@zuplo/cli 6.73.8 → 6.73.11

package/node_modules/js-yaml/lib/loader.js

@@ -152,7 +152,7 @@ function State (input, options) {
   this.json = options['json'] || false
   this.listener = options['listener'] || null
   this.maxDepth = typeof options['maxDepth'] === 'number' ? options['maxDepth'] : 100
-  this.maxMergeSeqLength = typeof options['maxMergeSeqLength'] === 'number' ? options['maxMergeSeqLength'] : 20
+  this.maxTotalMergeKeys = typeof options['maxTotalMergeKeys'] === 'number' ? options['maxTotalMergeKeys'] : 10000
 
   this.implicitTypes = this.schema.compiledImplicit
   this.typeMap = this.schema.compiledTypeMap
@@ -163,6 +163,7 @@ function State (input, options) {
   this.lineStart = 0
   this.lineIndent = 0
   this.depth = 0
+  this.totalMergeKeys = 0
 
   // position of first leading tab in the current line,
   // used to make sure there are no tabs in the indentation
@@ -380,6 +381,10 @@ function mergeMappings (state, destination, source, overridableKeys) {
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
+    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
+      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+    }
+
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
       overridableKeys[key] = true
@@ -421,17 +426,8 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
-      if (valueNode.length > state.maxMergeSeqLength) {
-        throwError(state, 'merge sequence length exceeded maxMergeSeqLength (' + state.maxMergeSeqLength + ')')
-      }
-      const seen = new Set()
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
-        const src = valueNode[index]
-        // Existing keys are not overridden on merge, so dedupe sources to
-        // avoid redundant work on repeated aliases.
-        if (seen.has(src)) continue
-        seen.add(src)
-        mergeMappings(state, _result, src, overridableKeys)
+        mergeMappings(state, _result, valueNode[index], overridableKeys)
       }
     } else {
       mergeMappings(state, _result, valueNode, overridableKeys)

package/node_modules/js-yaml/lib/type/float.js

@@ -28,7 +28,7 @@ function resolveYamlFloat (data) {
     return false
   }
 
-  if (Number.isFinite(parseFloat(data, 10))) {
+  if (isFinite(parseFloat(data, 10))) {
     return true
   }
 

package/node_modules/js-yaml/lib/type/int.js

@@ -49,7 +49,7 @@ function resolveYamlInteger (data) {
         if (ch !== '0' && ch !== '1') return false
         hasDigits = true
       }
-      return hasDigits && Number.isFinite(parseYamlInteger(data))
+      return hasDigits && isFinite(parseYamlInteger(data))
     }
 
     if (ch === 'x') {
@@ -60,7 +60,7 @@ function resolveYamlInteger (data) {
         if (!isHexCode(data.charCodeAt(index))) return false
         hasDigits = true
       }
-      return hasDigits && Number.isFinite(parseYamlInteger(data))
+      return hasDigits && isFinite(parseYamlInteger(data))
     }
 
     if (ch === 'o') {
@@ -71,7 +71,7 @@ function resolveYamlInteger (data) {
         if (!isOctCode(data.charCodeAt(index))) return false
         hasDigits = true
       }
-      return hasDigits && Number.isFinite(parseYamlInteger(data))
+      return hasDigits && isFinite(parseYamlInteger(data))
     }
   }
 
@@ -86,7 +86,7 @@ function resolveYamlInteger (data) {
 
   if (!hasDigits) return false
 
-  return Number.isFinite(parseYamlInteger(data))
+  return isFinite(parseYamlInteger(data))
 }
 
 function parseYamlInteger (data) {

package/node_modules/js-yaml/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-yaml",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "YAML 1.2 parser and serializer",
   "keywords": [
     "yaml",
@@ -32,6 +32,9 @@
     "bin/",
     "dist/"
   ],
+  "publishConfig": {
+    "tag": "v4-legacy"
+  },
   "bin": {
     "js-yaml": "bin/js-yaml.js"
   },
@@ -53,8 +56,7 @@
     "build": "node support/build-dist.mjs",
     "build:demo": "npm run lint && node support/build_demo.mjs",
     "gh-demo": "npm run build:demo && gh-pages -d demo -f",
-    "prepack": "npm test && npm run build && npm run build:demo",
-    "postpublish": "npm run gh-demo"
+    "prepack": "npm test && npm run build"
   },
   "unpkg": "dist/js-yaml.min.js",
   "jsdelivr": "dist/js-yaml.min.js",
@@ -62,6 +64,10 @@
     "argparse": "^2.0.1"
   },
   "devDependencies": {
+    "@babel/core": "8.0.1",
+    "@babel/preset-env": "8.0.1",
+    "@rollup/plugin-commonjs": "29.0.3",
+    "@rollup/plugin-terser": "0.4.4",
     "c8": "^11.0.0",
     "codemirror": "^5.65.21",
     "eslint": "^9.39.4",
@@ -69,7 +75,7 @@
     "gh-pages": "^6.3.0",
     "neostandard": "^0.13.0",
     "tinybench": "^6.0.2",
-    "vite": "^8.0.14",
+    "vite": "7.3.6",
     "vite-plugin-node-polyfills": "^0.28.0",
     "vite-plugin-singlefile": "^2.3.3",
     "workerpool": "^10.0.2"

package/node_modules/tar/README.md

@@ -32,10 +32,27 @@ implementation. (Note that most of these are disabled if
   is set, or the extraction is run as root.
 - File and directory modes in the archive are ignored, unless
   the `chmod: true` option is set.
-
-**However**, care must still be taken when dealing with data from
-unknown sources, especially when extracting files, with this or
-any library, no matter how hardened it may be.
+- A path-reservation system is used to ensure that even when
+  multiple entries are being extracted in parallel, subsequent
+  entries with the same filename will not interfere with one
+  another (for example, exchanging a file with a symbolic link
+  while it is being written to).
+- Unicode characters in path names are fully normalized, to
+  prevent evading these protections with unicode equivalences.
+
+It is frankly unlikely that any tar implementation in JavaScript
+is going to be as secure as this one, unless a similar amount of
+work is put into it, putting it to the test over many years of
+intensive use and scrutiny. You can vibe-code a tar extractor in
+an afternoon, but you'll regret it.
+
+> [!WARNING]
+>
+> **However**, all that being said, _care must still be taken_
+> when dealing with data from unknown sources, especially when
+> extracting files, with this or any library, no matter how
+> hardened it may be. It is _your_ responsibility to use this
+> library safely.
 
 1. **NEVER** extract tarball data into a folder that could be
    potentially controlled by an unknown actor. A clever attacker
@@ -43,8 +60,10 @@ any library, no matter how hardened it may be.
    link to some location of their choosing, resulting in writing
    files outside the target folder. There is no reasonable way to
    harden against this category of attack, and security reports
-   about it will be closed. TOCTOU exposure is unavoidable when
-   creating files based on entries in an archive file.
+   about it will be closed.
+   [TOCTOU](https://cwe.mitre.org/data/definitions/367.html)
+   exposure is unavoidable when creating files based on entries
+   in an archive file.
 2. If you are unpacking tarballs that may come from an unknown
    source, it is **highly recommended** that you use a filter
    function that rejects all hardlinks and symbolic links. Link
@@ -551,6 +570,9 @@ The following options are supported:
   defaults to 1024. Anything deeper than the limit will raise a
   warning and skip the entry. Set to `Infinity` to remove the
   limitation.
+- `maxDecompressionRatio` Defaults to 1000. The maximum ratio of
+  decommpressed bytes to compressed bytes, in a compressed
+  archive. Set to `Infinity` to allow explosive decompression.
 
 The following options are mostly internal, but can be modified in some
 advanced use cases, such as re-using caches between runs.
@@ -610,6 +632,9 @@ The following options are supported:
   complete until the entry data is consumed.
 - `onwarn` A function that will get called with `(code, message, data)` for
   any warnings encountered. (See "Warnings and Errors")
+- `maxDecompressionRatio` Defaults to 1000. The maximum ratio of
+  decommpressed bytes to compressed bytes, in a compressed
+  archive. Set to `Infinity` to allow explosive decompression.
 
 ### tar.u(options, fileList, callback) [alias: tar.update]
 
@@ -885,6 +910,9 @@ Most unpack errors will cause a `warn` event to be emitted. If the
   defaults to 1024. Anything deeper than the limit will raise a
   warning and skip the entry. Set to `Infinity` to remove the
   limitation.
+- `maxDecompressionRatio` Defaults to 1000. The maximum ratio of
+  decommpressed bytes to compressed bytes, in a compressed
+  archive. Set to `Infinity` to allow explosive decompression.
 
 ### class UnpackSync
 

package/node_modules/tar/dist/commonjs/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/create.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AA8E1C,eAAO,MAAM,MAAM,wDAUlB,CAAA"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/create.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AA0E1C,eAAO,MAAM,MAAM,wDAUlB,CAAA"}

package/node_modules/tar/dist/commonjs/create.js

@@ -28,7 +28,7 @@ const createFile = (opt, files) => {
         stream.on('close', res);
         p.on('error', rej);
     });
-    addFilesAsync(p, files);
+    addFilesAsync(p, files).catch(er => p.emit('error', er));
     return promise;
 };
 const addFilesSync = (p, files) => {
@@ -48,8 +48,7 @@ const addFilesSync = (p, files) => {
     p.end();
 };
 const addFilesAsync = async (p, files) => {
-    for (let i = 0; i < files.length; i++) {
-        const file = String(files[i]);
+    for (const file of files) {
         if (file.charAt(0) === '@') {
             await (0, list_js_1.list)({
                 file: node_path_1.default.resolve(String(p.cwd), file.slice(1)),
@@ -72,7 +71,7 @@ const createSync = (opt, files) => {
 };
 const createAsync = (opt, files) => {
     const p = new pack_js_1.Pack(opt);
-    addFilesAsync(p, files);
+    addFilesAsync(p, files).catch(er => p.emit('error', er));
     return p;
 };
 exports.create = (0, make_command_js_1.makeCommand)(createFileSync, createFile, createSync, createAsync, (_opt, files) => {

package/node_modules/tar/dist/commonjs/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/create.ts"],"names":[],"mappings":";;;;;;AAAA,qDAAkE;AAElE,0DAA4B;AAC5B,uCAAgC;AAChC,uDAA+C;AAO/C,uCAA0C;AAE1C,MAAM,cAAc,GAAG,CAAC,GAAuB,EAAE,KAAe,EAAE,EAAE;IAClE,MAAM,CAAC,GAAG,IAAI,kBAAQ,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,IAAI,EAAE;QAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK;KACxB,CAAC,CAAA;IACF,CAAC,CAAC,IAAI,CAAC,MAAsC,CAAC,CAAA;IAC9C,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,KAAe,EAAE,EAAE;IAC1D,MAAM,CAAC,GAAG,IAAI,cAAI,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,yBAAW,CAAC,GAAG,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK;KACxB,CAAC,CAAA;IACF,CAAC,CAAC,IAAI,CAAC,MAAsC,CAAC,CAAA;IAE9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACvB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAEvB,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAW,EAAE,KAAe,EAAE,EAAE;IACpD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,IAAA,cAAI,EAAC;gBACH,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;aACnC,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IACF,CAAC,CAAC,GAAG,EAAE,CAAA;AACT,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,KAAK,EACzB,CAAO,EACP,KAAe,EACA,EAAE;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAA,cAAI,EAAC;gBACT,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChD,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,KAAK,CAAC,EAAE;oBACnB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACd,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,GAAG,EAAE,CAAA;AACT,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,KAAe,EAAE,EAAE;IAC1D,MAAM,CAAC,GAAG,IAAI,kBAAQ,CAAC,GAAG,CAAC,CAAA;IAC3B,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACtB,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAe,EAAE,KAAe,EAAE,EAAE;IACvD,MAAM,CAAC,GAAG,IAAI,cAAI,CAAC,GAAG,CAAC,CAAA;IACvB,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAEY,QAAA,MAAM,GAAG,IAAA,6BAAW,EAC/B,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;IACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC,CACF,CAAA","sourcesContent":["import { WriteStream, WriteStreamSync } from '@isaacs/fs-minipass'\nimport { Minipass } from 'minipass'\nimport path from 'node:path'\nimport { list } from './list.js'\nimport { makeCommand } from './make-command.js'\nimport {\n  TarOptions,\n  TarOptionsFile,\n  TarOptionsSync,\n  TarOptionsSyncFile,\n} from './options.js'\nimport { Pack, PackSync } from './pack.js'\n\nconst createFileSync = (opt: TarOptionsSyncFile, files: string[]) => {\n  const p = new PackSync(opt)\n  const stream = new WriteStreamSync(opt.file, {\n    mode: opt.mode || 0o666,\n  })\n  p.pipe(stream as unknown as Minipass.Writable)\n  addFilesSync(p, files)\n}\n\nconst createFile = (opt: TarOptionsFile, files: string[]) => {\n  const p = new Pack(opt)\n  const stream = new WriteStream(opt.file, {\n    mode: opt.mode || 0o666,\n  })\n  p.pipe(stream as unknown as Minipass.Writable)\n\n  const promise = new Promise<void>((res, rej) => {\n    stream.on('error', rej)\n    stream.on('close', res)\n    p.on('error', rej)\n  })\n\n  addFilesAsync(p, files)\n\n  return promise\n}\n\nconst addFilesSync = (p: PackSync, files: string[]) => {\n  files.forEach(file => {\n    if (file.charAt(0) === '@') {\n      list({\n        file: path.resolve(p.cwd, file.slice(1)),\n        sync: true,\n        noResume: true,\n        onReadEntry: entry => p.add(entry),\n      })\n    } else {\n      p.add(file)\n    }\n  })\n  p.end()\n}\n\nconst addFilesAsync = async (\n  p: Pack,\n  files: string[],\n): Promise<void> => {\n  for (let i = 0; i < files.length; i++) {\n    const file = String(files[i])\n    if (file.charAt(0) === '@') {\n      await list({\n        file: path.resolve(String(p.cwd), file.slice(1)),\n        noResume: true,\n        onReadEntry: entry => {\n          p.add(entry)\n        },\n      })\n    } else {\n      p.add(file)\n    }\n  }\n  p.end()\n}\n\nconst createSync = (opt: TarOptionsSync, files: string[]) => {\n  const p = new PackSync(opt)\n  addFilesSync(p, files)\n  return p\n}\n\nconst createAsync = (opt: TarOptions, files: string[]) => {\n  const p = new Pack(opt)\n  addFilesAsync(p, files)\n  return p\n}\n\nexport const create = makeCommand(\n  createFileSync,\n  createFile,\n  createSync,\n  createAsync,\n  (_opt, files) => {\n    if (!files?.length) {\n      throw new TypeError('no paths specified to add to archive')\n    }\n  },\n)\n"]}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/create.ts"],"names":[],"mappings":";;;;;;AAAA,qDAAkE;AAElE,0DAA4B;AAC5B,uCAAgC;AAChC,uDAA+C;AAO/C,uCAA0C;AAE1C,MAAM,cAAc,GAAG,CAAC,GAAuB,EAAE,KAAe,EAAE,EAAE;IAClE,MAAM,CAAC,GAAG,IAAI,kBAAQ,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,IAAI,EAAE;QAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK;KACxB,CAAC,CAAA;IACF,CAAC,CAAC,IAAI,CAAC,MAAsC,CAAC,CAAA;IAC9C,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,KAAe,EAAE,EAAE;IAC1D,MAAM,CAAC,GAAG,IAAI,cAAI,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,yBAAW,CAAC,GAAG,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK;KACxB,CAAC,CAAA;IACF,CAAC,CAAC,IAAI,CAAC,MAAsC,CAAC,CAAA;IAE9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACvB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IAExD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAW,EAAE,KAAe,EAAE,EAAE;IACpD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,IAAA,cAAI,EAAC;gBACH,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;aACnC,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IACF,CAAC,CAAC,GAAG,EAAE,CAAA;AACT,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,KAAK,EAAE,CAAO,EAAE,KAAe,EAAiB,EAAE;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAA,cAAI,EAAC;gBACT,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChD,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,KAAK,CAAC,EAAE;oBACnB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACd,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,GAAG,EAAE,CAAA;AACT,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,KAAe,EAAE,EAAE;IAC1D,MAAM,CAAC,GAAG,IAAI,kBAAQ,CAAC,GAAG,CAAC,CAAA;IAC3B,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACtB,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAe,EAAE,KAAe,EAAE,EAAE;IACvD,MAAM,CAAC,GAAG,IAAI,cAAI,CAAC,GAAG,CAAC,CAAA;IACvB,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAEY,QAAA,MAAM,GAAG,IAAA,6BAAW,EAC/B,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;IACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC,CACF,CAAA","sourcesContent":["import { WriteStream, WriteStreamSync } from '@isaacs/fs-minipass'\nimport type { Minipass } from 'minipass'\nimport path from 'node:path'\nimport { list } from './list.js'\nimport { makeCommand } from './make-command.js'\nimport type {\n  TarOptions,\n  TarOptionsFile,\n  TarOptionsSync,\n  TarOptionsSyncFile,\n} from './options.js'\nimport { Pack, PackSync } from './pack.js'\n\nconst createFileSync = (opt: TarOptionsSyncFile, files: string[]) => {\n  const p = new PackSync(opt)\n  const stream = new WriteStreamSync(opt.file, {\n    mode: opt.mode || 0o666,\n  })\n  p.pipe(stream as unknown as Minipass.Writable)\n  addFilesSync(p, files)\n}\n\nconst createFile = (opt: TarOptionsFile, files: string[]) => {\n  const p = new Pack(opt)\n  const stream = new WriteStream(opt.file, {\n    mode: opt.mode || 0o666,\n  })\n  p.pipe(stream as unknown as Minipass.Writable)\n\n  const promise = new Promise<void>((res, rej) => {\n    stream.on('error', rej)\n    stream.on('close', res)\n    p.on('error', rej)\n  })\n\n  addFilesAsync(p, files).catch(er => p.emit('error', er))\n\n  return promise\n}\n\nconst addFilesSync = (p: PackSync, files: string[]) => {\n  files.forEach(file => {\n    if (file.charAt(0) === '@') {\n      list({\n        file: path.resolve(p.cwd, file.slice(1)),\n        sync: true,\n        noResume: true,\n        onReadEntry: entry => p.add(entry),\n      })\n    } else {\n      p.add(file)\n    }\n  })\n  p.end()\n}\n\nconst addFilesAsync = async (p: Pack, files: string[]): Promise<void> => {\n  for (const file of files) {\n    if (file.charAt(0) === '@') {\n      await list({\n        file: path.resolve(String(p.cwd), file.slice(1)),\n        noResume: true,\n        onReadEntry: entry => {\n          p.add(entry)\n        },\n      })\n    } else {\n      p.add(file)\n    }\n  }\n  p.end()\n}\n\nconst createSync = (opt: TarOptionsSync, files: string[]) => {\n  const p = new PackSync(opt)\n  addFilesSync(p, files)\n  return p\n}\n\nconst createAsync = (opt: TarOptions, files: string[]) => {\n  const p = new Pack(opt)\n  addFilesAsync(p, files).catch(er => p.emit('error', er))\n  return p\n}\n\nexport const create = makeCommand(\n  createFileSync,\n  createFile,\n  createSync,\n  createAsync,\n  (_opt, files) => {\n    if (!files?.length) {\n      throw new TypeError('no paths specified to add to archive')\n    }\n  },\n)\n"]}

package/node_modules/tar/dist/commonjs/cwd-error.d.ts

@@ -1,7 +1,7 @@
 export declare class CwdError extends Error {
     path: string;
     code: string;
-    syscall: 'chdir';
+    syscall: "chdir";
     constructor(path: string, code: string);
     get name(): string;
 }

package/node_modules/tar/dist/commonjs/cwd-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cwd-error.d.ts","sourceRoot":"","sources":["../../src/cwd-error.ts"],"names":[],"mappings":"AAAA,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAU;gBAEd,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAMtC,IAAI,IAAI,WAEP;CACF"}
+{"version":3,"file":"cwd-error.d.ts","sourceRoot":"","sources":["../../src/cwd-error.ts"],"names":[],"mappings":"AAAA,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAG,OAAO,CAAS;gBAEd,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAMtC,IAAI,IAAI,WAEP;CACF"}

package/node_modules/tar/dist/commonjs/cwd-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"cwd-error.js","sourceRoot":"","sources":["../../src/cwd-error.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAQ;IACZ,IAAI,CAAQ;IACZ,OAAO,GAAY,OAAO,CAAA;IAE1B,YAAY,IAAY,EAAE,IAAY;QACpC,KAAK,CAAC,GAAG,IAAI,qBAAqB,IAAI,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,UAAU,CAAA;IACnB,CAAC;CACF;AAdD,4BAcC","sourcesContent":["export class CwdError extends Error {\n  path: string\n  code: string\n  syscall: 'chdir' = 'chdir'\n\n  constructor(path: string, code: string) {\n    super(`${code}: Cannot cd into '${path}'`)\n    this.path = path\n    this.code = code\n  }\n\n  get name() {\n    return 'CwdError'\n  }\n}\n"]}
+{"version":3,"file":"cwd-error.js","sourceRoot":"","sources":["../../src/cwd-error.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAQ;IACZ,IAAI,CAAQ;IACZ,OAAO,GAAG,OAAgB,CAAA;IAE1B,YAAY,IAAY,EAAE,IAAY;QACpC,KAAK,CAAC,GAAG,IAAI,qBAAqB,IAAI,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,UAAU,CAAA;IACnB,CAAC;CACF;AAdD,4BAcC","sourcesContent":["export class CwdError extends Error {\n  path: string\n  code: string\n  syscall = 'chdir' as const\n\n  constructor(path: string, code: string) {\n    super(`${code}: Cannot cd into '${path}'`)\n    this.path = path\n    this.code = code\n  }\n\n  get name() {\n    return 'CwdError'\n  }\n}\n"]}

package/node_modules/tar/dist/commonjs/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/extract.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS;AACT,yDAA0C;AAC1C,sDAAwB;AACxB,uCAAuC;AACvC,uDAA+C;AAE/C,2CAAgD;AAEhD,MAAM,eAAe,GAAG,CAAC,GAAuB,EAAE,EAAE;IAClD,MAAM,CAAC,GAAG,IAAI,sBAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,IAAI,GAAG,iBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,oDAAoD;IACpD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1C,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAmB,EAAE,CAAY,EAAE,EAAE;IACxD,MAAM,CAAC,GAAG,IAAI,kBAAM,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IAEpD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,CAAC,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAEtB,oDAAoD;QACpD,4DAA4D;QAC5D,iBAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,CAAC,EAAE,CAAC,CAAA;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;oBACtC,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAEY,QAAA,OAAO,GAAG,IAAA,6BAAW,EAChC,eAAe,EACf,WAAW,EACX,GAAG,CAAC,EAAE,CAAC,IAAI,sBAAU,CAAC,GAAG,CAAC,EAC1B,GAAG,CAAC,EAAE,CAAC,IAAI,kBAAM,CAAC,GAAG,CAAC,EACtB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;IACb,IAAI,KAAK,EAAE,MAAM;QAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC,CACF,CAAA","sourcesContent":["// tar -x\nimport * as fsm from '@isaacs/fs-minipass'\nimport fs from 'node:fs'\nimport { filesFilter } from './list.js'\nimport { makeCommand } from './make-command.js'\nimport { TarOptionsFile, TarOptionsSyncFile } from './options.js'\nimport { Unpack, UnpackSync } from './unpack.js'\n\nconst extractFileSync = (opt: TarOptionsSyncFile) => {\n  const u = new UnpackSync(opt)\n  const file = opt.file\n  const stat = fs.statSync(file)\n  // This trades a zero-byte read() syscall for a stat\n  // However, it will usually result in less memory allocation\n  const readSize = opt.maxReadSize || 16 * 1024 * 1024\n  const stream = new fsm.ReadStreamSync(file, {\n    readSize: readSize,\n    size: stat.size,\n  })\n  stream.pipe(u)\n}\n\nconst extractFile = (opt: TarOptionsFile, _?: string[]) => {\n  const u = new Unpack(opt)\n  const readSize = opt.maxReadSize || 16 * 1024 * 1024\n\n  const file = opt.file\n  const p = new Promise<void>((resolve, reject) => {\n    u.on('error', reject)\n    u.on('close', resolve)\n\n    // This trades a zero-byte read() syscall for a stat\n    // However, it will usually result in less memory allocation\n    fs.stat(file, (er, stat) => {\n      if (er) {\n        reject(er)\n      } else {\n        const stream = new fsm.ReadStream(file, {\n          readSize: readSize,\n          size: stat.size,\n        })\n        stream.on('error', reject)\n        stream.pipe(u)\n      }\n    })\n  })\n  return p\n}\n\nexport const extract = makeCommand<Unpack, UnpackSync>(\n  extractFileSync,\n  extractFile,\n  opt => new UnpackSync(opt),\n  opt => new Unpack(opt),\n  (opt, files) => {\n    if (files?.length) filesFilter(opt, files)\n  },\n)\n"]}
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/extract.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS;AACT,yDAA0C;AAC1C,sDAAwB;AACxB,uCAAuC;AACvC,uDAA+C;AAE/C,2CAAgD;AAEhD,MAAM,eAAe,GAAG,CAAC,GAAuB,EAAE,EAAE;IAClD,MAAM,CAAC,GAAG,IAAI,sBAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,IAAI,GAAG,iBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,oDAAoD;IACpD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1C,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAmB,EAAE,CAAY,EAAE,EAAE;IACxD,MAAM,CAAC,GAAG,IAAI,kBAAM,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IAEpD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,MAAM,CAAC,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAEtB,oDAAoD;QACpD,4DAA4D;QAC5D,iBAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,CAAC,EAAE,CAAC,CAAA;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;oBACtC,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAEY,QAAA,OAAO,GAAG,IAAA,6BAAW,EAChC,eAAe,EACf,WAAW,EACX,GAAG,CAAC,EAAE,CAAC,IAAI,sBAAU,CAAC,GAAG,CAAC,EAC1B,GAAG,CAAC,EAAE,CAAC,IAAI,kBAAM,CAAC,GAAG,CAAC,EACtB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;IACb,IAAI,KAAK,EAAE,MAAM;QAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC,CACF,CAAA","sourcesContent":["// tar -x\nimport * as fsm from '@isaacs/fs-minipass'\nimport fs from 'node:fs'\nimport { filesFilter } from './list.js'\nimport { makeCommand } from './make-command.js'\nimport type { TarOptionsFile, TarOptionsSyncFile } from './options.js'\nimport { Unpack, UnpackSync } from './unpack.js'\n\nconst extractFileSync = (opt: TarOptionsSyncFile) => {\n  const u = new UnpackSync(opt)\n  const file = opt.file\n  const stat = fs.statSync(file)\n  // This trades a zero-byte read() syscall for a stat\n  // However, it will usually result in less memory allocation\n  const readSize = opt.maxReadSize || 16 * 1024 * 1024\n  const stream = new fsm.ReadStreamSync(file, {\n    readSize: readSize,\n    size: stat.size,\n  })\n  stream.pipe(u)\n}\n\nconst extractFile = (opt: TarOptionsFile, _?: string[]) => {\n  const u = new Unpack(opt)\n  const readSize = opt.maxReadSize || 16 * 1024 * 1024\n\n  const file = opt.file\n  const p = new Promise<void>((resolve, reject) => {\n    u.on('error', reject)\n    u.on('close', resolve)\n\n    // This trades a zero-byte read() syscall for a stat\n    // However, it will usually result in less memory allocation\n    fs.stat(file, (er, stat) => {\n      if (er) {\n        reject(er)\n      } else {\n        const stream = new fsm.ReadStream(file, {\n          readSize: readSize,\n          size: stat.size,\n        })\n        stream.on('error', reject)\n        stream.pipe(u)\n      }\n    })\n  })\n  return p\n}\n\nexport const extract = makeCommand<Unpack, UnpackSync>(\n  extractFileSync,\n  extractFile,\n  opt => new UnpackSync(opt),\n  opt => new Unpack(opt),\n  (opt, files) => {\n    if (files?.length) filesFilter(opt, files)\n  },\n)\n"]}

package/node_modules/tar/dist/commonjs/get-write-flag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-write-flag.d.ts","sourceRoot":"","sources":["../../src/get-write-flag.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,YAAY,2BAGd,MAAM,kBAAwC,CAAA"}
+{"version":3,"file":"get-write-flag.d.ts","sourceRoot":"","sources":["../../src/get-write-flag.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,YAAY,2BAGd,MAAM,kBAAwC,CAAA"}

package/node_modules/tar/dist/commonjs/get-write-flag.js

@@ -15,7 +15,7 @@ const fs_1 = __importDefault(require("fs"));
 const platform = process.env.__FAKE_PLATFORM__ || process.platform;
 const isWindows = platform === 'win32';
 /* c8 ignore start */
-const { O_CREAT, O_TRUNC, O_WRONLY } = fs_1.default.constants;
+const { O_CREAT, O_NOFOLLOW, O_TRUNC, O_WRONLY } = fs_1.default.constants;
 const UV_FS_O_FILEMAP = Number(process.env.__FAKE_FS_O_FILENAME__) ||
     fs_1.default.constants.UV_FS_O_FILEMAP ||
     0;
@@ -23,7 +23,10 @@ const UV_FS_O_FILEMAP = Number(process.env.__FAKE_FS_O_FILENAME__) ||
 const fMapEnabled = isWindows && !!UV_FS_O_FILEMAP;
 const fMapLimit = 512 * 1024;
 const fMapFlag = UV_FS_O_FILEMAP | O_TRUNC | O_CREAT | O_WRONLY;
-exports.getWriteFlag = !fMapEnabled ?
-    () => 'w'
-    : (size) => (size < fMapLimit ? fMapFlag : 'w');
+const noFollowFlag = !isWindows && typeof O_NOFOLLOW === 'number' ?
+    O_NOFOLLOW | O_TRUNC | O_CREAT | O_WRONLY
+    : null;
+exports.getWriteFlag = noFollowFlag !== null ? () => noFollowFlag
+    : !fMapEnabled ? () => 'w'
+        : (size) => (size < fMapLimit ? fMapFlag : 'w');
 //# sourceMappingURL=get-write-flag.js.map

package/node_modules/tar/dist/commonjs/get-write-flag.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-write-flag.js","sourceRoot":"","sources":["../../src/get-write-flag.ts"],"names":[],"mappings":";AAAA,qDAAqD;AACrD,uDAAuD;AACvD,wDAAwD;AACxD,wDAAwD;AACxD,qDAAqD;AACrD,uDAAuD;AACvD,8CAA8C;;;;;;AAE9C,4CAAmB;AAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAA;AAClE,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAA;AAEtC,qBAAqB;AACrB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAE,CAAC,SAAS,CAAA;AACnD,MAAM,eAAe,GACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC1C,YAAE,CAAC,SAAS,CAAC,eAAe;IAC5B,CAAC,CAAA;AACH,oBAAoB;AAEpB,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,CAAC,eAAe,CAAA;AAClD,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAA;AAC5B,MAAM,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAClD,QAAA,YAAY,GACvB,CAAC,WAAW,CAAC,CAAC;IACZ,GAAG,EAAE,CAAC,GAAG;IACX,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA","sourcesContent":["// Get the appropriate flag to use for creating files\n// We use fmap on Windows platforms for files less than\n// 512kb.  This is a fairly low limit, but avoids making\n// things slower in some cases.  Since most of what this\n// library is used for is extracting tarballs of many\n// relatively small files in npm packages and the like,\n// it can be a big boost on Windows platforms.\n\nimport fs from 'fs'\n\nconst platform = process.env.__FAKE_PLATFORM__ || process.platform\nconst isWindows = platform === 'win32'\n\n/* c8 ignore start */\nconst { O_CREAT, O_TRUNC, O_WRONLY } = fs.constants\nconst UV_FS_O_FILEMAP =\n  Number(process.env.__FAKE_FS_O_FILENAME__) ||\n  fs.constants.UV_FS_O_FILEMAP ||\n  0\n/* c8 ignore stop */\n\nconst fMapEnabled = isWindows && !!UV_FS_O_FILEMAP\nconst fMapLimit = 512 * 1024\nconst fMapFlag = UV_FS_O_FILEMAP | O_TRUNC | O_CREAT | O_WRONLY\nexport const getWriteFlag =\n  !fMapEnabled ?\n    () => 'w'\n  : (size: number) => (size < fMapLimit ? fMapFlag : 'w')\n"]}
+{"version":3,"file":"get-write-flag.js","sourceRoot":"","sources":["../../src/get-write-flag.ts"],"names":[],"mappings":";AAAA,qDAAqD;AACrD,uDAAuD;AACvD,wDAAwD;AACxD,wDAAwD;AACxD,qDAAqD;AACrD,uDAAuD;AACvD,8CAA8C;;;;;;AAE9C,4CAAmB;AAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAA;AAClE,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAA;AAEtC,qBAAqB;AACrB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAE,CAAC,SAAS,CAAA;AAC/D,MAAM,eAAe,GACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC1C,YAAE,CAAC,SAAS,CAAC,eAAe;IAC5B,CAAC,CAAA;AACH,oBAAoB;AAEpB,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,CAAC,eAAe,CAAA;AAClD,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAA;AAC5B,MAAM,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAC/D,MAAM,YAAY,GAChB,CAAC,SAAS,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC;IAC5C,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ;IAC3C,CAAC,CAAC,IAAI,CAAA;AACK,QAAA,YAAY,GACvB,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,YAAY;IAC1C,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG;QAC1B,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA","sourcesContent":["// Get the appropriate flag to use for creating files\n// We use fmap on Windows platforms for files less than\n// 512kb.  This is a fairly low limit, but avoids making\n// things slower in some cases.  Since most of what this\n// library is used for is extracting tarballs of many\n// relatively small files in npm packages and the like,\n// it can be a big boost on Windows platforms.\n\nimport fs from 'fs'\n\nconst platform = process.env.__FAKE_PLATFORM__ || process.platform\nconst isWindows = platform === 'win32'\n\n/* c8 ignore start */\nconst { O_CREAT, O_NOFOLLOW, O_TRUNC, O_WRONLY } = fs.constants\nconst UV_FS_O_FILEMAP =\n  Number(process.env.__FAKE_FS_O_FILENAME__) ||\n  fs.constants.UV_FS_O_FILEMAP ||\n  0\n/* c8 ignore stop */\n\nconst fMapEnabled = isWindows && !!UV_FS_O_FILEMAP\nconst fMapLimit = 512 * 1024\nconst fMapFlag = UV_FS_O_FILEMAP | O_TRUNC | O_CREAT | O_WRONLY\nconst noFollowFlag =\n  !isWindows && typeof O_NOFOLLOW === 'number' ?\n    O_NOFOLLOW | O_TRUNC | O_CREAT | O_WRONLY\n  : null\nexport const getWriteFlag =\n  noFollowFlag !== null ? () => noFollowFlag\n  : !fMapEnabled ? () => 'w'\n  : (size: number) => (size < fMapLimit ? fMapFlag : 'w')\n"]}

package/node_modules/tar/dist/commonjs/header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/header.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG9D,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IAIZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qBAAa,MAAO,YAAW,UAAU;;IACvC,UAAU,EAAE,OAAO,CAAQ;IAC3B,OAAO,EAAE,OAAO,CAAQ;IACxB,SAAS,EAAE,OAAO,CAAQ;IAE1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAI;IAClB,MAAM,EAAE,MAAM,CAAI;IAClB,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IAEZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;gBAGd,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAC1B,GAAG,GAAE,MAAU,EACf,EAAE,CAAC,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,UAAU;IASlB,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,EAAE,CAAC,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,UAAU;IA+GlB,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAU;IAwEpC,IAAI,IAAI,IAAI,aAAa,CAKxB;IAED,IAAI,OAAO,IAAI,aAAa,GAAG,aAAa,CAE3C;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,EAS3D;CACF"}
+{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/header.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAM9D,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IAIZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qBAAa,MAAO,YAAW,UAAU;;IACvC,UAAU,EAAE,OAAO,CAAQ;IAC3B,OAAO,EAAE,OAAO,CAAQ;IACxB,SAAS,EAAE,OAAO,CAAQ;IAE1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAI;IAClB,MAAM,EAAE,MAAM,CAAI;IAClB,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IAEZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;gBAGd,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,EAC1B,GAAG,GAAE,MAAU,EACf,EAAE,CAAC,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,UAAU;IASlB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,UAAU;IA+IlE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAU;IAiEpC,IAAI,IAAI,IAAI,aAAa,CAKxB;IAED,IAAI,OAAO,IAAI,aAAa,GAAG,aAAa,CAE3C;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,EAS3D;CACF"}

package/node_modules/tar/dist/commonjs/header.js

@@ -41,6 +41,7 @@ exports.Header = void 0;
 const node_path_1 = require("node:path");
 const large = __importStar(require("./large-numbers.js"));
 const types = __importStar(require("./types.js"));
+const notNegative = (n) => n === undefined || n < 0 ? undefined : n;
 class Header {
     cksumValid = false;
     needPax = false;
@@ -78,23 +79,44 @@ class Header {
         if (!buf || !(buf.length >= off + 512)) {
             throw new Error('need 512 bytes for header');
         }
-        this.path = ex?.path ?? decString(buf, off, 100);
-        this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8);
-        this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8);
-        this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8);
-        this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12);
+        // Decode the typeflag (independent of any pending PAX/GNU extended header)
+        // up front so we can tell whether THIS block is itself an intermediary
+        // extension header (PAX `x`/`g`, GNU long-name `L`, GNU long-link `K`).
+        // Per POSIX pax, a PAX extended header describes the *next file entry*, not
+        // the extension headers that may sit between it and that file. Applying the
+        // pending PAX overrides (notably `size`) to an intervening `L`/`K`/`x`/`g`
+        // header desynchronizes the stream relative to other tar implementations
+        // and enables tar interpretation-conflict / file-smuggling attacks.
+        const t = decString(buf, off + 156, 1);
+        const isNormalFS = types.normalFsTypes.has(t);
+        const exForFields = isNormalFS ? ex : undefined;
+        const gexForFields = isNormalFS ? gex : undefined;
+        this.path = exForFields?.path ?? decString(buf, off, 100);
+        this.mode =
+            exForFields?.mode ??
+                gexForFields?.mode ??
+                decNumber(buf, off + 100, 8);
+        this.uid =
+            exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
+        this.gid =
+            exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
+        this.size = notNegative(exForFields?.size ??
+            gexForFields?.size ??
+            decNumber(buf, off + 124, 12));
         this.mtime =
-            ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12);
+            exForFields?.mtime ??
+                gexForFields?.mtime ??
+                decDate(buf, off + 136, 12);
         this.cksum = decNumber(buf, off + 148, 12);
         // if we have extended or global extended headers, apply them now
         // See https://github.com/npm/node-tar/pull/187
-        // Apply global before local, so it overrides
-        if (gex)
-            this.#slurp(gex, true);
-        if (ex)
-            this.#slurp(ex);
+        // Apply global before local, so it overrides. Never slurp the pending
+        // extended-header fields onto an intermediary extension header.
+        if (gexForFields)
+            this.#slurp(gexForFields, true);
+        if (exForFields)
+            this.#slurp(exForFields);
         // old tar versions marked dirs as a file with a trailing /
-        const t = decString(buf, off + 156, 1);
         if (types.isCode(t)) {
             this.#type = t || '0';
         }
@@ -110,17 +132,26 @@ class Header {
             this.size = 0;
         }
         this.linkpath = decString(buf, off + 157, 100);
-        if (buf.subarray(off + 257, off + 265).toString() ===
-            'ustar\u000000') {
+        if (buf.subarray(off + 257, off + 265).toString() === 'ustar\u000000') {
             /* c8 ignore start */
             this.uname =
-                ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32);
+                exForFields?.uname ??
+                    gexForFields?.uname ??
+                    decString(buf, off + 265, 32);
             this.gname =
-                ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32);
+                exForFields?.gname ??
+                    gexForFields?.gname ??
+                    decString(buf, off + 297, 32);
             this.devmaj =
-                ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
+                exForFields?.devmaj ??
+                    gexForFields?.devmaj ??
+                    decNumber(buf, off + 329, 8) ??
+                    0;
             this.devmin =
-                ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
+                exForFields?.devmin ??
+                    gexForFields?.devmin ??
+                    decNumber(buf, off + 337, 8) ??
+                    0;
             /* c8 ignore stop */
             if (buf[off + 475] !== 0) {
                 // definitely a prefix, definitely >130 chars.
@@ -133,10 +164,8 @@ class Header {
                     this.path = prefix + '/' + this.path;
                 }
                 /* c8 ignore start */
-                this.atime =
-                    ex?.atime ?? gex?.atime ?? decDate(buf, off + 476, 12);
-                this.ctime =
-                    ex?.ctime ?? gex?.ctime ?? decDate(buf, off + 488, 12);
+                this.atime = ex?.atime ?? gex?.atime ?? decDate(buf, off + 476, 12);
+                this.ctime = ex?.ctime ?? gex?.ctime ?? decDate(buf, off + 488, 12);
                 /* c8 ignore stop */
             }
         }
@@ -159,6 +188,7 @@ class Header {
             // null/undefined values are ignored.
             return !(v === null ||
                 v === undefined ||
+                (k === 'size' && Number(v) < 0) ||
                 (k === 'path' && gex) ||
                 (k === 'linkpath' && gex) ||
                 k === 'global');
@@ -180,17 +210,12 @@ class Header {
         const prefix = split[1];
         this.needPax = !!split[2];
         this.needPax = encString(buf, off, 100, path) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 100, 8, this.mode) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 108, 8, this.uid) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 116, 8, this.gid) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 124, 12, this.size) || this.needPax;
-        this.needPax =
-            encDate(buf, off + 136, 12, this.mtime) || this.needPax;
-        buf[off + 156] = this.#type.charCodeAt(0);
+        this.needPax = encNumber(buf, off + 100, 8, this.mode) || this.needPax;
+        this.needPax = encNumber(buf, off + 108, 8, this.uid) || this.needPax;
+        this.needPax = encNumber(buf, off + 116, 8, this.gid) || this.needPax;
+        this.needPax = encNumber(buf, off + 124, 12, this.size) || this.needPax;
+        this.needPax = encDate(buf, off + 136, 12, this.mtime) || this.needPax;
+        buf[off + 156] = Number(this.#type.codePointAt(0));
         this.needPax =
             encString(buf, off + 157, 100, this.linkpath) || this.needPax;
         buf.write('ustar\u000000', off + 257, 8);
@@ -205,12 +230,10 @@ class Header {
         this.needPax =
             encString(buf, off + 345, prefixSize, prefix) || this.needPax;
         if (buf[off + 475] !== 0) {
-            this.needPax =
-                encString(buf, off + 345, 155, prefix) || this.needPax;
+            this.needPax = encString(buf, off + 345, 155, prefix) || this.needPax;
         }
         else {
-            this.needPax =
-                encString(buf, off + 345, 130, prefix) || this.needPax;
+            this.needPax = encString(buf, off + 345, 130, prefix) || this.needPax;
             this.needPax =
                 encDate(buf, off + 476, 12, this.atime) || this.needPax;
             this.needPax =