just-bash 3.0.1 → 3.0.3

package/CHANGELOG.md

@@ -1,5 +1,128 @@
 # just-bash
 
+## 3.0.3
+
+### Patch Changes
+
+- [#277](https://github.com/vercel-labs/just-bash/pull/277) [`aec5643`](https://github.com/vercel-labs/just-bash/commit/aec56431d7d9b6fcb141bbfe25d26f4931f54f80) Thanks [@mutewinter](https://github.com/mutewinter)! - interpreter: avoid lazy import in variable assignment path that trips defense-in-depth (fixes [#273](https://github.com/vercel-labs/just-bash/issues/273))
+
+  Any non-`export` variable assignment (bare `SECRET=s`, prefixed `SECRET=s cmd`,
+  or before a custom command) failed with a defense-in-depth security violation
+  (`dynamic import of Node.js builtin 'node:module' is blocked during script
+execution`), while plain commands and `export`-ed assignments passed.
+
+  `processScalarAssignment()` resolved `isArray` via `await import("./expansion.js")`
+  in two spots. In the bundled `dist`, that dynamic `import()` marks `expansion.js`
+  as a lazily-linked chunk whose `createRequire` banner imports `node:module`; the
+  defense layer's ESM `resolve` hook blocks that builtin import when the sandbox is
+  active and untrusted, so it blocked just-bash's own chunk load. The file already
+  statically imports from `./expansion.js`, so `isArray` is now pulled from that
+  static import and the two lazy imports are removed — no lazy `node:module`-bearing
+  chunk is linked at runtime. No public API change.
+
+- [#276](https://github.com/vercel-labs/just-bash/pull/276) [`1ec5eec`](https://github.com/vercel-labs/just-bash/commit/1ec5eec0aefd099d23ac9f056df1e6612c81d49b) Thanks [@mutewinter](https://github.com/mutewinter)! - interpreter: preserve leading whitespace in multi-line quoted strings (fixes [#259](https://github.com/vercel-labs/just-bash/issues/259))
+
+  `exec()` runs each script through `normalizeScript()`, which `trimStart()`s
+  leading indentation from lines so indented template-literal scripts parse. It
+  was applied line-by-line and stripped the leading whitespace inside multi-line
+  single- and double-quoted strings too. The visible symptom was `python3 -c
+'...'` (and `node -e`, `awk`, etc.) with an indented body failing with
+  `IndentationError`, while the same code via heredoc or pipe worked.
+
+  `normalizeScript()` is now quote-aware (mirroring the earlier heredoc-aware
+  fix): it only strips indentation from lines that begin outside any quote, and
+  preserves lines that begin inside an unterminated single- or double-quoted
+  string verbatim. This also un-skips four sed spec tests whose indented stdin
+  was previously being corrupted.
+
+- [#286](https://github.com/vercel-labs/just-bash/pull/286) [`cb2b583`](https://github.com/vercel-labs/just-bash/commit/cb2b583b3f46e6bb4e6982c4bfe19903ec811a87) Thanks [@privatenumber](https://github.com/privatenumber)! - interpreter: deliver redirected output to each fd's final target (fixes `cmd > file 2>&1` leaking stderr to stdout)
+
+  `applyRedirections()` processed a command's redirection list sequentially over
+  the result's stdout/stderr strings, moving content at each step. The
+  duplication operators (`2>&1`, `1>&2`) merged into the live stream regardless
+  of where the source fd pointed, so the canonical `cmd > file 2>&1` wrote
+  stdout to the file but leaked stderr onto the caller's stdout — including
+  "command not found" errors and custom-command stderr. Any wrapper protocol
+  that parses the enclosing script's stdout (e.g. a runner emitting a JSON
+  payload after `eval "$CMD" > "$OUT" 2>&1`) saw the leaked stderr corrupt its
+  stream. Ordering variants were wrong in other ways: `cmd 2>&1 > file` put
+  stderr in the file instead of on stdout, and `cmd > a > b` wrote content to
+  `a` instead of `b`.
+
+  The pass now mirrors how bash sets up fds before running the command: each
+  output redirection only opens/truncates its target and re-points the fd's
+  sink (file, /dev/null, or a snapshot of the caller-visible stream), and
+  duplication operators copy the source fd's current sink. Stream content is
+  delivered once, after the whole list is processed, to each fd's final sink.
+  This makes `cmd > file 2>&1` send stderr to the file, `cmd 2>&1 > file` keep
+  stderr on the caller's stdout, `cmd > all 2>&1 2> err` let the later `2> err`
+  reclaim stderr, and `cmd > a > b` truncate `a` while writing content to `b`.
+  The `/dev/null`-as-regular-VFS-file behavior for stdout redirects is
+  preserved.
+
+## 3.0.2
+
+### Patch Changes
+
+- [#272](https://github.com/vercel-labs/just-bash/pull/272) [`150a915`](https://github.com/vercel-labs/just-bash/commit/150a915a1d45a2cc7f2b6aec3268f27116c34916) Thanks [@trieloff](https://github.com/trieloff)! - interpreter: fix UTF-8 mojibake when a script interleaves text-output and byte-output statements
+
+  A single `exec()` can interleave text-shaped statements (sed, awk, echo — `ö`
+  as `U+00F6`) with byte-shaped ones (grep | head, cat — `ö` as bytes
+  `0xC3 0xB6`). `executeScript` / `executeStatement` concatenated each result's
+  raw stdout, so the lone high byte from the text half made the combined stream
+  invalid UTF-8, the output-boundary decoder bailed, and the byte half came back
+  as Latin-1 mojibake (`Köpenicker` for `Köpenicker`). The same path backs
+  command substitution, so `echo "你好: $(cat /file)"` was affected too.
+
+  The fix decodes each statement/pipeline result to text via its explicit
+  `stdoutKind` (`decodedTextFromResult`) before concatenating — no guessing from
+  string contents, so text whose code units merely look like UTF-8 (`ö`) is
+  preserved. `tac` (stdin path) and `curl` (response body) now declare
+  `stdoutKind: "bytes"` on the results that forward raw bytes, so the decode is
+  driven per output rather than by inspecting characters.
+
+- [#256](https://github.com/vercel-labs/just-bash/pull/256) [`75d8dfd`](https://github.com/vercel-labs/just-bash/commit/75d8dfd3a322786250e3b0f81b1500c87610acb7) Thanks [@Hazzng](https://github.com/Hazzng)! - js-exec: fix Buffer shim correctness — ascii encode now uses & 0xff (not & 0x7f), consolidate latin1/ascii into shared \_rawEncode, fix Buffer.from(ArrayBuffer, offset, length), throw on invalid byteLength input, clamp negative toString start, throw RangeError for out-of-range write offset
+
+- [#239](https://github.com/vercel-labs/just-bash/pull/239) [`1369b77`](https://github.com/vercel-labs/just-bash/commit/1369b772fe887694c09ce834d1b0b21aa6420b59) Thanks [@trieloff](https://github.com/trieloff)! - curl: interpret `@file` for `-d`/`--data`, `--data-binary`, and `--data-urlencode`
+
+  Real curl reads file contents when these flags are passed `@filename`:
+
+  - `-d @file` / `--data @file` — read file contents, strip CR/LF.
+  - `--data-binary @file` — read file contents verbatim (newlines preserved).
+  - `--data-urlencode @file` — read file, URL-encode the contents.
+  - `--data-urlencode name@file` — prefix the URL-encoded contents with `name=`.
+
+  just-bash's curl previously passed `@filename` through verbatim as the HTTP body. Posting JSON or any non-trivial payload via `curl --data-binary @payload.json https://…` sent the literal string `@payload.json` instead of the file. The new behavior matches upstream curl; `--data-raw` keeps the documented "no `@` interpretation" semantics.
+
+- [#262](https://github.com/vercel-labs/just-bash/pull/262) [`4ece258`](https://github.com/vercel-labs/just-bash/commit/4ece2580d8cb707e6c6b7fa22897ea3fdd21739a) Thanks [@chernetsov](https://github.com/chernetsov)! - parser: don't treat quotes inside a heredoc body as shell quotes when finding the end of a command substitution
+
+  A command substitution whose body contained a heredoc with an unbalanced quote in its body — most commonly an apostrophe in literal prose, e.g. `June's` — failed to parse with `bash: syntax error: ... unexpected EOF while looking for matching ')'`:
+
+  ```bash
+  OUT=$(cat <<'SCRIPT'
+  June's moon
+  SCRIPT
+  )
+  ```
+
+  Both the lexer's `$(...)` word scanner and the substitution boundary scanner walked into the heredoc body and applied shell quote tracking to it. The `'` in `June's` opened a single-quoted string that never closed, so the closing `)` was swallowed and the scan ran to EOF. In bash a heredoc body is literal text and must be skipped wholesale when locating the substitution boundary.
+
+  Both scanners are now heredoc-aware: when scanning a `$(...)` they recognize `<<` / `<<-` operators (but not the `<<<` here-string), capture the possibly-quoted delimiter, and skip the heredoc body lines literally — without quote or paren tracking — up to the terminator. Multiple heredocs on one line and tab-stripping (`<<-`) are handled. This fixes the common pattern of capturing the output of a connector/CLI invocation that is fed a heredoc script containing apostrophes, backticks, or parentheses.
+
+  The heredoc scan also tracks arithmetic `((...))` nesting so a `<<` left-shift inside `$((...))` (or a nested arithmetic expansion) is not mistaken for a heredoc opener — previously a multi-line arithmetic expansion containing a shift, e.g. `$((\n1 << 2\n))`, had its closing `))` swallowed by spurious body-skipping.
+
+- [#248](https://github.com/vercel-labs/just-bash/pull/248) [`d64009a`](https://github.com/vercel-labs/just-bash/commit/d64009aef6bc1556e7c84b22ed455863275ea953) Thanks [@Hazzng](https://github.com/Hazzng)! - perf(grep): up to 14.5× speedup via preFilter extensions and matcher reuse.
+
+  Anchored alternation patterns like `^def \|^async def` now extract literal needles (stripping outer `^`/`$`), enabling the `String.indexOf` fast-path. Files with no matching needle are rejected before `split("\n")`, skipping RE2 entirely. `acquireMatcher()` extended to `match()`, `replace()`, `search()`, and `matchAll()` to reduce GC pressure across awk/sed hot-paths.
+
+- [#261](https://github.com/vercel-labs/just-bash/pull/261) [`c9904de`](https://github.com/vercel-labs/just-bash/commit/c9904dea24ad2aa847749ee6289239c2a2c651fc) Thanks [@chernetsov](https://github.com/chernetsov)! - set: support a bundled `-o`/`+o` long option inside a short-flag cluster (e.g. `set -euo pipefail`)
+
+  The `set` builtin previously rejected `set -euo pipefail` with `bash: set: -o: invalid option`, because it parsed each character after the `-` as an independent short flag and has no `o` short flag. `-o` was only honored as its own token (`set -eu -o pipefail`).
+
+  This is the canonical "bash strict mode" idiom and is extremely common in generated scripts, so the whole script would abort on its first line.
+
+  `set` now matches bash: an `o` inside a cluster consumes the _next word_ as its long-option name, and the remaining characters keep being parsed as short flags. So `set -euo pipefail` is equivalent to `set -e -u -o pipefail`, `set -oe pipefail` enables both `pipefail` and `errexit`, trailing words become positional parameters, and `+`-clusters (`set +euo pipefail`) disable the options. An invalid bundled name (`set -euo bogus`) still reports `invalid option name`, and an `o` with no following argument falls back to the standalone `-o`/`+o` listing.
+
 ## 3.0.1
 
 ### Patch Changes

package/README.md

@@ -141,6 +141,17 @@ await env.exec("while true; do sleep 1; done", { signal: controller.signal });
 await env.exec("cat <<EOF\n  indented\nEOF", { rawScript: true });
 ```
 
+### Timezone
+
+`date` defaults to UTC (`%Z=UTC`, `%z=+0000`) regardless of the host clock, so the sandbox does not leak the host timezone. To opt into a specific zone, pass `TZ` as an initial env var:
+
+```typescript
+const bash = new Bash({ env: { TZ: "America/New_York" } });
+await bash.exec("date"); // Mon Jun  1 09:30:00 EDT 2026
+```
+
+`-u` always forces UTC; an unset or invalid `$TZ` falls back to UTC. Setting `TZ` exposes that timezone to scripts running in the sandbox, so only pass a value you are comfortable revealing — forwarding the host's real `$TZ` (e.g. `process.env.TZ`) reintroduces the disclosure that the UTC default exists to prevent.
+
 `exec()` options:
 
 | Option | Type | Description |

package/dist/AGENTS.md

@@ -64,6 +64,8 @@ const result = await bash.exec("cat input.txt | grep pattern");
 
 5. **ReadWriteFs root separation**: If you use `ReadWriteFs`, point it at a workspace directory, not at the installed `just-bash` package or other trusted runtime code.
 
+6. **UTC by default**: `date` always shows UTC (`%Z=UTC`, `%z=+0000`) unless the host opts in by passing `TZ` as an env var (e.g. `new Bash({ env: { TZ: "America/New_York" } })`). `-u` always forces UTC; an invalid `$TZ` falls back to UTC.
+
 ## Available Commands
 
 **Text processing**: `awk`, `cat`, `column`, `comm`, `cut`, `egrep`, `expand`, `fgrep`, `fold`, `grep`, `head`, `join`, `nl`, `paste`, `rev`, `rg`, `sed`, `sort`, `strings`, `tac`, `tail`, `tr`, `unexpand`, `uniq`, `wc`, `xargs`

package/dist/bin/chunks/{awk2-RLMNTGI7.js → awk2-UFCNQFCV.js}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b}from"./chunk-NXVG64T3.js";import"./chunk-MROECM42.js";import"./chunk-LNNWMRCB.js";import"./chunk-HL4ZS7TX.js";import"./chunk-IEXQTXU5.js";import"./chunk-VZK4FHWJ.js";import"./chunk-47WZ2U6M.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as awkCommand2,b as flagsForFuzzing};
+import{a,b}from"./chunk-D7YFPDMV.js";import"./chunk-MROECM42.js";import"./chunk-AZH64XMJ.js";import"./chunk-LX2H4DPL.js";import"./chunk-52FZYTIX.js";import"./chunk-DHIKZU63.js";import"./chunk-47WZ2U6M.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as awkCommand2,b as flagsForFuzzing};

package/dist/bin/{shell/chunks/base64-RZRLGMB3.js → chunks/base64-EGKVQIBC.js}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b}from"./chunk-6WJQNLR2.js";import"./chunk-VZK4FHWJ.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as base64Command,b as flagsForFuzzing};
+import{a,b}from"./chunk-6WJQNLR2.js";import"./chunk-DHIKZU63.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as base64Command,b as flagsForFuzzing};

package/dist/bin/{shell/chunks/bash-CLP24TE2.js → chunks/bash-BEG4JB7K.js}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b,c,d}from"./chunk-7UU7KPEM.js";import"./chunk-MROECM42.js";import"./chunk-VZK4FHWJ.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as bashCommand,c as flagsForFuzzing,b as shCommand,d as shFlagsForFuzzing};
+import{a,b,c,d}from"./chunk-OVVMB2JI.js";import"./chunk-MROECM42.js";import"./chunk-DHIKZU63.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as bashCommand,c as flagsForFuzzing,b as shCommand,d as shFlagsForFuzzing};

package/dist/bin/{shell/chunks/cat-LQH5FSAR.js → chunks/cat-NBL6MU5H.js}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b}from"./chunk-XJ37N3S5.js";import"./chunk-H7JTIXAO.js";import"./chunk-VZK4FHWJ.js";import"./chunk-7JZKVC3F.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as catCommand,b as flagsForFuzzing};
+import{a,b}from"./chunk-GTO74SFS.js";import"./chunk-ZZP3RSWL.js";import"./chunk-DHIKZU63.js";import"./chunk-7JZKVC3F.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-LNVSXNT7.js";export{a as catCommand,b as flagsForFuzzing};

package/dist/bin/chunks/{chunk-KFMPGSUT.js → chunk-2ZAK22BG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a as y}from"./chunk-VZK4FHWJ.js";import{a as C}from"./chunk-NE4R2FVV.js";import{a as F,b as x}from"./chunk-MUFNRCMY.js";var H={name:"column",summary:"columnate lists",usage:"column [OPTION]... [FILE]...",description:"Format input into multiple columns. By default, fills rows first. Use -t to create a table based on whitespace-delimited input.",options:["-t           Create a table (determine columns from input)","-s SEP       Input field delimiter (default: whitespace)","-o SEP       Output field delimiter (default: two spaces)","-c WIDTH     Output width for fill mode (default: 80)","-n           Don't merge multiple adjacent delimiters"],examples:["ls | column              # Fill columns with ls output","cat data | column -t     # Format as table","column -t -s ',' file    # Format CSV as table","column -c 40 file        # Fill 40-char wide columns"]},I={table:{short:"t",long:"table",type:"boolean"},separator:{short:"s",type:"string"},outputSep:{short:"o",type:"string"},width:{short:"c",type:"number",default:80},noMerge:{short:"n",type:"boolean"}};function v(t,e,o){return e?o?t.split(e):t.split(e).filter(n=>n.length>0):o?t.split(/[ \t]/):t.split(/[ \t]+/).filter(n=>n.length>0)}function T(t){let e=[];for(let o of t)for(let n=0;n<o.length;n++){let l=o[n].length;(e[n]===void 0||l>e[n])&&(e[n]=l)}return e}function W(t,e){if(t.length===0)return"";let o=T(t),n=[];for(let l of t){let c=[];for(let s=0;s<l.length;s++)s===l.length-1?c.push(l[s]):c.push(l[s].padEnd(o[s]));n.push(c.join(e))}return n.join(`
+import{a as y}from"./chunk-DHIKZU63.js";import{a as C}from"./chunk-NE4R2FVV.js";import{a as F,b as x}from"./chunk-MUFNRCMY.js";var H={name:"column",summary:"columnate lists",usage:"column [OPTION]... [FILE]...",description:"Format input into multiple columns. By default, fills rows first. Use -t to create a table based on whitespace-delimited input.",options:["-t           Create a table (determine columns from input)","-s SEP       Input field delimiter (default: whitespace)","-o SEP       Output field delimiter (default: two spaces)","-c WIDTH     Output width for fill mode (default: 80)","-n           Don't merge multiple adjacent delimiters"],examples:["ls | column              # Fill columns with ls output","cat data | column -t     # Format as table","column -t -s ',' file    # Format CSV as table","column -c 40 file        # Fill 40-char wide columns"]},I={table:{short:"t",long:"table",type:"boolean"},separator:{short:"s",type:"string"},outputSep:{short:"o",type:"string"},width:{short:"c",type:"number",default:80},noMerge:{short:"n",type:"boolean"}};function v(t,e,o){return e?o?t.split(e):t.split(e).filter(n=>n.length>0):o?t.split(/[ \t]/):t.split(/[ \t]+/).filter(n=>n.length>0)}function T(t){let e=[];for(let o of t)for(let n=0;n<o.length;n++){let l=o[n].length;(e[n]===void 0||l>e[n])&&(e[n]=l)}return e}function W(t,e){if(t.length===0)return"";let o=T(t),n=[];for(let l of t){let c=[];for(let s=0;s<l.length;s++)s===l.length-1?c.push(l[s]):c.push(l[s].padEnd(o[s]));n.push(c.join(e))}return n.join(`
 `)}function j(t,e,o){if(t.length===0)return"";let n=Math.max(...t.map(a=>a.length)),l=o.length,c=n+l,s=Math.max(1,Math.floor((e+l)/c)),p=Math.ceil(t.length/s),d=[];for(let a=0;a<p;a++){let i=[];for(let r=0;r<s;r++){let m=r*p+a;m<t.length&&(r===s-1||(r+1)*p+a>=t.length?i.push(t[m]):i.push(t[m].padEnd(n)))}d.push(i.join(o))}return d.join(`
 `)}var S={name:"column",execute:async(t,e)=>{if(x(t))return F(H);let o=C("column",t,I);if(!o.ok)return o.error;let{table:n,separator:l,outputSep:c,width:s,noMerge:p}=o.result.flags,d=o.result.positional,a=c??"  ",i;if(d.length===0)i=y(e.stdin)??"";else{let u=[];for(let f of d)if(f==="-")u.push(y(e.stdin)??"");else{let w=e.fs.resolvePath(e.cwd,f),b=await e.fs.readFile(w);if(b===null)return{exitCode:1,stdout:"",stderr:`column: ${f}: No such file or directory
 `};u.push(b)}i=u.join("")}if(i===""||i.trim()==="")return{exitCode:0,stdout:"",stderr:""};let r=i.split(`

package/dist/bin/chunks/chunk-4BNS566Q.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+function M(r,o,a){let e=new Date(o*1e3),t="",n=0;for(;n<r.length;)if(r[n]==="%"&&n+1<r.length){let u=r[n+1],i=S(e,u,a);i!==null?(t+=i,n+=2):(t+=r[n],n++)}else t+=r[n],n++;return t}function f(r,o){let a={year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short",hour12:!1,timeZone:o};try{let t=new Intl.DateTimeFormat("en-US",a).formatToParts(r),n=c=>t.find(m=>m.type===c)?.value??"",u=new Map([["Sun",0],["Mon",1],["Tue",2],["Wed",3],["Thu",4],["Fri",5],["Sat",6]]),i=n("weekday"),s=(c,m)=>{let y=Number.parseInt(c,10);return Number.isNaN(y)?m:y};return{year:s(n("year"),r.getFullYear()),month:s(n("month"),r.getMonth()+1),day:s(n("day"),r.getDate()),hour:s(n("hour"),r.getHours())%24,minute:s(n("minute"),r.getMinutes()),second:s(n("second"),r.getSeconds()),weekday:u.get(i)??r.getDay()}}catch{return{year:r.getFullYear(),month:r.getMonth()+1,day:r.getDate(),hour:r.getHours(),minute:r.getMinutes(),second:r.getSeconds(),weekday:r.getDay()}}}function S(r,o,a){let e=f(r,a),t=(s,c=2)=>String(s).padStart(c,"0"),n=g(e.year,e.month,e.day),u=d(e.year,e.month,e.day,e.weekday,0),i=d(e.year,e.month,e.day,e.weekday,1);switch(o){case"a":return["Sun","Mon","Tue","Wed","Thu","Fri","Sat"][e.weekday];case"A":return["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"][e.weekday];case"b":case"h":return["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"][e.month-1];case"B":return["January","February","March","April","May","June","July","August","September","October","November","December"][e.month-1];case"c":return`${["Sun","Mon","Tue","Wed","Thu","Fri","Sat"][e.weekday]} ${["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"][e.month-1]} ${String(e.day).padStart(2," ")} ${t(e.hour)}:${t(e.minute)}:${t(e.second)} ${e.year}`;case"C":return t(Math.floor(e.year/100));case"d":return t(e.day);case"D":return`${t(e.month)}/${t(e.day)}/${t(e.year%100)}`;case"e":return String(e.day).padStart(2," ");case"F":return`${e.year}-${t(e.month)}-${t(e.day)}`;case"g":return t(h(e.year,e.month,e.day)%100);case"G":return String(h(e.year,e.month,e.day));case"H":return t(e.hour);case"I":return t(e.hour%12||12);case"j":return String(n).padStart(3,"0");case"k":return String(e.hour).padStart(2," ");case"l":return String(e.hour%12||12).padStart(2," ");case"m":return t(e.month);case"M":return t(e.minute);case"n":return`
+`;case"N":return"000000000";case"p":return e.hour<12?"AM":"PM";case"P":return e.hour<12?"am":"pm";case"r":return`${t(e.hour%12||12)}:${t(e.minute)}:${t(e.second)} ${e.hour<12?"AM":"PM"}`;case"R":return`${t(e.hour)}:${t(e.minute)}`;case"s":return String(Math.floor(r.getTime()/1e3));case"S":return t(e.second);case"t":return"	";case"T":return`${t(e.hour)}:${t(e.minute)}:${t(e.second)}`;case"u":return String(e.weekday===0?7:e.weekday);case"U":return t(u);case"V":return t($(e.year,e.month,e.day));case"w":return String(e.weekday);case"W":return t(i);case"x":return`${t(e.month)}/${t(e.day)}/${t(e.year%100)}`;case"X":return`${t(e.hour)}:${t(e.minute)}:${t(e.second)}`;case"y":return t(e.year%100);case"Y":return String(e.year);case"z":return l(r,a);case"Z":return p(r,a);case"%":return"%";default:return null}}function l(r,o){if(!o){let u=-r.getTimezoneOffset(),i=u>=0?"+":"-",s=Math.floor(Math.abs(u)/60),c=Math.abs(u)%60;return`${i}${String(s).padStart(2,"0")}${String(c).padStart(2,"0")}`}try{let s=new Intl.DateTimeFormat("en-US",{timeZone:o,timeZoneName:"longOffset"}).formatToParts(r).find(c=>c.type==="timeZoneName");if(s){let c=s.value.match(/GMT([+-])(\d{2}):(\d{2})/);if(c)return`${c[1]}${c[2]}${c[3]}`;if(s.value==="GMT"||s.value==="UTC")return"+0000"}}catch{}let a=-r.getTimezoneOffset(),e=a>=0?"+":"-",t=Math.floor(Math.abs(a)/60),n=Math.abs(a)%60;return`${e}${String(t).padStart(2,"0")}${String(n).padStart(2,"0")}`}function p(r,o){try{return new Intl.DateTimeFormat("en-US",{timeZone:o,timeZoneName:"short"}).formatToParts(r).find(n=>n.type==="timeZoneName")?.value??"UTC"}catch{return"UTC"}}function g(r,o,a){let e=[31,28,31,30,31,30,31,31,30,31,30,31];(r%4===0&&r%100!==0||r%400===0)&&(e[1]=29);let n=a;for(let u=0;u<o-1;u++)n+=e[u];return n}function d(r,o,a,e,t){let n=g(r,o,a),u=new Date(r,0,1).getDay(),i=1+(7+t-u)%7,s=n-i;return s<0?0:Math.floor(s/7)+1}function $(r,o,a){let e=new Date(r,o-1,a,12,0,0);e.setDate(e.getDate()+3-(e.getDay()+6)%7);let t=new Date(e.getFullYear(),0,4);t.setDate(t.getDate()+3-(t.getDay()+6)%7);let n=e.getTime()-t.getTime();return 1+Math.round(n/(10080*60*1e3))}function h(r,o,a){let e=new Date(r,o-1,a,12,0,0);return e.setDate(e.getDate()+3-(e.getDay()+6)%7),e.getFullYear()}export{M as a};

package/dist/bin/chunks/chunk-4J4UC7OD.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a as w,b as V}from"./chunk-LMA4D2KK.js";import{d as E}from"./chunk-MLUOPG3W.js";import{a as T,b as M}from"./chunk-AZH64XMJ.js";import{a as F}from"./chunk-LX2H4DPL.js";import{a as R}from"./chunk-ZZP3RSWL.js";import{a as J}from"./chunk-DHIKZU63.js";import{k as O}from"./chunk-47WZ2U6M.js";import{a as N}from"./chunk-PBOVSFTJ.js";import{a as A,b as L,c as I}from"./chunk-MUFNRCMY.js";function W(t){switch(t){case"\b":return"\\b";case"\f":return"\\f";case`
+`:return"\\n";case"\r":return"\\r";case"	":return"\\t";default:return`\\u${t.charCodeAt(0).toString(16).padStart(4,"0")}`}}function _(t){let n="",s=!1,i=!1;for(let a=0;a<t.length;a++){let r=t[a];if(i){n+=r,i=!1;continue}if(r==="\\"){n+=r,i=!0;continue}if(r==='"'){n+=r,s=!s;continue}if(s&&r.charCodeAt(0)<=31){n+=W(r);continue}n+=r}return n}function k(t,n,s){return JSON.parse(_(t.slice(n,s)))}function B(t){let n=[],s=0,i=t.length;for(;s<i;){for(;s<i&&/\s/.test(t[s]);)s++;if(s>=i)break;let a=s,r=t[s];if(r==="{"||r==="["){let f=r,c=r==="{"?"}":"]",p=1,m=!1,d=!1;for(s++;s<i&&p>0;){let j=t[s];d?d=!1:j==="\\"?d=!0:j==='"'?m=!m:m||(j===f?p++:j===c&&p--),s++}if(p!==0)throw new Error(`Unexpected end of JSON input at position ${s} (unclosed ${f})`);n.push(E(k(t,a,s)))}else if(r==='"'){let f=!1;for(s++;s<i;){let c=t[s];if(f)f=!1;else if(c==="\\")f=!0;else if(c==='"'){s++;break}s++}n.push(E(k(t,a,s)))}else if(r==="-"||r>="0"&&r<="9"){for(;s<i&&/[\d.eE+-]/.test(t[s]);)s++;n.push(E(k(t,a,s)))}else if(t.slice(s,s+4)==="true")n.push(!0),s+=4;else if(t.slice(s,s+5)==="false")n.push(!1),s+=5;else if(t.slice(s,s+4)==="null")n.push(null),s+=4;else{let f=t.slice(s,s+10);throw new Error(`Invalid JSON at position ${a}: unexpected '${f.split(/\s/)[0]}'`)}}return n}var X={name:"jq",summary:"command-line JSON processor",usage:"jq [OPTIONS] FILTER [FILE...]",options:["-R, --raw-input   read each line as string instead of JSON","-r, --raw-output  output strings without quotes","-c, --compact-output  compact instead of pretty-printed output","-e, --exit-status set exit status based on output","-s, --slurp       read entire input into array","-n, --null-input  don't read any input","-j, --join-output don't print newlines after each output","-a, --ascii       force ASCII output","-S, --sort-keys   sort object keys","-C, --color       colorize output (ignored)","-M, --monochrome  monochrome output (ignored)","    --tab         use tabs for indentation","    --help        display this help and exit"]};function C(t,n,s,i,a,r=0){if(t===null||t===void 0)return"null";if(typeof t=="boolean")return String(t);if(typeof t=="number")return Number.isFinite(t)?String(t):"null";if(typeof t=="string")return s?t:JSON.stringify(t);let f=a?"	":"  ";if(Array.isArray(t))return t.length===0?"[]":n?`[${t.map(p=>C(p,!0,!1,i,a)).join(",")}]`:`[
+${t.map(p=>f.repeat(r+1)+C(p,!1,!1,i,a,r+1)).join(`,
+`)}
+${f.repeat(r)}]`;if(typeof t=="object"){let c=Object.keys(t);return i&&(c=c.sort()),c.length===0?"{}":n?`{${c.map(m=>`${JSON.stringify(m)}:${C(t[m],!0,!1,i,a)}`).join(",")}}`:`{
+${c.map(m=>{let d=C(t[m],!1,!1,i,a,r+1);return`${f.repeat(r+1)}${JSON.stringify(m)}: ${d}`}).join(`,
+`)}
+${f.repeat(r)}}`}return String(t)}var re={name:"jq",async execute(t,n){T(n.requireDefenseContext,"jq","execution entry");let s=(o,e)=>M(n.requireDefenseContext,"jq",o,e);if(L(t))return A(X);let i=!1,a=!1,r=!1,f=!1,c=!1,p=!1,m=!1,d=!1,j=!1,D=".",z=!1,x=[];for(let o=0;o<t.length;o++){let e=t[o];if(e==="-R"||e==="--raw-input")a=!0;else if(e==="-r"||e==="--raw-output")i=!0;else if(e==="-c"||e==="--compact-output")r=!0;else if(e==="-e"||e==="--exit-status")f=!0;else if(e==="-s"||e==="--slurp")c=!0;else if(e==="-n"||e==="--null-input")p=!0;else if(e==="-j"||e==="--join-output")m=!0;else if(!(e==="-a"||e==="--ascii")){if(e==="-S"||e==="--sort-keys")d=!0;else if(!(e==="-C"||e==="--color")){if(!(e==="-M"||e==="--monochrome"))if(e==="--tab")j=!0;else if(e==="-")x.push("-");else{if(e.startsWith("--"))return I("jq",e);if(e.startsWith("-")){for(let l of e.slice(1))if(l==="R")a=!0;else if(l==="r")i=!0;else if(l==="c")r=!0;else if(l==="e")f=!0;else if(l==="s")c=!0;else if(l==="n")p=!0;else if(l==="j")m=!0;else if(l!=="a"){if(l==="S")d=!0;else if(l!=="C"){if(l!=="M")return I("jq",`-${l}`)}}}else z?x.push(e):(D=e,z=!0)}}}}let S=[];if(!p)if(x.length===0||x.length===1&&x[0]==="-")S.push({source:"stdin",content:J(n.stdin)});else{let o=await s("file read",()=>R(n,x,{cmdName:"jq",stopOnError:!0}));if(o.exitCode!==0)return{stdout:"",stderr:o.stderr,exitCode:2};S=o.files.map(e=>({source:e.filename||"stdin",content:J(e.content)}))}try{let o=V(D),e=[],l={limits:n.limits?{maxIterations:n.limits.maxJqIterations}:void 0,env:n.env,coverage:n.coverage,requireDefenseContext:n.requireDefenseContext};if(p)e=w(null,o,l);else if(a&&c){let u=S.map(({content:g})=>g).join("");e=w(u,o,l)}else if(a){let u="";for(let{content:g}of S){let h=u+g,y=0,q=h.indexOf(`
+`,y);for(;q!==-1;)e.push(...w(h.slice(y,q),o,l)),y=q+1,q=h.indexOf(`
+`,y);u=h.slice(y)}u!==""&&e.push(...w(u,o,l))}else if(c){let u=[];for(let{content:g}of S){let h=g.trim();h&&u.push(...B(h))}e=w(u,o,l)}else for(let{content:u}of S){let g=u.trim();if(!g)continue;let h=B(g);for(let y of h)e.push(...w(y,o,l))}let H=e.map(u=>C(u,r,i,d,j)),P=m?"":`
+`,b=H.join(P),$=n.limits?.maxStringLength;if($!==void 0&&$>0&&b.length>$)throw new O(`jq: output size limit exceeded (${$} bytes)`,"string_length");let U=f&&(e.length===0||e.every(u=>u==null||u===!1))?1:0;return{stdout:b?m?b:`${b}
+`:"",stderr:"",exitCode:U}}catch(o){if(o instanceof F)throw o;if(o instanceof O)return{stdout:"",stderr:`jq: ${N(o.message)}
+`,exitCode:O.EXIT_CODE};let e=N(o.message);return e.includes("Unknown function")?{stdout:"",stderr:`jq: error: ${e}
+`,exitCode:3}:{stdout:"",stderr:`jq: parse error: ${e}
+`,exitCode:5}}}},oe={name:"jq",flags:[{flag:"-R",type:"boolean"},{flag:"-r",type:"boolean"},{flag:"-c",type:"boolean"},{flag:"-e",type:"boolean"},{flag:"-s",type:"boolean"},{flag:"-n",type:"boolean"},{flag:"-j",type:"boolean"},{flag:"-S",type:"boolean"},{flag:"--tab",type:"boolean"}],stdinType:"json",needsArgs:!0};export{re as a,oe as b};