@poe-platform/safe-bash 0.1.799 → 0.1.800

package/dist/safe-bash/command-chunks/chunk-EK6YNAXT.js

@@ -0,0 +1,343 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip/safety.ts
+init_buffer();
+import { retainFileSystemCleanup } from "@poe-platform/safe-fs/core";
+import { readBytes } from "../../safe-bash-contracts/index.js";
+import { writeFileOutput } from "../../safe-bash-contracts/filesystem-output.js";
+import { checkPath, fail, hasIdentity as hasPosixIdentity, sameIdentity as samePosixIdentity } from "../../safe-bash-io-engine/commands/archive/internal.js";
+function hasZipIdentity(stat) {
+  return hasPosixIdentity(stat) || (typeof stat.identityScope === "object" && stat.identityScope !== null || typeof stat.identityScope === "symbol") && typeof stat.opaqueIdentity === "string" && stat.opaqueIdentity.length > 0 && stat.opaqueIdentity.length <= 4096 && hasZipVersion(stat);
+}
+function hasZipVersion(stat) {
+  return typeof stat.opaqueVersion === "string" && stat.opaqueVersion.length > 0 && stat.opaqueVersion.length <= 4096;
+}
+function sameZipIdentity(first, second) {
+  return samePosixIdentity(first, second) || hasZipIdentity(first) && hasZipIdentity(second) && first.opaqueIdentity !== void 0 && first.identityScope === second.identityScope && first.opaqueIdentity === second.opaqueIdentity;
+}
+function unchangedZipSource(before, after) {
+  return before.type === after.type && before.size === after.size && before.mode === after.mode && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.nlink === after.nlink && before.opaqueVersion === after.opaqueVersion && before.revision === after.revision && (!hasZipIdentity(before) || sameZipIdentity(before, after));
+}
+async function safeZipFile(scope, path, stat, allowHardlinked = false) {
+  if (stat.type !== "file" || !hasZipIdentity(stat)) return false;
+  if (stat.nlink !== void 0) {
+    if (stat.nlink === 1) return true;
+    if (!allowHardlinked || stat.nlink < 1 || !hasPosixIdentity(stat)) return false;
+    const capabilities2 = await scope.operation(() => scope.context.fs.capabilitiesFor?.(path, { signal: scope.context.signal }) ?? scope.context.fs.capabilities);
+    return capabilities2.hardlinks === true && capabilities2.atomicFileMutation === true && typeof scope.context.fs.writeFileConditional === "function";
+  }
+  const capabilities = await scope.operation(() => scope.context.fs.capabilitiesFor?.(path, { signal: scope.context.signal }) ?? scope.context.fs.capabilities);
+  return stat.opaqueIdentity !== void 0 && capabilities.hardlinks === false;
+}
+var ZipScope = class {
+  constructor(original, limits) {
+    this.original = original;
+    this.limits = limits;
+    this.context = { ...original, signal: AbortSignal.any([original.signal, this.controller.signal]) };
+    original.registerCleanup?.(this.close);
+  }
+  original;
+  limits;
+  context;
+  controller = new AbortController();
+  pending = /* @__PURE__ */ new Set();
+  readers = /* @__PURE__ */ new Set();
+  closedReason = new Error("ZIP command is closed");
+  drain;
+  inputDrain;
+  work = 0;
+  stdinSource;
+  close = () => {
+    if (!this.drain) {
+      this.drain = Promise.resolve().then(async () => {
+        while (this.pending.size) await Promise.allSettled([...this.pending]);
+        await this.closeInputs();
+      });
+      this.controller.abort(this.original.signal.aborted ? this.original.signal.reason : this.closedReason);
+    }
+    return this.drain;
+  };
+  closeInputs() {
+    return this.inputDrain ??= Promise.allSettled([...this.readers].map((close) => close())).then((results) => {
+      const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+      if (failures.length === 1) throw failures[0];
+      if (failures.length) throw new AggregateError(failures, "ZIP reader cleanup failed");
+    });
+  }
+  async operation(action) {
+    this.context.signal.throwIfAborted();
+    if (++this.work > this.limits.maxPatternSteps) fail("filesystem work limit exceeded");
+    const pending = Promise.resolve().then(() => {
+      this.context.signal.throwIfAborted();
+      return action();
+    });
+    this.pending.add(pending);
+    try {
+      const value = await pending;
+      this.context.signal.throwIfAborted();
+      return value;
+    } finally {
+      this.pending.delete(pending);
+    }
+  }
+  async stat(path) {
+    try {
+      return await this.operation(() => this.context.fs.lstat(path, { signal: this.context.signal }));
+    } catch (error) {
+      this.context.signal.throwIfAborted();
+      if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  get stdin() {
+    return this.stdinSource ??= this.source(this.original.stdin);
+  }
+  source(source, controller) {
+    if (this.inputDrain) fail("ZIP inputs are closed");
+    const iterator = source[Symbol.asyncIterator]();
+    let closing;
+    const close = () => closing ??= (async () => {
+      controller?.abort(this.closedReason);
+      try {
+        await iterator.return?.();
+      } finally {
+        this.readers.delete(close);
+      }
+    })();
+    this.readers.add(close);
+    return { [Symbol.asyncIterator]: () => ({
+      next: () => this.operation(async () => {
+        const result = await iterator.next();
+        if (result.done) this.readers.delete(close);
+        return result;
+      }),
+      async return() {
+        await close();
+        return { done: true, value: void 0 };
+      }
+    }) };
+  }
+  async *input(path, fifo = false, expected) {
+    const { fs } = this.context;
+    if (expected) {
+      if (!hasZipIdentity(expected)) fail("ZIP source requires known backing identity");
+      const controller2 = new AbortController();
+      const signal2 = AbortSignal.any([this.context.signal, controller2.signal]);
+      let handle;
+      let acquisition;
+      let reading;
+      let closing;
+      const close = () => closing ??= (async () => {
+        controller2.abort(this.closedReason);
+        try {
+          await acquisition?.catch(() => {
+          });
+          await reading?.catch(() => {
+          });
+          await handle?.close();
+        } finally {
+          this.readers.delete(close);
+        }
+      })();
+      if (this.inputDrain) fail("ZIP inputs are closed");
+      this.readers.add(close);
+      try {
+        await (acquisition = this.operation(async () => {
+          const capabilities2 = await (fs.capabilitiesFor?.(path, { signal: signal2 }) ?? fs.capabilities);
+          signal2.throwIfAborted();
+          if (capabilities2.retainedRead !== true || !fs.openReadFile) fail("ZIP source requires retained reads");
+          handle = await fs.openReadFile(path, { signal: signal2 });
+        }));
+        if (this.inputDrain) fail("ZIP inputs are closed");
+        const stat = await (reading = this.operation(() => handle.stat({ signal: signal2 })));
+        if (!unchangedZipSource(expected, stat)) fail(`source changed while opening: ${path}`);
+        let position = 0;
+        while (position < expected.size) {
+          const size = Math.min(this.limits.chunkSize, expected.size - position);
+          signal2.throwIfAborted();
+          const bytes = await (reading = this.operation(() => handle.read(position, size, { signal: signal2 })));
+          signal2.throwIfAborted();
+          if (!bytes.length || bytes.length > size) fail(`source changed while reading: ${path}`);
+          position += bytes.length;
+          yield bytes;
+        }
+        signal2.throwIfAborted();
+        const current = await (reading = this.operation(() => handle.stat({ signal: signal2 })));
+        if (!unchangedZipSource(expected, current)) fail(`source changed while reading: ${path}`);
+      } finally {
+        await close();
+      }
+      return;
+    }
+    const controller = new AbortController();
+    const signal = AbortSignal.any([this.context.signal, controller.signal]);
+    const capabilities = await this.operation(() => fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities);
+    if (fifo && (!fs.readStream || capabilities.streamingRead !== true)) fail("filesystem lacks explicit FIFO byte stream capability");
+    if (fs.readStream && capabilities.streamingRead !== false) {
+      const source = await this.operation(() => this.source(fs.readStream(path, { signal, chunkSize: this.limits.chunkSize }), controller));
+      yield* readBytes(source, signal);
+    } else {
+      const stat = await this.operation(() => fs.stat(path, { signal }));
+      if (stat.size > this.limits.maxBufferedFileBytes) fail("filesystem lacks streaming reads: buffered file limit exceeded");
+      const bytes = await this.operation(() => fs.readFile(path, { signal, ...Number.isFinite(this.limits.maxBufferedFileBytes) ? { maxBytes: this.limits.maxBufferedFileBytes } : {} }));
+      if (bytes.length > this.limits.maxBufferedFileBytes) fail("buffered file limit exceeded");
+      yield bytes;
+    }
+  }
+};
+async function stageZip(scope, prepared, consume) {
+  const { fs, signal } = scope.context;
+  const capabilities = await scope.operation(() => fs.capabilitiesFor?.(prepared.parent, { signal }) ?? fs.capabilities);
+  if (capabilities.atomicFileStaging !== true && capabilities.trustedOwnedStaging !== true || !fs.createStagedFile || !fs.removeStagedFile) fail("ZIP temporary path requires atomic owned file staging");
+  if (prepared.source && (capabilities.atomicFileMutation !== true && capabilities.trustedOwnedStaging !== true || !fs.writeFileConditional)) fail("ZIP temporary path requires atomic conditional writes");
+  let staging;
+  let failure;
+  const close = retainFileSystemCleanup(fs, async (cleanup) => {
+    if (staging) {
+      if (!cleanup.removeStagedFile) fail("ZIP atomic cleanup unavailable");
+      await cleanup.removeStagedFile(staging);
+    }
+  }, { maxOperations: 16 });
+  try {
+    for (let attempt = 0; attempt < scope.limits.maxMembers; attempt++) {
+      const path = `${prepared.parent === "/" ? "" : prepared.parent}/.${prepared.stagingPrefix ?? "zip"}-${attempt + 1}`;
+      checkPath(path, scope.limits);
+      checkPath(`${path}/archive.zip`, scope.limits);
+      if (path === prepared.reservedPath) continue;
+      try {
+        await scope.operation(async () => {
+          staging = await fs.createStagedFile(path, "archive.zip", { type: "file", data: prepared.bytes ?? new Uint8Array() }, {
+            signal,
+            parent: prepared.parentStat,
+            ...prepared.existing ? { mode: prepared.existing.mode & 4095 } : {},
+            ...prepared.mtimeMs === void 0 ? {} : { mtimeMs: prepared.mtimeMs, atimeMs: prepared.mtimeMs }
+          });
+        });
+        break;
+      } catch (error) {
+        signal.throwIfAborted();
+        if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "EEXIST") throw error;
+      }
+    }
+    if (!staging) fail("ZIP temporary directory attempt limit exceeded");
+    if (prepared.source) {
+      for await (const chunk of readBytes(prepared.source, signal)) {
+        try {
+          await writeFileOutput(scope.context, chunk, (bytes) => scope.operation(async () => {
+            const stat = await fs.writeFileConditional(staging.file.path, bytes, {
+              signal,
+              parent: staging.directory.stat,
+              expected: staging.file.stat,
+              append: true
+            });
+            staging = { ...staging, file: { path: staging.file.path, stat } };
+          }));
+        } catch (error) {
+          void scope.closeInputs().catch(() => {
+          });
+          throw error;
+        }
+      }
+    }
+    if (prepared.mtimeMs !== void 0 && (staging.file.stat.mtimeMs !== prepared.mtimeMs || staging.file.stat.atimeMs !== prepared.mtimeMs)) fail("ZIP staging did not retain archive modification time");
+    await consume(staging);
+  } catch (error) {
+    failure = { reason: error };
+  }
+  try {
+    await close();
+  } catch (error) {
+    if (failure) throw new AggregateError([failure.reason, error], "ZIP publication and cleanup failed");
+    throw error;
+  }
+  if (failure) throw failure.reason;
+}
+async function publishZip(scope, prepared) {
+  const { fs, signal } = scope.context;
+  const capabilities = await scope.operation(() => fs.capabilitiesFor?.(prepared.output, { signal, create: true }) ?? fs.capabilities);
+  if (capabilities.atomicFilePublication === true && fs.publishFileConditional && !prepared.validate && prepared.stagingName === void 0) {
+    if (capabilities.readOnly === true || capabilities.write === false) fail("ZIP destination is not writable");
+    if (prepared.existing && (!hasZipIdentity(prepared.existing) || !hasZipVersion(prepared.existing))) fail("ZIP conditional publication requires an observed opaque version");
+    const parent = await scope.operation(() => fs.realpath(prepared.parentName, { signal }));
+    if (parent !== prepared.parent) fail("archive parent changed before publication");
+    let size = 0;
+    let completed = false;
+    let active = true;
+    const input = prepared.source ?? { async *[Symbol.asyncIterator]() {
+      yield prepared.bytes ?? new Uint8Array();
+    } };
+    const source = scope.source((async function* () {
+      for await (const chunk of readBytes(input, signal)) {
+        if (!active) fail("ZIP publication source is closed");
+        if (chunk.length > scope.limits.maxArchiveBytes - size) fail("archive byte limit exceeded");
+        size += chunk.length;
+        let owned = chunk;
+        if (prepared.source) await writeFileOutput(scope.context, chunk, async (bytes) => {
+          owned = Uint8Array.from(bytes);
+        });
+        yield owned;
+      }
+      completed = true;
+    })());
+    try {
+      const receipt = await scope.operation(() => fs.publishFileConditional(prepared.output, source, {
+        signal,
+        parent: prepared.parentStat,
+        expected: prepared.existing ?? null,
+        maxBytes: Number.isFinite(scope.limits.maxArchiveBytes) ? scope.limits.maxArchiveBytes : Number.MAX_SAFE_INTEGER,
+        ...prepared.existing && capabilities.permissions !== false ? { mode: prepared.existing.mode & 4095 } : {},
+        ...prepared.mtimeMs === void 0 ? {} : { mtimeMs: prepared.mtimeMs }
+      }));
+      if (!completed || receipt.type !== "file" || receipt.size !== size || !hasZipIdentity(receipt) || !hasZipVersion(receipt) || prepared.existing?.opaqueVersion === receipt.opaqueVersion) fail("Invalid ZIP conditional publication acknowledgement");
+    } finally {
+      active = false;
+      await scope.closeInputs();
+    }
+    return;
+  }
+  if (capabilities.atomicFileStaging !== true && capabilities.trustedOwnedStaging !== true || !fs.publishStagedFile) fail("ZIP publication requires atomic owned file staging");
+  await stageZip(scope, {
+    ...prepared,
+    reservedPath: prepared.output,
+    parent: prepared.stagingParent ?? prepared.parent,
+    parentStat: prepared.stagingParentStat ?? prepared.parentStat
+  }, async (staging) => {
+    if (prepared.validate) await prepared.validate(staging.file.path);
+    if (prepared.stagingName !== void 0) {
+      const current = await scope.operation(() => fs.realpath(prepared.stagingName, { signal }));
+      if (current !== prepared.stagingParent) fail("ZIP temporary path changed before publication");
+    }
+    const parent = await scope.operation(() => fs.realpath(prepared.parentName, { signal }));
+    if (parent !== prepared.parent) fail("archive parent changed before publication");
+    if (prepared.existing && (prepared.existing.nlink ?? 1) > 1) {
+      if (capabilities.atomicFileMutation !== true || !fs.writeFileConditional) fail("ZIP hardlinked archive update requires conditional in-place file mutation");
+      const stagedBytes = await scope.operation(() => fs.readFile(staging.file.path, { signal, ...Number.isFinite(scope.limits.maxArchiveBytes) ? { maxBytes: scope.limits.maxArchiveBytes } : {} }));
+      const receipt = await scope.operation(() => fs.writeFileConditional(prepared.output, stagedBytes, {
+        signal,
+        parent: prepared.parentStat,
+        expected: prepared.existing,
+        ...capabilities.permissions !== false ? { mode: prepared.existing.mode & 4095 } : {},
+        ...prepared.mtimeMs === void 0 ? {} : { mtimeMs: prepared.mtimeMs, atimeMs: prepared.mtimeMs }
+      }));
+      if (prepared.mtimeMs !== void 0 && (receipt.mtimeMs !== prepared.mtimeMs || receipt.atimeMs !== prepared.mtimeMs)) fail("ZIP publication did not retain archive modification time");
+      return;
+    }
+    await scope.operation(() => fs.publishStagedFile(staging, prepared.output, {
+      signal,
+      parent: prepared.parentStat,
+      destination: prepared.existing ?? null
+    }));
+  });
+}
+
+export {
+  hasZipIdentity,
+  sameZipIdentity,
+  unchangedZipSource,
+  safeZipFile,
+  ZipScope,
+  stageZip,
+  publishZip
+};

package/dist/safe-bash/command-chunks/chunk-EQ4HV54N.js

@@ -0,0 +1,22 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-awk/src/awk-quote.ts
+init_buffer();
+import { ProgramError } from "../../safe-bash-io-engine/commands/text-programs/shared.js";
+function quoteAwk(value, budget) {
+  let output = '"';
+  for (const character of value) {
+    budget.step();
+    const code = character.charCodeAt(0);
+    const escaped = character === '"' || character === "\\" ? `\\${character}` : character === "\n" ? "\\n" : character === "	" ? "\\t" : character === "\r" ? "\\r" : code < 32 || code === 127 ? `\\${code.toString(8).padStart(3, "0")}` : character;
+    if (output.length + escaped.length + 1 > budget.maxBufferBytes) throw new ProgramError("text buffer limit exceeded");
+    output += escaped;
+  }
+  return budget.check(output + '"');
+}
+
+export {
+  quoteAwk
+};

package/dist/safe-bash/command-chunks/chunk-ERYJLO6G.js

@@ -0,0 +1,293 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-wget/src/wget.ts
+init_buffer();
+import { createTransferCommand } from "../../safe-bash-command-curl/curl.js";
+import { getCommandArguments } from "../../safe-bash-contracts/index.js";
+import { shellValueByteLength, shellValueBytes } from "../../safe-bash-contracts/value.js";
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { pathOf } from "../../safe-bash-io-engine/internal.js";
+import { validateRequestHeader } from "../../safe-bash-network-engine/args.js";
+import { validateHeaderName } from "../../safe-bash-network-engine/platform-portable.js";
+import { collectNetworkBytes as collectBytes } from "../../safe-bash-network-engine/shared.js";
+import { CurlError } from "../../safe-bash-network-engine/types.js";
+async function parseWget(context, limits) {
+  const carrier = getCommandArguments(context);
+  let argumentBytes = 0;
+  for (const value of carrier.values) {
+    if (typeof value === "string" && value.length > limits.maxBufferBytes) throw new CurlError(2, "Arguments exceed host buffer limit");
+    argumentBytes += shellValueByteLength(value);
+    if (argumentBytes > limits.maxBufferBytes) throw new CurlError(2, "Arguments exceed host buffer limit");
+    if (typeof value === "string") {
+      for (let index = 0; index < value.length; index++) {
+        if (index % 1024 === 0) await yieldTurn(context.signal);
+        const code = value.charCodeAt(index);
+        if (code >= 55296 && code <= 56319) {
+          const next = value.charCodeAt(++index);
+          if (!(next >= 56320 && next <= 57343)) throw new CurlError(2, "Arguments must be valid UTF-8");
+        } else if (code >= 56320 && code <= 57343) throw new CurlError(2, "Arguments must be valid UTF-8");
+      }
+      continue;
+    }
+    const bytes = shellValueBytes(value);
+    const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    for (let offset = 0; offset < bytes.length; offset += 1024) {
+      await yieldTurn(context.signal);
+      try {
+        decoder.decode(bytes.subarray(offset, offset + 1024), { stream: offset + 1024 < bytes.length });
+      } catch (error) {
+        context.signal.throwIfAborted();
+        if (!(error instanceof TypeError) || "code" in error && error.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
+        throw new CurlError(2, "Arguments must be valid UTF-8");
+      }
+    }
+  }
+  const result = {
+    urls: [],
+    data: [],
+    headers: [],
+    include: false,
+    head: false,
+    get: false,
+    location: true,
+    remoteName: true,
+    fail: true,
+    failWithBody: false,
+    silent: false,
+    showError: false,
+    verbose: false,
+    globoff: true,
+    help: false,
+    version: false,
+    retries: limits.maxRetries,
+    retryDelayMs: 0,
+    maxTimeMs: limits.maxTimeMs,
+    maxRedirects: limits.maxRedirects,
+    maxFileSize: limits.maxDownloadBytes,
+    agent: "virtual-bash-wget/0.0",
+    retryTransport: true,
+    directoryIndex: "index.html",
+    download: { spider: false, resume: false, noClobber: false, contentDisposition: false }
+  };
+  const number = (value, integral) => {
+    let start = 0;
+    let end = value.length;
+    if (!integral) {
+      while (start < end && " 	\n\r\v\f".includes(value[start])) start++;
+      while (end > start && " 	\n\r\v\f".includes(value[end - 1])) end--;
+    }
+    let multiplier = 1;
+    if (!integral) {
+      const units = { s: 1, m: 60, h: 3600, d: 86400 };
+      const unit = units[value[end - 1]];
+      if (unit !== void 0) {
+        multiplier = unit;
+        end--;
+      }
+    }
+    let position = start;
+    if (!integral && (value[position] === "+" || value[position] === "-")) position++;
+    let digits = 0;
+    let dot = false;
+    for (; position < end; position++) {
+      const character = value[position];
+      if (character >= "0" && character <= "9") digits++;
+      else if (!integral && character === "." && !dot) dot = true;
+      else throw new CurlError(2, "Invalid numeric option");
+    }
+    if (!digits) throw new CurlError(2, "Invalid numeric option");
+    const parsed = Number(value.slice(start, end)) * multiplier;
+    if (!Number.isFinite(parsed) || parsed < 0 || parsed > Number.MAX_SAFE_INTEGER) throw new CurlError(2, "Invalid numeric option");
+    return parsed;
+  };
+  const bodies = {};
+  const headers = /* @__PURE__ */ new Map();
+  let agent;
+  let referer;
+  let ended = false;
+  let inputFile;
+  for (let index = 0; index < context.args.length; index++) {
+    if (index % 128 === 0) await yieldTurn(context.signal);
+    const argument = context.args[index];
+    if (ended || !argument.startsWith("-") || argument === "-") {
+      result.urls.push(argument);
+      continue;
+    }
+    if (argument === "--") {
+      ended = true;
+      continue;
+    }
+    if (!argument.startsWith("--")) {
+      for (let position = 1; position < argument.length; position++) {
+        if (position % 1024 === 0) await yieldTurn(context.signal);
+        const flag2 = argument[position];
+        if (flag2 === "q") result.silent = true;
+        else if (flag2 === "c") result.download.resume = true;
+        else if (flag2 === "n" && argument[position + 1] === "c") {
+          result.download.noClobber = true;
+          position++;
+        } else if (flag2 === "n" && argument[position + 1] === "v") position++;
+        else if (flag2 === "h") result.help = true;
+        else if (flag2 === "r") throw new CurlError(2, "Recursive mirroring is unsupported");
+        else if (["O", "P", "i", "T", "t"].includes(flag2)) {
+          const output = position + 1 < argument.length ? argument.slice(position + 1) : context.args[++index];
+          if (!output) throw new CurlError(2, `-${flag2} requires a nonempty argument`);
+          if (flag2 === "O") {
+            result.output = output;
+            result.remoteName = false;
+          } else if (flag2 === "P") result.outputDirectory = output;
+          else if (flag2 === "i") inputFile = output;
+          else if (flag2 === "T") {
+            const seconds = number(output, false);
+            result.maxTimeMs = Math.min(seconds === 0 ? Infinity : seconds * 1e3, limits.maxTimeMs);
+          } else {
+            const tries = number(output, true);
+            result.retries = tries === 0 ? limits.maxRetries : Math.min(tries - 1, limits.maxRetries);
+          }
+          break;
+        } else throw new CurlError(2, `Unsupported option: -${flag2}`);
+      }
+      continue;
+    }
+    if (argument === "--quiet") {
+      result.silent = true;
+      continue;
+    }
+    if (argument === "--no-verbose") continue;
+    if (argument === "--help") {
+      result.help = true;
+      continue;
+    }
+    if (argument === "--version") {
+      result.version = true;
+      continue;
+    }
+    if (argument === "--spider") {
+      result.download.spider = true;
+      continue;
+    }
+    if (argument === "--continue") {
+      result.download.resume = true;
+      continue;
+    }
+    if (argument === "--no-clobber") {
+      result.download.noClobber = true;
+      continue;
+    }
+    if (argument === "--content-disposition") {
+      result.download.contentDisposition = true;
+      continue;
+    }
+    if (argument === "--recursive") throw new CurlError(2, "Recursive mirroring is unsupported");
+    const equal = argument.indexOf("=");
+    const flag = equal < 0 ? argument : argument.slice(0, equal);
+    let operand;
+    if (["--directory-prefix", "--input-file", "--output-document", "--timeout", "--tries", "--method", "--post-data", "--post-file", "--body-data", "--body-file", "--header", "--user-agent", "--referer"].includes(flag)) {
+      operand = equal < 0 ? context.args[++index] : argument.slice(equal + 1);
+    } else throw new CurlError(2, `Unsupported option: ${argument}`);
+    if (operand === void 0) throw new CurlError(2, `${flag} requires an argument`);
+    if (flag === "--output-document") {
+      if (!operand) throw new CurlError(2, "Output filename must not be empty");
+      result.output = operand;
+      result.remoteName = false;
+    } else if (flag === "--directory-prefix") result.outputDirectory = operand;
+    else if (flag === "--input-file") inputFile = operand;
+    else if (flag === "--timeout") {
+      const seconds = number(operand, false);
+      result.maxTimeMs = Math.min(seconds === 0 ? Infinity : seconds * 1e3, limits.maxTimeMs);
+    } else if (flag === "--tries") {
+      const tries = number(operand, true);
+      result.retries = tries === 0 ? limits.maxRetries : Math.min(tries - 1, limits.maxRetries);
+    } else if (flag === "--header") {
+      if (operand === "") {
+        headers.clear();
+        continue;
+      }
+      const colon = operand.indexOf(":");
+      if (colon < 1) throw new CurlError(2, "Invalid HTTP header");
+      const name = operand.slice(0, colon);
+      const value = operand.slice(colon + 1).trim();
+      validateRequestHeader(name, value);
+      headers.set(name.toLowerCase(), [name, value]);
+    } else if (flag === "--user-agent") {
+      validateRequestHeader("User-Agent", operand);
+      agent = operand;
+    } else if (flag === "--referer") {
+      validateRequestHeader("Referer", operand);
+      referer = operand;
+    } else if (flag === "--method") {
+      try {
+        validateHeaderName(operand);
+      } catch {
+        throw new CurlError(2, "Invalid or unsupported HTTP method");
+      }
+      result.method = operand.toUpperCase();
+      if (["CONNECT", "TRACE"].includes(result.method)) throw new CurlError(2, "Invalid or unsupported HTTP method");
+    } else {
+      const bodyFlag = flag;
+      if (bodyFlag.endsWith("-file") && !operand) throw new CurlError(2, "Upload filename must not be empty");
+      bodies[bodyFlag] = operand;
+    }
+  }
+  if (agent !== void 0 && !headers.has("user-agent")) result.headers.push(["User-Agent", agent === "" ? null : agent]);
+  if (referer !== void 0 && !headers.has("referer")) result.headers.push(["Referer", referer]);
+  result.headers.push(...headers.values());
+  const post = bodies["--post-data"] !== void 0 || bodies["--post-file"] !== void 0;
+  const customBody = bodies["--body-data"] !== void 0 || bodies["--body-file"] !== void 0;
+  if (post && result.method !== void 0 || customBody && result.method === void 0 || bodies["--post-data"] !== void 0 && bodies["--post-file"] !== void 0 || bodies["--body-data"] !== void 0 && bodies["--body-file"] !== void 0) {
+    throw new CurlError(2, "Incompatible request body options: use --post-data or --post-file, or --method with --body-data or --body-file");
+  }
+  const data = bodies["--post-data"] ?? bodies["--body-data"];
+  const file = bodies["--post-file"] ?? bodies["--body-file"];
+  if (data !== void 0) result.data.push({ kind: "raw", value: data });
+  else if (file !== void 0) result.data.push({ kind: "binary", value: `@${file === "-" ? "./-" : file}` });
+  if (!result.help && !result.version) {
+    if (inputFile !== void 0) {
+      let bytes;
+      try {
+        bytes = inputFile === "-" ? await collectBytes(context.stdin, { signal: context.signal, maxBytes: limits.maxBufferBytes }) : await context.fs.readFile(pathOf(context, inputFile), { signal: context.signal, ...Number.isFinite(limits.maxBufferBytes) ? { maxBytes: limits.maxBufferBytes } : {} });
+      } catch {
+        context.signal.throwIfAborted();
+        throw new CurlError(26, "Failed reading virtual URL input file");
+      }
+      let text;
+      try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch {
+        throw new CurlError(2, "URL input must be valid UTF-8");
+      }
+      let start = 0;
+      let lines = 0;
+      for (let index = 0; index <= text.length; index++) {
+        if (index % 1024 === 0) await yieldTurn(context.signal);
+        if (index !== text.length && text[index] !== "\n") continue;
+        if (index === text.length && start === index) break;
+        if (++lines > 4096) throw new CurlError(2, "URL input exceeds 4096-line limit");
+        const url = text.slice(start, index).trim();
+        start = index + 1;
+        if (url) result.urls.push(url);
+        if (result.urls.length > limits.maxUrls) throw new CurlError(2, "URL count exceeds host limit");
+      }
+    }
+    if (!result.urls.length) throw new CurlError(2, "An HTTP(S) URL is required");
+    if (result.urls.length > limits.maxUrls) throw new CurlError(2, "URL count exceeds host limit");
+    if (result.download.resume && result.download.noClobber) throw new CurlError(2, "Continue and no-clobber are incompatible");
+    if (result.output === "-" && (result.download.resume || result.download.noClobber)) throw new CurlError(2, "Download controls require a file output");
+  }
+  return result;
+}
+function createWgetCommand(options = {}) {
+  return createTransferCommand(options, {
+    name: "wget",
+    parse: parseWget,
+    help: "Usage: wget [-O FILE|-] [-q|-nv] [-T SECONDS] [-t COUNT] [URL ...]\nDownloads: --spider | -c/--continue | -nc/--no-clobber | -P/--directory-prefix DIR | --content-disposition\nInput: -i/--input-file FILE (VFS URL list; '-' reads stdin)\nRequest headers: --header 'NAME: VALUE' | --user-agent AGENT | --referer URL\nRequest bodies: --post-data DATA | --post-file FILE | --method METHOD [--body-data DATA | --body-file FILE]\nBody files are read from the VFS. Downloads require explicit host authorization. Recursive mirroring is unsupported.\nTimeout (--timeout) is aggregate and host-capped; --tries=0 remains host-capped.\n",
+    version: "virtual-bash wget 0.0 (bounded HTTP HTTPS)\n",
+    status: (code) => code === 0 ? 0 : [1, 2, 3].includes(code) ? 2 : [23, 26].includes(code) ? 3 : code === 60 ? 5 : code === 22 ? 8 : 4
+  });
+}
+
+export {
+  createWgetCommand
+};

package/dist/safe-bash/command-chunks/{chunk-4ONEXMD3.js → chunk-EUSPTFAX.js}

@@ -49,7 +49,7 @@ import {
 } from "./chunk-DWFLVJC6.js";
 import {
   createZipCodec
-} from "./chunk-MKQVQMXO.js";
+} from "./chunk-5LU4UCBR.js";
 import {
   CodecError,
   createCompressionCodec