@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/safe-bash-command-node/index.js

@@ -0,0 +1,328 @@
+import {
+  init_buffer
+} from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-node/src/index.ts
+init_buffer();
+import { newQuickJSAsyncWASMModule } from "quickjs-emscripten";
+import { collectBytes, resolvePath, dirname, posixPath } from "@poe-platform/safe-fs/core";
+
+// packages/safe-bash-command-node/src/runtime.ts
+init_buffer();
+var bootstrap = String.raw`
+(() => {
+const bridge = globalThis.__host;
+delete globalThis.__host;
+const call = (op, ...args) => {
+  const result = JSON.parse(bridge(op, JSON.stringify(args)));
+  if (result.error) throw Object.assign(new Error(result.error.message), {code: result.error.code});
+  return result.value;
+};
+const encoding = value => {
+  if (value !== undefined && value !== 'utf8' && value !== 'utf-8') throw new Error('Only UTF-8 encoding is supported');
+  return value;
+};
+globalThis.Buffer = class Buffer extends Uint8Array {
+  static from(value, enc) { encoding(enc); return new Buffer(typeof value === 'string' ? call('encode', value) : value); }
+  static alloc(size) { return new Buffer(size); }
+  static isBuffer(value) { return value instanceof Buffer; }
+  toString(enc = 'utf8') { encoding(enc); return call('decode', Array.from(this)); }
+};
+const fileEncoding = options => {
+  if (options !== null && typeof options === 'object') {
+    for (const key of Object.keys(options)) if (key !== 'encoding') throw new Error('Unsupported fs option: ' + key);
+    options = options.encoding;
+  }
+  return encoding(options);
+};
+const fs = {
+  readFileSync(path, enc) { enc = fileEncoding(enc); const bytes = Buffer.from(call('read', path)); return enc ? bytes.toString(enc) : bytes; },
+  writeFileSync(path, data, enc) { fileEncoding(enc); call('write', path, Array.from(Buffer.from(data))); },
+  existsSync(path) { try { call('stat', path); return true; } catch (e) { if (e.code === 'ENOENT' || e.code === 'ENOTDIR') return false; throw e; } },
+  statSync(path) { const stat = call('stat', path); return {...stat, isFile: () => stat.type === 'file', isDirectory: () => stat.type === 'directory', isSymbolicLink: () => stat.type === 'symlink'}; },
+  mkdirSync(path, options = {}) { call('mkdir', path, options.recursive === true); },
+};
+const childResult = (command, args, options = {}) => {
+  for (const key of Object.keys(options)) if (key !== 'encoding') throw new Error('Unsupported child_process option: ' + key);
+  encoding(options.encoding);
+  const result = call('exec', command, args);
+  const stdout = Buffer.from(result.bytes);
+  if (result.status !== 0) throw Object.assign(new Error('Command failed: ' + command), {status: result.status, stdout});
+  return options.encoding ? stdout.toString(options.encoding) : stdout;
+};
+const child = {
+  execSync(command, options) { return childResult('sh', ['-c', command], options); },
+  execFileSync(command, args = [], options) { return childResult(command, args, options); },
+};
+function __setup(config) {
+  globalThis.process = {argv: config.argv, env: config.env, cwd: () => config.cwd, exitCode: 0,
+    stdout: {write: value => {call('output', String(value), false); return true;}},
+    stderr: {write: value => {call('output', String(value), true); return true;}},
+  };
+  globalThis.console = {
+    log: (...values) => call('output', values.map(String).join(' ') + '\n', false),
+    error: (...values) => call('output', values.map(String).join(' ') + '\n', true),
+  };
+  const path = {sep:'/', delimiter:':',
+    resolve: (...parts) => parts.reduce((base, part) => call('resolve', base, part), config.cwd),
+    dirname: value => call('dirname', value),
+    join: (...parts) => call('path', 'join', ...parts),
+    basename: value => call('path', 'basename', value),
+    extname: value => call('path', 'extname', value),
+  };
+  path.posix = path;
+  const cache = new Map();
+  const load = base => name => {
+    if (typeof name !== 'string') throw new TypeError('Module name must be a string');
+    const builtin = name.startsWith('node:') ? name.slice(5) : name;
+    if (builtin === 'fs') return fs;
+    if (builtin === 'child_process') return child;
+    if (builtin === 'path') return path;
+    if (!(name.startsWith('./') || name.startsWith('../') || name.startsWith('/'))) throw new Error('Unsupported module: ' + name);
+    const filename = call('resolve', base, name);
+    if (cache.has(filename)) return cache.get(filename).exports;
+    const source = call('source', filename);
+    const module = {exports:{}};
+    cache.set(filename, module);
+    try {
+      if (filename.endsWith('.json')) module.exports = JSON.parse(source);
+      else new Function('exports', 'require', 'module', '__filename', '__dirname', source)(module.exports, load(path.dirname(filename)), module, filename, path.dirname(filename));
+      return module.exports;
+    } catch (e) { cache.delete(filename); throw e; }
+  };
+  globalThis.__filename = config.filename;
+  globalThis.__dirname = config.filename.startsWith('/') ? path.dirname(config.filename) : config.cwd;
+  globalThis.require = load(__dirname);
+  globalThis.module = {exports:{}};
+  globalThis.exports = module.exports;
+}
+return __setup;
+})()
+`;
+
+// packages/safe-bash-command-node/src/index.ts
+var defaults = { memoryBytes: 32 * 1024 * 1024, sourceBytes: 1024 * 1024, outputBytes: 1024 * 1024, fileBytes: 4 * 1024 * 1024, operations: 1e3, timeoutMs: 5e3 };
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function createNodeCommand(options = {}) {
+  const limits = { ...defaults, ...options.limits };
+  for (const [key, value] of Object.entries(limits)) {
+    if (!Object.hasOwn(defaults, key) || !Number.isSafeInteger(value) || value <= 0) throw new TypeError(`Invalid node limit: ${key}`);
+  }
+  return { name: "node", description: "Execute JavaScript in QuickJS with safe-fs and safe-bash", async execute(context) {
+    const controller = new AbortController();
+    const signal = AbortSignal.any([context.signal, controller.signal]);
+    const timeout = setTimeout(() => controller.abort(new Error("Node execution deadline exceeded")), limits.timeoutMs);
+    const deadline = Date.now() + limits.timeoutMs;
+    let closeRequested = false;
+    let completed;
+    const completion = new Promise((resolve) => {
+      completed = resolve;
+    });
+    context.registerCleanup?.(async () => {
+      closeRequested = true;
+      controller.abort();
+      await completion;
+    });
+    let vm;
+    let outputBytes = 0;
+    let sourceBytes = 0;
+    let operations = 0;
+    let limitFailure;
+    const check = () => {
+      signal.throwIfAborted();
+      if (closeRequested || Date.now() > deadline) throw new Error("Node execution deadline exceeded");
+      if (limitFailure) throw limitFailure;
+    };
+    const bound = (size, max, name) => {
+      if (size > max) {
+        limitFailure = new Error(`Node ${name} limit exceeded`);
+        throw limitFailure;
+      }
+    };
+    const path = (value) => {
+      if (typeof value !== "string" || value.includes("\0")) throw new TypeError("Expected a virtual path");
+      return resolvePath(context.cwd, value);
+    };
+    const fs = context.fs;
+    const read = async (name, source = false) => {
+      check();
+      const bytes = await fs.readFile(path(name), { signal, maxBytes: source ? limits.sourceBytes - sourceBytes : limits.fileBytes });
+      bound(bytes.length, source ? limits.sourceBytes - sourceBytes : limits.fileBytes, source ? "source" : "file");
+      if (source) sourceBytes += bytes.length;
+      return bytes;
+    };
+    const emit = async (value, stderr) => {
+      const bytes = typeof value === "string" ? encoder.encode(value) : value;
+      outputBytes += bytes.length;
+      bound(outputBytes, limits.outputBytes, "output");
+      await (stderr ? context.stderr : context.stdout).write(bytes);
+      check();
+    };
+    try {
+      const args = [...context.args];
+      let source;
+      let filename = "[stdin]";
+      let print = false;
+      const flag = args[0];
+      if (flag === "-e" || flag === "--eval" || flag === "-p" || flag === "--print") {
+        args.shift();
+        if (args.length === 0) throw new Error(`${flag} requires source`);
+        source = args.shift();
+        print = flag === "-p" || flag === "--print";
+        filename = "[eval]";
+      } else {
+        if (flag === "--") args.shift();
+        if (args[0]?.startsWith("-") && args[0] !== "-") throw new Error(`Unsupported node option: ${args[0]}`);
+        const file = args.shift();
+        if (file && file !== "-") {
+          filename = path(file);
+          source = decoder.decode(await read(filename, true));
+        } else source = decoder.decode(await collectBytes(context.stdin, { signal, maxBytes: limits.sourceBytes }));
+      }
+      if (filename[0] === "[") sourceBytes = encoder.encode(source).length;
+      bound(sourceBytes, limits.sourceBytes, "source");
+      if (source.startsWith("#!")) {
+        const end = source.indexOf("\n");
+        source = end < 0 ? "" : source.slice(end);
+      }
+      check();
+      const engine = await newQuickJSAsyncWASMModule();
+      const contextVm = engine.newContext();
+      vm = contextVm;
+      vm.runtime.setMemoryLimit(limits.memoryBytes);
+      vm.runtime.setMaxStackSize(512 * 1024);
+      vm.runtime.setInterruptHandler(() => signal.aborted || closeRequested || Date.now() > deadline || !!limitFailure);
+      const host = contextVm.newAsyncifiedFunction("__host", async (operation, payload) => {
+        try {
+          check();
+          bound(++operations, limits.operations, "operations");
+          const op = contextVm.getString(operation);
+          const values = JSON.parse(contextVm.getString(payload));
+          let value = null;
+          switch (op) {
+            case "read":
+              value = Array.from(await read(values[0]));
+              break;
+            case "source":
+              value = decoder.decode(await read(values[0], true));
+              break;
+            case "write": {
+              if (!Array.isArray(values[1]) || !values[1].every((n) => Number.isInteger(n) && n >= 0 && n <= 255)) throw new TypeError("Expected bytes");
+              bound(values[1].length, limits.fileBytes, "file");
+              await fs.writeFile(path(values[0]), new Uint8Array(values[1]), { signal });
+              break;
+            }
+            case "stat": {
+              const stat = await fs.stat(path(values[0]), { signal });
+              value = { type: stat.type, size: stat.size };
+              break;
+            }
+            case "mkdir":
+              await fs.mkdir(path(values[0]), { signal, recursive: values[1] === true });
+              break;
+            case "output":
+              await emit(String(values[0]), values[1] === true);
+              break;
+            case "encode":
+              value = Array.from(encoder.encode(String(values[0])));
+              break;
+            case "decode":
+              value = decoder.decode(new Uint8Array(values[0]));
+              break;
+            case "resolve":
+              value = resolvePath(String(values[0]), String(values[1]));
+              break;
+            case "dirname":
+              value = dirname(String(values[0]));
+              break;
+            case "path": {
+              const method = values[0];
+              if (method === "join") value = posixPath.join(...values.slice(1));
+              else if (method === "basename") value = posixPath.basename(String(values[1]));
+              else if (method === "extname") value = posixPath.extname(String(values[1]));
+              else throw new Error("Unsupported path operation");
+              break;
+            }
+            case "exec": {
+              if (!context.invoke) throw new Error("safe-bash command dispatch unavailable");
+              if (typeof values[0] !== "string" || !Array.isArray(values[1]) || !values[1].every((v) => typeof v === "string")) throw new TypeError("Expected command and string argv");
+              const chunks = [];
+              let total = 0;
+              const result2 = await context.invoke(values[0], values[1], {
+                signal,
+                stdin: { async *[Symbol.asyncIterator]() {
+                } },
+                stdout: { async write(bytes2) {
+                  total += bytes2.length;
+                  bound(total, limits.outputBytes, "child output");
+                  chunks.push(new Uint8Array(bytes2));
+                } },
+                stderr: { async write(bytes2) {
+                  await emit(bytes2, true);
+                } }
+              });
+              const bytes = new Uint8Array(total);
+              let offset = 0;
+              for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.length;
+              }
+              value = { status: result2.exitCode, bytes: Array.from(bytes) };
+              break;
+            }
+            default:
+              throw new Error("Unsupported host operation");
+          }
+          check();
+          return contextVm.newString(JSON.stringify({ value }));
+        } catch (error) {
+          const failure = error;
+          return contextVm.newString(JSON.stringify({ error: { message: failure?.message ?? String(error), code: failure?.code } }));
+        }
+      });
+      vm.setProp(vm.global, "__host", host);
+      host.dispose();
+      const configuration = JSON.stringify({ cwd: context.cwd, env: context.env, argv: ["/virtual/bin/node", ...filename === "[eval]" ? [] : [filename], ...args], filename });
+      const setup = await vm.evalCodeAsync(`${bootstrap}(${configuration});`, "safe-bash-node");
+      vm.unwrapResult(setup).dispose();
+      const result = await vm.evalCodeAsync(print ? `console.log((${source}
+))` : source, filename);
+      vm.unwrapResult(result).dispose();
+      check();
+      if (vm.runtime.hasPendingJob()) throw new Error("Asynchronous jobs are unsupported by this Node profile");
+      const exit = vm.unwrapResult(await vm.evalCodeAsync("process.exitCode", "exitCode"));
+      const exitCode = vm.getNumber(exit);
+      exit.dispose();
+      if (!Number.isInteger(exitCode) || exitCode < 0 || exitCode > 255) throw new Error("Invalid process.exitCode");
+      return { exitCode };
+    } catch (error) {
+      context.signal.throwIfAborted();
+      const message = error instanceof Error ? error.message : JSON.stringify(error);
+      await context.stderr.write(encoder.encode(`node: ${message}
+`).slice(0, limits.outputBytes));
+      return { exitCode: 1 };
+    } finally {
+      clearTimeout(timeout);
+      try {
+        if (vm?.alive) vm.dispose();
+      } finally {
+        completed();
+      }
+    }
+  } };
+}
+function createNodeCommands(options = {}) {
+  return [createNodeCommand(options)];
+}
+function nodeCommands(options = {}) {
+  const command = createNodeCommand(options);
+  return { name: "quickjs-node", setup(host) {
+    host.commands.register(command, { replace: options.replace ?? false });
+  } };
+}
+export {
+  createNodeCommand,
+  createNodeCommands,
+  nodeCommands
+};

package/dist/safe-bash-command-numfmt/index.js

@@ -2516,6 +2516,7 @@ function numfmtCommand(options = {}) {
             if (item.done) break;
             if (item.value.length > limits.maxSingleChunkBytes || item.value.length > limits.maxInputBytes - received) throw new PublicDiagnostic("byte command input limit exceeded");
             received += item.value.length;
+            context.inputBudget?.check(received);
             if (!item.value.length && ++empty > limits.maxEmptyChunks) throw new PublicDiagnostic("empty input chunk limit exceeded");
             const chunk = new Uint8Array(item.value);
             const sepByte = settings2.separator.charCodeAt(0);

package/dist/safe-bash-command-od/index.js

@@ -371,7 +371,6 @@ function formats(text) {
       offset++;
     }
     result.push({ kind, size, ...printable ? { printable: true } : {} });
-    if (result.length > 16) throw new UsageError("at most 16 output types are supported");
   }
   if (!result.length) throw new UsageError("empty output type");
   return result;
@@ -639,24 +638,28 @@ function createOdCommand(optionsOrMaxBytes) {
       "little"
     );
     const selected = (parsed.values.get("t") ?? ["o2"]).flatMap(formats);
-    const width = validatedOption(
+    const requestedWidth = validatedOption(
       parsed,
       "w",
       (text) => {
         const number = numeric(text);
-        if (number < 1 || selected.some((format) => number % format.size !== 0)) {
-          throw new UsageError("width must be positive and a multiple of each output type size");
-        }
+        if (number < 1) throw new UsageError("width must be positive");
         return number;
       },
       16
     );
+    const alignment = selected.reduce((size, format) => Math.max(size, format.size), 1);
+    const width = requestedWidth % alignment === 0 ? requestedWidth : alignment;
+    if (width !== requestedWidth) {
+      await writeDiagnostic(context.stderr, `${context.command}: warning: invalid width ${requestedWidth}; using ${width} instead
+`, context.signal);
+    }
     const skip = validatedOption(parsed, "j", (text) => numeric(text, true), 0);
     const count = validatedOption(parsed, "N", (text) => numeric(text, true), Infinity);
     if (count === 0 && skip === 0 && parsed.operands[0] && parsed.operands[0] !== "-") {
       await context.fs.stat(pathOf(context, parsed.operands[0]), { signal: context.signal });
     }
-    const charsPerByte = Math.max(...selected.map((format) => (fieldWidth(format) + 1) / format.size));
+    const charsPerByte = selected.reduce((width2, format) => Math.max(width2, (fieldWidth(format) + 1) / format.size), 0);
     const minimumStringLength = validatedOption(
       parsed,
       "S",
@@ -740,6 +743,7 @@ function createOdCommand(optionsOrMaxBytes) {
           offset = addOffset(offset, row.length);
           if (!flushedFirst && outBuf || outBuf.length >= 16384) await flushOut();
         }
+        await flushOut();
       }
     } finally {
       await flushOut();

package/dist/safe-bash-command-op/index.js

@@ -4,10 +4,11 @@ import {
 
 // packages/safe-bash-command-op/src/index.ts
 init_buffer();
+import { builtInDirectContextExecutors, syncCommandEvaluators } from "../safe-bash-contracts/runtime-control.js";
 
 // packages/safe-bash-command-op/src/cli.ts
 init_buffer();
-import { isFsError } from "@poe-platform/safe-fs/core";
+import { isFsError, listenForAbort as listenForAbort4 } from "@poe-platform/safe-fs/core";
 import { InputByteBudget } from "../safe-bash-contracts/io.js";
 
 // packages/safe-bash-command-op/src/encoding.ts
@@ -1764,6 +1765,7 @@ function changeVaultPermissions(current, requested, action) {
 
 // packages/safe-bash-command-op/src/plugin-scopes.ts
 init_buffer();
+import { listenForAbort } from "@poe-platform/safe-fs/core";
 function object(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1845,10 +1847,10 @@ async function clearPluginDefaults(plugin, context, all, force) {
     const confirm = context.confirmPluginClear;
     if (!confirm) throw new Error("Plugin clear confirmation capability is unavailable");
     const confirmation = Object.freeze({ pluginId: plugin.id, defaults: Object.freeze(selected.map(({ entry }) => Object.freeze({ id: entry.id, scope: Object.freeze({ ...entry.scope }) }))) });
-    let onAbort;
+    let disposeAbort;
     const aborted = new Promise((_resolve, reject) => {
-      onAbort = () => reject(new DOMException("Plugin clear aborted", "AbortError"));
-      context.signal.addEventListener("abort", onAbort, { once: true });
+      const onAbort = () => reject(new DOMException("Plugin clear aborted", "AbortError"));
+      disposeAbort = listenForAbort(context.signal, onAbort);
       if (context.signal.aborted) onAbort();
     });
     let accepted;
@@ -1861,7 +1863,7 @@ async function clearPluginDefaults(plugin, context, all, force) {
       if (context.signal.aborted) throw new DOMException("Plugin clear aborted", "AbortError");
       throw new Error("Plugin clear confirmation failed");
     } finally {
-      context.signal.removeEventListener("abort", onAbort);
+      disposeAbort?.();
     }
     if (accepted !== true) throw new Error("Plugin clear was not confirmed");
   }
@@ -2388,9 +2390,11 @@ function listItemTemplates(templates = []) {
 
 // packages/safe-bash-command-op/src/bindings.ts
 init_buffer();
+import { listenForAbort as listenForAbort3 } from "@poe-platform/safe-fs/core";
 
 // packages/safe-bash-command-op/src/plugin-selection.ts
 init_buffer();
+import { listenForAbort as listenForAbort2 } from "@poe-platform/safe-fs/core";
 async function selectPluginId(plugins, context, accountId) {
   const { signal, selectPlugin } = context;
   signal.throwIfAborted();
@@ -2399,13 +2403,12 @@ async function selectPluginId(plugins, context, accountId) {
     const id = plugin.executable ?? plugin.id;
     return id === void 0 ? [] : [Object.freeze({ id, name: plugin.plugin_name ?? plugin.name ?? id })];
   }));
-  let abort;
+  let disposeAbort;
   let selected;
   try {
     selected = await Promise.race([
       new Promise((_resolve, reject) => {
-        abort = () => reject(new Error("Plugin selection cancelled"));
-        signal.addEventListener("abort", abort, { once: true });
+        disposeAbort = listenForAbort2(signal, () => reject(new Error("Plugin selection cancelled")));
       }),
       Promise.resolve().then(() => {
         signal.throwIfAborted();
@@ -2417,7 +2420,7 @@ async function selectPluginId(plugins, context, accountId) {
     signal.throwIfAborted();
     throw new Error("Plugin selection failed");
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
   if (selected === void 0) throw new Error("Plugin selection cancelled");
   if (typeof selected !== "string" || !candidates.some((candidate) => candidate.id === selected)) throw new Error("Invalid plugin selection");
@@ -2522,7 +2525,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
     binding.cancelled = true;
     delete binding.staged;
     binding.steps = [];
-    binding.signal.removeEventListener("abort", binding.abort);
+    binding.disposeAbort?.();
+    delete binding.disposeAbort;
   }
   function validate(handle, context) {
     const binding = bindings.get(handle);
@@ -2542,7 +2546,7 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
   return {
     async prepareBinding(requests, context) {
       context.signal.throwIfAborted();
-      if (context.binding || requests.length > 1024) throw new Error("Invalid binding plan");
+      if (context.binding) throw new Error("Invalid binding plan");
       context = Object.freeze({
         ...context,
         ...context.authentication === void 0 ? {} : { authentication: structuredClone(context.authentication) },
@@ -2550,8 +2554,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
       });
       const preparedGeneration = generation;
       const now = clock.now();
-      const expiresAt = context.expiresAt ?? now + 6e4;
-      if (!Number.isFinite(now) || !Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("Invalid binding deadline");
+      const expiresAt = context.expiresAt ?? Infinity;
+      if (!Number.isFinite(now) || expiresAt !== Infinity && !Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("Invalid binding deadline");
       const targets = [];
       const requestMetadata = requests.map(() => Object.freeze({}));
       const accounts = /* @__PURE__ */ new Set();
@@ -2686,9 +2690,9 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
       if (generation !== preparedGeneration) throw invalid();
       if (accounts.size > 1) throw new Error("A binding requires one account scope");
       const handle = Object.freeze({});
-      const binding = { generation, expiresAt, signal: context.signal, authentication: structuredClone(context.authentication), pluginScope: structuredClone(context.pluginScope), steps, cancelled: false, queue: Promise.resolve(), abort: () => cancel(binding) };
+      const binding = { generation, expiresAt, signal: context.signal, authentication: structuredClone(context.authentication), pluginScope: structuredClone(context.pluginScope), steps, cancelled: false, queue: Promise.resolve() };
       bindings.set(handle, binding);
-      context.signal.addEventListener("abort", binding.abort, { once: true });
+      if (steps.length) binding.disposeAbort = listenForAbort3(context.signal, () => cancel(binding));
       validate(handle, context);
       return Object.freeze({ backendId, accountId: accounts.values().next().value ?? null, handle, targets: Object.freeze(targets), metadata: Object.freeze(requestMetadata) });
     },
@@ -2733,6 +2737,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
           published(before);
           binding.generation = generation;
           delete binding.staged;
+          binding.disposeAbort?.();
+          delete binding.disposeAbort;
         }
         return result;
       } catch (error) {
@@ -3461,10 +3467,9 @@ ${value.map((row) => keys.map((key) => typeof row[key] === "object" ? JSON.strin
 }
 async function policyResult(callback, signal) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(new Error("operation aborted"));
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort4(signal, () => reject(new Error("operation aborted")));
   });
   try {
     return await Promise.race([Promise.resolve().then(() => {
@@ -3474,7 +3479,7 @@ async function policyResult(callback, signal) {
   } catch {
     throw new Error("authorization failed");
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 function approvalManifest(request, requests, prepared, effects) {
@@ -3708,22 +3713,23 @@ function createOpCommand(options = {}) {
 
 // packages/safe-bash-command-op/src/secrets.ts
 init_buffer();
+import { listenForAbort as listenForAbort6 } from "@poe-platform/safe-fs/core";
 
 // packages/safe-bash-command-op/src/handler-preparation.ts
 init_buffer();
+import { listenForAbort as listenForAbort5 } from "@poe-platform/safe-fs/core";
 async function acquire(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(new Error("Operation aborted"));
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort5(signal, () => reject(new Error("Operation aborted")));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 function createSourceSnapshot(source, maxBytes = Infinity) {
@@ -3911,17 +3917,16 @@ function expand(value, env, escapes = true) {
 }
 async function cancellable(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(signal.reason);
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort6(signal, () => reject(signal.reason));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 async function template(value, env, resolve, variables = true) {
@@ -4544,22 +4549,22 @@ function createDocumentHandlers(backend, options = {}) {
 
 // packages/safe-bash-command-op/src/items.ts
 init_buffer();
+import { listenForAbort as listenForAbort7 } from "@poe-platform/safe-fs/core";
 function record6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Uint8Array);
 }
 async function cancellable2(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(signal.reason);
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort7(signal, () => reject(signal.reason));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 async function stdinText(context, encoding) {
@@ -4761,7 +4766,7 @@ function createOpCommand2(options = {}) {
           try {
             bytes = await fs.readFile(resolved, {
               signal,
-              ...context.inputBudget ? { maxBytes: Math.max(0, context.inputBudget.maxBytes - inputBytes) } : {}
+              ...context.inputBudget && Number.isFinite(context.inputBudget.maxBytes) ? { maxBytes: Math.max(0, context.inputBudget.maxBytes - inputBytes) } : {}
             });
           } catch (error) {
             if (isFsError2(error, "EFBIG") && context.inputBudget) context.inputBudget.check(context.inputBudget.maxBytes + 1);
@@ -4815,6 +4820,8 @@ function createOpCommand2(options = {}) {
       return command.execute(invocation);
     }
   };
+  builtInDirectContextExecutors.add(def.execute);
+  syncCommandEvaluators.evalSyncOp = evalSyncOp;
   opMetaByExecutor.set(def.execute, { version: options.version ?? "0.0.1", channel: options.channel ?? "stable" });
   return def;
 }

package/dist/safe-bash-command-op/types.d.ts

@@ -31,6 +31,7 @@ export interface OpBindingTarget {
     readonly revision: string;
 }
 export interface OpBindingPrepareContext extends OpBackendContext {
+    /** Deadline on the backend clock; omitted or Infinity means no timeout. */
     readonly expiresAt?: number;
 }
 export interface OpPreparedBinding {

package/dist/safe-bash-command-pandoc/command.js

@@ -2,12 +2,12 @@ import {
   createPandocCommand,
   createPandocCommands,
   pandocCommands
-} from "../safe-bash/command-chunks/chunk-TGSNCQSR.js";
+} from "../safe-bash/command-chunks/chunk-JT4RYCA6.js";
 import "../safe-bash/command-chunks/chunk-BAXU7B5Z.js";
-import "../safe-bash/command-chunks/chunk-QRRYN2KO.js";
+import "../safe-bash/command-chunks/chunk-BC7BK6R6.js";
 import "../safe-bash/command-chunks/chunk-5LU4UCBR.js";
 import "../safe-bash/command-chunks/chunk-RDV7UCYZ.js";
-import "../safe-bash/command-chunks/chunk-YG4EPFWC.js";
+import "../safe-bash/command-chunks/chunk-M3NINRDU.js";
 import "../safe-bash/command-chunks/chunk-3E2OIS2J.js";
 import "../safe-bash/command-chunks/chunk-Y6TUZWPS.js";
 import "../safe-bash/command-chunks/chunk-7OKDCM5U.js";

package/dist/safe-bash-command-pandoc/index.d.ts

@@ -1,3 +1,4 @@
+export { evalSyncPandoc } from "./sync.js";
 export { convert, convertSync, readDocument, writeDocument, PandocError } from "./engine.js";
 export { createFormatRegistry, coreFormats, formatCapabilities } from "./formats.js";
 export type { FormatCapability, FormatDescriptor, FormatSelection, Direction } from "./formats.js";