@kubohiroya/turbowarp-extension-loader 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## Unreleased
 
+## 0.2.1
+
+Default size limits that fit real extensions. A bundled story runtime of about 7 MiB was rejected in
+every Plus form (`INVALID_ARCHIVE` for embedded, `INVALID_BYTES` for remote and cached) although
+the same project loaded from a Data URL, because the loader read at most 1 MiB per extension while
+the project codec stored entries up to 16 MiB.
+
+- The loader, `./project-catalog` and `./project-authoring` default to 16 MiB per extension and
+  64 MiB in total, the codec's per-entry and expansion limits. All defaults now come from one module,
+  so an entry the codec accepts is one the loader reads. Hosts can still lower them.
+- `./project-codec` accepts a `project.json` of up to 32 MiB by default (it was 4 MiB), the value
+  the TurboWarp Plus editor already passed; the same project's `project.json` is 6.8 MB once its
+  runtime moves out to an archive entry, so a host using the defaults, such as the packager page,
+  rejected it before any extension was read.
+- `createMemoryContentCache` defaults to 32 MiB and the IndexedDB cache to a 16 MiB decompressed
+  maximum, so a cache holds an extension of the largest default size.
+- `migrateLegacyDataURL` accepts a Data URL long enough for a 16 MiB extension (it stopped at
+  4,194,304 characters), and its base64 check is linear: the previous pattern overflowed the regex
+  stack on a payload of a few MiB and reported `INVALID_ENCODING`.
+
 ## 0.2.0
 
 A third source form for extensions whose bytes should be reachable both from a canonical published

package/README.ja.md

@@ -74,7 +74,7 @@ await loader.unload();
 - `./packager` はEmbedded / Remote変換、明示承認付きData URL移行、lock/license metadata保持、offline SB3準備を提供します。外部依存資源がある拡張は同梱を推測せず拒否します。署名・発行者鍵のpinningはホスト側で追加できる設計で、初期実装は内容・取得元に束縛したセッション承認です。
 - ZIP の実装は `createProjectIO({zip: JSZip})` に注入します。core の codec が ZIP central directory を直接検査し、重複・経路・宣言容量を検証してから、ストリーム展開の実容量と CRC32 を検査します。外部実装の archive port を使う場合も同等の検証が必要です。
 
-既定値は最大64拡張、1拡張1 MiB、合計8 MiB、取得・認可30秒です。データURLやHTTPの開発モード例外はありません。標準 TurboWarp / 非対応エディターが独自 Manifest と ZIP エントリを破棄する可能性があるため、保持対応のないホストでの再保存は移行手段になりません。
+既定値は最大64拡張、1拡張16 MiB、合計64 MiB、取得・認可30秒です。1拡張と合計の既定値は project codec の1 entry と全展開量の上限に揃えてあり、作品に格納できる拡張ファイルは Loader でも読めます。ホストは loader options で下げられます。データURLやHTTPの開発モード例外はありません。標準 TurboWarp / 非対応エディターが独自 Manifest と ZIP エントリを破棄する可能性があるため、保持対応のないホストでの再保存は移行手段になりません。
 
 ## IndexedDB 永続キャッシュ（ブラウザホスト用）
 
@@ -90,13 +90,13 @@ import {createIndexedDBContentCache}
 const cache = createIndexedDBContentCache({
     databaseName: 'turbowarp-plus-extension-cache',
     maxBytes: 32 * 1024 * 1024, // compressed storage quota
-    maxDecompressedBytes: 8 * 1024 * 1024
+    maxDecompressedBytes: 16 * 1024 * 1024
 });
 const loader = createExtensionLoader({...hostPorts, cache});
 // 終了・ログアウトなどの明示操作で await cache.clear() / await cache.close()
 ```
 
-- キーは lowercase SHA-256 hex。**保存する値は生JSではなく gzip 圧縮されたバイト列**（format: `gzip-v1`、元サイズを併記）。取得時に展開して Loader に返します。既定32 MiB は**圧縮後の総保存容量**、展開後の最大サイズは8 MiB、有効期限なし。容量超過時は最終アクセス順LRUで削除します。旧形式の非圧縮エントリは読み込まず削除します。
+- キーは lowercase SHA-256 hex。**保存する値は生JSではなく gzip 圧縮されたバイト列**（format: `gzip-v1`、元サイズを併記）。取得時に展開して Loader に返します。既定32 MiB は**圧縮後の総保存容量**、展開後の最大サイズは16 MiB（1拡張の既定値）、有効期限なし。容量超過時は最終アクセス順LRUで削除します。旧形式の非圧縮エントリは読み込まず削除します。
 - 展開は出力サイズを制限し、改ざん・gzip破損や展開超過を拒否します。ブラウザの `CompressionStream` / `DecompressionStream` が必要です。非対応環境で生JSへ黙って切り替えて保存することはありません。
 - キャッシュを利用した際にも Loader コアが **取得バイト列の SHA-256 を再検証** し、毎回 trustProvider の権限判定を適用します。キャッシュが信頼判断を代行することはありません。
 - キャッシュは IndexedDB を使用できるブラウザ origin に紐付き、ブラウザのストレージ削除・プライベートモード・容量不足等で消える場合があります。ブラウザからの永続化保証はありません。
@@ -130,13 +130,13 @@ npm run check
 
 `prepare` は JSON object / string / UTF-8 bytes / ArrayBuffer / Blob と SB3 ZIP を受け取り、`{manifest, input, context}` を返します。Manifest があれば core で検証し、legacy input の Plus ID に対する `extensionURLs` を除去して自動 URL 実行を防ぎます。ID 自体は GUI の登録 hook 用に残します。保存時は Manifest・元の Plus URL metadata・embedded bytes・未知の ZIP entry・未知の top-level metadata を復元します。`restoreArchive` は GUI の `toJSON` hook が `project.json` を復元済みであることを前提とします。
 
-未対応形式は ZIP64、multidisk、暗号化、STORE/DEFLATE 以外、UTF-8 以外の非 ASCII entry 名、Unicode path extra field です。既定上限は archive と全展開量64 MiB、1 entry16 MiB、project.json 4 MiB、4096 entry、圧縮比1000です。上限はホスト起動設定で変更できます。Manifest のない ZIP もこの安全検査を受け、通過後は元 input をそのまま返します。このため、従来 VM が許していた未対応 ZIP もフラグ有効時には拒否されます。フラグ OFF では codec 自体を呼びません。
+未対応形式は ZIP64、multidisk、暗号化、STORE/DEFLATE 以外、UTF-8 以外の非 ASCII entry 名、Unicode path extra field です。既定上限は archive と全展開量64 MiB、1 entry16 MiB、project.json 32 MiB、4096 entry、圧縮比1000です。上限はホスト起動設定で変更できます。Manifest のない ZIP もこの安全検査を受け、通過後は元 input をそのまま返します。このため、従来 VM が許していた未対応 ZIP もフラグ有効時には拒否されます。フラグ OFF では codec 自体を呼びません。
 
 ## 追加のホスト向けAPI
 
 - `isAuthorizedCode(value)` はコアが発行し現在登録中の認可証跡だけを識別します。コピー・作品データによる偽造を拒否し、transaction終了時に失効します。
 - `./session-trust` の `createSessionTrustProvider` はid/digest/source/version/publisher/capabilities/dependenciesへ束縛した承認を保持します。明示された外部ホストのURL/execution方針をUI前に毎回適用し、判定できないEmbedded要求は拒否します。
-- `./memory-cache` の `createMemoryContentCache` はコピー・容量・TTL・LRUを提供し、コアはヒット時にも内容を再検証します。
+- `./memory-cache` の `createMemoryContentCache` はコピー・容量（既定32 MiB、既定最大サイズの拡張2件分）・TTL・LRUを提供し、コアはヒット時にも内容を再検証します。
 - `./webpack4` はGUI/Packager用の同一コアをwebpack 4でビルドするための構成補助です。
 
 実GUI、実Packager 3.14.0の生成HTML、Desktop 1.17.0の互換性はEditor側のE2Eが担当します。標準Desktopや標準WebへLoaderを無断インストールしません。標準Desktopの保存は独自Manifest/ZIPエントリを破棄することを実測しているため、保持対応エディターで保存してください。

package/README.md

@@ -74,7 +74,7 @@ The real VM adapter is owned by `scratch-gui/src/lib/tw-plus-extension-registrar
 - `./packager` provides Embedded / Remote conversion, Data URL migration with explicit approval, lock and license metadata preservation, and offline SB3 preparation. An extension with external dependent resources is rejected rather than guessed into a bundle. Signature and publisher key pinning can be added by the host; the initial implementation is session approval bound to content and source.
 - The ZIP implementation is injected through `createProjectIO({zip: JSZip})`. The core codec inspects the ZIP central directory directly and validates duplicates, paths and declared capacity before checking the real expanded size and CRC32 of the stream. An externally implemented archive port needs equivalent validation.
 
-The defaults are at most 64 extensions, 1 MiB per extension, 8 MiB in total, and 30 seconds for fetching and authorization. There is no development-mode exception for Data URLs or HTTP. Because standard TurboWarp and unsupported editors may discard the non-standard Manifest and ZIP entries, re-saving in a host without preservation support is not a migration path.
+The defaults are at most 64 extensions, 16 MiB per extension, 64 MiB in total, and 30 seconds for fetching and authorization. The per-extension and total defaults equal the project codec's per-entry and expansion limits, so any extension file a project can carry is also one the Loader reads; a host can lower them through its loader options. There is no development-mode exception for Data URLs or HTTP. Because standard TurboWarp and unsupported editors may discard the non-standard Manifest and ZIP entries, re-saving in a host without preservation support is not a migration path.
 
 ## IndexedDB persistent cache (for browser hosts)
 
@@ -89,13 +89,13 @@ import {createIndexedDBContentCache}
 const cache = createIndexedDBContentCache({
     databaseName: 'turbowarp-plus-extension-cache',
     maxBytes: 32 * 1024 * 1024, // compressed storage quota
-    maxDecompressedBytes: 8 * 1024 * 1024
+    maxDecompressedBytes: 16 * 1024 * 1024
 });
 const loader = createExtensionLoader({...hostPorts, cache});
 // On an explicit action such as exit or sign-out: await cache.clear() / await cache.close()
 ```
 
-- The key is a lowercase SHA-256 hex digest. **The stored value is gzip-compressed bytes, not raw JS** (format `gzip-v1`, with the original size recorded alongside). It is decompressed on read and returned to the Loader. The default 32 MiB is the **total compressed storage quota**, the maximum decompressed size is 8 MiB, and entries do not expire. On quota overflow, entries are evicted in least-recently-accessed order. Uncompressed entries in the old format are deleted rather than read.
+- The key is a lowercase SHA-256 hex digest. **The stored value is gzip-compressed bytes, not raw JS** (format `gzip-v1`, with the original size recorded alongside). It is decompressed on read and returned to the Loader. The default 32 MiB is the **total compressed storage quota**, the maximum decompressed size is 16 MiB (the per-extension default), and entries do not expire. On quota overflow, entries are evicted in least-recently-accessed order. Uncompressed entries in the old format are deleted rather than read.
 - Decompression bounds the output size and rejects tampering, gzip corruption and oversized expansion. The browser's `CompressionStream` / `DecompressionStream` is required. The adapter never silently falls back to storing raw JS in an unsupported environment.
 - Even on a cache hit, the Loader core **re-verifies the SHA-256 of the returned bytes** and applies the `trustProvider` decision every time. The cache never stands in for a trust decision.
 - The cache is bound to a browser origin that can use IndexedDB, and may disappear when the browser clears storage, in private mode, when storage runs out, and so on. The browser offers no persistence guarantee.
@@ -128,13 +128,13 @@ Wire the Loader inside a host feature flag that is fixed at startup and off by d
 
 `prepare` accepts a JSON object, a string, UTF-8 bytes, an ArrayBuffer, a Blob and an SB3 ZIP, and returns `{manifest, input, context}`. When a Manifest is present, the core validates it and strips `extensionURLs` for Plus IDs in legacy input to prevent automatic URL execution. The IDs themselves remain for the GUI's registration hook. On save it restores the Manifest, the original Plus URL metadata, embedded bytes, unknown ZIP entries and unknown top-level metadata. `restoreArchive` assumes the GUI's `toJSON` hook has already restored `project.json`.
 
-Unsupported formats are ZIP64, multidisk, encryption, compression other than STORE/DEFLATE, non-ASCII entry names that are not UTF-8, and the Unicode path extra field. The default limits are 64 MiB for the archive and for total expansion, 16 MiB per entry, 4 MiB for `project.json`, 4096 entries, and a compression ratio of 1000. The limits are configurable through the host's startup settings. A ZIP without a Manifest goes through the same safety checks, and the original input is returned unchanged once it passes. As a result, an unsupported ZIP that the previous VM accepted is rejected while the flag is on. With the flag off, the codec is not called at all.
+Unsupported formats are ZIP64, multidisk, encryption, compression other than STORE/DEFLATE, non-ASCII entry names that are not UTF-8, and the Unicode path extra field. The default limits are 64 MiB for the archive and for total expansion, 16 MiB per entry, 32 MiB for `project.json`, 4096 entries, and a compression ratio of 1000. The limits are configurable through the host's startup settings. A ZIP without a Manifest goes through the same safety checks, and the original input is returned unchanged once it passes. As a result, an unsupported ZIP that the previous VM accepted is rejected while the flag is on. With the flag off, the codec is not called at all.
 
 ## Additional host-facing API
 
 - `isAuthorizedCode(value)` identifies only an authorization trail issued by the core and currently being registered. Copies and forgeries from project data are rejected, and the trail expires when the transaction ends.
 - `createSessionTrustProvider` in `./session-trust` keeps approval bound to id, digest, source, version, publisher, capabilities and dependencies. It applies the explicit external host URL / execution policy before the UI every time, and rejects an Embedded request it cannot decide.
-- `createMemoryContentCache` in `./memory-cache` provides copying, capacity, TTL and LRU, and the core re-verifies the content even on a hit.
+- `createMemoryContentCache` in `./memory-cache` provides copying, capacity (32 MiB by default, two extensions of the largest default size), TTL and LRU, and the core re-verifies the content even on a hit.
 - `./webpack4` is a configuration helper for building the same core with webpack 4 for the GUI and Packager.
 
 Compatibility with the real GUI, with the HTML generated by the real Packager 3.14.0, and with Desktop 1.17.0 is covered by E2E tests on the Editor side. Do not install the Loader into standard Desktop or standard Web without permission. Saving in standard Desktop has been measured to discard the non-standard Manifest and ZIP entries, so save in an editor that preserves them.

package/dist/index.js

@@ -1,4 +1,5 @@
-const DEFAULTS = Object.freeze({ maxExtensions: 64, maxBytes: 1024 * 1024, maxTotalBytes: 8 * 1024 * 1024, timeoutMs: 30000 });
+import { DEFAULT_LOADER_LIMITS } from './limits.js';
+const DEFAULTS = DEFAULT_LOADER_LIMITS;
 const RESERVED_IDS = new Set(['pen', 'music', 'videoSensing', 'text2speech', 'translate', 'microbit', 'ev3', 'boost', 'wedo2', 'gdxfor', 'makeymakey']);
 const ID = /^[a-zA-Z][a-zA-Z0-9]{0,63}$/;
 const SHA256 = /^[a-f0-9]{64}$/;

package/dist/indexeddb-cache.d.ts

@@ -3,7 +3,7 @@ export interface IndexedDBContentCacheOptions {
     databaseName?: string;
     /** Compressed bytes quota (default 32 MiB). */
     maxBytes?: number;
-    /** Maximum decompressed JS size (default 8 MiB). */
+    /** Maximum decompressed JS size (default 16 MiB, the largest default extension). */
     maxDecompressedBytes?: number;
     now?: () => number;
 }

package/dist/indexeddb-cache.js

@@ -1,8 +1,9 @@
 import { gzipBytes, gunzipBytes } from './cache-gzip.js';
+import { DEFAULT_ENTRY_BYTES } from './limits.js';
 /** Persistent, content-addressed cache. The Loader independently verifies SHA-256 on every hit.
  * Storage is untrusted: this adapter is not an authorization or integrity boundary.
  */
-export function createIndexedDBContentCache({ indexedDB = globalThis.indexedDB, databaseName = 'turbowarp-plus-extension-cache', maxBytes = 32 * 1024 * 1024, maxDecompressedBytes = 8 * 1024 * 1024, now = Date.now } = {}) {
+export function createIndexedDBContentCache({ indexedDB = globalThis.indexedDB, databaseName = 'turbowarp-plus-extension-cache', maxBytes = 32 * 1024 * 1024, maxDecompressedBytes = DEFAULT_ENTRY_BYTES, now = Date.now } = {}) {
     if (!indexedDB || typeof indexedDB.open !== 'function')
         throw new Error('IndexedDB unavailable');
     if (typeof databaseName !== 'string' || !databaseName || !Number.isSafeInteger(maxBytes) || maxBytes < 1 ||

package/dist/limits.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The one source of the default size limits. A file the project codec accepts as an archive entry
+ * must also be one the loader reads, so the per-extension and total defaults are the codec's entry
+ * and expansion limits; real extensions such as a bundled story runtime reach several MiB.
+ */
+export declare const DEFAULT_ENTRY_BYTES: number;
+export declare const DEFAULT_TOTAL_BYTES: number;
+/** A project.json may itself carry large scripts, such as legacy Data URL extensions or story data. */
+export declare const DEFAULT_PROJECT_JSON_BYTES: number;
+export declare const DEFAULT_LOADER_LIMITS: Readonly<{
+    maxExtensions: 64;
+    maxBytes: number;
+    maxTotalBytes: number;
+    timeoutMs: 30000;
+}>;
+/** A cache holds at least one extension of the largest default size. */
+export declare const DEFAULT_MEMORY_CACHE_BYTES: number;
+/** Base64 of the largest default extension, plus room for the `data:` prefix. */
+export declare const MAX_LEGACY_DATA_URL_LENGTH: number;

package/dist/limits.js

@@ -0,0 +1,16 @@
+const MiB = 1024 * 1024;
+/**
+ * The one source of the default size limits. A file the project codec accepts as an archive entry
+ * must also be one the loader reads, so the per-extension and total defaults are the codec's entry
+ * and expansion limits; real extensions such as a bundled story runtime reach several MiB.
+ */
+export const DEFAULT_ENTRY_BYTES = 16 * MiB;
+export const DEFAULT_TOTAL_BYTES = 64 * MiB;
+/** A project.json may itself carry large scripts, such as legacy Data URL extensions or story data. */
+export const DEFAULT_PROJECT_JSON_BYTES = 32 * MiB;
+export const DEFAULT_LOADER_LIMITS = Object.freeze({ maxExtensions: 64, maxBytes: DEFAULT_ENTRY_BYTES,
+    maxTotalBytes: DEFAULT_TOTAL_BYTES, timeoutMs: 30000 });
+/** A cache holds at least one extension of the largest default size. */
+export const DEFAULT_MEMORY_CACHE_BYTES = 2 * DEFAULT_ENTRY_BYTES;
+/** Base64 of the largest default extension, plus room for the `data:` prefix. */
+export const MAX_LEGACY_DATA_URL_LENGTH = Math.ceil(DEFAULT_ENTRY_BYTES / 3) * 4 + 1024;

package/dist/memory-cache.js

@@ -1,5 +1,6 @@
+import { DEFAULT_MEMORY_CACHE_BYTES } from './limits.js';
 /** Bounded host-session storage; the Loader re-verifies bytes on every cache hit. */
-export function createMemoryContentCache({ maxBytes = 8 * 1024 * 1024, ttlMs = 60 * 60 * 1000, now = Date.now } = {}) {
+export function createMemoryContentCache({ maxBytes = DEFAULT_MEMORY_CACHE_BYTES, ttlMs = 60 * 60 * 1000, now = Date.now } = {}) {
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isSafeInteger(ttlMs) || ttlMs < 1 || typeof now !== 'function') {
         throw new TypeError('Invalid cache capacity or expiry');
     }

package/dist/packager.js

@@ -2,6 +2,7 @@ import { LoaderError, validateManifest } from './index.js';
 import { createProjectIO } from './project-codec.js';
 import { collectVerifiedCodes as collect } from './verified-code.js';
 import { readPreparedProject as decodePrepared } from './project-data.js';
+import { MAX_LEGACY_DATA_URL_LENGTH } from './limits.js';
 const encoder = new TextEncoder();
 function fail(code, message) { throw new LoaderError(code, message); }
 const cancelled = (signal) => { if (signal?.aborted)
@@ -118,7 +119,7 @@ export async function prepareOfflinePackage(input, ports, options = {}) {
 }
 /** Migrate a legacy Data URL only after the host explicitly pins and approves its bytes. */
 export async function migrateLegacyDataURL({ id, url, sha256, metadata }, ports, options = {}) {
-    if (typeof url !== 'string' || url.length > 4 * 1024 * 1024)
+    if (typeof url !== 'string' || url.length > MAX_LEGACY_DATA_URL_LENGTH)
         fail('INVALID_SOURCE', 'Invalid or oversized legacy Data URL');
     const match = /^data:(?:application|text)\/(?:javascript|x-javascript)(?:;charset=utf-8)?(;base64)?;?,([\s\S]*)$/i.exec(url);
     if (!match)
@@ -126,7 +127,8 @@ export async function migrateLegacyDataURL({ id, url, sha256, metadata }, ports,
     let bytes;
     try {
         if (match[1]) {
-            if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(match[2]))
+            // A repeated group overflows the regex stack on a multi-MiB payload; this form is linear.
+            if (match[2].length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(match[2]))
                 throw new Error('Invalid base64');
             bytes = Uint8Array.from(atob(match[2]), character => character.charCodeAt(0));
         }

package/dist/project-authoring.js

@@ -2,6 +2,7 @@ import { LoaderError, validateManifest } from './index.js';
 import { createProjectIO } from './project-codec.js';
 import { readPreparedProject } from './project-data.js';
 import { collectVerifiedCodes } from './verified-code.js';
+import { DEFAULT_LOADER_LIMITS } from './limits.js';
 const encoder = new TextEncoder();
 function fail(code, message, id) { throw new LoaderError(code, message, id); }
 const plainObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value) &&
@@ -28,7 +29,7 @@ export async function prepareExtensionAddition(input, request, ports, { zip: Zip
     }
     if (typeof ports?.trustProvider?.authorize !== 'function')
         fail('INVALID_PORT', 'An explicit host trust provider is required');
-    const limits = { maxBytes: 1024 * 1024, timeoutMs: 30000, ...loaderOptions };
+    const limits = { maxBytes: DEFAULT_LOADER_LIMITS.maxBytes, timeoutMs: DEFAULT_LOADER_LIMITS.timeoutMs, ...loaderOptions };
     for (const key of ['maxBytes', 'maxTotalBytes', 'maxExtensions', 'timeoutMs']) {
         const value = limits[key];
         if (value !== undefined && (!Number.isSafeInteger(value) || value < 1))

package/dist/project-catalog.js

@@ -2,6 +2,7 @@ import { LoaderError, validateManifest } from './index.js';
 import { createProjectIO } from './project-codec.js';
 import { readPreparedProject } from './project-data.js';
 import { collectVerifiedCodes } from './verified-code.js';
+import { DEFAULT_LOADER_LIMITS, DEFAULT_TOTAL_BYTES } from './limits.js';
 const encoder = new TextEncoder();
 const digest = async (bytes) => Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes)), value => value.toString(16).padStart(2, '0')).join('');
 function fail(code, message, id) { throw new LoaderError(code, message, id); }
@@ -11,8 +12,7 @@ export async function readProjectAuthoringState(input, { zip, signal, archiveOpt
     return prepared.manifest;
 }
 export async function prepareCatalogExtensionChanges(input, requests, ports, { zip: Zip, signal: externalSignal, loaderOptions = {}, archiveOptions } = {}) {
-    const limits = { maxExtensions: 64, maxBytes: 1024 * 1024, maxTotalBytes: 8 * 1024 * 1024,
-        timeoutMs: 30000, ...loaderOptions };
+    const limits = { ...DEFAULT_LOADER_LIMITS, ...loaderOptions };
     for (const key of ['maxExtensions', 'maxBytes', 'maxTotalBytes', 'timeoutMs']) {
         if (!Number.isSafeInteger(limits[key]) || limits[key] < 1)
             fail('INVALID_OPTIONS', `Invalid ${key}`);
@@ -21,7 +21,7 @@ export async function prepareCatalogExtensionChanges(input, requests, ports, { z
         fail('INVALID_ADDITION', 'A bounded catalog selection is required');
     }
     if (input instanceof Uint8Array || input instanceof ArrayBuffer) {
-        if (input.byteLength > (archiveOptions?.maxArchiveBytes ?? 64 * 1024 * 1024)) {
+        if (input.byteLength > (archiveOptions?.maxArchiveBytes ?? DEFAULT_TOTAL_BYTES)) {
             fail('ARCHIVE_SIZE_LIMIT', 'Project exceeds the archive byte limit');
         }
         input = input.slice(0);

package/dist/project-codec.js

@@ -1,6 +1,7 @@
 import { discoverManifest, LoaderError } from './index.js';
-const DEFAULTS = Object.freeze({ maxArchiveBytes: 64 * 1024 * 1024, maxTotalBytes: 64 * 1024 * 1024,
-    maxEntryBytes: 16 * 1024 * 1024, maxProjectBytes: 4 * 1024 * 1024, maxEntries: 4096, maxRatio: 1000 });
+import { DEFAULT_ENTRY_BYTES, DEFAULT_PROJECT_JSON_BYTES, DEFAULT_TOTAL_BYTES } from './limits.js';
+const DEFAULTS = Object.freeze({ maxArchiveBytes: DEFAULT_TOTAL_BYTES, maxTotalBytes: DEFAULT_TOTAL_BYTES,
+    maxEntryBytes: DEFAULT_ENTRY_BYTES, maxProjectBytes: DEFAULT_PROJECT_JSON_BYTES, maxEntries: 4096, maxRatio: 1000 });
 const decoder = new TextDecoder('utf-8', { fatal: true });
 const encoder = new TextEncoder();
 function fail(message) { throw new LoaderError('INVALID_ARCHIVE', message); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubohiroya/turbowarp-extension-loader",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Host-independent verified TurboWarp Plus extension loading core",
   "keywords": [
     "turbowarp",