@poe-platform/safe-bash 0.1.799 → 0.1.801

package/dist/safe-bash/command-chunks/chunk-TIOCQVUQ.js

@@ -0,0 +1,557 @@
+import {
+  Exclusions
+} from "./chunk-5TBUOBDE.js";
+import {
+  Reader
+} from "./chunk-BNOU5YQS.js";
+import {
+  TransformedNames
+} from "./chunk-YOF7R4OY.js";
+import {
+  applyPax,
+  numberField,
+  parseHeader,
+  parsePax
+} from "./chunk-7N2LI2KO.js";
+import {
+  quoteName
+} from "./chunk-C7I25AAL.js";
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-tar/src/extract.ts
+init_buffer();
+import { dirname, isPathWithin, resolvePath, retainFileSystemCleanup } from "@poe-platform/safe-fs/core";
+import { collectBytes, writeBytes } from "../../safe-bash-contracts/index.js";
+import { byteLength } from "../../safe-bash-io-engine/byte-encoding.js";
+import { checkPath, display, fail, fileSource, hasIdentity, maybeStat, operation, sameIdentity, text, vfsPath } from "../../safe-bash-io-engine/commands/archive/internal.js";
+async function* extractionInput(context, path, limits) {
+  const capabilities = await context.fs.capabilitiesFor?.(path, { signal: context.signal }) ?? context.fs.capabilities;
+  if (!context.fs.openReadFile || capabilities.retainedRead !== true) {
+    yield* fileSource(context, path, limits);
+    return;
+  }
+  const handle = await context.fs.openReadFile(path, { signal: context.signal });
+  try {
+    let position = 0;
+    while (true) {
+      const bytes = await handle.read(position, limits.chunkSize, { signal: context.signal });
+      if (!bytes.length) break;
+      position += bytes.length;
+      yield bytes;
+    }
+  } finally {
+    await handle.close();
+  }
+}
+function relativeName(name, strip) {
+  if (name.includes("\0")) fail("NUL in member name");
+  const components = name.replace(/^\/+/u, "").split("/").filter((component) => component !== "");
+  if (components.includes("..")) fail(`unsafe parent component in member: ${display(name)}`);
+  const stripped = components.slice(strip).filter((component) => component !== ".");
+  if (components.length <= strip) return void 0;
+  return stripped.join("/");
+}
+async function checkRoot(context, root) {
+  const ancestors = [];
+  const slashStat = await operation(context, () => context.fs.lstat("/", { signal: context.signal }));
+  if (slashStat.type !== "directory") fail(`not an extraction directory: /`);
+  ancestors.push({ path: "/", stat: slashStat });
+  if (root === "/") return ancestors;
+  const parts = root.split("/").filter(Boolean);
+  let path = "/";
+  for (let i = 0; i < parts.length; i++) {
+    path = resolvePath(path, parts[i]);
+    const stat = await operation(context, () => context.fs.lstat(path, { signal: context.signal }));
+    if (stat.type !== "directory") fail(`extraction root has a non-directory or symlink ancestor: ${display(path)}`);
+    ancestors.push({ path, stat });
+  }
+  return ancestors;
+}
+async function parents(context, root, path, create, allowMissing = false) {
+  if (!isPathWithin(root, path)) fail("extraction path escapes root");
+  const ancestors = await checkRoot(context, root);
+  const relative = path.slice(root === "/" ? 1 : root.length + 1);
+  let parent = root;
+  for (const component of relative.split("/").slice(0, -1)) {
+    if (!component) continue;
+    parent = resolvePath(parent, component);
+    let stat = await maybeStat(context, parent);
+    if (!stat && create) {
+      if (!context.fs.prepareDirectory) fail("extraction requires conditional directory creation");
+      const identity = ancestors.at(-1).stat;
+      await context.fs.prepareDirectory(parent, { signal: context.signal, parent: identity, expected: null, mode: 448 });
+      stat = await context.fs.lstat(parent, { signal: context.signal });
+    } else if (!stat && !allowMissing || stat && stat.type !== "directory") fail(`unsafe non-directory or symlink ancestor: ${display(parent)}`);
+    if (stat) ancestors.push({ path: parent, stat });
+  }
+  return ancestors;
+}
+async function removeExisting(context, path, stat) {
+  if (!stat) return;
+  const parent = await context.fs.lstat(dirname(path), { signal: context.signal });
+  if (stat.type === "file") {
+    if (!context.fs.removeFileConditional) fail("extraction requires conditional file removal");
+    await context.fs.removeFileConditional(path, { signal: context.signal, expected: stat, parent });
+  } else {
+    if (!context.fs.removeEntryConditional) fail("extraction requires conditional entry removal");
+    await context.fs.removeEntryConditional(path, { signal: context.signal, expected: stat, parent });
+  }
+}
+async function checkSymlinkTarget(context, root, path, target, budget) {
+  if (target.startsWith("/")) fail(`symlink target escapes extraction root: ${display(path)}`);
+  let current = dirname(path);
+  let pending = target.split("/");
+  let links = 0;
+  let steps = 0;
+  const safeComponents = (value) => {
+    const components = value.split("/");
+    let descended = false;
+    for (const component of components) {
+      if (component === ".." && descended) fail("symlink targets with non-leading '..' components are unsafe under later link replacement");
+      if (component !== ".." && component !== "." && component !== "") descended = true;
+    }
+    return components;
+  };
+  pending = safeComponents(target);
+  while (pending.length) {
+    if (++steps > budget.limits.maxDepth * 41) fail("symlink target resolution limit exceeded");
+    const component = pending.shift();
+    if (!component || component === ".") continue;
+    if (component === "..") {
+      if (current === root) fail(`symlink target escapes extraction root: ${display(path)}`);
+      current = dirname(current);
+      continue;
+    }
+    const candidate = resolvePath(current, component);
+    if (!isPathWithin(root, candidate)) fail("symlink target escapes extraction root");
+    const stat = await maybeStat(context, candidate);
+    if (stat?.type === "symlink") {
+      if (++links > 40 || !context.fs.readlink) fail("symlink target chain cannot be safely resolved");
+      const link = await operation(context, () => context.fs.readlink(candidate, { signal: context.signal }));
+      checkPath(link, budget.limits);
+      if (link.startsWith("/")) {
+        if (root !== "/" && link !== root && !link.startsWith(`${root}/`)) fail("symlink target chain escapes extraction root");
+        current = root;
+        pending = [...safeComponents(link.slice(root === "/" ? 1 : root.length)), ...pending];
+      } else pending = [...safeComponents(link), ...pending];
+    } else current = candidate;
+  }
+}
+async function metadata(context, path, entry, options) {
+  const { fs, signal } = context;
+  const capabilities = await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities;
+  if (options.metadata.permissions === true && capabilities.permissions === false) fail("filesystem does not support restoring archive permissions");
+  if (!fs.prepareDirectory) fail("extraction requires conditional metadata");
+  const expected = await fs.lstat(path, { signal });
+  const parent = await fs.lstat(dirname(path), { signal });
+  await fs.prepareDirectory(path, {
+    signal,
+    expected,
+    parent,
+    ...capabilities.permissions === false ? {} : { mode: entry.mode & (options.metadata.permissions === false ? 493 : 511) },
+    ...options.metadata.touch || capabilities.timestamps === false ? {} : {
+      ...entry.atime === void 0 && (entry.atimeDeleted || entry.mtime === void 0) ? {} : { atimeMs: (entry.atime ?? entry.mtime) * 1e3 },
+      ...entry.mtime === void 0 ? {} : { mtimeMs: entry.mtime * 1e3 }
+    }
+  });
+}
+var stagingSerial = 0;
+async function stageEntry(context, path, source, existing, entry, options, budget, preparedAncestors) {
+  const { fs, signal } = context;
+  const capabilities = await fs.capabilitiesFor?.(path, { signal, create: true, stagingAncestry: true }) ?? fs.capabilities;
+  if (capabilities.atomicFileStaging !== true && capabilities.trustedOwnedStaging !== true || capabilities.atomicStagingAncestry !== true || !fs.createStagedFile || !fs.publishStagedFile || !fs.removeStagedFile) fail("extraction requires atomic staging and ancestry verification");
+  let ancestors;
+  if (preparedAncestors) {
+    ancestors = preparedAncestors;
+  } else {
+    ancestors = [];
+    let current = "/";
+    for (const component of ["", ...dirname(path).split("/").filter(Boolean)]) {
+      if (component) current = resolvePath(current, component);
+      const stat = await fs.lstat(current, { signal });
+      if (stat.type !== "directory") fail("unsafe extraction ancestor");
+      ancestors.push({ path: current, stat });
+    }
+  }
+  const parent = ancestors.at(-1).stat;
+  let staging;
+  const cleanup = retainFileSystemCleanup(fs, async (view) => {
+    if (staging?.cleanup) await staging.cleanup.remove();
+    else if (staging) await view.removeStagedFile(staging);
+  }, { maxOperations: Math.min(4096, budget.limits.maxDepth + 3) });
+  let failure;
+  try {
+    const maximum = Math.min(budget.limits.maxEntryBytes, budget.limits.maxBufferedFileBytes);
+    const streaming = entry.type !== "2" && capabilities.retainedStagingWrite === true && capabilities.retainedStagingCleanup === true;
+    const data = entry.type === "2" ? void 0 : streaming ? new Uint8Array() : await collectBytes(source, { signal, ...Number.isFinite(maximum) ? { maxBytes: maximum } : {} });
+    for (let attempt = 0; attempt < budget.limits.maxMembers; attempt++) {
+      const temporary = resolvePath(dirname(path), `.tar-${++stagingSerial}`);
+      checkPath(`${temporary}/entry`, budget.limits);
+      if (temporary === path) continue;
+      try {
+        staging = await fs.createStagedFile(temporary, "entry", entry.type === "2" ? { type: "symlink", target: entry.linkname } : { type: "file", data }, {
+          signal,
+          parent,
+          ...capabilities.retainedStagingCleanup === true ? { retainCleanup: true } : {},
+          ...entry.type === "2" || capabilities.permissions === false ? {} : { mode: entry.mode & (options.metadata.permissions === false ? 493 : 511) },
+          ...entry.type === "2" || options.metadata.touch || capabilities.timestamps === false ? {} : {
+            ...entry.atime === void 0 && (entry.atimeDeleted || entry.mtime === void 0) ? {} : { atimeMs: (entry.atime ?? entry.mtime) * 1e3 },
+            ...entry.mtime === void 0 ? {} : { mtimeMs: entry.mtime * 1e3 }
+          }
+        });
+        break;
+      } catch (error) {
+        signal.throwIfAborted();
+        if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "EEXIST") throw error;
+      }
+    }
+    if (!staging) fail("temporary file attempt limit exceeded");
+    if (streaming) {
+      const writer = staging.writer;
+      if (!writer) fail("filesystem did not return a retained staged writer");
+      let written = 0;
+      const flushThreshold = Math.min(65536, budget.limits.chunkSize);
+      let buf;
+      let bufUsed = 0;
+      for await (const bytes of source) {
+        signal.throwIfAborted();
+        if (bytes.byteLength > maximum - written) fail("entry byte limit exceeded");
+        written += bytes.byteLength;
+        if (bytes.byteLength >= flushThreshold) {
+          if (bufUsed > 0) {
+            await writer.write(buf.subarray(0, bufUsed), { signal });
+            bufUsed = 0;
+          }
+          await writer.write(bytes, { signal });
+        } else {
+          if (!buf) buf = new Uint8Array(flushThreshold);
+          if (bufUsed + bytes.byteLength > flushThreshold) {
+            await writer.write(buf.subarray(0, bufUsed), { signal });
+            bufUsed = 0;
+          }
+          buf.set(bytes, bufUsed);
+          bufUsed += bytes.byteLength;
+        }
+      }
+      if (bufUsed > 0) {
+        await writer.write(buf.subarray(0, bufUsed), { signal });
+      }
+      const stat = await writer.finish({ signal });
+      staging = { ...staging, file: { ...staging.file, stat } };
+    }
+    await fs.publishStagedFile(staging, path, { signal, parent, destination: existing ?? null, ancestors });
+  } catch (reason) {
+    failure = { reason };
+  }
+  try {
+    await cleanup();
+  } catch (reason) {
+    if (failure) throw new AggregateError([failure.reason, reason], "tar publication and cleanup failed");
+    throw reason;
+  }
+  if (failure) throw failure.reason;
+}
+function verbose(entry, options) {
+  const type = entry.type === "5" ? "d" : entry.type === "2" ? "l" : entry.type === "1" ? "h" : "-";
+  let permissions = "";
+  for (const bit of [256, 128, 64, 32, 16, 8, 4, 2, 1]) permissions += entry.mode & bit ? bit & 292 ? "r" : bit & 146 ? "w" : "x" : "-";
+  for (const [offset, special, execute, lower, upper] of [[2, 2048, 64, "s", "S"], [5, 1024, 8, "s", "S"], [8, 512, 1, "t", "T"]]) {
+    if (entry.mode & special) permissions = permissions.slice(0, offset) + (entry.mode & execute ? lower : upper) + permissions.slice(offset + 1);
+  }
+  const suffix = entry.type === "2" ? ` -> ${quoteName(entry.linkname, options.quotingStyle)}` : entry.type === "1" ? ` link to ${quoteName(entry.linkname, options.quotingStyle)}` : "";
+  let timestamp = entry.mtime ?? "-";
+  if ((options.utc || options.metadata.fullTime) && entry.mtime !== void 0) {
+    const iso = new Date((options.utc ? Math.floor(entry.mtime) : entry.mtime) * 1e3).toISOString().split("T").join(" ");
+    timestamp = options.utc ? iso.slice(0, options.metadata.fullTime ? 19 : 16) : iso.slice(0, -1);
+    if (options.utc && options.metadata.fullTime) {
+      let fraction = entry.mtime.toLocaleString("en-US", { useGrouping: false, maximumFractionDigits: 9 }).split(".")[1] ?? "";
+      if (entry.mtime < 0 && fraction) fraction = String(10n ** BigInt(fraction.length) - BigInt(fraction)).padStart(fraction.length, "0");
+      while (fraction.endsWith("0")) fraction = fraction.slice(0, -1);
+      if (fraction) timestamp += `.${fraction}`;
+    }
+  }
+  const owner = `${entry.uid ?? "-"}/${entry.gid ?? "-"}`;
+  const size = options.utc ? String(entry.size).padStart(Math.max(1, 18 - owner.length)) : entry.size;
+  return `${type}${permissions} ${owner} ${size} ${timestamp} ${quoteName(entry.name, options.quotingStyle)}${suffix}
+`;
+}
+async function readArchive(context, source, options, budget, visitor) {
+  if (options.mode === "x" && !options.toStdout && !visitor) {
+    if (!context.fs.confineExtraction) fail("filesystem does not support race-safe archive extraction");
+    const fs = await operation(context, () => context.fs.confineExtraction(
+      [...new Set([options.cwd, ...options.operands.map((operand) => operand.cwd)].map((root) => resolvePath(root)))],
+      { signal: context.signal }
+    ));
+    context = { ...context, fs };
+  }
+  const reader = new Reader(source, context.signal);
+  const exclusions = new Exclusions(options.excludes, budget.limits.maxPatternSteps);
+  const transformedNames = new TransformedNames(context, options.transforms, budget.limits);
+  const global = /* @__PURE__ */ new Map();
+  let local = /* @__PURE__ */ new Map();
+  let pending = false;
+  let memberStart = 0;
+  let longName;
+  let longLink;
+  let warnedAbsolute = false;
+  let keptExisting = false;
+  const matched = /* @__PURE__ */ new Set();
+  const occurrences = /* @__PURE__ */ new Map();
+  const selectors = options.wildcards ? options.operands.map((operand) => new Exclusions([operand.name], budget.limits.maxPatternSteps, true)) : [];
+  const published = /* @__PURE__ */ new Map();
+  const directories = /* @__PURE__ */ new Map();
+  let archivePath;
+  let archiveStat;
+  if (options.mode === "x" && !options.toStdout && options.archive !== "-") {
+    archivePath = await operation(context, () => context.fs.realpath(vfsPath(context.cwd, options.archive), { signal: context.signal }));
+    archiveStat = await operation(context, () => context.fs.stat(archivePath, { signal: context.signal }));
+  }
+  if (options.mode === "x" && !options.toStdout) await checkRoot(context, options.cwd);
+  try {
+    while (true) {
+      let block;
+      if (options.ignoreZeros) {
+        const first = await reader.take(1);
+        if (!first) {
+          if (reader.position === 0) fail("truncated archive");
+          if (pending) fail("orphan extended header at end of archive");
+          break;
+        }
+        block = new Uint8Array(512);
+        block[0] = first[0];
+        block.set(await reader.exact(511), 1);
+      } else block = await reader.exact(512);
+      if (block.every((byte) => byte === 0)) {
+        if (options.ignoreZeros) {
+          if (!pending) memberStart = reader.position;
+          continue;
+        }
+        if (!(await reader.exact(512)).every((byte) => byte === 0)) fail("missing second end-of-archive block");
+        if (pending) fail("orphan extended header at end of archive");
+        await reader.finish();
+        break;
+      }
+      const header = parseHeader(block);
+      await budget.member();
+      if (["x", "g", "L", "K"].includes(header.type)) {
+        if (header.type === "g" && visitor?.rejectGlobal) fail("global PAX headers are unsupported for archive mutation");
+        const size = numberField(block, 124, 12);
+        if (size > budget.limits.maxPaxBytes) fail("extended header byte limit exceeded");
+        const payload = await reader.exact(size);
+        await reader.padding(size);
+        if (header.type === "x" || header.type === "g") {
+          const values = parsePax(payload);
+          if (header.type === "g") {
+            for (const [key, value] of values) global.set(key, value);
+          } else {
+            for (const [key, value] of values) local.set(key, value);
+            pending = true;
+          }
+          for (const state of [global, local]) {
+            if ([...state].reduce((size2, [key, value]) => size2 + byteLength(key) + byteLength(value), 0) > budget.limits.maxPaxBytes) fail("PAX state byte limit exceeded");
+          }
+        } else {
+          if (payload.length === 0 || payload.at(-1) !== 0) fail("invalid GNU long-name record");
+          const value = text(payload.subarray(0, -1));
+          checkPath(value, budget.limits);
+          if (header.type === "L") longName = value;
+          else longLink = value;
+          pending = true;
+        }
+        continue;
+      }
+      const entry = applyPax(header, global, local, longName, longLink);
+      local = /* @__PURE__ */ new Map();
+      pending = false;
+      longName = void 0;
+      longLink = void 0;
+      checkPath(entry.name, budget.limits);
+      if (entry.mtime !== void 0 && (!Number.isFinite(entry.mtime) || Math.abs(entry.mtime * 1e3) > 864e13)) fail("archive timestamp is outside the supported range");
+      if (entry.linkname) checkPath(entry.linkname, budget.limits);
+      if (entry.type === "0" && entry.name.endsWith("/")) entry.type = "5";
+      if (!["0", "1", "2", "5"].includes(entry.type)) fail(`unsupported archive entry type: ${display(entry.type)}`);
+      if (entry.type !== "0" && entry.size !== 0) fail("non-file entry has a nonzero payload size");
+      if (entry.size > budget.limits.maxEntryBytes) fail("entry byte limit exceeded");
+      if (entry.size > budget.limits.maxTotalBytes - budget.totalBytes) fail("total payload byte limit exceeded");
+      budget.totalBytes += entry.size;
+      let relative;
+      const effectiveEntryName = options.mode === "x" && options.transforms.length ? await transformedNames.apply(entry.name) : entry.name;
+      if (options.mode === "x" && options.transforms.length && entry.linkname) entry.linkname = await transformedNames.apply(entry.linkname);
+      if (options.mode === "x") relative = relativeName(effectiveEntryName, options.strip);
+      const name = entry.name.replace(/^\/+/u, "");
+      const normalizedName = name.replace(/^(?:\.\/)+/u, "");
+      let selected = options.operands.length === 0;
+      let root = resolvePath(options.cwd);
+      for (let index = 0; index < options.operands.length; index++) {
+        const operand = options.operands[index];
+        const wanted = operand.name.replace(/^\/+/u, "").replace(/\/+$/u, "");
+        const normalizedWanted = wanted.replace(/^(?:\.\/)+/u, "");
+        const plainName = name.replace(/\/+$/u, "");
+        const plainNormalized = normalizedName.replace(/\/+$/u, "");
+        if (options.wildcards ? selectors[index].matches(plainName) || selectors[index].matches(plainNormalized) : plainName === wanted || name.startsWith(`${wanted}/`) || normalizedWanted !== "" && (plainNormalized === normalizedWanted || normalizedName.startsWith(`${normalizedWanted}/`))) {
+          if (options.occurrence !== void 0) {
+            const count = (occurrences.get(index) ?? 0) + 1;
+            occurrences.set(index, count);
+            if (count !== options.occurrence) continue;
+          }
+          if (!selected) {
+            if (options.mode === "x" && !options.toStdout) await checkRoot(context, operand.cwd);
+            root = resolvePath(operand.cwd);
+          }
+          selected = true;
+          matched.add(index);
+        }
+      }
+      if (visitor) {
+        await visitor.member(entry, reader, selected && !exclusions.matches(name), root, memberStart);
+        await reader.padding(entry.size);
+        memberStart = reader.position;
+        continue;
+      }
+      if (!selected || exclusions.matches(name)) {
+        await reader.discard(entry.size);
+        await reader.padding(entry.size);
+        continue;
+      }
+      if (options.mode === "t") {
+        let baseName = entry.name;
+        if (options.strip > 0) {
+          const stripped = relativeName(entry.name, options.strip);
+          if (stripped === void 0) {
+            await reader.discard(entry.size);
+            await reader.padding(entry.size);
+            continue;
+          }
+          baseName = entry.name.endsWith("/") && stripped ? `${stripped}/` : stripped;
+        }
+        const shown = options.showTransformedNames ? {
+          ...entry,
+          name: await transformedNames.apply(baseName),
+          linkname: entry.linkname ? await transformedNames.apply(entry.linkname) : entry.linkname
+        } : { ...entry, name: baseName };
+        await budget.output(options.verbose ? verbose(shown, options) : `${quoteName(shown.name, options.quotingStyle)}
+`);
+        await reader.discard(entry.size);
+        await reader.padding(entry.size);
+        continue;
+      }
+      if (entry.name.startsWith("/") && !warnedAbsolute) {
+        await budget.output("tar: removing leading '/' from member names\n", true);
+        warnedAbsolute = true;
+      }
+      if (relative === void 0) {
+        await reader.discard(entry.size);
+        await reader.padding(entry.size);
+        continue;
+      }
+      if (options.toStdout) {
+        if (options.verbose) await budget.output(`${quoteName(entry.name, options.quotingStyle)}
+`, true);
+        for await (const chunk of reader.body(entry.size)) await writeBytes(context.stdout, chunk, context.signal);
+        await reader.padding(entry.size);
+        continue;
+      }
+      const path = resolvePath(root, relative);
+      if (path === root && entry.type !== "5") fail("non-directory entry would replace extraction root");
+      let hardTarget;
+      if (entry.type === "2") {
+        await parents(context, root, path, false, true);
+        checkPath(entry.linkname, budget.limits);
+        await checkSymlinkTarget(context, root, path, entry.linkname, budget);
+        if (!context.fs.symlink || context.fs.capabilities.symlinks === false) fail("filesystem does not support symbolic links");
+      } else if (entry.type === "1") {
+        checkPath(entry.linkname, budget.limits);
+        const targetName = relativeName(entry.linkname, options.strip);
+        if (targetName === void 0) fail("hardlink target removed by strip-components");
+        hardTarget = resolvePath(root, targetName);
+        if (hardTarget === path) fail("self-referential hardlink entry is unsupported");
+        if (!published.has(hardTarget)) fail(`hardlink target was not previously extracted (forward or unselected target): ${display(entry.linkname)}`);
+        await parents(context, root, hardTarget, false);
+        const targetStat = await operation(context, () => context.fs.lstat(hardTarget, { signal: context.signal }));
+        if (targetStat.type !== "file" || published.get(hardTarget).identityScope !== void 0 && !sameIdentity(published.get(hardTarget), targetStat)) fail("hardlink target changed or is not a regular file");
+        if (!context.fs.link || context.fs.capabilities.hardlinks === false) fail("filesystem does not support hardlinks");
+      }
+      if (options.metadata.delayDirectories === false) {
+        for (const [directory, value] of [...directories].sort(([first], [second]) => second.length - first.length)) {
+          if (path === directory || isPathWithin(directory, path)) continue;
+          await parents(context, value.root, directory, false);
+          const stat = await operation(context, () => context.fs.lstat(directory, { signal: context.signal }));
+          if (stat.type !== "directory") fail("directory changed before metadata restoration");
+          await metadata(context, directory, value.entry, options);
+          directories.delete(directory);
+        }
+      }
+      const preparedAncestors = await parents(context, root, path, true);
+      if (options.metadata.permissions === true && entry.type !== "2" && entry.type !== "1") {
+        const capabilities = await operation(context, () => context.fs.capabilitiesFor?.(path, { signal: context.signal }) ?? context.fs.capabilities);
+        if (!context.fs.prepareDirectory || capabilities.permissions === false) fail("filesystem does not support restoring archive permissions");
+      }
+      const existing = await maybeStat(context, path);
+      if (archivePath && (path === archivePath || existing && archiveStat && sameIdentity(existing, archiveStat))) fail("entry would overwrite the input archive");
+      if (existing && !(entry.type === "5" && existing.type === "directory") && options.overwrite !== "replace") {
+        if (options.overwrite === "keep") {
+          await budget.output(`tar: ${display(entry.name)}: Cannot open: File exists
+`, true);
+          keptExisting = true;
+        }
+        await reader.discard(entry.size);
+        await reader.padding(entry.size);
+        continue;
+      }
+      if (existing?.type === "file" && archiveStat && (!hasIdentity(existing) || !hasIdentity(archiveStat))) fail("cannot replace an existing file with unknown input-archive/destination backing identity");
+      if (entry.type === "2") {
+        const hadNonFile = Boolean(existing && existing.type !== "file");
+        if (hadNonFile) await removeExisting(context, path, existing);
+        published.delete(path);
+        directories.delete(path);
+        await stageEntry(context, path, reader.body(0), existing?.type === "file" ? existing : void 0, entry, options, budget, hadNonFile ? void 0 : preparedAncestors);
+      } else if (entry.type === "1") {
+        await removeExisting(context, path, existing);
+        published.delete(path);
+        directories.delete(path);
+        await operation(context, () => context.fs.link(hardTarget, path, { signal: context.signal }));
+        published.set(path, await operation(context, () => context.fs.lstat(path, { signal: context.signal })));
+      } else if (entry.type === "5") {
+        if (existing?.type !== "directory") {
+          await removeExisting(context, path, existing);
+          if (!context.fs.prepareDirectory) fail("extraction requires conditional directory creation");
+          const parent = await context.fs.lstat(dirname(path), { signal: context.signal });
+          await context.fs.prepareDirectory(path, { signal: context.signal, expected: null, parent, mode: 448 });
+        }
+        published.delete(path);
+        directories.set(path, { root, entry });
+      } else {
+        const hadNonFile = Boolean(existing && existing.type !== "file");
+        if (hadNonFile) await removeExisting(context, path, existing);
+        published.delete(path);
+        directories.delete(path);
+        await stageEntry(context, path, reader.body(entry.size), existing?.type === "file" ? existing : void 0, entry, options, budget, hadNonFile ? void 0 : preparedAncestors);
+        published.set(path, await operation(context, () => context.fs.lstat(path, { signal: context.signal })));
+      }
+      await reader.padding(entry.size);
+      const shownExtractName = options.showTransformedNames ? options.strip > 0 && relative !== void 0 ? effectiveEntryName.endsWith("/") && relative ? `${relative}/` : relative : effectiveEntryName : entry.name;
+      if (options.verbose) await budget.output(`${quoteName(shownExtractName, options.quotingStyle)}
+`);
+    }
+    for (let index = 0; index < options.operands.length; index++) if (!matched.has(index)) fail(`member not found: ${display(options.operands[index].name)}`);
+    for (const [path, value] of [...directories].sort(([first], [second]) => second.length - first.length)) {
+      await parents(context, value.root, path, false);
+      const stat = await operation(context, () => context.fs.lstat(path, { signal: context.signal }));
+      if (stat.type !== "directory") fail("directory changed before metadata restoration");
+      await metadata(context, path, value.entry, options);
+    }
+    if (keptExisting) fail("Exiting with failure status due to previous errors");
+    if (options.totals) await budget.output(`Total bytes read: ${reader.position}
+`, true);
+  } finally {
+    void reader.close().catch(() => {
+    });
+  }
+}
+
+export {
+  extractionInput,
+  readArchive
+};

package/dist/safe-bash/command-chunks/{chunk-T5H5UJQ3.js → chunk-TNOA7FCQ.js}

@@ -1,6 +1,6 @@
 import {
   ProgramError
-} from "./chunk-HLGKIZ25.js";
+} from "./chunk-F6OYH562.js";
 import {
   init_buffer
 } from "./chunk-HX3SHTCE.js";

package/dist/safe-bash/command-chunks/{chunk-GN2TKLE7.js → chunk-TS65BJHG.js}

@@ -4,11 +4,11 @@ import {
 
 // packages/safe-bash-command-comm/src/comm.ts
 init_buffer();
-import { argument, Budget, command, compare, encode, fail, Inputs, OrderCheck, settings } from "../../safe-bash-table-text-engine/table-text/internal.js";
+import { argument, command, compare, encode, fail, Inputs, OrderCheck, settings } from "../../safe-bash-table-text-engine/table-text/internal.js";
 function createCommCommand(options = {}) {
   const limits = settings(options);
-  return command("comm", async (context) => {
-    const budget = new Budget(context, limits), files = [], suppressed = /* @__PURE__ */ new Set();
+  return command("comm", limits, async (context, budget) => {
+    const files = [], suppressed = /* @__PURE__ */ new Set();
     let separator = 10, delimiter = Uint8Array.of(9), literal = false, total = false, mode = "default";
     let delimiterSet = false;
     for (let index = 0; index < context.args.length; index++) {
@@ -52,7 +52,7 @@ function createCommCommand(options = {}) {
       } else fail(`unsupported option ${token}`);
     }
     if (files.length !== 2) fail("comm requires exactly two files");
-    const inputs = new Inputs(context, budget, separator), order = new OrderCheck(mode, context), terminator = Uint8Array.of(separator);
+    const inputs = new Inputs(context, budget, separator), order = new OrderCheck(mode, context, budget), terminator = Uint8Array.of(separator);
     try {
       const readers = [await inputs.open(files[0]), await inputs.open(files[1])];
       const rows = [await readers[0].next(), await readers[1].next()];
@@ -64,7 +64,7 @@ function createCommCommand(options = {}) {
         const comparison = rows[0] === void 0 ? 1 : rows[1] === void 0 ? -1 : compare(rows[0], rows[1]);
         const column = comparison < 0 ? 0 : comparison > 0 ? 1 : 2;
         totals[column] = totals[column] + 1n;
-        if (column !== 2) order.unpaired = true;
+        if (column !== 2) await order.markUnpaired();
         if (!suppressed.has(column)) {
           const parts = [];
           for (let index = 0; index < column; index++) if (!suppressed.has(index)) parts.push(delimiter);