@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/media-cli/resources.js

@@ -1,187 +0,0 @@
-import { byteText, textBytes, token } from "./bytes.js";
-import { classify } from "./resolution-path.js";
-import { filterInputMetadata, filterOutputMetadata, filterResourceAliases, filterResourceDefaults } from './options.generated.js';
-export function resource(index, value, role, access, stage, literal = role === 'preset', syntax = role === 'option-file' ? 'avio' : 'stdio') {
-    if (!(value instanceof Uint8Array))
-        throw new TypeError('Resource classification requires original bytes');
-    // Classify the same owned bytes that discovery returns. Producer metadata
-    // must not disguise a native URL as a filesystem dependency.
-    value = new Uint8Array(value);
-    const name = byteText(value);
-    // AVIO opens '-' in the file namespace; only specific callers rewrite it.
-    literal ||= syntax === 'avio' && name === '-';
-    const classification = classify(value);
-    const kind = literal ? 'path' : classification === "descriptor" ? "descriptor"
-        : classification === "url" ? "url"
-            : classification === 'file-protocol' ? 'file-protocol'
-                : name.includes("%") || name.includes("*") ? "pattern" : "path";
-    return { index, value, role, access, stage, kind, base: "cwd",
-        ...(literal ? { literal: true } : {}) };
-}
-// Positional fields and aliases come from the individual registered filter tables.
-const filterFiles = {
-    movie: ["filename"], amovie: ["filename"],
-    lut1d: ["file"], lut3d: ["file"], haldclut: [], drawtext: ["fontfile", "text", "textfile"],
-    sendcmd: [], asendcmd: [], convolution: [], afir: [],
-};
-const filterKeys = {
-    movie: ["filename"], amovie: ["filename"],
-    lut1d: ["file"], lut3d: ["file"], drawtext: ["fontfile", "textfile", "font"],
-    sendcmd: ["filename", "f"], asendcmd: ["filename", "f"],
-};
-/** Apply a selected AVOption value directly. Loaded buffers are not graph syntax. */
-export function filterValueResource(filter, field, value) {
-    const output = Object.hasOwn(filterOutputMetadata, filter) ? filterOutputMetadata[filter] : undefined;
-    const input = Object.hasOwn(filterInputMetadata, filter) ? filterInputMetadata[filter] : undefined;
-    if (field.startsWith('/'))
-        return { value, literal: byteText(value) === '-', filterReader: { filter, name: field.slice(1) } };
-    // Child DNN options select backend-specific readers: TensorFlow uses AVIO,
-    // other libraries own filename reads and can load companion model files.
-    // Keep this obligation unresolved rather than guessing a transfer namespace.
-    if (input?.lookups?.includes(field))
-        return { value, literal: false, kind: 'resource-lookup' };
-    if (output?.keys.includes(field)) {
-        if (output.generated && value.length === 0)
-            return;
-        return { value, access: 'write', literal: output.literal && (!output.stdout || byteText(value) !== '-'),
-            ...(output.generated ? { kind: 'resource-lookup' } : {}) };
-    }
-    if (input && Object.hasOwn(input.keys, field))
-        return { value, literal: input.keys[field] || byteText(value) === '-' };
-    if (Object.hasOwn(filterKeys, filter) && filterKeys[filter].includes(field))
-        return { value, ...(filter === 'drawtext' && field === 'font' ? { kind: 'resource-lookup' } : {}), literal: field !== 'font' && (byteText(value) === '-' || field !== 'filename' || !['movie', 'amovie', 'subtitles'].includes(filter)) };
-}
-export function filterResources(value) {
-    // Native filter graph and AVOption parsers read C strings, even when the
-    // observed script/option-file buffer contains additional bytes after NUL.
-    const end = value.indexOf(0);
-    const graph = byteText(end < 0 ? value : value.subarray(0, end));
-    const found = [];
-    // fftools/ffmpeg_filter.c graph_opts_apply loads slash values for every
-    // filter before graphparser.c segment_init initializes any resource reader.
-    // Keep those evaluation phases separate, retaining order within each phase.
-    const loaded = [];
-    let i = 0;
-    const labels = () => {
-        while (graph[i] === "[") {
-            // graphparser.c parse_link_name uses av_get_token, including its own
-            // quoting layer. A protected ']' is label data, not the closing delimiter.
-            const label = token(graph, i + 1, "]");
-            if (!label.value || graph[label.end] !== "]")
-                return false;
-            i = label.end + 1;
-            while (" \t\r\n".includes(graph[i] ?? '\0'))
-                i++;
-        }
-        return true;
-    };
-    while (" \t\r\n".includes(graph[i] ?? '\0'))
-        i++;
-    // parse_sws_flags consumes the raw first semicolon before graph tokens.
-    // Quotes and backslashes do not protect a delimiter in this prefix.
-    if (graph.startsWith('sws_flags=', i)) {
-        const separator = graph.indexOf(';', i);
-        if (separator < 0)
-            return { resources: [], complete: false };
-        i = separator + 1;
-        while (" \t\r\n".includes(graph[i] ?? '\0'))
-            i++;
-    }
-    // graphparser.c rejects descriptions containing no filters. The C-string
-    // boundary above can also make a nonempty observed buffer an empty graph.
-    // Keep this advisory: discovery neither initializes filters nor raises the
-    // native execution error before the reader reaches this stage.
-    if (i === graph.length)
-        return { resources: [], complete: false };
-    while (i < graph.length) {
-        if (!labels())
-            return { resources: [...loaded, ...found], complete: false };
-        const name = token(graph, i, "=,;[");
-        i = name.end;
-        const filter = name.value.split("@")[0];
-        // graphparser.c separates the instance suffix before filter lookup. An
-        // empty name cannot create a filter, even when it has an instance name.
-        // Keep preceding predictions; later initialization readers are unreachable.
-        if (!filter)
-            return { resources: [...loaded, ...found], complete: false };
-        const output = Object.hasOwn(filterOutputMetadata, filter) ? filterOutputMetadata[filter] : undefined;
-        const input = Object.hasOwn(filterInputMetadata, filter) ? filterInputMetadata[filter] : undefined;
-        const assigned = new Set();
-        if (graph[i] === "=") {
-            const args = token(graph, i + 1, "[],;");
-            i = args.end;
-            let j = 0;
-            let position = 0;
-            let shorthand = true;
-            let complete = true;
-            const assignments = [];
-            const last = new Map();
-            const aliases = Object.hasOwn(filterResourceAliases, filter)
-                ? filterResourceAliases[filter] : undefined;
-            while (j < args.value.length) {
-                const key = token(args.value, j, "=:");
-                let field = shorthand ? (output?.positional ?? input?.positional ?? (Object.hasOwn(filterFiles, filter) ? filterFiles[filter] : undefined))?.[position++] : undefined;
-                let val = key;
-                if (args.value[key.end] === "=") {
-                    // ff_filter_opt_parse disables all later positional keys here.
-                    shorthand = false;
-                    field = key.value;
-                    val = token(args.value, key.end + 1, ":");
-                }
-                else if (!shorthand) {
-                    complete = false;
-                    break;
-                }
-                const file = field && filterValueResource(filter, field, textBytes(val.value));
-                if (field) {
-                    const name = field.startsWith('/') ? field.slice(1) : field;
-                    const canonical = aliases && Object.hasOwn(aliases, name) ? aliases[name] : name;
-                    assigned.add(canonical);
-                    last.set(canonical, assignments.length);
-                    assignments.push({ field: canonical, file: file || undefined });
-                }
-                j = val.end + 1;
-            }
-            // MULTIKEY retains every setter in order, but initialization reads only
-            // the final filename. Every slash setter still loads its own value file.
-            for (let index = 0; index < assignments.length; index++) {
-                const { field, file } = assignments[index];
-                if (!file)
-                    continue;
-                const replaced = last.get(field) !== index;
-                if (file.filterReader)
-                    loaded.push(replaced
-                        ? { ...file, filterReader: { ...file.filterReader, discardValue: true } } : file);
-                else if (!replaced)
-                    found.push(file);
-            }
-            if (!complete)
-                return { resources: [...loaded, ...found], complete: false };
-        }
-        const defaults = Object.hasOwn(filterResourceDefaults, filter)
-            ? filterResourceDefaults[filter] : undefined;
-        for (const [field, value] of Object.entries(defaults ?? {})) {
-            // Explicit empty and slash-loaded values replace the default too. The
-            // selected resource remains a runtime prediction, never a preflight read.
-            if (assigned.has(field))
-                continue;
-            const file = filterValueResource(filter, field, textBytes(value));
-            if (file)
-                found.push(file);
-        }
-        // graphparser.c filter_parse consumes output labels, then chain_parse
-        // requires a comma, semicolon or end. Input labels for another filter
-        // cannot make a missing separator valid. Retain only the advisory prefix.
-        if (!labels())
-            return { resources: [...loaded, ...found], complete: false };
-        while (" \t\r\n".includes(graph[i] ?? '\0'))
-            i++;
-        if (i < graph.length && graph[i] !== ',' && graph[i] !== ';')
-            return { resources: [...loaded, ...found], complete: false };
-        if (i < graph.length)
-            i++;
-        while (" \t\r\n".includes(graph[i] ?? '\0'))
-            i++;
-    }
-    return { resources: [...loaded, ...found], complete: true };
-}

package/dist/media-cli/shim.js

@@ -1,52 +0,0 @@
-import { discover } from "./discover.js";
-import { grammarRevision, nativeReference } from "./options.generated.js";
-export function createFFmpegShims(binding) {
-    if (binding.build !== nativeReference.id)
-        throw new Error("Native build does not match the pinned reference");
-    if (binding.grammarRevision !== grammarRevision)
-        throw new Error("Native grammar revision drift");
-    if (binding.lateAccess !== "complete" || binding.effects !== "live")
-        throw new Error("Native binding requires complete late access and live effects");
-    if (binding.argv !== "bytes")
-        throw new Error("Native binding must preserve argv bytes");
-    // Keep the admitted execution method, including its receiver, rather than
-    // consulting caller-owned configuration again on each invocation.
-    const run = binding.run.bind(binding);
-    return Object.fromEntries(["ffmpeg", "ffprobe"].map(tool => [tool,
-        async (args, context) => {
-            if (!Array.isArray(args))
-                throw new TypeError('Native argv must be an array of byte arguments');
-            const argumentCount = args.length;
-            const argv = Array.from({ length: argumentCount }, (_, index) => {
-                if (!Object.hasOwn(args, index))
-                    throw new TypeError('Native argv slot is missing');
-                const arg = args[index];
-                if (!(arg instanceof Uint8Array))
-                    throw new TypeError('Native argv arguments must be bytes');
-                return new Uint8Array(arg);
-            });
-            if (args.length !== argumentCount)
-                throw new TypeError('Native argv changed during capture');
-            if (argv.some(arg => arg.includes(0)))
-                throw new Error("NUL is not representable in native argv");
-            let discovery;
-            try {
-                discovery = discover(tool, argv);
-            }
-            catch {
-                // Prediction is optional. Only the admitted native binding can decide
-                // whether the command is valid and which resources it actually opens.
-                discovery = {
-                    tool, grammarRevision, argv: argv.map(arg => new Uint8Array(arg)),
-                    globals: [], groups: [], dependencies: [],
-                    deferred: [{ index: -1, reason: 'native-access' }],
-                };
-            }
-            const result = await run({ tool, executable: nativeReference.executables[tool], argv, discovery, context });
-            const exitCode = result?.exitCode;
-            if (!Number.isInteger(exitCode) || exitCode < 0 || exitCode > 255)
-                throw new TypeError('Invalid native exit status');
-            return { exitCode };
-        }
-    ]));
-}

package/dist/media-cli/tee.d.ts

@@ -1,6 +0,0 @@
-/** Advisory slave parsing. Malformed option lists remain native-owned; they do
- * not authorize reads or prevent later slaves from reaching native execution. */
-export declare function teeResources(value: Uint8Array): {
-    target: Uint8Array;
-    options: ReadonlyMap<string, Uint8Array>;
-}[];

package/dist/media-cli/tee.js

@@ -1,38 +0,0 @@
-// FFmpeg 9.0.1 libavformat/tee.c and tee_common.c; retained notices in NOTICE.
-import { byteText, textBytes, token } from './bytes.js';
-/** Advisory slave parsing. Malformed option lists remain native-owned; they do
- * not authorize reads or prevent later slaves from reaching native execution. */
-export function teeResources(value) {
-    const expression = byteText(value);
-    const resources = [];
-    let cursor = 0;
-    while (cursor < expression.length) {
-        const slave = token(expression, cursor, '|');
-        cursor = slave.end + 1;
-        const options = new Map();
-        let filename = 0;
-        if (slave.value.startsWith('[')) {
-            filename = 1;
-            if (slave.value[filename] !== ']') {
-                while (filename < slave.value.length) {
-                    const key = token(slave.value, filename, '=');
-                    if (!key.value || slave.value[key.end] !== '=')
-                        break;
-                    const argument = token(slave.value, key.end + 1, ':]');
-                    options.set(key.value, textBytes(argument.value));
-                    filename = argument.end;
-                    if (slave.value[filename] === ']')
-                        break;
-                    if (slave.value[filename] !== ':')
-                        break;
-                    filename++;
-                }
-            }
-            if (slave.value[filename] !== ']')
-                continue;
-            filename++;
-        }
-        resources.push({ target: textBytes(slave.value.slice(filename)), options });
-    }
-    return resources;
-}

package/dist/office-package/zip-sync.js

@@ -1,111 +0,0 @@
-import { inflateRaw } from "pako";
-// Synchronous stored/raw-DEFLATE ZIP access for office document fast paths.
-function crc32Bytes(data) {
-    let c = 0xffffffff;
-    for (let i = 0; i < data.length; i++) {
-        c ^= data[i];
-        for (let k = 0; k < 8; k++) {
-            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        }
-    }
-    return (c ^ 0xffffffff) >>> 0;
-}
-export function createStoredZipArchive(entries) {
-    const localParts = [];
-    const centralParts = [];
-    let offset = 0;
-    let count = 0;
-    for (const [name, content] of Object.entries(entries)) {
-        const nameBytes = new TextEncoder().encode(name);
-        const crc = crc32Bytes(content);
-        const localHeader = new Uint8Array(30 + nameBytes.length);
-        const lv = new DataView(localHeader.buffer);
-        lv.setUint32(0, 0x04034b50, true);
-        lv.setUint16(4, 20, true);
-        lv.setUint16(6, 0, true);
-        lv.setUint16(8, 0, true); // stored
-        lv.setUint32(14, crc, true);
-        lv.setUint32(18, content.length, true);
-        lv.setUint32(22, content.length, true);
-        lv.setUint16(26, nameBytes.length, true);
-        localHeader.set(nameBytes, 30);
-        const centralHeader = new Uint8Array(46 + nameBytes.length);
-        const cv = new DataView(centralHeader.buffer);
-        cv.setUint32(0, 0x02014b50, true);
-        cv.setUint16(4, 20, true);
-        cv.setUint16(6, 20, true);
-        cv.setUint16(10, 0, true);
-        cv.setUint32(16, crc, true);
-        cv.setUint32(20, content.length, true);
-        cv.setUint32(24, content.length, true);
-        cv.setUint16(28, nameBytes.length, true);
-        cv.setUint32(42, offset, true);
-        centralHeader.set(nameBytes, 46);
-        localParts.push(localHeader, content);
-        centralParts.push(centralHeader);
-        offset += localHeader.length + content.length;
-        count++;
-    }
-    const centralSize = centralParts.reduce((s, p) => s + p.length, 0);
-    const eocd = new Uint8Array(22);
-    const ev = new DataView(eocd.buffer);
-    ev.setUint32(0, 0x06054b50, true);
-    ev.setUint16(8, count, true);
-    ev.setUint16(10, count, true);
-    ev.setUint32(12, centralSize, true);
-    ev.setUint32(16, offset, true);
-    const total = offset + centralSize + 22;
-    const out = new Uint8Array(total);
-    let pos = 0;
-    for (const p of [...localParts, ...centralParts, eocd]) {
-        out.set(p, pos);
-        pos += p.length;
-    }
-    return out;
-}
-export function readZipArchiveEntries(zipBytes) {
-    const map = new Map();
-    const view = new DataView(zipBytes.buffer, zipBytes.byteOffset, zipBytes.byteLength);
-    let eocdPos = -1;
-    for (let i = zipBytes.length - 22; i >= Math.max(0, zipBytes.length - 65557); i--) {
-        if (view.getUint32(i, true) === 0x06054b50) {
-            eocdPos = i;
-            break;
-        }
-    }
-    if (eocdPos < 0)
-        throw new Error("Invalid ZIP: missing end of central directory");
-    const count = view.getUint16(eocdPos + 10, true);
-    let cdPos = view.getUint32(eocdPos + 16, true);
-    for (let i = 0; i < count; i++) {
-        if (cdPos + 46 > zipBytes.length || view.getUint32(cdPos, true) !== 0x02014b50) {
-            throw new Error("Invalid ZIP: truncated central directory");
-        }
-        const method = view.getUint16(cdPos + 10, true);
-        const compSize = view.getUint32(cdPos + 20, true);
-        const nameLen = view.getUint16(cdPos + 28, true);
-        const extraLen = view.getUint16(cdPos + 30, true);
-        const commentLen = view.getUint16(cdPos + 32, true);
-        const localOffset = view.getUint32(cdPos + 42, true);
-        if (cdPos + 46 + nameLen + extraLen + commentLen > zipBytes.length ||
-            localOffset + 30 > zipBytes.length || view.getUint32(localOffset, true) !== 0x04034b50) {
-            throw new Error("Invalid ZIP: truncated or invalid entry header");
-        }
-        const name = new TextDecoder().decode(zipBytes.subarray(cdPos + 46, cdPos + 46 + nameLen));
-        const localNameLen = view.getUint16(localOffset + 26, true);
-        const localExtraLen = view.getUint16(localOffset + 28, true);
-        const dataStart = localOffset + 30 + localNameLen + localExtraLen;
-        if (dataStart + compSize > zipBytes.length) {
-            throw new Error("Invalid ZIP: truncated entry data");
-        }
-        const rawData = zipBytes.subarray(dataStart, dataStart + compSize);
-        if (method === 0) {
-            map.set(name, new Uint8Array(rawData));
-        }
-        else if (method === 8) {
-            map.set(name, inflateRaw(rawData));
-        }
-        cdPos += 46 + nameLen + extraLen + commentLen;
-    }
-    return map;
-}

package/dist/remote-execution/binary.js

@@ -1,178 +0,0 @@
-/** Portable codec for the normative REX1 schema. No Node globals or media text. */
-import { parseWireJson } from './wire-json.js';
-export const binaryContentType = 'application/vnd.poe.remote-execution.v1+octet-stream';
-function bounds(options) {
-    for (const n of [options.maxFrameBytes, options.maxControlBytes])
-        if (!Number.isSafeInteger(n) || n < 1 || n > 1048576)
-            throw new TypeError('Invalid frame bound');
-    if (options.maxChannels !== undefined && (!Number.isSafeInteger(options.maxChannels) || options.maxChannels < options.channels.length))
-        throw new TypeError('Invalid channel capacity');
-    if (options.endedChannels?.some(id => !options.channels.includes(id)))
-        throw new TypeError('Invalid ended channel');
-    if (options.maxTotalBytes !== undefined && (!Number.isSafeInteger(options.maxTotalBytes) || options.maxTotalBytes < 0))
-        throw new TypeError('Invalid lane bound');
-    if (options.maxControlBytes > options.maxFrameBytes || options.channels.some(n => !Number.isInteger(n) || n < 1 || n > 4294967295))
-        throw new TypeError('Invalid channel bound');
-}
-function uint64(n) { if (typeof n !== 'bigint' || n < 0n || n > 18446744073709551615n)
-    throw new TypeError('Invalid uint64'); }
-function header(bytes, options) {
-    const view = new DataView(bytes.buffer, bytes.byteOffset, 40);
-    if (view.getUint32(0) !== 0x52455831 || view.getUint8(4) !== 1 || view.getUint16(6) !== 0)
-        throw new TypeError('Invalid frame magic/version/reserved bits');
-    const kind = { 1: 'data', 2: 'end', 3: 'control' }[view.getUint8(5)];
-    const channelId = view.getUint32(8);
-    const length = view.getUint32(12);
-    const sequence = view.getBigUint64(16);
-    const offset = view.getBigUint64(24);
-    const correlationId = view.getBigUint64(32);
-    if (!kind || sequence === 0n)
-        throw new TypeError('Invalid frame kind/sequence');
-    if (length > options.maxFrameBytes || (kind === 'control' && length > options.maxControlBytes))
-        throw new TypeError('Invalid frame length');
-    if (kind === 'control' ? channelId !== 0 || offset !== 0n : !options.channels.includes(channelId))
-        throw new TypeError('Invalid frame channel/offset');
-    if (kind === 'end' && length !== 0)
-        throw new TypeError('END must have zero length');
-    if (offset + BigInt(length) > 18446744073709551615n)
-        throw new TypeError('Channel offset overflow');
-    return { kind, channelId, length, sequence, offset, correlationId };
-}
-function control(frame, options) {
-    if (frame.kind !== 'control')
-        return;
-    if (!options.validateControl)
-        throw new TypeError('CONTROL schema is not negotiated');
-    const record = parseWireJson(new TextDecoder('utf-8', { fatal: true }).decode(frame.payload));
-    options.validateControl(record);
-    return record;
-}
-export function encodeFrame(frame, options) {
-    frame = { kind: frame.kind, channelId: frame.channelId, sequence: frame.sequence, offset: frame.offset, correlationId: frame.correlationId, payload: frame.payload };
-    bounds(options);
-    for (const n of [frame.sequence, frame.offset, frame.correlationId])
-        uint64(n);
-    if (!Number.isInteger(frame.channelId) || frame.channelId < 0 || frame.channelId > 4294967295 || !(frame.payload instanceof Uint8Array))
-        throw new TypeError('Invalid frame');
-    // Validate size before making a retained copy.
-    const length = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(frame.payload);
-    if (length > options.maxFrameBytes)
-        throw new TypeError('Invalid frame length');
-    // A fixed header admits kind, channel, control size and counters before
-    // allocating the payload-bearing frame.
-    const raw = new Uint8Array(40);
-    const view = new DataView(raw.buffer);
-    view.setUint32(0, 0x52455831);
-    view.setUint8(4, 1);
-    view.setUint8(5, { data: 1, end: 2, control: 3 }[frame.kind]);
-    view.setUint32(8, frame.channelId);
-    view.setUint32(12, length);
-    view.setBigUint64(16, frame.sequence);
-    view.setBigUint64(24, frame.offset);
-    view.setBigUint64(32, frame.correlationId);
-    header(raw, options);
-    control(frame, options);
-    const wire = new Uint8Array(40 + length);
-    wire.set(raw);
-    wire.set(frame.payload, 40);
-    return wire;
-}
-/** One header and one admitted payload in memory. The producer is advanced only
- * after yielding the owned frame. Interrupted frames never yield or acknowledge.
- * Offset/sequence state advances only when the consumer resumes after delivery. */
-export async function* decodeFrames(source, options, signal) {
-    signal?.throwIfAborted();
-    // Retain every negotiated capability before yielding to transport or delivery.
-    // Caller mutation cannot widen budgets, replace validation or waive END.
-    options = { ...options };
-    bounds(options);
-    options = { ...options, channels: [...options.channels],
-        endedChannels: options.endedChannels ? [...options.endedChannels] : undefined,
-        offsets: options.offsets ? new Map(options.offsets) : undefined };
-    const channels = [...options.channels];
-    const admittedOptions = { ...options, channels };
-    let chunk = new Uint8Array();
-    let position = 0;
-    let chunkLength = 0;
-    let sequence = options.firstSequence ?? 1n;
-    const typedArray = Object.getPrototypeOf(Uint8Array.prototype);
-    const byteLength = Object.getOwnPropertyDescriptor(typedArray, 'byteLength').get;
-    const buffer = Object.getOwnPropertyDescriptor(typedArray, 'buffer').get;
-    const byteOffset = Object.getOwnPropertyDescriptor(typedArray, 'byteOffset').get;
-    uint64(sequence);
-    let totalBytes = 0;
-    const offsets = new Map(options.channels.map(id => [id, options.offsets?.get(id) ?? 0n]));
-    const ended = new Set(options.endedChannels);
-    const reader = source.getReader();
-    const abort = () => { void reader.cancel(signal?.reason).catch(() => { }); };
-    signal?.addEventListener('abort', abort, { once: true });
-    async function fill(target) {
-        let filled = 0;
-        while (filled < target.length) {
-            signal?.throwIfAborted();
-            if (position === chunkLength) {
-                const next = await reader.read();
-                signal?.throwIfAborted();
-                if (next.done) {
-                    if (filled)
-                        throw new TypeError('Interrupted binary frame');
-                    return false;
-                }
-                if (!(next.value instanceof Uint8Array))
-                    throw new TypeError('Binary transport bytes required');
-                chunk = next.value;
-                chunkLength = byteLength.call(chunk);
-                position = 0;
-                if (!chunkLength)
-                    continue;
-            }
-            const count = Math.min(chunkLength - position, target.length - filled);
-            target.set(new Uint8Array(buffer.call(chunk), byteOffset.call(chunk) + position, count), filled);
-            filled += count;
-            position += count;
-        }
-        return true;
-    }
-    try {
-        for (;;) {
-            const raw = new Uint8Array(40);
-            if (!await fill(raw))
-                break;
-            const parsed = header(raw, admittedOptions);
-            totalBytes += 40 + parsed.length;
-            if (totalBytes > (options.maxTotalBytes ?? Infinity))
-                throw new TypeError('Lane byte length exceeds admission');
-            if (parsed.sequence !== sequence)
-                throw new TypeError('Noncontiguous frame sequence');
-            if (parsed.kind !== 'control' && (ended.has(parsed.channelId) || parsed.offset !== offsets.get(parsed.channelId)))
-                throw new TypeError('Invalid channel END/offset');
-            const payload = new Uint8Array(parsed.length);
-            if (!await fill(payload))
-                throw new TypeError('Interrupted binary frame');
-            const { length: ignoredLength, ...fields } = parsed;
-            const frame = { ...fields, payload };
-            const record = control(frame, options);
-            if (record?.type === 'ChannelOpen' && record.direction === options.channelOpenDirection) {
-                const id = record.channelId;
-                if (!Number.isInteger(id) || id < 4 || id > 4294967295 || channels.includes(id) || channels.length >= (options.maxChannels ?? options.channels.length))
-                    throw new TypeError('Invalid dynamic channel admission');
-                channels.push(id);
-                offsets.set(id, 0n);
-            }
-            signal?.throwIfAborted();
-            yield frame;
-            sequence++;
-            if (parsed.kind !== 'control')
-                offsets.set(parsed.channelId, parsed.offset + BigInt(parsed.length));
-            if (parsed.kind === 'end')
-                ended.add(parsed.channelId);
-        }
-        if (options.requireEnd && channels.some(id => !ended.has(id)))
-            throw new TypeError('Transport EOF without END');
-    }
-    finally {
-        signal?.removeEventListener('abort', abort);
-        await reader.cancel().catch(() => { });
-        reader.releaseLock();
-    }
-}

package/dist/remote-execution/callback-result.js

@@ -1,26 +0,0 @@
-import { validateWire } from './wire-validation.js';
-/** Shape validation alone cannot authorize a receipt for another operation.
- * Transfer/END settlement is checked by the channel owner independently. */
-export function validateCallbackResult(operation, result) {
-    validateWire('FileOperation', operation);
-    validateWire('CallbackResult', result);
-    if (result.state === 'applied' && result.error !== undefined || result.state !== 'applied' && (!result.error || !result.error.code))
-        throw new TypeError('Callback state contradicts its failure receipt');
-    if (result.state === 'unknown' && (result.error?.phase !== 'unknown' || !result.error.recovery))
-        throw new TypeError('Unknown callback result requires recovery information');
-    const fields = {
-        open: ['handleId', 'identityId'], stat: ['stat', 'identityId'], lstat: ['stat', 'identityId'],
-        read: ['acknowledgedBytes'], write: ['acknowledgedBytes'], seek: ['position'],
-        readlink: ['target'], readdir: ['entries'],
-    };
-    const allowed = fields[operation.op] ?? [];
-    const common = ['type', 'callbackId', 'operationId', 'state', 'error'];
-    if (Object.keys(result).some(key => !common.includes(key) && !allowed.includes(key)))
-        throw new TypeError('Callback result contradicts its operation');
-    if (result.state === 'applied' && allowed.length && !Object.hasOwn(result, allowed[0]))
-        throw new TypeError('Callback result is missing its operation receipt');
-    if ((operation.op === 'read' || operation.op === 'write') && result.acknowledgedBytes !== undefined && BigInt(result.acknowledgedBytes) > BigInt(operation.length))
-        throw new TypeError('Callback progress exceeds its operation');
-    if (operation.op === 'readdir' && result.entries !== undefined && result.entries.length > operation.maxEntries)
-        throw new TypeError('Callback listing exceeds its operation');
-}

package/dist/remote-execution/canonical-capabilities.d.ts

@@ -1,5 +0,0 @@
-import type { FileSystemCapabilities } from "@poe-platform/safe-fs/core";
-/** Structural contract fields may be non-enumerable prototype accessors. Capture
- * each guarantee once at access time, preserving absent versus explicit false.
- * Own enumerable extensions retain the existing boolean capability profile. */
-export declare function admitCanonicalCapabilities(input: unknown, syscall: 'capabilities' | 'rmdir', path: string, maxBytes?: number): FileSystemCapabilities;

package/dist/remote-execution/canonical-capabilities.js

@@ -1,45 +0,0 @@
-import { FsError } from "@poe-platform/safe-fs/contracts/errors";
-/** Structural contract fields may be non-enumerable prototype accessors. Capture
- * each guarantee once at access time, preserving absent versus explicit false.
- * Own enumerable extensions retain the existing boolean capability profile. */
-export function admitCanonicalCapabilities(input, syscall, path, maxBytes) {
-    if (maxBytes !== undefined && (!Number.isSafeInteger(maxBytes) || maxBytes < 1))
-        throw new TypeError('Invalid capability metadata bound');
-    if (!input || typeof input !== 'object' || Array.isArray(input))
-        throw new FsError('EIO', { syscall, path });
-    const fields = new Set([
-        'readOnly', 'read', 'stat', 'readdir', 'realpath', 'access', 'write', 'append',
-        'exclusiveCreate', 'explicitDirectories', 'implicitDirectories', 'mkdir',
-        'recursiveMkdir', 'remove', 'removeDirectory', 'recursiveRemove', 'rename',
-        'copy', 'exclusiveCopy', 'readlink', 'truncate', 'streamingAppend',
-        'randomAccessWrite', 'symlinks', 'hardlinks', 'permissions', 'timestamps',
-        'atomicRename', 'atomicFileStaging', 'atomicFileMutation',
-        'atomicDirectoryMetadata', 'atomicRenameNoReplace', 'snapshotRmdir',
-        'streamingRead', 'retainedRead', 'retainedResize', 'atomicResize',
-        'streamingWrite', 'descriptorWriteStream', ...Object.keys(input),
-    ]);
-    const observed = {};
-    let remaining = maxBytes === undefined ? Infinity : maxBytes - 2;
-    let members = 0;
-    if (remaining < 0)
-        throw new FsError('EFBIG', { syscall, path });
-    for (const field of fields) {
-        if (!(field in input))
-            continue;
-        const value = Reflect.get(input, field);
-        if (value !== undefined && typeof value !== 'boolean')
-            throw new FsError('EIO', { syscall, path });
-        if (value !== undefined) {
-            // Admit the UTF-16 lower bound before encoding potentially large extension
-            // names. Count JSON escaping, UTF-8 octets, punctuation and boolean values;
-            // undefined guarantees have no member in the wire observation.
-            if (field.length > remaining)
-                throw new FsError('EFBIG', { syscall, path });
-            remaining -= new TextEncoder().encode(JSON.stringify(field)).length + 1 + (value ? 4 : 5) + (members++ ? 1 : 0);
-            if (remaining < 0)
-                throw new FsError('EFBIG', { syscall, path });
-        }
-        Object.defineProperty(observed, field, { value, enumerable: true, writable: true, configurable: true });
-    }
-    return observed;
-}

package/dist/remote-execution/canonical-metadata.d.ts

@@ -1,4 +0,0 @@
-import type { FileStat } from "@poe-platform/safe-fs/core";
-/** Admit one live legacy stat observation. Numeric metadata cannot gain exact
- * bigint precision through coercion, and backend identity never crosses the wire. */
-export declare function admitCanonicalMetadata(input: FileStat, syscall: 'stat' | 'lstat'): FileStat;