@jigging/jig 0.1.0-alpha.20 → 0.1.0-alpha.22

package/libexec/authoring/node_modules/string-width/index.js

@@ -15,11 +15,9 @@ Logic:
 
 const segmenter = new Intl.Segmenter();
 
-// Whole-cluster zero-width
-const zeroWidthClusterRegex = /^(?:\p{Default_Ignorable_Code_Point}|\p{Control}|\p{Format}|\p{Nonspacing_Mark}|\p{Enclosing_Mark}|\p{Surrogate})+$/v;
-
-// Pick the base scalar if the cluster starts with Prepend/Format/Marks
-const leadingNonPrintingRegex = /^[\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Nonspacing_Mark}\p{Enclosing_Mark}\p{Surrogate}]+/v;
+// Matches a visible (printing) character. Used to find the base scalar of a cluster (skipping leading Prepend/Format/Marks) and to detect whole-cluster zero-width.
+// Intentionally a single negated class without a quantifier: a repeated pattern like `^(?:…|…)+$` backtracks exponentially on overlapping properties, and even `^[…]+$` overflows V8's backtrack stack (RangeError) on clusters with millions of marks.
+const visibleCharacterRegex = /[^\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Nonspacing_Mark}\p{Enclosing_Mark}\p{Surrogate}]/v;
 const spacingMarkRegex = /\p{Spacing_Mark}/v;
 
 // RGI emoji sequences
@@ -48,12 +46,10 @@ function isDoubleWidthNonRgiEmojiSequence(segment) {
 	return false;
 }
 
+// Returns the cluster starting at its first visible character, or `undefined` if the whole cluster is zero-width.
 function baseVisible(segment) {
-	return segment.replace(leadingNonPrintingRegex, '');
-}
-
-function isZeroWidthCluster(segment) {
-	return zeroWidthClusterRegex.test(segment);
+	const index = segment.search(visibleCharacterRegex);
+	return index === -1 ? undefined : segment.slice(index);
 }
 
 function isHangulLeadingJamo(codePoint) {
@@ -81,7 +77,7 @@ function hangulClusterWidth(visibleSegment, eastAsianWidthOptions) {
 	const codePoints = [];
 
 	for (const character of visibleSegment) {
-		if (zeroWidthClusterRegex.test(character)) {
+		if (!visibleCharacterRegex.test(character)) {
 			continue;
 		}
 
@@ -178,7 +174,8 @@ export default function stringWidth(input, options = {}) {
 
 	for (const {segment} of segmenter.segment(string)) {
 		// Zero-width / non-printing clusters
-		if (isZeroWidthCluster(segment)) {
+		const visibleSegment = baseVisible(segment);
+		if (visibleSegment === undefined) {
 			continue;
 		}
 
@@ -188,7 +185,6 @@ export default function stringWidth(input, options = {}) {
 			continue;
 		}
 
-		const visibleSegment = baseVisible(segment);
 		const hangulWidth = hangulClusterWidth(visibleSegment, eastAsianWidthOptions);
 		if (hangulWidth !== undefined) {
 			width += hangulWidth;

package/libexec/authoring/node_modules/string-width/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "string-width",
-	"version": "8.2.2",
+	"version": "8.3.0",
 	"description": "Get the visual width of a string - the number of columns required to display it",
 	"license": "MIT",
 	"repository": "sindresorhus/string-width",

package/libexec/authoring/node_modules/vscode-languageserver-textdocument/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "vscode-languageserver-textdocument",
 	"description": "A simple text document implementation for Node LSP servers",
-	"version": "1.0.14",
+	"version": "1.0.15",
 	"author": "Microsoft Corporation",
 	"license": "MIT",
 	"repository": {
@@ -23,7 +23,7 @@
 		}
 	},
 	"scripts": {
-		"prepublishOnly": "echo \"⛔ Can only publish from a secure pipeline ⛔\" && node ../build/npm/fail",
+		"prepublishOnly": "npm run all:publish",
 		"prepack": "npm run all:publish",
 		"compile": "tsc -b ./tsconfig.json",
 		"clean": "rimraf lib",

package/libexec/installed-cli.js

@@ -7510,7 +7510,7 @@ import { setTimeout as delay } from "timers/promises";
 // package.json
 var package_default = {
   name: "@jigging/jig",
-  version: "0.1.0-alpha.20",
+  version: "0.1.0-alpha.22",
   description: "A local, secure host for admitted FLOW packages",
   license: "SEE LICENSE IN LICENSE.md",
   repository: {
@@ -13035,6 +13035,7 @@ var PRIVATE_FILE_LIMITS = Object.freeze({
 });
 var NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var CLOSED_SEALS = 15;
+var F_DUPFD_CLOEXEC = 1030;
 var O_PATH = 2097152;
 var O_CLOEXEC = 524288;
 var O_DIRECTORY = 65536;
@@ -13330,6 +13331,11 @@ function privateVerifySealedFile(fd, bytes, digest) {
   if (!info.isFile() || info.nlink !== 0 || info.size !== bytes || (result(calls().symbols.fcntl(fd, 1034, 0)) & CLOSED_SEALS) !== CLOSED_SEALS || sha256(readFileSync(`/proc/self/fd/${fd}`)) !== digest)
     throw new TypeError("captured input descriptor changed");
 }
+function privateDuplicateInputForStdio(fd, minimum) {
+  if (!Number.isSafeInteger(fd) || fd < 0 || !Number.isSafeInteger(minimum) || minimum < 6)
+    throw new TypeError("invalid captured input descriptor handoff");
+  return result(calls().symbols.fcntl(fd, F_DUPFD_CLOEXEC, minimum));
+}
 function sha256(bytes) {
   return `sha256:${createHash4("sha256").update(bytes).digest("hex")}`;
 }
@@ -17798,7 +17804,7 @@ function directoryEntryName2(entry) {
 }
 
 // src/internal/bound-attachments.ts
-import { closeSync as closeSync2, fstatSync as fstatSync2, readFileSync as readFileSync2 } from "fs";
+import { closeSync as closeSync3, fstatSync as fstatSync2, readFileSync as readFileSync2 } from "fs";
 
 // src/internal/package-artifact-store.ts
 import { createHash as createHash6, randomUUID } from "crypto";
@@ -18472,6 +18478,7 @@ async function privateFileDigest(path) {
 // src/internal/linux-rootless-backend.ts
 import { spawn } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
+import { closeSync as closeSync2 } from "fs";
 import {
   link as link3,
   lstat as lstat6,
@@ -19174,28 +19181,29 @@ class PrivateLinuxCgroupBackend {
     try {
       await listen(server, controlPath);
       const accepted = acceptOne(server, this.#options.startupTimeoutMs);
-      supervisor = requirePipedChild(spawn(data.mechanism.support.trustedCoordinatorBunPath, [
-        ...BUN_POLICY,
-        data.mechanism.support.trustedSupervisorPath,
-        "--supervisor",
-        controlPath,
-        String(this.#options.startupTimeoutMs)
-      ], {
-        cwd: "/",
-        env: {
-          LD_LIBRARY_PATH: data.mechanism.support.trustedCoordinatorLibraryPath
-        },
-        detached: true,
-        stdio: [
-          "pipe",
-          "pipe",
-          "pipe",
-          "ignore",
-          "ignore",
-          "ignore",
-          ...data.sealedPlan.capturedInputs.map((file) => file.fd)
-        ]
-      }));
+      const inputFds = [];
+      try {
+        const minimum = 6 + data.sealedPlan.capturedInputs.length;
+        for (const file of data.sealedPlan.capturedInputs)
+          inputFds.push(privateDuplicateInputForStdio(file.fd, minimum));
+        supervisor = requirePipedChild(spawn(data.mechanism.support.trustedCoordinatorBunPath, [
+          ...BUN_POLICY,
+          data.mechanism.support.trustedSupervisorPath,
+          "--supervisor",
+          controlPath,
+          String(this.#options.startupTimeoutMs)
+        ], {
+          cwd: "/",
+          env: {
+            LD_LIBRARY_PATH: data.mechanism.support.trustedCoordinatorLibraryPath
+          },
+          detached: true,
+          stdio: ["pipe", "pipe", "pipe", "ignore", "ignore", "ignore", ...inputFds]
+        }));
+      } finally {
+        for (const fd of inputFds)
+          closeSync2(fd);
+      }
       const closed = childClose(supervisor);
       control = await Promise.race([
         accepted,
@@ -20911,7 +20919,7 @@ async function captureBoundAttachments(root, selections, storeRoot) {
     return invalid("PROJECT_BINDING_ATTACHMENTS_INVALID", error instanceof PrivateFileInputError ? error.message : "cannot capture the selected Binding files; use stable, bounded project directories without links or protected state");
   } finally {
     if (parent !== undefined)
-      closeSync2(parent);
+      closeSync3(parent);
   }
 }
 async function verifyBoundAttachment(captured, expected) {
@@ -20928,7 +20936,7 @@ async function openBoundAttachments(storeRoot, value = {}) {
   const opened = [];
   const close = () => {
     for (const fd of opened.splice(0))
-      closeSync2(fd);
+      closeSync3(fd);
   };
   try {
     for (const [name, item2] of Object.entries(bindings)) {
@@ -33519,12 +33527,12 @@ class PrivateCliOutput {
 // src/internal/file-command.ts
 import { spawn as spawn2 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { closeSync as closeSync4, fstatSync as fstatSync4 } from "fs";
+import { closeSync as closeSync5, fstatSync as fstatSync4 } from "fs";
 import { connect, createServer as createServer2 } from "net";
 
 // src/internal/file-delivery.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { closeSync as closeSync3, fstatSync as fstatSync3, lstatSync, mkdirSync, opendirSync as opendirSync2 } from "fs";
+import { closeSync as closeSync4, fstatSync as fstatSync3, lstatSync, mkdirSync, opendirSync as opendirSync2 } from "fs";
 import { mkdir as mkdir7, open as open12, rm as rm3, statfs as statfs3 } from "fs/promises";
 import { basename as basename5, dirname as dirname11, resolve as resolve10 } from "path";
 class PrivateFileDeliveryOwner {
@@ -33574,7 +33582,7 @@ class PrivateFileDeliveryOwner {
       this.#destination = destination;
     } finally {
       if (parent !== undefined)
-        closeSync3(parent);
+        closeSync4(parent);
       this.#preparing = false;
     }
   }
@@ -33635,7 +33643,7 @@ class PrivateFileDeliveryOwner {
           } finally {
             directory.closeSync();
             if (fd !== output.fd)
-              closeSync3(fd);
+              closeSync4(fd);
           }
         };
         walk("");
@@ -33712,7 +33720,7 @@ class PrivateFileDeliveryOwner {
   async close() {
     await this.#cleanupStage();
     if (this.#parent !== undefined) {
-      closeSync3(this.#parent);
+      closeSync4(this.#parent);
       this.#parent = undefined;
     }
   }
@@ -33723,7 +33731,7 @@ class PrivateFileDeliveryOwner {
       if (before.dev !== after.dev || before.ino !== after.ino)
         throw new Error("destination parent changed");
     } finally {
-      closeSync3(current2);
+      closeSync4(current2);
     }
   }
   async#cleanupStage() {
@@ -33757,14 +33765,14 @@ function directoryContains(root, candidate) {
         return true;
       const next2 = privateOpenAt(current2, "..", 2097152 | 65536, false);
       const parent = fstatSync3(next2, { bigint: true });
-      closeSync3(current2);
+      closeSync4(current2);
       current2 = next2;
       if (parent.dev === info.dev && parent.ino === info.ino)
         return false;
     }
     throw new Error("output ancestry exceeds limit");
   } finally {
-    closeSync3(current2);
+    closeSync4(current2);
   }
 }
 
@@ -33958,7 +33966,7 @@ async function privateOwnFileCommand(command, arguments_, signal, lifetimeMs, on
     await task;
     checkpoints?.close();
     if (projectFd !== undefined)
-      closeSync4(projectFd);
+      closeSync5(projectFd);
     try {
       await owner.close();
     } catch {
@@ -39996,7 +40004,7 @@ function fail2(message) {
 }
 
 // src/internal/codex-session-state.ts
-import { closeSync as closeSync5, opendirSync as opendirSync3 } from "fs";
+import { closeSync as closeSync6, opendirSync as opendirSync3 } from "fs";
 var PRIVATE_CODEX_SESSION_BYTES = 8 * 1024 * 1024;
 var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![\s\S])/;
 var PATH = /^sessions\/\d{4}\/\d{2}\/\d{2}\/rollout-[0-9T-]+-([0-9a-f-]{36})\.jsonl(?![\s\S])/;
@@ -40169,7 +40177,7 @@ function collectPrivateCodexSession(output, nativeId, secrets2) {
         directory2?.closeSync();
       } finally {
         if (fd !== output.fd)
-          closeSync5(fd);
+          closeSync6(fd);
       }
     }
   };
@@ -41542,7 +41550,7 @@ function failed(code2, message, details) {
 }
 
 // src/internal/root-contained-effect-controller.ts
-import { closeSync as closeSync6 } from "fs";
+import { closeSync as closeSync7 } from "fs";
 var KIND = "private-contained-effect-owner/1";
 var ROOT = "/jig-input/project";
 async function executePrivateContainedEffect(input) {
@@ -41726,7 +41734,7 @@ async function executePrivateContainedEffect(input) {
     return failed2(attempted ? "UNCERTAIN" : "EXECUTION_FAILED", attempted ? "operation dispatch may have occurred but no result was proved" : "contained operation setup failed before dispatch");
   } finally {
     for (const file of files)
-      closeSync6(file.fd);
+      closeSync7(file.fd);
   }
 }
 function privateContainedDeadlineLimit(kind, rootDeadlineUnixMs, parentDeadlineUnixMs, ownDeadlineUnixMs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jigging/jig",
-  "version": "0.1.0-alpha.20",
+  "version": "0.1.0-alpha.22",
   "description": "A local, secure host for admitted FLOW packages",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {