just-bash 3.0.3 → 3.2.0

package/dist/commands/jq/jq.d.ts

@@ -1,9 +1,9 @@
 /**
- * jq - Command-line JSON processor
+ * jq - RuntimeCommand-line JSON processor
  *
  * Full jq implementation with proper parser and evaluator.
  */
-import type { Command } from "../../types.js";
-export declare const jqCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const jqCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/js-exec/fetch-polyfill.d.ts

@@ -3,4 +3,4 @@
  * Exported as a string constant to be evaluated inside the sandbox.
  * Provides URLSearchParams, URL, Headers, Response, Request, and fetch().
  */
-export declare const FETCH_POLYFILL_SOURCE = "\n(function() {\n  // --- URLSearchParams ---\n  function URLSearchParams(init) {\n    this._entries = [];\n    if (!init) return;\n    if (typeof init === 'string') {\n      var s = init;\n      if (s.charAt(0) === '?') s = s.slice(1);\n      var pairs = s.split('&');\n      for (var i = 0; i < pairs.length; i++) {\n        var pair = pairs[i];\n        if (pair === '') continue;\n        var eq = pair.indexOf('=');\n        if (eq === -1) {\n          this._entries.push([decodeURIComponent(pair), '']);\n        } else {\n          this._entries.push([\n            decodeURIComponent(pair.slice(0, eq)),\n            decodeURIComponent(pair.slice(eq + 1))\n          ]);\n        }\n      }\n    } else if (typeof init === 'object' && init !== null) {\n      if (init instanceof URLSearchParams) {\n        this._entries = init._entries.slice();\n      } else {\n        var keys = Object.keys(init);\n        for (var i = 0; i < keys.length; i++) {\n          this._entries.push([keys[i], String(init[keys[i]])]);\n        }\n      }\n    }\n  }\n\n  URLSearchParams.prototype.append = function(name, value) {\n    this._entries.push([String(name), String(value)]);\n  };\n\n  URLSearchParams.prototype.delete = function(name) {\n    var n = String(name);\n    this._entries = this._entries.filter(function(e) { return e[0] !== n; });\n  };\n\n  URLSearchParams.prototype.get = function(name) {\n    var n = String(name);\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) return this._entries[i][1];\n    }\n    return null;\n  };\n\n  URLSearchParams.prototype.getAll = function(name) {\n    var n = String(name);\n    var result = [];\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) result.push(this._entries[i][1]);\n    }\n    return result;\n  };\n\n  URLSearchParams.prototype.has = function(name) {\n    var n = String(name);\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) return true;\n    }\n    return false;\n  };\n\n  URLSearchParams.prototype.set = function(name, value) {\n    var n = String(name);\n    var v = String(value);\n    var found = false;\n    var newEntries = [];\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) {\n        if (!found) {\n          newEntries.push([n, v]);\n          found = true;\n        }\n      } else {\n        newEntries.push(this._entries[i]);\n      }\n    }\n    if (!found) newEntries.push([n, v]);\n    this._entries = newEntries;\n  };\n\n  URLSearchParams.prototype.sort = function() {\n    this._entries.sort(function(a, b) {\n      if (a[0] < b[0]) return -1;\n      if (a[0] > b[0]) return 1;\n      return 0;\n    });\n  };\n\n  URLSearchParams.prototype.toString = function() {\n    return this._entries.map(function(e) {\n      return encodeURIComponent(e[0]) + '=' + encodeURIComponent(e[1]);\n    }).join('&');\n  };\n\n  URLSearchParams.prototype.forEach = function(callback, thisArg) {\n    for (var i = 0; i < this._entries.length; i++) {\n      callback.call(thisArg, this._entries[i][1], this._entries[i][0], this);\n    }\n  };\n\n  URLSearchParams.prototype.entries = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++].slice() };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype.keys = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++][0] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype.values = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++][1] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype[Symbol.iterator] = URLSearchParams.prototype.entries;\n\n  Object.defineProperty(URLSearchParams.prototype, 'size', {\n    get: function() { return this._entries.length; }\n  });\n\n  // --- URL ---\n  var urlRegex = /^([a-zA-Z][a-zA-Z0-9+.-]*):(?:\\/\\/(?:([^:@/?#]*)(?::([^@/?#]*))?@)?([^:/?#]*)(?::([0-9]+))?)?(\\/[^?#]*)?(?:\\?([^#]*))?(?:#(.*))?$/;\n\n  function URL(url, base) {\n    var input = String(url);\n\n    if (base !== undefined) {\n      var baseUrl = (base instanceof URL) ? base : new URL(String(base));\n      // Resolve relative URL against base\n      if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(input)) {\n        // Absolute URL - parse as-is\n      } else if (input.charAt(0) === '/' && input.charAt(1) === '/') {\n        // Protocol-relative\n        input = baseUrl.protocol + input;\n      } else if (input.charAt(0) === '/') {\n        // Absolute path\n        input = baseUrl.origin + input;\n      } else if (input.charAt(0) === '?' || input.charAt(0) === '#') {\n        // Query or hash only\n        var basePath = baseUrl.protocol + '//' + baseUrl.host + baseUrl.pathname;\n        if (input.charAt(0) === '#') {\n          input = basePath + baseUrl.search + input;\n        } else {\n          input = basePath + input;\n        }\n      } else {\n        // Relative path\n        var basePath = baseUrl.protocol + '//' + baseUrl.host;\n        var dirPath = baseUrl.pathname;\n        var lastSlash = dirPath.lastIndexOf('/');\n        if (lastSlash >= 0) dirPath = dirPath.slice(0, lastSlash + 1);\n        else dirPath = '/';\n        input = basePath + dirPath + input;\n      }\n    }\n\n    var m = urlRegex.exec(input);\n    if (!m) throw new TypeError(\"Invalid URL: \" + String(url));\n\n    this.protocol = m[1].toLowerCase() + ':';\n    this.username = m[2] ? decodeURIComponent(m[2]) : '';\n    this.password = m[3] ? decodeURIComponent(m[3]) : '';\n    this.hostname = m[4] || '';\n    this.port = m[5] || '';\n    this.pathname = m[6] || '/';\n    this.hash = m[8] ? '#' + m[8] : '';\n\n    // Normalize pathname (resolve . and ..)\n    var parts = this.pathname.split('/');\n    var resolved = [];\n    for (var i = 0; i < parts.length; i++) {\n      if (parts[i] === '..') { if (resolved.length > 1) resolved.pop(); }\n      else if (parts[i] !== '.') resolved.push(parts[i]);\n    }\n    this.pathname = resolved.join('/') || '/';\n\n    // searchParams is live\n    this._searchParamsStr = m[7] || '';\n    this.searchParams = new URLSearchParams(this._searchParamsStr);\n  }\n\n  Object.defineProperty(URL.prototype, 'search', {\n    get: function() {\n      var s = this.searchParams.toString();\n      return s ? '?' + s : '';\n    },\n    set: function(v) {\n      this.searchParams = new URLSearchParams(String(v));\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'host', {\n    get: function() {\n      return this.port ? this.hostname + ':' + this.port : this.hostname;\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'origin', {\n    get: function() {\n      return this.protocol + '//' + this.host;\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'href', {\n    get: function() {\n      var auth = '';\n      if (this.username) {\n        auth = this.username;\n        if (this.password) auth += ':' + this.password;\n        auth += '@';\n      }\n      return this.protocol + '//' + auth + this.host + this.pathname + this.search + this.hash;\n    },\n    set: function(v) {\n      var parsed = new URL(String(v));\n      this.protocol = parsed.protocol;\n      this.username = parsed.username;\n      this.password = parsed.password;\n      this.hostname = parsed.hostname;\n      this.port = parsed.port;\n      this.pathname = parsed.pathname;\n      this.searchParams = parsed.searchParams;\n      this.hash = parsed.hash;\n    }\n  });\n\n  URL.prototype.toString = function() { return this.href; };\n  URL.prototype.toJSON = function() { return this.href; };\n\n  // --- Headers ---\n  function Headers(init) {\n    this._map = {};\n    if (!init) return;\n    if (init instanceof Headers) {\n      var keys = Object.keys(init._map);\n      for (var i = 0; i < keys.length; i++) {\n        this._map[keys[i]] = init._map[keys[i]].slice();\n      }\n    } else if (typeof init === 'object') {\n      var keys = Object.keys(init);\n      for (var i = 0; i < keys.length; i++) {\n        this._map[keys[i].toLowerCase()] = [String(init[keys[i]])];\n      }\n    }\n  }\n\n  Headers.prototype.append = function(name, value) {\n    var key = String(name).toLowerCase();\n    if (!this._map[key]) this._map[key] = [];\n    this._map[key].push(String(value));\n  };\n\n  Headers.prototype.delete = function(name) {\n    delete this._map[String(name).toLowerCase()];\n  };\n\n  Headers.prototype.get = function(name) {\n    var vals = this._map[String(name).toLowerCase()];\n    return vals ? vals.join(', ') : null;\n  };\n\n  Headers.prototype.has = function(name) {\n    return String(name).toLowerCase() in this._map;\n  };\n\n  Headers.prototype.set = function(name, value) {\n    this._map[String(name).toLowerCase()] = [String(value)];\n  };\n\n  Headers.prototype.forEach = function(callback, thisArg) {\n    var keys = Object.keys(this._map).sort();\n    for (var i = 0; i < keys.length; i++) {\n      callback.call(thisArg, this._map[keys[i]].join(', '), keys[i], this);\n    }\n  };\n\n  Headers.prototype.entries = function() {\n    var keys = Object.keys(this._map).sort();\n    var map = this._map;\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        var k = keys[idx++];\n        return { done: false, value: [k, map[k].join(', ')] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype.keys = function() {\n    var keys = Object.keys(this._map).sort();\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        return { done: false, value: keys[idx++] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype.values = function() {\n    var keys = Object.keys(this._map).sort();\n    var map = this._map;\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        return { done: false, value: map[keys[idx++]].join(', ') };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype[Symbol.iterator] = Headers.prototype.entries;\n\n  // --- Response ---\n  function Response(body, init) {\n    if (init === undefined) init = {};\n    this.status = init.status !== undefined ? init.status : 200;\n    this.statusText = init.statusText !== undefined ? init.statusText : '';\n    this.headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    this.body = body !== undefined && body !== null ? String(body) : '';\n    this.ok = this.status >= 200 && this.status <= 299;\n    this.url = '';\n    this.redirected = false;\n    this.type = 'basic';\n    this.bodyUsed = false;\n  }\n\n  Response.prototype.text = function() {\n    this.bodyUsed = true;\n    return Promise.resolve(this.body);\n  };\n\n  Response.prototype.json = function() {\n    this.bodyUsed = true;\n    try {\n      return Promise.resolve(JSON.parse(this.body));\n    } catch (e) {\n      return Promise.reject(e);\n    }\n  };\n\n  Response.prototype.clone = function() {\n    var r = new Response(this.body, {\n      status: this.status,\n      statusText: this.statusText,\n      headers: new Headers(this.headers)\n    });\n    r.url = this.url;\n    r.redirected = this.redirected;\n    r.type = this.type;\n    return r;\n  };\n\n  Response.json = function(data, init) {\n    if (init === undefined) init = {};\n    var headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    if (!headers.has('content-type')) {\n      headers.set('content-type', 'application/json');\n    }\n    return new Response(JSON.stringify(data), {\n      status: init.status !== undefined ? init.status : 200,\n      statusText: init.statusText || '',\n      headers: headers\n    });\n  };\n\n  Response.error = function() {\n    var r = new Response(null, { status: 0, statusText: '' });\n    r.type = 'error';\n    r.ok = false;\n    return r;\n  };\n\n  Response.redirect = function(url, status) {\n    if (status === undefined) status = 302;\n    var r = new Response(null, {\n      status: status,\n      statusText: '',\n      headers: new Headers({ location: String(url) })\n    });\n    r.redirected = true;\n    return r;\n  };\n\n  // --- Request ---\n  function Request(input, init) {\n    if (init === undefined) init = {};\n    if (input instanceof Request) {\n      this.url = input.url;\n      this.method = input.method;\n      this.headers = new Headers(input.headers);\n      this.body = input.body;\n    } else {\n      this.url = String(input);\n      this.method = 'GET';\n      this.headers = new Headers();\n      this.body = null;\n    }\n    if (init.method !== undefined) this.method = String(init.method).toUpperCase();\n    if (init.headers !== undefined) this.headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    if (init.body !== undefined) this.body = init.body !== null ? String(init.body) : null;\n  }\n\n  Request.prototype.clone = function() {\n    return new Request(this);\n  };\n\n  // --- Assign to globalThis ---\n  globalThis.URLSearchParams = URLSearchParams;\n  globalThis.URL = URL;\n  globalThis.Headers = Headers;\n  globalThis.Response = Response;\n  globalThis.Request = Request;\n\n  // --- Wrap native fetch ---\n  var _nativeFetch = globalThis[Symbol.for('jb:fetch')];\n  globalThis.fetch = function fetch(input, init) {\n    try {\n      var url, method, headers, body;\n\n      if (input instanceof Request) {\n        url = input.url;\n        method = input.method;\n        headers = {};\n        input.headers.forEach(function(v, k) { headers[k] = v; });\n        body = input.body;\n      } else {\n        url = String(input);\n        method = undefined;\n        headers = undefined;\n        body = undefined;\n      }\n\n      if (init) {\n        if (init.method !== undefined) method = String(init.method).toUpperCase();\n        if (init.headers !== undefined) {\n          var h = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n          headers = {};\n          h.forEach(function(v, k) { headers[k] = v; });\n        }\n        if (init.body !== undefined) body = init.body !== null ? String(init.body) : undefined;\n      }\n\n      var opts = Object.create(null);\n      if (method) opts.method = method;\n      if (headers) opts.headers = headers;\n      if (body) opts.body = body;\n\n      var raw = _nativeFetch(url, opts);\n\n      var respHeaders = new Headers(raw.headers || {});\n      var response = new Response(raw.body, {\n        status: raw.status,\n        statusText: raw.statusText || '',\n        headers: respHeaders\n      });\n      response.url = raw.url || url;\n\n      return Promise.resolve(response);\n    } catch (e) {\n      return Promise.reject(new TypeError(e.message || 'fetch failed'));\n    }\n  };\n})();\n";
+export declare const FETCH_POLYFILL_SOURCE = "\n(function() {\n  // --- URLSearchParams ---\n  function URLSearchParams(init) {\n    this._entries = [];\n    if (!init) return;\n    if (typeof init === 'string') {\n      var s = init;\n      if (s.charAt(0) === '?') s = s.slice(1);\n      var pairs = s.split('&');\n      for (var i = 0; i < pairs.length; i++) {\n        var pair = pairs[i];\n        if (pair === '') continue;\n        var eq = pair.indexOf('=');\n        if (eq === -1) {\n          this._entries.push([decodeURIComponent(pair), '']);\n        } else {\n          this._entries.push([\n            decodeURIComponent(pair.slice(0, eq)),\n            decodeURIComponent(pair.slice(eq + 1))\n          ]);\n        }\n      }\n    } else if (typeof init === 'object' && init !== null) {\n      if (init instanceof URLSearchParams) {\n        this._entries = init._entries.slice();\n      } else {\n        var keys = Object.keys(init);\n        for (var i = 0; i < keys.length; i++) {\n          this._entries.push([keys[i], String(init[keys[i]])]);\n        }\n      }\n    }\n  }\n\n  URLSearchParams.prototype.append = function(name, value) {\n    this._entries.push([String(name), String(value)]);\n  };\n\n  URLSearchParams.prototype.delete = function(name) {\n    var n = String(name);\n    this._entries = this._entries.filter(function(e) { return e[0] !== n; });\n  };\n\n  URLSearchParams.prototype.get = function(name) {\n    var n = String(name);\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) return this._entries[i][1];\n    }\n    return null;\n  };\n\n  URLSearchParams.prototype.getAll = function(name) {\n    var n = String(name);\n    var result = [];\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) result.push(this._entries[i][1]);\n    }\n    return result;\n  };\n\n  URLSearchParams.prototype.has = function(name) {\n    var n = String(name);\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) return true;\n    }\n    return false;\n  };\n\n  URLSearchParams.prototype.set = function(name, value) {\n    var n = String(name);\n    var v = String(value);\n    var found = false;\n    var newEntries = [];\n    for (var i = 0; i < this._entries.length; i++) {\n      if (this._entries[i][0] === n) {\n        if (!found) {\n          newEntries.push([n, v]);\n          found = true;\n        }\n      } else {\n        newEntries.push(this._entries[i]);\n      }\n    }\n    if (!found) newEntries.push([n, v]);\n    this._entries = newEntries;\n  };\n\n  URLSearchParams.prototype.sort = function() {\n    this._entries.sort(function(a, b) {\n      if (a[0] < b[0]) return -1;\n      if (a[0] > b[0]) return 1;\n      return 0;\n    });\n  };\n\n  URLSearchParams.prototype.toString = function() {\n    return this._entries.map(function(e) {\n      return encodeURIComponent(e[0]) + '=' + encodeURIComponent(e[1]);\n    }).join('&');\n  };\n\n  URLSearchParams.prototype.forEach = function(callback, thisArg) {\n    for (var i = 0; i < this._entries.length; i++) {\n      callback.call(thisArg, this._entries[i][1], this._entries[i][0], this);\n    }\n  };\n\n  URLSearchParams.prototype.entries = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++].slice() };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype.keys = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++][0] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype.values = function() {\n    var idx = 0;\n    var entries = this._entries;\n    return {\n      next: function() {\n        if (idx >= entries.length) return { done: true, value: undefined };\n        return { done: false, value: entries[idx++][1] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  URLSearchParams.prototype[Symbol.iterator] = URLSearchParams.prototype.entries;\n\n  Object.defineProperty(URLSearchParams.prototype, 'size', {\n    get: function() { return this._entries.length; }\n  });\n\n  // --- URL ---\n  var urlRegex = /^([a-zA-Z][a-zA-Z0-9+.-]*):(?:\\/\\/(?:([^:@/?#]*)(?::([^@/?#]*))?@)?([^:/?#]*)(?::([0-9]+))?)?(\\/[^?#]*)?(?:\\?([^#]*))?(?:#(.*))?$/;\n\n  function URL(url, base) {\n    var input = String(url);\n\n    if (base !== undefined) {\n      var baseUrl = (base instanceof URL) ? base : new URL(String(base));\n      // Resolve relative URL against base\n      if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(input)) {\n        // Absolute URL - parse as-is\n      } else if (input.charAt(0) === '/' && input.charAt(1) === '/') {\n        // Protocol-relative\n        input = baseUrl.protocol + input;\n      } else if (input.charAt(0) === '/') {\n        // Absolute path\n        input = baseUrl.origin + input;\n      } else if (input.charAt(0) === '?' || input.charAt(0) === '#') {\n        // Query or hash only\n        var basePath = baseUrl.protocol + '//' + baseUrl.host + baseUrl.pathname;\n        if (input.charAt(0) === '#') {\n          input = basePath + baseUrl.search + input;\n        } else {\n          input = basePath + input;\n        }\n      } else {\n        // Relative path\n        var basePath = baseUrl.protocol + '//' + baseUrl.host;\n        var dirPath = baseUrl.pathname;\n        var lastSlash = dirPath.lastIndexOf('/');\n        if (lastSlash >= 0) dirPath = dirPath.slice(0, lastSlash + 1);\n        else dirPath = '/';\n        input = basePath + dirPath + input;\n      }\n    }\n\n    var m = urlRegex.exec(input);\n    if (!m) throw new TypeError(\"Invalid URL: \" + String(url));\n\n    this.protocol = m[1].toLowerCase() + ':';\n    this.username = m[2] ? decodeURIComponent(m[2]) : '';\n    this.password = m[3] ? decodeURIComponent(m[3]) : '';\n    this.hostname = m[4] || '';\n    this.port = m[5] || '';\n    this.pathname = m[6] || '/';\n    this.hash = m[8] ? '#' + m[8] : '';\n\n    // Normalize pathname (resolve . and ..)\n    var parts = this.pathname.split('/');\n    var resolved = [];\n    for (var i = 0; i < parts.length; i++) {\n      if (parts[i] === '..') { if (resolved.length > 1) resolved.pop(); }\n      else if (parts[i] !== '.') resolved.push(parts[i]);\n    }\n    this.pathname = resolved.join('/') || '/';\n\n    // searchParams is live\n    this._searchParamsStr = m[7] || '';\n    this.searchParams = new URLSearchParams(this._searchParamsStr);\n  }\n\n  Object.defineProperty(URL.prototype, 'search', {\n    get: function() {\n      var s = this.searchParams.toString();\n      return s ? '?' + s : '';\n    },\n    set: function(v) {\n      this.searchParams = new URLSearchParams(String(v));\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'host', {\n    get: function() {\n      return this.port ? this.hostname + ':' + this.port : this.hostname;\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'origin', {\n    get: function() {\n      return this.protocol + '//' + this.host;\n    }\n  });\n\n  Object.defineProperty(URL.prototype, 'href', {\n    get: function() {\n      var auth = '';\n      if (this.username) {\n        auth = this.username;\n        if (this.password) auth += ':' + this.password;\n        auth += '@';\n      }\n      return this.protocol + '//' + auth + this.host + this.pathname + this.search + this.hash;\n    },\n    set: function(v) {\n      var parsed = new URL(String(v));\n      this.protocol = parsed.protocol;\n      this.username = parsed.username;\n      this.password = parsed.password;\n      this.hostname = parsed.hostname;\n      this.port = parsed.port;\n      this.pathname = parsed.pathname;\n      this.searchParams = parsed.searchParams;\n      this.hash = parsed.hash;\n    }\n  });\n\n  URL.prototype.toString = function() { return this.href; };\n  URL.prototype.toJSON = function() { return this.href; };\n\n  // --- Headers ---\n  function Headers(init) {\n    this._map = Object.create(null);\n    if (!init) return;\n    if (init instanceof Headers) {\n      var keys = Object.keys(init._map);\n      for (var i = 0; i < keys.length; i++) {\n        this._map[keys[i]] = init._map[keys[i]].slice();\n      }\n    } else if (typeof init === 'object') {\n      var keys = Object.keys(init);\n      for (var i = 0; i < keys.length; i++) {\n        this._map[keys[i].toLowerCase()] = [String(init[keys[i]])];\n      }\n    }\n  }\n\n  Headers.prototype.append = function(name, value) {\n    var key = String(name).toLowerCase();\n    if (!Object.prototype.hasOwnProperty.call(this._map, key)) this._map[key] = [];\n    this._map[key].push(String(value));\n  };\n\n  Headers.prototype.delete = function(name) {\n    delete this._map[String(name).toLowerCase()];\n  };\n\n  Headers.prototype.get = function(name) {\n    var vals = this._map[String(name).toLowerCase()];\n    return vals ? vals.join(', ') : null;\n  };\n\n  Headers.prototype.has = function(name) {\n    return Object.prototype.hasOwnProperty.call(this._map, String(name).toLowerCase());\n  };\n\n  Headers.prototype.set = function(name, value) {\n    this._map[String(name).toLowerCase()] = [String(value)];\n  };\n\n  Headers.prototype.forEach = function(callback, thisArg) {\n    var keys = Object.keys(this._map).sort();\n    for (var i = 0; i < keys.length; i++) {\n      callback.call(thisArg, this._map[keys[i]].join(', '), keys[i], this);\n    }\n  };\n\n  Headers.prototype.entries = function() {\n    var keys = Object.keys(this._map).sort();\n    var map = this._map;\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        var k = keys[idx++];\n        return { done: false, value: [k, map[k].join(', ')] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype.keys = function() {\n    var keys = Object.keys(this._map).sort();\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        return { done: false, value: keys[idx++] };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype.values = function() {\n    var keys = Object.keys(this._map).sort();\n    var map = this._map;\n    var idx = 0;\n    return {\n      next: function() {\n        if (idx >= keys.length) return { done: true, value: undefined };\n        return { done: false, value: map[keys[idx++]].join(', ') };\n      },\n      [Symbol.iterator]: function() { return this; }\n    };\n  };\n\n  Headers.prototype[Symbol.iterator] = Headers.prototype.entries;\n\n  // --- Response ---\n  function Response(body, init) {\n    if (init === undefined) init = {};\n    this.status = init.status !== undefined ? init.status : 200;\n    this.statusText = init.statusText !== undefined ? init.statusText : '';\n    this.headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    this.body = body !== undefined && body !== null ? String(body) : '';\n    this.ok = this.status >= 200 && this.status <= 299;\n    this.url = '';\n    this.redirected = false;\n    this.type = 'basic';\n    this.bodyUsed = false;\n  }\n\n  Response.prototype.text = function() {\n    this.bodyUsed = true;\n    return Promise.resolve(this.body);\n  };\n\n  Response.prototype.json = function() {\n    this.bodyUsed = true;\n    try {\n      return Promise.resolve(JSON.parse(this.body));\n    } catch (e) {\n      return Promise.reject(e);\n    }\n  };\n\n  Response.prototype.clone = function() {\n    var r = new Response(this.body, {\n      status: this.status,\n      statusText: this.statusText,\n      headers: new Headers(this.headers)\n    });\n    r.url = this.url;\n    r.redirected = this.redirected;\n    r.type = this.type;\n    return r;\n  };\n\n  Response.json = function(data, init) {\n    if (init === undefined) init = {};\n    var headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    if (!headers.has('content-type')) {\n      headers.set('content-type', 'application/json');\n    }\n    return new Response(JSON.stringify(data), {\n      status: init.status !== undefined ? init.status : 200,\n      statusText: init.statusText || '',\n      headers: headers\n    });\n  };\n\n  Response.error = function() {\n    var r = new Response(null, { status: 0, statusText: '' });\n    r.type = 'error';\n    r.ok = false;\n    return r;\n  };\n\n  Response.redirect = function(url, status) {\n    if (status === undefined) status = 302;\n    var r = new Response(null, {\n      status: status,\n      statusText: '',\n      headers: new Headers({ location: String(url) })\n    });\n    r.redirected = true;\n    return r;\n  };\n\n  // --- Request ---\n  function Request(input, init) {\n    if (init === undefined) init = {};\n    if (input instanceof Request) {\n      this.url = input.url;\n      this.method = input.method;\n      this.headers = new Headers(input.headers);\n      this.body = input.body;\n    } else {\n      this.url = String(input);\n      this.method = 'GET';\n      this.headers = new Headers();\n      this.body = null;\n    }\n    if (init.method !== undefined) this.method = String(init.method).toUpperCase();\n    if (init.headers !== undefined) this.headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n    if (init.body !== undefined) this.body = init.body !== null ? String(init.body) : null;\n  }\n\n  Request.prototype.clone = function() {\n    return new Request(this);\n  };\n\n  // --- Assign to globalThis ---\n  globalThis.URLSearchParams = URLSearchParams;\n  globalThis.URL = URL;\n  globalThis.Headers = Headers;\n  globalThis.Response = Response;\n  globalThis.Request = Request;\n\n  // --- Wrap native fetch ---\n  var _nativeFetch = globalThis[Symbol.for('jb:fetch')];\n  globalThis.fetch = function fetch(input, init) {\n    try {\n      var url, method, headers, body;\n\n      if (input instanceof Request) {\n        url = input.url;\n        method = input.method;\n        headers = {};\n        input.headers.forEach(function(v, k) { headers[k] = v; });\n        body = input.body;\n      } else {\n        url = String(input);\n        method = undefined;\n        headers = undefined;\n        body = undefined;\n      }\n\n      if (init) {\n        if (init.method !== undefined) method = String(init.method).toUpperCase();\n        if (init.headers !== undefined) {\n          var h = init.headers instanceof Headers ? init.headers : new Headers(init.headers);\n          headers = {};\n          h.forEach(function(v, k) { headers[k] = v; });\n        }\n        if (init.body !== undefined) body = init.body !== null ? String(init.body) : undefined;\n      }\n\n      var opts = Object.create(null);\n      if (method) opts.method = method;\n      if (headers) opts.headers = headers;\n      if (body) opts.body = body;\n\n      var raw = _nativeFetch(url, opts);\n\n      var respHeaders = new Headers(raw.headers || {});\n      var response = new Response(raw.body, {\n        status: raw.status,\n        statusText: raw.statusText || '',\n        headers: respHeaders\n      });\n      response.url = raw.url || url;\n\n      return Promise.resolve(response);\n    } catch (e) {\n      return Promise.reject(new TypeError(e.message || 'fetch failed'));\n    }\n  };\n})();\n";

package/dist/commands/js-exec/js-exec-worker.d.ts

@@ -26,6 +26,7 @@ export interface JsExecWorkerInput {
 }
 export interface JsExecWorkerOutput {
     protocolToken?: string;
+    type?: "initialization-failure";
     success: boolean;
     error?: string;
     defenseStats?: WorkerDefenseStats;

package/dist/commands/js-exec/js-exec.d.ts

@@ -6,6 +6,8 @@
  *
  * This command is Node.js only (uses worker_threads).
  */
-import type { Command } from "../../types.js";
-export declare const jsExecCommand: Command;
-export declare const nodeStubCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+/** @internal Reset singleton worker state — for focused protocol tests only. */
+export declare function _resetJsExecWorkerForTests(): void;
+export declare const jsExecCommand: RuntimeCommand;
+export declare const nodeStubCommand: RuntimeCommand;

package/dist/commands/ln/ln.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const lnCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const lnCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/ls/ls.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const lsCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const lsCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/md5sum/checksum.d.ts

@@ -2,6 +2,6 @@
  * Shared checksum utilities for md5sum, sha1sum, sha256sum
  * Uses WebCrypto API for SHA algorithms, pure JS for MD5
  */
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 export type HashAlgorithm = "md5" | "sha1" | "sha256";
-export declare function createChecksumCommand(name: string, algorithm: HashAlgorithm, summary: string): Command;
+export declare function createChecksumCommand(name: string, algorithm: HashAlgorithm, summary: string): RuntimeCommand;

package/dist/commands/md5sum/md5sum.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const md5sumCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const md5sumCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/md5sum/sha1sum.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const sha1sumCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const sha1sumCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/md5sum/sha256sum.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const sha256sumCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const sha256sumCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/mkdir/mkdir.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const mkdirCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const mkdirCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/mv/mv.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const mvCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const mvCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/nl/nl.d.ts

@@ -6,7 +6,7 @@
  * Write each FILE to standard output, with line numbers added.
  * If no FILE is specified, standard input is read.
  */
-import type { Command } from "../../types.js";
-export declare const nl: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const nl: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/od/od.d.ts

@@ -6,7 +6,7 @@
  * Write an unambiguous representation, octal bytes by default,
  * of FILE to standard output.
  */
-import type { Command } from "../../types.js";
-export declare const od: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const od: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/paste/paste.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const pasteCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const pasteCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/printf/escapes.d.ts

@@ -2,6 +2,8 @@
  * Shared escape sequence and formatting utilities
  * Used by printf command and find -printf
  */
+export { utf8ByteLength } from "../../encoding.js";
+export declare function assertFormattingInteger(value: number, maxBytes: number, kind: "width" | "precision"): void;
 /**
  * Apply width and alignment to a string value
  * Supports: width (right-justify), -width (left-justify), .precision (truncate)
@@ -9,17 +11,17 @@
  * @param width - The field width (negative for left-justify)
  * @param precision - Maximum length (-1 for no limit)
  */
-export declare function applyWidth(value: string, width: number, precision: number): string;
+export declare function applyWidth(value: string, width: number, precision: number, maxBytes?: number): string;
 /**
  * Parse a width/precision spec from a format directive
  * Returns: [width, precision, charsConsumed]
  * width: positive for right-justify, negative for left-justify
  * precision: -1 if not specified
  */
-export declare function parseWidthPrecision(format: string, startIndex: number): [number, number, number];
+export declare function parseWidthPrecision(format: string, startIndex: number, maxBytes?: number): [number, number, number];
 /**
  * Process escape sequences in a string
  * Handles: \n, \t, \r, \\, \a, \b, \f, \v, \e, \0NNN (octal), \xHH (hex),
  *          \uHHHH (unicode), \UHHHHHHHH (unicode)
  */
-export declare function processEscapes(str: string): string;
+export declare function processEscapes(str: string, maxBytes?: number): string;

package/dist/commands/printf/printf.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const printfCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const printfCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/printf/strftime.d.ts

@@ -3,7 +3,12 @@
  *
  * Handles date/time formatting for printf's %(...)T directive.
  */
+interface StrftimeLimits {
+    maxOperations?: number;
+    maxOutputBytes?: number;
+}
 /**
  * Format a timestamp using strftime-like format string.
  */
-export declare function formatStrftime(format: string, timestamp: number, tz?: string): string;
+export declare function formatStrftime(format: string, timestamp: number, tz?: string, limits?: StrftimeLimits): string;
+export {};

package/dist/commands/pwd/pwd.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const pwdCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const pwdCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/python3/python3.d.ts

@@ -9,8 +9,8 @@
  *
  * This command is Node.js only (uses worker_threads).
  */
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 /** @internal Reset queue state — for tests only */
 export declare function _resetExecutionQueue(): void;
-export declare const python3Command: Command;
-export declare const pythonCommand: Command;
+export declare const python3Command: RuntimeCommand;
+export declare const pythonCommand: RuntimeCommand;

package/dist/commands/python3/worker.d.ts

@@ -19,6 +19,8 @@ export interface WorkerInput {
     args: string[];
     scriptPath?: string;
     timeoutMs?: number;
+    /** Maximum size of one HOSTFS file, enforced before guest allocations. */
+    maxFileSize?: number;
 }
 export interface WorkerOutput {
     success: boolean;

package/dist/commands/query-engine/builtins/control-builtins.d.ts

@@ -9,7 +9,7 @@ import type { QueryValue } from "../value-operations.js";
 type EvalFn = (value: QueryValue, ast: AstNode, ctx: EvalContext) => QueryValue[];
 type EvalWithPartialFn = (value: QueryValue, ast: AstNode, ctx: EvalContext) => QueryValue[];
 type IsTruthyFn = (v: QueryValue) => boolean;
-type ExecutionLimitErrorClass = new (message: string, kind: "recursion" | "commands" | "iterations") => Error;
+type ExecutionLimitErrorClass = new (message: string, kind: "recursion" | "commands" | "iterations" | "array_elements") => Error;
 /**
  * Handle control flow builtins.
  * Returns null if the builtin name is not a control builtin handled here.

package/dist/commands/query-engine/builtins/path-builtins.d.ts

@@ -3,7 +3,7 @@
  *
  * Handles path manipulation functions like getpath, setpath, delpaths, paths, etc.
  */
-import type { EvalContext } from "../evaluator.js";
+import { type EvalContext } from "../evaluator.js";
 import type { AstNode } from "../parser.js";
 import type { QueryValue } from "../value-operations.js";
 type EvalFn = (value: QueryValue, ast: AstNode, ctx: EvalContext) => QueryValue[];

package/dist/commands/query-engine/evaluator.d.ts

@@ -11,10 +11,14 @@ export type { QueryValue } from "./value-operations.js";
 export interface QueryExecutionLimits {
     maxIterations?: number;
     maxDepth?: number;
+    maxStringLength?: number;
+    maxOutputSize?: number;
+    maxArrayElements?: number;
 }
+export type ResolvedQueryExecutionLimits = Required<QueryExecutionLimits>;
 export interface EvalContext {
     vars: Map<string, QueryValue>;
-    limits: Required<Pick<QueryExecutionLimits, "maxIterations">> & QueryExecutionLimits;
+    limits: ResolvedQueryExecutionLimits;
     env?: Map<string, string>;
     requireDefenseContext?: boolean;
     defenseContextChecked?: boolean;
@@ -30,11 +34,21 @@ export interface EvalContext {
     labels?: Set<string>;
     /** Feature coverage writer for fuzzing instrumentation */
     coverage?: FeatureCoverageWriter;
+    /** Shared across every recursive evaluation and builtin invocation. */
+    budget: QueryEvaluationBudget;
 }
+export interface QueryEvaluationBudget {
+    operations: number;
+    callDepth: number;
+}
+export declare function chargeQueryWork(ctx: EvalContext, count?: number): void;
+export declare function assertQueryResultCapacity(ctx: EvalContext, current: number, additional?: number): void;
 export interface EvaluateOptions {
     limits?: QueryExecutionLimits;
     env?: Map<string, string>;
     coverage?: FeatureCoverageWriter;
     requireDefenseContext?: boolean;
+    /** Reuse across multiple input documents to enforce one command budget. */
+    budget?: QueryEvaluationBudget;
 }
 export declare function evaluate(value: QueryValue, ast: AstNode, ctxOrOptions?: EvalContext | EvaluateOptions): QueryValue[];

package/dist/commands/query-engine/json-output.d.ts

@@ -0,0 +1,11 @@
+import type { QueryValue } from "./value-operations.js";
+export interface JsonOutputOptions {
+    compact?: boolean;
+    raw?: boolean;
+    sortKeys?: boolean;
+    indent?: number;
+    useTab?: boolean;
+    limitKind?: "output_size" | "string_length";
+}
+/** Serialize query values directly into a bounded builder. */
+export declare function formatJsonValue(value: QueryValue, maxBytes: number, options?: JsonOutputOptions): string;

package/dist/commands/query-engine/parser.d.ts

@@ -6,4 +6,9 @@
  */
 export type { ArrayNode, AstNode, BinaryOpNode, BreakNode, CallNode, CommaNode, CondNode, DefNode, DestructurePattern, FieldNode, ForeachNode, IdentityNode, IndexNode, IterateNode, LabelNode, LiteralNode, ObjectNode, OptionalNode, ParenNode, PipeNode, RecurseNode, ReduceNode, SliceNode, StringInterpNode, Token, TokenType, TryNode, UnaryOpNode, UpdateOpNode, VarBindNode, VarRefNode, } from "./parser-types.js";
 import type { AstNode } from "./parser-types.js";
-export declare function parse(input: string): AstNode;
+export interface QueryParseLimits {
+    maxDepth?: number;
+    maxTokens?: number;
+    maxSourceLength?: number;
+}
+export declare function parse(input: string, limits?: QueryParseLimits): AstNode;

package/dist/commands/query-engine/safe-object.d.ts

@@ -1,10 +1,3 @@
-/**
- * Safe Object Utilities
- *
- * Defense-in-depth against JavaScript prototype pollution attacks.
- * These utilities prevent malicious JSON from accessing or modifying
- * the JavaScript prototype chain via keys like "__proto__", "constructor", etc.
- */
 /**
  * Check if a key is safe to use for object property access/assignment.
  * Returns true if the key is safe, false if it could cause prototype pollution.
@@ -54,7 +47,15 @@ export declare function safeHasOwn(obj: object, key: string): boolean;
  * All keys (including __proto__, constructor) are preserved as own properties —
  * the defense is null-prototype, not key filtering.
  */
-export declare function sanitizeParsedData(value: unknown): unknown;
+export interface SanitizeParsedDataLimits {
+    maxDepth?: number;
+    maxElements?: number;
+    /** Optional shared counter for aggregate accounting across documents. */
+    elementBudget?: {
+        used: number;
+    };
+}
+export declare function sanitizeParsedData(value: unknown, limits?: SanitizeParsedDataLimits): unknown;
 /**
  * Type-safe cast from unknown to Record for property access.
  * Returns null if the value is not a non-array object.

package/dist/commands/query-engine/value-operations.d.ts

@@ -24,7 +24,10 @@ export declare function compare(a: QueryValue, b: QueryValue): number;
  * Filters out dangerous keys (__proto__, constructor, prototype) to prevent prototype pollution.
  * Uses null-prototype objects to prevent prototype pollution via inherited properties.
  */
-export declare function deepMerge(a: Record<string, unknown>, b: Record<string, unknown>): Record<string, unknown>;
+export declare function deepMerge(a: Record<string, unknown>, b: Record<string, unknown>, options?: {
+    maxDepth?: number;
+    visit?: () => void;
+}): Record<string, unknown>;
 /**
  * Calculate the nesting depth of a value (array or object).
  */

package/dist/commands/readlink/readlink.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const readlinkCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const readlinkCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/registry.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../types.js";
+import type { RuntimeCommand } from "../types.js";
 /** All available built-in command names (excludes network commands) */
 export type CommandName = "echo" | "cat" | "printf" | "ls" | "mkdir" | "rmdir" | "touch" | "rm" | "cp" | "mv" | "ln" | "chmod" | "pwd" | "readlink" | "head" | "tail" | "wc" | "stat" | "grep" | "fgrep" | "egrep" | "rg" | "sed" | "awk" | "sort" | "uniq" | "comm" | "cut" | "paste" | "tr" | "rev" | "nl" | "fold" | "expand" | "unexpand" | "strings" | "split" | "column" | "join" | "tee" | "find" | "basename" | "dirname" | "tree" | "du" | "env" | "printenv" | "alias" | "unalias" | "history" | "xargs" | "true" | "false" | "clear" | "bash" | "sh" | "jq" | "base64" | "diff" | "date" | "sleep" | "timeout" | "seq" | "expr" | "md5sum" | "sha1sum" | "sha256sum" | "file" | "html-to-markdown" | "help" | "which" | "tac" | "hostname" | "od" | "gzip" | "gunzip" | "zcat" | "tar" | "yq" | "xan" | "sqlite3" | "time" | "whoami";
 /** Network command names (only available when network is configured) */
@@ -21,12 +21,12 @@ export declare function getNetworkCommandNames(): string[];
  * Creates all lazy commands for registration (excludes network commands)
  * @param filter Optional array of command names to include. If not provided, all commands are created.
  */
-export declare function createLazyCommands(filter?: CommandName[]): Command[];
+export declare function createLazyCommands(filter?: CommandName[]): RuntimeCommand[];
 /**
  * Creates network commands for registration (curl, etc.)
  * These are only registered when network is explicitly configured.
  */
-export declare function createNetworkCommands(): Command[];
+export declare function createNetworkCommands(): RuntimeCommand[];
 /**
  * Gets all python command names
  */
@@ -36,7 +36,7 @@ export declare function getPythonCommandNames(): string[];
  * These are only registered when python is explicitly enabled.
  * Note: Python introduces additional security surface (arbitrary code execution).
  */
-export declare function createPythonCommands(): Command[];
+export declare function createPythonCommands(): RuntimeCommand[];
 /**
  * Gets all javascript command names
  */
@@ -45,7 +45,7 @@ export declare function getJavaScriptCommandNames(): string[];
  * Creates javascript commands for registration (js-exec).
  * These are only registered when javascript is explicitly enabled.
  */
-export declare function createJavaScriptCommands(): Command[];
+export declare function createJavaScriptCommands(): RuntimeCommand[];
 /**
  * Clears the command cache (for testing)
  */

package/dist/commands/rev/rev.d.ts

@@ -7,7 +7,7 @@
  * of characters in every line. If no files are specified, standard
  * input is read.
  */
-import type { Command } from "../../types.js";
-export declare const rev: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const rev: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/rg/rg-search.d.ts

@@ -1,10 +1,10 @@
 /**
  * Core search logic for rg command
  */
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import type { RgOptions } from "./rg-options.js";
 export interface SearchContext {
-    ctx: CommandContext;
+    ctx: RuntimeCommandContext;
     options: RgOptions;
     paths: string[];
     explicitLineNumbers: boolean;

package/dist/commands/rg/rg.d.ts

@@ -8,7 +8,7 @@
  * - Skips binary files by default
  * - Smart case sensitivity (case-insensitive unless pattern has uppercase)
  */
-import type { Command } from "../../types.js";
-export declare const rgCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const rgCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/rm/rm.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const rmCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const rmCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/rmdir/rmdir.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const rmdirCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const rmdirCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/search-engine/matcher.d.ts

@@ -43,6 +43,12 @@ export interface SearchOptions {
      * is present. Pre-computed by buildRegex from the source pattern.
      */
     preFilter?: PreFilter | null;
+    /** Maximum synchronous matching/formatting work units. */
+    maxWork?: number;
+    /** Maximum retained match objects. */
+    maxMatches?: number;
+    /** Cooperative cancellation signal checked during long scans. */
+    signal?: AbortSignal;
 }
 export interface SearchResult {
     /** The formatted output string */

package/dist/commands/sed/lexer.d.ts

@@ -53,11 +53,13 @@ export interface SedToken {
     column: number;
 }
 export declare class SedLexer {
+    private readonly maxInputLength;
+    private readonly maxTokens;
     private input;
     private pos;
     private line;
     private column;
-    constructor(input: string);
+    constructor(input: string, maxInputLength?: number, maxTokens?: number);
     tokenize(): SedToken[];
     private makeToken;
     private peek;

package/dist/commands/sed/parser.d.ts

@@ -10,7 +10,10 @@ import type { SedCommand } from "./types.js";
  * Handles backslash continuation across -e arguments:
  * - If a script ends with \, the next script is treated as continuation
  */
-export declare function parseMultipleScripts(scripts: string[], extendedRegex?: boolean): {
+export declare function parseMultipleScripts(scripts: string[], extendedRegex?: boolean, limits?: {
+    maxStringLength: number;
+    maxArrayElements: number;
+}): {
     commands: SedCommand[];
     error?: string;
     silentMode?: boolean;

package/dist/commands/sed/sed.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const sedCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const sedCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/seq/seq.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 /**
  * seq - print a sequence of numbers
  *
@@ -11,6 +11,6 @@ import type { Command } from "../../types.js";
  *   -s STRING  use STRING to separate numbers (default: newline)
  *   -w         equalize width by padding with leading zeros
  */
-export declare const seqCommand: Command;
+export declare const seqCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/sleep/sleep.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const sleepCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const sleepCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/sort/sort.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "../../types.js";
-export declare const sortCommand: Command;
+import type { RuntimeCommand } from "../../types.js";
+export declare const sortCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
 export declare const flagsForFuzzing: CommandFuzzInfo;