anhedral 0.8.5 → 0.9.0

package/assets/security/audit-deps.mjs

@@ -0,0 +1,295 @@
+import console from 'node:console';
+import { createHash } from 'node:crypto';
+import { readdir, readFile, lstat, writeFile, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { setTimeout, clearTimeout } from 'node:timers';
+import { fileURLToPath } from 'node:url';
+import { verifyForge } from './forge-regression.mjs';
+import { verifyBraces } from './braces-regression.mjs';
+import { verifyDecoder } from './decoder-regression.mjs';
+
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const assetRoot = path.dirname(fileURLToPath(import.meta.url));
+const severities = ['info', 'low', 'moderate', 'high', 'critical'];
+const supported = {
+  'node-forge': { version: '1.4.0', advisory: 'GHSA-86w9-cpqp-85rv', verify: verifyForge },
+  braces: { version: '3.0.3', advisory: 'GHSA-vfj7-8cjw-p6xm', verify: verifyBraces },
+  'decode-uri-component': { version: '0.2.2', advisory: 'GHSA-vcc3-ghjq-m6fr', verify: verifyDecoder },
+};
+
+function ensure(condition, message) {
+  if (!condition) throw new Error(message);
+}
+const nonemptyString = (value) => typeof value === 'string' && value.length > 0;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const strings = (value) => Array.isArray(value) && value.length > 0 && value.every(nonemptyString);
+
+async function collectPackageFiles(directory, relative, files) {
+  const names = (await readdir(directory)).sort().filter((name) => relative || name !== 'node_modules');
+  for (const name of names) {
+    const key = relative ? `${relative}/${name}` : name;
+    await collectPackageEntry(path.join(directory, name), key, files);
+  }
+}
+
+async function collectPackageEntry(location, key, files) {
+  const entry = await lstat(location);
+  ensure(!entry.isSymbolicLink(), `Unexpected package symlink: ${key}`);
+  if (entry.isDirectory()) return collectPackageFiles(location, key, files);
+  ensure(entry.isFile(), `Unexpected package file type: ${key}`);
+  files.push([key, sha256(await readFile(location))]);
+}
+
+export async function hashPackageTree(packageRoot) {
+  const files = [];
+  await collectPackageFiles(packageRoot, '', files);
+  // Use code-unit ordering independently of the host locale.
+  const sortedNames = files.map(([name]) => name).sort();
+  const hashes = new Map(files);
+  return sha256(sortedNames.map((name) => `${name}\0${hashes.get(name)}\n`).join(''));
+}
+
+async function optionalStat(location) {
+  try { return await lstat(location); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+
+async function discoverCopy(directory, name, copies, links) {
+  const candidate = path.join(directory, name);
+  const stat = await optionalStat(candidate);
+  if (!stat) return;
+  if (stat.isSymbolicLink()) return links.push(candidate);
+  ensure(stat.isDirectory(), `Unexpected package location: ${candidate}`);
+  copies.add(await realpath(candidate));
+}
+
+function insideRoot(root, target) {
+  const relative = path.relative(root, target);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+async function discoverLinkedDirectory(location, name, copies, links, state) {
+  const target = await realpath(location);
+  const stat = await lstat(target);
+  if (!stat.isDirectory()) return;
+  ensure(insideRoot(state.root, target), `Directory link escapes dependency inspection: ${location}`);
+  await discoverPackages(location, name, copies, links, state);
+}
+
+async function discoverPackages(directory, name, copies, links, state) {
+  // Inspect logical node_modules aliases before deduplicating physical traversal.
+  if (path.basename(directory) === 'node_modules') await discoverCopy(directory, name, copies, links);
+  const physical = await realpath(directory);
+  if (state.visited.has(physical)) return;
+  state.visited.add(physical);
+  const entries = (await readdir(directory, { withFileTypes: true })).filter((entry) => entry.name !== '.git');
+  for (const entry of entries) await discoverEntry(directory, entry, name, copies, links, state);
+
+}
+
+async function discoverEntry(directory, entry, name, copies, links, state) {
+  const location = path.join(directory, entry.name);
+  if (entry.isDirectory()) return discoverPackages(location, name, copies, links, state);
+  if (entry.isSymbolicLink()) return discoverLinkedDirectory(location, name, copies, links, state);
+}
+
+async function packageCopies(projectRoot, name) {
+  const copies = new Set();
+  const links = [];
+  const state = { root: await realpath(projectRoot), visited: new Set() };
+  await discoverPackages(projectRoot, name, copies, links, state);
+  const storeCopies = new Set([...copies].filter((copy) => copy.split(path.sep).includes('.pnpm')));
+  for (const link of links) ensure(storeCopies.has(await realpath(link)), `Package link escapes verified pnpm copies: ${link}`);
+  return [...copies];
+}
+
+function validateFinding(finding) {
+  ensure(nonemptyString(finding?.version), 'Malformed pnpm advisory');
+  ensure(strings(finding.paths), 'Malformed pnpm advisory');
+}
+
+function validateAdvisory(advisory) {
+  ensure(nonemptyString(advisory?.module_name), 'Malformed pnpm advisory');
+  ensure(severities.includes(advisory.severity), 'Malformed pnpm advisory');
+  ensure(Array.isArray(advisory.findings), 'Malformed pnpm advisory');
+  ensure(advisory.findings.length > 0, 'Malformed pnpm advisory');
+  advisory.findings.forEach(validateFinding);
+}
+
+function validateCount(advisories, severity, count) {
+  ensure(Number.isInteger(count) && count >= 0, 'Malformed pnpm vulnerability counts');
+  const details = advisories.filter((advisory) => advisory.severity === severity).length;
+  ensure(count === details, `Missing ${severity} advisory details: count ${count}, details ${details}`);
+}
+
+function validateReport(report) {
+  ensure(record(report), 'Malformed pnpm audit report');
+  ensure(record(report.advisories), 'Malformed pnpm audit report');
+  ensure(record(report.metadata?.vulnerabilities), 'Malformed pnpm audit report');
+  ensure(!report.error, 'Malformed pnpm audit report');
+  const advisories = Object.values(report.advisories);
+  advisories.forEach(validateAdvisory);
+  for (const severity of severities) validateCount(advisories, severity, report.metadata.vulnerabilities[severity]);
+}
+
+function validateEntry(entry) {
+  const message = 'Malformed remediation entry';
+  ensure(record(entry), message);
+  ensure(Object.hasOwn(supported, entry.name), message);
+  const expected = supported[entry.name];
+  ensure(entry.version === expected.version, message);
+  ensure(Array.isArray(entry.advisoryIds), message);
+  ensure(entry.advisoryIds.length === 1, message);
+  ensure(entry.advisoryIds[0] === expected.advisory, message);
+  ensure(/^[a-f0-9]{64}$/.test(entry.patchSha256 ?? ''), message);
+  ensure(/^[a-f0-9]{64}$/.test(entry.installedTreeSha256 ?? ''), message);
+  ensure(entry.patch === `${entry.name}@${entry.version}.patch`, message);
+}
+
+function validateManifest(manifest) {
+  ensure(manifest?.schemaVersion === 1, 'Malformed remediation manifest');
+  ensure(Array.isArray(manifest.packages), 'Malformed remediation manifest');
+  manifest.packages.forEach(validateEntry);
+  const names = manifest.packages.map((entry) => entry.name);
+  ensure(new Set(names).size === names.length, 'Duplicate remediation entries');
+  ensure(names.length === Object.keys(supported).length, 'Incomplete remediation manifest');
+}
+
+async function optionalFile(file) {
+  try { return await readFile(file, 'utf8'); }
+  catch (error) { if (error.code === 'ENOENT') return ''; throw error; }
+}
+
+function parsePatchLine(line) {
+  const match = line.match(/^\s+['"]?([^'"\s]+)['"]?:\s*['"]?([^'"\s#]+)['"]?\s*(?:#.*)?$/);
+  return match?.slice(1);
+}
+
+function patchSection(workspace) {
+  const lines = workspace.split(/\r?\n/);
+  const headers = lines.flatMap((line, index) => /^(?:patchedDependencies|"patchedDependencies"|'patchedDependencies')\s*:\s*(?:#.*)?$/.test(line) ? [index] : []);
+  ensure(headers.length <= 1, 'Duplicate patchedDependencies sections');
+  if (headers.length === 0) return [];
+  const remainder = lines.slice(headers[0] + 1);
+  const end = remainder.findIndex((line) => /^\S/.test(line) && !line.startsWith('#'));
+  return (end < 0 ? remainder : remainder.slice(0, end)).map(parsePatchLine).filter(Boolean);
+}
+
+async function hasPatchMapping(projectRoot, entry) {
+  const section = patchSection(await optionalFile(path.join(projectRoot, 'pnpm-workspace.yaml')));
+  const key = `${entry.name}@${entry.version}`;
+  const matches = section.filter(([name]) => name === key);
+  ensure(matches.length <= 1, `Duplicate patch mapping: ${key}`);
+  return matches[0]?.[1] === path.posix.join('scripts/security', entry.patch);
+}
+
+async function verifyPatch(projectRoot, securityRoot, entry) {
+  ensure(await hasPatchMapping(projectRoot, entry), `Missing patch mapping: ${entry.name}@${entry.version}`);
+  const patch = path.join(securityRoot, entry.patch);
+  ensure((await lstat(patch)).isFile(), `Unexpected patch file: ${entry.name}`);
+  ensure(sha256(await readFile(patch)) === entry.patchSha256, `Patch checksum mismatch: ${entry.name}`);
+}
+
+async function verifyCopy(copy, entry, verify) {
+  const pkg = JSON.parse(await readFile(path.join(copy, 'package.json'), 'utf8'));
+  ensure(pkg.name === entry.name && pkg.version === entry.version, `Unexpected installed version: ${entry.name} at ${copy}`);
+  ensure(await hashPackageTree(copy) === entry.installedTreeSha256, `Installed package bytes differ: ${copy}`);
+  await verify(copy);
+}
+
+async function verifyEntry(entry, options) {
+  const copies = await packageCopies(options.projectRoot, entry.name);
+  if (copies.length === 0) return false;
+  await verifyPatch(options.projectRoot, options.securityRoot, entry);
+  const verify = options.regressions[entry.name] ?? supported[entry.name].verify;
+  ensure(typeof verify === 'function', `Missing regression verifier: ${entry.name}`);
+  for (const copy of copies) await verifyCopy(copy, entry, verify);
+  return true;
+}
+
+function matchesAdvisory(entry, advisory) {
+  return entry.name === advisory.module_name && entry.advisoryIds.includes(advisory.github_advisory_id);
+}
+
+function advisoryFixed(entry, advisory, verified) {
+  return Boolean(entry && verified.has(entry.name) && advisory.findings.every((finding) => finding.version === entry.version));
+}
+
+function advisoryVerdict(advisory, manifest, verified) {
+  const entry = manifest.packages.find((item) => matchesAdvisory(item, advisory));
+  const fixed = advisoryFixed(entry, advisory, verified);
+  const id = advisory.github_advisory_id ?? String(advisory.id);
+  const state = fixed ? 'verified local backport; upstream audit remains affected' : 'unremediated';
+  return { text: `${advisory.severity}: ${id} (${advisory.module_name}) — ${state}`, blocked: !fixed && ['high', 'critical'].includes(advisory.severity), id };
+}
+
+export async function verifyAuditReport(report, { projectRoot, manifest, securityRoot = assetRoot, regressions = {} }) {
+  validateReport(report);
+  validateManifest(manifest);
+  const verified = new Set();
+  for (const entry of manifest.packages) {
+    if (await verifyEntry(entry, { projectRoot, securityRoot, regressions })) verified.add(entry.name);
+  }
+  const results = Object.values(report.advisories).map((advisory) => advisoryVerdict(advisory, manifest, verified));
+  const verdicts = results.map((result) => result.text);
+  const blocked = results.filter((result) => result.blocked).map((result) => result.id);
+  ensure(blocked.length === 0, `Unremediated high/critical advisories: ${blocked.join(', ')}\n${verdicts.join('\n')}`);
+  return { verdicts, verified: [...verified] };
+}
+
+function parseAuditResult(stdout, stderr, code, signal) {
+  ensure(!signal && [0, 1].includes(code), `pnpm audit failed (${signal ?? code}): ${stderr.slice(0, 2000)}`);
+  let report;
+  try { report = JSON.parse(stdout); }
+  catch { throw new Error(`pnpm audit returned malformed JSON: ${stderr.slice(0, 2000)}`); }
+  validateReport(report);
+  const clean = Object.values(report.metadata.vulnerabilities).every((count) => count === 0);
+  ensure((code === 0) === clean, 'pnpm audit exit status disagrees with vulnerability counts');
+  return { report, raw: stdout };
+}
+
+function collectAuditProcess(child) {
+  return new Promise((resolve, reject) => {
+    let stdout = '', stderr = '';
+    const fail = (error) => { clearTimeout(timer); child.kill(); reject(error); };
+    const timer = setTimeout(() => fail(new Error('pnpm audit timed out')), 120_000);
+    child.stdout.on('data', (data) => {
+      stdout += data;
+      if (stdout.length > 16_000_000) fail(new Error('pnpm audit output exceeds limit'));
+    });
+    child.stderr.on('data', (data) => { stderr = (stderr + data).slice(-16_000); });
+    child.on('error', fail);
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      try { resolve(parseAuditResult(stdout, stderr, code, signal)); }
+      catch (error) { reject(error); }
+    });
+  });
+}
+
+export function runAudit(projectRoot, all = true) {
+  const pnpm = process.env.npm_execpath;
+  ensure(nonemptyString(pnpm), 'Run this check through pnpm');
+  ensure(/pnpm/i.test(path.basename(pnpm)), 'Run this check through pnpm');
+  const args = ['audit', '--json', '--audit-level', 'low', ...(all ? [] : ['--prod'])];
+  const javascript = /\.[cm]?js$/i.test(pnpm);
+  const child = spawn(javascript ? process.execPath : pnpm, javascript ? [pnpm, ...args] : args, { cwd: projectRoot, stdio: ['ignore', 'pipe', 'pipe'] });
+  return collectAuditProcess(child);
+}
+
+async function main() {
+  const projectRoot = process.cwd();
+  const { report, raw } = await runAudit(projectRoot);
+  const reportPath = path.join(projectRoot, '.anhedral-audit-report.json');
+  await writeFile(reportPath, raw);
+  console.log(`Unmodified pnpm audit report (all dependencies): ${reportPath}`);
+  const manifest = JSON.parse(await readFile(path.join(assetRoot, 'manifest.json'), 'utf8'));
+  const result = await verifyAuditReport(report, { projectRoot, manifest });
+  result.verdicts.forEach((verdict) => console.log(verdict));
+  console.log('Dependency gate passed: no unremediated high/critical findings.');
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error) => { console.error(error.message); process.exitCode = 1; });
+}

package/assets/security/braces-regression.mjs

@@ -0,0 +1,102 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+// Golden results were captured from the original registry package braces 3.0.3.
+const fixtures = [
+  {"input":"{a,b}","options":{},"expected":{"create":"(a|b)","compile":"(a|b)","expand":["a","b"],"stringify":"{a,b}"},"main":["(a|b)"]},
+  {"input":"a/{b,c}/d","options":{},"expected":{"create":"a/(b|c)/d","compile":"a/(b|c)/d","expand":["a/b/d","a/c/d"],"stringify":"a/{b,c}/d"},"main":["a/(b|c)/d"]},
+  {"input":"{01..05}","options":{},"expected":{"create":"(0[1-5])","compile":"(0[1-5])","expand":["01","02","03","04","05"],"stringify":"{01..05}"},"main":["(0[1-5])"]},
+  {"input":"{-3..3}","options":{},"expected":{"create":"(-[1-3]|[0-3])","compile":"(-[1-3]|[0-3])","expand":["-3","-2","-1","0","1","2","3"],"stringify":"{-3..3}"},"main":["(-[1-3]|[0-3])"]},
+  {"input":"{10..2..2}","options":{},"expected":{"create":"(2|4|6|8|10)","compile":"(2|4|6|8|10)","expand":["10","8","6","4","2"],"stringify":"{10..2..2}"},"main":["(2|4|6|8|10)"]},
+  {"input":"{a..z..3}","options":{},"expected":{"create":"(a|d|g|j|m|p|s|v|y)","compile":"(a|d|g|j|m|p|s|v|y)","expand":["a","d","g","j","m","p","s","v","y"],"stringify":"{a..z..3}"},"main":["(a|d|g|j|m|p|s|v|y)"]},
+  {"input":"{a,{b,c}}","options":{},"expected":{"create":"(a|(b|c))","compile":"(a|(b|c))","expand":["a","b","c"],"stringify":"{a,{b,c}}"},"main":["(a|(b|c))"]},
+  {"input":"{,a,,b,}","options":{},"expected":{"create":"(|a|b|)","compile":"(|a|b|)","expand":["","a","","b",""],"stringify":"{,a,,b,}"},"main":["(|a|b|)"]},
+  {"input":"\\{literal\\}","options":{"keepEscaping":true},"expected":{"create":"\\{literal\\}","compile":"\\{literal\\}","expand":["\\{literal\\}"],"stringify":"\\{literal\\}"},"main":["\\{literal\\}"]},
+  {"input":"file[{}].js","options":{},"expected":{"create":"file[{}].js","compile":"file[{}].js","expand":["file[{}].js"],"stringify":"file[{}].js"},"main":["file[{}].js"]},
+  {"input":"(x){a,b}","options":{},"expected":{"create":"(x)(a|b)","compile":"(x)(a|b)","expand":["(x)a","(x)b"],"stringify":"(x){a,b}"},"main":["(x)(a|b)"]},
+  {"input":"${name}","options":{},"expected":{"create":"${name}","compile":"${name}","expand":["${name}"],"stringify":"${name}"},"main":["${name}"]},
+  {"input":"{unclosed","options":{"escapeInvalid":true},"expected":{"create":"\\{unclosed","compile":"\\{unclosed","expand":["{unclosed"],"stringify":"{unclosed"},"main":["\\{unclosed"]},
+  {"input":"\"{a,b}\"","options":{"keepQuotes":true},"expected":{"create":"\"{a,b}\"","compile":"\"{a,b}\"","expand":["\"{a,b}\""],"stringify":"\"{a,b}\""},"main":["\"{a,b}\""]},
+  {"input":"{a,a,,b}","options":{"nodupes":true,"noempty":true},"expected":{"create":"(a|a|b)","compile":"(a|a|b)","expand":["a","b"],"stringify":"{a,a,,b}"},"main":["(a|a|b)"]},
+  {"input":"user-{200..300}","options":{},"expected":{"create":"user-(20[0-9]|2[1-9][0-9]|300)","compile":"user-(20[0-9]|2[1-9][0-9]|300)","expand":["user-200","user-201","user-202","user-203","user-204","user-205","user-206","user-207","user-208","user-209","user-210","user-211","user-212","user-213","user-214","user-215","user-216","user-217","user-218","user-219","user-220","user-221","user-222","user-223","user-224","user-225","user-226","user-227","user-228","user-229","user-230","user-231","user-232","user-233","user-234","user-235","user-236","user-237","user-238","user-239","user-240","user-241","user-242","user-243","user-244","user-245","user-246","user-247","user-248","user-249","user-250","user-251","user-252","user-253","user-254","user-255","user-256","user-257","user-258","user-259","user-260","user-261","user-262","user-263","user-264","user-265","user-266","user-267","user-268","user-269","user-270","user-271","user-272","user-273","user-274","user-275","user-276","user-277","user-278","user-279","user-280","user-281","user-282","user-283","user-284","user-285","user-286","user-287","user-288","user-289","user-290","user-291","user-292","user-293","user-294","user-295","user-296","user-297","user-298","user-299","user-300"],"stringify":"user-{200..300}"},"main":["user-(20[0-9]|2[1-9][0-9]|300)"]},
+  {"input":"","options":{},"expected":{"create":[""],"compile":"","expand":[],"stringify":""},"main":[""]},
+  {"input":"x","options":{},"expected":{"create":["x"],"compile":"x","expand":["x"],"stringify":"x"},"main":["x"]},
+  {"input":"{..3}","options":{},"expected":{"create":"{..3}","compile":"{..3}","expand":["{..3}"],"stringify":"{..3}"},"main":["{..3}"]},
+  {"input":"{1..3}","options":{"step":2},"expected":{"create":"(1|3)","compile":"(1|3)","expand":["1","3"],"stringify":"{1..3}"},"main":["(1|3)"]}
+];
+
+const normalize = value => JSON.parse(JSON.stringify(value, (key, item) => ['parent', 'prev'].includes(key) ? undefined : item));
+
+const bounded = fn => assert.throws(fn, error => error instanceof RangeError && /safe resource limits/.test(error.message));
+
+function verifyCompatibility(braces) {
+  for (const { input, options, expected, main } of fixtures) {
+    assert.deepEqual(braces(input, options), main, `braces ${input}`);
+    const parsed = braces.parse(input, options);
+    assert.equal(parsed.type, 'root');
+    assert.equal(parsed.input, input);
+    assert.equal(braces.stringify(parsed, options), expected.stringify);
+    for (const method of ['create', 'compile', 'expand', 'stringify']) {
+      assert.deepEqual(normalize(braces[method](input, options)), expected[method], `${method} ${input}`);
+    }
+  }
+  assert.deepEqual(braces(['{a,b}', '{1..3}'], { expand: true }), ['a', 'b', '1', '2', '3']);
+  assert.deepEqual(braces(['{a,a}', '{a,b}'], { expand: true, nodupes: true }), ['a', 'b']);
+  assert.throws(() => braces.expand('{1..1001}'), /range limit/);
+  assert.deepEqual(braces.expand('{1..3}', { rangeLimit: false }), ['1', '2', '3']);
+  assert.match(braces.compile('{1..1000000000}'), /./, 'Optimized numeric regex compilation remains available');
+  assert.equal(braces.expand('{1..100000}', { rangeLimit: false }).length, 100000);
+
+}
+
+function verifyNestedStrings(braces) {
+  for (const method of ['create', 'compile', 'expand', 'parse', 'stringify']) {
+    bounded(() => braces[method]('{'.repeat(4000) + 'a,b' + '}'.repeat(4000)));
+    bounded(() => braces[method]('('.repeat(4000) + 'x' + ')'.repeat(4000)));
+  }
+}
+
+function verifyAstBounds(braces) {
+  for (const method of ['compile', 'expand', 'stringify']) {
+    let ast = { type: 'text', value: 'x' };
+    for (let i = 0; i < 101; i++) ast = { type: 'root', nodes: [ast] };
+    bounded(() => braces[method](ast));
+    const cycle = { type: 'root', nodes: [] }; cycle.nodes.push(cycle);
+    bounded(() => braces[method](cycle));
+    const parentCycle = { type: 'root', nodes: [] }; parentCycle.parent = parentCycle;
+    bounded(() => braces[method](parentCycle));
+    const foreignParents = Array.from({ length: 201 }, () => {
+      let parent;
+      for (let i = 0; i < 100; i++) parent = { parent };
+      return { type: 'text', value: 'x', parent };
+    });
+    bounded(() => braces[method]({ type: 'root', nodes: foreignParents }));
+    const leaf = { type: 'text', value: 'x' };
+    const dag = { type: 'root', nodes: [leaf, leaf] };
+    assert.deepEqual(braces[method](dag), method === 'expand' ? ['xx'] : 'xx', `${method} accepts an acyclic shared node`);
+    bounded(() => braces[method]({ type: 'root', nodes: Array.from({ length: 20001 }, () => ({ type: 'text', value: 'x' })) }));
+  }
+}
+
+function verifyExpansionBounds(braces) {
+  for (const input of ['{1..100001}', '{100001..1}', '{-100001..-1}', '{a,b}'.repeat(17)]) {
+    bounded(() => braces.expand(input, { rangeLimit: false }));
+  }
+  bounded(() => braces.compile('{1..300000..2}'));
+  bounded(() => braces.expand(`{${'0'.repeat(200)}1..${'0'.repeat(200)}100000}`, { rangeLimit: false }));
+  bounded(() => braces.expand('{100000000000000000000..100000000000000000001}', { rangeLimit: false }));
+  bounded(() => braces(['{a,b}'.repeat(16), '{a,b}'.repeat(16)], { expand: true }));
+  bounded(() => braces(Array(100001).fill('a')));
+}
+
+export function verifyBraces(packageRoot) {
+  const require = createRequire(import.meta.url);
+  const braces = require(path.join(packageRoot, 'index.js'));
+  assert.equal(require(path.join(packageRoot, 'package.json')).version, '3.0.3');
+  verifyCompatibility(braces);
+  verifyNestedStrings(braces);
+  verifyAstBounds(braces);
+  verifyExpansionBounds(braces);
+  return { normalPatterns: fixtures.length, depthLimit: 100, nodeLimit: 20000, expansionLimit: 100000, characterLimit: 10485760 };
+}