@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/media-cli/discover.js

@@ -1,286 +0,0 @@
-// Source-informed control flow: FFmpeg 9.0.1 fftools/cmdutils.c. See NOTICE.
-import { byteText } from "./bytes.js";
-import { avCodecChildOptionNames, avCodecOptionNames, avOptionNames, grammarRevision, optionMetadata, pathOptionMetadata } from "./options.generated.js";
-import { filterResources, resource } from "./resources.js";
-import { teeResources } from './tee.js';
-const privateOptions = new Set(avOptionNames);
-const codecOptions = new Set(avCodecOptionNames);
-const codecChildOptions = new Set(avCodecChildOptionNames);
-const pathOptions = pathOptionMetadata;
-export const filterOptions = Object.freeze(["vf", "af", "filter", "filter_complex", "lavfi"]);
-const presets = new Set(["pre", "apre", "vpre", "spre"]);
-/** Predictions never perform I/O, validate native syntax, or authorize access. */
-export function discover(tool, args, entrypoint = 'command') {
-    // Presets call parse_option with FFmpeg definitions, not split_commandline.
-    const sequential = tool === 'ffprobe' || entrypoint === 'preset';
-    // Interpret the indexed native arguments, never caller-supplied array methods
-    // that can replace URL or request option bytes with a snapshot operand.
-    const argv = Array.from({ length: args.length }, (_, index) => new Uint8Array(args[index]));
-    const globals = [];
-    const groups = [];
-    const dependencies = [];
-    const deferred = [{ index: -1, reason: "native-access" }];
-    const definitions = optionMetadata[tool];
-    let pending = [];
-    let protectedIndex = -1;
-    let handleOptions = true;
-    // ffprobe.c retains the first filename, even an empty one. Its -i wrapper
-    // discards duplicate callback errors; positional inputs and -o propagate them.
-    let probeInput = false;
-    let probeOutput = false;
-    function dependenciesFor(option, stage) {
-        const { value, index, name } = option;
-        // Indirection changes where the value comes from, not the selected
-        // option's need for stream metadata. Never probe to resolve that hint.
-        // opt_default stores codec AVOptions in a dictionary; filter_codec_opts
-        // matches that dictionary against actual streams even without a suffix.
-        const codecDictionary = !Object.hasOwn(definitions, name) &&
-            (codecChildOptions.has(name) || !option.specifier && 'vas'.includes(name[0]) && codecOptions.has(name.slice(1)));
-        if (Object.hasOwn(definitions, name) && definitions[name].perStream || codecDictionary ||
-            name === "map" || name === "map_metadata" || name === "map_chapters" || option.specifier ||
-            name === 'dump_attachment' && value !== undefined && (option.fromFile || value.length === 0)) {
-            deferred.push({ index, reason: "stream-metadata" });
-        }
-        // Operand-free per-stream booleans still select streams at runtime.
-        if (value === undefined)
-            return;
-        if (option.fromFile) {
-            dependencies.push({ ...resource(index, value, "option-file", "read", stage), optionReader: { tool, name, specifier: option.specifier,
-                    ...(option.discardValue ? { discardValue: true } : {}) } });
-            deferred.push({ index, reason: "option-file-content" });
-            return;
-        }
-        if (option.discardValue)
-            return;
-        if (presets.has(name))
-            deferred.push({ index, reason: "preset-search" });
-        if (filterOptions.includes(name) || (tool === "ffmpeg" && name === "f" && byteText(value) === "lavfi")) {
-            if (filterOptions.includes(name)) {
-                const parsed = filterResources(value);
-                for (const file of parsed.resources) {
-                    dependencies.push({ ...resource(index, file.value, "filter-resource", file.access ?? "read", "runtime", file.literal), literal: file.literal, ...(file.filterReader ? { filterReader: file.filterReader } : {}), ...(file.kind ? { kind: file.kind } : {}) });
-                }
-                if (!parsed.complete)
-                    deferred.push({ index, reason: 'filter-syntax' });
-            }
-            deferred.push({ index, reason: "filter-runtime" });
-        }
-        const role = Object.hasOwn(pathOptions, name) ? pathOptions[name] : undefined;
-        if (role) {
-            // opt_preset chooses an explicit path from the handler's first byte,
-            // not the matched OptionDef. Sequential "nofpre" therefore searches.
-            const presetLookup = role.role === 'preset' && sequential && byteText(argv[index])[1] !== 'f';
-            if (presetLookup)
-                deferred.push({ index, reason: 'preset-search' });
-            // Empty attachment names come from stream metadata, not the empty path.
-            if (name !== "dump_attachment" || value.length > 0) {
-                const dependency = { ...resource(index, value, role.role, role.access, stage, !presetLookup && (role.syntax === 'literal' || role.syntax === 'generated'), role.syntax === 'stdio' ? 'stdio' : 'avio'),
-                    optionReader: { tool, name, specifier: option.specifier } };
-                dependencies.push(role.syntax === 'generated' || presetLookup ? { ...dependency, kind: 'resource-lookup' } : dependency);
-            }
-            if (name === "dump_attachment" || name === "passlogfile")
-                deferred.push({ index, reason: "generated-name" });
-            if (role.role === "filter-script" || role.role === "preset")
-                deferred.push({ index, reason: "option-file-content" });
-        }
-    }
-    function group(kind, index, target) {
-        if (tool === 'ffmpeg' && kind === 'output') {
-            // ffmpeg_opt.c's vf/af handlers always append filter:v/filter:a.
-            // opt_match_per_stream selects the last matching value. Equal selector
-            // bytes are sufficient here; other overlaps require native metadata.
-            const selector = (option) => option.name === 'vf' ? 'v'
-                : option.name === 'af' ? 'a'
-                    : option.name === 'filter' ? byteText(option.specifier ?? new Uint8Array()) : undefined;
-            const last = new Map();
-            for (const option of pending) {
-                const key = selector(option);
-                if (key !== undefined)
-                    last.set(key, option.index);
-            }
-            pending = pending.map(option => {
-                const key = selector(option);
-                return key !== undefined && last.get(key) !== option.index ? { ...option, discardValue: true } : option;
-            });
-        }
-        groups.push({ kind, index, target, options: pending });
-        const stage = kind === "input" ? "input" : "output";
-        for (const option of pending)
-            dependenciesFor(option, stage);
-        if (target !== undefined && (kind === "input" || kind === "output")) {
-            const format = [...pending].reverse().find(option => option.name === "f");
-            if (kind === "input" && format?.value && !format.fromFile && byteText(format.value) === "lavfi") {
-                const parsed = filterResources(target);
-                for (const file of parsed.resources)
-                    dependencies.push({ ...resource(index, file.value, "filter-resource", file.access ?? "read", "runtime", file.literal), literal: file.literal, ...(file.filterReader ? { filterReader: file.filterReader } : {}), ...(file.kind ? { kind: file.kind } : {}) });
-                if (!parsed.complete)
-                    deferred.push({ index, reason: 'filter-syntax' });
-                deferred.push({ index, reason: "filter-runtime" });
-            }
-            else if (kind === 'output' && format?.value && !format.fromFile && byteText(format.value) === 'tee') {
-                for (const slave of teeResources(target)) {
-                    for (const [name, value] of slave.options) {
-                        const role = Object.hasOwn(pathOptions, name) ? pathOptions[name] : undefined;
-                        if (role)
-                            dependencies.push({ ...resource(index, value, role.role, role.access, 'runtime', role.syntax === 'literal', role.syntax === 'stdio' ? 'stdio' : 'avio'),
-                                optionReader: { tool, name } });
-                    }
-                    // tee.c opens slave filenames through ff_format_output_open/AVIO;
-                    // it does not apply fftools' top-level '-' to pipe:1 rewriting.
-                    dependencies.push(resource(index, slave.target, 'output', 'write', 'runtime', false, 'avio'));
-                }
-                deferred.push({ index, reason: 'stream-metadata' }, { index, reason: 'generated-name' });
-            }
-            else
-                dependencies.push(resource(index, target, kind, kind === "input" ? "read" : "write", stage));
-        }
-        pending = [];
-    }
-    for (let i = 0; i < argv.length; i++) {
-        const raw = byteText(argv[i]);
-        if (handleOptions && raw === "--") {
-            if (tool === "ffmpeg")
-                protectedIndex = i + 1;
-            else
-                handleOptions = false;
-            continue;
-        }
-        if (!handleOptions || i === protectedIndex || raw === "-" || !raw.startsWith("-")) {
-            if (tool === 'ffprobe') {
-                if (probeInput) {
-                    deferred.push({ index: i, reason: 'native-access' });
-                    break;
-                }
-                probeInput = true;
-            }
-            group(tool === "ffmpeg" ? "output" : "input", i, argv[i]);
-            continue;
-        }
-        const index = i;
-        let key = raw.slice(1);
-        const fromFile = key.startsWith("/");
-        if (fromFile)
-            key = key.slice(1);
-        const colon = key.indexOf(":");
-        let name = colon < 0 ? key : key.slice(0, colon);
-        const specifier = colon < 0 ? undefined : argv[i].slice(raw.indexOf(":") + 1);
-        if (!sequential && !fromFile && (key === "i" || key === "dec")) {
-            if (argv[i + 1] === undefined) {
-                deferred.push({ index, reason: "missing-value" });
-                break;
-            }
-            group(key === "i" ? "input" : "decoder", ++i, argv[i]);
-            continue;
-        }
-        let definition = Object.hasOwn(definitions, name) ? definitions[name] : undefined;
-        let unknownIndirect = false;
-        // parse_option retains a found no-prefixed non-boolean definition too,
-        // including in presets; split_commandline only accepts boolean negation.
-        if (!definition && !fromFile && name.startsWith("no")) {
-            // Both parsers call find_option again after 'no'. That
-            // lookup strips one slash, but write_option still receives the original
-            // no-prefixed spelling, so this is not argument-file indirection.
-            const negated = name[2] === '/' ? name.slice(3) : name.slice(2);
-            if (Object.hasOwn(definitions, negated) && (sequential || definitions[negated].boolean)) {
-                name = negated;
-                definition = definitions[name];
-            }
-        }
-        if (!definition) {
-            // An inventory hit is only an arity hint, never build availability or validity.
-            const legacyCodec = !fromFile && colon < 0 && "vas".includes(name[0]) && codecOptions.has(name.slice(1));
-            const avOption = codecChildOptions.has(name) || privateOptions.has(key) || legacyCodec;
-            // Sequential parse_option loads slash passthrough values before looking
-            // up an AVOption. The split parser passes the slash verbatim to opt_default.
-            if (sequential && fromFile || !fromFile && avOption) {
-                unknownIndirect = sequential && fromFile && !avOption;
-                definition = { arity: 1, boolean: false, exit: false, perFile: true, scopes: [] };
-            }
-            else {
-                deferred.push({ index, reason: "unknown-option" });
-                break;
-            }
-        }
-        if (sequential && fromFile && definition.arity === 0) {
-            // write_option fails before any following positional operands are read.
-            // This is an advisory stop; the one native invocation owns the error.
-            deferred.push({ index, reason: 'native-access' });
-            break;
-        }
-        const consumes = definition.arity > 0 || (!sequential && definition.exit);
-        const value = consumes ? argv[++i] : undefined;
-        if (consumes && value === undefined && !definition.exit) {
-            deferred.push({ index, reason: "missing-value" });
-            break;
-        }
-        const option = { index, name, specifier, value, fromFile, scopes: definition.scopes,
-            ...(tool === 'ffprobe' && fromFile && (name === 'i' && probeInput || name === 'o' && probeOutput)
-                ? { discardValue: true } : {}) };
-        if (tool === "ffprobe" && (name === "i" || name === "o") && value !== undefined) {
-            // write_option reads slash values before invoking the filename callback,
-            // including duplicate names. A successful read retains the first input
-            // regardless of its contents; prediction never opens that value file.
-            if (fromFile) {
-                globals.push(option);
-                dependenciesFor(option, 'global');
-            }
-            if (name === 'i') {
-                if (probeInput) {
-                    deferred.push({ index, reason: 'native-access' });
-                    continue;
-                }
-                probeInput = true;
-            }
-            else {
-                if (probeOutput) {
-                    deferred.push({ index, reason: 'native-access' });
-                    break;
-                }
-                probeOutput = true;
-            }
-            if (!fromFile)
-                group(name === "i" ? "input" : "output", i, value);
-        }
-        else if (tool === "ffprobe" || !definition.perFile) {
-            globals.push(option);
-            dependenciesFor(option, "global");
-        }
-        else
-            pending.push(option);
-        if (unknownIndirect) {
-            // write_option reads the slash file before opt_default applies its value.
-            // Keep that read, but do not predict past an unknown application boundary.
-            // A native-valid inventory miss still reaches complete late access.
-            if (pending.length) {
-                for (const item of pending)
-                    dependenciesFor(item, 'runtime');
-                groups.push({ kind: 'trailing', index: argv.length, options: pending });
-                pending = [];
-            }
-            deferred.push({ index, reason: 'unknown-option' });
-            break;
-        }
-        if (sequential && definition.exit)
-            break;
-    }
-    if (pending.length)
-        groups.push({ kind: "trailing", index: argv.length, options: pending });
-    const probeFormat = tool === "ffprobe" ? [...globals].reverse().find(option => option.name === "f") : undefined;
-    if (probeFormat?.value && !probeFormat.fromFile && byteText(probeFormat.value) === "lavfi") {
-        for (let i = dependencies.length - 1; i >= 0; i--) {
-            const dependency = dependencies[i];
-            if (dependency.role !== "input")
-                continue;
-            dependencies.splice(i, 1);
-            const parsed = filterResources(dependency.value);
-            for (const file of parsed.resources)
-                dependencies.push({ ...resource(dependency.index, file.value, "filter-resource", file.access ?? "read", "runtime", file.literal), literal: file.literal, ...(file.filterReader ? { filterReader: file.filterReader } : {}), ...(file.kind ? { kind: file.kind } : {}) });
-            if (!parsed.complete)
-                deferred.push({ index: dependency.index, reason: 'filter-syntax' });
-            deferred.push({ index: dependency.index, reason: "filter-runtime" });
-        }
-    }
-    // Discovery ordering is argv ordering, not an assertion about native open order.
-    dependencies.sort((a, b) => a.index - b.index);
-    return { tool, grammarRevision, argv, globals, groups, dependencies, deferred };
-}

package/dist/media-cli/engine.js

@@ -1,190 +0,0 @@
-import { captureJobSource, nativeArgvByteLimit, assertJobInvocation, assertNativeProcessView } from "../remote-execution/index.js";
-/** The host binds the supplied scoped filesystem and borrowed IO to its
- * authenticated session. Nothing is recovered from an earlier invocation. */
-export function createMediaEngine(options) {
-    options = Object.freeze({ ...options });
-    return {
-        execute(request) {
-            // Defer acquisition until the synchronous cleanup registration has finished.
-            const argv = request.args;
-            // Admit each slot before copying it or observing a later slot. An invalid
-            // starting process description must not trigger dependency acquisition.
-            let args;
-            let env;
-            try {
-                if (!Array.isArray(argv))
-                    throw new TypeError('Incomplete native argv');
-                if (argv.length > nativeArgvByteLimit)
-                    throw new TypeError('Native argv limit');
-                const argumentCount = argv.length;
-                let remaining = nativeArgvByteLimit;
-                args = Array.from({ length: argumentCount }, (_, index) => {
-                    if (!Object.hasOwn(argv, index))
-                        throw new TypeError('Incomplete native argv');
-                    const arg = argv[index];
-                    if (!(arg instanceof Uint8Array))
-                        throw new TypeError('Incomplete native argv');
-                    // Public length/search properties can be replaced on a byte carrier.
-                    // Budget its intrinsic span before copying or observing another slot;
-                    // inspect only the owned octets, without speculative caller methods.
-                    const span = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(arg);
-                    if (span > 1048576)
-                        throw new TypeError('Invalid native octets');
-                    if (span >= remaining)
-                        throw new TypeError('Native argv limit');
-                    remaining -= span + 1;
-                    const owned = new Uint8Array(arg);
-                    if (owned.includes(0))
-                        throw new TypeError('NUL in native argv');
-                    return owned;
-                });
-                if (argv.length !== argumentCount)
-                    throw new TypeError('Incomplete native argv');
-                const exported = request.env;
-                if (!exported || typeof exported !== 'object' || Array.isArray(exported))
-                    throw new TypeError('Invalid native environment');
-                env = { ...exported };
-            }
-            catch (cause) {
-                return Promise.reject(cause);
-            }
-            const cleanups = [];
-            let finalizing = false;
-            // Preserve extension capabilities without invoking speculative accessors.
-            // Only the process description belongs to synchronous admission; the
-            // binder/native adapter decides when to access any additional capability.
-            const extensions = Object.fromEntries(Object.entries(Object.getOwnPropertyDescriptors(request))
-                .filter(([key]) => !['command', 'args', 'cwd', 'env', 'fs', 'signal', 'registerCleanup'].includes(key)));
-            const owned = Object.defineProperties({ command: request.command, cwd: request.cwd,
-                fs: request.fs, signal: request.signal, args, env,
-                registerCleanup(cleanup) {
-                    if (finalizing)
-                        throw new Error('Media invocation cleanup admission closed');
-                    cleanups.push(cleanup);
-                },
-            }, extensions);
-            const signal = owned.signal;
-            const sourceCapability = owned.fs;
-            // Admission metadata is retained in this call, before either the caller
-            // or the asynchronous binder can replace the source's method table.
-            let admittedSource;
-            try {
-                if (sourceCapability && typeof sourceCapability === 'object')
-                    admittedSource = captureJobSource(sourceCapability);
-            }
-            catch (cause) {
-                return Promise.reject(cause);
-            }
-            let registered;
-            let registrationFailed;
-            const admission = new Promise((resolve, reject) => {
-                registered = resolve;
-                registrationFailed = reject;
-            });
-            const completion = admission.then(async () => {
-                let primary;
-                let result;
-                try {
-                    signal.throwIfAborted();
-                    if (typeof owned.command !== 'string' || !owned.command || owned.command.includes('\0')
-                        || new TextDecoder('utf-8', { ignoreBOM: true }).decode(new TextEncoder().encode(owned.command)) !== owned.command)
-                        throw new TypeError('Invalid native command identity');
-                    if (!sourceCapability || typeof sourceCapability !== 'object')
-                        throw new TypeError('Canonical source capability required');
-                    if (!owned.cwd.startsWith('/') || owned.cwd.includes('\0') || new TextDecoder('utf-8', { ignoreBOM: true }).decode(new TextEncoder().encode(owned.cwd)) !== owned.cwd)
-                        throw new TypeError('Absolute lossless logical cwd required');
-                    for (const [key, value] of Object.entries(owned.env)) {
-                        if (!key || key.includes('=') || [key, value].some(text => typeof text !== 'string' || text.includes('\0') || new TextDecoder('utf-8', { ignoreBOM: true }).decode(new TextEncoder().encode(text)) !== text))
-                            throw new TypeError('Invalid native environment');
-                    }
-                    const cwd = Array.from(new TextEncoder().encode(owned.cwd));
-                    const originalArgv = owned.args.map(arg => Array.from(arg));
-                    assertNativeProcessView(cwd, originalArgv);
-                    const process = { command: owned.command, cwd: owned.cwd, args: owned.args,
-                        env: owned.env, exported: { ...owned.env } };
-                    const bound = await options.bind(owned);
-                    signal.throwIfAborted();
-                    // Public binding observations cannot substitute another executor or
-                    // scratch authority for the capability acquired by this invocation.
-                    const job = bound.job;
-                    const execute = job.execute.bind(job);
-                    const binding = bound.invocation;
-                    // A structural binder may carry private staging or previous-process
-                    // properties. Observe only binding metadata; cwd/argv belong to this
-                    // invocation and never come from the binder's filesystem view.
-                    const invocation = {
-                        sessionId: binding.sessionId, epoch: binding.epoch, buildId: binding.buildId,
-                        sourceAuthorityId: binding.sourceAuthorityId, bindingId: binding.bindingId,
-                        materializationId: binding.materializationId, manifestId: binding.manifestId,
-                        manifestRevision: binding.manifestRevision, directoryRevision: binding.directoryRevision,
-                        cwd, originalArgv,
-                    };
-                    assertJobInvocation(invocation);
-                    // The host also retains this request while constructing its native
-                    // adapter. Require its process view and source to agree with our
-                    // private admission copies. Binding metadata accessors can change
-                    // them too; finish observing
-                    // the acquired binding before checking the process at admission.
-                    // Replacing them during binding would select another native definition
-                    // or execute with settings that never passed admission.
-                    // Environment entries began as owned data properties. Do not invoke
-                    // replacement accessors during the final comparison: they could alter
-                    // argv or cwd after those fields have already passed admission.
-                    const environment = Object.getOwnPropertyDescriptors(process.env);
-                    const description = Object.getOwnPropertyDescriptors(owned);
-                    const argumentsView = Object.getOwnPropertyDescriptors(process.args);
-                    if (Object.entries({ command: process.command, cwd: process.cwd, fs: sourceCapability,
-                        signal, args: process.args, env: process.env }).some(([key, value]) => !Object.hasOwn(description, key) || !('value' in description[key]) || description[key].value !== value)
-                        || process.args.length !== originalArgv.length
-                        || originalArgv.some((arg, index) => {
-                            const slot = argumentsView[index];
-                            // Binder-installed getters can mutate cwd or a previously checked
-                            // argument during comparison. Admit only owned data slots without
-                            // invoking those getters at the process boundary.
-                            if (!slot || !('value' in slot) || !(slot.value instanceof Uint8Array))
-                                return true;
-                            const bytes = new Uint8Array(slot.value);
-                            return bytes.length !== arg.length || arg.some((byte, offset) => bytes[offset] !== byte);
-                        })
-                        || Object.keys(environment).length !== Object.keys(process.exported).length
-                        || Object.entries(process.exported).some(([key, value]) => !Object.hasOwn(environment, key)
-                            || !('value' in environment[key]) || environment[key].value !== value || !environment[key].enumerable))
-                        throw new Error('Media process binding changed');
-                    signal.throwIfAborted();
-                    const native = await execute(invocation, signal, sourceCapability, admittedSource);
-                    signal.throwIfAborted();
-                    const exitCode = native?.exitCode;
-                    if (!Number.isInteger(exitCode) || exitCode < 0 || exitCode > 255)
-                        throw new TypeError('Invalid native exit status');
-                    result = { exitCode };
-                }
-                catch (cause) {
-                    primary = { cause };
-                }
-                // Binding acquisition can fail or settle after cancellation. Its owned
-                // resources belong to this invocation even without a shell registrar.
-                finalizing = true;
-                const results = await Promise.allSettled(cleanups.map(cleanup => Promise.resolve().then(cleanup)));
-                const failures = results.filter(result => result.status === 'rejected');
-                if (failures.length)
-                    throw new AggregateError([
-                        ...(primary ? [primary.cause] : []), ...failures.map(result => result.reason),
-                    ], 'Media invocation cleanup failed', primary);
-                if (primary)
-                    throw primary.cause;
-                return result;
-            });
-            try {
-                request.registerCleanup?.(async () => { await completion; });
-            }
-            catch (cause) {
-                // No binding has been acquired. Settle the same barrier a registrar may
-                // already have retained, without opening admission after its failure.
-                registrationFailed(cause);
-                return completion;
-            }
-            registered();
-            return completion;
-        },
-    };
-}

package/dist/media-cli/filename-expression.js

@@ -1,147 +0,0 @@
-import { byteText } from './bytes.js';
-/** Tokenize filename languages only in a grammar position that admits them.
- * No frame expansion, metadata evaluation, strftime, globbing or filesystem I/O.
- * Sequence readers pass false for native flags=0 (one counter); the default
- * permits img2enc's MULTIPLE flag. Other dialects ignore that parameter. */
-export function parseFilenameExpression(value, dialect, multipleCounters = true) {
-    const input = byteText(value), tokens = [];
-    let literal = '', begin = 0, complete = true;
-    const flush = (end) => { if (literal)
-        tokens.push({ kind: 'literal', value: literal, start: begin, end }); literal = ''; };
-    if (dialect === 'dash-resource') {
-        // dashdec.c get_content_url performs case-insensitive string replacement
-        // for these two exact tags after joining the complete resource URL. This
-        // reader does not apply ff_dash_fill_tmpl's counters, formatting or $$.
-        const folded = input.toLowerCase();
-        for (let i = 0; i < input.length;) {
-            const tag = ['$representationid$', '$bandwidth$'].find(tag => folded.startsWith(tag, i));
-            if (tag) {
-                flush(i);
-                tokens.push({ kind: 'template', value: input.slice(i + 1, i + tag.length - 1), start: i, end: i + tag.length });
-                i += tag.length;
-            }
-            else {
-                if (!literal)
-                    begin = i;
-                literal += input[i++];
-            }
-        }
-        flush(input.length);
-        return { dialect, tokens, complete };
-    }
-    if (dialect === 'hls') {
-        let cursor = 0;
-        while (cursor < input.length) {
-            const start = input.indexOf('{$', cursor);
-            const end = start < 0 ? input.length : start;
-            if (end > cursor)
-                tokens.push({ kind: 'literal', value: input.slice(cursor, end), start: cursor, end });
-            if (start < 0)
-                break;
-            const close = input.indexOf('}', start + 2);
-            const name = input.slice(start + 2, close < 0 ? input.length : close);
-            if (close < 0 || !name || ![...name].every(c => 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-'.includes(c)))
-                complete = false;
-            tokens.push({ kind: 'property', value: name, start, end: close < 0 ? input.length : close + 1 });
-            cursor = close < 0 ? input.length : close + 1;
-        }
-        return { dialect, tokens, complete };
-    }
-    const marker = dialect === 'dash' ? '$' : '%';
-    for (let i = 0; i < input.length;) {
-        if (input[i] !== marker) {
-            if (!literal)
-                begin = i;
-            literal += input[i++];
-            continue;
-        }
-        const start = i++;
-        if (input[i] === marker) {
-            if (!literal)
-                begin = start;
-            literal += marker;
-            i++;
-            continue;
-        }
-        flush(start);
-        if (dialect === 'dash') {
-            const end = input.indexOf('$', i);
-            if (end < 0) {
-                complete = false;
-                break;
-            }
-            const name = input.slice(i, end), percent = name.indexOf('%'), key = percent < 0 ? name : name.slice(0, percent);
-            if (!['RepresentationID', 'Number', 'Bandwidth', 'Time'].includes(key))
-                complete = false;
-            if (percent >= 0) {
-                const format = name.slice(percent + 1);
-                // Registered dash.c accepts exactly %0[width]d, where width is one
-                // digit. Unsupported tags remain native literal/fallback decisions.
-                if (key === 'RepresentationID' || format.length !== 3 || format[0] !== '0'
-                    || !'0123456789'.includes(format[1]) || format[2] !== 'd')
-                    complete = false;
-            }
-            tokens.push({ kind: 'template', value: name, start, end: end + 1 });
-            i = end + 1;
-        }
-        else if (dialect === 'imagemagick' && input[i] === '[') {
-            const content = ++i;
-            let depth = 1;
-            while (i < input.length && depth) {
-                if (input[i] === '\\' && i + 1 < input.length) {
-                    i += 2;
-                    continue;
-                }
-                if (input[i] === '[')
-                    depth++;
-                else if (input[i] === ']')
-                    depth--;
-                i++;
-            }
-            if (depth) {
-                complete = false;
-                break;
-            }
-            tokens.push({ kind: 'property', value: input.slice(content, i - 1), start, end: i });
-        }
-        else {
-            const digits = i;
-            let width = 0;
-            while (i < input.length && '0123456789'.includes(input[i])) {
-                // Registered utils.c ff_bprint_get_frame_filename guards the width
-                // before consuming each digit, including widths before a literal %.
-                // Never allocate or expand that width during advisory discovery.
-                if (dialect === 'sequence' && width >= Math.floor(2147483647 / 10) - 255) {
-                    return { dialect, tokens, complete: false };
-                }
-                if (dialect === 'sequence')
-                    width = width * 10 + Number(input[i]);
-                i++;
-            }
-            if (dialect === 'sequence' && input[i] === '%') {
-                begin = start;
-                literal = '%';
-                i++;
-                continue;
-            }
-            if (input[i] === 'd')
-                tokens.push({ kind: 'counter', value: input.slice(digits, i), start, end: ++i });
-            else if (dialect === 'imagemagick' && i === digits && i < input.length)
-                tokens.push({ kind: 'property', value: input[i++], start, end: i });
-            else {
-                complete = false;
-                if (i < input.length)
-                    i++;
-            }
-        }
-    }
-    flush(input.length);
-    if (dialect === 'sequence') {
-        // img2dec calls the native formatter with flags=0; img2enc permits
-        // MULTIPLE. Both readers require at least one counter, even with %%.
-        const counters = tokens.filter(token => token.kind === 'counter').length;
-        if (!counters || !multipleCounters && counters > 1)
-            complete = false;
-    }
-    return { dialect, tokens, complete };
-}

package/dist/media-cli/filesystem.js

@@ -1,35 +0,0 @@
-import { createEffectStore, createJobBinding } from "../remote-execution/index.js";
-/** Own one invocation's inspection/retrieval ledger while native callbacks act
- * directly on the scoped canonical filesystem. The host must fork independent
- * output read retains; it must not reopen former output pathnames. The session
- * owner closes effects after retrieval, separately from native job cleanup.
- * effects.inspect/download expose the partial ledger and retained files;
- * effects.freshness issues an optional host-qualified content version for
- * guarded stat/download calls, including direct interrupted range resumes.
- * A retained identity alone does not certify an unchanged downloaded prefix.
- * direct stat/download reject untouched retained inputs, just as tree retrieval
- * excludes them; a settled mutation grants output membership immediately.
- * effects.inspectTree exposes surviving byte paths and detached identities;
- * unavailablePaths identifies settled outputs lacking a usable retained identity;
- * failed output retains stay in the effect manifest with retrievalFailures;
- * tree retrieval copies independent available files before reporting failure.
- * unresolvedEffects identifies unknown or unlocated namespace settlement,
- * including receipts without both pathname and identity; independent known
- * outputs still transfer, while the result reports incomplete reconstruction.
- * effects.retrieve copies a surviving byte-path tree for API-only consumers.
- * effects.reconstruct replays ordered settlement receipts. Preserve its returned
- * transfer.cursor to resume only on the same invocation and destination authority.
- * Retrieval cursors belong to their destination authority. Recreated download
- * adapters must supply the same identity and preserve acknowledged contents.
- * Settled opens after output creation locate surviving retained aliases and
- * displace stale names without treating untouched replacement files as outputs.
- * Initial opens also preserve locations through renames before the first write;
- * untouched input spellings remain excluded from the retrieved output tree.
- * Settled namespace removals are recorded alongside writes; retrieval does not
- * recreate removed generated directories or unchanged zero-progress inputs.
- * Native callbacks continue applying live canonical effects during execution. */
-export function createCanonicalMediaFilesystem(options) {
-    const effects = createEffectStore({ maxEffects: options.maxCallbacks, maxFrameBytes: options.maxIoBytes ?? 1048576 });
-    const job = createJobBinding({ ...options, effects });
-    return { job, effects };
-}