@poe-platform/safe-bash 0.1.799 → 0.1.801

package/dist/safe-bash-xml-engine/limits.d.ts

@@ -35,6 +35,8 @@ export declare class XmlBudget {
     outputBytes: number;
     inputBytes: number;
     constructor(limits: XmlQueryLimits, signal: AbortSignal, checkpointTurn: XmlCheckpoint);
+    /** Charge synchronous work only when it cannot start an asynchronous checkpoint. */
+    tryTickSync(work?: number): boolean;
     tick(work?: number): Promise<void> | void;
     results(size: number): void;
 }

package/dist/safe-bash-xml-engine/limits.js

@@ -4,7 +4,7 @@ import {
   XmlQueryLimitError,
   defaultXmlQueryLimits,
   resolveXmlQueryLimits
-} from "../safe-bash/command-chunks/chunk-KVFCSLKK.js";
+} from "../safe-bash/command-chunks/chunk-NXEQ3ESQ.js";
 import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {
   XmlBudget,

package/dist/safe-bash-xml-engine/predicate.d.ts

@@ -0,0 +1,57 @@
+import { XmlBudget } from "./limits.js";
+import type { Query } from "./query.js";
+import { type Node } from "./evaluate.js";
+type Selected = {
+    text: string;
+    node: Node;
+};
+export type Value = string | number | boolean | Selected[];
+type Operator = "or" | "and" | "=" | "!=" | "<" | "<=" | ">" | ">=";
+type FunctionName = keyof typeof arity;
+export type Instruction = {
+    kind: "path";
+    source: string;
+    query?: Query;
+} | {
+    kind: "literal";
+    value: string | number;
+} | {
+    kind: "operator";
+    name: Operator;
+} | {
+    kind: "function";
+    name: FunctionName;
+    count: number;
+};
+declare const arity: {
+    contains: number[];
+    "starts-with": number[];
+    "normalize-space": number[];
+    not: number[];
+    position: number[];
+    last: number[];
+    concat: number[];
+    substring: number[];
+    "substring-before": number[];
+    "substring-after": number[];
+    translate: number[];
+    "string-length": number[];
+    string: number[];
+    count: number[];
+    boolean: number[];
+    true: number[];
+    false: number[];
+    number: number[];
+    sum: number[];
+    floor: number[];
+    ceiling: number[];
+    round: number[];
+    name: number[];
+    "local-name": number[];
+    "namespace-uri": number[];
+};
+/** Shunting-yard compilation keeps adversarial expression nesting off the JS stack. */
+export declare function parsePredicate(source: string, budget: XmlBudget): readonly Instruction[];
+export declare function evaluateExpression(program: readonly Instruction[], node: Node, position: number, last: number, budget: XmlBudget, select?: (query: Query, absolute: boolean) => Promise<Node[]>): Promise<Value>;
+export declare function testPredicate(program: readonly Instruction[], node: Node, position: number, last: number, budget: XmlBudget, select?: (query: Query, absolute: boolean) => Promise<Node[]>): Promise<boolean>;
+export {};

package/dist/safe-bash-xml-engine/query.d.ts

@@ -1,18 +1,6 @@
 import { XmlBudget } from "./limits.js";
-export type Predicate = {
-    kind: "position";
-    value: number;
-} | {
-    kind: "last";
-} | {
-    kind: "attribute";
-    name: string;
-    value?: string;
-} | {
-    kind: "child" | "text" | "self";
-    name: string;
-    value: string;
-};
+import { type Instruction } from "./predicate.js";
+export type Predicate = readonly Instruction[];
 export interface QueryStep {
     readonly descendant: boolean;
     readonly kind: "element" | "attribute" | "text" | "self" | "parent";
@@ -20,7 +8,7 @@ export interface QueryStep {
     readonly predicates: readonly Predicate[];
 }
 export interface Query {
-    readonly scalar: "string" | "count" | "boolean" | undefined;
+    readonly expression?: readonly Instruction[];
     readonly paths: readonly (readonly QueryStep[])[];
 }
 export declare function parseQuery(source: string, budget: XmlBudget): Promise<Query>;

package/dist/safe-bash-xml-engine/query.js

@@ -1,7 +1,8 @@
 import {
   parseQuery
-} from "../safe-bash/command-chunks/chunk-5MPOQ6V3.js";
-import "../safe-bash/command-chunks/chunk-KVFCSLKK.js";
+} from "../safe-bash/command-chunks/chunk-JNZ3CVAE.js";
+import "../safe-bash/command-chunks/chunk-XJXU3VVH.js";
+import "../safe-bash/command-chunks/chunk-NXEQ3ESQ.js";
 import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {
   parseQuery

package/dist/safe-bash-zip-engine/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Poe Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/safe-bash-zip-engine/index.d.ts

@@ -0,0 +1 @@
+export * from "./zip-format.js";

package/dist/safe-bash-zip-engine/index.js

@@ -0,0 +1,32 @@
+import {
+  crc32,
+  decodeZipEntry,
+  makeZipEntry,
+  readZipArchive,
+  setZipEntryComment,
+  streamZipArchive,
+  updateZipExtras,
+  writeZipArchive
+} from "../safe-bash/command-chunks/chunk-364TMWBT.js";
+import "../safe-bash/command-chunks/chunk-LE5LZNHE.js";
+import "../safe-bash/command-chunks/chunk-2FGJYFWZ.js";
+import "../safe-bash/command-chunks/chunk-PII4YEZW.js";
+import "../safe-bash/command-chunks/chunk-H622NS6Z.js";
+import "../safe-bash/command-chunks/chunk-SEM36PG5.js";
+import "../safe-bash/command-chunks/chunk-UXSR5BZH.js";
+import {
+  init_buffer
+} from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/index.ts
+init_buffer();
+export {
+  crc32,
+  decodeZipEntry,
+  makeZipEntry,
+  readZipArchive,
+  setZipEntryComment,
+  streamZipArchive,
+  updateZipExtras,
+  writeZipArchive
+};

package/dist/safe-bash-zip-engine/unzip/arguments.d.ts

@@ -0,0 +1,53 @@
+import { type ByteSource, type CommandContext } from "../../safe-bash-contracts/index.js";
+import { type ArchiveLimits } from "../../safe-bash-io-engine/commands/archive/internal.js";
+export declare function parseArguments(context: Pick<CommandContext, "args" | "argumentValues">, limits: ArchiveLimits): {
+    test: boolean;
+    quiet: number;
+    password: Uint8Array<ArrayBufferLike> | undefined;
+    names: boolean;
+    archiveComment: boolean;
+    list: boolean;
+    verbose: boolean;
+    caseInsensitive: boolean;
+    update: boolean;
+    freshen: boolean;
+    exclusions: string[];
+    pipe: boolean;
+    pipeHeaders: boolean;
+    overwrite: boolean;
+    neverOverwrite: boolean;
+    junkPaths: boolean;
+    destination: string | undefined;
+    archive: string;
+    patterns: string[];
+};
+export declare class Selection {
+    private readonly limits;
+    private readonly signal;
+    private readonly options;
+    private work;
+    private readonly patterns;
+    private readonly tailComponents;
+    private readonly emptyTailMatch;
+    readonly matched: Set<number>;
+    constructor(patterns: readonly string[], limits: ArchiveLimits, signal: AbortSignal, options?: {
+        noWild?: boolean;
+        stopAtDirectories?: boolean;
+        trailingComponents?: boolean;
+        caseInsensitive?: boolean;
+    });
+    private step;
+    matches(name: string, firstMatchOnly?: boolean): Promise<boolean>;
+}
+export declare class Answers {
+    private readonly limits;
+    private readonly signal;
+    private readonly iterator;
+    private chunk;
+    private offset;
+    private bytes;
+    private pulls;
+    constructor(source: ByteSource, limits: ArchiveLimits, signal: AbortSignal);
+    read(maximum?: number): Promise<string | undefined>;
+    close(): Promise<void>;
+}

package/dist/safe-bash-zip-engine/unzip/arguments.js

@@ -0,0 +1,270 @@
+import {
+  init_buffer
+} from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/unzip/arguments.ts
+init_buffer();
+import { getCommandArguments, readBytes } from "../../safe-bash-contracts/index.js";
+import { shellValueByteLength, shellValueBytes } from "../../safe-bash-contracts/value.js";
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { byteLength, decodeBytes, encodeBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { checkPath, fail, text } from "../../safe-bash-io-engine/commands/archive/internal.js";
+function parseArguments(context, limits) {
+  const { args } = context;
+  const rawArguments = context.argumentValues ? getCommandArguments(context) : void 0;
+  const passwordArguments = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  for (const argument of args) {
+    bytes += byteLength(argument) + 1;
+    if (bytes > limits.maxArgumentBytes) fail("argument byte limit exceeded");
+    if (argument.includes("\0")) fail("NUL in argument");
+  }
+  if (context.argumentValues) {
+    const argumentsValue = getCommandArguments(context);
+    let rawBytes = 0;
+    for (const value of argumentsValue.values) {
+      const size = shellValueByteLength(value) + 1;
+      if (size > limits.maxArgumentBytes - rawBytes) fail("argument byte limit exceeded");
+      rawBytes += size;
+    }
+  }
+  let list = false;
+  let verbose = false;
+  let caseInsensitive = false;
+  let update = false;
+  let freshen = false;
+  let excluding = false;
+  const exclusions = [];
+  let zipinfo = false;
+  let names = false;
+  let archiveComment = false;
+  let test = false;
+  let quiet = 0;
+  let password;
+  let pipe = false;
+  let pipeHeaders = false;
+  let overwrite = false;
+  let neverOverwrite = false;
+  let junkPaths = false;
+  let destination;
+  let archive;
+  let ended = false;
+  const patterns = [];
+  for (let index = 0; index < args.length; index++) {
+    const argument = args[index];
+    if (!ended && argument === "--") {
+      ended = true;
+      continue;
+    }
+    if (!ended && argument.startsWith("-") && argument !== "-") {
+      for (let offset = 1; offset < argument.length; offset++) {
+        const flag = argument[offset];
+        if (flag === "P") {
+          const attached = offset + 1 < argument.length;
+          const value = argument.slice(offset + 1) || args[++index];
+          if (value === void 0) fail("password option requires a value");
+          passwordArguments.add(index);
+          const raw = rawArguments?.bytes(index);
+          password = raw ? new Uint8Array(raw.subarray(attached ? offset + 1 : 0)) : encodeBytes(value);
+          break;
+        } else if (flag === "Z" && index === 0 && offset === 1) zipinfo = true;
+        else if (flag === "1" && zipinfo) names = true;
+        else if (flag === "z") archiveComment = true;
+        else if (flag === "t") test = true;
+        else if (flag === "q") quiet++;
+        else if (flag === "l") list = true;
+        else if (flag === "v") {
+          list = true;
+          verbose = true;
+        } else if (flag === "C") caseInsensitive = true;
+        else if (flag === "u") {
+          update = true;
+          freshen = false;
+        } else if (flag === "f") {
+          update = true;
+          freshen = true;
+        } else if (flag === "x") {
+          excluding = true;
+          if (argument.length > offset + 1) exclusions.push(argument.slice(offset + 1));
+          break;
+        } else if (flag === "p") pipe = true;
+        else if (flag === "c") pipeHeaders = true;
+        else if (flag === "o") overwrite = true;
+        else if (flag === "n") neverOverwrite = true;
+        else if (flag === "j") junkPaths = true;
+        else if (flag === "d") {
+          if (destination !== void 0) fail("-d may only be specified once");
+          destination = argument.slice(offset + 1) || args[++index];
+          if (!destination) fail("must specify directory to which to extract with -d option");
+          checkPath(destination, limits);
+          break;
+        } else fail(`unsupported option: -${flag}`);
+      }
+    } else if (archive === void 0) archive = argument;
+    else (excluding ? exclusions : patterns).push(argument);
+  }
+  if (rawArguments) for (const [index, value] of rawArguments.values.entries()) {
+    if (!passwordArguments.has(index)) text(shellValueBytes(value));
+  }
+  pipeHeaders = pipeHeaders && !pipe;
+  pipe = pipe || pipeHeaders;
+  if (archive === void 0) fail("usage: unzip [-l|-v] [-C] [-u|-f] [-p|-c] [-t] [-z] [-Z -1] [-q[q]] [-o] [-n] [-j] [-d DIR] ARCHIVE [FILES...] [-x PATTERNS...]");
+  checkPath(archive, limits);
+  if (zipinfo && (!names || list || test || pipe || archiveComment || overwrite || destination !== void 0 || password !== void 0)) fail("supported zipinfo mode is unzip -Z -1 ARCHIVE [FILES...]");
+  if (archiveComment && (list || test || pipe || overwrite || destination !== void 0)) fail("archive comment mode cannot be combined with extraction, listing or test options");
+  if (test && (list || pipe || destination !== void 0)) fail("unzip test mode cannot be combined with listing, pipe or destination");
+  return { test, quiet, password, names, archiveComment, list: list && !pipe, verbose, caseInsensitive, update, freshen, exclusions, pipe, pipeHeaders, overwrite, neverOverwrite, junkPaths, destination, archive, patterns };
+}
+function tokenize(pattern, noWild, stopAtDirectories) {
+  const characters = Array.from(pattern);
+  const tokens = [];
+  for (let index = 0; index < characters.length; index++) {
+    const character = characters[index];
+    if (character === "*" && !noWild) {
+      let count = 1;
+      while (characters[index + 1] === "*") {
+        count++;
+        index++;
+      }
+      tokens.push({ kind: "star", crossDirectories: !stopAtDirectories || count > 1 });
+    } else if (character === "?") tokens.push({ kind: "any" });
+    else if (character === "\\" && !noWild) {
+      const escaped = characters[++index];
+      tokens.push(escaped === void 0 ? { kind: "never" } : { kind: "literal", value: escaped });
+    } else if (character === "[" && !noWild) {
+      const negative = characters[index + 1] === "!" || characters[index + 1] === "^";
+      if (negative) index++;
+      const ranges = [];
+      const start = index + 1;
+      let closing = start;
+      let escaped = false;
+      for (; closing < characters.length; closing++) {
+        const current = characters[closing];
+        if (escaped) escaped = false;
+        else if (current === "\\") escaped = true;
+        else if (current === "]") break;
+      }
+      let first;
+      escaped = characters[start] === "-";
+      for (let position = start; position < closing; position++) {
+        const current = characters[position];
+        if (!escaped && current === "\\") escaped = true;
+        else if (!escaped && current === "-") first = characters[position - 1].codePointAt(0);
+        else {
+          const last = current.codePointAt(0);
+          if (characters[position + 1] !== "-") ranges.push([first ?? last, last]);
+          first = void 0;
+          escaped = false;
+        }
+      }
+      index = closing;
+      tokens.push(closing < characters.length ? { kind: "class", ranges, negative } : { kind: "never" });
+    } else tokens.push({ kind: "literal", value: character });
+  }
+  return tokens;
+}
+var Selection = class {
+  constructor(patterns, limits, signal, options = {}) {
+    this.limits = limits;
+    this.signal = signal;
+    this.options = options;
+    this.patterns = patterns.map((pattern) => tokenize(options.caseInsensitive ? pattern.toLowerCase() : pattern, options.noWild === true, options.stopAtDirectories === true));
+    this.tailComponents = patterns.map((pattern) => pattern.split("/").length);
+    this.emptyTailMatch = patterns.map((pattern) => !options.noWild && (pattern === "*" || options.stopAtDirectories === true && pattern === "**"));
+  }
+  limits;
+  signal;
+  options;
+  work = 0;
+  patterns;
+  tailComponents;
+  emptyTailMatch;
+  matched = /* @__PURE__ */ new Set();
+  step() {
+    if (++this.work > this.limits.maxPatternSteps) fail("pattern work limit exceeded");
+  }
+  async matches(name, firstMatchOnly = false) {
+    if (!this.patterns.length) return true;
+    if (this.options.caseInsensitive) name = name.toLowerCase();
+    const fullCharacters = Array.from(name);
+    let selected = false;
+    for (let pattern = 0; pattern < this.patterns.length; pattern++) {
+      this.step();
+      const characters = this.options.trailingComponents ? Array.from(name.split("/").slice(-this.tailComponents[pattern]).join("/")) : fullCharacters;
+      if (this.options.trailingComponents && !characters.length && !this.emptyTailMatch[pattern]) continue;
+      let states = new Uint8Array(characters.length + 1);
+      states[0] = 1;
+      for (const token of this.patterns[pattern]) {
+        const next = new Uint8Array(states.length);
+        for (let index = 0; index < states.length; index++) {
+          this.step();
+          if (token.kind === "star") next[index] = states[index] || (index > 0 && (token.crossDirectories || characters[index - 1] !== "/") ? next[index - 1] : 0);
+          else if (states[index] && index < characters.length) {
+            const character = characters[index];
+            let match = token.kind === "any" && (!this.options.stopAtDirectories || character !== "/") || token.kind === "literal" && token.value === character;
+            if (token.kind === "class") {
+              let inRange = false;
+              for (const [first, last] of token.ranges) {
+                this.step();
+                if (character.codePointAt(0) >= first && character.codePointAt(0) <= last) inRange = true;
+              }
+              match = inRange !== token.negative;
+            }
+            if (match) next[index + 1] = 1;
+          }
+          if (this.work % 4096 === 0) await yieldTurn(this.signal);
+        }
+        states = next;
+      }
+      if (states[characters.length]) {
+        this.matched.add(pattern);
+        if (firstMatchOnly) return true;
+        selected = true;
+      }
+    }
+    return selected;
+  }
+};
+var Answers = class {
+  constructor(source, limits, signal) {
+    this.limits = limits;
+    this.signal = signal;
+    this.iterator = readBytes(source, signal)[Symbol.asyncIterator]();
+  }
+  limits;
+  signal;
+  iterator;
+  chunk = new Uint8Array();
+  offset = 0;
+  bytes = 0;
+  pulls = 0;
+  async read(maximum = 9) {
+    const answer = [];
+    while (answer.length < maximum) {
+      this.signal.throwIfAborted();
+      if (this.offset === this.chunk.length) {
+        if (++this.pulls > this.limits.maxPatternSteps) fail("overwrite input work limit exceeded");
+        if (this.pulls % 64 === 0) await yieldTurn(this.signal);
+        const next = await this.iterator.next();
+        if (next.done) break;
+        if (next.value.length > this.limits.maxFilesFromBytes - this.bytes) fail("overwrite input byte limit exceeded");
+        this.bytes += next.value.length;
+        this.chunk = Uint8Array.from(next.value);
+        this.offset = 0;
+        if (!this.chunk.length) continue;
+      }
+      const byte = this.chunk[this.offset++];
+      answer.push(byte);
+      if (byte === 10) break;
+    }
+    return answer.length ? decodeBytes(encodeBytes(answer), "utf8") : void 0;
+  }
+  async close() {
+    await this.iterator.return?.();
+  }
+};
+export {
+  Answers,
+  Selection,
+  parseArguments
+};

package/dist/safe-bash-zip-engine/zip/aes.d.ts

@@ -0,0 +1,17 @@
+import { type ByteSource } from "../../safe-bash-contracts/index.js";
+import type { ZipEncryption } from "./crypto.js";
+/** WinZip AES encryption specification 1.04, AE-1 and AE-2. */
+export interface ZipAes {
+    readonly strength: 128 | 192 | 256;
+    readonly version: 1 | 2;
+}
+export declare function zipEncryptionProfile(profile: string): ZipAes | undefined;
+export declare function aesParameters(aes: ZipAes): {
+    keyBytes: number;
+    saltBytes: number;
+};
+export declare function encryptAesPayload(source: ByteSource, encryption: ZipEncryption & {
+    aes: ZipAes;
+}, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
+export declare function decryptAesPayload(wire: Uint8Array, password: Uint8Array, aes: ZipAes, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
+export declare function aesExtra(aes: ZipAes, method: number): Uint8Array;

package/dist/safe-bash-zip-engine/zip/aes.js

@@ -0,0 +1,15 @@
+import {
+  aesExtra,
+  aesParameters,
+  decryptAesPayload,
+  encryptAesPayload,
+  zipEncryptionProfile
+} from "../../safe-bash/command-chunks/chunk-UXSR5BZH.js";
+import "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+export {
+  aesExtra,
+  aesParameters,
+  decryptAesPayload,
+  encryptAesPayload,
+  zipEncryptionProfile
+};

package/dist/safe-bash-zip-engine/zip/comments.d.ts

@@ -0,0 +1,17 @@
+import { type ByteSource } from "../../safe-bash-contracts/index.js";
+import { type ArchiveLimits } from "../../safe-bash-io-engine/commands/archive/internal.js";
+/** One bounded cursor for all comments; an input chunk may contain many lines. */
+export declare class ZipCommentInput {
+    private readonly limits;
+    private readonly signal;
+    readonly iterator: AsyncIterator<Uint8Array>;
+    private chunk;
+    private offset;
+    private bytes;
+    private pulls;
+    private ended;
+    constructor(source: ByteSource, limits: ArchiveLimits, signal: AbortSignal);
+    readLine(): Promise<Uint8Array | undefined>;
+}
+/** Info-ZIP's fgets/strlen archive-comment grammar, with explicit byte limits. */
+export declare function readZipComment(source: ByteSource | ZipCommentInput, limits: ArchiveLimits, signal: AbortSignal): Promise<Uint8Array>;

package/dist/safe-bash-zip-engine/zip/comments.js

@@ -0,0 +1,77 @@
+import {
+  init_buffer
+} from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip/comments.ts
+init_buffer();
+import { readBytes } from "../../safe-bash-contracts/index.js";
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { concatBytes, encodeBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { fail } from "../../safe-bash-io-engine/commands/archive/internal.js";
+var ZipCommentInput = class {
+  constructor(source, limits, signal) {
+    this.limits = limits;
+    this.signal = signal;
+    this.iterator = readBytes(source, signal)[Symbol.asyncIterator]();
+  }
+  limits;
+  signal;
+  iterator;
+  chunk = new Uint8Array();
+  offset = 0;
+  bytes = 0;
+  pulls = 0;
+  ended = false;
+  async readLine() {
+    const line = [];
+    while (line.length < 65535) {
+      this.signal.throwIfAborted();
+      if (this.offset === this.chunk.length) {
+        if (this.ended) break;
+        if (++this.pulls > this.limits.maxPatternSteps) fail("ZIP comment input work limit exceeded");
+        const next = await this.iterator.next();
+        if (next.done) {
+          this.ended = true;
+          break;
+        }
+        if (next.value.length > this.limits.maxFilesFromBytes - this.bytes) fail("ZIP comment input byte limit exceeded");
+        this.chunk = new Uint8Array(next.value);
+        this.offset = 0;
+        if (this.pulls % 64 === 0) await yieldTurn(this.signal);
+        if (!this.chunk.length) continue;
+      }
+      if (++this.bytes > this.limits.maxFilesFromBytes) fail("ZIP comment input byte limit exceeded");
+      const byte = this.chunk[this.offset++];
+      line.push(byte);
+      if (this.bytes % 4096 === 0) await yieldTurn(this.signal);
+      if (byte === 10) break;
+    }
+    if (!line.length) return void 0;
+    const zero = line.indexOf(0);
+    return Uint8Array.from(line.slice(0, zero < 0 ? void 0 : zero));
+  }
+};
+async function readZipComment(source, limits, signal) {
+  const input = source instanceof ZipCommentInput ? source : new ZipCommentInput(source, limits, signal);
+  const parts = [];
+  let length = 0;
+  try {
+    for (; ; ) {
+      const line = await input.readLine();
+      if (line === void 0 || line.length === 2 && line[0] === 46 && line[1] === 10) break;
+      const text = line.at(-1) === 10 ? line.subarray(0, -1) : line;
+      const separator = length || !text.length ? 2 : 0;
+      if (text.length + separator > Math.min(limits.maxTextBytes, 65535) - length) fail("ZIP archive comment byte limit exceeded");
+      if (separator) parts.push(encodeBytes("\r\n"));
+      if (text.length) parts.push(text);
+      length += separator + text.length;
+    }
+    return concatBytes(parts, length);
+  } finally {
+    await input.iterator.return?.();
+  }
+}
+export {
+  ZipCommentInput,
+  readZipComment
+};

package/dist/safe-bash-zip-engine/zip/crc.d.ts

@@ -0,0 +1 @@
+export { crcTable } from "../../safe-bash-compression-engine/crc.js";

package/dist/safe-bash-zip-engine/zip/crc.js

@@ -0,0 +1,7 @@
+import {
+  crcTable
+} from "../../safe-bash/command-chunks/chunk-H622NS6Z.js";
+import "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+export {
+  crcTable
+};

package/dist/safe-bash-zip-engine/zip/crypto.d.ts

@@ -0,0 +1,19 @@
+import { type ByteSource } from "../../safe-bash-contracts/index.js";
+import { PublicDiagnostic } from "../../safe-bash-contracts/diagnostics.js";
+import { type ZipHost } from "../../safe-bash-io-engine/commands/archive/internal.js";
+import type { ZipAes } from "./aes.js";
+/** Fixed capability diagnostics may be shown without credential-text filtering. */
+export declare class ZipHostFailure extends PublicDiagnostic {
+    readonly code: "no-echo" | "entropy" | "entropy-failed" | "entropy-bytes" | "prompt-failed" | "prompt-eof" | "password-bytes" | "password-empty" | "password-confirm";
+    constructor(code: "no-echo" | "entropy" | "entropy-failed" | "entropy-bytes" | "prompt-failed" | "prompt-eof" | "password-bytes" | "password-empty" | "password-confirm");
+}
+export interface ZipEncryption {
+    readonly aes?: ZipAes;
+    readonly password: Uint8Array;
+    readonly entropy: NonNullable<ZipHost["entropy"]>;
+}
+export declare function encryptZipPayload(source: ByteSource, encryption: ZipEncryption, verifier: number, signal: AbortSignal): ByteSource;
+export declare function decryptZipPayload(source: ByteSource, password: Uint8Array, verifier: number, signal: AbortSignal): ByteSource;
+export declare function readZipPassword(host: ZipHost | undefined, maxBytes: number, signal: AbortSignal, confirm: boolean): Promise<Uint8Array>;
+/** Traditional PKZIP byte transformation; callers own header/password checks. */
+export declare function zipCrypto(source: ByteSource, password: Uint8Array, decode: boolean, signal: AbortSignal): AsyncGenerator<Uint8Array>;