@crewhaus/tool-media 0.7.0 → 0.8.1

package/dist/lib/jpeg.js

@@ -13,8 +13,10 @@
  * ## What this does not read
  *
  * MakerNotes (vendor-private, undocumented, and different per camera),
- * IFD1 thumbnails, XMP, IPTC, and EXIF carried in a TIFF or HEIC rather
- * than a JPEG. Each would be a separate parser; none is approximated.
+ * IFD1 thumbnails, and EXIF carried in a TIFF or HEIC rather than a JPEG.
+ * Each would be a separate parser; none is approximated. XMP and Photoshop
+ * resource blocks are searched for a location (see `otherMetadataOf`), not
+ * parsed, and any other APPn segment is reported as not read.
  */
 import { ByteReader, MediaFormatError, asciiAt, startsWith } from "./bytes";
 function markerName(marker) {
@@ -97,6 +99,167 @@ export function readJpegSegments(bytes) {
     }
     throw new MediaFormatError("the file ends before the start-of-scan marker");
 }
+/** More marker segments than any real JPEG has; past it the file is refused. */
+const MAX_JPEG_SEGMENTS = 65_536;
+/**
+ * Walk the WHOLE codestream: every marker segment, including those between
+ * the scans of a progressive or multi-scan file, to EOI.
+ *
+ * `readJpegSegments` stops at the first start-of-scan, which is all a header
+ * reader needs, and 0.7.0's ExifStrip copied everything after that point
+ * verbatim. But an APPn or COM segment may sit between scans, and a camera
+ * appends whole images after EOI (MPF previews, HDR gain maps, stereo pairs)
+ * and phones append motion-photo video; each can carry its own EXIF and GPS.
+ *
+ * Inside a scan, `0xFF` followed by `0x00` (stuffing), `0xD0`–`0xD7` (restart
+ * markers) or another `0xFF` (fill) belongs to the scan; any other `0xFF xx`
+ * is the next marker. The walk is linear: the scan search is a native
+ * `indexOf` from where the last one stopped.
+ *
+ * A broken header (before the first scan) is refused. Past the first scan
+ * the picture is already there, and a file cut short there — a partial
+ * download, a truncated progressive JPEG — is still a photo: the walk stops
+ * at the break and says where (`stopped`), rather than refusing a file
+ * 0.7.0 read, which only ever looked as far as the first scan.
+ */
+export function walkJpeg(bytes) {
+    if (!startsWith(bytes, [0xff, 0xd8])) {
+        throw new MediaFormatError("not a JPEG: the file does not start with FFD8 (SOI)");
+    }
+    const parts = [];
+    const segments = [];
+    const push = (segment) => {
+        if (segments.length >= MAX_JPEG_SEGMENTS) {
+            throw new MediaFormatError(`the file has more than ${MAX_JPEG_SEGMENTS} marker segments`);
+        }
+        segments.push(segment);
+        parts.push({ type: "segment", segment });
+    };
+    let pos = 2;
+    let sawScan = false;
+    // Past the first scan a framing error ends the walk; before it, the file.
+    const broken = (offset, reason) => {
+        if (!sawScan)
+            throw new MediaFormatError(reason);
+        return { parts, segments, eoiEnd: null, trailing: 0, stopped: { offset, reason } };
+    };
+    while (pos < bytes.length) {
+        const start = pos;
+        if (bytes[pos] !== 0xff) {
+            return broken(start, `expected a marker at offset ${start}, found 0x${bytes[pos].toString(16)}`);
+        }
+        pos++;
+        while (pos < bytes.length && bytes[pos] === 0xff)
+            pos++; // fill bytes
+        if (pos >= bytes.length)
+            break; // a lone trailing 0xFF: nothing follows
+        const marker = bytes[pos];
+        pos++;
+        if (marker === 0xd9) {
+            push({ marker, name: "EOI", offset: start, length: pos - start, payload: new Uint8Array(0) });
+            return { parts, segments, eoiEnd: pos, trailing: bytes.length - pos, stopped: null };
+        }
+        if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7)) {
+            push({
+                marker,
+                name: markerName(marker),
+                offset: start,
+                length: pos - start,
+                payload: new Uint8Array(0),
+            });
+            continue;
+        }
+        if (marker === 0xd8) {
+            return broken(start, `a second start-of-image marker at offset ${start}`);
+        }
+        if (pos + 2 > bytes.length) {
+            return broken(start, `segment ${markerName(marker)} at ${start} is cut off`);
+        }
+        const length = (bytes[pos] << 8) | bytes[pos + 1];
+        if (length < 2) {
+            return broken(start, `segment ${markerName(marker)} declares a length of ${length}`);
+        }
+        if (pos + length > bytes.length) {
+            return broken(start, `segment ${markerName(marker)} at ${start} runs ${pos + length - bytes.length} bytes past the end of the file`);
+        }
+        push({
+            marker,
+            name: markerName(marker),
+            offset: start,
+            length: pos + length - start,
+            payload: bytes.subarray(pos + 2, pos + length),
+        });
+        pos += length;
+        if (marker !== 0xda)
+            continue;
+        sawScan = true;
+        // Entropy-coded data, up to the next real marker.
+        const dataStart = pos;
+        for (;;) {
+            const ff = bytes.indexOf(0xff, pos);
+            if (ff === -1 || ff + 1 >= bytes.length) {
+                pos = bytes.length;
+                break;
+            }
+            const next = bytes[ff + 1];
+            if (next === 0x00 || (next >= 0xd0 && next <= 0xd7)) {
+                pos = ff + 2;
+                continue;
+            }
+            if (next === 0xff) {
+                pos = ff + 1;
+                continue;
+            }
+            pos = ff;
+            break;
+        }
+        parts.push({ type: "scan", start: dataStart, end: pos });
+    }
+    return { parts, segments, eoiEnd: null, trailing: 0, stopped: null };
+}
+/** Whether `marker` opens a segment ExifStrip treats as metadata by default (APPn, COM). */
+function isMetadataMarker(marker) {
+    return marker !== undefined && ((marker >= 0xe0 && marker <= 0xef) || marker === 0xfe);
+}
+const EXIF_SIGNATURE = [0x45, 0x78, 0x69, 0x66, 0x00, 0x00]; // "Exif\0\0"
+/** Offsets in `bytes[from, to)` where an `Exif\0\0` block starts, at most `max` of them. */
+function exifSignatures(bytes, from, to, max) {
+    const out = [];
+    for (let i = bytes.indexOf(0x45, from); i !== -1 && i + 6 <= to; i = bytes.indexOf(0x45, i + 1)) {
+        if (EXIF_SIGNATURE.every((b, k) => bytes[i + k] === b)) {
+            out.push(i);
+            if (out.length >= max)
+                break;
+        }
+    }
+    return out;
+}
+/**
+ * The first offset in `bytes` that looks like metadata — an APPn or COM
+ * marker, or an `Exif\0\0` block — or -1. For bytes a walk could not frame.
+ */
+function metadataHint(bytes) {
+    for (let i = bytes.indexOf(0xff); i !== -1 && i + 1 < bytes.length; i = bytes.indexOf(0xff, i + 1)) {
+        if (isMetadataMarker(bytes[i + 1]))
+            return i;
+    }
+    return exifSignatures(bytes, 0, bytes.length, 1)[0] ?? -1;
+}
+/** A hint at what the bytes after EOI are, for a person reading the result. */
+export function describeTrailer(trailer) {
+    if (trailer.length === 0)
+        return "nothing";
+    for (let i = trailer.indexOf(0xff); i !== -1 && i + 2 < trailer.length; i = trailer.indexOf(0xff, i + 1)) {
+        if (trailer[i + 1] === 0xd8 && trailer[i + 2] === 0xff) {
+            return "an appended JPEG (an MPF preview, a second view or an HDR gain map)";
+        }
+    }
+    for (let i = trailer.indexOf(0x66); i !== -1 && i + 3 < trailer.length; i = trailer.indexOf(0x66, i + 1)) {
+        if (asciiAt(trailer, i, "ftyp"))
+            return "an appended video (a motion photo)";
+    }
+    return "unrecognised data";
+}
 // --- EXIF ----------------------------------------------------------------
 const TYPE_SIZES = {
     1: 1,
@@ -357,24 +520,52 @@ function isMetadata(segment, options) {
     return marker >= 0xe1 && marker <= 0xef;
 }
 /**
- * A JPEG with its metadata segments dropped. The scan data is copied
- * verbatim — nothing is re-encoded, so the image is bit-for-bit the same
- * picture, just without the record of who took it and where.
+ * A JPEG with its metadata dropped: every APPn and COM segment the options
+ * do not keep, wherever it sits (before the first scan or between scans),
+ * and everything after EOI. The scans' entropy-coded bytes are copied
+ * verbatim — nothing is re-encoded, so the primary image is bit-for-bit the
+ * same picture, without the record of who took it and where.
+ *
+ * Dropping the trailer loses an appended preview, gain map or motion-photo
+ * video, and the metadata inside each. Nothing in the stripped file points
+ * at them any more: the MPF index (APP2) and the XMP (APP1) that did are
+ * metadata segments and are removed.
  */
 export function stripJpegMetadata(bytes, options = {}) {
-    const { segments, scanStart } = readJpegSegments(bytes);
+    const walk = walkJpeg(bytes);
     const kept = [new Uint8Array([0xff, 0xd8])];
     const removed = [];
-    for (const segment of segments) {
-        if (segment.marker === 0xd8)
+    for (const part of walk.parts) {
+        if (part.type === "scan") {
+            kept.push(bytes.subarray(part.start, part.end));
             continue;
+        }
+        const segment = part.segment;
         if (isMetadata(segment, options)) {
             removed.push({ name: segment.name, bytes: segment.length });
             continue;
         }
         kept.push(bytes.subarray(segment.offset, segment.offset + segment.length));
     }
-    kept.push(bytes.subarray(scanStart));
+    if (walk.stopped !== null) {
+        // The file breaks off after the first scan. What follows the break is a
+        // cut-off segment or unframed bytes: a cut metadata segment is dropped;
+        // anything else is kept as 0.7.0 kept everything after the first scan,
+        // unless it holds what may be metadata, which is refused rather than
+        // written into a file that claims to be stripped.
+        const tail = bytes.subarray(walk.stopped.offset);
+        if (tail[0] === 0xff && isMetadataMarker(tail[1])) {
+            removed.push({ name: `${markerName(tail[1])} (cut off)`, bytes: tail.length });
+        }
+        else {
+            const hint = metadataHint(tail);
+            if (hint !== -1) {
+                throw new MediaFormatError(`the file breaks off at offset ${walk.stopped.offset} (${walk.stopped.reason}), and the part after it that could not be walked holds what may be metadata at offset ${walk.stopped.offset + hint}; nothing was written — re-export the file and strip that`);
+            }
+            kept.push(tail);
+        }
+    }
+    const trailerStart = walk.eoiEnd ?? bytes.length;
     let total = 0;
     for (const part of kept)
         total += part.length;
@@ -384,5 +575,331 @@ export function stripJpegMetadata(bytes, options = {}) {
         out.set(part, at);
         at += part.length;
     }
-    return { bytes: out, removed, bytesRemoved: bytes.length - out.length };
+    const trailing = bytes.length - trailerStart;
+    return {
+        bytes: out,
+        removed,
+        bytesRemoved: bytes.length - out.length,
+        trailingBytesRemoved: trailing,
+        ...(trailing > 0 ? { trailingKind: describeTrailer(bytes.subarray(trailerStart)) } : {}),
+        eoiMissing: walk.eoiEnd === null,
+        ...(walk.stopped === null ? {} : { breaksOffAt: walk.stopped }),
+    };
+}
+/** How many appended images one call walks. */
+const MAX_EMBEDDED_IMAGES = 16;
+/** How many EXIF blocks found in unwalked bytes one call parses. */
+const MAX_LOOSE_EXIF_BLOCKS = 16;
+function exifBlocksOf(walk, base, where) {
+    const out = [];
+    let sawScan = false;
+    for (const part of walk.parts) {
+        if (part.type === "scan") {
+            sawScan = true;
+            continue;
+        }
+        const s = part.segment;
+        if (s.marker !== 0xe1 || !asciiAt(s.payload, 0, "Exif"))
+            continue;
+        let exif = null;
+        let unreadable;
+        try {
+            exif = parseExif(s.payload);
+        }
+        catch (err) {
+            unreadable = err.message;
+        }
+        out.push({
+            where: where(sawScan),
+            offset: base + s.offset,
+            exif,
+            ...(unreadable === undefined ? {} : { unreadable }),
+        });
+    }
+    return out;
+}
+const XMP_ID = "http://ns.adobe.com/xap/1.0/\0";
+const XMP_EXTENSION_ID = "http://ns.adobe.com/xmp/extension/\0";
+/** Extended XMP: the identifier, a 32-byte GUID, the full length and this chunk's offset. */
+const XMP_EXTENSION_HEADER = XMP_EXTENSION_ID.length + 32 + 4 + 4;
+/**
+ * Does an XMP packet name a location? The GPS properties are
+ * `exif:GPSLatitude` and `exif:GPSLongitude`, written as attributes or
+ * elements under whatever prefix the packet binds (IPTC's LocationCreated
+ * nests the same two; DJI writes `drone-dji:GpsLatitude`), so the property
+ * names are searched for, ignoring case. A packet that has either is taken
+ * to carry a location: for a file about to be published, a false "yes" costs
+ * a strip, and a false "no" publishes where it was taken.
+ */
+function xmpNamesLocation(bytes) {
+    let text = "";
+    // Latin-1 keeps one character per byte, and the property names are ASCII.
+    for (let i = 0; i < bytes.length; i += 8192) {
+        text += String.fromCharCode(...bytes.subarray(i, i + 8192));
+    }
+    const lower = text.toLowerCase();
+    return lower.includes("gpslatitude") || lower.includes("gpslongitude");
+}
+/**
+ * Walk a Photoshop Image Resource Block (APP13 `Photoshop 3.0`) and say
+ * whether it names a location: the EXIF (0x0422, 0x0423) and XMP (0x0424)
+ * resources Photoshop can keep there are read like their APP1 twins; the
+ * IPTC-IIM record (0x0404) has place names but no coordinates. A block that
+ * does not walk is not read.
+ */
+function photoshopNamesLocation(payload) {
+    const header = "Photoshop 3.0\0";
+    let at = header.length;
+    let unread = false;
+    while (at + 12 <= payload.length) {
+        if (!asciiAt(payload, at, "8BIM"))
+            return null;
+        const id = (payload[at + 4] << 8) | payload[at + 5];
+        const nameLength = payload[at + 6];
+        // The Pascal-string name, its length byte included, is padded to even.
+        const nameEnd = at + 6 + ((nameLength + 2) & ~1);
+        if (nameEnd + 4 > payload.length)
+            return null;
+        const size = ((payload[nameEnd] << 24) >>> 0) +
+            (payload[nameEnd + 1] << 16) +
+            (payload[nameEnd + 2] << 8) +
+            payload[nameEnd + 3];
+        const dataStart = nameEnd + 4;
+        if (dataStart + size > payload.length)
+            return null;
+        const data = payload.subarray(dataStart, dataStart + size);
+        if (id === 0x0424 && xmpNamesLocation(data))
+            return true;
+        if (id === 0x0422 || id === 0x0423) {
+            const framed = new Uint8Array(6 + data.length);
+            framed.set([0x45, 0x78, 0x69, 0x66, 0, 0]);
+            framed.set(data, 6);
+            try {
+                if (parseExif(framed).hasGps)
+                    return true;
+            }
+            catch {
+                unread = true;
+            }
+        }
+        at = dataStart + size + (size & 1);
+    }
+    return unread ? null : false;
+}
+/** The first bytes of an identifier, for naming a segment this does not read. */
+function identifierOf(payload) {
+    let id = "";
+    for (let i = 0; i < Math.min(payload.length, 24); i++) {
+        const b = payload[i];
+        if (b === 0)
+            break;
+        if (b < 0x20 || b > 0x7e)
+            return id;
+        id += String.fromCharCode(b);
+    }
+    return id;
+}
+/**
+ * The APPn segments of one walk other than EXIF, each with whether it names
+ * a location. XMP split across Extended XMP chunks is put back together
+ * (per GUID, by offset) before it is searched, so a property cut in two by a
+ * chunk boundary is still seen.
+ */
+function otherMetadataOf(walk, base, where) {
+    const out = [];
+    const extended = new Map();
+    let sawScan = false;
+    for (const part of walk.parts) {
+        if (part.type === "scan") {
+            sawScan = true;
+            continue;
+        }
+        const s = part.segment;
+        if (s.marker < 0xe0 || s.marker > 0xef)
+            continue;
+        const p = s.payload;
+        const at = { where: where(sawScan), offset: base + s.offset };
+        if (s.marker === 0xe1 && asciiAt(p, 0, "Exif"))
+            continue; // parsed as EXIF
+        if (s.marker === 0xe1 && asciiAt(p, 0, XMP_ID)) {
+            out.push({ segment: "APP1 XMP", ...at, location: xmpNamesLocation(p) });
+            continue;
+        }
+        if (s.marker === 0xe1 && asciiAt(p, 0, XMP_EXTENSION_ID)) {
+            if (p.length < XMP_EXTENSION_HEADER) {
+                out.push({ segment: "APP1 extended XMP", ...at, location: null });
+                continue;
+            }
+            const guid = String.fromCharCode(...p.subarray(XMP_EXTENSION_ID.length, XMP_EXTENSION_ID.length + 32));
+            const o = XMP_EXTENSION_ID.length + 36;
+            const chunkOffset = ((p[o] << 24) >>> 0) +
+                (p[o + 1] << 16) +
+                (p[o + 2] << 8) +
+                p[o + 3];
+            const entry = extended.get(guid) ?? { ...at, chunks: [] };
+            entry.chunks.push([chunkOffset, p.subarray(XMP_EXTENSION_HEADER)]);
+            extended.set(guid, entry);
+            continue;
+        }
+        let location = null;
+        let segment = `${s.name} ${identifierOf(p)}`.trim();
+        if (s.marker === 0xe0 && asciiAt(p, 0, "JFIF\0"))
+            location = false;
+        // JFXX carries a thumbnail; one coded as a JPEG (0x10) could carry EXIF.
+        else if (s.marker === 0xe0 && asciiAt(p, 0, "JFXX\0"))
+            location = p[5] === 0x10 ? null : false;
+        else if (s.marker === 0xe2 && asciiAt(p, 0, "ICC_PROFILE\0"))
+            location = false;
+        // MPF indexes the appended images, which are walked for themselves.
+        else if (s.marker === 0xe2 && asciiAt(p, 0, "MPF\0"))
+            location = false;
+        else if (s.marker === 0xec && asciiAt(p, 0, "Ducky"))
+            location = false;
+        else if (s.marker === 0xee && asciiAt(p, 0, "Adobe"))
+            location = false;
+        else if (s.marker === 0xed && asciiAt(p, 0, "Photoshop 3.0\0")) {
+            segment = "APP13 Photoshop";
+            location = photoshopNamesLocation(p);
+        }
+        out.push({ segment, ...at, location });
+    }
+    for (const entry of extended.values()) {
+        entry.chunks.sort((a, b) => a[0] - b[0]);
+        let total = 0;
+        for (const [, chunk] of entry.chunks)
+            total += chunk.length;
+        const joined = new Uint8Array(total);
+        let at = 0;
+        for (const [, chunk] of entry.chunks) {
+            joined.set(chunk, at);
+            at += chunk.length;
+        }
+        out.push({
+            segment: "APP1 extended XMP",
+            where: entry.where,
+            offset: entry.offset,
+            location: xmpNamesLocation(joined),
+        });
+    }
+    return out;
+}
+/**
+ * Every place in a JPEG that can carry metadata: EXIF before and between
+ * scans, other APPn/COM segments, and the JPEGs appended after EOI (walked
+ * once each, not their own trailers again). Bytes no walk accounts for —
+ * after a break, a video, unrecognised data, an appended image that would
+ * not walk — are counted and searched for EXIF blocks, which are parsed
+ * where found. What this reports is what ExifRead answers from, so it
+ * cannot call a file clean on the strength of bytes it never read.
+ */
+export function inspectJpegMetadata(bytes) {
+    const walk = walkJpeg(bytes);
+    const mainWhere = (sawScan) => sawScan ? "between scans" : "before the first scan";
+    const exifBlocks = exifBlocksOf(walk, 0, mainWhere);
+    const otherMetadata = otherMetadataOf(walk, 0, mainWhere);
+    const interScan = [];
+    const before = [];
+    let sawScan = false;
+    for (const part of walk.parts) {
+        if (part.type === "scan") {
+            sawScan = true;
+            continue;
+        }
+        const m = part.segment.marker;
+        if ((m >= 0xe0 && m <= 0xef) || m === 0xfe) {
+            (sawScan ? interScan : before).push(part.segment.name);
+        }
+    }
+    let embeddedImages = 0;
+    let attempts = 0;
+    let notInspected = 0;
+    // Everything from here to the end is outside the main image's walk.
+    const outsideFrom = walk.eoiEnd ?? walk.stopped?.offset ?? bytes.length;
+    // Ranges an appended image's walk accounts for, in order.
+    const covered = [];
+    if (walk.eoiEnd !== null && walk.trailing > 0) {
+        // Each appended JPEG is walked from its SOI; a candidate inside one
+        // already walked (its thumbnail, say) is skipped rather than walked
+        // again. Every attempt counts against the cap, a failed one too, so a
+        // trailer of false starts cannot make this quadratic.
+        let coveredTo = outsideFrom;
+        for (let i = bytes.indexOf(0xff, outsideFrom); i !== -1 && i + 2 < bytes.length; i = bytes.indexOf(0xff, i + 1)) {
+            if (bytes[i + 1] !== 0xd8 || bytes[i + 2] !== 0xff || i < coveredTo)
+                continue;
+            if (attempts >= MAX_EMBEDDED_IMAGES) {
+                notInspected++;
+                continue;
+            }
+            attempts++;
+            try {
+                const inner = walkJpeg(bytes.subarray(i));
+                embeddedImages++;
+                exifBlocks.push(...exifBlocksOf(inner, i, () => "in an appended image"));
+                otherMetadata.push(...otherMetadataOf(inner, i, () => "in an appended image"));
+                const end = i + (inner.eoiEnd ?? inner.stopped?.offset ?? bytes.length - i);
+                covered.push([i, end]);
+                coveredTo = end;
+            }
+            catch {
+                // Not a walkable JPEG after all (FF D8 FF inside other data, or an
+                // image whose header is broken): its bytes stay unaccounted for.
+            }
+        }
+    }
+    // The rest: counted, and searched for EXIF blocks, unless it is padding.
+    let unaccounted = 0;
+    let signatures = 0;
+    let parsedLoose = 0;
+    let at = outsideFrom;
+    for (const [from, to] of [...covered, [bytes.length, bytes.length]]) {
+        if (from > at) {
+            let padding = true;
+            for (let k = at; k < from; k++) {
+                const b = bytes[k];
+                if (b !== 0x00 && b !== 0xff) {
+                    padding = false;
+                    break;
+                }
+            }
+            if (!padding) {
+                unaccounted += from - at;
+                for (const offset of exifSignatures(bytes, at, from, Number.POSITIVE_INFINITY)) {
+                    signatures++;
+                    if (parsedLoose >= MAX_LOOSE_EXIF_BLOCKS)
+                        continue;
+                    parsedLoose++;
+                    let exif = null;
+                    let unreadable;
+                    try {
+                        exif = parseExif(bytes.subarray(offset, from));
+                    }
+                    catch (err) {
+                        unreadable = err.message;
+                    }
+                    exifBlocks.push({
+                        where: "in bytes no walk accounts for",
+                        offset,
+                        exif,
+                        ...(unreadable === undefined ? {} : { unreadable }),
+                    });
+                }
+            }
+        }
+        at = Math.max(at, to);
+    }
+    const trailerStart = walk.eoiEnd ?? bytes.length;
+    return {
+        exifBlocks,
+        interScanMetadataSegments: interScan,
+        metadataSegments: before.filter((n) => n !== "COM").sort(),
+        trailingBytes: walk.trailing,
+        ...(walk.trailing > 0 ? { trailingKind: describeTrailer(bytes.subarray(trailerStart)) } : {}),
+        embeddedImages,
+        embeddedImagesNotInspected: notInspected,
+        eoiMissing: walk.eoiEnd === null,
+        ...(walk.stopped === null ? {} : { breaksOffAt: walk.stopped }),
+        unaccountedBytes: unaccounted,
+        exifSignaturesNotParsed: signatures - parsedLoose,
+        otherMetadata,
+    };
 }

package/dist/lib/subtitle.d.ts

@@ -20,6 +20,19 @@ export type ParseResult = {
         reason: string;
     }>;
 };
+/**
+ * A timing line's two sides: the text before its first `-->`, and the text
+ * after it. Null when the line has no `-->`, or holds a line break: `\r\n`
+ * folding leaves U+2028 and U+2029 inside a line.
+ *
+ * This is what `/^(.*?)-->(.*?)$/` captured, read with one search for the
+ * arrow and one for a break. That pattern's lazy start tried every `-->` on
+ * the line and ran from each to the break that `$` cannot pass: quadratic in
+ * a line of arrows. No pattern here repeats a group either, because
+ * JavaScriptCore silently stops matching one that repeats a group a million
+ * times or so, and a line can be as long as the file.
+ */
+export declare function timingParts(line: string): readonly [start: string, rest: string] | null;
 /** `HH:MM:SS,mmm`, `MM:SS.mmm` and the other legal spellings, to millis. */
 export declare function parseTimestamp(text: string): number;
 /** Milliseconds to `HH:MM:SS,mmm` (SRT) or `HH:MM:SS.mmm` (WebVTT). */

package/dist/lib/subtitle.js

@@ -22,7 +22,26 @@
  * shift is an input, never "now minus something".
  */
 import { MediaFormatError } from "./bytes";
-const TIMING = /^(.*?)-->(.*?)$/;
+/** The line breaks a regular expression's `.` does not take. */
+const LINE_BREAK = /[\n\r\u2028\u2029]/;
+/**
+ * A timing line's two sides: the text before its first `-->`, and the text
+ * after it. Null when the line has no `-->`, or holds a line break: `\r\n`
+ * folding leaves U+2028 and U+2029 inside a line.
+ *
+ * This is what `/^(.*?)-->(.*?)$/` captured, read with one search for the
+ * arrow and one for a break. That pattern's lazy start tried every `-->` on
+ * the line and ran from each to the break that `$` cannot pass: quadratic in
+ * a line of arrows. No pattern here repeats a group either, because
+ * JavaScriptCore silently stops matching one that repeats a group a million
+ * times or so, and a line can be as long as the file.
+ */
+export function timingParts(line) {
+    const arrow = line.indexOf("-->");
+    if (arrow === -1 || LINE_BREAK.test(line))
+        return null;
+    return [line.slice(0, arrow), line.slice(arrow + 3)];
+}
 const TIMESTAMP = /^(?:(\d+):)?(\d{1,2}):(\d{1,2})[.,](\d{1,3})$/;
 /** `HH:MM:SS,mmm`, `MM:SS.mmm` and the other legal spellings, to millis. */
 export function parseTimestamp(text) {
@@ -76,17 +95,18 @@ export function parseSubtitles(input, format) {
         }
         let at = 0;
         let id;
-        if (!TIMING.test(first)) {
+        let timing = timingParts(first);
+        if (timing === null) {
             id = first.trim();
             at = 1;
+            const next = lines[1];
+            timing = next === undefined ? null : timingParts(next);
         }
-        const timingLine = lines[at];
-        if (timingLine === undefined || !TIMING.test(timingLine)) {
+        if (timing === null) {
             skipped.push({ block: b, reason: "no timing line" });
             continue;
         }
-        const match = TIMING.exec(timingLine);
-        const rightSide = match[2].trim();
+        const rightSide = timing[1].trim();
         // Cue settings follow the end timestamp, separated by whitespace.
         const spaceAt = rightSide.search(/\s/);
         const endText = spaceAt === -1 ? rightSide : rightSide.slice(0, spaceAt);
@@ -94,7 +114,7 @@ export function parseSubtitles(input, format) {
         let startMs;
         let endMs;
         try {
-            startMs = parseTimestamp(match[1]);
+            startMs = parseTimestamp(timing[0]);
             endMs = parseTimestamp(endText);
         }
         catch (err) {

package/dist/paths.d.ts

@@ -1,10 +1,29 @@
 import { CrewhausError } from "@crewhaus/errors";
-/** Raised when a caller-supplied path resolves outside the workspace root. */
+/**
+ * The longest path this resolves, in UTF-16 code units; a longer one is
+ * refused before it is walked. Nothing that long can be opened or created:
+ * PATH_MAX is 1,024 bytes on macOS and 4,096 on Linux, Windows stops at
+ * 32,767 UTF-16 units, and a path's UTF-8 form is never shorter than its
+ * UTF-16 one. The limit is twice that because the part of a path that exists
+ * is itself under PATH_MAX, so the part that does not is over PATH_MAX on its
+ * own: no spelling of the place reaches it, not even one through a symlink
+ * that shortens the part that exists.
+ */
+export declare const MAX_PATH_CHARS: number;
+/**
+ * Raised when a caller-supplied path resolves outside the workspace root, or
+ * is longer than any path can be.
+ */
 export declare class ToolPermissionError extends CrewhausError {
     readonly name = "ToolPermissionError";
     readonly toolName: string;
     readonly path: string;
-    constructor(toolName: string, attemptedPath: string);
+    /**
+     * Why, when it is not that the location escapes the workspace root: a path
+     * longer than any path can be. A caller that rewords the refusal says this.
+     */
+    readonly reason: string | undefined;
+    constructor(toolName: string, attemptedPath: string, reason?: string);
 }
 /**
  * A validated path, in both forms the tools need.