@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/safe-bash/command-chunks/{chunk-II77KPZN.js → chunk-JWW6FYBN.js}

@@ -1,9 +1,9 @@
 import {
   Interpreter
-} from "./chunk-ZYHTWNAE.js";
+} from "./chunk-UAW423ZL.js";
 import {
   parse
-} from "./chunk-NKFYQSES.js";
+} from "./chunk-4CTI3ZTX.js";
 import {
   Budget,
   JqLimitError,

package/dist/safe-bash/command-chunks/{chunk-ZYXH3B66.js → chunk-LCJWKTCJ.js}

@@ -64,10 +64,11 @@ function parseUrl(text, redirect = false) {
   url.hash = "";
   return { url, ...user === void 0 ? {} : { user } };
 }
-function requestHeaders(args, contentType, user, scoped, maxBytes, previous) {
+function requestHeaders(args, contentType, user, scoped, maxBytes, previous, cookie) {
   const json = args.data[0]?.kind === "json";
   if (json) contentType = "application/json";
   const defaults = [["Accept", json ? "application/json" : "*/*"]];
+  if (cookie) defaults.push(["Cookie", cookie]);
   if (args.agent !== "") defaults.push(["User-Agent", args.agent ?? "virtual-bash-curl/0.0"]);
   if (contentType !== void 0) defaults.push(["Content-Type", contentType]);
   if (args.compressed) defaults.push(["Accept-Encoding", "gzip, deflate"]);
@@ -94,6 +95,39 @@ function requestHeaders(args, contentType, user, scoped, maxBytes, previous) {
   }
   return result;
 }
+async function readCookies(context, args, limits, signal) {
+  const cookies = [];
+  for (const input of args.cookies ?? []) {
+    if (input.includes("=")) {
+      validateRequestHeader("Cookie", input);
+      cookies.push({ name: "", value: input });
+      continue;
+    }
+    if (!input) continue;
+    let bytes;
+    try {
+      bytes = input === "-" ? await collectBytes(context.stdin, { signal, maxBytes: limits.maxBufferBytes }) : await withSignal(() => context.fs.readFile(pathOf(context, input), { signal, ...Number.isFinite(limits.maxBufferBytes) ? { maxBytes: limits.maxBufferBytes } : {} }), signal);
+    } catch (error) {
+      signal.throwIfAborted();
+      if (error instanceof FsError && error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (bytes.length > limits.maxBufferBytes) throw new CurlError(63, "Cookie file exceeds host buffer limit");
+    for (let line of new TextDecoder().decode(bytes).split("\n")) {
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      if (line.startsWith("#HttpOnly_")) line = line.slice(10);
+      else if (line.startsWith("#")) continue;
+      const fields = line.split("	");
+      if (fields.length !== 7) continue;
+      const [domain, subdomains, path, secure, expires, name, value] = fields;
+      if (!["TRUE", "FALSE"].includes(subdomains) || !["TRUE", "FALSE"].includes(secure) || !Number.isFinite(Number(expires))) continue;
+      validateRequestHeader("Cookie", `${name}=${value}`);
+      cookies.push({ name, value, domain: domain.toLowerCase().startsWith(".") ? domain.slice(1).toLowerCase() : domain.toLowerCase(), subdomains: subdomains === "TRUE", path, secure: secure === "TRUE", expires: Number(expires) });
+      if (cookies.length % 256 === 0) await yieldTurn(signal);
+    }
+  }
+  return cookies;
+}
 async function stop(response, signal) {
   if (!response) return;
   const cleanup = Promise.resolve().then(() => response.dispose());
@@ -163,9 +197,10 @@ function createTransferCommand(options, profile) {
           await writeBytes(context.stdout, encode(args.version ? profile.version : profile.help), context.signal);
           return { exitCode: 0 };
         }
-        if (args.connectTimeoutMs !== void 0 && transport.supportsConnectTimeout !== true) {
+        if (args.connectTimeoutMs !== void 0 && transport.supportsConnectTimeout !== true && transport.supportsResponseHeaderTimeout !== true) {
           throw new CurlError(2, "Transport cannot enforce connection timeout");
         }
+        if (args.insecure && transport.supportsInsecureTls !== true) throw new CurlError(2, "Transport cannot disable TLS verification");
         if (args.caFile !== void 0 && transport.supportsRequestCa !== true) {
           throw new CurlError(2, "Transport cannot enforce request CA trust");
         }
@@ -304,6 +339,7 @@ async function transfer(context, args, input, limits, transport, authorize, star
     }
     const parsed = parseUrl(input);
     const initial = parsed.url;
+    const cookies = await readCookies(context, args, limits, signal);
     const rawTarget = curlRequestTarget(input);
     let initialTarget = rawTarget;
     const initialSearch = initial.search;
@@ -350,62 +386,69 @@ async function transfer(context, args, input, limits, transport, authorize, star
     const initialRequestMethod = args.head || args.download?.spider ? "HEAD" : args.get ? "GET" : args.upload !== void 0 ? "PUT" : body ? "POST" : "GET";
     const initialMethod = args.method ?? initialRequestMethod;
     requestHeaders(args, body?.contentType, args.user ?? parsed.user, true, limits.maxHeaderBytes);
+    const retryRemaining = () => (args.retryMaxTimeMs ?? Infinity) - (performance.now() - start);
     attempts: for (let attempt = 0; attempt <= args.retries; attempt++) {
-      if (attempt && args.download?.resume && output && output !== "-") resumeOffset = await existingSize(context, output, signal) ?? 0;
-      values.num_retries = String(attempt);
-      downloaded = 0;
-      uploaded = 0;
-      failure = void 0;
-      let current = new URL(initial);
-      let currentUrl = current.origin + initialTarget;
-      let method = initialMethod;
-      let requestMethod = initialRequestMethod;
-      let currentBody = body;
-      let credentialsInScope = true;
-      let previous;
-      let redirects = 0;
-      included = [];
-      let headerBytes = 0;
-      while (true) {
-        signal.throwIfAborted();
-        if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
-        values.url_effective = currentUrl;
-        values.method = method;
-        let denyPrivateNetworks = false;
-        let allowed;
-        const headers = requestHeaders(resumeOffset ? { ...args, range: `${resumeOffset}-` } : args, currentBody?.contentType, args.user ?? parsed.user, credentialsInScope, limits.maxHeaderBytes, previous);
-        try {
-          allowed = await withSignal(() => authorize({
-            url: currentUrl,
-            method,
-            headers,
-            attempt,
-            signal,
-            requirePrivateNetworkDeny() {
-              denyPrivateNetworks = true;
-            },
-            ...previous === void 0 ? {} : { redirectFrom: previous }
-          }), signal);
-        } catch {
+      try {
+        if (attempt && args.download?.resume && output && output !== "-") resumeOffset = await existingSize(context, output, signal) ?? 0;
+        values.num_retries = String(attempt);
+        downloaded = 0;
+        uploaded = 0;
+        failure = void 0;
+        let current = new URL(initial);
+        let currentUrl = current.origin + initialTarget;
+        let method = initialMethod;
+        let requestMethod = initialRequestMethod;
+        let currentBody = body;
+        let credentialsInScope = true;
+        let previous;
+        let redirects = 0;
+        included = [];
+        let headerBytes = 0;
+        while (true) {
           signal.throwIfAborted();
-          throw new CurlError(7, "Network authorization failed");
-        }
-        if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
-        if (allowed !== true) throw new CurlError(7, "Network access denied by host policy");
-        const policy = denyPrivateNetworks ? { denyPrivateNetworks: true } : {};
-        if (policy.denyPrivateNetworks && transport.supportsPrivateNetworkDeny !== true) {
-          throw new CurlError(7, "Transport cannot enforce private network policy");
-        }
-        if (args.verbose) await writeBytes(context.stderr, encode(`> ${method} ${current.origin}
+          if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
+          values.url_effective = currentUrl;
+          values.method = method;
+          let denyPrivateNetworks = false;
+          let allowed;
+          const cookie = cookies.filter((item) => {
+            if (item.domain === void 0) return credentialsInScope;
+            const domain = current.hostname.toLowerCase();
+            const path = item.path || "/";
+            return (domain === item.domain || item.subdomains && domain.endsWith(`.${item.domain}`)) && (!item.secure || current.protocol === "https:") && (!item.expires || item.expires > Date.now() / 1e3) && (current.pathname === path || current.pathname.startsWith(path.endsWith("/") ? path : `${path}/`));
+          }).map((item) => item.name ? `${item.name}=${item.value}` : item.value).join("; ");
+          const headers = requestHeaders(resumeOffset ? { ...args, range: `${resumeOffset}-` } : args, currentBody?.contentType, args.user ?? parsed.user, credentialsInScope, limits.maxHeaderBytes, previous, cookie);
+          try {
+            allowed = await withSignal(() => authorize({
+              url: currentUrl,
+              method,
+              headers,
+              attempt,
+              signal,
+              requirePrivateNetworkDeny() {
+                denyPrivateNetworks = true;
+              },
+              ...previous === void 0 ? {} : { redirectFrom: previous }
+            }), signal);
+          } catch {
+            signal.throwIfAborted();
+            throw new CurlError(7, "Network authorization failed");
+          }
+          if (remaining() <= 0) throw new CurlError(28, "Operation timed out");
+          if (allowed !== true) throw new CurlError(7, "Network access denied by host policy");
+          const policy = denyPrivateNetworks ? { denyPrivateNetworks: true } : {};
+          if (policy.denyPrivateNetworks && transport.supportsPrivateNetworkDeny !== true) {
+            throw new CurlError(7, "Transport cannot enforce private network policy");
+          }
+          if (args.verbose) await writeBytes(context.stderr, encode(`> ${method} ${current.origin}
 ${headers.map(([name]) => `> ${name}: [redacted]
 `).join("")}`), signal);
-        const upload = currentBody && (async function* () {
-          for await (const chunk of currentBody.open(signal)) {
-            uploaded += chunk.length;
-            yield chunk;
-          }
-        })();
-        try {
+          const upload = currentBody && (async function* () {
+            for await (const chunk of currentBody.open(signal)) {
+              uploaded += chunk.length;
+              yield chunk;
+            }
+          })();
           response = await operation.acquire(async () => {
             const acquired = await transport({
               url: currentUrl,
@@ -418,8 +461,9 @@ ${headers.map(([name]) => `> ${name}: [redacted]
               registerCleanup: operation.registerCleanup,
               ...policy,
               ...upload ? { body: upload } : {},
+              ...args.insecure ? { insecure: true } : {},
               ...ca === void 0 ? {} : { ca },
-              ...args.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: args.connectTimeoutMs }
+              ...args.connectTimeoutMs === void 0 ? {} : transport.supportsConnectTimeout === true ? { connectTimeoutMs: args.connectTimeoutMs } : { responseHeaderTimeoutMs: args.connectTimeoutMs }
             });
             let cleanup;
             return { ...acquired, dispose() {
@@ -427,171 +471,174 @@ ${headers.map(([name]) => `> ${name}: [redacted]
               return cleanup;
             } };
           }, (result) => result.dispose());
-        } catch (error) {
-          signal.throwIfAborted();
-          const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
-          if (args.retryTransport && (code === "ECONNRESET" || code === "ETIMEDOUT" || code === "EPIPE") && attempt < args.retries) {
-            await delay(args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5), signal);
-            continue attempts;
-          }
-          throw error;
-        }
-        const block = responseHeaders(response, limits.maxHeaderBytes);
-        headerBytes += block.length;
-        if (headerBytes > limits.maxHeaderBytes) throw new CurlError(63, "Combined response headers exceed host byte limit");
-        values.http_code = values.response_code = String(response.status).padStart(3, "0");
-        values.content_type = header(response.headers, "content-type") ?? "";
-        values.http_version = response.httpVersion ?? "1.1";
-        if (args.verbose) await writeBytes(context.stderr, encode(`< HTTP ${response.status}
+          const block = responseHeaders(response, limits.maxHeaderBytes);
+          headerBytes += block.length;
+          if (headerBytes > limits.maxHeaderBytes) throw new CurlError(63, "Combined response headers exceed host byte limit");
+          values.http_code = values.response_code = String(response.status).padStart(3, "0");
+          values.content_type = header(response.headers, "content-type") ?? "";
+          values.http_version = response.httpVersion ?? "1.1";
+          if (args.verbose) await writeBytes(context.stderr, encode(`< HTTP ${response.status}
 `), signal);
-        if (args.dumpHeader !== void 0) {
-          if (args.dumpHeader === "-") await publish(block);
-          else {
-            await dumpHeaders(context, args.dumpHeader, block, dumped || headerState.dumped, signal);
-            headerState.dumped = true;
+          if (args.dumpHeader !== void 0) {
+            if (args.dumpHeader === "-") await publish(block);
+            else {
+              await dumpHeaders(context, args.dumpHeader, block, dumped || headerState.dumped, signal);
+              headerState.dumped = true;
+            }
+            dumped = true;
           }
-          dumped = true;
-        }
-        if (args.etagSave !== void 0) {
-          const tag = header(response.headers, "etag");
-          const bytes = tag === void 0 ? new Uint8Array() : new Uint8Array(encodeBytes(`${tag}
+          if (args.etagSave !== void 0) {
+            const tag = header(response.headers, "etag");
+            const bytes = tag === void 0 ? new Uint8Array() : new Uint8Array(encodeBytes(`${tag}
 `, "latin1"));
-          if (args.etagSave === "-") await publish(bytes);
-          else await writeOutput(context, args.etagSave, toByteSource(bytes), signal);
-        }
-        if (args.head || args.include) included.push(block);
-        const location = header(response.headers, "location");
-        if (redirectStatuses.has(response.status) && location !== void 0) {
-          let target;
-          let targetUrl;
-          try {
-            const base = currentUrl.split("?")[0];
-            const colon = location.indexOf(":");
-            const boundary = [...location].findIndex((character) => "/?#".includes(character));
-            const resolved = colon >= 0 && (boundary < 0 || colon < boundary) ? location : location.startsWith("//") ? current.protocol + location : location.startsWith("/") ? current.origin + location : location.startsWith("?") ? base + location : location.startsWith("#") || location === "" ? currentUrl + location : base.slice(0, base.lastIndexOf("/") + 1) + location;
-            target = parseUrl(resolved, true).url;
-            targetUrl = target.origin + curlRequestTarget(resolved);
-          } catch (error) {
-            if (error instanceof CurlError) throw error;
-            throw new CurlError(3, "Malformed redirect URL");
+            if (args.etagSave === "-") await publish(bytes);
+            else await writeOutput(context, args.etagSave, toByteSource(bytes), signal);
           }
-          values.redirect_url = targetUrl;
-          if (args.location) {
-            if (redirects++ >= args.maxRedirects) throw new CurlError(47, "Maximum redirects exceeded");
-            if (current.protocol === "https:" && target.protocol === "http:") throw new CurlError(1, "HTTPS-to-HTTP redirects are disabled");
-            if (target.origin !== current.origin) credentialsInScope = false;
-            if (response.status === 303 && method !== "HEAD" || [301, 302].includes(response.status) && requestMethod === "POST") {
-              currentBody = void 0;
-              requestMethod = "GET";
-              if (args.method === void 0) method = "GET";
+          if (args.head || args.include) included.push(block);
+          const location = header(response.headers, "location");
+          if (redirectStatuses.has(response.status) && location !== void 0) {
+            let target;
+            let targetUrl;
+            try {
+              const base = currentUrl.split("?")[0];
+              const colon = location.indexOf(":");
+              const boundary = [...location].findIndex((character) => "/?#".includes(character));
+              const resolved = colon >= 0 && (boundary < 0 || colon < boundary) ? location : location.startsWith("//") ? current.protocol + location : location.startsWith("/") ? current.origin + location : location.startsWith("?") ? base + location : location.startsWith("#") || location === "" ? currentUrl + location : base.slice(0, base.lastIndexOf("/") + 1) + location;
+              target = parseUrl(resolved, true).url;
+              targetUrl = target.origin + curlRequestTarget(resolved);
+            } catch (error) {
+              if (error instanceof CurlError) throw error;
+              throw new CurlError(3, "Malformed redirect URL");
+            }
+            values.redirect_url = targetUrl;
+            if (args.location) {
+              if (redirects++ >= args.maxRedirects) throw new CurlError(47, "Maximum redirects exceeded");
+              if (current.protocol === "https:" && target.protocol === "http:") throw new CurlError(1, "HTTPS-to-HTTP redirects are disabled");
+              if (target.origin !== current.origin) credentialsInScope = false;
+              if (response.status === 303 && method !== "HEAD" || [301, 302].includes(response.status) && requestMethod === "POST") {
+                currentBody = void 0;
+                requestMethod = "GET";
+                if (args.method === void 0) method = "GET";
+              }
+              previous = currentUrl;
+              current = target;
+              currentUrl = targetUrl;
+              values.num_redirects = String(redirects);
+              await stop(response, signal);
+              response = void 0;
+              continue;
             }
-            previous = currentUrl;
-            current = target;
-            currentUrl = targetUrl;
-            values.num_redirects = String(redirects);
-            await stop(response, signal);
-            response = void 0;
-            continue;
           }
+          break;
         }
-        break;
-      }
-      if (!response) throw new CurlError(56, "No HTTP response");
-      if (args.download?.contentDisposition && args.remoteName) {
-        const disposition = header(response.headers, "content-disposition");
-        const parameter = disposition?.split(";").map((part) => part.trim()).find((part) => part.slice(0, part.indexOf("=")).toLowerCase() === "filename");
-        if (parameter) {
-          let filename = parameter.slice(parameter.indexOf("=") + 1).trim();
-          if (filename.startsWith('"') && filename.endsWith('"')) filename = filename.slice(1, -1);
-          filename = posix.basename(filename.split("\\").join("/"));
-          if (filename && filename !== "." && filename !== ".." && !filename.includes("\0")) output = args.outputDirectory === void 0 ? filename : `${args.outputDirectory}/${filename}`;
-        }
-      }
-      if (args.download?.noClobber && output && output !== "-" && await existingSize(context, output, signal) !== void 0) return 0;
-      let append = false;
-      if (resumeOffset && response.status === 206) {
-        const range = header(response.headers, "content-range") ?? "";
-        if (!range.startsWith(`bytes ${resumeOffset}-`)) throw new CurlError(args.continueAt === void 0 ? 56 : 33, "Invalid resume Content-Range");
-        append = true;
-      }
-      if (resumeOffset && response.status === 416) {
-        if (header(response.headers, "content-range") === `bytes */${resumeOffset}`) return 0;
-      }
-      if (resumeOffset && args.continueAt !== void 0 && !append) throw new CurlError(33, "Server does not support resuming this transfer");
-      if (response.status >= 400 && (args.fail || args.failWithBody)) failure = new CurlError(22, `HTTP response status ${response.status}`);
-      const suppressBody = response.status === 304 || args.fail && failure !== void 0;
-      const readBody = !(args.download && method === "HEAD") && !args.head && !suppressBody;
-      let published = 0;
-      if (!args.download?.spider && (!suppressBody || included.length)) {
-        if (args.download && output && output !== "-") await context.fs.mkdir(posix.dirname(pathOf(context, output)), { recursive: true, signal });
-        const length = args.ignoreContentLength ? void 0 : header(response.headers, "content-length");
-        if (readBody && length && /^\d+$/.test(length) && Number(length) > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
-        const final = response;
-        const encoding = header(final.headers, "content-encoding");
-        const writing = output === void 0 || output === "-" ? createOutputOperation({ ...context, signal }, context.stdout) : void 0;
-        const bodySignal = writing?.signal ?? signal;
-        const source = (async function* () {
-          for (const bytes of included) {
-            published += bytes.length;
-            yield bytes;
+        if (!response) throw new CurlError(56, "No HTTP response");
+        if (args.download?.contentDisposition && args.remoteName) {
+          const disposition = header(response.headers, "content-disposition");
+          const parameter = disposition?.split(";").map((part) => part.trim()).find((part) => part.slice(0, part.indexOf("=")).toLowerCase() === "filename");
+          if (parameter) {
+            let filename = parameter.slice(parameter.indexOf("=") + 1).trim();
+            if (filename.startsWith('"') && filename.endsWith('"')) filename = filename.slice(1, -1);
+            filename = posix.basename(filename.split("\\").join("/"));
+            if (filename && filename !== "." && filename !== ".." && !filename.includes("\0")) output = args.outputDirectory === void 0 ? filename : `${args.outputDirectory}/${filename}`;
           }
-          if (readBody) {
-            if (args.raw && final.contentDecoded && encoding) throw new CurlError(61, "Transport cannot preserve encoded response bytes");
-            if (args.raw && header(final.headers, "transfer-encoding")) throw new CurlError(61, "Raw transfer encoding is unsupported by this transport");
-            let chunks = 0;
-            const encoded = (async function* () {
-              for await (const chunk of readBytes(final.body, bodySignal)) {
-                downloaded += chunk.length;
-                if (downloaded > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
-                yield chunk;
-              }
-              if (!final.contentDecoded && length && /^\d+$/.test(length) && downloaded !== Number(length)) throw new CurlError(18, "Partial HTTP response body");
-            })();
-            const decoded = args.compressed && !args.raw && !final.contentDecoded && encoding ? decodeContent(encoded, encoding, bodySignal, args.maxFileSize, limits.maxEncodingLayers) : encoded;
-            let outputBytes = 0;
-            try {
-              for await (const chunk of decoded) {
-                if (++chunks % 256 === 0) {
-                  await yieldTurn(context.signal);
-                  bodySignal.throwIfAborted();
+        }
+        if (args.download?.noClobber && output && output !== "-" && await existingSize(context, output, signal) !== void 0) return 0;
+        let append = false;
+        if (resumeOffset && response.status === 206) {
+          const range = header(response.headers, "content-range") ?? "";
+          if (!range.startsWith(`bytes ${resumeOffset}-`)) throw new CurlError(args.continueAt === void 0 ? 56 : 33, "Invalid resume Content-Range");
+          append = true;
+        }
+        if (resumeOffset && response.status === 416) {
+          if (header(response.headers, "content-range") === `bytes */${resumeOffset}`) return 0;
+        }
+        if (resumeOffset && args.continueAt !== void 0 && !append) throw new CurlError(33, "Server does not support resuming this transfer");
+        if (response.status >= 400 && (args.fail || args.failWithBody)) failure = new CurlError(22, `HTTP response status ${response.status}`);
+        const suppressBody = response.status === 304 || args.fail && failure !== void 0;
+        const readBody = !(args.download && method === "HEAD") && !args.head && !suppressBody;
+        let published = 0;
+        if (!args.download?.spider && (!suppressBody || included.length)) {
+          if ((args.download || args.createDirs) && output && output !== "-") await context.fs.mkdir(posix.dirname(pathOf(context, output)), { recursive: true, signal });
+          const length = args.ignoreContentLength ? void 0 : header(response.headers, "content-length");
+          if (readBody && length && /^\d+$/.test(length) && Number(length) > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
+          const final = response;
+          const encoding = header(final.headers, "content-encoding");
+          const writing = output === void 0 || output === "-" ? createOutputOperation({ ...context, signal }, context.stdout) : void 0;
+          const bodySignal = writing?.signal ?? signal;
+          const source = (async function* () {
+            for (const bytes of included) {
+              published += bytes.length;
+              yield bytes;
+            }
+            if (readBody) {
+              if (args.raw && final.contentDecoded && encoding) throw new CurlError(61, "Transport cannot preserve encoded response bytes");
+              if (args.raw && header(final.headers, "transfer-encoding")) throw new CurlError(61, "Raw transfer encoding is unsupported by this transport");
+              let chunks = 0;
+              const encoded = (async function* () {
+                for await (const chunk of readBytes(final.body, bodySignal)) {
+                  downloaded += chunk.length;
+                  if (downloaded > args.maxFileSize) throw new CurlError(63, "Response exceeds download byte limit");
+                  yield chunk;
+                }
+                if (!final.contentDecoded && length && /^\d+$/.test(length) && downloaded !== Number(length)) throw new CurlError(18, "Partial HTTP response body");
+              })();
+              const decoded = args.compressed && !args.raw && !final.contentDecoded && encoding ? decodeContent(encoded, encoding, bodySignal, args.maxFileSize, limits.maxEncodingLayers) : encoded;
+              let outputBytes = 0;
+              try {
+                for await (const chunk of decoded) {
+                  if (++chunks % 256 === 0) {
+                    await yieldTurn(context.signal);
+                    bodySignal.throwIfAborted();
+                  }
+                  outputBytes += chunk.length;
+                  if (outputBytes > args.maxFileSize) throw new CurlError(63, "Decoded response exceeds download byte limit");
+                  published += chunk.length;
+                  yield chunk;
                 }
-                outputBytes += chunk.length;
-                if (outputBytes > args.maxFileSize) throw new CurlError(63, "Decoded response exceeds download byte limit");
-                published += chunk.length;
-                yield chunk;
+              } catch (error) {
+                bodySignal.throwIfAborted();
+                if (!(error instanceof CurlError) && !final.contentDecoded && length && /^\d+$/.test(length) && downloaded < Number(length)) throw new CurlError(18, "Partial HTTP response body");
+                throw networkError(error);
               }
-            } catch (error) {
-              bodySignal.throwIfAborted();
-              if (!(error instanceof CurlError) && !final.contentDecoded && length && /^\d+$/.test(length) && downloaded < Number(length)) throw new CurlError(18, "Partial HTTP response body");
-              throw networkError(error);
             }
+          })();
+          try {
+            await writeOutput(writing ? { ...context, stdout: writing.output } : context, output, source, bodySignal, append, args.failWithBody && failure !== void 0);
+          } catch (error) {
+            context.signal.throwIfAborted();
+            if (!pipeClosed(error)) throw error;
+            closedOutput = true;
+          } finally {
+            await writing?.close();
           }
-        })();
-        try {
-          await writeOutput(writing ? { ...context, stdout: writing.output } : context, output, source, bodySignal, append, args.failWithBody && failure !== void 0);
-        } catch (error) {
-          context.signal.throwIfAborted();
-          if (!pipeClosed(error)) throw error;
-          closedOutput = true;
-        } finally {
-          await writing?.close();
         }
-      }
-      if (retryStatuses.has(response.status) && attempt < args.retries) {
-        if (failure && (!args.silent || args.showError)) await deadlineDiagnostic(context, new CurlError(status(failure.exitCode), failure.message), remaining());
-        const after = header(response.headers, "retry-after");
-        let wait = args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5);
-        if (after !== void 0) {
-          const parsed2 = /^\d+$/.test(after) ? Number(after) * 1e3 : Date.parse(after) - Date.now();
-          if (Number.isFinite(parsed2)) wait = Math.max(wait, parsed2);
+        if ((retryStatuses.has(response.status) || args.retryAllErrors && failure) && attempt < args.retries && retryRemaining() > 0) {
+          if (failure && (!args.silent || args.showError)) await deadlineDiagnostic(context, new CurlError(status(failure.exitCode), failure.message), remaining());
+          const after = header(response.headers, "retry-after");
+          let wait = args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5);
+          if (after !== void 0) {
+            const parsed2 = /^\d+$/.test(after) ? Number(after) * 1e3 : Date.parse(after) - Date.now();
+            if (Number.isFinite(parsed2)) wait = Math.max(wait, parsed2);
+          }
+          if (wait >= retryRemaining()) break;
+          await stop(response, signal);
+          response = void 0;
+          if (published && output !== void 0 && output !== "-" && !args.download?.resume) await writeOutput(context, output, toByteSource(""), signal);
+          await delay(Math.min(wait, limits.maxTimeMs), signal);
+          continue;
         }
+        break;
+      } catch (error) {
+        signal.throwIfAborted();
+        const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
+        const retryable = args.retryAllErrors || args.retryConnrefused && code === "ECONNREFUSED" || args.retryTransport && (code === "ECONNRESET" || code === "ETIMEDOUT" || code === "EPIPE");
+        const wait = args.retryDelayMs || Math.min(1e3 * 2 ** attempt, 6e5);
+        if (!retryable || attempt >= args.retries || wait >= retryRemaining() || pipeClosed(error)) throw error;
         await stop(response, signal);
         response = void 0;
-        if (published && output !== void 0 && output !== "-" && !args.download?.resume) await writeOutput(context, output, toByteSource(""), signal);
-        await delay(Math.min(wait, limits.maxTimeMs), signal);
-        continue;
+        await delay(wait, signal);
+        continue attempts;
       }
-      break;
     }
   } catch (error) {
     if (context.signal.aborted) throw context.signal.reason;

package/dist/safe-bash/command-chunks/{chunk-I237SNW5.js → chunk-LFJJQQND.js}

@@ -1,6 +1,6 @@
 import {
   SearchError
-} from "./chunk-VGG2DL5Q.js";
+} from "./chunk-TRR4MYWF.js";
 import {
   init_buffer
 } from "./chunk-HX3SHTCE.js";