@poe-platform/safe-bash 0.1.799 → 0.1.800

package/dist/safe-bash-zip-engine/zip/repair.js

@@ -0,0 +1,348 @@
+import {
+  ZipFailure
+} from "../../safe-bash/command-chunks/chunk-Q3EWDEUQ.js";
+import {
+  decodeZipEntry,
+  readZipArchive
+} from "../../safe-bash/command-chunks/chunk-364TMWBT.js";
+import {
+  stripZip64,
+  zip64Fields,
+  zipEnd
+} from "../../safe-bash/command-chunks/chunk-LE5LZNHE.js";
+import "../../safe-bash/command-chunks/chunk-2FGJYFWZ.js";
+import "../../safe-bash/command-chunks/chunk-PII4YEZW.js";
+import "../../safe-bash/command-chunks/chunk-H622NS6Z.js";
+import "../../safe-bash/command-chunks/chunk-SEM36PG5.js";
+import "../../safe-bash/command-chunks/chunk-UXSR5BZH.js";
+import {
+  init_buffer
+} from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip/repair.ts
+init_buffer();
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { concatBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { fail } from "../../safe-bash-io-engine/commands/archive/internal.js";
+function zip64Payload(bytes) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let result;
+  for (let offset = 0; offset < bytes.length; ) {
+    if (offset + 4 > bytes.length) fail("ZIP truncated extra field");
+    const next = offset + 4 + view.getUint16(offset + 2, true);
+    if (next > bytes.length) fail("ZIP truncated extra field");
+    if (view.getUint16(offset, true) === 1) {
+      if (result) fail("ZIP duplicate ZIP64 extra field");
+      result = bytes.subarray(offset + 4, next);
+    }
+    offset = next;
+  }
+  return result;
+}
+async function repairZip(bytes, mode, limits, signal, password) {
+  signal.throwIfAborted();
+  if (bytes.length > limits.maxArchiveBytes) fail("ZIP archive byte limit exceeded");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let work = 0, candidates = 0, decoded = 0;
+  const charge = (amount) => {
+    signal.throwIfAborted();
+    if (amount > limits.maxPatternSteps - work) throw new ZipFailure(4, "Out of memory", "ZIP recovery work limit exceeded");
+    work += amount;
+  };
+  const verify = async (archive) => {
+    for (const entry of archive.entries) {
+      for await (const chunk of decodeZipEntry(entry, limits, signal, password)) {
+        charge(chunk.length);
+        if (chunk.length > limits.maxTotalBytes - decoded) throw new ZipFailure(4, "Out of memory", "ZIP recovery total byte limit exceeded");
+        decoded += chunk.length;
+      }
+    }
+  };
+  const recoverCentral = async (archive) => {
+    const entries2 = [];
+    let partial2 = false;
+    for (const entry of archive.entries) {
+      try {
+        await verify({ entries: [entry], comment: new Uint8Array() });
+        entries2.push(entry);
+      } catch (error) {
+        signal.throwIfAborted();
+        if (error instanceof ZipFailure) throw error;
+        if (mode === "F") throw new ZipFailure(3, "Zip file structure invalid", "entry payload could not be verified; try -FF with a separate --out file");
+        partial2 = true;
+      }
+    }
+    if (partial2 && !entries2.length) throw new ZipFailure(3, "Zip file structure invalid", "no verified members recovered");
+    return { archive: { ...archive, entries: entries2 }, partial: partial2 };
+  };
+  const admitCandidate = (length) => {
+    if (++candidates > limits.maxMembers) fail("ZIP recovery candidate limit exceeded");
+    charge(length);
+    if (length > limits.maxArchiveBytes) fail("ZIP recovery archive byte limit exceeded");
+  };
+  charge(bytes.length);
+  let complete;
+  try {
+    complete = await readZipArchive(bytes, limits, signal, { prefix: true });
+  } catch {
+    signal.throwIfAborted();
+  }
+  if (complete?.prefix?.length) {
+    const prefixLength = complete.prefix.length;
+    for (let offset = 0; offset + 30 <= prefixLength; offset++) {
+      charge(1);
+      if (offset % 4096 === 0) await yieldTurn(signal);
+      if (view.getUint32(offset, true) !== 67324752) continue;
+      const payload = offset + 30 + view.getUint16(offset + 26, true) + view.getUint16(offset + 28, true);
+      if (view.getUint16(offset + 26, true) && payload <= prefixLength) {
+        complete = void 0;
+        break;
+      }
+    }
+  }
+  if (complete) return recoverCentral(complete);
+  {
+    let firstLocal = -1;
+    for (let start = 0; start + 46 <= bytes.length; start++) {
+      charge(1);
+      if (start % 4096 === 0) await yieldTurn(signal);
+      if (start + 30 <= bytes.length && view.getUint32(start, true) === 67324752) {
+        if (firstLocal < 0) firstLocal = start;
+        const payload = start + 30 + view.getUint16(start + 26, true) + view.getUint16(start + 28, true);
+        let compressed = view.getUint32(start + 18, true);
+        if (compressed === 4294967295 && payload <= bytes.length) {
+          try {
+            const extra = bytes.subarray(start + 30 + view.getUint16(start + 26, true), payload);
+            compressed = zip64Fields(zip64Payload(extra), [view.getUint32(start + 22, true), compressed])[1];
+          } catch {
+            signal.throwIfAborted();
+          }
+        }
+        const end2 = payload + compressed;
+        if (compressed !== 4294967295 && compressed && end2 <= bytes.length) {
+          start = end2 - 1;
+          continue;
+        }
+      }
+      if (view.getUint32(start, true) !== 33639248) continue;
+      let end = start, members = 0, minimumLocal = Infinity;
+      while (end + 46 <= bytes.length && view.getUint32(end, true) === 33639248) {
+        charge(46);
+        if (++members > limits.maxMembers) fail("ZIP recovery member limit exceeded");
+        const next = end + 46 + view.getUint16(end + 28, true) + view.getUint16(end + 30, true) + view.getUint16(end + 32, true);
+        if (next > bytes.length) break;
+        try {
+          const extra = end + 46 + view.getUint16(end + 28, true);
+          const values = zip64Fields(zip64Payload(bytes.subarray(extra, extra + view.getUint16(end + 30, true))), [view.getUint32(end + 24, true), view.getUint32(end + 20, true), view.getUint32(end + 42, true)]);
+          minimumLocal = Math.min(minimumLocal, values[2]);
+        } catch {
+          signal.throwIfAborted();
+        }
+        end = next;
+      }
+      const displacement = firstLocal >= 0 && minimumLocal !== Infinity ? Math.max(0, firstLocal - minimumLocal) : 0;
+      const tail = zipEnd(members, end - start, start - displacement, new Uint8Array());
+      admitCandidate(end + tail.length);
+      const candidate = new Uint8Array(end + tail.length);
+      candidate.set(bytes.subarray(0, end));
+      candidate.set(tail, end);
+      let archive;
+      try {
+        archive = await readZipArchive(candidate, limits, signal, { prefix: true });
+      } catch {
+        signal.throwIfAborted();
+        continue;
+      }
+      if (firstLocal >= 0 && archive.prefix?.length !== firstLocal) continue;
+      return recoverCentral(archive);
+    }
+    if (mode === "F") throw new ZipFailure(3, "Zip file structure invalid", "central directory could not be verified; try -FF with a separate --out file");
+  }
+  const entries = [];
+  const names = /* @__PURE__ */ new Set();
+  let partial = false, total = 0;
+  for (let start = 0; start + 4 <= bytes.length; start++) {
+    charge(1);
+    if (start % 4096 === 0) await yieldTurn(signal);
+    if (view.getUint32(start, true) !== 67324752) continue;
+    if (start + 30 > bytes.length) {
+      partial = true;
+      break;
+    }
+    const flags = view.getUint16(start + 6, true);
+    const nameLength = view.getUint16(start + 26, true), extraLength = view.getUint16(start + 28, true);
+    const payload = start + 30 + nameLength + extraLength;
+    if (payload > bytes.length || nameLength > limits.maxPathBytes || extraLength > limits.maxPaxBytes) {
+      partial = true;
+      break;
+    }
+    const rawCompressed = view.getUint32(start + 18, true), rawSize = view.getUint32(start + 22, true);
+    const checksum = view.getUint32(start + 14, true);
+    const wide = rawCompressed === 4294967295 || rawSize === 4294967295;
+    const localExtra = bytes.subarray(start + 30 + nameLength, payload);
+    let compressed = rawCompressed, size = rawSize;
+    let centralExtra;
+    try {
+      [size, compressed] = zip64Fields(zip64Payload(localExtra), [rawSize, rawCompressed]);
+      centralExtra = stripZip64(localExtra);
+      const fields = [];
+      const centralView = new DataView(centralExtra.buffer);
+      for (let offset = 0; offset < centralExtra.length; ) {
+        const next = offset + 4 + centralView.getUint16(offset + 2, true);
+        if (centralView.getUint16(offset, true) === 21589 && next - offset >= 5) {
+          const mtime = centralExtra[offset + 4] & 1;
+          const stamp = new Uint8Array(centralExtra.subarray(offset, offset + (mtime ? 9 : 5)));
+          new DataView(stamp.buffer).setUint16(2, mtime ? 5 : 1, true);
+          stamp[4] = mtime;
+          fields.push(stamp);
+        } else fields.push(centralExtra.subarray(offset, next));
+        offset = next;
+      }
+      centralExtra = new Uint8Array(concatBytes(fields));
+    } catch {
+      signal.throwIfAborted();
+      partial = true;
+      if (!(flags & 8) && !wide && payload + rawCompressed <= bytes.length) {
+        start = payload + rawCompressed - 1;
+        continue;
+      }
+      break;
+    }
+    const attempt = async (end2, compressedSize, expanded, crc) => {
+      if (expanded > limits.maxTotalBytes - total) throw new ZipFailure(4, "Out of memory", "ZIP recovery total byte limit exceeded");
+      if (expanded > limits.maxEntryBytes || compressedSize > limits.maxArchiveBytes || expanded >= 4294967295) return void 0;
+      const localLength = end2 - start, centralLength = 46 + nameLength + centralExtra.length;
+      const tail = zipEnd(1, centralLength, localLength, new Uint8Array());
+      admitCandidate(localLength + centralLength + tail.length);
+      const candidate = new Uint8Array(localLength + centralLength + tail.length);
+      candidate.set(bytes.subarray(start, end2));
+      const central = new DataView(candidate.buffer, localLength, centralLength);
+      central.setUint32(0, 33639248, true);
+      central.setUint16(4, 20, true);
+      candidate.set(bytes.subarray(start + 4, start + 14), localLength + 6);
+      central.setUint32(16, crc, true);
+      central.setUint32(20, compressedSize, true);
+      central.setUint32(24, expanded, true);
+      central.setUint16(28, nameLength, true);
+      central.setUint16(30, centralExtra.length, true);
+      candidate.set(bytes.subarray(start + 30, start + 30 + nameLength), localLength + 46);
+      candidate.set(centralExtra, localLength + 46 + nameLength);
+      candidate.set(tail, localLength + centralLength);
+      try {
+        const archive = await readZipArchive(candidate, limits, signal);
+        await verify(archive);
+        return archive.entries[0];
+      } catch (error) {
+        signal.throwIfAborted();
+        if (error instanceof ZipFailure) throw error;
+        return void 0;
+      }
+    };
+    let end = payload + compressed, entry;
+    if (flags & 8) {
+      const length = wide ? 20 : 12;
+      let matches = 0;
+      for (let offset = payload; offset + length <= bytes.length; offset++) {
+        charge(1);
+        if ((offset - payload) % 4096 === 0) await yieldTurn(signal);
+        const signed = view.getUint32(offset, true) === 134695760;
+        const base = offset + (signed ? 4 : 0), next = base + length;
+        if (next > bytes.length) continue;
+        const packed = wide ? view.getBigUint64(base + 4, true) : BigInt(view.getUint32(base + 4, true));
+        const expanded = wide ? view.getBigUint64(base + 12, true) : BigInt(view.getUint32(base + 8, true));
+        if (packed !== BigInt(offset - payload) || Number.isFinite(limits.maxEntryBytes) && expanded > BigInt(limits.maxEntryBytes)) continue;
+        if (compressed && packed !== BigInt(compressed) || size && expanded !== BigInt(size) || checksum && checksum !== view.getUint32(base, true)) continue;
+        if (next !== bytes.length && (next + 4 > bytes.length || ![67324752, 33639248, 101010256, 101075792].includes(view.getUint32(next, true)))) continue;
+        const candidateEntry = await attempt(next, Number(packed), Number(expanded), view.getUint32(base, true));
+        if (!candidateEntry) continue;
+        entry = candidateEntry;
+        end = next;
+        if (++matches > 1) {
+          partial = true;
+          entry = void 0;
+          break;
+        }
+        if (compressed) break;
+      }
+      if (!entry) {
+        partial = true;
+        if (matches > 1) {
+          start = end - 1;
+          continue;
+        }
+        break;
+      }
+    } else {
+      if (end > bytes.length) {
+        partial = true;
+        break;
+      }
+      entry = await attempt(end, compressed, size, checksum);
+    }
+    start = end - 1;
+    if (!entry || names.has(entry.name)) {
+      partial = true;
+      continue;
+    }
+    if (entry.size > limits.maxTotalBytes - total) fail("ZIP recovery total byte limit exceeded");
+    names.add(entry.name);
+    total += entry.size;
+    entries.push(entry);
+  }
+  if (!entries.length) throw new ZipFailure(3, "Zip file structure invalid", "no verified members recovered");
+  return { archive: { entries, comment: new Uint8Array() }, partial };
+}
+async function adjustZipSfx(bytes, archive, limits, signal, password) {
+  const prefix = archive.prefix?.length ?? 0;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const end = bytes.length - 22 - archive.comment.length;
+  let centralEnd = end, central = end - view.getUint32(end + 12, true);
+  let displacement = central - view.getUint32(end + 16, true);
+  const wide = end >= 20 && view.getUint32(end - 20, true) === 117853008;
+  if (wide) {
+    const declared = Number(view.getBigUint64(end - 12, true));
+    centralEnd = declared;
+    if (declared + 12 > end - 20 || view.getUint32(declared, true) !== 101075792) centralEnd += prefix;
+    displacement = centralEnd - declared;
+    central = Number(view.getBigUint64(centralEnd + 48, true)) + displacement;
+  }
+  if (displacement !== 0 && displacement !== prefix) fail("ZIP inconsistent SFX offsets");
+  for (const entry of archive.entries) for await (const chunk of decodeZipEntry(entry, limits, signal, password)) {
+    void chunk;
+  }
+  const result = new Uint8Array(bytes);
+  const output = new DataView(result.buffer);
+  for (let offset = central; offset < centralEnd; ) {
+    await yieldTurn(signal);
+    const local = view.getUint32(offset + 42, true);
+    if (local === 4294967295) {
+      const extraStart = offset + 46 + view.getUint16(offset + 28, true);
+      const extraEnd = extraStart + view.getUint16(offset + 30, true);
+      for (let extra = extraStart; extra < extraEnd; extra += 4 + view.getUint16(extra + 2, true)) {
+        if (view.getUint16(extra, true) !== 1) continue;
+        const position = extra + 4 + (view.getUint32(offset + 24, true) === 4294967295 ? 8 : 0) + (view.getUint32(offset + 20, true) === 4294967295 ? 8 : 0);
+        const adjusted = view.getBigUint64(position, true) + BigInt(displacement);
+        if (adjusted > BigInt(Number.MAX_SAFE_INTEGER)) fail("ZIP64 unsafe adjusted offset");
+        output.setBigUint64(position, adjusted, true);
+      }
+    } else {
+      if (local + displacement >= 4294967295) fail("ZIP SFX adjusted offset requires ZIP64 promotion");
+      output.setUint32(offset + 42, local + displacement, true);
+    }
+    offset += 46 + view.getUint16(offset + 28, true) + view.getUint16(offset + 30, true) + view.getUint16(offset + 32, true);
+  }
+  if (view.getUint32(end + 16, true) !== 4294967295) {
+    if (central >= 4294967295) fail("ZIP SFX adjusted directory requires ZIP64 promotion");
+    output.setUint32(end + 16, central, true);
+  }
+  if (wide) {
+    output.setBigUint64(centralEnd + 48, BigInt(central), true);
+    output.setBigUint64(end - 12, BigInt(centralEnd), true);
+  }
+  await readZipArchive(result, limits, signal, { prefix: true });
+  return result;
+}
+export {
+  adjustZipSfx,
+  repairZip
+};

package/dist/safe-bash-zip-engine/zip/safety.d.ts

@@ -0,0 +1,54 @@
+import { type ByteSource, type CommandContext, type FileStaging, type FileStat } from "../../safe-bash-contracts/index.js";
+import { type ArchiveLimits } from "../../safe-bash-io-engine/commands/archive/internal.js";
+export declare function hasZipIdentity(stat: FileStat): boolean;
+export declare function sameZipIdentity(first: FileStat, second: FileStat): boolean;
+export declare function unchangedZipSource(before: FileStat, after: FileStat): boolean;
+export declare function safeZipFile(scope: ZipScope, path: string, stat: FileStat, allowHardlinked?: boolean): Promise<boolean>;
+export declare class ZipScope {
+    private readonly original;
+    readonly limits: ArchiveLimits;
+    readonly context: CommandContext;
+    private readonly controller;
+    private readonly pending;
+    private readonly readers;
+    private readonly closedReason;
+    private drain;
+    private inputDrain;
+    private work;
+    private stdinSource;
+    constructor(original: CommandContext, limits: ArchiveLimits);
+    readonly close: () => Promise<void>;
+    closeInputs(): Promise<void>;
+    operation<Value>(action: () => Value | PromiseLike<Value>): Promise<Value>;
+    stat(path: string): Promise<FileStat | undefined>;
+    get stdin(): ByteSource;
+    source(source: ByteSource, controller?: AbortController): ByteSource;
+    input(path: string, fifo?: boolean, expected?: FileStat): ByteSource;
+}
+export interface ZipPublication {
+    readonly output: string;
+    readonly parent: string;
+    readonly parentName: string;
+    readonly existing: FileStat | undefined;
+    readonly parentStat: FileStat;
+    readonly bytes?: Uint8Array;
+    readonly source?: ByteSource;
+    readonly mtimeMs?: number;
+    readonly stagingName?: string;
+    readonly stagingParent?: string;
+    readonly stagingParentStat?: FileStat;
+    readonly validate?: (path: string) => Promise<void>;
+}
+export interface ZipStaging {
+    readonly stagingPrefix?: string;
+    readonly reservedPath?: string;
+    readonly parent: string;
+    readonly parentStat: FileStat;
+    readonly existing?: FileStat | undefined;
+    readonly bytes?: Uint8Array;
+    readonly source?: ByteSource;
+    readonly mtimeMs?: number;
+}
+/** Own a temporary archive through acquisition, writing, consumption and cleanup. */
+export declare function stageZip(scope: ZipScope, prepared: ZipStaging, consume: (staging: FileStaging) => Promise<void>): Promise<void>;
+export declare function publishZip(scope: ZipScope, prepared: ZipPublication): Promise<void>;

package/dist/safe-bash-zip-engine/zip/safety.js

@@ -0,0 +1,19 @@
+import {
+  ZipScope,
+  hasZipIdentity,
+  publishZip,
+  safeZipFile,
+  sameZipIdentity,
+  stageZip,
+  unchangedZipSource
+} from "../../safe-bash/command-chunks/chunk-EK6YNAXT.js";
+import "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+export {
+  ZipScope,
+  hasZipIdentity,
+  publishZip,
+  safeZipFile,
+  sameZipIdentity,
+  stageZip,
+  unchangedZipSource
+};

package/dist/safe-bash-zip-engine/zip/sfx.d.ts

@@ -0,0 +1,4 @@
+import { type ArchiveLimits } from "../../safe-bash-io-engine/commands/archive/internal.js";
+import { type ZipArchive } from "../zip-format.js";
+/** Accept only a complete validated archive following a prefix. Never execute it. */
+export declare function readZipSfx(bytes: Uint8Array, limits: ArchiveLimits, signal: AbortSignal, password?: Uint8Array): Promise<ZipArchive>;

package/dist/safe-bash-zip-engine/zip/sfx.js

@@ -0,0 +1,58 @@
+import {
+  decodeZipEntry,
+  readZipArchive
+} from "../../safe-bash/command-chunks/chunk-364TMWBT.js";
+import "../../safe-bash/command-chunks/chunk-LE5LZNHE.js";
+import "../../safe-bash/command-chunks/chunk-2FGJYFWZ.js";
+import "../../safe-bash/command-chunks/chunk-PII4YEZW.js";
+import "../../safe-bash/command-chunks/chunk-H622NS6Z.js";
+import "../../safe-bash/command-chunks/chunk-SEM36PG5.js";
+import "../../safe-bash/command-chunks/chunk-UXSR5BZH.js";
+import {
+  init_buffer
+} from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip/sfx.ts
+init_buffer();
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { fail } from "../../safe-bash-io-engine/commands/archive/internal.js";
+async function readZipSfx(bytes, limits, signal, password) {
+  signal.throwIfAborted();
+  if (bytes.length > limits.maxArchiveBytes) fail("ZIP archive byte limit exceeded");
+  let archive;
+  try {
+    archive = await readZipArchive(bytes, limits, signal, { prefix: true });
+  } catch {
+    signal.throwIfAborted();
+  }
+  if (!archive) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    for (let offset = 1; offset + 22 <= bytes.length; offset++) {
+      if (offset > limits.maxPatternSteps) fail("ZIP SFX scan work limit exceeded");
+      if (offset % 4096 === 0) await yieldTurn(signal);
+      const signature = view.getUint32(offset, true);
+      if (signature !== 67324752 && signature !== 101010256) continue;
+      let candidate;
+      try {
+        candidate = await readZipArchive(bytes.subarray(offset), limits, signal);
+      } catch {
+        signal.throwIfAborted();
+        continue;
+      }
+      archive = candidate;
+      break;
+    }
+  }
+  if (!archive) fail("ZIP SFX prefix does not contain a validated archive");
+  let decoded = 0;
+  for (const entry of archive.entries) {
+    for await (const chunk of decodeZipEntry(entry, limits, signal, password)) {
+      if (chunk.length > limits.maxTotalBytes - decoded) fail("ZIP SFX decoded byte limit exceeded");
+      decoded += chunk.length;
+    }
+  }
+  return archive;
+}
+export {
+  readZipSfx
+};

package/dist/safe-bash-zip-engine/zip/test-command.d.ts

@@ -0,0 +1,5 @@
+import { Budget } from "../../safe-bash-io-engine/commands/archive/internal.js";
+import type { ZipScope } from "./safety.js";
+/** A literal argv grammar: spaces, quotes and backslash escapes, with no shell. */
+export declare function parseZipTestCommand(value: string): readonly string[];
+export declare function testZipCommand(scope: ZipScope, command: readonly string[] | undefined, path: string, budget: Budget, archive: string, quiet: boolean, password?: Uint8Array): Promise<void>;

package/dist/safe-bash-zip-engine/zip/test-command.js

@@ -0,0 +1,98 @@
+import {
+  ZipFailure,
+  zipPublicText
+} from "../../safe-bash/command-chunks/chunk-Q3EWDEUQ.js";
+import {
+  init_buffer
+} from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip/test-command.ts
+init_buffer();
+import { createCommandArguments, toByteSource } from "../../safe-bash-contracts/index.js";
+import { shellValueFromBytes } from "../../safe-bash-contracts/value.js";
+import { byteLength } from "../../safe-bash-io-engine/byte-encoding.js";
+import { fail } from "../../safe-bash-io-engine/commands/archive/internal.js";
+function parseZipTestCommand(value) {
+  const words = [];
+  let word = "";
+  let quote = "";
+  let active = false;
+  for (let index = 0; index < value.length; index++) {
+    const character = value[index];
+    if ("\n\r\0;|&<>$`".includes(character)) throw new ZipFailure(16, "Invalid command arguments", "unsupported virtual test-command syntax");
+    if (character === "\\" && quote !== "'") {
+      const next = value[++index];
+      if (next === void 0 || "\n\r\0;|&<>$`".includes(next)) throw new ZipFailure(16, "Invalid command arguments", "invalid test-command escape");
+      word += next;
+      active = true;
+    } else if (quote) {
+      if (character === quote) quote = "";
+      else word += character;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+      active = true;
+    } else if (character === " " || character === "	") {
+      if (active) {
+        words.push(word);
+        word = "";
+        active = false;
+      }
+    } else {
+      word += character;
+      active = true;
+    }
+  }
+  if (quote) throw new ZipFailure(16, "Invalid command arguments", "unterminated test-command quote");
+  if (active) words.push(word);
+  if (!words[0] || words[0].includes("{}")) throw new ZipFailure(16, "Invalid command arguments", "invalid virtual test command");
+  return words;
+}
+async function testZipCommand(scope, command, path, budget, archive, quiet, password) {
+  const { context, limits } = scope;
+  let outputBytes = 0;
+  const sink = { async write(chunk) {
+    context.signal.throwIfAborted();
+    if (chunk.length > limits.maxTextBytes - outputBytes) fail("ZIP test-command output limit exceeded");
+    outputBytes += chunk.length;
+  } };
+  try {
+    if (!context.invoke) fail("virtual command invocation unavailable");
+    const virtualCommand = command ?? ["unzip", "-tqq"];
+    const placeholders = virtualCommand.slice(1).some((word) => word.includes("{}"));
+    let argumentBytes = command === void 0 && password !== void 0 ? password.length + 4 : 0;
+    for (const word of virtualCommand.slice(1)) {
+      let placeholders2 = 0;
+      for (let index = 0; index + 1 < word.length; index++) if (word[index] === "{" && word[index + 1] === "}") {
+        placeholders2++;
+        index++;
+      }
+      const size = byteLength(word) + placeholders2 * (byteLength(path) - 2) + 1;
+      if (size > limits.maxArgumentBytes - argumentBytes) fail("ZIP test-command argument byte limit exceeded");
+      argumentBytes += size;
+    }
+    if (!placeholders && byteLength(path) + 1 > limits.maxArgumentBytes - argumentBytes) fail("ZIP test-command argument byte limit exceeded");
+    const args = virtualCommand.slice(1).map((word) => word.split("{}").join(path));
+    if (!placeholders) args.push(path);
+    const values = createCommandArguments(command === void 0 && password !== void 0 ? ["-P", shellValueFromBytes(password), ...args] : args);
+    const result = await scope.operation(() => context.invoke(virtualCommand[0], values.args, {
+      argumentValues: values,
+      signal: context.signal,
+      stdin: toByteSource(""),
+      stdinIsDefault: true,
+      stdout: sink,
+      stderr: sink
+    }));
+    if (result.exitCode !== 0) fail("ZIP virtual test command failed");
+  } catch {
+    context.signal.throwIfAborted();
+    if (!quiet) await budget.output(`test of ${zipPublicText(archive)} FAILED
+`);
+    throw new ZipFailure(8, "Zip file invalid, could not spawn unzip, or wrong unzip", "virtual test command failed; original files unmodified");
+  }
+  if (!quiet) await budget.output(`test of ${zipPublicText(archive)} OK
+`);
+}
+export {
+  parseZipTestCommand,
+  testZipCommand
+};

package/dist/safe-bash-zip-engine/zip/volumes.d.ts

@@ -0,0 +1,21 @@
+import { type FileStat } from "../../safe-bash-contracts/index.js";
+import { type ArchiveLimits, type ZipHost } from "../../safe-bash-io-engine/commands/archive/internal.js";
+import { type ZipPublication, type ZipScope } from "./safety.js";
+import { type ZipDisks } from "./zip64.js";
+export declare function splitSize(value: string): number;
+export declare function volumeName(archive: string, disk: number, disks: number): string;
+export declare function zipEndOffset(bytes: Uint8Array): number;
+/** Input disks are supplied by the host, then read solely through the invocation VFS. */
+export declare function resolveZipVolumes(scope: Pick<ZipScope, "context" | "limits" | "operation" | "stat" | "input">, archive: string, final: Uint8Array, host?: ZipHost): Promise<{
+    bytes: Uint8Array;
+    disks?: ZipDisks;
+    paths: readonly string[];
+    volumes?: readonly {
+        path: string;
+        stat: FileStat;
+    }[];
+}>;
+/** Partition a validated single-disk encoding, preserving record boundaries and ciphertext. */
+export declare function splitZipVolumes(input: Uint8Array, size: number, limits: ArchiveLimits, signal: AbortSignal): Promise<Uint8Array[]>;
+/** All destinations preflight; all volumes staged before the first per-volume publication. */
+export declare function publishZipVolumes(scope: ZipScope, publication: ZipPublication, parts: readonly Uint8Array[], inputPaths: readonly string[], before: (path: string, disk: number) => Promise<void>): Promise<void>;