[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_110":111,"_112":113},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","cleitoncosta","name","grimorio-evidence-memory","path","lib/archive_forensics.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/cleitoncosta/grimorio-evidence-memory/code/lib/archive_forensics.ts","extension","id","8a185745-862f-4120-94f6-fcbb7738d151","archive_forensics.ts","fileId","8c06f9b8-aae5-11f1-8fa2-1607ee4eb77e","parentId","cff173e0-aa97-11f1-b2c7-1607ee4eb77e","branchId","a63c93e7-3d77-4ab6-bcb1-01531faf38ba","branchVersion",58,"latest",true,"createdAt",["D",1788805294333],"version",1,"fileType","script","content","export type ZipEntryMeta={\n index:number;name:string;flags:number;method:number;crc32:number;compressed_size:number;uncompressed_size:number;\n local_header_offset:number;external_attrs:number;version_made_by:number;is_directory:boolean;is_symlink:boolean;\n path_risks:string[];compression_ratio:number|null;nested_archive_name_signal:boolean\n};\n\nfunction u16(b:Uint8Array,o:number){return b[o]|(b[o+1]<<8)}\nfunction u32(b:Uint8Array,o:number){return (b[o]|(b[o+1]<<8)|(b[o+2]<<16)|(b[o+3]<<24))>>>0}\nfunction sig(b:Uint8Array,o:number){return o+4<=b.length?u32(b,o):0}\nfunction decodeName(raw:Uint8Array,utf8:boolean){\n try{return new TextDecoder(utf8?'utf-8':'windows-1252',{fatal:false}).decode(raw)}catch{return new TextDecoder('utf-8',{fatal:false}).decode(raw)}\n}\nexport function pathRisks(name:string){\n const risks:string[]=[]; const n=name.replaceAll('\\\\','/'); const parts=n.split('/').filter(x=>x!==''&&x!=='.');\n if(n.startsWith('/')||/^[A-Za-z]:\\//.test(n)) risks.push('ABSOLUTE_OR_DRIVE_PATH');\n if(parts.includes('..')) risks.push('PATH_TRAVERSAL');\n if(n.includes(':')&&!/^[A-Za-z]:\\//.test(n)) risks.push('COLON_OR_ADS_RISK');\n const reserved=new Set(['CON','PRN','AUX','NUL',...Array.from({length:9},(_,i)=>`COM${i+1}`),...Array.from({length:9},(_,i)=>`LPT${i+1}`)]);\n for(const p of parts){const trimmed=p.replace(/[ .]+$/g,''); if(trimmed!==p)risks.push('TRAILING_DOT_SPACE'); const stem=trimmed.split('.')[0].toUpperCase();if(reserved.has(stem))risks.push('WINDOWS_RESERVED_NAME');}\n if(n.includes('\\u0000'))risks.push('NUL_BYTE');\n return [...new Set(risks)];\n}\nexport function parseZipCentralDirectory(bytes:Uint8Array){\n const reasons:string[]=[]; if(bytes.length<22)return {status:'FAIL',reasons:['TOO_SHORT_FOR_EOCD'],entries:[] as ZipEntryMeta[]};\n const start=Math.max(0,bytes.length-65557); let eocd=-1;\n for(let i=bytes.length-22;i>=start;i--){if(sig(bytes,i)===0x06054b50){eocd=i;break}}\n if(eocd<0)return {status:'FAIL',reasons:['EOCD_NOT_FOUND'],entries:[] as ZipEntryMeta[]};\n const disk=u16(bytes,eocd+4),cdDisk=u16(bytes,eocd+6),entriesDisk=u16(bytes,eocd+8),totalEntries=u16(bytes,eocd+10),cdSize=u32(bytes,eocd+12),cdOffset=u32(bytes,eocd+16),commentLen=u16(bytes,eocd+20);\n if(disk!==0||cdDisk!==0||entriesDisk!==totalEntries)reasons.push('MULTI_DISK_ZIP_UNSUPPORTED');\n if(totalEntries===0xffff||cdSize===0xffffffff||cdOffset===0xffffffff)reasons.push('ZIP64_REQUIRES_EXTENDED_PARSER');\n if(eocd+22+commentLen>bytes.length)reasons.push('EOCD_COMMENT_OUT_OF_BOUNDS');\n if(cdOffset+cdSize>bytes.length)reasons.push('CENTRAL_DIRECTORY_OUT_OF_BOUNDS');\n const entries:ZipEntryMeta[]=[]; let p=cdOffset; const cdEnd=cdOffset+cdSize;\n if(!reasons.includes('CENTRAL_DIRECTORY_OUT_OF_BOUNDS')&&!reasons.includes('ZIP64_REQUIRES_EXTENDED_PARSER')){\n for(let idx=0;idxcdEnd||sig(bytes,p)!==0x02014b50){reasons.push(`CENTRAL_HEADER_BAD_SIGNATURE_AT:${idx}`);break}\n if(p+46>cdEnd){reasons.push(`CENTRAL_HEADER_TRUNCATED_AT:${idx}`);break}\n const versionMade=u16(bytes,p+4),flags=u16(bytes,p+8),method=u16(bytes,p+10),crc=u32(bytes,p+16),csize=u32(bytes,p+20),usize=u32(bytes,p+24),nameLen=u16(bytes,p+28),extraLen=u16(bytes,p+30),commentL=u16(bytes,p+32),ext=u32(bytes,p+38),local=u32(bytes,p+42);\n const end=p+46+nameLen+extraLen+commentL;if(end>cdEnd){reasons.push(`CENTRAL_ENTRY_OUT_OF_BOUNDS_AT:${idx}`);break}\n const name=decodeName(bytes.slice(p+46,p+46+nameLen),Boolean(flags&0x800)); const host=(versionMade>>8)&0xff; const unixMode=(ext>>>16)&0xffff; const fileType=unixMode&0o170000; const symlink=host===3&&fileType===0o120000;\n const isDir=name.endsWith('/')||(host===3&&fileType===0o040000); const ratio=csize>0?usize/csize:(usize>0?Infinity:1);\n const low=name.toLowerCase(); const nested=/\\.(zip|jar|whl|docx|xlsx|pptx|odt|ods|odp|apk)$/i.test(low);\n entries.push({index:idx,name,flags,method,crc32:crc,compressed_size:csize,uncompressed_size:usize,local_header_offset:local,external_attrs:ext,version_made_by:versionMade,is_directory:isDir,is_symlink:symlink,path_risks:pathRisks(name),compression_ratio:Number.isFinite(ratio)?ratio:null,nested_archive_name_signal:nested});\n p=end;\n }\n }\n return {schema:'grimorio.zip-central-directory/1.0',status:reasons.length?'PARTIAL_OR_FAIL':'PASS',reasons,eocd:{disk,cdDisk,entriesDisk,totalEntries,cdSize,cdOffset,commentLen},entries};\n}\nexport function assessZipSafety(parsed:any,limits={max_entries:200000,max_total_uncompressed:20_000_000_000,max_entry_uncompressed:5_000_000_000,max_ratio:500}){\n const reasons:string[]=[]; const entries:ZipEntryMeta[]=parsed.entries||[];\n if(parsed.status==='FAIL')reasons.push(...(parsed.reasons||[]));\n if(entries.length>limits.max_entries)reasons.push('ENTRY_COUNT_LIMIT');\n const total=entries.reduce((a,e)=>a+e.uncompressed_size,0);if(total>limits.max_total_uncompressed)reasons.push('TOTAL_UNCOMPRESSED_LIMIT');\n if(entries.some(e=>e.uncompressed_size>limits.max_entry_uncompressed))reasons.push('ENTRY_SIZE_LIMIT');\n if(entries.some(e=>e.compression_ratio!==null&&e.compression_ratio>limits.max_ratio))reasons.push('SUSPICIOUS_COMPRESSION_RATIO');\n if(entries.some(e=>e.is_symlink))reasons.push('SYMLINK_ENTRY');\n if(entries.some(e=>e.path_risks.length))reasons.push('UNSAFE_PATH_ENTRY');\n const names=entries.map(e=>e.name); const exact=new Map();for(const n of names)exact.set(n,(exact.get(n)||0)+1);if([...exact.values()].some(n=>n>1))reasons.push('DUPLICATE_EXACT_PATH');\n const cf=new Map>();for(const n of names){const k=n.normalize('NFKC').toLocaleLowerCase('en-US');if(!cf.has(k))cf.set(k,new Set());cf.get(k)!.add(n)}if([...cf.values()].some(s=>s.size>1))reasons.push('UNICODE_OR_CASEFOLD_COLLISION');\n return {schema:'grimorio.zip-safety-assessment/1.0',status:reasons.length?'BLOCKED_OR_REVIEW':'PASS',reasons,entry_count:entries.length,total_uncompressed:total,nested_archive_name_signals:entries.filter(e=>e.nested_archive_name_signal).map(e=>e.name),limits};\n}\n","deleted",false,"label",[47,24],"lib","3d35a1ad-763a-4f0a-b226-376a3cd33711",["D",1788770368230],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Evidence ledger and semantic checkpoint engine","imageUrl","userId","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","d572484c-aa99-11f1-bc26-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","3d35a1ad763a4f0ab226376a3cd33711","tursoHostname","3d35a1ad763a4f0ab226376a3cd33711-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789551045218],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_109":105},"org",{"_9":10,"_102":103,"_104":105,"_58":59,"_106":107,"_108":44},"branch",{"_37":92,"_11":93,"_22":30,"_94":48,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":12,"_101":10},"isOwned",149,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_85":-5,"_143":144,"_145":146,"_147":148,"_149":44,"_150":44,"_151":44,"_152":34,"_153":-5,"_154":-7,"_155":-7,"_156":66,"_157":44,"_158":44,"_159":-5,"_160":44,"_161":44,"_162":44,"_163":-5},"ENV",{"_114":115,"_116":117,"_118":93,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]