@poe-platform/safe-bash 0.1.798 → 0.1.800

package/dist/safe-bash/commands/archive/unzip.js

@@ -1,399 +1,2 @@
-import { byteLength, concatBytes, encodeBytes } from "../../byte-encoding.js";
-import { dirname, collectBytes, readBytes, resolvePath, writeBytes } from "../../contracts/index.js";
-import { writeFileOutput } from "../../contracts/filesystem-output.js";
-import { createOutputOperation } from "../../contracts/output.js";
-import { PublicDiagnostic, publicDiagnosticMessage } from "../../diagnostics.js";
-import { Budget, bounded, checkPath, display, fail, invocationLimits, settings, text, vfsPath } from "./internal.js";
-import { decodeZipEntry, readZipArchive } from "./zip-format.js";
-import { Answers, parseArguments, Selection } from "./unzip/arguments.js";
-import { Extraction } from "./unzip/safety.js";
-import { readZipPassword } from "./zip/crypto.js";
-import { resolveZipVolumes } from "./zip/volumes.js";
-function filtered(name) {
-    let output = "";
-    for (const character of name) {
-        const code = character.charCodeAt(0);
-        output += code < 32 ? `^${String.fromCharCode(code + 64)}` : character;
-    }
-    return output;
-}
-function padded(name) {
-    return name + " ".repeat(Math.max(0, 22 - byteLength(name)));
-}
-function date(entry) {
-    const modified = entry.modified;
-    const pad = (value) => String(value).padStart(2, "0");
-    return `${modified.getFullYear()}-${pad(modified.getMonth() + 1)}-${pad(modified.getDate())} ${pad(modified.getHours())}:${pad(modified.getMinutes())}`;
-}
-async function comment(bytes, budget) {
-    if (!bytes.length)
-        return;
-    const output = [];
-    let length = 0;
-    for (const byte of bytes) {
-        if (!byte)
-            break;
-        if (byte !== 13 && byte !== 19)
-            length += byte === 27 ? 2 : 1;
-        if (length > budget.limits.maxTextBytes - budget.textBytes)
-            fail("text output limit exceeded");
-    }
-    for (const byte of bytes) {
-        if (!byte)
-            break;
-        if (byte === 13 || byte === 19)
-            continue;
-        if (byte === 27)
-            output.push(94, 91);
-        else
-            output.push(byte);
-    }
-    if (output.length && output.at(-1) !== 10)
-        output.push(10);
-    const value = Uint8Array.from(output);
-    if (value.length > budget.limits.maxTextBytes - budget.textBytes)
-        fail("text output limit exceeded");
-    budget.textBytes += value.length;
-    await writeBytes(budget.context.stdout, value, budget.context.signal);
-}
-export function createUnzipCommand(options = {}) {
-    const configured = settings(options);
-    return { name: "unzip", description: "List, stream or safely extract ZIP archives in the virtual filesystem", async execute(original) {
-            const limits = invocationLimits(configured, original);
-            original.signal.throwIfAborted();
-            const controller = new AbortController();
-            const context = { ...original, signal: AbortSignal.any([original.signal, controller.signal]) };
-            const extraction = new Extraction(context, limits);
-            let output;
-            let answers;
-            let closing;
-            const close = () => closing ??= (async () => {
-                controller.abort(new Error("unzip command closed"));
-                await Promise.all([extraction.close(), output?.close()]);
-                await answers?.close().catch(() => { });
-            })();
-            original.registerCleanup?.(close);
-            const budget = new Budget(context, limits);
-            try {
-                const parsed = parseArguments(context, limits);
-                if (parsed.pipe)
-                    output = createOutputOperation(context, context.stdout);
-                if (parsed.pipe && parsed.destination !== undefined)
-                    await budget.output("caution:  not extracting; -d ignored\n", true);
-                const selection = new Selection(parsed.patterns, limits, context.signal, { caseInsensitive: parsed.caseInsensitive });
-                const exclusions = new Selection(parsed.exclusions, limits, context.signal, { caseInsensitive: parsed.caseInsensitive });
-                let archive = parsed.archive;
-                let archiveStat;
-                for (const candidate of [archive, `${archive}.zip`, `${archive}.ZIP`]) {
-                    checkPath(candidate, limits);
-                    const candidateStat = await extraction.stat(vfsPath(context.cwd, candidate));
-                    if (candidateStat) {
-                        archive = candidate;
-                        archiveStat = candidateStat;
-                        break;
-                    }
-                }
-                if (!archiveStat) {
-                    if (!parsed.pipe)
-                        await budget.output(`unzip:  cannot find or open ${archive}, ${archive}.zip or ${archive}.ZIP.\n`, true);
-                    return { exitCode: 9 };
-                }
-                const archivePath = await extraction.operation(() => context.fs.realpath(vfsPath(context.cwd, archive), { signal: context.signal }));
-                archiveStat = await extraction.operation(() => context.fs.stat(archivePath, { signal: context.signal }));
-                if (archiveStat.type !== "file")
-                    fail("input archive is not a regular file");
-                if (!Number.isSafeInteger(archiveStat.size) || archiveStat.size < 0 || archiveStat.size > limits.maxArchiveBytes)
-                    fail("archive byte limit exceeded");
-                const bytes = await collectBytes(bounded(extraction.input(archivePath), limits.maxArchiveBytes, context.signal, limits.chunkSize), { signal: context.signal, ...(Number.isFinite(limits.maxArchiveBytes) ? { maxBytes: limits.maxArchiveBytes } : {}), ...(Number.isFinite(limits.maxInputMemoryBytes) ? { maxMemoryBytes: limits.maxInputMemoryBytes } : {}) });
-                if ((!parsed.pipe || parsed.pipeHeaders) && !parsed.names && !parsed.quiet)
-                    await budget.output(`Archive:  ${filtered(archive)}\n`);
-                const resolved = await resolveZipVolumes({ context, limits, operation: action => extraction.operation(async () => action()), stat: path => extraction.stat(path), input: path => extraction.input(path) }, archivePath, bytes, options.zipHost);
-                extraction.inputVolumes = resolved.volumes ?? [];
-                const zip = await readZipArchive(resolved.bytes, limits, context.signal, resolved.disks ? { disks: resolved.disks } : { prefix: true });
-                if (parsed.archiveComment || (!parsed.pipe || parsed.pipeHeaders) && !parsed.names && !parsed.quiet)
-                    await comment(zip.comment, budget);
-                if (parsed.archiveComment)
-                    return { exitCode: 0 };
-                if (!zip.entries.length) {
-                    await budget.output(`warning [${filtered(archive)}]:  zipfile is empty\n`, true);
-                    return { exitCode: 1 };
-                }
-                if (parsed.names) {
-                    let selected = 0;
-                    for (const entry of zip.entries) {
-                        await budget.member(entry.size);
-                        checkPath(entry.name, limits);
-                        if (!await selection.matches(entry.name, true))
-                            continue;
-                        if (parsed.exclusions.length && await exclusions.matches(entry.name, true))
-                            continue;
-                        await budget.output(`${filtered(entry.name)}\n`);
-                        selected++;
-                    }
-                    let unmatched = false;
-                    for (let index = 0; index < parsed.patterns.length; index++)
-                        if (!selection.matched.has(index)) {
-                            await budget.output(`caution: filename not matched:  ${filtered(parsed.patterns[index])}\n`, true);
-                            unmatched = true;
-                        }
-                    return { exitCode: selected && !unmatched ? 0 : 11 };
-                }
-                if (parsed.list)
-                    await budget.output(parsed.verbose
-                        ? " Length   Method    Size  Cmpr    Date    Time   CRC-32   Name\n--------  ------  ------- ---- ---------- ----- --------  ----\n"
-                        : "  Length      Date    Time    Name\n---------  ---------- -----   ----\n");
-                const rootRaw = parsed.destination === undefined ? context.cwd : vfsPath(context.cwd, parsed.destination);
-                const root = parsed.list || parsed.pipe || parsed.test ? resolvePath(rootRaw) : await extraction.directory(rootRaw, true);
-                if (!parsed.list && !parsed.pipe && !parsed.test)
-                    answers = new Answers(extraction.source(context.stdin), limits, context.signal);
-                let overwrite = parsed.neverOverwrite ? "none" : parsed.overwrite ? "all" : "ask";
-                let exitCode = 0;
-                let selected = 0;
-                let badPasswords = 0;
-                let total = 0;
-                let compressedTotal = 0;
-                let actualTotal = 0;
-                let password = parsed.password;
-                const payload = async function* (entry) {
-                    let actual = 0;
-                    const signal = output?.signal ?? context.signal;
-                    if (entry.flags & 1) {
-                        // A matching header byte does not authenticate the member. Verify
-                        // each candidate completely before retaining a password or output.
-                        for (let attempt = password !== undefined && parsed.password === undefined ? -1 : 0; attempt < 3; attempt++) {
-                            if (password === undefined)
-                                password = await extraction.operation(() => readZipPassword(options.zipHost, limits.maxArgumentBytes, signal, false));
-                            try {
-                                const verified = await collectBytes(decodeZipEntry(entry, limits, signal, password), { ...(Number.isFinite(Math.min(limits.maxEntryBytes, limits.maxTotalBytes - actualTotal)) ? { maxBytes: Math.min(limits.maxEntryBytes, limits.maxTotalBytes - actualTotal) } : {}), signal });
-                                actualTotal += verified.length;
-                                yield verified;
-                                return;
-                            }
-                            catch (error) {
-                                signal.throwIfAborted();
-                                if (parsed.password !== undefined || !(error instanceof PublicDiagnostic) || error.message !== "ZIP incorrect password")
-                                    throw error;
-                                password = undefined;
-                            }
-                        }
-                        fail("ZIP incorrect password");
-                    }
-                    for await (const chunk of readBytes(decodeZipEntry(entry, limits, signal, password), signal)) {
-                        if (chunk.length > limits.maxEntryBytes - actual || chunk.length > limits.maxTotalBytes - actualTotal)
-                            fail("actual decompressed byte limit exceeded");
-                        actual += chunk.length;
-                        actualTotal += chunk.length;
-                        yield chunk;
-                    }
-                };
-                const links = [];
-                const directories = [];
-                for (const entry of zip.entries) {
-                    await budget.member(entry.size);
-                    checkPath(entry.name, limits);
-                    if (!await selection.matches(entry.name, true))
-                        continue;
-                    if (parsed.exclusions.length && await exclusions.matches(entry.name, true))
-                        continue;
-                    selected++;
-                    total += entry.size;
-                    try {
-                        if (parsed.test) {
-                            for await (const chunk of payload(entry)) {
-                                if (chunk.length)
-                                    context.signal.throwIfAborted();
-                            }
-                            if (!parsed.quiet)
-                                await budget.output(`    testing: ${padded(filtered(entry.name))} OK\n`);
-                            continue;
-                        }
-                        if (parsed.pipe) {
-                            if (parsed.pipeHeaders && !parsed.quiet)
-                                await budget.output(`${entry.method === 0 ? " extracting" : "  inflating"}: ${padded(filtered(entry.name))}  \n`);
-                            for await (const chunk of payload(entry))
-                                await output.output.write(chunk);
-                            if (parsed.pipeHeaders && !parsed.quiet)
-                                await budget.output("\n");
-                            continue;
-                        }
-                        if (parsed.list) {
-                            const size = entry.compressedSize ?? entry.data.length;
-                            compressedTotal += size;
-                            const method = entry.method === 0 ? "Stored" : entry.method === 8 ? "Defl:N" : entry.method === 12 ? "BZip2" : entry.method === 14 ? "LZMA" : `m${entry.method}`;
-                            const ratio = entry.size ? Math.round(100 * (entry.size - size) / entry.size) : 0;
-                            await budget.output(parsed.verbose
-                                ? `${String(entry.size).padStart(8)}  ${method.padEnd(6)} ${String(size).padStart(8)} ${String(ratio).padStart(3)}% ${date(entry)} ${entry.crc32.toString(16).padStart(8, "0")}  ${filtered(entry.name)}\n`
-                                : `${String(entry.size).padStart(9)}  ${date(entry)}   ${filtered(entry.name)}\n`);
-                            if (entry.comment)
-                                await comment(entry.comment, budget);
-                            continue;
-                        }
-                        let path = extraction.member(root, entry.name);
-                        const fileType = entry.mode & 0o170000;
-                        if (fileType && fileType !== 0o100000 && fileType !== 0o040000 && fileType !== 0o120000 && fileType !== 0o010000)
-                            fail("unsupported special ZIP entry");
-                        if (path === root && !entry.directory)
-                            fail("entry would replace extraction root");
-                        if (parsed.junkPaths && entry.directory)
-                            continue;
-                        const name = parsed.junkPaths ? entry.name.split("/").at(-1) : entry.name;
-                        if (parsed.junkPaths)
-                            path = extraction.member(root, name);
-                        if (path === root && !entry.directory)
-                            fail("entry would replace extraction root");
-                        let shown = parsed.destination === undefined ? name : `${parsed.destination.endsWith("/") ? parsed.destination : `${parsed.destination}/`}${name}`;
-                        if (parsed.freshen && !await extraction.stat(path))
-                            continue;
-                        await extraction.parents(root, path, true);
-                        if (entry.directory) {
-                            if (entry.size)
-                                fail("directory has nonempty payload");
-                            for await (const chunk of payload(entry)) {
-                                await writeFileOutput(context, chunk, async () => { if (chunk.length)
-                                    fail("directory has nonempty payload"); });
-                            }
-                            const parent = await extraction.operation(() => context.fs.lstat(dirname(path), { signal: context.signal }));
-                            const existing = await extraction.stat(path);
-                            let identity = existing;
-                            if (existing && existing.type !== "directory")
-                                fail("directory destination is not a directory");
-                            if (!existing) {
-                                identity = await extraction.createDirectory(path, parent);
-                                if (!parsed.quiet)
-                                    await budget.output(`   creating: ${filtered(shown)}\n`);
-                            }
-                            if (!identity || identity.type !== "directory")
-                                fail("directory changed during creation");
-                            directories.push({ path, entry, identity, parent });
-                            continue;
-                        }
-                        let parent = await extraction.operation(() => context.fs.lstat(dirname(path), { signal: context.signal }));
-                        let existing = await extraction.destination(path, archivePath, archiveStat);
-                        if (parsed.update && existing && Math.ceil(Math.floor(existing.mtimeMs / 1000) / 2) * 2000 >= entry.modified.getTime())
-                            continue;
-                        let skip = false;
-                        let prompting = 0;
-                        while (existing && overwrite !== "all") {
-                            if (overwrite === "none") {
-                                skip = true;
-                                break;
-                            }
-                            if (++prompting > limits.maxMembers)
-                                fail("overwrite prompt work limit exceeded");
-                            await budget.output(`replace ${filtered(shown)}? [y]es, [n]o, [A]ll, [N]one, [r]ename: `, true);
-                            const answer = await answers.read();
-                            if (answer === undefined) {
-                                await budget.output(' NULL\n(EOF or read error, treating as "[N]one" ...)\n', true);
-                                overwrite = "none";
-                                exitCode = 1;
-                                skip = true;
-                                break;
-                            }
-                            const choice = answer[0];
-                            if (choice === "A") {
-                                overwrite = "all";
-                                break;
-                            }
-                            if (choice === "y" || choice === "Y")
-                                break;
-                            if (choice === "n" || choice === "N") {
-                                if (choice === "N")
-                                    overwrite = "none";
-                                skip = true;
-                                break;
-                            }
-                            if (choice === "r" || choice === "R") {
-                                let renamed = "";
-                                while (!renamed) {
-                                    await budget.output("new name: ", true);
-                                    const value = await answers.read(limits.maxPathBytes);
-                                    if (value === undefined)
-                                        fail("EOF while reading replacement name");
-                                    renamed = value.endsWith("\n") ? value.slice(0, -1) : value;
-                                }
-                                path = extraction.member(root, renamed);
-                                shown = parsed.destination === undefined ? renamed : `${parsed.destination.endsWith("/") ? parsed.destination : `${parsed.destination}/`}${renamed}`;
-                                await extraction.parents(root, path, true);
-                                parent = await extraction.operation(() => context.fs.lstat(dirname(path), { signal: context.signal }));
-                                existing = await extraction.destination(path, archivePath, archiveStat);
-                                continue;
-                            }
-                            const response = choice === "\n" || choice === "\r" ? "{ENTER}" : answer.endsWith("\n") ? answer.slice(0, -1) : answer;
-                            await budget.output(`error:  invalid response [${response}]\n`, true);
-                        }
-                        if (skip)
-                            continue;
-                        const chunks = [];
-                        let actual = 0;
-                        for await (const chunk of payload(entry)) {
-                            actual += chunk.length;
-                            await writeFileOutput(context, chunk, async (bytes) => { chunks.push(Uint8Array.from(bytes)); });
-                        }
-                        if (entry.symlink) {
-                            if (actual > limits.maxPathBytes)
-                                fail("symlink target byte limit exceeded");
-                            const target = text(concatBytes(chunks));
-                            await extraction.target(root, path, target);
-                            if (!context.fs.symlink || context.fs.capabilities.symlinks === false)
-                                fail("filesystem does not support symlinks");
-                            links.push({ path, shown, target, existing, parent, entry });
-                            if (!parsed.quiet)
-                                await budget.output(`    linking: ${padded(filtered(shown))}  -> ${filtered(target)} \n`);
-                        }
-                        else {
-                            await extraction.publish(root, path, chunks, existing, parent, entry.mode, entry.modified);
-                            if (!parsed.quiet)
-                                await budget.output(`${entry.method === 0 ? " extracting" : "  inflating"}: ${padded(filtered(shown))}  \n`);
-                        }
-                    }
-                    catch (error) {
-                        context.signal.throwIfAborted();
-                        if (!(error instanceof PublicDiagnostic) || error.message !== "ZIP incorrect password")
-                            throw error;
-                        badPasswords++;
-                        await budget.output(`skipping: ${filtered(entry.name)}  incorrect password\n`, true);
-                    }
-                }
-                if (parsed.list)
-                    await budget.output(parsed.verbose
-                        ? `--------          -------  ---                            -------\n${String(total).padStart(8)}         ${String(compressedTotal).padStart(8)} ${String(total ? Math.round(100 * (total - compressedTotal) / total) : 0).padStart(3)}%                            ${selected} file${selected === 1 ? "" : "s"}\n`
-                        : `---------                     -------\n${String(total).padStart(9)}                     ${selected} file${selected === 1 ? "" : "s"}\n`);
-                else {
-                    if (links.length && !parsed.quiet)
-                        await budget.output("finishing deferred symbolic links:\n");
-                    for (const link of links) {
-                        await extraction.parents(root, link.path, false);
-                        await extraction.target(root, link.path, link.target);
-                        await extraction.destination(link.path, archivePath, archiveStat);
-                        await extraction.publish(root, link.path, [], link.existing, link.parent, link.entry.mode, link.entry.modified, link.target);
-                        if (!parsed.quiet)
-                            await budget.output(`  ${padded(filtered(link.shown))} -> ${filtered(link.target)}\n`);
-                    }
-                    for (const { path, entry, identity, parent } of directories.reverse()) {
-                        await extraction.metadata(root, path, identity, parent, entry.mode, entry.modified);
-                    }
-                }
-                for (let index = 0; index < parsed.patterns.length; index++)
-                    if (!selection.matched.has(index)) {
-                        await budget.output(`caution: filename not matched:  ${filtered(parsed.patterns[index])}\n`, true);
-                        exitCode = 11;
-                    }
-                const resultCode = badPasswords ? badPasswords === selected ? 82 : 1 : selected ? exitCode : 11;
-                if (parsed.test && parsed.quiet < 2)
-                    await budget.output(resultCode
-                        ? `At least one error was detected in ${filtered(archive)}.\n`
-                        : `No errors detected in compressed data of ${filtered(archive)}.\n`);
-                return { exitCode: resultCode };
-            }
-            catch (error) {
-                original.signal.throwIfAborted();
-                const message = display(publicDiagnosticMessage(error, original.onInternalError).slice(0, limits.maxDiagnosticBytes));
-                await writeBytes(original.stderr, encodeBytes(`unzip: ${message}\n`).subarray(0, limits.maxDiagnosticBytes), original.signal);
-                return { exitCode: 2 };
-            }
-            finally {
-                await close();
-            }
-        } };
-}
+export * from "../../../safe-bash-command-unzip/unzip.js";
 //# sourceMappingURL=unzip.js.map

package/dist/safe-bash/commands/archive/zip/aes.d.ts

@@ -1,18 +1,2 @@
-import { type ByteSource } from "../../../contracts/index.js";
-import type { ZipEncryption } from "./crypto.js";
-/** WinZip AES encryption specification 1.04, AE-1 and AE-2. */
-export interface ZipAes {
-    readonly strength: 128 | 192 | 256;
-    readonly version: 1 | 2;
-}
-export declare function zipEncryptionProfile(profile: string): ZipAes | undefined;
-export declare function aesParameters(aes: ZipAes): {
-    keyBytes: number;
-    saltBytes: number;
-};
-export declare function encryptAesPayload(source: ByteSource, encryption: ZipEncryption & {
-    aes: ZipAes;
-}, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
-export declare function decryptAesPayload(wire: Uint8Array, password: Uint8Array, aes: ZipAes, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
-export declare function aesExtra(aes: ZipAes, method: number): Uint8Array;
+export * from "../../../../safe-bash-zip-engine/zip/aes.js";
 //# sourceMappingURL=aes.d.ts.map

package/dist/safe-bash/commands/archive/zip/aes.js

@@ -1,157 +1,2 @@
-import * as crypto from "#safe-bash-zip-aes-crypto";
-import { collectBytes } from "../../../contracts/index.js";
-import { yieldTurn } from "../../../contracts/yield.js";
-import { fail } from "../internal.js";
-function aesPrimitives() {
-    // Some legitimate non-Node hosts expose only hashes/randomness. Reflective
-    // admission keeps plain ZIP loadable there without requiring absent exports.
-    const names = ["createCipheriv", "createHmac", "pbkdf2Sync", "timingSafeEqual"];
-    const entries = names.map(name => [name, Reflect.get(crypto, name)]);
-    if (entries.some(([, value]) => typeof value !== "function"))
-        fail("ZIP AES vetted crypto primitives are unavailable");
-    return Object.fromEntries(entries);
-}
-export function zipEncryptionProfile(profile) {
-    if (profile === "zipcrypto")
-        return undefined;
-    const [prefix, strength, version, extra] = profile.split("-");
-    if (prefix !== "aes" || extra !== undefined || !["128", "192", "256"].includes(strength) || !["ae1", "ae2"].includes(version))
-        fail("ZIP unsupported encryption profile");
-    return { strength: Number(strength), version: version === "ae1" ? 1 : 2 };
-}
-export function aesParameters(aes) {
-    if (aes.version !== 1 && aes.version !== 2)
-        fail("ZIP unsupported AES version");
-    if (aes.strength !== 128 && aes.strength !== 192 && aes.strength !== 256)
-        fail("ZIP unsupported AES strength");
-    return { keyBytes: aes.strength / 8, saltBytes: aes.strength / 16 };
-}
-function keys(password, salt, aes, signal) {
-    signal.throwIfAborted();
-    const { keyBytes } = aesParameters(aes);
-    // A fixed 1000-iteration native call introduces no asynchronous resource to
-    // outlive invocation cleanup. Cancellation is checked at native boundaries.
-    const derived = aesPrimitives().pbkdf2Sync(password, salt, 1000, keyBytes * 2 + 2, "sha1");
-    if (signal.aborted) {
-        derived.fill(0);
-        signal.throwIfAborted();
-    }
-    return derived;
-}
-async function transform(input, key, aes, signal) {
-    const cipher = aesPrimitives().createCipheriv(`aes-${aes.strength}-ecb`, key, null);
-    cipher.setAutoPadding(false);
-    const output = new Uint8Array(input.length);
-    try {
-        // The extension uses AES(counter), with a 128-bit little-endian counter
-        // starting at one. OpenSSL CTR's big-endian increment is incompatible.
-        for (let offset = 0; offset < input.length; offset += 65536) {
-            signal.throwIfAborted();
-            const length = Math.min(65536, input.length - offset);
-            const counters = new Uint8Array(Math.ceil(length / 16) * 16);
-            const view = new DataView(counters.buffer);
-            for (let block = 0; block < counters.length; block += 16)
-                view.setBigUint64(block, BigInt((offset + block) / 16 + 1), true);
-            const stream = cipher.update(counters);
-            for (let i = 0; i < length; i++)
-                output[offset + i] = input[offset + i] ^ stream[i];
-            stream.fill(0);
-            await yieldTurn(signal);
-        }
-        cipher.final();
-        return output;
-    }
-    catch (error) {
-        output.fill(0);
-        throw error;
-    }
-    finally {
-        cipher.destroy();
-    }
-}
-export async function encryptAesPayload(source, encryption, maxBytes, signal) {
-    signal.throwIfAborted();
-    const primitives = aesPrimitives();
-    const { keyBytes, saltBytes } = aesParameters(encryption.aes);
-    const aes = { ...encryption.aes };
-    const password = new Uint8Array(encryption.password);
-    let plaintext;
-    let derived;
-    try {
-        plaintext = await collectBytes(source, { ...(Number.isFinite(maxBytes) ? { maxBytes } : {}), signal });
-        let supplied;
-        try {
-            supplied = await encryption.entropy(saltBytes, signal);
-        }
-        catch {
-            signal.throwIfAborted();
-            fail("ZIP AES entropy capability failed");
-        }
-        signal.throwIfAborted();
-        if (!(supplied instanceof Uint8Array) || supplied.length !== saltBytes)
-            fail("ZIP invalid AES entropy bytes");
-        const salt = new Uint8Array(supplied);
-        derived = keys(password, salt, aes, signal);
-        const encrypted = await transform(plaintext, derived.subarray(0, keyBytes), aes, signal);
-        const tag = primitives.createHmac("sha1", derived.subarray(keyBytes, keyBytes * 2)).update(encrypted).digest();
-        const wire = new Uint8Array(saltBytes + 2 + encrypted.length + 10);
-        wire.set(salt);
-        wire.set(derived.subarray(keyBytes * 2), saltBytes);
-        wire.set(encrypted, saltBytes + 2);
-        wire.set(tag.subarray(0, 10), wire.length - 10);
-        encrypted.fill(0);
-        tag.fill(0);
-        return wire;
-    }
-    finally {
-        plaintext?.fill(0);
-        derived?.fill(0);
-        password.fill(0);
-    }
-}
-export async function decryptAesPayload(wire, password, aes, maxBytes, signal) {
-    signal.throwIfAborted();
-    const primitives = aesPrimitives();
-    const { keyBytes, saltBytes } = aesParameters(aes);
-    aes = { ...aes };
-    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0))
-        throw new RangeError("maxBytes must be a nonnegative safe integer");
-    if (wire.length < saltBytes + 12)
-        fail("ZIP truncated AES payload");
-    const size = wire.length - saltBytes - 12;
-    if (size > maxBytes)
-        fail("ZIP AES authenticated staging limit exceeded");
-    // Copy before asynchronous KDF work; callers cannot mutate authenticated bytes.
-    const owned = new Uint8Array(wire);
-    const secret = new Uint8Array(password);
-    let derived;
-    try {
-        derived = keys(secret, owned.subarray(0, saltBytes), aes, signal);
-        if (!primitives.timingSafeEqual(derived.subarray(keyBytes * 2), owned.subarray(saltBytes, saltBytes + 2)))
-            fail("ZIP incorrect password");
-        const encrypted = owned.subarray(saltBytes + 2, owned.length - 10);
-        const tag = primitives.createHmac("sha1", derived.subarray(keyBytes, keyBytes * 2)).update(encrypted).digest();
-        const authentic = primitives.timingSafeEqual(tag.subarray(0, 10), owned.subarray(owned.length - 10));
-        tag.fill(0);
-        if (!authentic)
-            fail("ZIP AES authentication failed");
-        return await transform(encrypted, derived.subarray(0, keyBytes), aes, signal);
-    }
-    finally {
-        derived?.fill(0);
-        secret.fill(0);
-        owned.fill(0);
-    }
-}
-export function aesExtra(aes, method) {
-    aesParameters(aes);
-    const bytes = new Uint8Array(11);
-    const view = new DataView(bytes.buffer);
-    view.setUint16(0, 0x9901, true);
-    view.setUint16(2, 7, true);
-    view.setUint16(4, aes.version, true);
-    bytes.set([65, 69, aes.strength / 64 - 1], 6);
-    view.setUint16(9, method, true);
-    return bytes;
-}
+export * from "../../../../safe-bash-zip-engine/zip/aes.js";
 //# sourceMappingURL=aes.js.map

package/dist/safe-bash/commands/archive/zip/comments.d.ts

@@ -1,18 +1,2 @@
-import { type ByteSource } from "../../../contracts/index.js";
-import { type ArchiveLimits } from "../internal.js";
-/** One bounded cursor for all comments; an input chunk may contain many lines. */
-export declare class ZipCommentInput {
-    private readonly limits;
-    private readonly signal;
-    readonly iterator: AsyncIterator<Uint8Array>;
-    private chunk;
-    private offset;
-    private bytes;
-    private pulls;
-    private ended;
-    constructor(source: ByteSource, limits: ArchiveLimits, signal: AbortSignal);
-    readLine(): Promise<Uint8Array | undefined>;
-}
-/** Info-ZIP's fgets/strlen archive-comment grammar, with explicit byte limits. */
-export declare function readZipComment(source: ByteSource | ZipCommentInput, limits: ArchiveLimits, signal: AbortSignal): Promise<Uint8Array>;
+export * from "../../../../safe-bash-zip-engine/zip/comments.js";
 //# sourceMappingURL=comments.d.ts.map