@loaders.gl/scene 5.0.0-beta.4 → 5.0.0-beta.5

package/dist/usd/lib/parse-usdc.js

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+import { USDCParser } from '../libs/usdc-parser.js';
+/** Decodes the supported binary crate subset into the same stage model as USDA. */
+export function parseUSDC(data, url) {
+    if (data.byteLength < 88 || data.byteLength > 64 * 1024 * 1024)
+        throw new Error('USDC: invalid input size');
+    const bytes = new Uint8Array(data);
+    if (bytes[8] !== 0 || bytes[9] !== 8 || bytes[10] !== 0)
+        throw new Error('USDC: initial decoder requires crate version 0.8.0');
+    const reader = new DataView(data);
+    const table = reader.getBigUint64(16, true);
+    if (table > BigInt(data.byteLength - 8))
+        throw new Error('USDC: invalid section table');
+    const offset = Number(table), count = reader.getBigUint64(offset, true);
+    if (count > 16n || offset + 8 + Number(count) * 32 > data.byteLength)
+        throw new Error('USDC: invalid section table length');
+    const sectionNames = new Set();
+    for (let index = 0; index < Number(count); index++) {
+        const entry = offset + 8 + index * 32;
+        const nameBytes = bytes.subarray(entry, entry + 16);
+        const terminator = nameBytes.indexOf(0);
+        const name = new TextDecoder().decode(nameBytes.subarray(0, terminator < 0 ? nameBytes.length : terminator));
+        if (sectionNames.has(name))
+            throw new Error('USDC: duplicate section');
+        sectionNames.add(name);
+        const start = reader.getBigUint64(entry + 16, true), size = reader.getBigUint64(entry + 24, true);
+        if (start < 88n || start + size > BigInt(data.byteLength))
+            throw new Error('USDC: section out of bounds');
+    }
+    for (const name of ['TOKENS', 'STRINGS', 'FIELDS', 'FIELDSETS', 'PATHS', 'SPECS'])
+        if (!sectionNames.has(name))
+            throw new Error('USDC: missing required section');
+    const { specsByPath } = new USDCParser().parseData(data);
+    const prims = new Map();
+    for (const [path, specification] of Object.entries(specsByPath)) {
+        if (specification.specType === 7 && path === '/')
+            continue;
+        if (specification.specType === 1 || specification.specType === 8)
+            continue;
+        if (specification.specType !== 6 || !/^\/(?:[A-Za-z_][\w:]*\/)*[A-Za-z_][\w:]*$/.test(path))
+            throw new Error('USDC: unsupported prim specification');
+        const fields = specification.fields;
+        const specifier = fields.specifier ?? 0;
+        if (specifier !== 0 && specifier !== 1 && specifier !== 2)
+            throw new Error('USDC: invalid prim specifier');
+        const metadata = convertFields(fields, new Set(['specifier', 'typeName', 'primChildren', 'properties']));
+        prims.set(path, {
+            name: path.slice(path.lastIndexOf('/') + 1),
+            path,
+            sourceUrl: url,
+            type: String(fields.typeName || ''),
+            specifier: ['def', 'over', 'class'][specifier],
+            attributes: Object.create(null),
+            metadata,
+            variants: Object.create(null),
+            children: []
+        });
+    }
+    const roots = [];
+    for (const prim of prims.values()) {
+        const parentPath = prim.path.slice(0, prim.path.lastIndexOf('/'));
+        if (!parentPath)
+            roots.push(prim);
+        else {
+            const parent = prims.get(parentPath);
+            if (!parent)
+                throw new Error('USDC: missing parent prim');
+            parent.children.push(prim);
+        }
+    }
+    orderPrims(roots, specsByPath['/']?.fields.primChildren);
+    for (const prim of prims.values())
+        orderPrims(prim.children, specsByPath[prim.path]?.fields.primChildren);
+    for (const [path, specification] of Object.entries(specsByPath)) {
+        if (specification.specType !== 1 && specification.specType !== 8)
+            continue;
+        const separator = path.indexOf('.');
+        const prim = prims.get(path.slice(0, separator));
+        if (separator < 0 || !prim)
+            throw new Error('USDC: property has no owning prim');
+        const name = path.slice(separator + 1), fields = specification.fields;
+        const type = specification.specType === 8 ? 'rel' : String(fields.typeName || '');
+        const value = convertAttributeValue(specification.specType === 8 ? fields.targetPaths : fields.default, type);
+        const metadata = convertFields(fields, new Set(['typeName', 'default', 'targetPaths', 'timeSamples']));
+        if (fields.timeSamples !== undefined)
+            metadata.timeSamples = convertTimeSamples(fields.timeSamples, type);
+        prim.attributes[name] = {
+            name,
+            type,
+            value,
+            metadata
+        };
+    }
+    return {
+        format: 'usdc',
+        url,
+        metadata: convertFields(specsByPath['/']?.fields || {}, new Set(['primChildren'])),
+        rootPrims: roots,
+        layers: []
+    };
+}
+/** Converts raw field dictionaries while retaining authored values and time samples. */
+function convertFields(fields, excluded) {
+    const result = Object.create(null);
+    for (const [name, value] of Object.entries(fields))
+        if (!excluded.has(name))
+            result[name] = convertValue(value);
+    return result;
+}
+/** Converts decoded typed arrays to the existing renderer-independent USD value contract. */
+function convertValue(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value === 'number' || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value))
+        return value.map(convertValue);
+    if (ArrayBuffer.isView(value) && !(value instanceof DataView))
+        return Array.from(value);
+    if (typeof value === 'object')
+        return convertFields(value, new Set());
+    throw new Error('USDC: unsupported decoded value');
+}
+/** Preserves USDA-compatible asset/path values and vector-array tuple boundaries. */
+function convertAttributeValue(raw, type) {
+    const value = convertValue(raw);
+    if (type === 'asset' && typeof value === 'string')
+        return { assetPath: value };
+    if (type === 'rel' && Array.isArray(value))
+        return value.map(path => (typeof path === 'string' ? { path } : path));
+    const tuple = /^(?:(?:point|normal|vector|color|texCoord)([234])[fdh]|(?:float|double|half|int)([234]))\[\]$/.exec(type);
+    if (tuple && Array.isArray(value)) {
+        const components = Number(tuple[1] || tuple[2]);
+        if (value.length % components)
+            throw new Error('USDC: incomplete vector tuple');
+        const tuples = [];
+        for (let offset = 0; offset < value.length; offset += components)
+            tuples.push(value.slice(offset, offset + components));
+        return tuples;
+    }
+    return value;
+}
+/** Applies authored child-name order while retaining any other decoded specifications. */
+function orderPrims(prims, names) {
+    if (names === undefined)
+        return;
+    if (!Array.isArray(names))
+        throw new Error('USDC: invalid primChildren order');
+    const remaining = new Map(prims.map(prim => [prim.name, prim]));
+    const ordered = [];
+    for (const name of names) {
+        const prim = typeof name === 'string' ? remaining.get(name) : undefined;
+        if (!prim)
+            throw new Error('USDC: invalid primChildren reference');
+        ordered.push(prim);
+        remaining.delete(name);
+    }
+    for (const prim of remaining.values())
+        ordered.push(prim);
+    for (let index = 0; index < ordered.length; index++)
+        prims[index] = ordered[index];
+}
+/** Converts every authored sample through the same type-aware path as an attribute default. */
+function convertTimeSamples(raw, type) {
+    if (!raw || typeof raw !== 'object')
+        throw new Error('USDC: invalid time samples');
+    const samples = raw;
+    const times = convertValue(samples.times);
+    if (!Array.isArray(times) ||
+        !Array.isArray(samples.values) ||
+        times.length !== samples.values.length)
+        throw new Error('USDC: invalid time samples');
+    return { times, values: samples.values.map(value => convertAttributeValue(value, type)) };
+}
+//# sourceMappingURL=parse-usdc.js.map

package/dist/usd/lib/parse-usdc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-usdc.js","sourceRoot":"","sources":["../../../src/usd/lib/parse-usdc.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,oCAAoC;AACpC,OAAO,EAAC,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAGlD,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAiB,EAAE,GAAY;IACvD,IAAI,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAC5D,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAC1B,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,GAAG,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;QAClE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACnC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CACtE,CAAC;QACF,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,EACjD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;QAC/E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjF,MAAM,EAAC,WAAW,EAAC,GAAG,IAAI,UAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3D,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC;YAAE,SAAS;QAC3E,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,EACN,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CACjE,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACd,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnC,SAAS,EAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAW,CAAC,SAAS,CAAC;YACzD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAC7B,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7B,CAAC;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;QAC/B,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC;YAAE,SAAS;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACjD,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EACpC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAChC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,qBAAqB,CACjC,aAAa,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAClE,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,EACN,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAC/D,CAAC;QACF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAClC,QAAQ,CAAC,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG;YACtB,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,GAAG;QACH,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAClF,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CACpB,MAA+B,EAC/B,QAAqB;IAErB,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACtF,OAAO,KAAK,CAAC;IACf,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAqC,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAgC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,GAAY,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAC,SAAS,EAAE,KAAK,EAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GACT,+FAA+F,CAAC,IAAI,CAClG,IAAI,CACL,CAAC;IACJ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChF,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,UAAU;YAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,KAAgB,EAAE,KAAc;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,SAAS,CAAC,MAAM,CAAC,IAAc,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,+FAA+F;AAC/F,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,GAKf,CAAC;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QAEtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO,EAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAC,CAAC;AAC1F,CAAC"}

package/dist/usd/lib/parse-usdz.cjs

@@ -31,30 +31,52 @@ function parseUSDZArchive(arrayBuffer) {
   const directoryOffset = findCentralDirectory(view);
   const entryCount = view.getUint16(directoryOffset + 10, true);
   let entryOffset = view.getUint32(directoryOffset + 16, true);
+  const dataLimit = entryOffset;
   const files = /* @__PURE__ */ new Map();
   const textDecoder = new TextDecoder();
+  let extractedByteLength = 0;
   for (let entryIndex = 0; entryIndex < entryCount; entryIndex++) {
+    if (entryOffset + 46 > directoryOffset) {
+      throw new Error("USDZ archive contains a truncated ZIP central-directory entry.");
+    }
     if (view.getUint32(entryOffset, true) !== CENTRAL_DIRECTORY_ENTRY) {
       throw new Error("USDZ archive contains an invalid ZIP central-directory entry.");
     }
     const compression = view.getUint16(entryOffset + 10, true);
     const compressedLength = view.getUint32(entryOffset + 20, true);
+    const uncompressedLength = view.getUint32(entryOffset + 24, true);
     const filenameLength = view.getUint16(entryOffset + 28, true);
     const extraLength = view.getUint16(entryOffset + 30, true);
     const commentLength = view.getUint16(entryOffset + 32, true);
     const localOffset = view.getUint32(entryOffset + 42, true);
+    if (entryOffset + 46 + filenameLength + extraLength + commentLength > directoryOffset) {
+      throw new Error("USDZ archive contains a truncated ZIP filename or extra field.");
+    }
     const filename = textDecoder.decode(
       new Uint8Array(arrayBuffer, entryOffset + 46, filenameLength)
     );
     if (compression !== 0) {
       throw new Error(`USDZ entry "${filename}" is compressed; USDZ requires stored ZIP entries.`);
     }
+    if (localOffset + 30 > dataLimit || compressedLength !== uncompressedLength) {
+      throw new Error(`USDZ entry "${filename}" has invalid stored ZIP bounds.`);
+    }
     if (view.getUint32(localOffset, true) !== LOCAL_FILE_HEADER) {
       throw new Error(`USDZ entry "${filename}" has an invalid local ZIP header.`);
     }
     const localNameLength = view.getUint16(localOffset + 26, true);
     const localExtraLength = view.getUint16(localOffset + 28, true);
     const contentOffset = localOffset + 30 + localNameLength + localExtraLength;
+    if ((view.getUint16(entryOffset + 8, true) | view.getUint16(localOffset + 6, true)) & 1) {
+      throw new Error(`USDZ entry "${filename}" is encrypted.`);
+    }
+    if (contentOffset + compressedLength > dataLimit || view.getUint16(localOffset + 8, true) !== 0 || textDecoder.decode(new Uint8Array(arrayBuffer, localOffset + 30, localNameLength)) !== filename || files.has(filename)) {
+      throw new Error(`USDZ entry "${filename}" has invalid or duplicate stored ZIP data.`);
+    }
+    extractedByteLength += compressedLength;
+    if (extractedByteLength > arrayBuffer.byteLength) {
+      throw new Error("USDZ archive exceeds its stored data budget.");
+    }
     files.set(filename, arrayBuffer.slice(contentOffset, contentOffset + compressedLength));
     entryOffset += 46 + filenameLength + extraLength + commentLength;
   }

package/dist/usd/lib/parse-usdz.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/usd/lib/parse-usdz.ts"],
-  "sourcesContent": ["// loaders.gl\n// SPDX-License-Identifier: MIT\n// Copyright (c) vis.gl contributors\n\nconst END_OF_CENTRAL_DIRECTORY = 0x06054b50;\nconst CENTRAL_DIRECTORY_ENTRY = 0x02014b50;\nconst LOCAL_FILE_HEADER = 0x04034b50;\n\n/** Extracts stored files from an uncompressed USDZ ZIP archive. */\nexport function parseUSDZArchive(arrayBuffer: ArrayBuffer): Map<string, ArrayBuffer> {\n  const view = new DataView(arrayBuffer);\n  const directoryOffset = findCentralDirectory(view);\n  const entryCount = view.getUint16(directoryOffset + 10, true);\n  let entryOffset = view.getUint32(directoryOffset + 16, true);\n  const files = new Map<string, ArrayBuffer>();\n  const textDecoder = new TextDecoder();\n\n  for (let entryIndex = 0; entryIndex < entryCount; entryIndex++) {\n    if (view.getUint32(entryOffset, true) !== CENTRAL_DIRECTORY_ENTRY) {\n      throw new Error('USDZ archive contains an invalid ZIP central-directory entry.');\n    }\n\n    const compression = view.getUint16(entryOffset + 10, true);\n    const compressedLength = view.getUint32(entryOffset + 20, true);\n    const filenameLength = view.getUint16(entryOffset + 28, true);\n    const extraLength = view.getUint16(entryOffset + 30, true);\n    const commentLength = view.getUint16(entryOffset + 32, true);\n    const localOffset = view.getUint32(entryOffset + 42, true);\n    const filename = textDecoder.decode(\n      new Uint8Array(arrayBuffer, entryOffset + 46, filenameLength)\n    );\n\n    if (compression !== 0) {\n      throw new Error(`USDZ entry \"${filename}\" is compressed; USDZ requires stored ZIP entries.`);\n    }\n    if (view.getUint32(localOffset, true) !== LOCAL_FILE_HEADER) {\n      throw new Error(`USDZ entry \"${filename}\" has an invalid local ZIP header.`);\n    }\n\n    const localNameLength = view.getUint16(localOffset + 26, true);\n    const localExtraLength = view.getUint16(localOffset + 28, true);\n    const contentOffset = localOffset + 30 + localNameLength + localExtraLength;\n    files.set(filename, arrayBuffer.slice(contentOffset, contentOffset + compressedLength));\n    entryOffset += 46 + filenameLength + extraLength + commentLength;\n  }\n\n  return files;\n}\n\n/** Finds the ZIP end-of-central-directory record. */\nfunction findCentralDirectory(view: DataView): number {\n  const minimumOffset = Math.max(0, view.byteLength - 65557);\n  for (let offset = view.byteLength - 22; offset >= minimumOffset; offset--) {\n    if (view.getUint32(offset, true) === END_OF_CENTRAL_DIRECTORY) {\n      return offset;\n    }\n  }\n  throw new Error('USDZ archive does not contain a ZIP end-of-central-directory record.');\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,IAAM,2BAA2B;AACjC,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAGnB,SAAS,iBAAiB,aAAoD;AACnF,QAAM,OAAO,IAAI,SAAS,WAAW;AACrC,QAAM,kBAAkB,qBAAqB,IAAI;AACjD,QAAM,aAAa,KAAK,UAAU,kBAAkB,IAAI,IAAI;AAC5D,MAAI,cAAc,KAAK,UAAU,kBAAkB,IAAI,IAAI;AAC3D,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,cAAc,IAAI,YAAY;AAEpC,WAAS,aAAa,GAAG,aAAa,YAAY,cAAc;AAC9D,QAAI,KAAK,UAAU,aAAa,IAAI,MAAM,yBAAyB;AACjE,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AAEA,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,UAAM,mBAAmB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC9D,UAAM,iBAAiB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC5D,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,UAAM,gBAAgB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC3D,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,UAAM,WAAW,YAAY;AAAA,MAC3B,IAAI,WAAW,aAAa,cAAc,IAAI,cAAc;AAAA,IAC9D;AAEA,QAAI,gBAAgB,GAAG;AACrB,YAAM,IAAI,MAAM,eAAe,QAAQ,oDAAoD;AAAA,IAC7F;AACA,QAAI,KAAK,UAAU,aAAa,IAAI,MAAM,mBAAmB;AAC3D,YAAM,IAAI,MAAM,eAAe,QAAQ,oCAAoC;AAAA,IAC7E;AAEA,UAAM,kBAAkB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC7D,UAAM,mBAAmB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC9D,UAAM,gBAAgB,cAAc,KAAK,kBAAkB;AAC3D,UAAM,IAAI,UAAU,YAAY,MAAM,eAAe,gBAAgB,gBAAgB,CAAC;AACtF,mBAAe,KAAK,iBAAiB,cAAc;AAAA,EACrD;AAEA,SAAO;AACT;AAGA,SAAS,qBAAqB,MAAwB;AACpD,QAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,aAAa,KAAK;AACzD,WAAS,SAAS,KAAK,aAAa,IAAI,UAAU,eAAe,UAAU;AACzE,QAAI,KAAK,UAAU,QAAQ,IAAI,MAAM,0BAA0B;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,MAAM,sEAAsE;AACxF;",
+  "sourcesContent": ["// loaders.gl\n// SPDX-License-Identifier: MIT\n// Copyright (c) vis.gl contributors\n\nconst END_OF_CENTRAL_DIRECTORY = 0x06054b50;\nconst CENTRAL_DIRECTORY_ENTRY = 0x02014b50;\nconst LOCAL_FILE_HEADER = 0x04034b50;\n\n/** Extracts stored files from an uncompressed USDZ ZIP archive. */\nexport function parseUSDZArchive(arrayBuffer: ArrayBuffer): Map<string, ArrayBuffer> {\n  const view = new DataView(arrayBuffer);\n  const directoryOffset = findCentralDirectory(view);\n  const entryCount = view.getUint16(directoryOffset + 10, true);\n  let entryOffset = view.getUint32(directoryOffset + 16, true);\n  const dataLimit = entryOffset;\n  const files = new Map<string, ArrayBuffer>();\n  const textDecoder = new TextDecoder();\n  let extractedByteLength = 0;\n\n  for (let entryIndex = 0; entryIndex < entryCount; entryIndex++) {\n    if (entryOffset + 46 > directoryOffset) {\n      throw new Error('USDZ archive contains a truncated ZIP central-directory entry.');\n    }\n    if (view.getUint32(entryOffset, true) !== CENTRAL_DIRECTORY_ENTRY) {\n      throw new Error('USDZ archive contains an invalid ZIP central-directory entry.');\n    }\n\n    const compression = view.getUint16(entryOffset + 10, true);\n    const compressedLength = view.getUint32(entryOffset + 20, true);\n    const uncompressedLength = view.getUint32(entryOffset + 24, true);\n    const filenameLength = view.getUint16(entryOffset + 28, true);\n    const extraLength = view.getUint16(entryOffset + 30, true);\n    const commentLength = view.getUint16(entryOffset + 32, true);\n    const localOffset = view.getUint32(entryOffset + 42, true);\n    if (entryOffset + 46 + filenameLength + extraLength + commentLength > directoryOffset) {\n      throw new Error('USDZ archive contains a truncated ZIP filename or extra field.');\n    }\n    const filename = textDecoder.decode(\n      new Uint8Array(arrayBuffer, entryOffset + 46, filenameLength)\n    );\n\n    if (compression !== 0) {\n      throw new Error(`USDZ entry \"${filename}\" is compressed; USDZ requires stored ZIP entries.`);\n    }\n    if (localOffset + 30 > dataLimit || compressedLength !== uncompressedLength) {\n      throw new Error(`USDZ entry \"${filename}\" has invalid stored ZIP bounds.`);\n    }\n    if (view.getUint32(localOffset, true) !== LOCAL_FILE_HEADER) {\n      throw new Error(`USDZ entry \"${filename}\" has an invalid local ZIP header.`);\n    }\n\n    const localNameLength = view.getUint16(localOffset + 26, true);\n    const localExtraLength = view.getUint16(localOffset + 28, true);\n    const contentOffset = localOffset + 30 + localNameLength + localExtraLength;\n    if ((view.getUint16(entryOffset + 8, true) | view.getUint16(localOffset + 6, true)) & 1) {\n      throw new Error(`USDZ entry \"${filename}\" is encrypted.`);\n    }\n    if (\n      contentOffset + compressedLength > dataLimit ||\n      view.getUint16(localOffset + 8, true) !== 0 ||\n      textDecoder.decode(new Uint8Array(arrayBuffer, localOffset + 30, localNameLength)) !==\n        filename ||\n      files.has(filename)\n    ) {\n      throw new Error(`USDZ entry \"${filename}\" has invalid or duplicate stored ZIP data.`);\n    }\n    extractedByteLength += compressedLength;\n    if (extractedByteLength > arrayBuffer.byteLength) {\n      throw new Error('USDZ archive exceeds its stored data budget.');\n    }\n    files.set(filename, arrayBuffer.slice(contentOffset, contentOffset + compressedLength));\n    entryOffset += 46 + filenameLength + extraLength + commentLength;\n  }\n\n  return files;\n}\n\n/** Finds the ZIP end-of-central-directory record. */\nfunction findCentralDirectory(view: DataView): number {\n  const minimumOffset = Math.max(0, view.byteLength - 65557);\n  for (let offset = view.byteLength - 22; offset >= minimumOffset; offset--) {\n    if (view.getUint32(offset, true) === END_OF_CENTRAL_DIRECTORY) {\n      return offset;\n    }\n  }\n  throw new Error('USDZ archive does not contain a ZIP end-of-central-directory record.');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,IAAM,2BAA2B;AACjC,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAGnB,SAAS,iBAAiB,aAAoD;AACnF,QAAM,OAAO,IAAI,SAAS,WAAW;AACrC,QAAM,kBAAkB,qBAAqB,IAAI;AACjD,QAAM,aAAa,KAAK,UAAU,kBAAkB,IAAI,IAAI;AAC5D,MAAI,cAAc,KAAK,UAAU,kBAAkB,IAAI,IAAI;AAC3D,QAAM,YAAY;AAClB,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,cAAc,IAAI,YAAY;AACpC,MAAI,sBAAsB;AAE1B,WAAS,aAAa,GAAG,aAAa,YAAY,cAAc;AAC9D,QAAI,cAAc,KAAK,iBAAiB;AACtC,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,QAAI,KAAK,UAAU,aAAa,IAAI,MAAM,yBAAyB;AACjE,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AAEA,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,UAAM,mBAAmB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC9D,UAAM,qBAAqB,KAAK,UAAU,cAAc,IAAI,IAAI;AAChE,UAAM,iBAAiB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC5D,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,UAAM,gBAAgB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC3D,UAAM,cAAc,KAAK,UAAU,cAAc,IAAI,IAAI;AACzD,QAAI,cAAc,KAAK,iBAAiB,cAAc,gBAAgB,iBAAiB;AACrF,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,UAAM,WAAW,YAAY;AAAA,MAC3B,IAAI,WAAW,aAAa,cAAc,IAAI,cAAc;AAAA,IAC9D;AAEA,QAAI,gBAAgB,GAAG;AACrB,YAAM,IAAI,MAAM,eAAe,QAAQ,oDAAoD;AAAA,IAC7F;AACA,QAAI,cAAc,KAAK,aAAa,qBAAqB,oBAAoB;AAC3E,YAAM,IAAI,MAAM,eAAe,QAAQ,kCAAkC;AAAA,IAC3E;AACA,QAAI,KAAK,UAAU,aAAa,IAAI,MAAM,mBAAmB;AAC3D,YAAM,IAAI,MAAM,eAAe,QAAQ,oCAAoC;AAAA,IAC7E;AAEA,UAAM,kBAAkB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC7D,UAAM,mBAAmB,KAAK,UAAU,cAAc,IAAI,IAAI;AAC9D,UAAM,gBAAgB,cAAc,KAAK,kBAAkB;AAC3D,SAAK,KAAK,UAAU,cAAc,GAAG,IAAI,IAAI,KAAK,UAAU,cAAc,GAAG,IAAI,KAAK,GAAG;AACvF,YAAM,IAAI,MAAM,eAAe,QAAQ,iBAAiB;AAAA,IAC1D;AACA,QACE,gBAAgB,mBAAmB,aACnC,KAAK,UAAU,cAAc,GAAG,IAAI,MAAM,KAC1C,YAAY,OAAO,IAAI,WAAW,aAAa,cAAc,IAAI,eAAe,CAAC,MAC/E,YACF,MAAM,IAAI,QAAQ,GAClB;AACA,YAAM,IAAI,MAAM,eAAe,QAAQ,6CAA6C;AAAA,IACtF;AACA,2BAAuB;AACvB,QAAI,sBAAsB,YAAY,YAAY;AAChD,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,UAAM,IAAI,UAAU,YAAY,MAAM,eAAe,gBAAgB,gBAAgB,CAAC;AACtF,mBAAe,KAAK,iBAAiB,cAAc;AAAA,EACrD;AAEA,SAAO;AACT;AAGA,SAAS,qBAAqB,MAAwB;AACpD,QAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,aAAa,KAAK;AACzD,WAAS,SAAS,KAAK,aAAa,IAAI,UAAU,eAAe,UAAU;AACzE,QAAI,KAAK,UAAU,QAAQ,IAAI,MAAM,0BAA0B;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,MAAM,sEAAsE;AACxF;",
   "names": []
 }

package/dist/usd/lib/parse-usdz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-usdz.d.ts","sourceRoot":"","sources":["../../../src/usd/lib/parse-usdz.ts"],"names":[],"mappings":"AAQA,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAsCnF"}
+{"version":3,"file":"parse-usdz.d.ts","sourceRoot":"","sources":["../../../src/usd/lib/parse-usdz.ts"],"names":[],"mappings":"AAQA,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAkEnF"}

package/dist/usd/lib/parse-usdz.js

@@ -10,28 +10,54 @@ export function parseUSDZArchive(arrayBuffer) {
     const directoryOffset = findCentralDirectory(view);
     const entryCount = view.getUint16(directoryOffset + 10, true);
     let entryOffset = view.getUint32(directoryOffset + 16, true);
+    const dataLimit = entryOffset;
     const files = new Map();
     const textDecoder = new TextDecoder();
+    let extractedByteLength = 0;
     for (let entryIndex = 0; entryIndex < entryCount; entryIndex++) {
+        if (entryOffset + 46 > directoryOffset) {
+            throw new Error('USDZ archive contains a truncated ZIP central-directory entry.');
+        }
         if (view.getUint32(entryOffset, true) !== CENTRAL_DIRECTORY_ENTRY) {
             throw new Error('USDZ archive contains an invalid ZIP central-directory entry.');
         }
         const compression = view.getUint16(entryOffset + 10, true);
         const compressedLength = view.getUint32(entryOffset + 20, true);
+        const uncompressedLength = view.getUint32(entryOffset + 24, true);
         const filenameLength = view.getUint16(entryOffset + 28, true);
         const extraLength = view.getUint16(entryOffset + 30, true);
         const commentLength = view.getUint16(entryOffset + 32, true);
         const localOffset = view.getUint32(entryOffset + 42, true);
+        if (entryOffset + 46 + filenameLength + extraLength + commentLength > directoryOffset) {
+            throw new Error('USDZ archive contains a truncated ZIP filename or extra field.');
+        }
         const filename = textDecoder.decode(new Uint8Array(arrayBuffer, entryOffset + 46, filenameLength));
         if (compression !== 0) {
             throw new Error(`USDZ entry "${filename}" is compressed; USDZ requires stored ZIP entries.`);
         }
+        if (localOffset + 30 > dataLimit || compressedLength !== uncompressedLength) {
+            throw new Error(`USDZ entry "${filename}" has invalid stored ZIP bounds.`);
+        }
         if (view.getUint32(localOffset, true) !== LOCAL_FILE_HEADER) {
             throw new Error(`USDZ entry "${filename}" has an invalid local ZIP header.`);
         }
         const localNameLength = view.getUint16(localOffset + 26, true);
         const localExtraLength = view.getUint16(localOffset + 28, true);
         const contentOffset = localOffset + 30 + localNameLength + localExtraLength;
+        if ((view.getUint16(entryOffset + 8, true) | view.getUint16(localOffset + 6, true)) & 1) {
+            throw new Error(`USDZ entry "${filename}" is encrypted.`);
+        }
+        if (contentOffset + compressedLength > dataLimit ||
+            view.getUint16(localOffset + 8, true) !== 0 ||
+            textDecoder.decode(new Uint8Array(arrayBuffer, localOffset + 30, localNameLength)) !==
+                filename ||
+            files.has(filename)) {
+            throw new Error(`USDZ entry "${filename}" has invalid or duplicate stored ZIP data.`);
+        }
+        extractedByteLength += compressedLength;
+        if (extractedByteLength > arrayBuffer.byteLength) {
+            throw new Error('USDZ archive exceeds its stored data budget.');
+        }
         files.set(filename, arrayBuffer.slice(contentOffset, contentOffset + compressedLength));
         entryOffset += 46 + filenameLength + extraLength + commentLength;
     }

package/dist/usd/lib/parse-usdz.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-usdz.js","sourceRoot":"","sources":["../../../src/usd/lib/parse-usdz.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAEpC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAC5C,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAC3C,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,WAAwB;IACvD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAEtC,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,uBAAuB,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CACjC,IAAI,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,EAAE,EAAE,cAAc,CAAC,CAC9D,CAAC;QAEF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,oDAAoD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,WAAW,GAAG,EAAE,GAAG,eAAe,GAAG,gBAAgB,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC;QACxF,WAAW,IAAI,EAAE,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qDAAqD;AACrD,SAAS,oBAAoB,CAAC,IAAc;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;IAC3D,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;AAC1F,CAAC"}
+{"version":3,"file":"parse-usdz.js","sourceRoot":"","sources":["../../../src/usd/lib/parse-usdz.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAEpC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAC5C,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAC3C,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,WAAwB;IACvD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,WAAW,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC/D,IAAI,WAAW,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,uBAAuB,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,WAAW,GAAG,EAAE,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,GAAG,eAAe,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CACjC,IAAI,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,EAAE,EAAE,cAAc,CAAC,CAC9D,CAAC;QAEF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,oDAAoD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,WAAW,GAAG,EAAE,GAAG,SAAS,IAAI,gBAAgB,KAAK,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,kCAAkC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,WAAW,GAAG,EAAE,GAAG,eAAe,GAAG,gBAAgB,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,IACE,aAAa,GAAG,gBAAgB,GAAG,SAAS;YAC5C,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAC3C,WAAW,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;gBAChF,QAAQ;YACV,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,6CAA6C,CAAC,CAAC;QACxF,CAAC;QACD,mBAAmB,IAAI,gBAAgB,CAAC;QACxC,IAAI,mBAAmB,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC;QACxF,WAAW,IAAI,EAAE,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qDAAqD;AACrD,SAAS,oBAAoB,CAAC,IAAc;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;IAC3D,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/usd/lib/usd-types.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/usd/lib/usd-types.ts"],
-  "sourcesContent": ["// loaders.gl\n// SPDX-License-Identifier: MIT\n// Copyright (c) vis.gl contributors\n\nimport type {LoaderOptions} from '@loaders.gl/core/loader-utils';\n\n/** Reference to an external OpenUSD layer and optional prim within that layer. */\nexport type USDAssetPath = {\n  /** URL or relative path to the referenced layer. */\n  assetPath: string;\n  /** Optional prim path within the referenced layer. */\n  primPath?: string;\n};\n\n/** Reference to a prim in an OpenUSD scene. */\nexport type USDScenePath = {\n  /** Absolute or relative scene path. */\n  path: string;\n};\n\n/** Value types represented by the OpenUSD ASCII parser. */\nexport type USDValue =\n  | string\n  | number\n  | boolean\n  | null\n  | USDAssetPath\n  | USDScenePath\n  | USDValue[]\n  | {[name: string]: USDValue};\n\n/** Parsed OpenUSD attribute declaration. */\nexport type USDAttribute = {\n  /** Attribute name. */\n  name: string;\n  /** Authored OpenUSD type name. */\n  type: string;\n  /** Parsed attribute value. */\n  value: USDValue;\n  /** Attribute metadata. */\n  metadata: Record<string, USDValue>;\n};\n\n/** Opinions authored by one variant. */\nexport type USDVariant = {\n  /** Variant attributes. */\n  attributes: Record<string, USDAttribute>;\n  /** Variant metadata. */\n  metadata: Record<string, USDValue>;\n  /** Child prims introduced or overridden by the variant. */\n  children: USDPrim[];\n};\n\n/** Parsed and optionally composed OpenUSD prim. */\nexport type USDPrim = {\n  /** Prim name. */\n  name: string;\n  /** Absolute prim path. */\n  path: string;\n  /** URL of the layer that authored the prim. */\n  sourceUrl?: string;\n  /** Authored prim type, such as `Xform` or `Mesh`. */\n  type: string;\n  /** Prim specifier. */\n  specifier: 'def' | 'over' | 'class';\n  /** Authored attributes keyed by name. */\n  attributes: Record<string, USDAttribute>;\n  /** Prim metadata keyed by name. */\n  metadata: Record<string, USDValue>;\n  /** Variant sets keyed by set name and variant name. */\n  variants: Record<string, Record<string, USDVariant>>;\n  /** Child prims. */\n  children: USDPrim[];\n};\n\n/** Parsed OpenUSD stage. */\nexport type USDStage = {\n  /** Container format used for the root layer. */\n  format: 'usda' | 'usdz';\n  /** URL of the root layer when available. */\n  url?: string;\n  /** Root-layer metadata. */\n  metadata: Record<string, USDValue>;\n  /** Root prims in scene order. */\n  rootPrims: USDPrim[];\n  /** URLs of all layers used to compose the stage. */\n  layers: string[];\n};\n\n/** Options for {@link USDLoader}. */\nexport type USDLoaderOptions = LoaderOptions & {\n  /** OpenUSD-specific parser and composition options. */\n  usd?: {\n    /** Compose references and variants into the returned prim hierarchy. */\n    compose?: boolean;\n    /** Load referenced layers while composing the stage. */\n    loadReferences?: boolean;\n    /** Maximum recursive composition depth. */\n    maxReferenceDepth?: number;\n    /** Variant selections that override authored selections. */\n    variantSelections?: Record<string, string>;\n  };\n};\n"],
+  "sourcesContent": ["// SPDX-License-Identifier: MIT\n// Copyright (c) vis.gl contributors\n// loaders.gl\n\nimport type {LoaderOptions} from '@loaders.gl/core/loader-utils';\n\n/** Reference to an external OpenUSD layer and optional prim within that layer. */\nexport type USDAssetPath = {\n  /** URL or relative path to the referenced layer. */\n  assetPath: string;\n  /** Optional prim path within the referenced layer. */\n  primPath?: string;\n};\n\n/** Reference to a prim in an OpenUSD scene. */\nexport type USDScenePath = {\n  /** Absolute or relative scene path. */\n  path: string;\n};\n\n/** Value types represented by the OpenUSD ASCII parser. */\nexport type USDValue =\n  | string\n  | number\n  | boolean\n  | null\n  | USDAssetPath\n  | USDScenePath\n  | USDValue[]\n  | {[name: string]: USDValue};\n\n/** Parsed OpenUSD attribute declaration. */\nexport type USDAttribute = {\n  /** URL of the layer that authored this attribute, retained through composition. */\n  sourceUrl?: string;\n  /** Attribute name. */\n  name: string;\n  /** Authored OpenUSD type name. */\n  type: string;\n  /** Parsed attribute value. */\n  value: USDValue;\n  /** Attribute metadata. */\n  metadata: Record<string, USDValue>;\n};\n\n/** Opinions authored by one variant. */\nexport type USDVariant = {\n  /** Variant attributes. */\n  attributes: Record<string, USDAttribute>;\n  /** Variant metadata. */\n  metadata: Record<string, USDValue>;\n  /** Child prims introduced or overridden by the variant. */\n  children: USDPrim[];\n};\n\n/** Parsed and optionally composed OpenUSD prim. */\nexport type USDPrim = {\n  /** Prim name. */\n  name: string;\n  /** Absolute prim path. */\n  path: string;\n  /** URL of the layer that authored the prim. */\n  sourceUrl?: string;\n  /** Authored prim type, such as `Xform` or `Mesh`. */\n  type: string;\n  /** Prim specifier. */\n  specifier: 'def' | 'over' | 'class';\n  /** Authored attributes keyed by name. */\n  attributes: Record<string, USDAttribute>;\n  /** Prim metadata keyed by name. */\n  metadata: Record<string, USDValue>;\n  /** Variant sets keyed by set name and variant name. */\n  variants: Record<string, Record<string, USDVariant>>;\n  /** Child prims. */\n  children: USDPrim[];\n};\n\n/** Encoded file extracted from a USDZ package, without image decoding or renderer objects. */\nexport type USDEmbeddedAsset = {\n  /** Original archive-relative filename, including its directories. */\n  readonly path: string;\n  /** Exact stored bytes, owned by the returned stage rather than the input archive. */\n  readonly data: ArrayBuffer;\n  /** MIME type hint inferred from a PNG or JPEG filename; other formats omit this field. */\n  readonly mimeType?: string;\n};\n\n/** Parsed OpenUSD stage. */\nexport type USDStage = {\n  /** Container format used for the root layer. */\n  format: 'usda' | 'usdc' | 'usdz';\n  /** URL of the root layer when available. */\n  url?: string;\n  /** Root-layer metadata. */\n  metadata: Record<string, USDValue>;\n  /** Root prims in scene order. */\n  rootPrims: USDPrim[];\n  /** URLs of all layers used to compose the stage. */\n  layers: string[];\n  /** USDZ files keyed by resolved package URL; absent for standalone layers. Includes layers and textures. */\n  assets?: Record<string, USDEmbeddedAsset>;\n};\n\n/** Options for {@link USDLoader}. */\nexport type USDLoaderOptions = LoaderOptions & {\n  /** OpenUSD-specific parser and composition options. */\n  usd?: {\n    /** Compose references and variants into the returned prim hierarchy. */\n    compose?: boolean;\n    /** Load referenced layers while composing the stage. */\n    loadReferences?: boolean;\n    /** Maximum recursive composition depth. */\n    maxReferenceDepth?: number;\n    /** Variant selections that override authored selections. */\n    variantSelections?: Record<string, string>;\n  };\n};\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/usd/lib/usd-types.d.ts

@@ -17,6 +17,8 @@ export type USDValue = string | number | boolean | null | USDAssetPath | USDScen
 };
 /** Parsed OpenUSD attribute declaration. */
 export type USDAttribute = {
+    /** URL of the layer that authored this attribute, retained through composition. */
+    sourceUrl?: string;
     /** Attribute name. */
     name: string;
     /** Authored OpenUSD type name. */
@@ -56,10 +58,19 @@ export type USDPrim = {
     /** Child prims. */
     children: USDPrim[];
 };
+/** Encoded file extracted from a USDZ package, without image decoding or renderer objects. */
+export type USDEmbeddedAsset = {
+    /** Original archive-relative filename, including its directories. */
+    readonly path: string;
+    /** Exact stored bytes, owned by the returned stage rather than the input archive. */
+    readonly data: ArrayBuffer;
+    /** MIME type hint inferred from a PNG or JPEG filename; other formats omit this field. */
+    readonly mimeType?: string;
+};
 /** Parsed OpenUSD stage. */
 export type USDStage = {
     /** Container format used for the root layer. */
-    format: 'usda' | 'usdz';
+    format: 'usda' | 'usdc' | 'usdz';
     /** URL of the root layer when available. */
     url?: string;
     /** Root-layer metadata. */
@@ -68,6 +79,8 @@ export type USDStage = {
     rootPrims: USDPrim[];
     /** URLs of all layers used to compose the stage. */
     layers: string[];
+    /** USDZ files keyed by resolved package URL; absent for standalone layers. Includes layers and textures. */
+    assets?: Record<string, USDEmbeddedAsset>;
 };
 /** Options for {@link USDLoader}. */
 export type USDLoaderOptions = LoaderOptions & {

package/dist/usd/lib/usd-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usd-types.d.ts","sourceRoot":"","sources":["../../../src/usd/lib/usd-types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,+BAA+B,CAAC;AAEjE,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG;IACzB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,YAAY,GACZ,YAAY,GACZ,QAAQ,EAAE,GACV;IAAC,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAC,CAAC;AAE/B,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG;IACzB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG;IACvB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,MAAM,OAAO,GAAG;IACpB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACpC,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,mBAAmB;IACnB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB,CAAC;AAEF,4BAA4B;AAC5B,MAAM,MAAM,QAAQ,GAAG;IACrB,gDAAgD;IAChD,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,iCAAiC;IACjC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,oDAAoD;IACpD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAC7C,uDAAuD;IACvD,GAAG,CAAC,EAAE;QACJ,wEAAwE;QACxE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,wDAAwD;QACxD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,2CAA2C;QAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,4DAA4D;QAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC5C,CAAC;CACH,CAAC"}
+{"version":3,"file":"usd-types.d.ts","sourceRoot":"","sources":["../../../src/usd/lib/usd-types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,+BAA+B,CAAC;AAEjE,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG;IACzB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,YAAY,GACZ,YAAY,GACZ,QAAQ,EAAE,GACV;IAAC,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAC,CAAC;AAE/B,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG;IACzB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG;IACvB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,MAAM,OAAO,GAAG;IACpB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACpC,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,mBAAmB;IACnB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,4BAA4B;AAC5B,MAAM,MAAM,QAAQ,GAAG;IACrB,gDAAgD;IAChD,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,iCAAiC;IACjC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,oDAAoD;IACpD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4GAA4G;IAC5G,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC;AAEF,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAC7C,uDAAuD;IACvD,GAAG,CAAC,EAAE;QACJ,wEAAwE;QACxE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,wDAAwD;QACxD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,2CAA2C;QAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,4DAA4D;QAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC5C,CAAC;CACH,CAAC"}

package/dist/usd/lib/usd-types.js

@@ -1,5 +1,5 @@
-// loaders.gl
 // SPDX-License-Identifier: MIT
 // Copyright (c) vis.gl contributors
+// loaders.gl
 export {};
 //# sourceMappingURL=usd-types.js.map

package/dist/usd/lib/usd-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"usd-types.js","sourceRoot":"","sources":["../../../src/usd/lib/usd-types.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC"}
+{"version":3,"file":"usd-types.js","sourceRoot":"","sources":["../../../src/usd/lib/usd-types.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,oCAAoC;AACpC,aAAa"}

package/dist/usd/libs/README.md

@@ -0,0 +1,27 @@
+# USDC decoder source
+
+`usdc-parser.js` is adapted from THREE.js r187, commit/tag r187:
+https://github.com/mrdoob/three.js/blob/r187/examples/jsm/loaders/usd/USDCParser.js
+
+Copyright © 2010–2026 three.js authors; MIT terms are in THREE-LICENSE.
+This renderer-free source has no imports or package dependencies. It remains
+vendored JavaScript; the adjacent declaration and handwritten parse-usdc.ts
+adapter define the checked TypeScript boundary. Existing libs build/coverage
+policy applies to this vendored decoder; adapter code remains fully instrumented.
+
+Local changes bound aggregate allocations, integer precision and seek offsets,
+support bounded dictionary values and reject unsupported list operations/encoding cases, validate LZ4
+copies, use null-prototype dictionaries and correct signed inline integers.
+The adapter restricts crate versions, validates section bounds, and converts the
+supported specifications into USDStage. Broader upstream behavior is not promised.
+
+Dictionary decoding uses string-table keys and forward offsets to complete value
+representations, retaining false, empty strings, empty dictionaries and asset paths.
+It rejects duplicate/invalid keys, cycles, nesting beyond 64, and unsupported
+complex dictionary value types. These checks extend the r187 source while
+preserving its MIT attribution; no THREE runtime is imported.
+
+The authored-value extension decodes inline half and signed/unsigned 64-bit scalars,
+string arrays, and compressed half/double arrays. Dictionary array support is an
+explicit allowlist; unsupported representations fail before payload decoding.
+Half integer compression uses ties-to-even rounding, and lookup indices are checked.

package/dist/usd/libs/THREE-LICENSE

@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright © 2010-2026 three.js authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/dist/usd/libs/usdc-parser.d.ts

@@ -0,0 +1,78 @@
+export class USDCParser {
+    /**
+     * Parse USDC file and return raw spec data without building Three.js scene.
+     * Used by USDComposer for unified scene composition.
+     */
+    parseData(buffer: any): {
+        specsByPath: any;
+    };
+    _valueReadCount: any;
+    _activeDictionaries: Set<any> | undefined;
+    buffer: any;
+    reader: BinaryReader | undefined;
+    version: {
+        major: number;
+        minor: number;
+        patch: number;
+    } | undefined;
+    _conversionBuffer: ArrayBuffer | undefined;
+    _conversionView: DataView<ArrayBuffer> | undefined;
+    specsByPath: any;
+    _readBootstrap(): void;
+    tocOffset: number | undefined;
+    _readTOC(): void;
+    sections: any;
+    _readTokens(): void;
+    tokens: any[] | undefined;
+    _readStrings(): void;
+    strings: any[] | undefined;
+    _readFields(): void;
+    fields: any[] | undefined;
+    _readFieldSets(): void;
+    fieldSets: any[] | undefined;
+    _readPaths(): void;
+    paths: any[] | undefined;
+    _readPathsRecursive(parentPath: any, depth?: number): void;
+    /** Rebuilds compressed paths with an explicit stack instead of sibling recursion. */
+    _buildPathsFromCompressed(pathIndices: any, elementTokenIndices: any, jumps: any): void;
+    _readSpecs(): void;
+    specs: any[] | undefined;
+    _readValue(valueRep: any): any;
+    _readInlinedValue(valueRep: any): any;
+    _readTimeSamples(valueRep: any): {
+        times: any;
+        values: any[];
+    };
+    _readScalarValue(type: any): any;
+    /** Reads bounded string-keyed dictionary entries and their recursive value representations. */
+    _readDictionary(): any;
+    _readArrayValue(valueRep: any): string[] | Int32Array<any> | Uint32Array<any> | Float32Array<any> | Float64Array<any>;
+    _readCompressedArray(type: any, size: any): Int32Array<any> | Uint32Array<any> | Float32Array<any> | Float64Array<any>;
+    /** Rounds integer-compressed half samples using IEEE ties-to-even semantics. */
+    _convertHalfInteger(value: any): any;
+    _readHalf(): number;
+    _halfToFloat(h: any): number;
+    _getFieldsForSpec(spec: any): any;
+}
+declare class BinaryReader {
+    constructor(buffer: any);
+    buffer: any;
+    view: DataView<any>;
+    offset: number;
+    seek(offset: any): void;
+    tell(): number;
+    readUint8(): number;
+    readInt8(): number;
+    readUint16(): number;
+    readInt16(): number;
+    readUint32(): number;
+    readInt32(): number;
+    readUint64(): number;
+    readInt64(): number;
+    readFloat32(): number;
+    readFloat64(): number;
+    readBytes(length: any): Uint8Array<any>;
+    readString(length: any): string;
+}
+export {};
+//# sourceMappingURL=usdc-parser.d.ts.map

package/dist/usd/libs/usdc-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usdc-parser.d.ts","sourceRoot":"","sources":["../../../src/usd/libs/usdc-parser.js"],"names":[],"mappings":"AAmdA;IACE;;;OAGG;IACH;;MAiCC;IA/BC,qBAAwB;IACxB,0CAAoC;IAEpC,YAAoE;IACpE,iCAA2C;IAC3C;;;;kBAA6C;IAE7C,2CAA2C;IAC3C,mDAA2D;IAY3D,iBAAsC;IAaxC,uBAqBC;IAJC,8BAAoC;IAMtC,iBAgBC;IATC,cAAmC;IAWrC,oBA2CC;IAnCC,0BAAgB;IAqClB,qBAgBC;IAbG,2BAAiB;IAerB,oBAsDC;IA/CC,0BAAgB;IAiDlB,uBA+BC;IAxBC,6BAAmB;IA0BrB,mBAmDC;IA3CC,yBAAwD;IA6C1D,2DA+CC;IAED,qFAAqF;IACrF,wFAkDC;IAED,mBAmEC;IA5DC,yBAAe;IAkEjB,+BA2CC;IAED,sCAuGC;IAED;;;MA2DC;IAED,iCAsMC;IAED,+FAA+F;IAC/F,uBAyCC;IAED,sHA8HC;IAED,uHAmFC;IAED,gFAAgF;IAChF,qCAaC;IAED,oBAEC;IAED,6BAkBC;IAED,kCA6BC;CACF;AA5zCD;IACE,yBAIC;IAHC,YAAoB;IACpB,oBAAgC;IAChC,eAAe;IAGjB,wBAIC;IAED,eAEC;IAED,oBAIC;IAED,mBAIC;IAED,qBAIC;IAED,oBAIC;IAED,qBAIC;IAED,oBAIC;IAED,qBAQC;IAED,oBAOC;IAED,sBAIC;IAED,sBAIC;IAED,wCAIC;IAED,gCAKC;CACF"}