@xiaoso/dsh-tool-plus 0.1.0-beta.3 → 0.1.0-beta.4

package/lib/zip-D36ZKsP8.mjs

@@ -0,0 +1,1316 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { j as formatBytes } from "./src-lDmkSRbm.mjs";
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+//#region src/tools/omp/tools/tool-errors.ts
+/**
+* Standardized error types for tool execution.
+*
+* Tools should throw these instead of returning error text.
+* The agent loop catches and renders them appropriately.
+*/
+/**
+* Base error for tool execution failures.
+* Override render() for custom LLM-facing formatting.
+*/
+var ToolError = class extends Error {
+	context;
+	constructor(message, context) {
+		super(message);
+		this.context = context;
+		this.name = "ToolError";
+	}
+	/** Render error for LLM consumption. Override for custom formatting. */
+	render() {
+		return this.message;
+	}
+};
+/**
+* Error thrown when a tool operation is aborted (e.g., via AbortSignal).
+*/
+var ToolAbortError = class ToolAbortError extends Error {
+	static MESSAGE = "Operation aborted";
+	constructor(message = ToolAbortError.MESSAGE, options) {
+		super(message, options);
+		this.name = "ToolAbortError";
+	}
+};
+/**
+* Throw ToolAbortError if the signal is aborted.
+* Use this instead of signal?.throwIfAborted() to get consistent error types.
+*/
+function throwIfAborted(signal) {
+	if (signal?.aborted) {
+		const reason = signal.reason instanceof Error ? signal.reason : void 0;
+		throw reason instanceof ToolAbortError ? reason : new ToolAbortError(void 0, { cause: signal.reason });
+	}
+}
+//#endregion
+//#region src/tools/omp/utils/zip.ts
+const ENCODER = new TextEncoder();
+const UTF8_DECODER = new TextDecoder();
+const LEGACY_NAME_DECODER = new TextDecoder("windows-1252");
+/** Read a single ZIP entry as UTF-8 text, or `undefined` when the entry is absent. */
+function unzipText(entries, entryPath) {
+	const data = entries[entryPath];
+	return data ? UTF8_DECODER.decode(data) : void 0;
+}
+/**
+* Decode an in-memory ZIP archive into a `path → bytes` map of its file members
+* (directory entries and `..`-escaping names are dropped). Shares the
+* central-directory record parser with the lazy, file-backed reader.
+*/
+function unzip(bytes) {
+	const info = readCentralDirectoryInfoSync(bytes);
+	const centralDirectory = readMemoryRange(bytes, info.offset, info.offset + info.size);
+	const out = {};
+	for (const entry of parseZipCentralDirectory(memoryByteSource(bytes), centralDirectory, info.entries)) {
+		if (entry.isDirectory || entry.storage?.type !== "zip") continue;
+		out[entry.path] = extractZipMember(bytes, entry.storage, entry.size);
+	}
+	return out;
+}
+/**
+* Cap on tar/tar.gz archives loaded fully into memory for in-process indexing
+* (gzip input is bounded to this decompressed size). ZIP is exempt: it is read
+* via ranged central-directory access.
+*/
+const MAX_TAR_ARCHIVE_BYTES = 268435456;
+/**
+* Reject a tar input before materializing it. Tar parsing always retains the
+* complete decoded stream, unlike ZIP's ranged central-directory reader.
+*/
+function assertTarArchiveSize(size) {
+	if (!Number.isSafeInteger(size) || size < 0) throw new ToolError("Archive is too large to read safely");
+	if (size > MAX_TAR_ARCHIVE_BYTES) throw new ToolError(`Archive is too large to read in memory (${formatBytes(size)} > ${formatBytes(MAX_TAR_ARCHIVE_BYTES)} limit)`);
+}
+/**
+* Cap on a single archive member's declared (uncompressed) size. The declared
+* size is attacker-controlled metadata — a crafted ZIP entry can claim
+* multi-GB sizes that would be allocated up front before any data inflates.
+*/
+const MAX_ARCHIVE_MEMBER_BYTES = 67108864;
+/** Inflate one raw DEFLATE stream, bounded to its declared uncompressed size. */
+function inflateRaw(bytes, declaredSize) {
+	return zlib.inflateRawSync(bytes, { maxOutputLength: Math.max(declaredSize, 1) });
+}
+function assertValidRange(start, end) {
+	if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) throw new ToolError("Invalid ZIP archive range");
+}
+/** Read an exact in-memory range, throwing (not clamping) when it runs past the buffer. */
+function readMemoryRange(buffer, start, end) {
+	assertValidRange(start, end);
+	if (end > buffer.byteLength) throw new ToolError("Invalid ZIP archive: truncated data");
+	return buffer.subarray(start, end);
+}
+function fileByteSource(filePath) {
+	const file = Bun.file(filePath);
+	const size = file.size;
+	if (!Number.isSafeInteger(size)) throw new ToolError("ZIP archive is too large to read safely");
+	return {
+		size,
+		async read(start, end) {
+			assertValidRange(start, end);
+			const bytes = await file.slice(start, end).bytes();
+			if (bytes.byteLength !== end - start) throw new ToolError("Invalid ZIP archive: truncated data");
+			return bytes;
+		}
+	};
+}
+function memoryByteSource(buffer) {
+	return {
+		size: buffer.byteLength,
+		async read(start, end) {
+			return readMemoryRange(buffer, start, end);
+		}
+	};
+}
+function normalizeArchiveLookupPath(rawPath) {
+	if (!rawPath) return "";
+	const parts = rawPath.replace(/\\/g, "/").split("/");
+	const normalizedParts = [];
+	for (const part of parts) {
+		if (!part || part === ".") continue;
+		if (part === "..") return void 0;
+		normalizedParts.push(part);
+	}
+	return normalizedParts.join("/");
+}
+function normalizeArchiveEntryPath(rawPath) {
+	const parts = rawPath.replace(/\\/g, "/").split("/");
+	const normalizedParts = [];
+	for (const part of parts) {
+		if (!part || part === ".") continue;
+		if (part === "..") return void 0;
+		normalizedParts.push(part);
+	}
+	if (normalizedParts.length === 0) return void 0;
+	return normalizedParts.join("/");
+}
+function isArchiveDirectoryName(rawPath) {
+	return rawPath.endsWith("/") || rawPath.endsWith("\\");
+}
+function upsertArchiveEntry(map, entry) {
+	const existing = map.get(entry.path);
+	if (!existing) {
+		map.set(entry.path, entry);
+		return entry;
+	}
+	if (existing.isDirectory && !entry.isDirectory) {
+		map.set(entry.path, entry);
+		return entry;
+	}
+	if (!existing.isDirectory && entry.isDirectory) return;
+	const merged = {
+		...entry,
+		mtimeMs: entry.mtimeMs ?? existing.mtimeMs,
+		storage: entry.storage ?? existing.storage
+	};
+	map.set(entry.path, merged);
+	return merged;
+}
+function ensureParentDirectories(map) {
+	for (const entry of [...map.values()]) {
+		const parts = entry.path.split("/");
+		const stop = parts.length - 1;
+		for (let index = 1; index <= stop; index++) {
+			const dirPath = parts.slice(0, index).join("/");
+			if (!dirPath || map.has(dirPath)) continue;
+			map.set(dirPath, {
+				path: dirPath,
+				isDirectory: true,
+				size: 0
+			});
+		}
+	}
+}
+/**
+* Extensions that are ZIP containers under a different name — JVM (`.jar`,
+* `.war`, `.ear`) and Android (`.apk`) packages are all ZIP archives. Treated
+* as `zip` for member read/list and whole-archive rewrite.
+*/
+const ZIP_ALIAS_EXTENSIONS = [
+	"jar",
+	"war",
+	"ear",
+	"apk"
+];
+/**
+* Regex alternation of every recognized archive extension, longest first so
+* `.tar.gz` wins over `.tar`. Shared with `parseArchivePathCandidates` as its
+* split pattern so extension recognition and path splitting never drift.
+*/
+const ARCHIVE_EXTENSION_ALTERNATION = [
+	"tar\\.gz",
+	"tgz",
+	"zip",
+	"tar",
+	...ZIP_ALIAS_EXTENSIONS
+].join("|");
+/** Infer an archive format from a filesystem path's extension. */
+function archiveFormatFromPath(filePath) {
+	const normalized = filePath.toLowerCase();
+	if (normalized.endsWith(".tar.gz") || normalized.endsWith(".tgz")) return "tar.gz";
+	if (normalized.endsWith(".tar")) return "tar";
+	if (normalized.endsWith(".zip")) return "zip";
+	if (ZIP_ALIAS_EXTENSIONS.some((ext) => normalized.endsWith(`.${ext}`))) return "zip";
+}
+function formatArchiveEntryLines(entries) {
+	return entries.map((entry) => {
+		if (entry.isDirectory) return `${entry.name}/`;
+		const sizeSuffix = entry.size > 0 ? ` (${formatBytes(entry.size)})` : "";
+		return `${entry.name}${sizeSuffix}`;
+	});
+}
+const ZIP_LOCAL_FILE_HEADER_SIGNATURE = 67324752;
+const ZIP_CENTRAL_DIRECTORY_HEADER_SIGNATURE = 33639248;
+const ZIP64_EOCD_SIGNATURE = 101075792;
+const ZIP64_EOCD_LOCATOR_SIGNATURE = 117853008;
+const ZIP_EOCD_SIGNATURE = 101010256;
+const ZIP_DATA_DESCRIPTOR_SIGNATURE = 134695760;
+const ZIP_EOCD_MIN_LENGTH = 22;
+const ZIP64_EOCD_LOCATOR_LENGTH = 20;
+const ZIP_STORED_COMPRESSION = 0;
+const ZIP_DEFLATE_COMPRESSION = 8;
+const ZIP_UTF8_FLAG = 2048;
+const ZIP_ENCRYPTED_FLAG = 1;
+const ZIP_UINT16_MAX = 65535;
+const ZIP_UINT32_MAX = 4294967295;
+const ZIP_UINT32_RANGE = 4294967296;
+function readUInt16LE(bytes, offset) {
+	return bytes[offset] | bytes[offset + 1] << 8;
+}
+function readUInt32LE(bytes, offset) {
+	return (bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24) >>> 0;
+}
+function bytesMatchAscii(bytes, offset, value) {
+	if (bytes.byteLength < offset + value.length) return false;
+	for (let index = 0; index < value.length; index++) if (bytes[offset + index] !== value.charCodeAt(index)) return false;
+	return true;
+}
+function sniffArchiveFormat(bytes) {
+	if (bytes.byteLength >= 4) {
+		const signature = readUInt32LE(bytes, 0);
+		if (signature === ZIP_LOCAL_FILE_HEADER_SIGNATURE || signature === ZIP_EOCD_SIGNATURE || signature === ZIP_DATA_DESCRIPTOR_SIGNATURE) return "zip";
+	}
+	if (bytes.byteLength >= 2 && bytes[0] === 31 && bytes[1] === 139) return "tar.gz";
+	if (bytesMatchAscii(bytes, 257, "ustar")) return "tar";
+}
+function readUInt64LEAsNumber(bytes, offset) {
+	const value = readUInt32LE(bytes, offset) + readUInt32LE(bytes, offset + 4) * ZIP_UINT32_RANGE;
+	if (!Number.isSafeInteger(value)) throw new ToolError("ZIP archive uses offsets or sizes too large to read safely");
+	return value;
+}
+function findEndOfCentralDirectory(tail) {
+	for (let offset = tail.byteLength - ZIP_EOCD_MIN_LENGTH; offset >= 0; offset--) {
+		if (readUInt32LE(tail, offset) !== ZIP_EOCD_SIGNATURE) continue;
+		const commentLength = readUInt16LE(tail, offset + 20);
+		if (offset + ZIP_EOCD_MIN_LENGTH + commentLength === tail.byteLength) return offset;
+	}
+	throw new ToolError("Invalid ZIP archive: missing end of central directory");
+}
+async function readZip64CentralDirectoryInfo(source, tail, tailStart, eocdOffset) {
+	const locatorOffset = eocdOffset - ZIP64_EOCD_LOCATOR_LENGTH;
+	if (locatorOffset < 0) return void 0;
+	const locator = locatorOffset >= tailStart ? tail.subarray(locatorOffset - tailStart, locatorOffset - tailStart + ZIP64_EOCD_LOCATOR_LENGTH) : await source.read(locatorOffset, eocdOffset);
+	if (readUInt32LE(locator, 0) !== ZIP64_EOCD_LOCATOR_SIGNATURE) return void 0;
+	const zip64EocdDisk = readUInt32LE(locator, 4);
+	const zip64EocdOffset = readUInt64LEAsNumber(locator, 8);
+	const totalDisks = readUInt32LE(locator, 16);
+	if (zip64EocdDisk !== 0 || totalDisks > 1) throw new ToolError("Multi-disk ZIP archives are not supported");
+	const record = await source.read(zip64EocdOffset, zip64EocdOffset + 56);
+	if (readUInt32LE(record, 0) !== ZIP64_EOCD_SIGNATURE) throw new ToolError("Invalid ZIP archive: missing ZIP64 end of central directory");
+	if (readUInt32LE(record, 16) !== 0 || readUInt32LE(record, 20) !== 0) throw new ToolError("Multi-disk ZIP archives are not supported");
+	return {
+		entries: readUInt64LEAsNumber(record, 32),
+		size: readUInt64LEAsNumber(record, 40),
+		offset: readUInt64LEAsNumber(record, 48)
+	};
+}
+async function readZipCentralDirectoryInfo(source) {
+	const fileSize = source.size;
+	if (fileSize < ZIP_EOCD_MIN_LENGTH) throw new ToolError("Invalid ZIP archive: missing end of central directory");
+	const tailStart = fileSize - Math.min(fileSize, 65557);
+	const tail = await source.read(tailStart, fileSize);
+	const eocdIndex = findEndOfCentralDirectory(tail);
+	const eocdOffset = tailStart + eocdIndex;
+	if (readUInt16LE(tail, eocdIndex + 4) !== 0 || readUInt16LE(tail, eocdIndex + 6) !== 0) throw new ToolError("Multi-disk ZIP archives are not supported");
+	let entries = readUInt16LE(tail, eocdIndex + 10);
+	let size = readUInt32LE(tail, eocdIndex + 12);
+	let offset = readUInt32LE(tail, eocdIndex + 16);
+	const needsZip64 = entries === ZIP_UINT16_MAX || size === ZIP_UINT32_MAX || offset === ZIP_UINT32_MAX;
+	const zip64Info = await readZip64CentralDirectoryInfo(source, tail, tailStart, eocdOffset);
+	if (zip64Info) ({entries, size, offset} = zip64Info);
+	else if (needsZip64) throw new ToolError("Invalid ZIP archive: missing ZIP64 central directory metadata");
+	if (offset + size > fileSize) throw new ToolError("Invalid ZIP archive: central directory exceeds file size");
+	return {
+		entries,
+		offset,
+		size
+	};
+}
+function readZip64EntryValues(extra, placeholders, current) {
+	if (!placeholders.compressedSize && !placeholders.uncompressedSize && !placeholders.localHeaderOffset && !placeholders.diskStart) return current;
+	let offset = 0;
+	while (offset + 4 <= extra.byteLength) {
+		const headerId = readUInt16LE(extra, offset);
+		const dataSize = readUInt16LE(extra, offset + 2);
+		const dataStart = offset + 4;
+		const dataEnd = dataStart + dataSize;
+		if (dataEnd > extra.byteLength) throw new ToolError("Invalid ZIP archive: malformed extra field");
+		if (headerId === 1) {
+			let cursor = dataStart;
+			let uncompressedSize = current.uncompressedSize;
+			let compressedSize = current.compressedSize;
+			let localHeaderOffset = current.localHeaderOffset;
+			let diskStart = current.diskStart;
+			if (placeholders.uncompressedSize) {
+				if (cursor + 8 > dataEnd) throw new ToolError("Invalid ZIP archive: malformed ZIP64 extra field");
+				uncompressedSize = readUInt64LEAsNumber(extra, cursor);
+				cursor += 8;
+			}
+			if (placeholders.compressedSize) {
+				if (cursor + 8 > dataEnd) throw new ToolError("Invalid ZIP archive: malformed ZIP64 extra field");
+				compressedSize = readUInt64LEAsNumber(extra, cursor);
+				cursor += 8;
+			}
+			if (placeholders.localHeaderOffset) {
+				if (cursor + 8 > dataEnd) throw new ToolError("Invalid ZIP archive: malformed ZIP64 extra field");
+				localHeaderOffset = readUInt64LEAsNumber(extra, cursor);
+				cursor += 8;
+			}
+			if (placeholders.diskStart) {
+				if (cursor + 4 > dataEnd) throw new ToolError("Invalid ZIP archive: malformed ZIP64 extra field");
+				diskStart = readUInt32LE(extra, cursor);
+			}
+			return {
+				compressedSize,
+				uncompressedSize,
+				localHeaderOffset,
+				diskStart
+			};
+		}
+		offset = dataEnd;
+	}
+	throw new ToolError("Invalid ZIP archive: missing ZIP64 extra field");
+}
+function parseZipCentralDirectory(source, centralDirectory, expectedEntries) {
+	const entries = [];
+	let offset = 0;
+	for (let index = 0; index < expectedEntries; index++) {
+		if (offset + 46 > centralDirectory.byteLength) throw new ToolError("Invalid ZIP archive: truncated central directory");
+		if (readUInt32LE(centralDirectory, offset) !== ZIP_CENTRAL_DIRECTORY_HEADER_SIGNATURE) throw new ToolError("Invalid ZIP archive: malformed central directory");
+		const flags = readUInt16LE(centralDirectory, offset + 8);
+		const compression = readUInt16LE(centralDirectory, offset + 10);
+		const compressedSizeRaw = readUInt32LE(centralDirectory, offset + 20);
+		const uncompressedSizeRaw = readUInt32LE(centralDirectory, offset + 24);
+		const fileNameLength = readUInt16LE(centralDirectory, offset + 28);
+		const extraLength = readUInt16LE(centralDirectory, offset + 30);
+		const commentLength = readUInt16LE(centralDirectory, offset + 32);
+		const diskStartRaw = readUInt16LE(centralDirectory, offset + 34);
+		const localHeaderOffsetRaw = readUInt32LE(centralDirectory, offset + 42);
+		const nameStart = offset + 46;
+		const extraStart = nameStart + fileNameLength;
+		const entryEnd = extraStart + extraLength + commentLength;
+		if (entryEnd > centralDirectory.byteLength) throw new ToolError("Invalid ZIP archive: truncated central directory entry");
+		const rawPath = ((flags & ZIP_UTF8_FLAG) === 0 ? LEGACY_NAME_DECODER : UTF8_DECODER).decode(centralDirectory.subarray(nameStart, extraStart));
+		const normalizedPath = normalizeArchiveEntryPath(rawPath);
+		if (normalizedPath) {
+			const values = readZip64EntryValues(centralDirectory.subarray(extraStart, extraStart + extraLength), {
+				compressedSize: compressedSizeRaw === ZIP_UINT32_MAX,
+				uncompressedSize: uncompressedSizeRaw === ZIP_UINT32_MAX,
+				localHeaderOffset: localHeaderOffsetRaw === ZIP_UINT32_MAX,
+				diskStart: diskStartRaw === ZIP_UINT16_MAX
+			}, {
+				compressedSize: compressedSizeRaw,
+				uncompressedSize: uncompressedSizeRaw,
+				localHeaderOffset: localHeaderOffsetRaw,
+				diskStart: diskStartRaw
+			});
+			if (values.diskStart !== 0) throw new ToolError("Multi-disk ZIP archives are not supported");
+			const isDirectory = isArchiveDirectoryName(rawPath);
+			entries.push({
+				path: normalizedPath,
+				isDirectory,
+				size: isDirectory ? 0 : values.uncompressedSize,
+				storage: isDirectory ? void 0 : {
+					type: "zip",
+					source,
+					compressedSize: values.compressedSize,
+					compression,
+					flags,
+					localHeaderOffset: values.localHeaderOffset
+				}
+			});
+		}
+		offset = entryEnd;
+	}
+	return entries;
+}
+/** Decode a single ZIP member's already-read payload, bounded to its declared size. */
+function decodeZipMember(compressed, compression, declaredSize) {
+	if (compression === ZIP_STORED_COMPRESSION) return compressed;
+	if (compression !== ZIP_DEFLATE_COMPRESSION) throw new ToolError(`Unsupported ZIP compression method: ${compression}`);
+	try {
+		return inflateRaw(compressed, declaredSize);
+	} catch (error) {
+		throw new ToolError(error instanceof Error ? error.message : String(error));
+	}
+}
+async function readZipFileBytes(storage, uncompressedSize) {
+	if ((storage.flags & ZIP_ENCRYPTED_FLAG) !== 0) throw new ToolError("Encrypted ZIP entries are not supported");
+	const localHeader = await storage.source.read(storage.localHeaderOffset, storage.localHeaderOffset + 30);
+	if (readUInt32LE(localHeader, 0) !== ZIP_LOCAL_FILE_HEADER_SIGNATURE) throw new ToolError("Invalid ZIP archive: malformed local file header");
+	const fileNameLength = readUInt16LE(localHeader, 26);
+	const extraLength = readUInt16LE(localHeader, 28);
+	const dataStart = storage.localHeaderOffset + 30 + fileNameLength + extraLength;
+	return decodeZipMember(await storage.source.read(dataStart, dataStart + storage.compressedSize), storage.compression, uncompressedSize);
+}
+const TAR_BLOCK_SIZE = 512;
+const TAR_NAME_OFFSET = 0;
+const TAR_NAME_LENGTH = 100;
+const TAR_SIZE_OFFSET = 124;
+const TAR_SIZE_LENGTH = 12;
+const TAR_MTIME_OFFSET = 136;
+const TAR_MTIME_LENGTH = 12;
+const TAR_CHECKSUM_OFFSET = 148;
+const TAR_CHECKSUM_LENGTH = 8;
+const TAR_TYPEFLAG_OFFSET = 156;
+const TAR_LINKNAME_OFFSET = 157;
+const TAR_LINKNAME_LENGTH = 100;
+const TAR_MAGIC_OFFSET = 257;
+const TAR_MAGIC = "ustar\0";
+const TAR_VERSION_OFFSET = 263;
+const TAR_VERSION = "00";
+const TAR_PREFIX_OFFSET = 345;
+const TAR_PREFIX_LENGTH = 155;
+const TAR_GNU_SPARSE_ISEXTENDED_OFFSET = 482;
+const TAR_GNU_SPARSE_CONT_ISEXTENDED_OFFSET = 504;
+const TAR_MAX_PATH_BYTES = 4096;
+const TAR_MAX_PAX_NUMERIC_BYTES = 32;
+const TAR_ERROR_PATH_PREVIEW_BYTES = 256;
+const GZIP_MAGIC_0 = 31;
+const GZIP_MAGIC_1 = 139;
+const TAR_TEXT_DECODER = new TextDecoder();
+/**
+* Decompress a gzip stream in-process, bounded to the tar archive cap so a
+* gzip bomb cannot inflate without limit. Non-gzip input passes through.
+*/
+function gunzipIfNeeded(bytes) {
+	if (bytes.length >= 2 && bytes[0] === GZIP_MAGIC_0 && bytes[1] === GZIP_MAGIC_1) return new Uint8Array(zlib.gunzipSync(bytes, { maxOutputLength: MAX_TAR_ARCHIVE_BYTES }));
+	return bytes;
+}
+/** Read a NUL-terminated tar header string, clamped to the buffer bounds. */
+function readTarString(buffer, offset, length) {
+	const limit = Math.min(offset + length, buffer.length);
+	let end = offset;
+	while (end < limit && buffer[end] !== 0) end++;
+	return TAR_TEXT_DECODER.decode(buffer.subarray(offset, end));
+}
+function tarBytesEqualAscii(bytes, value) {
+	return bytes.byteLength === value.length && bytesMatchAscii(bytes, 0, value);
+}
+function isUstarHeader(buffer, offset) {
+	const magicOffset = offset + TAR_MAGIC_OFFSET;
+	const versionOffset = offset + TAR_VERSION_OFFSET;
+	return bytesMatchAscii(buffer, magicOffset, TAR_MAGIC) && bytesMatchAscii(buffer, versionOffset, TAR_VERSION);
+}
+function assertTarPathBytes(size, field) {
+	if (size > TAR_MAX_PATH_BYTES) throw new ToolError(`Archive ${field} exceeds ${TAR_MAX_PATH_BYTES} bytes`);
+}
+function assertTarPathString(value, field) {
+	assertTarPathBytes(Buffer.byteLength(value, "utf-8"), field);
+}
+function formatTarPathForError(value) {
+	if (Buffer.byteLength(value, "utf-8") <= TAR_ERROR_PATH_PREVIEW_BYTES) return value;
+	let end = 0;
+	let size = 0;
+	for (const char of value) {
+		const charSize = Buffer.byteLength(char, "utf-8");
+		if (size + charSize > 253) break;
+		end += char.length;
+		size += charSize;
+	}
+	return `${value.slice(0, end)}...`;
+}
+function readTarMetadataPath(data, field) {
+	const nul = data.indexOf(0);
+	const value = data.subarray(0, nul === -1 ? data.byteLength : nul);
+	assertTarPathBytes(value.byteLength, field);
+	return TAR_TEXT_DECODER.decode(value);
+}
+function readPaxPath(data, field) {
+	assertTarPathBytes(data.byteLength, field);
+	return TAR_TEXT_DECODER.decode(data);
+}
+/**
+* Read a tar numeric header field: GNU base-256 (high bit set) or the usual
+* NUL/space-padded octal. GNU's binary form reserves its high bit as a marker
+* and stores a signed two's-complement value in the remaining bits.
+*/
+function readTarNumeric(buffer, offset, length) {
+	if (offset < 0 || length <= 0 || offset + length > buffer.length) throw new ToolError("Invalid tar numeric field");
+	const first = buffer[offset];
+	let value = 0n;
+	if ((first & 128) !== 0) {
+		value = BigInt(first & 127);
+		for (let index = 1; index < length; index++) value = value << 8n | BigInt(buffer[offset + index]);
+		if ((first & 64) !== 0) value -= 1n << BigInt(length * 8 - 1);
+	} else for (let index = 0; index < length; index++) {
+		const byte = buffer[offset + index];
+		if (byte >= 48 && byte <= 55) value = value * 8n + BigInt(byte - 48);
+	}
+	return Number(value);
+}
+function readTarSize(buffer, offset) {
+	const size = readTarNumeric(buffer, offset, TAR_SIZE_LENGTH);
+	if (!Number.isSafeInteger(size) || size < 0) throw new ToolError("Invalid tar member size");
+	return size;
+}
+function tarPaddedSize(size) {
+	const remainder = size % TAR_BLOCK_SIZE;
+	const padded = size + (remainder === 0 ? 0 : TAR_BLOCK_SIZE - remainder);
+	if (!Number.isSafeInteger(padded)) throw new ToolError("Invalid tar member size");
+	return padded;
+}
+function parsePaxSize(value, field) {
+	if (!/^\d+$/.test(value)) throw new ToolError(`Invalid tar ${field}`);
+	const size = Number(value);
+	if (!Number.isSafeInteger(size) || size < 0) throw new ToolError(`Invalid tar ${field}`);
+	return size;
+}
+function isTarZeroBlock(buffer, offset) {
+	for (let i = 0; i < TAR_BLOCK_SIZE; i++) if (buffer[offset + i] !== 0) return false;
+	return true;
+}
+/** Verify a tar header block's checksum (both unsigned and signed conventions). */
+function tarChecksumMatches(buffer, offset) {
+	const stored = readTarNumeric(buffer, offset + TAR_CHECKSUM_OFFSET, TAR_CHECKSUM_LENGTH);
+	let unsigned = 0;
+	let signed = 0;
+	for (let i = 0; i < TAR_BLOCK_SIZE; i++) {
+		const byte = i >= TAR_CHECKSUM_OFFSET && i < 156 ? 32 : buffer[offset + i] ?? 0;
+		unsigned += byte;
+		signed += byte << 24 >> 24;
+	}
+	return stored === unsigned || stored === signed;
+}
+/**
+* Sentinel key marking that any `GNU.sparse.*` record appeared in a PAX
+* header. A real record cannot shadow it: PAX sparse keys always carry a
+* suffix after the trailing dot.
+*/
+const PAX_SPARSE_MARKER = "GNU.sparse.";
+/**
+* Parse a PAX extended-header payload into its `key → value` records. Only
+* exactly consumed keys are retained (plus the sparse marker), so a crafted
+* header packed with millions of unique records — including `GNU.sparse.*`
+* junk — cannot amplify into heap.
+*/
+function parsePaxRecords(data) {
+	const attrs = /* @__PURE__ */ new Map();
+	let pos = 0;
+	while (pos < data.length) {
+		let space = pos;
+		while (space < data.length && data[space] !== 32) space++;
+		if (space === pos || space >= data.length || space - pos > 16) throw new ToolError("Invalid tar PAX record");
+		let length = 0;
+		for (let index = pos; index < space; index++) {
+			const byte = data[index];
+			if (byte < 48 || byte > 57) throw new ToolError("Invalid tar PAX record");
+			length = length * 10 + (byte - 48);
+			if (length > data.length - pos) throw new ToolError("Invalid tar PAX record");
+		}
+		if (length <= 0 || pos + length > data.length || data[pos + length - 1] !== 10) throw new ToolError("Invalid tar PAX record");
+		const record = data.subarray(space + 1, pos + length - 1);
+		const eq = record.indexOf(61);
+		if (eq >= 0) {
+			const key = record.subarray(0, eq);
+			const value = record.subarray(eq + 1);
+			if (bytesMatchAscii(key, 0, PAX_SPARSE_MARKER)) {
+				attrs.set(PAX_SPARSE_MARKER, value.byteLength === 0 ? "" : "1");
+				if (tarBytesEqualAscii(key, "GNU.sparse.name")) attrs.set("GNU.sparse.name", readPaxPath(value, "PAX sparse path"));
+				else if (tarBytesEqualAscii(key, "GNU.sparse.realsize")) {
+					if (value.byteLength > TAR_MAX_PAX_NUMERIC_BYTES) throw new ToolError("Invalid tar sparse real size");
+					attrs.set("GNU.sparse.realsize", TAR_TEXT_DECODER.decode(value));
+				}
+			} else if (tarBytesEqualAscii(key, "path") || tarBytesEqualAscii(key, "linkpath")) {
+				const field = tarBytesEqualAscii(key, "path") ? "PAX path" : "PAX link target";
+				attrs.set(field === "PAX path" ? "path" : "linkpath", readPaxPath(value, field));
+			} else if (tarBytesEqualAscii(key, "size")) {
+				if (value.byteLength > TAR_MAX_PAX_NUMERIC_BYTES) throw new ToolError("Invalid tar member size");
+				attrs.set("size", TAR_TEXT_DECODER.decode(value));
+			}
+		}
+		pos += length;
+	}
+	return attrs;
+}
+function applyGlobalPax(globalPax, update) {
+	for (const [key, value] of update) if (value === "") globalPax.delete(key);
+	else globalPax.set(key, value);
+}
+function paxAttribute(globalPax, localPax, key) {
+	if (localPax?.has(key)) return localPax.get(key);
+	return globalPax.get(key);
+}
+function paxDeclaresSparse(globalPax, localPax) {
+	return paxAttribute(globalPax, localPax, PAX_SPARSE_MARKER) === "1";
+}
+function indexOfAscii(bytes, value, start) {
+	for (let offset = start; offset <= bytes.byteLength - value.length; offset++) if (bytesMatchAscii(bytes, offset, value)) return offset;
+	return -1;
+}
+function normalizeOldGnuName(value, field) {
+	const portable = value.replace(/\\/g, "/");
+	if (path.posix.isAbsolute(portable)) throw new ToolError(`Invalid old-GNU ${field}`);
+	const normalized = normalizeArchiveEntryPath(portable);
+	if (!normalized) throw new ToolError(`Invalid old-GNU ${field}`);
+	assertTarPathString(normalized, field);
+	return normalized;
+}
+function renameOldGnuEntries(entries, pendingLinks, fromPath, toPath) {
+	const moved = [...entries.entries()].filter(([entryPath]) => entryPath === fromPath || entryPath.startsWith(`${fromPath}/`));
+	if (moved.length === 0) return;
+	for (const [entryPath] of moved) entries.delete(entryPath);
+	for (const [entryPath, entry] of moved) {
+		const nextPath = `${toPath}${entryPath.slice(fromPath.length)}`;
+		assertTarPathString(nextPath, "member path");
+		entry.path = nextPath;
+		const replaced = entries.get(nextPath);
+		if (replaced) pendingLinks.delete(replaced);
+		entries.set(nextPath, entry);
+	}
+	for (const pending of pendingLinks.values()) {
+		if (pending.kind !== "hard link") continue;
+		if (pending.targetPath === fromPath || pending.targetPath.startsWith(`${fromPath}/`)) pending.targetPath = `${toPath}${pending.targetPath.slice(fromPath.length)}`;
+	}
+}
+function applyOldGnuNameRecords(data, entries, pendingLinks) {
+	const terminator = data.indexOf(0);
+	const end = terminator === -1 ? data.byteLength : terminator;
+	let start = 0;
+	while (start < end) {
+		const newline = data.indexOf(10, start);
+		const lineEnd = newline === -1 || newline > end ? end : newline;
+		const line = data.subarray(start, lineEnd);
+		if (bytesMatchAscii(line, 0, "Rename ")) {
+			const separator = indexOfAscii(line, " to ", 7);
+			if (separator === -1) throw new ToolError("Invalid old-GNU name record");
+			const source = readTarMetadataPath(line.subarray(7, separator), "old-GNU source path");
+			const targetEnd = line[line.byteLength - 1] === 47 ? line.byteLength - 1 : line.byteLength;
+			const target = readTarMetadataPath(line.subarray(separator + 4, targetEnd), "old-GNU target path");
+			renameOldGnuEntries(entries, pendingLinks, normalizeOldGnuName(source, "source path"), normalizeOldGnuName(target, "target path"));
+		}
+		start = lineEnd + 1;
+	}
+}
+/**
+* Index a tar (optionally gzip-compressed) archive entirely in TypeScript.
+* Handles ustar/GNU/pax layouts, `./`-prefixed and `prefix`-split names, GNU
+* `@LongLink` names/link targets, pax `path`/`linkpath`/`size` overrides, and
+* hard links. This deliberately avoids `Bun.Archive`/libarchive, whose
+* internal allocation-failure path calls `abort()` and takes down the whole
+* process on a crafted or oversized member (#4774). Sparse members are
+* indexed but flagged; reading their bytes throws a catchable `ToolError`
+* rather than returning a misassembled payload.
+*/
+function readTarEntries(rawBytes) {
+	assertTarArchiveSize(rawBytes.byteLength);
+	let buffer;
+	try {
+		buffer = gunzipIfNeeded(rawBytes);
+	} catch (error) {
+		throw new ToolError(error instanceof Error ? error.message : String(error));
+	}
+	assertTarArchiveSize(buffer.byteLength);
+	const entries = /* @__PURE__ */ new Map();
+	const pendingLinks = /* @__PURE__ */ new Map();
+	const addEntry = (entry, pendingLink) => {
+		const existing = entries.get(entry.path);
+		const indexed = upsertArchiveEntry(entries, entry);
+		if (!indexed) return;
+		if (existing) pendingLinks.delete(existing);
+		if (pendingLink) pendingLinks.set(indexed, pendingLink);
+	};
+	let offset = 0;
+	let longName;
+	let longLink;
+	let localPax;
+	const globalPax = /* @__PURE__ */ new Map();
+	let sawTerminator = false;
+	while (offset + TAR_BLOCK_SIZE <= buffer.length) {
+		if (isTarZeroBlock(buffer, offset)) {
+			sawTerminator = true;
+			break;
+		}
+		if (!tarChecksumMatches(buffer, offset)) throw new ToolError("Invalid or corrupt tar archive header");
+		const headerOffset = offset;
+		const typeFlag = String.fromCharCode(buffer[headerOffset + TAR_TYPEFLAG_OFFSET] || 48);
+		let size = readTarSize(buffer, headerOffset + TAR_SIZE_OFFSET);
+		let name = readTarString(buffer, headerOffset + TAR_NAME_OFFSET, TAR_NAME_LENGTH);
+		if (isUstarHeader(buffer, headerOffset)) {
+			const prefix = readTarString(buffer, headerOffset + TAR_PREFIX_OFFSET, TAR_PREFIX_LENGTH);
+			if (prefix) name = `${prefix}/${name}`;
+		}
+		let linkName = readTarString(buffer, headerOffset + TAR_LINKNAME_OFFSET, TAR_LINKNAME_LENGTH);
+		const mtime = readTarNumeric(buffer, headerOffset + TAR_MTIME_OFFSET, TAR_MTIME_LENGTH);
+		offset += TAR_BLOCK_SIZE;
+		const dataBlocks = tarPaddedSize(size);
+		if (dataBlocks > buffer.length - offset) throw new ToolError("Archive member data is truncated");
+		const data = buffer.subarray(offset, offset + size);
+		if (typeFlag === "L") {
+			longName = readTarMetadataPath(data, "GNU long path");
+			offset += dataBlocks;
+			continue;
+		}
+		if (typeFlag === "K") {
+			longLink = readTarMetadataPath(data, "GNU long link target");
+			offset += dataBlocks;
+			continue;
+		}
+		if (typeFlag === "N") {
+			applyOldGnuNameRecords(data, entries, pendingLinks);
+			offset += dataBlocks;
+			continue;
+		}
+		if (typeFlag === "x" || typeFlag === "X") {
+			localPax = parsePaxRecords(data);
+			offset += dataBlocks;
+			continue;
+		}
+		if (typeFlag === "g") {
+			applyGlobalPax(globalPax, parsePaxRecords(data));
+			offset += dataBlocks;
+			continue;
+		}
+		if (longName !== void 0) name = longName;
+		if (longLink !== void 0) linkName = longLink;
+		const paxPath = paxAttribute(globalPax, localPax, "path");
+		if (paxPath !== void 0) name = paxPath;
+		const paxLinkPath = paxAttribute(globalPax, localPax, "linkpath");
+		if (paxLinkPath !== void 0) linkName = paxLinkPath;
+		const paxSize = paxAttribute(globalPax, localPax, "size");
+		if (paxSize !== void 0) size = parsePaxSize(paxSize, "member size");
+		const paxSparseName = paxAttribute(globalPax, localPax, "GNU.sparse.name");
+		if (paxSparseName !== void 0) name = paxSparseName;
+		let displaySize = size;
+		const paxSparseRealSize = paxAttribute(globalPax, localPax, "GNU.sparse.realsize");
+		if (paxSparseRealSize !== void 0) displaySize = parsePaxSize(paxSparseRealSize, "sparse real size");
+		const sparse = typeFlag === "S" || paxDeclaresSparse(globalPax, localPax);
+		if (typeFlag === "S" && buffer[headerOffset + TAR_GNU_SPARSE_ISEXTENDED_OFFSET] === 1) {
+			let extended = true;
+			while (extended) {
+				if (offset + TAR_BLOCK_SIZE > buffer.length) throw new ToolError("Archive sparse metadata is truncated");
+				extended = buffer[offset + TAR_GNU_SPARSE_CONT_ISEXTENDED_OFFSET] === 1;
+				offset += TAR_BLOCK_SIZE;
+			}
+		}
+		const dataOffset = offset;
+		const memberDataBlocks = tarPaddedSize(size);
+		if (memberDataBlocks > buffer.length - dataOffset) throw new ToolError(`Archive member '${formatTarPathForError(name)}' is truncated`);
+		offset += memberDataBlocks;
+		longName = void 0;
+		longLink = void 0;
+		localPax = void 0;
+		const isDirectory = typeFlag === "5" || name.endsWith("/");
+		const normalizedPath = normalizeArchiveEntryPath(name);
+		if (!normalizedPath) continue;
+		assertTarPathString(normalizedPath, "member path");
+		const scaledMtime = mtime * 1e3;
+		const mtimeMs = mtime !== 0 && Number.isSafeInteger(mtime) && Number.isSafeInteger(scaledMtime) ? scaledMtime : void 0;
+		if (isDirectory) {
+			addEntry({
+				path: normalizedPath,
+				isDirectory: true,
+				size: 0,
+				mtimeMs
+			});
+			continue;
+		}
+		if (typeFlag === "1" || typeFlag === "2") {
+			const kind = typeFlag === "1" ? "hard link" : "symlink";
+			const portableLinkName = linkName.replace(/\\/g, "/");
+			assertTarPathString(portableLinkName, "link target");
+			const targetPath = typeFlag === "1" ? normalizeArchiveEntryPath(portableLinkName) : path.posix.isAbsolute(portableLinkName) ? void 0 : normalizeArchiveLookupPath(path.posix.join(path.posix.dirname(normalizedPath), portableLinkName));
+			const entry = {
+				path: normalizedPath,
+				isDirectory: false,
+				size: 0,
+				mtimeMs
+			};
+			if (targetPath === void 0 || Buffer.byteLength(targetPath, "utf-8") > TAR_MAX_PATH_BYTES) {
+				if (kind === "hard link") throw new ToolError(`Archive hard link '${formatTarPathForError(normalizedPath)}' has an invalid target`);
+				entry.storage = {
+					type: "tar-link",
+					targetPath: portableLinkName
+				};
+				addEntry(entry);
+				continue;
+			}
+			addEntry(entry, {
+				kind,
+				targetPath
+			});
+			continue;
+		}
+		if (typeFlag !== "0" && typeFlag !== "\0" && typeFlag !== "7" && typeFlag !== "S") continue;
+		addEntry({
+			path: normalizedPath,
+			isDirectory: false,
+			size: displaySize,
+			mtimeMs,
+			storage: {
+				type: "tar",
+				buffer,
+				dataOffset,
+				sparse
+			}
+		});
+	}
+	if (!sawTerminator) throw new ToolError("Not a valid tar archive: missing terminating zero block");
+	if (pendingLinks.size > 0) {
+		const entriesByPath = entries;
+		const directoryPrefixes = /* @__PURE__ */ new Set();
+		for (const entry of entriesByPath.values()) {
+			const memberPath = entry.path;
+			for (let cut = memberPath.lastIndexOf("/"); cut > 0; cut = memberPath.lastIndexOf("/", cut - 1)) {
+				const prefix = memberPath.slice(0, cut);
+				if (directoryPrefixes.has(prefix)) break;
+				directoryPrefixes.add(prefix);
+			}
+		}
+		const unresolved = new Set(pendingLinks.keys());
+		const dependents = /* @__PURE__ */ new Map();
+		const findUnresolvedBlocker = (targetPath) => {
+			for (let end = targetPath.length; end > 0; end = targetPath.lastIndexOf("/", end - 1)) {
+				const prefixEntry = entriesByPath.get(targetPath.slice(0, end));
+				if (prefixEntry && unresolved.has(prefixEntry)) return prefixEntry;
+			}
+			return null;
+		};
+		const queue = [...unresolved];
+		while (queue.length > 0) {
+			const entry = queue.pop();
+			if (!unresolved.has(entry)) continue;
+			const pending = pendingLinks.get(entry);
+			let blocker = findUnresolvedBlocker(pending.targetPath);
+			let targetPath = pending.targetPath;
+			if (blocker === null) {
+				try {
+					targetPath = resolveDirectoryAliasPath(entriesByPath, targetPath);
+				} catch {}
+				if (targetPath !== pending.targetPath) blocker = findUnresolvedBlocker(targetPath);
+			}
+			if (blocker !== null && blocker !== entry) {
+				const waiting = dependents.get(blocker);
+				if (waiting) waiting.push(entry);
+				else dependents.set(blocker, [entry]);
+				continue;
+			}
+			unresolved.delete(entry);
+			const settled = dependents.get(entry);
+			if (settled) {
+				dependents.delete(entry);
+				queue.push(...settled);
+			}
+			if (blocker === entry) {
+				if (pending.kind === "hard link") throw new ToolError(`Archive hard link '${formatTarPathForError(entry.path)}' has a cyclic target '${formatTarPathForError(pending.targetPath)}'`);
+				entry.storage = {
+					type: "tar-link",
+					targetPath: pending.targetPath
+				};
+				continue;
+			}
+			const target = entriesByPath.get(targetPath);
+			if (target?.storage && !target.isDirectory && !unresolved.has(target)) {
+				entry.size = target.size;
+				entry.storage = target.storage;
+				continue;
+			}
+			if (!(targetPath === "" || target?.isDirectory === true || directoryPrefixes.has(targetPath))) {
+				if (pending.kind === "symlink") {
+					entry.storage = {
+						type: "tar-link",
+						targetPath: pending.targetPath
+					};
+					continue;
+				}
+				const reason = target ? "unreadable member" : "missing member";
+				throw new ToolError(`Archive hard link '${formatTarPathForError(entry.path)}' targets ${reason} '${formatTarPathForError(pending.targetPath)}'`);
+			}
+			if (pending.kind === "hard link") throw new ToolError(`Archive hard link '${formatTarPathForError(entry.path)}' targets directory '${formatTarPathForError(pending.targetPath)}'`);
+			entry.isDirectory = true;
+			entry.storage = {
+				type: "tar-link",
+				targetPath: pending.targetPath
+			};
+		}
+		if (unresolved.size > 0) throw new ToolError("Archive contains cyclic or unsupported links");
+	}
+	return [...entries.values()];
+}
+/**
+* Slice one indexed tar member's bytes out of the archive buffer. Sparse
+* members cannot be reassembled from a contiguous slice, so reading them throws
+* a catchable error instead of returning corrupt data.
+*/
+function assertArchiveMemberSize(size, memberPath) {
+	if (!Number.isSafeInteger(size) || size < 0) throw new ToolError(`Archive member '${formatTarPathForError(memberPath)}' has an invalid size`);
+	if (size > MAX_ARCHIVE_MEMBER_BYTES) throw new ToolError(`Archive member '${formatTarPathForError(memberPath)}' is too large to extract in memory (${formatBytes(size)} > ${formatBytes(MAX_ARCHIVE_MEMBER_BYTES)} limit)`);
+}
+function extractTarMember(storage, size, memberPath) {
+	assertArchiveMemberSize(size, memberPath);
+	if (storage.sparse) throw new ToolError(`Archive member '${formatTarPathForError(memberPath)}' is a sparse file and cannot be read`);
+	if (size > storage.buffer.length - storage.dataOffset) throw new ToolError(`Archive member '${formatTarPathForError(memberPath)}' is truncated`);
+	return storage.buffer.subarray(storage.dataOffset, storage.dataOffset + size);
+}
+function throwUnreadableTarLink(storage, memberPath) {
+	throw new ToolError(`Archive symlink '${formatTarPathForError(memberPath)}' cannot be materialized from target '${formatTarPathForError(storage.targetPath)}'`);
+}
+/** ELOOP-style bound on directory-alias rewrites during a single path lookup. */
+const MAX_LINK_RESOLUTION_DEPTH = 40;
+/**
+* Rewrite `archivePath` through directory symlink aliases until it no longer
+* crosses one. Bounded: an exact revisit and an alias chain that keeps growing
+* the path (e.g. a directory symlink targeting its own subtree, `a -> a/b`)
+* both throw a catchable cyclic-symlink error instead of looping forever.
+*/
+function resolveDirectoryAliasPath(entries, archivePath) {
+	let resolvedPath = archivePath;
+	const seen = /* @__PURE__ */ new Set();
+	for (let rewrites = 0; !seen.has(resolvedPath);) {
+		seen.add(resolvedPath);
+		let replacement;
+		for (let end = resolvedPath.length; end > 0; end = resolvedPath.lastIndexOf("/", end - 1)) {
+			const entry = entries.get(resolvedPath.slice(0, end));
+			if (!entry?.isDirectory || entry.storage?.type !== "tar-link") continue;
+			const suffix = resolvedPath.slice(end + 1);
+			replacement = suffix ? entry.storage.targetPath ? `${entry.storage.targetPath}/${suffix}` : suffix : entry.storage.targetPath;
+			break;
+		}
+		if (replacement === void 0) return resolvedPath;
+		if (++rewrites > MAX_LINK_RESOLUTION_DEPTH) break;
+		resolvedPath = replacement;
+	}
+	throw new ToolError(`Archive path '${archivePath}' crosses a cyclic symlink`);
+}
+async function readZipEntries(source) {
+	const directoryInfo = await readZipCentralDirectoryInfo(source);
+	return parseZipCentralDirectory(source, await source.read(directoryInfo.offset, directoryInfo.offset + directoryInfo.size), directoryInfo.entries);
+}
+/**
+* Split an `archive.ext:inner/path` reference into every plausible
+* `{ archivePath, subPath }` pair, longest archive prefix first. A path may
+* contain more than one archive extension, so each candidate is a guess at
+* where the archive ends and the member portion begins.
+*/
+function parseArchivePathCandidates(filePath) {
+	const normalized = filePath.replace(/\\/g, "/");
+	const pattern = new RegExp(`\\.(?:${ARCHIVE_EXTENSION_ALTERNATION})(?=(?::|$))`, "gi");
+	const seen = /* @__PURE__ */ new Set();
+	const candidates = [];
+	let match;
+	while (true) {
+		match = pattern.exec(normalized);
+		if (match === null) break;
+		const end = match.index + match[0].length;
+		const archivePath = filePath.slice(0, end);
+		const subPath = normalized.slice(end).replace(/^:+/, "");
+		const key = `${archivePath}\0${subPath}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		candidates.push({
+			archivePath,
+			subPath
+		});
+	}
+	return candidates.sort((left, right) => right.archivePath.length - left.archivePath.length);
+}
+/**
+* An indexed, read-only view over a single archive. ZIP archives are indexed
+* from the central directory and members are inflated on demand; tar archives
+* are parsed from one in-memory buffer, members are sliced on demand, and
+* directory symlink aliases are traversed lazily.
+*/
+var ArchiveReader = class {
+	format;
+	#entries = /* @__PURE__ */ new Map();
+	constructor(format, entries) {
+		this.format = format;
+		for (const entry of entries) upsertArchiveEntry(this.#entries, entry);
+		ensureParentDirectories(this.#entries);
+	}
+	getNode(subPath) {
+		const normalizedPath = normalizeArchiveLookupPath(subPath);
+		if (normalizedPath === void 0) return void 0;
+		if (normalizedPath === "") return {
+			path: "",
+			isDirectory: true,
+			size: 0
+		};
+		const resolvedPath = resolveDirectoryAliasPath(this.#entries, normalizedPath);
+		if (resolvedPath === "") return {
+			path: normalizedPath,
+			isDirectory: true,
+			size: 0
+		};
+		const entry = this.#entries.get(resolvedPath);
+		if (!entry) return void 0;
+		return {
+			path: normalizedPath,
+			isDirectory: entry.isDirectory,
+			size: entry.size,
+			mtimeMs: entry.mtimeMs
+		};
+	}
+	listDirectory(subPath) {
+		const normalizedPath = normalizeArchiveLookupPath(subPath);
+		if (normalizedPath === void 0) throw new ToolError("Archive path cannot contain '..'");
+		const resolvedPath = normalizedPath ? resolveDirectoryAliasPath(this.#entries, normalizedPath) : "";
+		if (normalizedPath && resolvedPath !== "") {
+			const entry = this.#entries.get(resolvedPath);
+			if (!entry) throw new ToolError(`Archive path '${normalizedPath}' not found`);
+			if (!entry.isDirectory) throw new ToolError(`Archive path '${normalizedPath}' is not a directory`);
+		}
+		const sourcePrefix = resolvedPath ? `${resolvedPath}/` : "";
+		const children = /* @__PURE__ */ new Map();
+		for (const entry of this.#entries.values()) {
+			if (resolvedPath) {
+				if (!entry.path.startsWith(sourcePrefix) || entry.path === resolvedPath) continue;
+			}
+			const relativePath = resolvedPath ? entry.path.slice(sourcePrefix.length) : entry.path;
+			const nextSegment = relativePath.split("/")[0];
+			if (!nextSegment) continue;
+			const childPath = normalizedPath ? `${normalizedPath}/${nextSegment}` : nextSegment;
+			if (children.has(childPath)) continue;
+			const sourceChildPath = resolvedPath ? `${resolvedPath}/${nextSegment}` : nextSegment;
+			const childEntry = this.#entries.get(sourceChildPath);
+			const isDirectory = childEntry?.isDirectory ?? relativePath.includes("/");
+			children.set(childPath, {
+				name: nextSegment,
+				path: childPath,
+				isDirectory,
+				size: isDirectory ? 0 : childEntry?.size ?? entry.size,
+				mtimeMs: childEntry?.mtimeMs ?? entry.mtimeMs
+			});
+		}
+		return [...children.values()].sort((left, right) => left.name.toLowerCase().localeCompare(right.name.toLowerCase()));
+	}
+	async readFile(subPath) {
+		const normalizedPath = normalizeArchiveLookupPath(subPath);
+		if (!normalizedPath) throw new ToolError("Archive file path is required");
+		const resolvedPath = resolveDirectoryAliasPath(this.#entries, normalizedPath);
+		if (resolvedPath === "") throw new ToolError(`Archive path '${normalizedPath}' is a directory`);
+		const entry = this.#entries.get(resolvedPath);
+		if (!entry) throw new ToolError(`Archive file '${normalizedPath}' not found`);
+		if (entry.isDirectory) throw new ToolError(`Archive path '${normalizedPath}' is a directory`);
+		if (!entry.storage) throw new ToolError(`Archive file '${normalizedPath}' has no readable storage`);
+		assertArchiveMemberSize(entry.size, normalizedPath);
+		let bytes;
+		if (entry.storage.type === "tar") bytes = extractTarMember(entry.storage, entry.size, normalizedPath);
+		else if (entry.storage.type === "tar-link") throwUnreadableTarLink(entry.storage, normalizedPath);
+		else bytes = await readZipFileBytes(entry.storage, entry.size);
+		return {
+			path: normalizedPath,
+			isDirectory: false,
+			size: entry.size,
+			mtimeMs: entry.mtimeMs,
+			bytes
+		};
+	}
+};
+/**
+* Open an archive for reading. ZIP archives opened from a path are indexed
+* lazily via ranged central-directory reads (members inflate on demand); tar
+* archives and in-memory ZIPs are read from a single buffer.
+*/
+async function openArchive(source) {
+	if (typeof source !== "string" && "bytes" in source) {
+		if (source.format === "zip") return new ArchiveReader(source.format, await readZipEntries(memoryByteSource(source.bytes)));
+		return new ArchiveReader(source.format, readTarEntries(source.bytes));
+	}
+	const filePath = typeof source === "string" ? source : source.path;
+	const format = typeof source === "string" ? archiveFormatFromPath(filePath) : source.format;
+	if (!format) throw new ToolError(`Unsupported archive format: ${filePath}`);
+	if (format === "zip") return new ArchiveReader(format, await readZipEntries(fileByteSource(filePath)));
+	const file = Bun.file(filePath);
+	assertTarArchiveSize(file.size);
+	return new ArchiveReader(format, readTarEntries(await file.bytes()));
+}
+/** Render the top-level entries of an in-memory archive as one line each. */
+async function listArchiveRoot(bytes, format, opts = {}) {
+	const entries = (await openArchive({
+		bytes,
+		format
+	})).listDirectory("");
+	const lines = formatArchiveEntryLines(opts.limit !== void 0 && opts.limit > 0 ? entries.slice(0, opts.limit) : entries);
+	return lines.length > 0 ? lines.join("\n") : "(empty archive directory)";
+}
+async function resolveArchiveBytes(source) {
+	if (typeof source !== "string" && "bytes" in source) return source;
+	const filePath = typeof source === "string" ? source : source.path;
+	const format = typeof source === "string" ? archiveFormatFromPath(filePath) : source.format;
+	if (!format) throw new ToolError(`Unsupported archive format: ${filePath}`);
+	const file = Bun.file(filePath);
+	if (format !== "zip") assertTarArchiveSize(file.size);
+	return {
+		bytes: await file.bytes(),
+		format
+	};
+}
+async function memberToBytes(content) {
+	if (typeof content === "string") return ENCODER.encode(content);
+	if (content instanceof Uint8Array) return content;
+	return new Uint8Array(await content.arrayBuffer());
+}
+/**
+* Fully materialize every file member into a `path → content` map: ZIP members
+* are inflated in memory, tar members are sliced from the decoded archive
+* buffer. Use this when you need every entry (rewrite, extract); for browsing
+* or single-member reads prefer `openArchive`, which is lazy for ZIP.
+*/
+async function readArchiveEntries(source) {
+	const { bytes, format } = await resolveArchiveBytes(source);
+	const entries = /* @__PURE__ */ new Map();
+	if (format === "zip") {
+		const unzipped = unzip(bytes);
+		for (const name in unzipped) entries.set(name, unzipped[name]);
+		return entries;
+	}
+	for (const entry of readTarEntries(bytes)) {
+		if (entry.isDirectory) {
+			if (entry.storage?.type === "tar-link") throwUnreadableTarLink(entry.storage, entry.path);
+			continue;
+		}
+		if (!entry.storage) throw new ToolError(`Archive file '${entry.path}' has no readable storage`);
+		if (entry.storage.type === "tar-link") throwUnreadableTarLink(entry.storage, entry.path);
+		if (entry.storage.type !== "tar") throw new ToolError(`Archive file '${entry.path}' has invalid tar storage`);
+		entries.set(entry.path, extractTarMember(entry.storage, entry.size, entry.path));
+	}
+	return entries;
+}
+/**
+* Serialize `entries` into an archive of `format` and write it to `destPath`.
+* ZIP is framed in memory, tar / tar.gz via `Bun.Archive` (gzip for tar.gz).
+* String members are encoded as UTF-8.
+*/
+async function writeArchive(destPath, format, entries) {
+	if (format === "zip") {
+		const record = {};
+		for (const [name, content] of entries) record[name.replace(/\\/g, "/")] = await memberToBytes(content);
+		await Bun.write(destPath, zip(record));
+		return;
+	}
+	const record = {};
+	for (const [name, content] of entries) record[name.replace(/\\/g, "/")] = content;
+	await Bun.Archive.write(destPath, record, format === "tar.gz" ? { compress: "gzip" } : void 0);
+}
+/**
+* Extract every file member to `destDir`, creating parent directories as
+* needed. Entries that would escape `destDir` (via `..` or an absolute path)
+* are rejected. Returns the number of files written.
+*/
+async function extractArchive(source, destDir) {
+	const extractRoot = path.resolve(destDir);
+	const entries = await readArchiveEntries(source);
+	let count = 0;
+	for (const [name, content] of entries) {
+		if (name.endsWith("/")) continue;
+		const outputPath = path.resolve(extractRoot, name);
+		if (!outputPath.startsWith(extractRoot + path.sep)) throw new ToolError(`Archive entry escapes extraction dir: ${name}`);
+		await Bun.write(outputPath, content);
+		count++;
+	}
+	return count;
+}
+function writeUInt16LE(buf, offset, value) {
+	buf[offset] = value & 255;
+	buf[offset + 1] = value >>> 8 & 255;
+}
+function writeUInt32LE(buf, offset, value) {
+	buf[offset] = value & 255;
+	buf[offset + 1] = value >>> 8 & 255;
+	buf[offset + 2] = value >>> 16 & 255;
+	buf[offset + 3] = value >>> 24 & 255;
+}
+/**
+* Frame a `path → bytes` map into a ZIP archive in memory. Each member is raw
+* DEFLATE unless that would not shrink it, in which case it is stored. ZIP64 is
+* not emitted; archives beyond the 32-bit limits throw rather than corrupt.
+*/
+function zip(entries) {
+	const localParts = [];
+	const centralParts = [];
+	let offset = 0;
+	let count = 0;
+	for (const name in entries) {
+		const data = entries[name];
+		const nameBytes = ENCODER.encode(name);
+		const crc = zlib.crc32(data) >>> 0;
+		const uncompressedSize = data.byteLength;
+		const deflated = zlib.deflateRawSync(data);
+		const stored = deflated.byteLength >= uncompressedSize;
+		const method = stored ? ZIP_STORED_COMPRESSION : ZIP_DEFLATE_COMPRESSION;
+		const payload = stored ? data : deflated;
+		if (count + 1 >= ZIP_UINT16_MAX || nameBytes.byteLength > ZIP_UINT16_MAX || uncompressedSize >= ZIP_UINT32_MAX || offset + 30 + nameBytes.byteLength + payload.byteLength >= ZIP_UINT32_MAX) throw new ToolError("ZIP archive is too large to write (ZIP64 is not supported)");
+		const header = new Uint8Array(30 + nameBytes.byteLength);
+		writeUInt32LE(header, 0, ZIP_LOCAL_FILE_HEADER_SIGNATURE);
+		writeUInt16LE(header, 4, 20);
+		writeUInt16LE(header, 6, ZIP_UTF8_FLAG);
+		writeUInt16LE(header, 8, method);
+		writeUInt16LE(header, 12, 33);
+		writeUInt32LE(header, 14, crc);
+		writeUInt32LE(header, 18, payload.byteLength);
+		writeUInt32LE(header, 22, uncompressedSize);
+		writeUInt16LE(header, 26, nameBytes.byteLength);
+		header.set(nameBytes, 30);
+		localParts.push(header, payload);
+		const record = new Uint8Array(46 + nameBytes.byteLength);
+		writeUInt32LE(record, 0, ZIP_CENTRAL_DIRECTORY_HEADER_SIGNATURE);
+		writeUInt16LE(record, 4, 20);
+		writeUInt16LE(record, 6, 20);
+		writeUInt16LE(record, 8, ZIP_UTF8_FLAG);
+		writeUInt16LE(record, 10, method);
+		writeUInt16LE(record, 14, 33);
+		writeUInt32LE(record, 16, crc);
+		writeUInt32LE(record, 20, payload.byteLength);
+		writeUInt32LE(record, 24, uncompressedSize);
+		writeUInt16LE(record, 28, nameBytes.byteLength);
+		writeUInt32LE(record, 42, offset);
+		record.set(nameBytes, 46);
+		centralParts.push(record);
+		offset += header.byteLength + payload.byteLength;
+		count++;
+	}
+	const centralSize = centralParts.reduce((sum, part) => sum + part.byteLength, 0);
+	if (centralSize >= ZIP_UINT32_MAX || offset + centralSize + ZIP_EOCD_MIN_LENGTH >= ZIP_UINT32_MAX) throw new ToolError("ZIP archive is too large to write (ZIP64 is not supported)");
+	const eocd = new Uint8Array(ZIP_EOCD_MIN_LENGTH);
+	writeUInt32LE(eocd, 0, ZIP_EOCD_SIGNATURE);
+	writeUInt16LE(eocd, 8, count);
+	writeUInt16LE(eocd, 10, count);
+	writeUInt32LE(eocd, 12, centralSize);
+	writeUInt32LE(eocd, 16, offset);
+	const out = new Uint8Array(offset + centralSize + ZIP_EOCD_MIN_LENGTH);
+	let pos = 0;
+	for (const part of localParts) {
+		out.set(part, pos);
+		pos += part.byteLength;
+	}
+	for (const part of centralParts) {
+		out.set(part, pos);
+		pos += part.byteLength;
+	}
+	out.set(eocd, pos);
+	return out;
+}
+function readZip64CentralDirectoryInfoSync(bytes, eocdOffset) {
+	const locatorOffset = eocdOffset - ZIP64_EOCD_LOCATOR_LENGTH;
+	if (locatorOffset < 0) return void 0;
+	const locator = readMemoryRange(bytes, locatorOffset, locatorOffset + ZIP64_EOCD_LOCATOR_LENGTH);
+	if (readUInt32LE(locator, 0) !== ZIP64_EOCD_LOCATOR_SIGNATURE) return void 0;
+	if (readUInt32LE(locator, 4) !== 0 || readUInt32LE(locator, 16) > 1) throw new ToolError("Multi-disk ZIP archives are not supported");
+	const zip64EocdOffset = readUInt64LEAsNumber(locator, 8);
+	const record = readMemoryRange(bytes, zip64EocdOffset, zip64EocdOffset + 56);
+	if (readUInt32LE(record, 0) !== ZIP64_EOCD_SIGNATURE) throw new ToolError("Invalid ZIP archive: missing ZIP64 end of central directory");
+	if (readUInt32LE(record, 16) !== 0 || readUInt32LE(record, 20) !== 0) throw new ToolError("Multi-disk ZIP archives are not supported");
+	return {
+		entries: readUInt64LEAsNumber(record, 32),
+		size: readUInt64LEAsNumber(record, 40),
+		offset: readUInt64LEAsNumber(record, 48)
+	};
+}
+function readCentralDirectoryInfoSync(bytes) {
+	const fileSize = bytes.byteLength;
+	if (fileSize < ZIP_EOCD_MIN_LENGTH) throw new ToolError("Invalid ZIP archive: missing end of central directory");
+	const tailStart = fileSize - Math.min(fileSize, 65557);
+	const tail = readMemoryRange(bytes, tailStart, fileSize);
+	const eocdIndex = findEndOfCentralDirectory(tail);
+	if (readUInt16LE(tail, eocdIndex + 4) !== 0 || readUInt16LE(tail, eocdIndex + 6) !== 0) throw new ToolError("Multi-disk ZIP archives are not supported");
+	let entries = readUInt16LE(tail, eocdIndex + 10);
+	let size = readUInt32LE(tail, eocdIndex + 12);
+	let offset = readUInt32LE(tail, eocdIndex + 16);
+	const needsZip64 = entries === ZIP_UINT16_MAX || size === ZIP_UINT32_MAX || offset === ZIP_UINT32_MAX;
+	const zip64Info = readZip64CentralDirectoryInfoSync(bytes, tailStart + eocdIndex);
+	if (zip64Info) ({entries, size, offset} = zip64Info);
+	else if (needsZip64) throw new ToolError("Invalid ZIP archive: missing ZIP64 central directory metadata");
+	if (offset + size > fileSize) throw new ToolError("Invalid ZIP archive: central directory exceeds file size");
+	return {
+		entries,
+		offset,
+		size
+	};
+}
+function extractZipMember(bytes, storage, uncompressedSize) {
+	if ((storage.flags & ZIP_ENCRYPTED_FLAG) !== 0) throw new ToolError("Encrypted ZIP entries are not supported");
+	const headerStart = storage.localHeaderOffset;
+	const localHeader = readMemoryRange(bytes, headerStart, headerStart + 30);
+	if (readUInt32LE(localHeader, 0) !== ZIP_LOCAL_FILE_HEADER_SIGNATURE) throw new ToolError("Invalid ZIP archive: malformed local file header");
+	const fileNameLength = readUInt16LE(localHeader, 26);
+	const extraLength = readUInt16LE(localHeader, 28);
+	const dataStart = headerStart + 30 + fileNameLength + extraLength;
+	return decodeZipMember(readMemoryRange(bytes, dataStart, dataStart + storage.compressedSize), storage.compression, uncompressedSize);
+}
+//#endregion
+export { openArchive as a, sniffArchiveFormat as c, writeArchive as d, ToolAbortError as f, listArchiveRoot as i, unzip as l, throwIfAborted as m, extractArchive as n, parseArchivePathCandidates as o, ToolError as p, formatArchiveEntryLines as r, readArchiveEntries as s, archiveFormatFromPath as t, unzipText as u };