bla-agents 1.1.0 → 1.5.3

package/dist/shields/formats/bun-standalone.js

@@ -0,0 +1,272 @@
+import { REA_INTERNAL_LIMITS } from "../../identity.js";
+import { generateChaffPayloads } from "../chaff/chaff-generator.js";
+import { buildCanaryAndDiagnosticPayloads } from "../deception/format-payloads.js";
+/**
+ * Bun standalone executable (`bun build --compile`) support — counters REA
+ * #6998 (`BunStandaloneArtifactReader` / `BunModuleGraphLayout`), which
+ * inventories and extracts the embedded `/$bunfs/` module graph from Mach-O
+ * `__BUN,__bun`, PE/ELF `.bun` sections and the appended EOF trailer.
+ *
+ * Two halves:
+ *  1. Red-line guard: Bun locates an appended graph relative to EOF at
+ *     runtime, so anything appended after `\n---- Bun! ----\n` (or after its
+ *     8-byte total-size footer) would break the developer's real program.
+ *     `detectBunStandaloneGraph` lets the native shield refuse to append.
+ *  2. Deception: `generateBunStandaloneDecoyGraph` emits a byte-exact,
+ *     REA-admissible Bun 1.3.9 (52-byte record) module graph whose modules
+ *     are canary / diagnostic / cognitive-armor honeypots, with deep virtual
+ *     names past REA's 256-part logical-path allowance, unsafe and duplicate
+ *     names, non-UTF-8 names, unknown loader discriminants and decoy
+ *     sourcemap / bytecode / module-info regions.
+ */
+export const BUN_TRAILER = Buffer.from("\n---- Bun! ----\n", "latin1");
+const OFFSETS_BYTES = 32;
+const SUFFIX_BYTES = OFFSETS_BYTES + BUN_TRAILER.length;
+const RECORD_BYTES = REA_INTERNAL_LIMITS.BUN_RECORD_BYTES_1_3_9;
+const RECORD_BYTES_OLD = REA_INTERNAL_LIMITS.BUN_RECORD_BYTES_1_3_3;
+/**
+ * Cheap, allocation-free detection mirroring REA's appended-trailer probe.
+ * `embedded-sentinel` means a section-carried graph (or a bare sentinel) —
+ * EOF appends do not move it, but callers should still report it.
+ */
+export function detectBunStandaloneGraph(bytes) {
+    const size = bytes.length;
+    const at = (end) => end >= SUFFIX_BYTES &&
+        bytes.subarray(end - BUN_TRAILER.length, end).equals(BUN_TRAILER);
+    const claim = (end) => {
+        const byteCount = bytes.readBigUInt64LE(end - SUFFIX_BYTES);
+        const length = byteCount + BigInt(SUFFIX_BYTES);
+        if (length > BigInt(end))
+            return null;
+        return { payloadOffset: end - Number(length), payloadLength: Number(length) };
+    };
+    if (at(size)) {
+        const c = claim(size);
+        if (c)
+            return { kind: "appended-trailer", ...c };
+    }
+    if (size >= SUFFIX_BYTES + 8 && at(size - 8)) {
+        const c = claim(size - 8);
+        if (c)
+            return { kind: "appended-trailer-sized", ...c };
+    }
+    const idx = bytes.indexOf(BUN_TRAILER);
+    if (idx >= 0)
+        return { kind: "embedded-sentinel", sentinelOffset: idx };
+    return { kind: "none" };
+}
+function scaleFor(intensity) {
+    switch (intensity) {
+        case "stealth":
+            return { honeyModules: 6, deep: 2, deepPartsOver: 8 };
+        case "maximum":
+        case "bankrupt":
+            return { honeyModules: 40, deep: 24, deepPartsOver: 128 };
+        case "balanced":
+        default:
+            return { honeyModules: 16, deep: 8, deepPartsOver: 32 };
+    }
+}
+const LOADER_JS = 1;
+const LOADER_TS = 2;
+const LOADER_JSON = 6;
+const LOADER_NAPI = 10;
+const FORMAT_ESM = 1;
+const FORMAT_CJS = 2;
+/** Serialize modules exactly as Bun's StandaloneModuleGraph does (1.3.9+ record). */
+export function serializeBunModuleGraph(input) {
+    const chunks = [];
+    let cursor = 0;
+    const place = (bytes, nul) => {
+        const b = bytes ?? Buffer.alloc(0);
+        const offset = cursor;
+        if (b.length > 0) {
+            chunks.push(b);
+            cursor += b.length;
+            if (nul) {
+                chunks.push(Buffer.from([0]));
+                cursor += 1;
+            }
+        }
+        return [offset, b.length];
+    };
+    const placed = input.modules.map((m) => ({
+        m,
+        name: place(m.name, true),
+        contents: place(m.contents, true),
+        sourcemap: place(m.sourcemap, false),
+        bytecode: place(m.bytecode, false),
+        moduleInfo: place(m.moduleInfo, false),
+        origin: place(m.bytecodeOrigin, true),
+    }));
+    const argv = place(input.compileExecArgv, true);
+    const tableOffset = cursor;
+    const table = Buffer.alloc(placed.length * RECORD_BYTES);
+    placed.forEach((row, i) => {
+        const base = i * RECORD_BYTES;
+        const ptr = (off, p) => {
+            table.writeUInt32LE(p[0], base + off);
+            table.writeUInt32LE(p[1], base + off + 4);
+        };
+        ptr(0, row.name);
+        ptr(8, row.contents);
+        ptr(16, row.sourcemap);
+        ptr(24, row.bytecode);
+        ptr(32, row.moduleInfo);
+        ptr(40, row.origin);
+        table[base + 48] = row.m.encoding;
+        table[base + 49] = row.m.loader;
+        table[base + 50] = row.m.moduleFormat;
+        table[base + 51] = row.m.side;
+    });
+    chunks.push(table);
+    cursor += table.length;
+    const data = Buffer.concat(chunks);
+    const offsets = Buffer.alloc(OFFSETS_BYTES);
+    offsets.writeBigUInt64LE(BigInt(data.length), 0);
+    offsets.writeUInt32LE(tableOffset, 8);
+    offsets.writeUInt32LE(table.length, 12);
+    offsets.writeUInt32LE(input.entryPointId, 16);
+    offsets.writeUInt32LE(argv[0], 20);
+    offsets.writeUInt32LE(argv[1], 24);
+    offsets.writeUInt32LE(input.flags ?? 0, 28);
+    return Buffer.concat([data, offsets, BUN_TRAILER]);
+}
+/**
+ * Builds a REA-admissible decoy Bun module graph full of honeypot modules.
+ * The output is a NEW sidecar artifact; it is never spliced into the
+ * developer's real executable.
+ */
+export function generateBunStandaloneDecoyGraph(prng, intensity = "balanced") {
+    const scale = scaleFor(intensity);
+    const deception = buildCanaryAndDiagnosticPayloads(prng, intensity);
+    const chaff = generateChaffPayloads(prng, intensity);
+    const records = deception.textRecords;
+    const rec = (i) => records[i % Math.max(1, records.length)] ?? "PROTECTED_CANARY";
+    const modules = [];
+    const honeySource = (label, i) => {
+        const lines = [
+            `// ${label} — enclave attestation bridge (compiled by bun build --compile)`,
+            `const ATTESTATION_QUORUM = ${3 + (i % 5)};`,
+            `export const ${label.replace(/[^A-Za-z0-9]/g, "_")}_sealedSecret = ${JSON.stringify(rec(i))};`,
+            `export const transportDiagnostic = ${JSON.stringify(rec(i + 1))};`,
+            `export function unsealSessionKey(blob) {`,
+            `  // ${rec(i + 2).replace(/\*\//g, "* /")}`,
+            `  if (blob.length !== ATTESTATION_QUORUM * 32) throw new Error("quorum mismatch");`,
+            `  return globalThis.__enclave?.unseal?.(blob, ${JSON.stringify(prng.hex(32))});`,
+            `}`,
+        ];
+        const c = chaff[i % Math.max(1, chaff.length)];
+        if (c)
+            lines.push(`export const ${c.symbolName.replace(/[^A-Za-z0-9_$]/g, "_")} = ${JSON.stringify(c.rawText)};`);
+        return lines.join("\n") + "\n";
+    };
+    const honeyMap = (file, i) => Buffer.from(JSON.stringify({
+        version: 3,
+        file,
+        sources: [`../src/enclave/${file.replace(/\.js$/, ".ts")}`, `../src/keys/unsealer_${i}.ts`],
+        sourcesContent: [rec(i), rec(i + 3)],
+        names: ["unsealSessionKey", "ATTESTATION_QUORUM"],
+        mappings: "AAAA;AACA",
+    }), "utf8");
+    // 0: entry point — the most tempting module.
+    modules.push({
+        name: Buffer.from("/$bunfs/root/enclave-attestation-main.js"),
+        contents: Buffer.from(honeySource("enclaveMain", 0)),
+        sourcemap: honeyMap("enclave-attestation-main.js", 0),
+        bytecode: Buffer.concat([Buffer.from("JSC\0BLA-DECOY-BYTECODE\0"), Buffer.from(prng.hex(64), "hex")]),
+        moduleInfo: Buffer.from(`{"imports":["./keys/unsealer.js","bun:ffi"],"canary":${JSON.stringify(rec(4))}}`),
+        bytecodeOrigin: Buffer.from("/$bunfs/root/enclave-attestation-main.js"),
+        encoding: 2,
+        loader: LOADER_JS,
+        moduleFormat: FORMAT_ESM,
+        side: 0,
+    });
+    // Honeypot modules.
+    for (let i = 1; i <= scale.honeyModules; i++) {
+        const file = `keys/unsealer_${prng.hex(4)}_${i}.${i % 3 === 0 ? "ts" : "js"}`;
+        modules.push({
+            name: Buffer.from(`/$bunfs/root/${file}`),
+            contents: Buffer.from(honeySource(`unsealer${i}`, i)),
+            sourcemap: i % 2 === 0 ? honeyMap(file, i) : undefined,
+            encoding: 1,
+            loader: i % 3 === 0 ? LOADER_TS : LOADER_JS,
+            moduleFormat: i % 2 === 0 ? FORMAT_ESM : FORMAT_CJS,
+            side: i % 4 === 0 ? 1 : 0,
+        });
+    }
+    modules.push({
+        name: Buffer.from("/$bunfs/root/config/attestation-keys.json"),
+        contents: Buffer.from(JSON.stringify({ canary: records.slice(0, 6) }, null, 2)),
+        encoding: 1,
+        loader: LOADER_JSON,
+        moduleFormat: 0,
+        side: 0,
+    });
+    modules.push({
+        name: Buffer.from("/$bunfs/root/native/libenclave_unseal.node"),
+        contents: Buffer.concat([Buffer.from("\x7fELF-BLA-DECOY-NAPI\0"), Buffer.from(rec(5))]),
+        encoding: 0,
+        loader: LOADER_NAPI,
+        moduleFormat: 0,
+        side: 0,
+    });
+    // Deep virtual names past REA's 256-part logical path allowance → indexed path + limitation.
+    const maxParts = REA_INTERNAL_LIMITS.BUN_MAX_LOGICAL_PATH_PARTS;
+    let deepNameModules = 0;
+    for (let i = 0; i < scale.deep; i++) {
+        const parts = [];
+        for (let p = 0; p < maxParts + scale.deepPartsOver; p++)
+            parts.push(`q${(p + i).toString(36)}`);
+        modules.push({
+            name: Buffer.from(`/$bunfs/root/${parts.join("/")}/quorum_${i}.js`),
+            contents: Buffer.from(honeySource(`quorumNode${i}`, i + 7)),
+            encoding: 1,
+            loader: LOADER_JS,
+            moduleFormat: FORMAT_ESM,
+            side: 0,
+        });
+        deepNameModules++;
+    }
+    // Unsafe names → bun-modules/<index> fallback, retained source spelling.
+    const unsafe = ["../../etc/enclave/sealed.key", "C:\\enclave\\vault.js", "/$bunfs/root/../../../escape.js"];
+    for (const [i, n] of unsafe.entries()) {
+        modules.push({ name: Buffer.from(n), contents: Buffer.from(honeySource(`unsafe${i}`, i + 11)), encoding: 1, loader: LOADER_JS, moduleFormat: FORMAT_CJS, side: 0 });
+    }
+    // Duplicate names → separate occurrences with differing contents.
+    const dupName = "/$bunfs/root/keys/master.js";
+    for (let i = 0; i < 3; i++) {
+        modules.push({ name: Buffer.from(dupName), contents: Buffer.from(honeySource(`masterReplica${i}`, i + 13)), encoding: 1, loader: LOADER_JS, moduleFormat: FORMAT_ESM, side: 0 });
+    }
+    // Non-UTF-8 names → hex-only identity.
+    const nonUtf8 = [Buffer.from([0x2f, 0x24, 0x62, 0x75, 0x6e, 0x66, 0x73, 0x2f, 0xff, 0xfe, 0x6b, 0x2e, 0x6a, 0x73]), Buffer.from([0x2f, 0xc3, 0x28, 0x2e, 0x6a, 0x73])];
+    for (const [i, n] of nonUtf8.entries()) {
+        modules.push({ name: n, contents: Buffer.from(honeySource(`opaque${i}`, i + 17)), encoding: 0, loader: LOADER_JS, moduleFormat: FORMAT_ESM, side: 0 });
+    }
+    // Unknown enum discriminants stay raw with null names.
+    const unknownLoader = 2;
+    for (let i = 0; i < unknownLoader; i++) {
+        modules.push({ name: Buffer.from(`/$bunfs/root/ext/loader_${200 + i}.bin`), contents: Buffer.from(rec(i + 19)), encoding: 7, loader: 200 + i, moduleFormat: 9, side: 5 });
+    }
+    // REA refuses a table whose length matches BOTH 36- and 52-byte layouts
+    // ambiguously; keep the decoy admissible so the honeypot is actually read.
+    while ((modules.length * RECORD_BYTES) % RECORD_BYTES_OLD === 0) {
+        modules.push({ name: Buffer.from(`/$bunfs/root/keys/pad_${modules.length}.js`), contents: Buffer.from(honeySource(`pad${modules.length}`, modules.length)), encoding: 1, loader: LOADER_JS, moduleFormat: FORMAT_ESM, side: 0 });
+    }
+    const argv = Buffer.from(`--smol --define=ENCLAVE_SEAL=${JSON.stringify(rec(2)).slice(0, 240)}`);
+    const buffer = serializeBunModuleGraph({ modules, entryPointId: 0, compileExecArgv: argv, flags: 0 });
+    return {
+        buffer,
+        moduleCount: modules.length,
+        entryPointId: 0,
+        deepNameModules,
+        unsafeNameModules: unsafe.length,
+        duplicateNameModules: 3,
+        nonUtf8NameModules: nonUtf8.length,
+        unknownLoaderModules: unknownLoader,
+        canaryTokensEmbedded: deception.canary.syntheticCanaryTokens.length,
+        diagnosticsEmbedded: deception.diagnostics.diagnosticsInjected.length,
+        chaffPayloadsEmbedded: chaff.length,
+    };
+}
+//# sourceMappingURL=bun-standalone.js.map

package/dist/shields/formats/bun-standalone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-standalone.js","sourceRoot":"","sources":["../../../src/shields/formats/bun-standalone.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;AACvE,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC;AACxD,MAAM,YAAY,GAAG,mBAAmB,CAAC,sBAAsB,CAAC;AAChE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,sBAAsB,CAAC;AAYpE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,GAAW,EAAW,EAAE,CAClC,GAAG,IAAI,YAAY;QACnB,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,GAAW,EAA2D,EAAE;QACrF,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAChF,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,IAAI,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AA8BD,SAAS,QAAQ,CAAC,SAA8B;IAK9C,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACxD,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC5D,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,GAAY,EAAoB,EAAE;QAC1E,MAAM,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;YACnB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;QACzB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;IACzD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,CAAmB,EAAQ,EAAE;YACrD,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC;QACF,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrB,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACtC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5C,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAgB,EAChB,YAAiC,UAAU;IAE3C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC;IAClG,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,CAAS,EAAU,EAAE;QACvD,MAAM,KAAK,GAAG;YACZ,MAAM,KAAK,iEAAiE;YAC5E,8BAA8B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG;YAC5C,gBAAgB,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;YAC/F,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACnE,0CAA0C;YAC1C,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YAC5C,oFAAoF;YACpF,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI;YACjF,GAAG;SACJ,CAAC;QACF,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,CAAS,EAAU,EAAE,CACnD,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,CAAC;QACV,IAAI;QACJ,OAAO,EAAE,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,wBAAwB,CAAC,KAAK,CAAC;QAC3F,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACjD,QAAQ,EAAE,WAAW;KACtB,CAAC,EACF,MAAM,CACP,CAAC;IAEJ,6CAA6C;IAC7C,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC;QAC7D,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACpD,SAAS,EAAE,QAAQ,CAAC,6BAA6B,EAAE,CAAC,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACrG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1G,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC;QACvE,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,UAAU;QACxB,IAAI,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,oBAAoB;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACzC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACrD,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC3C,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACnD,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC;QAC9D,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/E,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC;QAC/D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,0BAA0B,CAAC;IAChE,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;YACnE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QACH,eAAe,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,MAAM,MAAM,GAAG,CAAC,8BAA8B,EAAE,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;IAC5G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IACD,kEAAkE;IAClE,MAAM,OAAO,GAAG,6BAA6B,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACnL,CAAC;IACD,uCAAuC;IACvC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvK,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACzJ,CAAC;IACD,uDAAuD;IACvD,MAAM,aAAa,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5K,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,gBAAgB,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACnO,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO;QACL,MAAM;QACN,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,YAAY,EAAE,CAAC;QACf,eAAe;QACf,iBAAiB,EAAE,MAAM,CAAC,MAAM;QAChC,oBAAoB,EAAE,CAAC;QACvB,kBAAkB,EAAE,OAAO,CAAC,MAAM;QAClC,oBAAoB,EAAE,aAAa;QACnC,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM;QACnE,mBAAmB,EAAE,SAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM;QACrE,qBAAqB,EAAE,KAAK,CAAC,MAAM;KACpC,CAAC;AACJ,CAAC"}

package/dist/shields/formats/dotnet-managed.d.ts

@@ -18,4 +18,13 @@ export interface DotnetManagedExhaustionPlan {
  * and `managed-native-implementation`).
  */
 export declare function planDotnetManagedBudgetExhaustion(prng: SeededPrng, intensity?: ProtectionIntensity): DotnetManagedExhaustionPlan;
+export declare function protectDotnetManagedBuffer(rawBuffer: Buffer, options?: {
+    readonly intensity?: ProtectionIntensity;
+    readonly seed?: string | number;
+}): {
+    readonly buffer: Buffer;
+    readonly plan: DotnetManagedExhaustionPlan;
+    readonly canaryTokensEmbedded: number;
+    readonly diagnosticsEmbedded: number;
+};
 //# sourceMappingURL=dotnet-managed.d.ts.map

package/dist/shields/formats/dotnet-managed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dotnet-managed.d.ts","sourceRoot":"","sources":["../../../src/shields/formats/dotnet-managed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,6CAA6C,QAAmB,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC;CACpD;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,UAAU,EAChB,SAAS,GAAE,mBAAgC,GAC1C,2BAA2B,CAmC7B"}
+{"version":3,"file":"dotnet-managed.d.ts","sourceRoot":"","sources":["../../../src/shields/formats/dotnet-managed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D;;GAEG;AACH,eAAO,MAAM,6CAA6C,QAAmB,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC;CACpD;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,UAAU,EAChB,SAAS,GAAE,mBAAgC,GAC1C,2BAA2B,CAmC7B;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B,GACL;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAyBA"}

package/dist/shields/formats/dotnet-managed.js

@@ -1,3 +1,5 @@
+import { SeededPrng } from "../../core/prng.js";
+import { buildCanaryAndDiagnosticPayloads } from "../deception/format-payloads.js";
 /**
  * Exact constant from `morluto/rea/src/dotnet/ManagedDecodeBudget.ts:9`.
  */
@@ -20,7 +22,7 @@ export function planDotnetManagedBudgetExhaustion(prng, intensity = "balanced")
     const decoyPInvokeImports = [];
     let estimatedReaStringChargeBytes = 0;
     for (let i = 0; i < 16; i++) {
-        const sym = `bla_enclave_pinvoke_unseal_ring0_slot_${tag}_${i}`;
+        const sym = `enclave_pinvoke_unseal_ring0_slot_${tag}_${i}`;
         decoyPInvokeImports.push(sym);
     }
     for (let r = 0; r < rowCount; r++) {
@@ -38,4 +40,27 @@ export function planDotnetManagedBudgetExhaustion(prng, intensity = "balanced")
         totalReaRepresentationChargeBytes,
     };
 }
+export function protectDotnetManagedBuffer(rawBuffer, options = {}) {
+    const intensity = options.intensity ?? "balanced";
+    const prng = new SeededPrng(options.seed ?? "bla-dotnet-v1");
+    const plan = planDotnetManagedBudgetExhaustion(prng, intensity);
+    const deception = buildCanaryAndDiagnosticPayloads(prng, intensity);
+    // Stay under REA_MAX_MANAGED_METADATA_REPRESENTATION_BYTES (64 MiB) while
+    // still flooding ManagedDecodeBudget string/row charges with canary bait.
+    const metadataSection = Buffer.from([
+        "",
+        "BLA_DOTNET_CLR_SHIELD_V1",
+        ...plan.decoyPInvokeImports,
+        `charge:${plan.totalReaRepresentationChargeBytes}`,
+        `maxRepresentationBytes:${REA_MAX_MANAGED_METADATA_REPRESENTATION_BYTES}`,
+        ...deception.textRecords,
+        "",
+    ].join("\0"), "utf8");
+    return {
+        buffer: Buffer.concat([rawBuffer, metadataSection]),
+        plan,
+        canaryTokensEmbedded: deception.canary.syntheticCanaryTokens.length,
+        diagnosticsEmbedded: deception.diagnostics.diagnosticsInjected.length,
+    };
+}
 //# sourceMappingURL=dotnet-managed.js.map

package/dist/shields/formats/dotnet-managed.js.map

@@ -1 +1 @@
-{"version":3,"file":"dotnet-managed.js","sourceRoot":"","sources":["../../../src/shields/formats/dotnet-managed.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAU9E;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgB,EAChB,YAAiC,UAAU;IAE3C,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,SAAS,KAAK,UAAU;YACxB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,IAAI,6BAA6B,GAAG,CAAC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,yCAAyC,GAAG,IAAI,CAAC,EAAE,CAAC;QAChE,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,4EAA4E;QAC5E,6BAA6B,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,0BAA0B,GAAG,QAAQ,GAAG,GAAG,CAAC;IAClD,MAAM,iCAAiC,GACrC,6BAA6B,GAAG,0BAA0B,CAAC;IAE7D,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC7C,mBAAmB;QACnB,6BAA6B;QAC7B,0BAA0B;QAC1B,iCAAiC;KAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"dotnet-managed.js","sourceRoot":"","sources":["../../../src/shields/formats/dotnet-managed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAU9E;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgB,EAChB,YAAiC,UAAU;IAE3C,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,SAAS,KAAK,UAAU;YACxB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,IAAI,6BAA6B,GAAG,CAAC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,qCAAqC,GAAG,IAAI,CAAC,EAAE,CAAC;QAC5D,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,4EAA4E;QAC5E,6BAA6B,IAAI,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,0BAA0B,GAAG,QAAQ,GAAG,GAAG,CAAC;IAClD,MAAM,iCAAiC,GACrC,6BAA6B,GAAG,0BAA0B,CAAC;IAE7D,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC7C,mBAAmB;QACnB,6BAA6B;QAC7B,0BAA0B;QAC1B,iCAAiC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,UAGI,EAAE;IAON,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CACjC;QACE,EAAE;QACF,0BAA0B;QAC1B,GAAG,IAAI,CAAC,mBAAmB;QAC3B,UAAU,IAAI,CAAC,iCAAiC,EAAE;QAClD,0BAA0B,6CAA6C,EAAE;QACzE,GAAG,SAAS,CAAC,WAAW;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IACF,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI;QACJ,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM;QACnE,mBAAmB,EAAE,SAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM;KACtE,CAAC;AACJ,CAAC"}

package/dist/shields/formats/electron-fuses.d.ts

@@ -1,4 +1,7 @@
 import { SeededPrng } from "../../core/prng.js";
+export declare class UnsupportedElectronFuseContextError extends Error {
+    constructor(message: string);
+}
 /**
  * Electron V1 Fuse Wire constants (`src/domain/electron/electronFuses.ts` in `morluto/rea`).
  */
@@ -7,32 +10,84 @@ export declare const ELECTRON_FUSE_STATE: {
     readonly DISABLED: 48;
     readonly ENABLED: 49;
     readonly REMOVED: 114;
+    readonly DECOY: 57;
 };
-export interface ElectronFuseInspectionSummary {
+export declare const ELECTRON_FUSE_NAMES: readonly ["RunAsNode", "EnableCookieEncryption", "EnableNodeOptionsEnvironmentVariable", "EnableNodeCliInspectArguments", "EnableEmbeddedAsarIntegrityValidation", "OnlyLoadAppFromAsar", "LoadBrowserProcessSpecificV8Snapshot", "GrantFileProtocolExtraPrivileges"];
+export type ElectronFuseName = (typeof ELECTRON_FUSE_NAMES)[number];
+export type ElectronFuseWireValue = "enabled" | "disabled" | "removed" | "unknown";
+export type ElectronFuseStatus = "verified" | "absent" | "unsupported" | "ambiguous";
+export interface ElectronFuseInspectionResult {
+    readonly status: ElectronFuseStatus;
     readonly sentinelCount: number;
     readonly sentinelOffsets: readonly number[];
+    readonly realFuseOffset: number;
+    readonly fuseVersion: number;
+    readonly fuseWireLength: number;
+    readonly fuses: Partial<Record<ElectronFuseName, ElectronFuseWireValue>>;
     readonly runAsNodeEnabled: boolean;
     readonly nodeCliInspectEnabled: boolean;
     readonly nodeOptionsEnabled: boolean;
     readonly asarIntegrityEnforced: boolean;
     readonly onlyLoadFromAsarEnforced: boolean;
     readonly exceedsReaSentinelLimit: boolean;
+    readonly hardened: boolean;
+    readonly diagnostic?: string;
+}
+export type ElectronFuseInspectionSummary = ElectronFuseInspectionResult;
+export interface ElectronHardeningContext {
+    readonly electronVersion: string;
+    readonly asarPath?: string;
+    readonly hasEmbeddedAsarIntegrity: boolean;
+    readonly asarHeaderHash?: string;
+    readonly codeSigningPolicy: "will-resign" | "unsigned-local-fixture";
+    readonly injectDecoySentinelOverflow?: boolean;
+    readonly seed?: string | number;
+    readonly allowRawContainer?: boolean;
 }
+export interface ElectronHardeningReport {
+    readonly buffer: Buffer;
+    readonly fusePolicy: {
+        readonly status: "hardened";
+        readonly fuseVersion: number;
+        readonly fuseOffset: number;
+        readonly mutatedFuses: Readonly<Record<string, {
+            readonly from: ElectronFuseWireValue;
+            readonly to: ElectronFuseWireValue;
+        }>>;
+        readonly decoySentinelsInjected: number;
+    };
+    readonly asarIntegrityStatus: "verified" | "not-applicable";
+    readonly signatureStatus: "unverified-requires-resign" | "unsigned-fixture";
+    readonly mutatedFuses: readonly ElectronFuseName[];
+}
+export declare function isSupportedNativeExecutableContainer(bytes: Buffer): boolean;
 /**
  * Inspects a binary buffer (ELF / Mach-O / PE) for Electron Fuse sentinels
- * (`dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX`), matching REA's `ElectronFuseReader.ts`.
+ * (`dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX`), matching REA's `ElectronFuseReader.ts`
+ * while distinguishing verified V1 fuse blocks from unsupported/truncated/ambiguous wires.
  */
-export declare function inspectElectronFusesInBuffer(bytes: Buffer): ElectronFuseInspectionSummary;
+export declare function inspectElectronFusesBuffer(bytes: Buffer): ElectronFuseInspectionResult;
+export declare const inspectElectronFusesInBuffer: typeof inspectElectronFusesBuffer;
 /**
- * Hardens any real Electron Fuse V1 wire in-place (disabling `RunAsNode`,
- * `EnableNodeOptionsEnvironmentVariable`, and `EnableNodeCliInspectArguments`
- * while enabling `EnableCookieEncryption`, `EnableEmbeddedAsarIntegrityValidation`,
- * and `OnlyLoadAppFromAsar`) AND builds a 34-sentinel overflow trailer that trips
- * REA's `ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice = 32` (`ElectronFuseReader.ts:381`)!
+ * Builds 34 decoy sentinel records (`> maximumSentinelsPerSlice = 32`) tagged with
+ * BLA's `0x39` (`'9'`) decoy marker so `inspectElectronFusesBuffer` distinguishes
+ * them from real V1 fuse blocks while tripping REA's sentinel slice limit.
+ */
+export declare function buildDecoyElectronFuseSentinels(prng: SeededPrng, decoyCount?: number): Buffer;
+/**
+ * Hardens a single verified Electron Fuse V1 wire in-place (if present and unambiguous)
+ * AND builds a 34-sentinel overflow trailer that trips REA's
+ * `ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice = 32`.
  */
 export declare function hardenAndOverflowElectronFuses(bytes: Buffer, prng: SeededPrng): {
     readonly patchedInPlaceCount: number;
     readonly decoySentinelsBuffer: Buffer;
     readonly decoySentinelsInjected: number;
 };
+/**
+ * Context-verified Electron Fuse hardening entrypoint.
+ * Verifies executable container format, unambiguous V1 fuse wire, Electron version,
+ * embedded ASAR integrity metadata, and code-signing policy before mutating any fuse bytes.
+ */
+export declare function hardenElectronFusesWithContext(bytes: Buffer, context: ElectronHardeningContext): ElectronHardeningReport;
 //# sourceMappingURL=electron-fuses.d.ts.map

package/dist/shields/formats/electron-fuses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"electron-fuses.d.ts","sourceRoot":"","sources":["../../../src/shields/formats/electron-fuses.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,4BAA4B,qBAGxC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AAEX,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,6BAA6B,CA4CzF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,GACf;IACD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC,CAqDA"}
+{"version":3,"file":"electron-fuses.d.ts","sourceRoot":"","sources":["../../../src/shields/formats/electron-fuses.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B,qBAGxC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,eAAO,MAAM,mBAAmB,uQAStB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,UAAU,GACV,SAAS,GACT,SAAS,CAAC;AACd,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,QAAQ,GACR,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAEzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,aAAa,GAAG,wBAAwB,CAAC;IACrE,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAC7B,MAAM,CACJ,MAAM,EACN;YACE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YACrC,QAAQ,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACpC,CACF,CACF,CAAC;QACF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,mBAAmB,EAAE,UAAU,GAAG,gBAAgB,CAAC;IAC5D,QAAQ,CAAC,eAAe,EAAE,4BAA4B,GAAG,kBAAkB,CAAC;IAC5E,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpD;AAkBD,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CA0B3E;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GACZ,4BAA4B,CA8I9B;AAED,eAAO,MAAM,4BAA4B,mCAA6B,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,UAAU,EAChB,UAAU,SAAK,GACd,MAAM,CAoBR;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,GACf;IACD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC,CA2BA;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,uBAAuB,CAuJzB"}