, Math.min(limits.maxArchiveBytes, 4294967294), "archive byte");
   }
   number3(length, Math.min(limits.maxArchiveBytes, 4294967294), "archive byte");
-  const bytes3 = new Uint8Array(length);
-  const view = new DataView(bytes3.buffer);
-  let central = localLength;
   for (const item of encoded2) {
     await yieldTurn(signal);
-    const { entry, rawName, flags: flags3, localExtra, centralExtra, comment: comment2, date: date2, time, offset } = item;
-    const version = entry.method === 8 || flags3 & 8 ? 20 : 10;
-    view.setUint32(offset, 67324752, true);
-    view.setUint16(offset + 4, version, true);
-    view.setUint16(offset + 6, flags3, true);
-    view.setUint16(offset + 8, entry.method, true);
-    view.setUint16(offset + 10, time, true);
-    view.setUint16(offset + 12, date2, true);
-    view.setUint32(offset + 14, flags3 & 8 ? 0 : entry.crc32, true);
-    view.setUint32(offset + 18, flags3 & 8 ? 0 : entry.data.length, true);
-    view.setUint32(offset + 22, flags3 & 8 ? 0 : entry.size, true);
-    view.setUint16(offset + 26, rawName.length, true);
-    view.setUint16(offset + 28, localExtra.length, true);
-    bytes3.set(rawName, offset + 30);
-    bytes3.set(localExtra, offset + 30 + rawName.length);
-    await copyBytes(entry.data, bytes3, offset + 30 + rawName.length + localExtra.length, chunkSize2, signal);
+    const { entry, rawName, wide: wide2, flags: flags3, localExtra, date: date2, time } = item;
+    const offset = 0;
+    const bytes4 = new Uint8Array(30 + rawName.length + localExtra.length);
+    const view2 = new DataView(bytes4.buffer);
+    const version = wide2 ? 45 : entry.method === 8 || flags3 & 8 ? 20 : 10;
+    view2.setUint32(offset, 67324752, true);
+    view2.setUint16(offset + 4, version, true);
+    view2.setUint16(offset + 6, flags3, true);
+    view2.setUint16(offset + 8, entry.method, true);
+    view2.setUint16(offset + 10, time, true);
+    view2.setUint16(offset + 12, date2, true);
+    view2.setUint32(offset + 14, flags3 & 8 ? 0 : entry.crc32, true);
+    view2.setUint32(offset + 18, wide2 ? 4294967295 : flags3 & 8 ? 0 : entry.data.length, true);
+    view2.setUint32(offset + 22, wide2 ? 4294967295 : flags3 & 8 ? 0 : entry.size, true);
+    view2.setUint16(offset + 26, rawName.length, true);
+    view2.setUint16(offset + 28, localExtra.length, true);
+    bytes4.set(rawName, offset + 30);
+    bytes4.set(localExtra, offset + 30 + rawName.length);
+    yield* wireChunks(bytes4, chunkSize2, signal);
+    yield* wireChunks(entry.data, chunkSize2, signal);
     if (flags3 & 8) {
-      const descriptor = offset + 30 + rawName.length + localExtra.length + entry.data.length;
-      view.setUint32(descriptor, 134695760, true);
-      view.setUint32(descriptor + 4, entry.crc32, true);
-      view.setUint32(descriptor + 8, entry.data.length, true);
-      view.setUint32(descriptor + 12, entry.size, true);
-    }
-    view.setUint32(central, 33639248, true);
-    view.setUint16(central + 4, entry.versionMadeBy ?? 798, true);
-    view.setUint16(central + 6, version, true);
-    view.setUint16(central + 8, flags3, true);
-    view.setUint16(central + 10, entry.method, true);
-    view.setUint16(central + 12, time, true);
-    view.setUint16(central + 14, date2, true);
-    view.setUint32(central + 16, entry.crc32, true);
-    view.setUint32(central + 20, entry.data.length, true);
-    view.setUint32(central + 24, entry.size, true);
-    view.setUint16(central + 28, rawName.length, true);
-    view.setUint16(central + 30, centralExtra.length, true);
-    view.setUint16(central + 32, comment2.length, true);
-    view.setUint16(central + 36, entry.internalAttributes ?? 0, true);
-    const mode = entry.mode & 61440 ? entry.mode : entry.mode | (entry.directory ? 16384 : entry.symlink ? 40960 : 32768);
-    view.setUint32(central + 38, entry.externalAttributes ?? mode * 65536 + (entry.directory ? 16 : 0), true);
-    view.setUint32(central + 42, offset, true);
-    bytes3.set(rawName, central + 46);
-    bytes3.set(centralExtra, central + 46 + rawName.length);
-    bytes3.set(comment2, central + 46 + rawName.length + centralExtra.length);
-    central += 46 + rawName.length + centralExtra.length + comment2.length;
+      const descriptor = 0;
+      const bytes5 = new Uint8Array(wide2 ? 24 : 16);
+      const view3 = new DataView(bytes5.buffer);
+      view3.setUint32(descriptor, 134695760, true);
+      view3.setUint32(descriptor + 4, entry.crc32, true);
+      if (wide2) {
+        view3.setBigUint64(descriptor + 8, BigInt(entry.data.length), true);
+        view3.setBigUint64(descriptor + 16, BigInt(entry.size), true);
+      } else {
+        view3.setUint32(descriptor + 8, entry.data.length, true);
+        view3.setUint32(descriptor + 12, entry.size, true);
+      }
+      yield* wireChunks(bytes5, chunkSize2, signal);
+    }
   }
+  let centralSize = 0;
+  for (const item of encoded2) {
+    await yieldTurn(signal);
+    const { entry, rawName, wide: wide2, flags: flags3, centralExtra, comment: comment2, date: date2, time, offset } = item;
+    const version = wide2 ? 45 : entry.method === 8 || flags3 & 8 ? 20 : 10;
+    const central2 = 0;
+    const bytes4 = new Uint8Array(46 + rawName.length + centralExtra.length + comment2.length);
+    const view2 = new DataView(bytes4.buffer);
+    view2.setUint32(central2, 33639248, true);
+    view2.setUint16(central2 + 4, entry.versionMadeBy ?? 798, true);
+    view2.setUint16(central2 + 6, version, true);
+    view2.setUint16(central2 + 8, flags3, true);
+    view2.setUint16(central2 + 10, entry.method, true);
+    view2.setUint16(central2 + 12, time, true);
+    view2.setUint16(central2 + 14, date2, true);
+    view2.setUint32(central2 + 16, entry.crc32, true);
+    view2.setUint32(central2 + 20, wide2 ? 4294967295 : entry.data.length, true);
+    view2.setUint32(central2 + 24, wide2 ? 4294967295 : entry.size, true);
+    view2.setUint16(central2 + 28, rawName.length, true);
+    view2.setUint16(central2 + 30, centralExtra.length, true);
+    view2.setUint16(central2 + 32, comment2.length, true);
+    view2.setUint16(central2 + 36, entry.internalAttributes ?? 0, true);
+    const mode = entry.mode & 61440 ? entry.mode : entry.mode | (entry.directory ? 16384 : entry.symlink ? 40960 : 32768);
+    view2.setUint32(central2 + 38, entry.externalAttributes ?? mode * 65536 + (entry.directory ? 16 : 0), true);
+    view2.setUint32(central2 + 42, wide2 ? 4294967295 : offset, true);
+    bytes4.set(rawName, central2 + 46);
+    bytes4.set(centralExtra, central2 + 46 + rawName.length);
+    bytes4.set(comment2, central2 + 46 + rawName.length + centralExtra.length);
+    centralSize += bytes4.length;
+    yield* wireChunks(bytes4, chunkSize2, signal);
+  }
+  const bytes3 = new Uint8Array((wideArchive ? 76 : 0) + 22 + archive.comment.length);
+  const view = new DataView(bytes3.buffer);
+  const central = wideArchive ? writeZip64End(view, 0, encoded2.length, centralSize, localLength, localLength + centralSize) : 0;
   view.setUint32(central, 101010256, true);
   view.setUint16(central + 8, encoded2.length, true);
   view.setUint16(central + 10, encoded2.length, true);
-  view.setUint32(central + 12, central - localLength, true);
-  view.setUint32(central + 16, localLength, true);
+  view.setUint32(central + 12, centralSize, true);
+  view.setUint32(central + 16, wideArchive ? 4294967295 : localLength, true);
   view.setUint16(central + 20, archive.comment.length, true);
   bytes3.set(archive.comment, central + 22);
-  signal.throwIfAborted();
-  return bytes3;
+  yield* wireChunks(bytes3, chunkSize2, signal);
+}
+async function* wireChunks(bytes3, chunkSize2, signal) {
+  for (let offset = 0; offset < bytes3.length; offset += chunkSize2) {
+    await yieldTurn(signal);
+    yield new Uint8Array(bytes3.subarray(offset, Math.min(bytes3.length, offset + chunkSize2)));
+  }
+}
+async function writeZipArchive(archive, limits, signal, descriptors = false, forceZip64 = false) {
+  return collectBytes(streamZipArchive(archive, limits, signal, descriptors, forceZip64), { maxBytes: limits.maxArchiveBytes, signal });
 }
 
 // packages/safe-bash/src/commands/archive/zip/safety.ts
@@ -27426,7 +27600,9 @@ var longOptions = {
   "compress-6": "6",
   "compress-7": "7",
   "compress-8": "8",
-  "compress-9": "9"
+  "compress-9": "9",
+  "force-zip64": "fz",
+  "strip-extra": "X"
 };
 var reservedOptions = [
   "adjust-sfx",
@@ -27446,7 +27622,6 @@ var reservedOptions = [
   "fifo",
   "filesync",
   "force-descriptors",
-  "force-zip64",
   "grow",
   "help",
   "more-help",
@@ -27482,23 +27657,25 @@ var reservedOptions = [
   "verbose",
   "version",
   "wild-stop-dirs",
-  "strip-extra",
   "archive-comment"
 ];
 function normalizeZipOption(argument2) {
   if (!argument2.startsWith("--") || argument2 === "--") return argument2;
   const equal2 = argument2.indexOf("=");
-  const name2 = argument2.slice(2, equal2 < 0 ? void 0 : equal2);
+  const rawName = argument2.slice(2, equal2 < 0 ? void 0 : equal2);
+  const negate2 = rawName.endsWith("-");
+  const name2 = negate2 ? rawName.slice(0, -1) : rawName;
   const names = [...Object.keys(longOptions), ...reservedOptions];
   const matches2 = names.includes(name2) ? [name2] : names.filter((option) => option.startsWith(name2));
   if (matches2.length > 1) throw new ZipFailure(16, "Invalid command arguments", `long option '${name2}' ambiguous`);
   const matched = matches2[0];
   const short = matched === void 0 ? void 0 : longOptions[matched];
   if (!short) throw new ZipFailure(16, "Invalid command arguments", `unsupported option: ${argument2}`);
+  if (negate2 && short !== "fz" && short !== "X") throw new ZipFailure(16, "Invalid command arguments", `option ${matched} is not negatable`);
   if (equal2 >= 0 && short !== "i" && short !== "x" && short !== "n" && short !== "Z") {
     throw new ZipFailure(16, "Invalid command arguments", `option '${matched}' does not allow a value`);
   }
-  return `-${short}${equal2 < 0 ? "" : argument2.slice(equal2)}`;
+  return `-${short}${negate2 ? "-" : ""}${equal2 < 0 ? "" : argument2.slice(equal2)}`;
 }
 
 // packages/safe-bash/src/commands/archive/zip.ts
@@ -27530,6 +27707,8 @@ async function parse12(scope, limits) {
   let omitDirectories = false;
   let storeLinks = false;
   let test = false;
+  let zip64;
+  let metadata3 = "default";
   let level = 6;
   let method = "deflate";
   let suffixes = defaultStoreSuffixes;
@@ -27550,13 +27729,19 @@ async function parse12(scope, limits) {
       for (let offset = 1; offset < argument2.length; offset++) {
         const flag = argument2[offset];
         if (flag === "r") recursive = true;
-        else if (flag === "d" || flag === "u" || flag === "f") {
+        else if (flag === "f" && argument2[offset + 1] === "z") {
+          zip64 = argument2[offset + 2] !== "-";
+          offset += zip64 ? 1 : 2;
+        } else if (flag === "d" || flag === "u" || flag === "f") {
           const next = flag === "d" ? "delete" : flag === "u" ? "update" : "freshen";
           if (action !== "add" && action !== next) throw new ZipFailure(16, "Invalid command arguments", "specify just one action");
           action = next;
         } else if (flag === "q") quiet = true;
         else if (flag === "j") junkPaths = true;
-        else if (flag === "D") omitDirectories = true;
+        else if (flag === "X") {
+          metadata3 = argument2[offset + 1] === "-" ? "all" : "strip";
+          if (metadata3 === "all") offset++;
+        } else if (flag === "D") omitDirectories = true;
         else if (flag === "y") storeLinks = true;
         else if (flag === "T") test = true;
         else if (flag === "@") stdinNames = true;
@@ -27645,7 +27830,7 @@ async function parse12(scope, limits) {
       start = end + 1;
     }
   }
-  return { action, archive, recursive, quiet, junkPaths, omitDirectories, storeLinks, test, includes, excludes, level, method, suffixes, operands: [...names, ...operands], firstOperand };
+  return { action, archive, recursive, quiet, junkPaths, omitDirectories, storeLinks, test, zip64, metadata: metadata3, includes, excludes, level, method, suffixes, operands: [...names, ...operands], firstOperand };
 }
 function memberName(path, limits) {
   if (path.startsWith("//") && !path.startsWith("///")) fail("UNC source paths are unsupported");
@@ -27727,8 +27912,10 @@ async function prepare(scope, parsed, budget) {
     if (!store && parsed.level === 0 && bytes4.length && !attributes.directory && !attributes.symlink) throw new ZipFailure(5, "Internal logic error", "bad pack level");
     const level = store ? 0 : parsed.level;
     let entry = await makeZipEntry(name2, bytes4, attributes, limits, context2.signal, level, parsed.archive === "-" && !store);
+    if (parsed.zip64 === true || parsed.zip64 === void 0 && source2 === "-") entry.zip64 = true;
     const prior = old.get(name2);
     if (prior?.comment) entry = { ...entry, comment: prior.comment };
+    if (parsed.metadata !== "default") entry = updateZipExtras(entry, prior, parsed.metadata, limits);
     if (entry.data.length > limits.maxArchiveBytes - compressedBytes) fail("archive byte limit exceeded");
     compressedBytes += entry.data.length;
     selected.set(name2, { entry, source: source2 });
@@ -27884,7 +28071,8 @@ async function prepare(scope, parsed, budget) {
     append(entry, false);
   }
   if (!entries2.length) queue("	zip warning: zip file empty\n");
-  const bytes3 = await writeZipArchive({ entries: entries2, comment: archive.comment }, limits, context2.signal, parsed.archive === "-");
+  if (parsed.archive === "-") return { kind: "stream", archive: { entries: entries2, comment: archive.comment }, progress };
+  const bytes3 = await writeZipArchive({ entries: entries2, comment: archive.comment }, limits, context2.signal, false, parsed.zip64 === true);
   if (parsed.test && parsed.archive !== "-") {
     for (const message3 of progress) await budget.output(message3);
     progress.length = 0;
@@ -27910,7 +28098,7 @@ async function prepare(scope, parsed, budget) {
 `);
     }
   }
-  return { publication, bytes: bytes3, progress };
+  return { kind: "file", publication, bytes: bytes3, progress };
 }
 function createZipCommand(options2 = {}) {
   const limits = settings2(options2);
@@ -27924,15 +28112,18 @@ function createZipCommand(options2 = {}) {
       if (parsed.archive === "-") budget = new Budget14({ ...context2, stdout: context2.stderr }, limits);
       const prepared = await prepare(scope, parsed, budget);
       if (!prepared) return { exitCode: 12 };
-      const publication = prepared.publication;
-      if (publication) {
+      if (prepared.kind === "file") {
+        const publication = prepared.publication;
+        if (!publication) fail("ZIP missing file publication");
         await writeFileOutput(context2, prepared.bytes, () => scope.operation(() => publishZip(scope, { ...publication, bytes: prepared.bytes })));
         for (const message3 of prepared.progress) await budget.output(message3);
       } else {
         for (const message3 of prepared.progress) await budget.output(message3);
         const output2 = createOutputOperation(context2, context2.stdout);
         try {
-          await writeBytes(output2.output, prepared.bytes, output2.signal);
+          for await (const chunk of streamZipArchive(prepared.archive, limits, output2.signal, true, parsed.zip64 === true)) {
+            await writeBytes(output2.output, chunk, output2.signal);
+          }
         } finally {
           await output2.close();
         }