@oh-my-pi/pi-utils 18.0.4 → 18.0.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [18.0.5] - 2026-08-25
+
+### Added
+
+- Added `stableStringifyJson` for deterministic serialization of nested JSON-shaped data.
+
+### Fixed
+
+- Fixed managed Chrome-for-Testing installation failures when extracting the trusted browser download.
+
 ## [18.0.4] - 2026-08-24
 
 ### Added

package/dist/types/json.d.ts

@@ -12,3 +12,9 @@ export declare function tryParseJson<T = unknown>(content: string): T | null;
  * only lossless JSON representation.
  */
 export declare function stringifyJson(value: unknown, space?: string | number): string | undefined;
+/**
+ * Deterministically serialize JSON-shaped data by sorting object keys at every
+ * depth while preserving array order. Throws for values JSON cannot represent
+ * as a top-level value instead of returning an easy-to-misuse undefined.
+ */
+export declare function stableStringifyJson(value: unknown): string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-utils",
-	"version": "18.0.4",
+	"version": "18.0.5",
 	"description": "Shared utilities for pi packages",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -31,7 +31,7 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "18.0.4"
+		"@oh-my-pi/pi-natives": "18.0.5"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/browsers.ts

@@ -4,11 +4,23 @@ import type * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { extractArchive } from "./ar";
+import { type ArchiveLimits, extractArchive } from "./ar";
 
 const CHROME_FOR_TESTING_BASE_URL = "https://storage.googleapis.com/chrome-for-testing-public";
 const CHROME_METADATA_BASE_URL = "https://googlechromelabs.github.io/chrome-for-testing";
 
+/**
+ * Archive ceilings for the managed browser download. The default archive
+ * limits (64 MiB per member / 256 MiB in memory) guard against attacker-
+ * controlled archives, but the Chrome-for-Testing binary is a trusted
+ * first-party download whose `chrome` executable already exceeds both
+ * (~269 MB and growing), so extraction gets a ceiling sized for it.
+ */
+const BROWSER_ARCHIVE_LIMITS: Partial<ArchiveLimits> = {
+	maxMemberSize: 1024 * 1024 * 1024,
+	maxInMemorySize: 1024 * 1024 * 1024,
+};
+
 /** Supported browser products. */
 export enum Browser {
 	CHROME = "chrome",
@@ -242,7 +254,7 @@ export async function install(options: InstallOptions): Promise<InstalledBrowser
 			archivePath,
 			options.downloadProgressCallback,
 		);
-		await extractArchive(archivePath, stagingPath);
+		await extractArchive(archivePath, stagingPath, { limits: BROWSER_ARCHIVE_LIMITS });
 		await fsp.mkdir(path.dirname(installPath), { recursive: true });
 		await fsp.rm(installPath, { recursive: true, force: true });
 		await fsp.rename(stagingPath, installPath);

package/src/json.ts

@@ -21,3 +21,26 @@ export function tryParseJson<T = unknown>(content: string): T | null {
 export function stringifyJson(value: unknown, space?: string | number): string | undefined {
 	return JSON.stringify(value, (_key, item) => (typeof item === "bigint" ? item.toString() : item), space);
 }
+
+function stableJsonClone(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(stableJsonClone);
+	if (value !== null && typeof value === "object") {
+		const sorted = Object.create(null) as Record<string, unknown>;
+		for (const key of Object.keys(value).sort()) {
+			sorted[key] = stableJsonClone(Reflect.get(value, key));
+		}
+		return sorted;
+	}
+	return value;
+}
+
+/**
+ * Deterministically serialize JSON-shaped data by sorting object keys at every
+ * depth while preserving array order. Throws for values JSON cannot represent
+ * as a top-level value instead of returning an easy-to-misuse undefined.
+ */
+export function stableStringifyJson(value: unknown): string {
+	const serialized = JSON.stringify(stableJsonClone(value));
+	if (serialized === undefined) throw new TypeError("Value is not JSON-serializable");
+	return serialized;
+}