@poe-platform/safe-bash 0.1.799 → 0.1.801

package/dist/safe-bash/command-chunks/chunk-5PWJG2UK.js

@@ -0,0 +1,174 @@
+import {
+  createArchive,
+  manifest
+} from "./chunk-WNE7FPVR.js";
+import {
+  readArchive
+} from "./chunk-TIOCQVUQ.js";
+import {
+  Reader,
+  autodetected,
+  compressed,
+  recordPadding,
+  recorded
+} from "./chunk-BNOU5YQS.js";
+import {
+  quoteName
+} from "./chunk-C7I25AAL.js";
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-tar/src/modes.ts
+init_buffer();
+import { collectBytes, resolvePath } from "../../safe-bash-contracts/index.js";
+import { decodeBytes, encodeBytes, equalBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { bounded, display, fail, fileSource, hasIdentity, maybeStat, operation, publish, sameIdentity, vfsPath } from "../../safe-bash-io-engine/commands/archive/internal.js";
+async function compareArchive(context, options, budget) {
+  let different = false;
+  const input = bounded(options.archive === "-" ? context.stdin : fileSource(context, vfsPath(context.cwd, options.archive), budget.limits), budget.limits.maxArchiveBytes, context.signal, budget.limits.chunkSize);
+  const source = options.compression ? compressed(input, true, context.signal, budget.limits, options.compression) : autodetected(input, context.signal, budget.limits);
+  await readArchive(context, source, options, budget, { async member(entry, reader, selected, root) {
+    const difference = async (message) => {
+      different = true;
+      await budget.output(`${display(entry.name)}: ${message}
+`);
+    };
+    if (!selected) {
+      await reader.discard(entry.size);
+      return;
+    }
+    if (entry.name.split("/").includes("..")) fail(`unsafe parent component in member: ${display(entry.name)}`);
+    const path = resolvePath(root, entry.name);
+    const stat = await maybeStat(context, path);
+    if (!stat) {
+      await difference("File is missing");
+      await reader.discard(entry.size);
+      return;
+    }
+    const wanted = entry.type === "5" ? "directory" : entry.type === "2" ? "symlink" : "file";
+    if (stat.type !== wanted) {
+      await difference("File type differs");
+      await reader.discard(entry.size);
+      return;
+    }
+    const capabilities = await operation(context, () => context.fs.capabilitiesFor?.(path, { signal: context.signal }) ?? context.fs.capabilities);
+    if (capabilities.permissions === false || capabilities.timestamps === false) fail("filesystem lacks metadata required for archive comparison");
+    if ((stat.mode & 4095) !== entry.mode) await difference("Mode differs");
+    if (entry.uid !== void 0) {
+      if (stat.uid === void 0) fail("filesystem lacks ownership required for archive comparison");
+      if (stat.uid !== entry.uid) await difference("Uid differs");
+    }
+    if (entry.gid !== void 0) {
+      if (stat.gid === void 0) fail("filesystem lacks ownership required for archive comparison");
+      if (stat.gid !== entry.gid) await difference("Gid differs");
+    }
+    if (entry.type !== "2" && entry.mtime !== void 0 && Math.floor(stat.mtimeMs / 1e3) !== Math.floor(entry.mtime)) await difference("Mod time differs");
+    if (entry.type === "2") {
+      if (!context.fs.readlink) fail("filesystem lacks readlink required for archive comparison");
+      if (await operation(context, () => context.fs.readlink(path, { signal: context.signal })) !== entry.linkname) await difference("Symlink differs");
+    } else if (entry.type === "1") {
+      if (entry.linkname.split("/").includes("..")) fail("unsafe hardlink target in archive comparison");
+      const target = await maybeStat(context, resolvePath(root, entry.linkname));
+      if (!hasIdentity(stat) || target && !hasIdentity(target)) fail("filesystem lacks identity required for hardlink comparison");
+      if (!target || !sameIdentity(stat, target)) await difference("Not linked to archive target");
+    } else if (entry.type === "0") {
+      if (stat.size !== entry.size) {
+        await difference("Size differs");
+        await reader.discard(entry.size);
+        return;
+      }
+      const actual = new Reader(fileSource(context, path, budget.limits), context.signal);
+      let equal = true;
+      try {
+        for await (const chunk of reader.body(entry.size)) {
+          const bytes = await actual.exact(chunk.length);
+          if (!equalBytes(encodeBytes(chunk), bytes)) equal = false;
+        }
+        if (await actual.take(1)) equal = false;
+      } finally {
+        await actual.close();
+      }
+      if (!equal) await difference("Contents differ");
+      if (options.verbose) await budget.output(`${quoteName(entry.name, options.quotingStyle)}
+`);
+      return;
+    }
+    await reader.discard(entry.size);
+  } });
+  return different ? 1 : 0;
+}
+async function mutateArchive(context, options, budget) {
+  if (options.archive === "-") fail("archive mutation requires a named archive");
+  if (options.compression) fail("cannot modify compressed archives");
+  const path = vfsPath(context.cwd, options.archive);
+  const stat = await maybeStat(context, path);
+  if (!stat || stat.type !== "file") fail("archive mutation requires an existing regular file");
+  if (!hasIdentity(stat)) fail("cannot safely replace an archive with unknown backing identity");
+  const parts = [];
+  let changed = false;
+  let bytes = 1024;
+  const add = (part) => {
+    if (part.length > budget.limits.maxArchiveBytes - bytes) fail("archive byte limit exceeded");
+    bytes += part.length;
+    parts.push(part);
+  };
+  const times = /* @__PURE__ */ new Map();
+  const scan = async (inputPath, deleting) => {
+    const data = await collectBytes(fileSource(context, inputPath, budget.limits), { ...Number.isFinite(budget.limits.maxArchiveBytes) ? { maxBytes: budget.limits.maxArchiveBytes } : {}, signal: context.signal });
+    const prefix = data.subarray(0, 6);
+    if (prefix[0] === 31 && prefix[1] === 139 || decodeBytes(encodeBytes(prefix.subarray(0, 3))) === "BZh" || [253, 55, 122, 88, 90, 0].every((value, index) => prefix[index] === value)) fail("cannot modify compressed archives");
+    await readArchive(context, (async function* () {
+      yield data;
+    })(), deleting ? options : { ...options, mode: "t", operands: [], excludes: [] }, budget, {
+      rejectGlobal: true,
+      async member(entry, reader, selected, _root, start) {
+        const end = reader.position + entry.size + (512 - entry.size % 512) % 512;
+        if (!deleting || !selected) add(data.subarray(start, end));
+        else changed = true;
+        const name = entry.name.endsWith("/") ? entry.name.slice(0, -1) : entry.name;
+        const prior = times.get(name);
+        if (!times.has(name) || entry.mtime === void 0 || prior !== void 0 && entry.mtime > prior) times.set(name, entry.mtime);
+        await reader.discard(entry.size);
+      }
+    });
+  };
+  await scan(path, options.mode === "delete");
+  if (options.mode === "A") {
+    for (const operand of options.operands) {
+      const inputPath = vfsPath(operand.cwd, operand.name);
+      const inputStat = await maybeStat(context, inputPath);
+      if (!inputStat || inputStat.type !== "file") fail("concatenation source must be a regular archive");
+      if (!hasIdentity(inputStat)) fail("concatenation source has unknown backing identity");
+      if (sameIdentity(stat, inputStat)) fail("cannot concatenate an archive to itself");
+      await scan(inputPath, false);
+      changed = true;
+    }
+  } else if (options.mode === "r" || options.mode === "u") {
+    const prepared = await manifest(context, options, budget);
+    const entries = options.mode === "u" ? prepared.entries.filter((source) => {
+      const name = source.entry.name.endsWith("/") ? source.entry.name.slice(0, -1) : source.entry.name;
+      if (!times.has(name)) return true;
+      const archived = times.get(name);
+      if (archived === void 0) fail("archive lacks mtime required for update");
+      return source.stat.mtimeMs / 1e3 > archived;
+    }) : prepared.entries;
+    const created = await collectBytes(createArchive(context, entries, options, budget), { ...Number.isFinite(budget.limits.maxArchiveBytes - bytes + 1024) ? { maxBytes: budget.limits.maxArchiveBytes - bytes + 1024 } : {}, signal: context.signal });
+    add(created.subarray(0, created.length - 1024));
+    changed = entries.length > 0;
+  }
+  if (!changed) return;
+  recordPadding(bytes, options.recordSize, budget.limits.maxArchiveBytes);
+  parts.push(new Uint8Array(1024));
+  const current = await maybeStat(context, path);
+  if (!current || !sameIdentity(stat, current) || current.size !== stat.size || current.mtimeMs !== stat.mtimeMs || current.ctimeMs !== stat.ctimeMs) fail("archive changed during preparation");
+  await operation(context, () => context.fs.rm(path, { signal: context.signal }));
+  await publish(context, path, recorded((async function* () {
+    yield* parts;
+  })(), options, budget), stat.mode & 4095);
+}
+
+export {
+  compareArchive,
+  mutateArchive
+};

package/dist/safe-bash/command-chunks/chunk-5TBUOBDE.js

@@ -0,0 +1,346 @@
+import {
+  parseTransform
+} from "./chunk-YOF7R4OY.js";
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-tar/src/options.ts
+init_buffer();
+import { collectBytes } from "../../safe-bash-contracts/index.js";
+import { byteLength, encodeBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { checkPath, fail, operation, smallFile, text, vfsPath } from "../../safe-bash-io-engine/commands/archive/internal.js";
+async function parseOptions(context, limits) {
+  if (context.args.reduce((total, argument) => total + byteLength(argument), 0) > limits.maxArgumentBytes) fail("argument byte limit exceeded");
+  let mode;
+  let archive = "-";
+  let compression;
+  let autoCompress = false;
+  let verbose = false;
+  let toStdout = false;
+  let utc = false;
+  let recordSize = 512;
+  let ignoreZeros = false;
+  let totals = false;
+  let quotingStyle = "escape";
+  let sort = "none";
+  let dereference = false;
+  let excludeCaches = false;
+  let recursion = true;
+  let showTransformedNames = false;
+  const transforms = [];
+  let overwrite = "replace";
+  let strip = 0;
+  let format = "pax";
+  let cwd = context.cwd;
+  let nullFiles = false;
+  let verbatim = false;
+  let filesFrom = false;
+  let stdinUsed = false;
+  let filesFromBytes = 0;
+  let lateExclude = false;
+  let wildcards = false;
+  let occurrence;
+  const metadata = {};
+  const operands = [];
+  const excludes = [];
+  const exclude = (pattern) => {
+    checkPath(pattern, limits);
+    if (excludes.length >= limits.maxMembers) fail("exclude pattern limit exceeded");
+    if (operands.length) lateExclude = true;
+    excludes.push(pattern);
+  };
+  const operand = (name) => {
+    checkPath(name, limits);
+    if (operands.length >= limits.maxMembers) fail("operand limit exceeded");
+    operands.push({ name, cwd });
+  };
+  const directory = async (name) => {
+    checkPath(name, limits);
+    const path = await operation(context, () => context.fs.realpath(vfsPath(cwd, name), { signal: context.signal }));
+    const stat = await operation(context, () => context.fs.stat(path, { signal: context.signal }));
+    if (stat.type !== "directory") fail(`not a directory: ${name}`);
+    cwd = path;
+  };
+  const names = async (path) => {
+    filesFrom = true;
+    if (path === "-" && stdinUsed) fail("standard input file list can only be read once");
+    const bytes = path === "-" ? await collectBytes(context.stdin, { ...Number.isFinite(limits.maxFilesFromBytes) ? { maxBytes: limits.maxFilesFromBytes } : {}, signal: context.signal }) : await smallFile(context, vfsPath(context.cwd, path), limits);
+    if (path === "-") stdinUsed = true;
+    filesFromBytes += bytes.length;
+    if (filesFromBytes > limits.maxFilesFromBytes) fail("files-from byte limit exceeded");
+    const contents = text(bytes);
+    if (!nullFiles && contents.includes("\0")) fail("NUL in newline file list; use --null");
+    const lines = contents.split(nullFiles ? "\0" : "\n");
+    for (let index = 0; index < lines.length; index++) {
+      const line = lines[index];
+      if (!line) continue;
+      if (!nullFiles && !verbatim && line.startsWith("-")) {
+        if (line === "-C") {
+          const next = lines[++index];
+          if (!next) fail("missing -C argument in file list");
+          await directory(next);
+        } else if (line.startsWith("-C") && !/\s/u.test(line[2] ?? "")) await directory(line.slice(2));
+        else if (line.startsWith("--directory=")) await directory(line.slice(12));
+        else fail(`unsupported option in file list: ${line}; use --verbatim-files-from for literal names`);
+      } else {
+        operand(!nullFiles && !verbatim ? unquoteFileName(line) : line);
+      }
+    }
+  };
+  const apply = async (flag, value) => {
+    if (flag === "c" || flag === "t" || flag === "x" || flag === "r" || flag === "u" || flag === "d" || flag === "delete" || flag === "A") {
+      if (mode) fail("exactly one tar operation is required (-c, -t, -x, -r, -u, -d, --delete, -A)");
+      mode = flag;
+    } else if (flag === "z" || flag === "j" || flag === "J") {
+      const selected = flag === "z" ? "gzip" : flag === "j" ? "bzip2" : "xz";
+      if (compression && compression !== selected) fail("conflicting compression options");
+      compression = selected;
+    } else if (flag === "a") autoCompress = true;
+    else if (flag === "v") verbose = true;
+    else if (flag === "O" || flag === "to-stdout") toStdout = true;
+    else if (flag === "utc") {
+      utc = true;
+      verbose = true;
+    } else if (flag === "totals") totals = true;
+    else if (flag === "i") ignoreZeros = true;
+    else if (flag === "B" || flag === "n" || flag === "no-seek" || flag === "force-local") {
+    } else if (flag === "b" || flag === "record-size") {
+      let digits = value;
+      let multiplier = flag === "b" ? 512 : 1;
+      if (flag === "record-size") {
+        const suffixes = { c: 1, w: 2, b: 512, k: 1024, K: 1024, M: 1024 ** 2, G: 1024 ** 3 };
+        const suffix = suffixes[digits.at(-1) ?? ""];
+        if (suffix !== void 0) {
+          multiplier = suffix;
+          digits = digits.slice(0, -1);
+        }
+      }
+      if (digits.startsWith("+")) digits = digits.slice(1);
+      const size = Number(digits) * multiplier;
+      if (!digits || ![...digits].every((character) => "0123456789".includes(character)) || !Number.isSafeInteger(size) || size <= 0 || size % 512 !== 0) fail("record size must be a positive multiple of 512");
+      if (size > limits.maxArchiveBytes) fail("record size exceeds archive byte limit");
+      recordSize = size;
+    } else if (flag === "quoting-style") {
+      if (value !== "literal" && value !== "escape" && value !== "c") fail(`unsupported quoting style: ${value}; use literal, escape or c`);
+      quotingStyle = value;
+    } else if (flag === "sort") {
+      if (value !== "name" && value !== "none") fail(`unsupported sort order: ${value}`);
+      sort = value;
+    } else if (flag === "h" || flag === "dereference") dereference = true;
+    else if (flag === "exclude-caches") excludeCaches = true;
+    else if (flag === "no-recursion") recursion = false;
+    else if (flag === "recursion") recursion = true;
+    else if (flag === "show-transformed-names") showTransformedNames = true;
+    else if (flag === "transform") transforms.push(...parseTransform(value));
+    else if (flag === "atime-preserve") {
+      if (value !== "replace") fail("only --atime-preserve=replace is supported; filesystem has no no-atime read capability");
+      metadata.preserveAtime = true;
+    } else if (flag === "full-time") metadata.fullTime = true;
+    else if (flag === "numeric-owner" || flag === "no-same-owner") {
+    } else if (flag === "same-owner") fail("filesystem does not support restoring archive ownership");
+    else if (flag === "m" || flag === "touch") metadata.touch = true;
+    else if (flag === "p" || flag === "same-permissions" || flag === "preserve-permissions") metadata.permissions = true;
+    else if (flag === "no-same-permissions") metadata.permissions = false;
+    else if (flag === "delay-directory-restore") metadata.delayDirectories = true;
+    else if (flag === "no-delay-directory-restore") metadata.delayDirectories = false;
+    else if (flag === "owner" || flag === "group" || flag === "mode") {
+      const radix = flag === "mode" ? 8 : 10;
+      const digits = radix === 8 ? "01234567" : "0123456789";
+      if (!value || ![...value].every((character) => digits.includes(character))) fail(`invalid numeric ${flag}: ${value}`);
+      const number = parseInt(value, radix);
+      if (!Number.isSafeInteger(number) || flag === "mode" && number > 4095) fail(`invalid numeric ${flag}: ${value}`);
+      if (flag === "owner") metadata.uid = number;
+      else if (flag === "group") metadata.gid = number;
+      else metadata.mode = number;
+    } else if (flag === "mtime") {
+      const seconds = value.startsWith("@") ? Number(value.slice(1)) : Date.parse(value) / 1e3;
+      if (!value || value === "@" || !Number.isFinite(seconds) || Math.abs(seconds * 1e3) > 864e13) fail(`invalid mtime: ${value}`);
+      metadata.mtime = seconds;
+    } else if (flag === "k" || flag === "keep-old-files") overwrite = "keep";
+    else if (flag === "skip-old-files") overwrite = "skip";
+    else if (flag === "overwrite") overwrite = "replace";
+    else if (flag === "f") {
+      if (!value) fail("empty archive name");
+      archive = value;
+    } else if (flag === "C") await directory(value);
+    else if (flag === "T") await names(value);
+    else if (flag === "exclude") exclude(value);
+    else if (flag === "X") {
+      if (value === "-" && stdinUsed) fail("standard input file list can only be read once");
+      const bytes = value === "-" ? await collectBytes(context.stdin, { ...Number.isFinite(limits.maxFilesFromBytes) ? { maxBytes: limits.maxFilesFromBytes } : {}, signal: context.signal }) : await smallFile(context, vfsPath(context.cwd, value), limits);
+      if (value === "-") stdinUsed = true;
+      filesFromBytes += bytes.length;
+      if (filesFromBytes > limits.maxFilesFromBytes) fail("files-from byte limit exceeded");
+      const contents = text(bytes);
+      if (contents.includes("\0")) fail("NUL in exclusion file");
+      for (const pattern of contents.split("\n")) if (pattern) exclude(pattern);
+    } else if (flag === "wildcards") wildcards = true;
+    else if (flag === "no-wildcards") wildcards = false;
+    else if (flag === "occurrence") {
+      const count = value ?? "1";
+      if (!count || ![...count].every((character) => "0123456789".includes(character)) || !Number.isSafeInteger(Number(count)) || Number(count) < 1) fail("invalid occurrence count");
+      occurrence = Number(count);
+    } else if (flag === "strip-components") {
+      if (!/^[0-9]+$/u.test(value) || !Number.isSafeInteger(Number(value))) fail("invalid strip-components count");
+      strip = Number(value);
+    } else if (flag === "format") {
+      if (value !== "ustar" && value !== "pax" && value !== "posix") fail(`unsupported archive format: ${value}`);
+      format = value === "ustar" ? "ustar" : "pax";
+    } else if (flag === "null") {
+      nullFiles = true;
+      verbatim = true;
+    } else if (flag === "no-null") nullFiles = false;
+    else if (flag === "verbatim-files-from") verbatim = true;
+    else if (flag === "no-verbatim-files-from") verbatim = false;
+    else fail(`unsupported option: ${flag}`);
+  };
+  const long = { create: "c", list: "t", extract: "x", get: "x", append: "r", update: "u", compare: "d", diff: "d", catenate: "A", concatenate: "A", file: "f", gzip: "z", bzip2: "j", xz: "J", "auto-compress": "a", verbose: "v", directory: "C", "files-from": "T", "exclude-from": "X", xform: "transform", "blocking-factor": "b", "read-full-records": "B", "ignore-zeros": "i", seek: "n" };
+  const values = /* @__PURE__ */ new Set(["f", "C", "T", "X", "exclude", "strip-components", "format", "transform", "mtime", "owner", "group", "mode", "sort", "b", "record-size", "quoting-style"]);
+  let end = false;
+  for (let index = 0; index < context.args.length; index++) {
+    const argument = context.args[index];
+    if (!end && argument === "--") {
+      end = true;
+      continue;
+    }
+    if (!end && argument.startsWith("--")) {
+      const equals = argument.indexOf("=");
+      const name = argument.slice(2, equals < 0 ? void 0 : equals);
+      const flag = long[name] ?? name;
+      let value = equals < 0 ? void 0 : argument.slice(equals + 1);
+      if (values.has(flag) && value === void 0) value = context.args[++index];
+      if (values.has(flag) && value === void 0) fail(`missing argument for --${name}`);
+      if (flag === "atime-preserve" && value === void 0) value = "replace";
+      if (!values.has(flag) && flag !== "atime-preserve" && flag !== "occurrence" && value !== void 0) fail(`option --${name} does not take an argument`);
+      if (flag === "help") return "help";
+      await apply(flag, value);
+    } else if (!end && (argument.startsWith("-") && argument !== "-" || index === 0 && argument.length > 0 && [...argument].every((flag) => "ctxrudAzjJavfCTXmpkhbBinO".includes(flag)))) {
+      const old = !argument.startsWith("-");
+      const cluster = old ? argument : argument.slice(1);
+      for (let offset = 0; offset < cluster.length; offset++) {
+        const flag = cluster[offset];
+        let value;
+        if (values.has(flag)) {
+          value = !old && offset + 1 < cluster.length ? cluster.slice(offset + 1) : context.args[++index];
+          if (value === void 0) fail(`missing argument for -${flag}`);
+          if (!old) offset = cluster.length;
+        }
+        await apply(flag, value);
+      }
+    } else operand(argument);
+  }
+  if (!mode) fail("exactly one tar operation is required (-c, -t, -x, -r, -u, -d, --delete, -A)");
+  const creating = mode === "c" || mode === "r" || mode === "u";
+  if (occurrence !== void 0 && (creating || mode === "A" || !operands.length)) fail("--occurrence requires member operands when reading archives");
+  if (mode !== "c" && archive === "-" && stdinUsed) fail("archive and file list cannot both use standard input");
+  if (mode !== "t" && mode !== "x" && strip !== 0) fail("--strip-components is only supported when listing or extracting archives");
+  if (creating && lateExclude) fail("--exclude after source operands is unsupported; place exclusions before operands");
+  if (mode === "c" && !operands.length && !filesFrom) fail("refusing to create an empty archive without -T");
+  if (archive !== "-") checkPath(archive, limits);
+  if (mode === "c" && autoCompress) {
+    compression = archive.endsWith(".gz") || archive.endsWith(".tgz") ? "gzip" : archive.endsWith(".bz2") || archive.endsWith(".tbz2") || archive.endsWith(".tbz") ? "bzip2" : archive.endsWith(".xz") || archive.endsWith(".txz") ? "xz" : void 0;
+  }
+  return { mode, archive, ...compression ? { compression } : {}, verbose, toStdout, utc, recordSize, ignoreZeros, totals, quotingStyle, showTransformedNames, transforms, strip, format, cwd, operands, excludes, sort, dereference, excludeCaches, recursion, wildcards, ...occurrence !== void 0 ? { occurrence } : {}, metadata, overwrite };
+}
+function unquoteFileName(name) {
+  const input = encodeBytes(name);
+  const output = [];
+  const escapes = { a: 7, b: 8, f: 12, n: 10, r: 13, t: 9, v: 11, "\\": 92 };
+  for (let index = 0; index < input.length; index++) {
+    const byte = input[index];
+    if (byte === 92 && index + 1 < input.length) {
+      const next = input[index + 1];
+      const escape = escapes[String.fromCharCode(next)];
+      if (escape !== void 0) {
+        output.push(escape);
+        index++;
+        continue;
+      }
+      const digits = input.subarray(index + 1, index + 4);
+      if (digits.length === 3 && digits.every((digit) => digit >= 48 && digit <= 55)) {
+        output.push((digits[0] - 48) * 64 + (digits[1] - 48) * 8 + digits[2] - 48 & 255);
+        index += 3;
+        continue;
+      }
+    }
+    output.push(byte);
+  }
+  return text(Uint8Array.from(output));
+}
+function tokenize(pattern) {
+  const characters = Array.from(pattern);
+  const tokens = [];
+  for (let index = 0; index < characters.length; index++) {
+    const character = characters[index];
+    if (character === "*") {
+      if (tokens.at(-1)?.kind !== "star") tokens.push({ kind: "star" });
+    } else if (character === "?") tokens.push({ kind: "any" });
+    else if (character === "\\") {
+      if (++index === characters.length) fail("trailing escape in exclude pattern");
+      tokens.push({ kind: "literal", value: characters[index] });
+    } else if (character === "[") {
+      const ranges = [];
+      index++;
+      const negative = characters[index] === "!" || characters[index] === "^";
+      if (negative) index++;
+      while (index < characters.length && (characters[index] !== "]" || ranges.length === 0)) {
+        const first = characters[index];
+        if (first === "[" || first === "\\") fail("POSIX classes and escapes inside exclude brackets are unsupported");
+        let last = first;
+        if (characters[index + 1] === "-" && characters[index + 2] && characters[index + 2] !== "]") {
+          last = characters[index + 2];
+          index += 2;
+        }
+        if (first.codePointAt(0) > last.codePointAt(0)) fail("invalid exclude bracket range");
+        ranges.push([first.codePointAt(0), last.codePointAt(0)]);
+        index++;
+      }
+      if (characters[index] !== "]") fail("unclosed exclude bracket");
+      tokens.push({ kind: "class", ranges, negative });
+    } else tokens.push({ kind: "literal", value: character });
+  }
+  return tokens;
+}
+var Exclusions = class {
+  constructor(patterns, maxWork = Infinity, anchored = false) {
+    this.maxWork = maxWork;
+    this.anchored = anchored;
+    this.patterns = patterns.map(tokenize);
+  }
+  maxWork;
+  anchored;
+  patterns;
+  work = 0;
+  matches(name) {
+    const characters = Array.from(name);
+    for (const tokens of this.patterns) {
+      let states = new Uint8Array(characters.length + 1);
+      states[0] = 1;
+      if (!this.anchored) {
+        for (let index = 0; index < characters.length; index++) if (characters[index] === "/") states[index + 1] = 1;
+      }
+      for (const token of tokens) {
+        this.work += characters.length + 1;
+        if (this.work > this.maxWork) fail("exclude pattern work limit exceeded");
+        const next = new Uint8Array(states.length);
+        for (let index = 0; index < states.length; index++) {
+          if (token.kind === "star") next[index] = states[index] || (index > 0 ? next[index - 1] : 0);
+          else if (states[index] && index < characters.length) {
+            const character = characters[index];
+            const matches = token.kind === "any" || (token.kind === "literal" ? token.value === character : token.ranges.some(([first, last]) => character.codePointAt(0) >= first && character.codePointAt(0) <= last) !== token.negative);
+            if (matches) next[index + 1] = 1;
+          }
+        }
+        states = next;
+      }
+      for (let index = 0; index < states.length; index++) if (states[index] && (index === characters.length || characters[index] === "/")) return true;
+    }
+    return false;
+  }
+};
+
+export {
+  parseOptions,
+  Exclusions
+};

package/dist/safe-bash/command-chunks/{chunk-JMPP4TCW.js → chunk-5UBXNSFZ.js}

@@ -37,7 +37,7 @@ function repr(value) {
   }
   return text + quote;
 }
-function integer(text, maxDigits = 4300) {
+function integer(text, maxDigits = Infinity) {
   const characters = Array.from(text);
   let start = 0;
   let end = characters.length;
@@ -347,8 +347,9 @@ async function* readCsvStream(lines, dialect = {}, step = () => {
           if (c === delimCode) fieldCount++;
         }
         if (plainAscii && fieldCount <= colBudget) {
-          for (let i = 0; i < len; i++) step();
+          step();
           admitRow();
+          for (let i = 1; i < len; i++) step();
           parser.advancePlainLine?.();
           yield { cells: text.slice(0, len - 1).split(delimiter), line: physicalLine };
           continue;

package/dist/safe-bash/command-chunks/chunk-5XY4DTNG.js

@@ -0,0 +1,34 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-network-engine/src/platform-portable.ts
+init_buffer();
+var requiresFiniteUrlLimits = false;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function validateHeaderName(name) {
+  if (!name.length) throw new TypeError("Invalid HTTP header name");
+  for (const character of name) {
+    const code = character.charCodeAt(0);
+    if (!(code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || "!#$%&'*+-.^_`|~".includes(character))) {
+      throw new TypeError("Invalid HTTP header name");
+    }
+  }
+}
+function validateHeaderValue(_name, value) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code !== 9 && (code < 32 || code === 127 || code > 255)) throw new TypeError("Invalid HTTP header value");
+  }
+}
+
+export {
+  requiresFiniteUrlLimits,
+  randomBytes,
+  validateHeaderName,
+  validateHeaderValue
+};