@quenty/nevermore-cli 4.50.1 → 4.51.0

package/src/utils/job-context/batch-script-job-context.ts

@@ -42,6 +42,8 @@ class BatchDeployment implements Deployment {
   ) {}
 }
 
+type BatchBuild = Pick<CombinedProjectResult, 'chunks' | 'primaryTarget'>;
+
 /** One combined place's upload and execution, each started at most once. */
 interface ChunkRun {
   chunk: CombinedPlaceChunk;
@@ -98,7 +100,7 @@ export class BatchScriptJobContext implements JobContext {
   private _reporter?: Reporter;
 
   // Lazy-promise state
-  private _combinedBuildPromise?: Promise<CombinedProjectResult>;
+  private _combinedBuildPromise?: Promise<BatchBuild>;
   private _chunkRuns?: ChunkRun[];
   private _executionPromise?: Promise<BatchExecutionOutcome>;
 
@@ -119,6 +121,12 @@ export class BatchScriptJobContext implements JobContext {
        */
       maxChunkBytes?: number;
       reporter?: Reporter;
+      /**
+       * Places already built by `batch bundle`, run instead of building. They
+       * upload to `batchPlaceId` in `batchUniverseId`, which are then required.
+       * The context owns `buildContext` and cleans it up like its own build.
+       */
+      prebuilt?: { chunks: CombinedPlaceChunk[]; buildContext: BuildContext };
     }
   ) {
     this._inner = inner;
@@ -130,6 +138,25 @@ export class BatchScriptJobContext implements JobContext {
     this._maxChunkBytes = options?.maxChunkBytes;
     this._reporter = options?.reporter;
 
+    if (options?.prebuilt) {
+      if (!this._batchPlaceId || !this._batchUniverseId) {
+        throw new Error(
+          'Prebuilt places need batchPlaceId and batchUniverseId to upload to'
+        );
+      }
+      const { chunks, buildContext } = options.prebuilt;
+      this._combinedBuildContext = buildContext;
+      this._chunkRuns = chunks.map((chunk) => ({ chunk }));
+      this._combinedBuildPromise = Promise.resolve({
+        chunks,
+        primaryTarget: {
+          placeId: this._batchPlaceId,
+          universeId: this._batchUniverseId,
+          project: '',
+        },
+      });
+    }
+
     const withBasePlace = batchTargets.filter((t) => t.target.basePlace);
     if (withBasePlace.length > 0) {
       OutputHelper.warn(
@@ -203,6 +230,10 @@ export class BatchScriptJobContext implements JobContext {
     return this._getBatchExecutionAsync();
   }
 
+  async getBuiltChunksAsync(): Promise<CombinedPlaceChunk[]> {
+    return (await this._getChunkRunsAsync()).map((run) => run.chunk);
+  }
+
   async getLogsAsync(deployment: Deployment): Promise<JobLogs> {
     const batchDeployment = deployment as BatchDeployment;
     const { results, stats } = await this._getBatchExecutionAsync();
@@ -249,14 +280,14 @@ export class BatchScriptJobContext implements JobContext {
 
   // ---- Lazy-promise internals ----
 
-  private _getCombinedBuildAsync(): Promise<CombinedProjectResult> {
+  private _getCombinedBuildAsync(): Promise<BatchBuild> {
     if (!this._combinedBuildPromise) {
       this._combinedBuildPromise = this._doCombinedBuildAsync();
     }
     return this._combinedBuildPromise;
   }
 
-  private async _doCombinedBuildAsync(): Promise<CombinedProjectResult> {
+  private async _doCombinedBuildAsync(): Promise<BatchBuild> {
     OutputHelper.verbose('Building combined batch place...');
 
     // Set all packages to "waiting" — they're queued for building

package/src/utils/sourcemap/sourcemap-loader.ts

@@ -4,17 +4,16 @@ import type { SourcemapNode } from './sourcemap-types.js';
 import { SourcemapResolver } from './sourcemap-resolver.js';
 
 /**
- * Try to load a `SourcemapResolver` from `sourcemap.json` in the given
- * directory.
+ * Try to load a `SourcemapResolver` for `repoRoot`, from its `sourcemap.json`
+ * unless another file is given.
  *
  * Returns `undefined` if the file doesn't exist or can't be parsed — callers
  * should fall back to heuristic resolution.
  */
 export function tryLoadSourcemapResolver(
-  repoRoot: string
+  repoRoot: string,
+  sourcemapPath = path.join(repoRoot, 'sourcemap.json')
 ): SourcemapResolver | undefined {
-  const sourcemapPath = path.join(repoRoot, 'sourcemap.json');
-
   let content: string;
   try {
     content = fs.readFileSync(sourcemapPath, 'utf-8');
@@ -22,12 +21,11 @@ export function tryLoadSourcemapResolver(
     return undefined;
   }
 
-  let root: SourcemapNode;
+  // A fork's build supplies this file, so a malformed tree is not fatal.
   try {
-    root = JSON.parse(content) as SourcemapNode;
+    const root = JSON.parse(content) as SourcemapNode;
+    return SourcemapResolver.fromSourcemap(root, repoRoot);
   } catch {
     return undefined;
   }
-
-  return SourcemapResolver.fromSourcemap(root, repoRoot);
 }

package/src/utils/testing/batch-run.e2e.test.ts

@@ -142,6 +142,7 @@ class FakeTransport implements JobContext {
   public scriptContent?: string;
   public scriptContents: string[] = [];
   public deployedPaths: string[] = [];
+  public deployedTargets: unknown[] = [];
   public deployCount = 0;
   public runCount = 0;
   public messagesFor?: (script: string) => TaskLogMessage[];
@@ -160,6 +161,7 @@ class FakeTransport implements JobContext {
   ): Promise<Deployment> {
     this.deployCount++;
     this.deployedPaths.push(options.builtPlace.rbxlPath);
+    this.deployedTargets.push(options.builtPlace.target);
     return {};
   }
 
@@ -506,4 +508,44 @@ describe('an aggregated batch run, end to end', () => {
       ])
     );
   });
+
+  it('runs prebuilt places on the target it was given, without building', async () => {
+    const generate = vi.mocked(
+      (await import('./runner/combined-project-generator.js'))
+        .generateCombinedProjectAsync
+    );
+    generate.mockClear();
+    const { targets } = createBatch();
+    const transport = new FakeTransport(TASK_MESSAGES);
+    const cleanupAsync = vi.fn(async () => {});
+    const batch = new BatchScriptJobContext(transport, targets, {
+      repoRoot: '/repo',
+      batchPlaceId: 900,
+      batchUniverseId: 901,
+      prebuilt: {
+        chunks: [
+          {
+            rbxlPath: '/bundle/place-1.rbxl',
+            slugMap: SLUG_MAP,
+            sizeBytes: 1024,
+          },
+        ],
+        buildContext: { cleanupAsync } as any,
+      },
+    });
+
+    const alpha = await runPackageAsync(batch, '@quenty/alpha');
+    const beta = await runPackageAsync(batch, '@quenty/beta');
+
+    expect(generate).not.toHaveBeenCalled();
+    expect(transport.deployedPaths).toEqual(['/bundle/place-1.rbxl']);
+    expect(transport.deployedTargets).toEqual([
+      { placeId: 900, universeId: 901, project: '' },
+    ]);
+    expect(alpha.success).toBe(true);
+    expect(beta.success).toBe(false);
+
+    await batch.disposeAsync();
+    expect(cleanupAsync).toHaveBeenCalledOnce();
+  });
 });

package/src/utils/testing/runner/prebuilt-batch-bundle.test.ts

@@ -0,0 +1,252 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+import { Header } from 'tar';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import {
+  type PrebuiltBatchBundle,
+  readPrebuiltBatchBundleAsync,
+  writePrebuiltBatchBundleAsync,
+} from './prebuilt-batch-bundle.js';
+
+interface RawEntry {
+  path: string;
+  body?: string;
+  type?: 'File' | 'SymbolicLink' | 'Directory';
+  linkpath?: string;
+}
+
+function rawTar(entries: RawEntry[]): Buffer {
+  const blocks: Buffer[] = [];
+  for (const entry of entries) {
+    const body = Buffer.from(entry.body ?? '');
+    const header = new Header({
+      path: entry.path,
+      type: entry.type ?? 'File',
+      linkpath: entry.linkpath,
+      size: entry.type && entry.type !== 'File' ? 0 : body.length,
+      mode: 0o644,
+      mtime: new Date(0),
+    });
+    header.encode();
+    blocks.push(header.block!);
+    if (!entry.type || entry.type === 'File') {
+      const padded = Buffer.alloc(Math.ceil(body.length / 512) * 512);
+      body.copy(padded);
+      blocks.push(padded);
+    }
+  }
+  blocks.push(Buffer.alloc(1024));
+  return Buffer.concat(blocks);
+}
+
+function validManifest(): any {
+  return {
+    formatVersion: 1,
+    chunks: [
+      {
+        file: 'place-1.rbxl',
+        packages: [
+          { name: '@quenty/rx', slug: 'rx', hasJestConfig: true },
+          { name: '@quenty/maid', slug: 'maid', hasJestConfig: false },
+        ],
+      },
+    ],
+  };
+}
+
+describe('prebuilt batch bundle', () => {
+  let workDir: string;
+  const opened: PrebuiltBatchBundle[] = [];
+
+  beforeEach(async () => {
+    workDir = await fs.mkdtemp(path.join(os.tmpdir(), 'prebuilt-bundle-'));
+  });
+
+  afterEach(async () => {
+    for (const bundle of opened.splice(0)) {
+      await bundle.buildContext.cleanupAsync();
+    }
+    await fs.rm(workDir, { recursive: true, force: true });
+  });
+
+  async function readAsync(file: string) {
+    const bundle = await readPrebuiltBatchBundleAsync(file);
+    opened.push(bundle);
+    return bundle;
+  }
+
+  async function writeRawAsync(entries: RawEntry[]): Promise<string> {
+    const file = path.join(workDir, 'raw.nevermore.tests.tar');
+    await fs.writeFile(file, rawTar(entries));
+    return file;
+  }
+
+  async function writeManifestAsync(manifest: any): Promise<string> {
+    return writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(manifest) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+    ]);
+  }
+
+  it('round-trips places, slugs and jest.config flags through one file', async () => {
+    const source = path.join(workDir, 'source.rbxl');
+    await fs.writeFile(source, 'place bytes');
+    const file = path.join(workDir, 'out', 'pr-1.nevermore.tests.tar');
+    await writePrebuiltBatchBundleAsync(
+      file,
+      [
+        {
+          rbxlPath: source,
+          slugMap: new Map([
+            ['@quenty/rx', 'rx'],
+            ['@quenty/maid', 'maid'],
+          ]),
+          sizeBytes: 11,
+        },
+      ],
+      new Map([['@quenty/rx', true]])
+    );
+
+    const bundle = await readAsync(file);
+
+    expect(bundle.packages).toEqual([
+      { name: '@quenty/rx', hasJestConfig: true },
+      { name: '@quenty/maid', hasJestConfig: false },
+    ]);
+    expect(bundle.chunks).toHaveLength(1);
+    expect(bundle.chunks[0]!.sizeBytes).toBe(11);
+    expect([...bundle.chunks[0]!.slugMap]).toEqual([
+      ['@quenty/rx', 'rx'],
+      ['@quenty/maid', 'maid'],
+    ]);
+    expect(await fs.readFile(bundle.chunks[0]!.rbxlPath, 'utf-8')).toBe(
+      'place bytes'
+    );
+  });
+
+  it('reads an empty bundle as no packages', async () => {
+    const file = path.join(workDir, 'empty.nevermore.tests.tar');
+    await writePrebuiltBatchBundleAsync(file, [], new Map());
+
+    const bundle = await readAsync(file);
+
+    expect(bundle.packages).toEqual([]);
+    expect(bundle.chunks).toEqual([]);
+  });
+
+  it('removes the unpacked places on cleanup', async () => {
+    const bundle = await readPrebuiltBatchBundleAsync(
+      await writeManifestAsync(validManifest())
+    );
+    const placePath = bundle.chunks[0]!.rbxlPath;
+
+    await bundle.buildContext.cleanupAsync();
+
+    await expect(fs.stat(placePath)).rejects.toThrow();
+  });
+
+  it('never writes outside its own directory for an entry that escapes', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+      { path: '../escaped.rbxl', body: 'evil' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('unexpected entry');
+    await expect(
+      fs.stat(path.join(os.tmpdir(), 'escaped.rbxl'))
+    ).rejects.toThrow();
+  });
+
+  it('rejects a symlink entry', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', type: 'SymbolicLink', linkpath: '/etc/passwd' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('not a regular file');
+  });
+
+  it('rejects a place the manifest does not list', async () => {
+    const file = await writeRawAsync([
+      { path: 'manifest.json', body: JSON.stringify(validManifest()) },
+      { path: 'place-1.rbxl', body: 'place bytes' },
+      { path: 'place-2.rbxl', body: 'extra' },
+    ]);
+
+    await expect(readAsync(file)).rejects.toThrow('every place it holds');
+  });
+
+  it('rejects a manifest that lists a place the bundle does not hold', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].file = 'place-2.rbxl';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'invalid place file'
+    );
+  });
+
+  it('rejects a file that is not a tar', async () => {
+    const file = path.join(workDir, 'junk.nevermore.tests.tar');
+    await fs.writeFile(file, 'not a tar at all');
+
+    await expect(readAsync(file)).rejects.toThrow();
+  });
+
+  it('rejects a slug that could break out of the batch script', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[0].slug = 'rx"]] print("hi") --';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'invalid slug'
+    );
+  });
+
+  it('accepts a multi-place target name with a free-form place name', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[0].name = '@quenty/rx - Hub (Test) + Lobby é';
+
+    const bundle = await readAsync(await writeManifestAsync(manifest));
+
+    expect(bundle.packages[0]!.name).toBe('@quenty/rx - Hub (Test) + Lobby é');
+  });
+
+  it.each([
+    '@quenty/rx | injected',
+    '@quenty/rx<img>',
+    '@quenty/rx\nline',
+    '@quenty/rx [Approved](https://evil.example)',
+    '@quenty/rx ![x](p.png)',
+    '@quenty/rx cc @someuser',
+    '@quenty/rx https://evil.example',
+  ])(
+    'rejects a package name that could break the PR comment: %j',
+    async (name) => {
+      const manifest = validManifest();
+      manifest.chunks[0].packages[0].name = name;
+
+      await expect(
+        readAsync(await writeManifestAsync(manifest))
+      ).rejects.toThrow('invalid package name');
+    }
+  );
+
+  it('rejects a package listed twice', async () => {
+    const manifest = validManifest();
+    manifest.chunks[0].packages[1].name = '@quenty/rx';
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'more than once'
+    );
+  });
+
+  it('rejects an unknown format version', async () => {
+    const manifest = validManifest();
+    manifest.formatVersion = 2;
+
+    await expect(readAsync(await writeManifestAsync(manifest))).rejects.toThrow(
+      'Unsupported bundle format'
+    );
+  });
+});

package/src/utils/testing/runner/prebuilt-batch-bundle.ts

@@ -0,0 +1,267 @@
+import * as fs from 'fs/promises';
+import { createReadStream, createWriteStream } from 'fs';
+import * as path from 'path';
+import * as tar from 'tar';
+import { BuildContext } from '@quenty/nevermore-template-helpers';
+import { type CombinedPlaceChunk } from './combined-project-generator.js';
+import { PLACE_UPLOAD_MAX_BYTES } from '../../open-cloud/open-cloud-client.js';
+
+/**
+ * Places built by `nevermore batch bundle`, unpacked from a
+ * `*.nevermore.tests.tar` and ready for `batch test --bundle` to run.
+ */
+export interface PrebuiltBatchBundle {
+  chunks: CombinedPlaceChunk[];
+  packages: PrebuiltBatchPackage[];
+  /** Holds the unpacked places; whoever runs them owns its cleanup. */
+  buildContext: BuildContext;
+}
+
+export interface PrebuiltBatchPackage {
+  name: string;
+  hasJestConfig: boolean;
+}
+
+interface ManifestFile {
+  formatVersion: number;
+  chunks: Array<{
+    file: string;
+    packages: Array<{ name: string; slug: string; hasJestConfig: boolean }>;
+  }>;
+}
+
+/** Suggested file suffix, following `deploy.nevermore.json`. */
+export const BUNDLE_FILE_SUFFIX = '.nevermore.tests.tar';
+
+const MANIFEST_FILE_NAME = 'manifest.json';
+const FORMAT_VERSION = 1;
+const MAX_CHUNKS = 32;
+const MAX_PACKAGES = 1000;
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const CHUNK_FILE_PATTERN = /^place-\d{1,3}\.rbxl$/;
+// Names reach the bot's PR comment, so a fork's bundle gets no Markdown links,
+// images, URLs, tables or @mentions: only a leading scope `@`, and plain text
+// for a multi-place target's place name ("pkg - Hub (Test)").
+const PACKAGE_NAME_PATTERN = /^@?[\p{L}\p{N} /()+.,'_~-]{1,200}$/u;
+const SLUG_PATTERN = /^[A-Za-z0-9_.-]{1,100}$/;
+
+export async function writePrebuiltBatchBundleAsync(
+  file: string,
+  chunks: CombinedPlaceChunk[],
+  hasJestConfig: Map<string, boolean>
+): Promise<void> {
+  const stage = await BuildContext.createAsync({ prefix: 'test-bundle-' });
+  const stageDir = stage.buildDir;
+  try {
+    const manifest: ManifestFile = {
+      formatVersion: FORMAT_VERSION,
+      chunks: [],
+    };
+    for (const [index, chunk] of chunks.entries()) {
+      const placeFile = `place-${index + 1}.rbxl`;
+      await fs.copyFile(chunk.rbxlPath, path.join(stageDir, placeFile));
+      manifest.chunks.push({
+        file: placeFile,
+        packages: [...chunk.slugMap].map(([name, slug]) => ({
+          name,
+          slug,
+          hasJestConfig: hasJestConfig.get(name) ?? false,
+        })),
+      });
+    }
+    await fs.writeFile(
+      path.join(stageDir, MANIFEST_FILE_NAME),
+      JSON.stringify(manifest, null, 2)
+    );
+
+    await fs.mkdir(path.dirname(path.resolve(file)), { recursive: true });
+    await tar.c({ file, cwd: stageDir, portable: true }, [
+      MANIFEST_FILE_NAME,
+      ...manifest.chunks.map((c) => c.file),
+    ]);
+  } finally {
+    await stage.cleanupAsync();
+  }
+}
+
+/**
+ * Read a bundle file. It is untrusted: entries are read from the archive, never
+ * extracted by it, and only `manifest.json` and `place-N.rbxl` regular files
+ * are accepted.
+ */
+export async function readPrebuiltBatchBundleAsync(
+  file: string
+): Promise<PrebuiltBatchBundle> {
+  let stat;
+  try {
+    stat = await fs.lstat(file);
+  } catch {
+    throw new Error(`Bundle file not found: ${file}`);
+  }
+  if (!stat.isFile()) {
+    throw new Error(`Bundle ${file} is not a regular file`);
+  }
+
+  const buildContext = await BuildContext.createAsync({
+    prefix: 'test-bundle-',
+  });
+  const dir = buildContext.buildDir;
+  try {
+    const { manifestText, placeSizes } = await _unpackAsync(file, dir);
+    return { ..._parseManifest(manifestText, dir, placeSizes), buildContext };
+  } catch (err) {
+    await buildContext.cleanupAsync();
+    throw err;
+  }
+}
+
+async function _unpackAsync(
+  file: string,
+  dir: string
+): Promise<{ manifestText: string; placeSizes: Map<string, number> }> {
+  let manifestText: string | undefined;
+  const placeSizes = new Map<string, number>();
+  const writes: Promise<void>[] = [];
+  let failure: Error | undefined;
+
+  const parser = new tar.Parser({
+    strict: true,
+    onReadEntry: (entry) => {
+      const name = entry.path;
+      const reject = (message: string) => {
+        failure ??= new Error(message);
+        entry.resume();
+      };
+
+      if (entry.type !== 'File' && entry.type !== 'OldFile') {
+        return reject(`Bundle entry ${name} is not a regular file`);
+      }
+
+      if (name === MANIFEST_FILE_NAME) {
+        if (manifestText !== undefined || entry.size > MAX_MANIFEST_BYTES) {
+          return reject('Bundle has more than one manifest, or one too large');
+        }
+        const parts: Buffer[] = [];
+        entry.on('data', (part: Buffer) => parts.push(part));
+        entry.on('end', () => {
+          manifestText = Buffer.concat(parts).toString('utf-8');
+        });
+        return;
+      }
+
+      if (!CHUNK_FILE_PATTERN.test(name) || placeSizes.has(name)) {
+        return reject(`Bundle has an unexpected entry: ${name}`);
+      }
+      if (placeSizes.size >= MAX_CHUNKS) {
+        return reject(`Bundle must hold at most ${MAX_CHUNKS} places`);
+      }
+      if (entry.size > PLACE_UPLOAD_MAX_BYTES) {
+        return reject(`${name} is over the place upload limit`);
+      }
+      placeSizes.set(name, entry.size);
+      writes.push(
+        new Promise<void>((resolve, rejectWrite) => {
+          const out = createWriteStream(path.join(dir, name));
+          out.on('finish', () => resolve());
+          out.on('error', rejectWrite);
+          entry.on('error', rejectWrite);
+          entry.pipe(out);
+        })
+      );
+    },
+  });
+
+  await new Promise<void>((resolve, rejectRead) => {
+    const input = createReadStream(file);
+    input.on('error', rejectRead);
+    parser.on('error', (err: Error) =>
+      rejectRead(new Error(`Bundle is not a valid tar file: ${err.message}`))
+    );
+    parser.on('end', () => resolve());
+    input.pipe(parser);
+  });
+  await Promise.all(writes);
+
+  if (failure) {
+    throw failure;
+  }
+  if (manifestText === undefined) {
+    throw new Error(`Bundle is missing ${MANIFEST_FILE_NAME}`);
+  }
+  return { manifestText, placeSizes };
+}
+
+function _parseManifest(
+  manifestText: string,
+  dir: string,
+  placeSizes: Map<string, number>
+): { chunks: CombinedPlaceChunk[]; packages: PrebuiltBatchPackage[] } {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(manifestText);
+  } catch {
+    throw new Error('Bundle manifest is not valid JSON');
+  }
+
+  const manifest = parsed as Partial<ManifestFile>;
+  if (manifest?.formatVersion !== FORMAT_VERSION) {
+    throw new Error(
+      `Unsupported bundle format ${String(manifest?.formatVersion)} ` +
+        `(expected ${FORMAT_VERSION})`
+    );
+  }
+  if (!Array.isArray(manifest.chunks) || manifest.chunks.length > MAX_CHUNKS) {
+    throw new Error(`Bundle must list at most ${MAX_CHUNKS} places`);
+  }
+  if (manifest.chunks.length !== placeSizes.size) {
+    throw new Error('Bundle manifest does not list every place it holds');
+  }
+
+  const seenNames = new Set<string>();
+  const seenSlugs = new Set<string>();
+  const seenFiles = new Set<string>();
+  const chunks: CombinedPlaceChunk[] = [];
+  const packages: PrebuiltBatchPackage[] = [];
+
+  for (const entry of manifest.chunks) {
+    const file = entry?.file;
+    const sizeBytes =
+      typeof file === 'string' ? placeSizes.get(file) : undefined;
+    if (sizeBytes === undefined || seenFiles.has(file!)) {
+      throw new Error(`Bundle lists an invalid place file: ${String(file)}`);
+    }
+    seenFiles.add(file!);
+
+    if (!Array.isArray(entry.packages) || entry.packages.length === 0) {
+      throw new Error(`${file} lists no packages`);
+    }
+
+    const slugMap = new Map<string, string>();
+    for (const pkg of entry.packages) {
+      const { name, slug, hasJestConfig } = pkg ?? {};
+      if (typeof name !== 'string' || !PACKAGE_NAME_PATTERN.test(name)) {
+        throw new Error(
+          `Bundle lists an invalid package name: ${String(name)}`
+        );
+      }
+      if (typeof slug !== 'string' || !SLUG_PATTERN.test(slug)) {
+        throw new Error(`Bundle lists an invalid slug for ${name}`);
+      }
+      if (seenNames.has(name) || seenSlugs.has(slug)) {
+        throw new Error(`Bundle lists ${name} (${slug}) more than once`);
+      }
+      seenNames.add(name);
+      seenSlugs.add(slug);
+      slugMap.set(name, slug);
+      packages.push({ name, hasJestConfig: hasJestConfig === true });
+    }
+
+    chunks.push({ rbxlPath: path.join(dir, file!), slugMap, sizeBytes });
+  }
+
+  if (packages.length > MAX_PACKAGES) {
+    throw new Error(`Bundle lists more than ${MAX_PACKAGES} packages`);
+  }
+
+  return { chunks, packages };
+}