wowdump 0.2.1 → 0.3.2

package/dist/broker-server.js

@@ -1,466 +0,0 @@
-import { createConnection, createServer } from "node:net";
-import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-import { mkdir, rename, writeFile } from "node:fs/promises";
-import { open, readFile, unlink } from "node:fs/promises";
-import { join } from "node:path";
-import { BROKER_MAX_INLINE_BYTES, BROKER_PROTOCOL_VERSION, FrameDecoder, BrokerProtocolError, encodeFrame, sidHash } from "./broker-protocol.js";
-export class FileBrokerArtifactStore {
-    directory;
-    constructor(directory) {
-        this.directory = directory;
-    }
-    async write(requestId, value) {
-        const body = Buffer.from(JSON.stringify(value), "utf8");
-        const sha256 = createHash("sha256").update(body).digest("hex");
-        await mkdir(this.directory, { recursive: true });
-        const name = `broker-response-${requestId.replace(/[^A-Za-z0-9_.-]/g, "_")}-${sha256.slice(0, 16)}.json`;
-        const path = join(this.directory, name);
-        const temporary = `${path}.${process.pid}.tmp`;
-        await writeFile(temporary, body);
-        await rename(temporary, path);
-        return { kind: "artifact", path, bytes: body.length, sha256, encoding: "json" };
-    }
-}
-/** Cross-process singleton guard. Windows deployments can replace this with a native mutex guard. */
-export class FileBrokerSingletonGuard {
-    lockPath;
-    expectedPipeName;
-    handle;
-    aclInspector;
-    aclConfigurator;
-    expectedSidHash;
-    constructor(lockPath, expectedPipeName, options = {}) {
-        this.lockPath = lockPath;
-        this.expectedPipeName = expectedPipeName;
-        this.aclInspector = options.aclInspector ?? new WindowsNamedPipeAclInspector();
-        this.aclConfigurator = options.aclConfigurator ?? new WindowsNamedPipeAclConfigurator();
-        this.expectedSidHash = options.expectedSidHash ?? pipeSidHash(expectedPipeName);
-    }
-    async acquire(pipeName) {
-        if (pipeName !== this.expectedPipeName)
-            return null;
-        try {
-            this.handle = await open(this.lockPath, "wx");
-            await this.handle.writeFile(JSON.stringify({ pid: process.pid, pipeName, acquiredAt: new Date().toISOString() }), "utf8");
-        }
-        catch {
-            if (await brokerOwnerAlive(this.lockPath, pipeName))
-                return null;
-            await unlink(this.lockPath).catch(() => undefined);
-            try {
-                this.handle = await open(this.lockPath, "wx");
-                await this.handle.writeFile(JSON.stringify({ pid: process.pid, pipeName, acquiredAt: new Date().toISOString() }), "utf8");
-            }
-            catch {
-                return null;
-            }
-        }
-        return { release: async () => { await this.handle?.close().catch(() => undefined); this.handle = undefined; await unlink(this.lockPath).catch(() => undefined); } };
-    }
-    async secureAcl(pipeName) {
-        if (pipeName !== this.expectedPipeName || !this.expectedSidHash)
-            throw new BrokerProtocolError("ACL_MISMATCH", "named-pipe SID namespace mismatch");
-        await this.aclConfigurator.configure(pipeName);
-    }
-    async verifyAcl(pipeName) {
-        if (pipeName !== this.expectedPipeName || !this.expectedSidHash)
-            return false;
-        try {
-            const acl = await this.aclInspector.inspect(pipeName);
-            if (sidHash(acl.currentSid) !== this.expectedSidHash)
-                return false;
-            const currentSid = normalizeSid(acl.currentSid);
-            const trustedOwners = new Set([currentSid, "S-1-5-18", "S-1-5-32-544"]);
-            if (!trustedOwners.has(normalizeSid(acl.ownerSid)))
-                return false;
-            const broadSids = new Set(["S-1-1-0", "S-1-5-7", "S-1-5-11", "S-1-5-32-545"]);
-            if (acl.access.some(entry => entry.type === "allow" && broadSids.has(normalizeSid(entry.sid)) && grantsMutationRights(entry.rights)))
-                return false;
-            if (acl.access.some(entry => entry.type === "deny" && normalizeSid(entry.sid) === currentSid))
-                return false;
-            return acl.access.some(entry => entry.type === "allow" && normalizeSid(entry.sid) === currentSid);
-        }
-        catch {
-            return false;
-        }
-    }
-}
-export class WindowsNamedPipeAclConfigurator {
-    async configure(pipeName) {
-        if (process.platform !== "win32")
-            throw new Error("Windows named-pipe ACL configuration requires Windows");
-        const script = [
-            "$ErrorActionPreference='Stop'",
-            "$source=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:WOW_BROKER_ACL_SOURCE))",
-            "Add-Type -TypeDefinition $source -Language CSharp",
-            "[WowDumpPipeAcl]::Configure($env:WOW_BROKER_ACL_PIPE)|Out-Null"
-        ].join(";");
-        const result = await runAclProcess("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script], pipeName.replace(/^\\\\\.\\pipe\\/i, ""));
-        if (result.code !== 0)
-            throw new Error(result.stderr || "named-pipe ACL configuration failed");
-    }
-}
-export class WindowsNamedPipeAclInspector {
-    async inspect(pipeName) {
-        if (process.platform !== "win32")
-            throw new Error("Windows named-pipe ACL inspection requires Windows");
-        const script = [
-            "$ErrorActionPreference='Stop'",
-            "$source=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:WOW_BROKER_ACL_SOURCE))",
-            "Add-Type -TypeDefinition $source -Language CSharp",
-            "[WowDumpPipeAcl]::Inspect($env:WOW_BROKER_ACL_PIPE)|ConvertTo-Json -Depth 4 -Compress"
-        ].join(";");
-        const result = await runAclProcess("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script], pipeName.replace(/^\\\\\.\\pipe\\/i, ""));
-        if (result.code !== 0)
-            throw new Error(result.stderr || "named-pipe ACL query failed");
-        const parsed = JSON.parse(result.stdout);
-        if (!parsed || typeof parsed.currentSid !== "string" || typeof parsed.ownerSid !== "string" || !Array.isArray(parsed.access))
-            throw new Error("named-pipe ACL response is invalid");
-        return parsed;
-    }
-}
-const PIPE_ACL_INSPECTOR_SOURCE = String.raw `
-using System;
-using System.Collections.Generic;
-using System.ComponentModel;
-using System.IO.Pipes;
-using System.Runtime.InteropServices;
-using System.Security.AccessControl;
-using System.Security.Principal;
-
-public static class WowDumpPipeAcl {
-  public sealed class Entry {
-    public string sid;
-    public string type;
-    public string rights;
-  }
-
-  public sealed class Snapshot {
-    public string currentSid;
-    public string ownerSid;
-    public Entry[] access;
-  }
-
-  [DllImport("advapi32.dll", SetLastError = true)]
-  private static extern uint GetSecurityInfo(
-    IntPtr handle,
-    int objectType,
-    uint securityInfo,
-    out IntPtr owner,
-    out IntPtr group,
-    out IntPtr dacl,
-    out IntPtr sacl,
-    out IntPtr descriptor);
-
-  [DllImport("advapi32.dll")]
-  private static extern uint GetSecurityDescriptorLength(IntPtr descriptor);
-
-  [DllImport("kernel32.dll")]
-  private static extern IntPtr LocalFree(IntPtr value);
-
-  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  private static extern IntPtr CreateFile(
-    string name,
-    uint access,
-    uint share,
-    IntPtr security,
-    uint creation,
-    uint flags,
-    IntPtr template);
-
-  [DllImport("kernel32.dll", SetLastError = true)]
-  private static extern bool CloseHandle(IntPtr handle);
-
-  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  private static extern bool ConvertStringSecurityDescriptorToSecurityDescriptor(
-    string sddl,
-    uint revision,
-    out IntPtr descriptor,
-    out uint size);
-
-  [DllImport("advapi32.dll", SetLastError = true)]
-  private static extern bool GetSecurityDescriptorDacl(
-    IntPtr descriptor,
-    out bool present,
-    out IntPtr dacl,
-    out bool defaulted);
-
-  [DllImport("advapi32.dll", SetLastError = true)]
-  private static extern uint SetSecurityInfo(
-    IntPtr handle,
-    int objectType,
-    uint securityInfo,
-    IntPtr owner,
-    IntPtr group,
-    IntPtr dacl,
-    IntPtr sacl);
-
-  public static void Configure(string pipeName) {
-    const uint ReadControl = 0x00020000;
-    const uint WriteDac = 0x00040000;
-    const uint OpenExisting = 3;
-    const int SeKernelObject = 6;
-    const uint DaclSecurityInformation = 4;
-    const uint ProtectedDaclSecurityInformation = 0x80000000;
-    string fullName = @"\\.\pipe\" + pipeName;
-    IntPtr handle = CreateFile(
-      fullName,
-      ReadControl | WriteDac,
-      0,
-      IntPtr.Zero,
-      OpenExisting,
-      0,
-      IntPtr.Zero);
-    if (handle == new IntPtr(-1)) throw new Win32Exception(Marshal.GetLastWin32Error());
-    try {
-      string currentSid = WindowsIdentity.GetCurrent().User.Value;
-      string sddl = "D:P(A;;GA;;;" + currentSid + ")(A;;GA;;;BA)(A;;GA;;;SY)";
-      IntPtr descriptor;
-      uint descriptorSize;
-      if (!ConvertStringSecurityDescriptorToSecurityDescriptor(sddl, 1, out descriptor, out descriptorSize)) {
-        throw new Win32Exception(Marshal.GetLastWin32Error());
-      }
-      try {
-        bool present, defaulted;
-        IntPtr dacl;
-        if (!GetSecurityDescriptorDacl(descriptor, out present, out dacl, out defaulted) || !present) {
-          throw new Win32Exception(Marshal.GetLastWin32Error());
-        }
-        uint code = SetSecurityInfo(
-          handle,
-          SeKernelObject,
-          DaclSecurityInformation | ProtectedDaclSecurityInformation,
-          IntPtr.Zero,
-          IntPtr.Zero,
-          dacl,
-          IntPtr.Zero);
-        if (code != 0) throw new Win32Exception((int)code);
-      } finally {
-        LocalFree(descriptor);
-      }
-    } finally {
-      CloseHandle(handle);
-    }
-  }
-
-  public static Snapshot Inspect(string pipeName) {
-    using (var pipe = new NamedPipeClientStream(".", pipeName, PipeDirection.InOut)) {
-      pipe.Connect(1000);
-      IntPtr owner, group, dacl, sacl, descriptor;
-      const int SeKernelObject = 6;
-      const uint OwnerAndDacl = 1u | 4u;
-      uint code = GetSecurityInfo(
-        pipe.SafePipeHandle.DangerousGetHandle(),
-        SeKernelObject,
-        OwnerAndDacl,
-        out owner,
-        out group,
-        out dacl,
-        out sacl,
-        out descriptor);
-      if (code != 0) throw new Win32Exception((int)code);
-      try {
-        int length = checked((int)GetSecurityDescriptorLength(descriptor));
-        var bytes = new byte[length];
-        Marshal.Copy(descriptor, bytes, 0, length);
-        var security = new RawSecurityDescriptor(bytes, 0);
-        var entries = new List<Entry>();
-        if (security.DiscretionaryAcl != null) {
-          foreach (GenericAce ace in security.DiscretionaryAcl) {
-            var known = ace as KnownAce;
-            var qualified = ace as QualifiedAce;
-            if (known == null || qualified == null || qualified.SecurityIdentifier == null) continue;
-            string type = qualified.AceQualifier == AceQualifier.AccessAllowed
-              ? "allow"
-              : qualified.AceQualifier == AceQualifier.AccessDenied ? "deny" : "other";
-            entries.Add(new Entry {
-              sid = qualified.SecurityIdentifier.Value,
-              type = type,
-              rights = known.AccessMask.ToString()
-            });
-          }
-        }
-        return new Snapshot {
-          currentSid = WindowsIdentity.GetCurrent().User.Value,
-          ownerSid = security.Owner == null ? null : security.Owner.Value,
-          access = entries.ToArray()
-        };
-      } finally {
-        if (descriptor != IntPtr.Zero) LocalFree(descriptor);
-      }
-    }
-  }
-}`;
-function pipeSidHash(pipeName) {
-    return /(?:^|\\)wowdump-frida-([a-f0-9]{24})$/i.exec(pipeName)?.[1]?.toLowerCase();
-}
-function normalizeSid(value) { return value.trim().toUpperCase(); }
-function grantsMutationRights(rights) {
-    const numeric = /^\d+$/.test(rights.trim()) ? Number(rights.trim()) : undefined;
-    if (numeric !== undefined)
-        return (numeric & (2 | 4 | 16 | 256 | 262_144 | 524_288)) !== 0;
-    return /write|create.?new.?instance|change.?permissions|take.?ownership|full.?control/i.test(rights);
-}
-function runAclProcess(file, args, pipeName) {
-    return new Promise(resolve => {
-        const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
-        const env = { SystemRoot: systemRoot, WINDIR: systemRoot, PATH: process.env.PATH, PATHEXT: process.env.PATHEXT, PSModulePath: join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "Modules"), WOW_BROKER_ACL_PIPE: pipeName, WOW_BROKER_ACL_SOURCE: Buffer.from(PIPE_ACL_INSPECTOR_SOURCE, "utf16le").toString("base64") };
-        const child = spawn(file, args, { env, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf8");
-        child.stderr.setEncoding("utf8");
-        child.stdout.on("data", chunk => { stdout += chunk; });
-        child.stderr.on("data", chunk => { stderr += chunk; });
-        child.on("error", error => resolve({ code: null, stdout, stderr: `${stderr}${error.message}` }));
-        child.on("exit", code => resolve({ code, stdout, stderr }));
-    });
-}
-async function brokerOwnerAlive(lockPath, pipeName) {
-    let owner;
-    try {
-        owner = JSON.parse(await readFile(lockPath, "utf8"));
-    }
-    catch {
-        owner = undefined;
-    }
-    if (owner && typeof owner === "object" && typeof owner.pid === "number") {
-        try {
-            process.kill(owner.pid, 0);
-            return true;
-        }
-        catch { /* stale PID */ }
-    }
-    return pipeReachable(pipeName);
-}
-function pipeReachable(pipeName) {
-    return new Promise(resolve => {
-        const socket = createConnection(pipeName);
-        const finish = (value) => { socket.destroy(); resolve(value); };
-        const timer = setTimeout(() => finish(false), 100);
-        socket.once("connect", () => { clearTimeout(timer); finish(true); });
-        socket.once("error", () => { clearTimeout(timer); finish(false); });
-    });
-}
-export class BrokerServer {
-    options;
-    server;
-    sockets = new Set();
-    preVerificationSockets = new Set();
-    guardLease;
-    aclVerified = false;
-    closePromise;
-    serverClosePromise;
-    guardReleasePromise;
-    constructor(options) {
-        this.options = options;
-    }
-    async listen() {
-        if (this.server)
-            return;
-        if (this.options.guard) {
-            this.guardLease = await this.options.guard.acquire(this.options.pipeName) ?? undefined;
-            if (!this.guardLease)
-                throw new BrokerProtocolError("STALE_LOCK_UNSAFE", "Broker singleton is already owned", "Connect to the existing Broker instance.");
-        }
-        this.server = createServer(socket => this.acceptSocket(socket));
-        try {
-            await new Promise((resolve, reject) => { this.server.once("error", reject); this.server.listen(this.options.pipeName, () => { this.server.off("error", reject); resolve(); }); });
-            await this.options.guard?.secureAcl?.(this.options.pipeName);
-            if (this.options.guard && !await this.options.guard.verifyAcl(this.options.pipeName))
-                throw new BrokerProtocolError("ACL_MISMATCH", "named-pipe ACL or SID namespace mismatch");
-            this.aclVerified = true;
-            for (const socket of this.preVerificationSockets)
-                socket.destroy();
-            this.preVerificationSockets.clear();
-        }
-        catch (error) {
-            await this.closeInternal().catch(() => undefined);
-            throw error;
-        }
-    }
-    async close() {
-        if (this.closePromise)
-            return this.closePromise;
-        this.closePromise = (async () => {
-            await this.closeServer();
-            await this.releaseGuard();
-        })().finally(() => { this.closePromise = undefined; });
-        return this.closePromise;
-    }
-    async closeServer() {
-        if (this.serverClosePromise)
-            return this.serverClosePromise;
-        this.serverClosePromise = this.closeServerInternal().finally(() => { this.serverClosePromise = undefined; });
-        return this.serverClosePromise;
-    }
-    async releaseGuard() {
-        if (this.guardReleasePromise)
-            return this.guardReleasePromise;
-        this.guardReleasePromise = (async () => {
-            const lease = this.guardLease;
-            this.guardLease = undefined;
-            await lease?.release();
-        })().finally(() => { this.guardReleasePromise = undefined; });
-        return this.guardReleasePromise;
-    }
-    async closeInternal() {
-        try {
-            await this.closeServer();
-        }
-        finally {
-            await this.releaseGuard();
-        }
-    }
-    async closeServerInternal() {
-        for (const socket of this.preVerificationSockets)
-            socket.destroy();
-        this.preVerificationSockets.clear();
-        for (const socket of this.sockets)
-            socket.destroy();
-        const server = this.server;
-        this.server = undefined;
-        this.aclVerified = false;
-        if (server?.listening)
-            await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
-    }
-    acceptSocket(socket) {
-        if (!this.aclVerified) {
-            this.preVerificationSockets.add(socket);
-            socket.once("close", () => this.preVerificationSockets.delete(socket));
-            return;
-        }
-        this.sockets.add(socket);
-        const decoder = new FrameDecoder();
-        let queued = 0;
-        socket.on("close", () => this.sockets.delete(socket));
-        socket.on("data", async (chunk) => {
-            try {
-                for (const request of decoder.push(chunk)) {
-                    if (queued >= (this.options.maxQueuedPerSocket ?? 128))
-                        throw new BrokerProtocolError("REQUEST_CANCELLED", "socket queue limit reached", "Wait for pending Broker requests.");
-                    queued += 1;
-                    try {
-                        socket.write(encodeFrame(await this.externalize(await this.options.core.accept(request))));
-                    }
-                    finally {
-                        queued -= 1;
-                    }
-                }
-            }
-            catch (error) {
-                const protocolError = error instanceof BrokerProtocolError ? error : new BrokerProtocolError("FRAME_INVALID", error instanceof Error ? error.message : String(error));
-                socket.write(encodeFrame({ schemaVersion: 1, protocolVersion: BROKER_PROTOCOL_VERSION, requestId: "unknown", ok: false, error: { code: protocolError.code, message: protocolError.message, nextAction: protocolError.nextAction } }));
-            }
-        });
-    }
-    async externalize(response) {
-        if (!response.ok || !this.options.artifactStore)
-            return response;
-        if (Buffer.byteLength(JSON.stringify(response.result), "utf8") <= BROKER_MAX_INLINE_BYTES)
-            return response;
-        const reference = await this.options.artifactStore.write(response.requestId, response.result);
-        return { ...response, result: { ...reference } };
-    }
-}

package/dist/build-bundle-loader.js

@@ -1,183 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { basename, isAbsolute, relative, resolve } from "node:path";
-import { buildBundleDirectory } from "./build-bundle.js";
-export const BUILD_BUNDLE_SCHEMA = "wowdump.build-bundle.v1";
-export const BUILD_BUNDLE_PAYLOADS = [
-    "build-profile.json",
-    "lua-targets.jsonl",
-    "data-sources.json",
-    "signatures.json"
-];
-const REQUIRED_PAYLOADS = new Set(BUILD_BUNDLE_PAYLOADS);
-export class BuildBundleStore {
-    profileRoot;
-    cache = new Map();
-    constructor(profileRoot) {
-        if (typeof profileRoot !== "string" || !profileRoot.trim())
-            invalid("profileRoot must be a non-empty string");
-        this.profileRoot = resolve(profileRoot);
-    }
-    async manifest(buildKey) {
-        return (await this.load(buildKey)).manifest;
-    }
-    async readText(buildKey, file) {
-        const bytes = await this.payload(buildKey, file);
-        const text = bytes.toString("utf8");
-        if (file === "lua-targets.jsonl")
-            parseJsonlWithBuildKey(text, buildKey, file);
-        else
-            parseJsonWithBuildKey(text, buildKey, file);
-        return text;
-    }
-    async readJson(buildKey, file) {
-        return parseJsonWithBuildKey((await this.payload(buildKey, file)).toString("utf8"), buildKey, file);
-    }
-    async readJsonl(buildKey, file) {
-        return parseJsonlWithBuildKey((await this.payload(buildKey, file)).toString("utf8"), buildKey, file);
-    }
-    async payload(buildKey, file) {
-        if (!REQUIRED_PAYLOADS.has(file))
-            invalid(`unsupported payload ${String(file)}`);
-        const bytes = (await this.load(buildKey)).payloads.get(file);
-        if (!bytes)
-            invalid(`${buildKey}/${file} is not present in the verified bundle`);
-        return bytes;
-    }
-    load(buildKey) {
-        const cached = this.cache.get(buildKey);
-        if (cached)
-            return cached;
-        const pending = this.loadUncached(buildKey);
-        this.cache.set(buildKey, pending);
-        void pending.catch(() => {
-            if (this.cache.get(buildKey) === pending)
-                this.cache.delete(buildKey);
-        });
-        return pending;
-    }
-    async loadUncached(buildKey) {
-        let directory;
-        try {
-            directory = buildBundleDirectory(this.profileRoot, buildKey);
-        }
-        catch (error) {
-            invalid(`${buildKey}: ${errorText(error)}`);
-        }
-        const manifestPath = containedPath(directory, "manifest.json");
-        let manifestBytes;
-        try {
-            manifestBytes = await readFile(manifestPath);
-        }
-        catch (error) {
-            invalid(`${buildKey}/manifest.json: ${errorText(error)}`);
-        }
-        const manifest = validateManifest(parseJson(manifestBytes.toString("utf8"), "manifest.json"), buildKey);
-        const entries = new Map(manifest.outputs.map(output => [output.file, output]));
-        const payloadPairs = await Promise.all(BUILD_BUNDLE_PAYLOADS.map(async (file) => {
-            const entry = entries.get(file);
-            if (!entry)
-                invalid(`${buildKey}/manifest.json: missing output ${file}`);
-            const path = containedPath(directory, file);
-            let bytes;
-            try {
-                bytes = await readFile(path);
-            }
-            catch (error) {
-                invalid(`${buildKey}/${file}: ${errorText(error)}`);
-            }
-            if (bytes.length !== entry.size)
-                invalid(`${buildKey}/${file}: size mismatch, expected ${entry.size}, got ${bytes.length}`);
-            const actualHash = createHash("sha256").update(bytes).digest("hex");
-            if (actualHash !== entry.sha256)
-                invalid(`${buildKey}/${file}: sha256 mismatch, expected ${entry.sha256}, got ${actualHash}`);
-            return [file, bytes];
-        }));
-        return { manifest, payloads: new Map(payloadPairs) };
-    }
-}
-function validateManifest(value, buildKey) {
-    if (!isRecord(value))
-        invalid(`${buildKey}/manifest.json: root must be an object`);
-    if (value.schema !== BUILD_BUNDLE_SCHEMA)
-        invalid(`${buildKey}/manifest.json: schema must be ${BUILD_BUNDLE_SCHEMA}`);
-    if (value.buildKey !== buildKey)
-        invalid(`${buildKey}/manifest.json: buildKey mismatch`);
-    const match = /^([a-z0-9_]+)@([0-9A-Za-z._-]+)$/.exec(buildKey);
-    if (!match)
-        invalid(`${buildKey}/manifest.json: invalid requested buildKey`);
-    if (value.flavor !== match[1])
-        invalid(`${buildKey}/manifest.json: flavor mismatch`);
-    if (value.version !== match[2])
-        invalid(`${buildKey}/manifest.json: version mismatch`);
-    if (!Array.isArray(value.outputs) || value.outputs.length !== BUILD_BUNDLE_PAYLOADS.length) {
-        invalid(`${buildKey}/manifest.json: outputs must contain exactly ${BUILD_BUNDLE_PAYLOADS.length} required payloads`);
-    }
-    const seen = new Set();
-    const outputs = value.outputs.map((candidate, index) => {
-        if (!isRecord(candidate))
-            invalid(`${buildKey}/manifest.json: outputs[${index}] must be an object`);
-        const file = candidate.file;
-        if (typeof file !== "string" || !REQUIRED_PAYLOADS.has(file))
-            invalid(`${buildKey}/manifest.json: invalid output file ${String(file)}`);
-        if (file !== basename(file) || isAbsolute(file) || file === "." || file === "..")
-            invalid(`${buildKey}/manifest.json: output path must be a basename: ${file}`);
-        if (seen.has(file))
-            invalid(`${buildKey}/manifest.json: duplicate output ${file}`);
-        seen.add(file);
-        if (!Number.isSafeInteger(candidate.size) || Number(candidate.size) < 0)
-            invalid(`${buildKey}/manifest.json: invalid size for ${file}`);
-        if (typeof candidate.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(candidate.sha256))
-            invalid(`${buildKey}/manifest.json: invalid sha256 for ${file}`);
-        return { file: file, size: Number(candidate.size), sha256: candidate.sha256 };
-    });
-    for (const file of BUILD_BUNDLE_PAYLOADS)
-        if (!seen.has(file))
-            invalid(`${buildKey}/manifest.json: missing output ${file}`);
-    return { ...value, schema: BUILD_BUNDLE_SCHEMA, buildKey, flavor: match[1], version: match[2], outputs };
-}
-function containedPath(directory, file) {
-    if (file !== basename(file) || isAbsolute(file))
-        invalid(`payload path must be a basename: ${file}`);
-    const path = resolve(directory, file);
-    const child = relative(directory, path);
-    if (!child || child.startsWith("..") || isAbsolute(child))
-        invalid(`payload path escapes bundle directory: ${file}`);
-    return path;
-}
-function parseJsonWithBuildKey(text, buildKey, file) {
-    const value = parseJson(text, file);
-    if (!isRecord(value))
-        invalid(`${buildKey}/${file}: root must be an object`);
-    if (value.buildKey !== buildKey)
-        invalid(`${buildKey}/${file}: semantic buildKey mismatch`);
-    return value;
-}
-function parseJsonlWithBuildKey(text, buildKey, file) {
-    const records = text.split(/\r?\n/).filter(Boolean).map((line, index) => {
-        const value = parseJson(line, `${file}:${index + 1}`);
-        if (!isRecord(value))
-            invalid(`${buildKey}/${file}:${index + 1}: record must be an object`);
-        if (value.buildKey !== buildKey)
-            invalid(`${buildKey}/${file}:${index + 1}: semantic buildKey mismatch`);
-        return value;
-    });
-    return records;
-}
-function parseJson(text, label) {
-    try {
-        return JSON.parse(text);
-    }
-    catch (error) {
-        invalid(`${label}: invalid JSON: ${errorText(error)}`);
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function errorText(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function invalid(message) {
-    throw new Error(`BUILD_BUNDLE_INVALID: ${message}`);
-}

package/dist/build-bundle.js

@@ -1,11 +0,0 @@
-import { resolve } from "node:path";
-export function buildBundleDirectory(profileRoot, buildKey) {
-    const match = /^([a-z0-9_]+)@([0-9A-Za-z._-]+)$/.exec(buildKey);
-    if (!match)
-        throw new Error(`Invalid buildKey: ${buildKey}`);
-    const root = resolve(profileRoot);
-    const directory = resolve(root, match[1], match[2]);
-    if (!directory.startsWith(root + "\\") && directory !== root)
-        throw new Error(`Invalid buildKey path: ${buildKey}`);
-    return directory;
-}