@1agh/maude 0.58.3 → 0.59.0

package/apps/studio/figma/fig-kiwi.ts

@@ -0,0 +1,410 @@
+/**
+ * @file       figma/fig-kiwi.ts — Kiwi schema + data decoder for the `.fig` door.
+ * @scope      apps/studio/figma/fig-kiwi.ts
+ * @purpose    Decode the two chunks of a `canvas.fig`: chunk[0] is the Kiwi
+ *             SCHEMA the file carries for itself, chunk[1] is the DATA encoded
+ *             against it. Ported from the documented reference implementation
+ *             (`evanw/kiwi`) rather than depended on (DDR-221 D1).
+ *
+ * @invariant  THE ATTACKER SUPPLIES THE SCHEMA, NOT JUST THE DATA. This is the
+ *             property that makes a `.fig` unlike every other parser input in
+ *             the repo, and the source of most controls below (DDR-221 A8):
+ *               - decoded objects use `Object.create(null)`, because field
+ *                 names are schema-chosen and `o["__proto__"] = v` would
+ *                 otherwise give a node an attacker-supplied prototype and
+ *                 therefore phantom inherited fields (F3);
+ *               - enum members decode to schema-chosen NAMES, so every value
+ *                 leaving here is UNTRUSTED text and must be bounded before it
+ *                 reaches a report (F1 — enforced at the sinks, not here);
+ *               - root-type resolution is the CALLER's job and must be strict
+ *                 (F2 — see `findRootDefinition`).
+ *
+ * @invariant  A LENGTH PREFIX IS A CLAIM ABOUT A BUFFER WE ALREADY HOLD. Every
+ *             array length is bounded by the bytes actually remaining, so a
+ *             `varuint` of 4 billion cannot allocate (DDR-221 D4).
+ *
+ * @invariant  DEPENDENCY-FREE and side-effect-free. No `node:*`, no IO.
+ */
+
+import { MAX_TREE_DEPTH } from './types.ts';
+
+// ── Caps (DDR-221 D4, headroom measured in A1) ──────────────────────────────
+
+/** Observed in the real schema: 627. */
+export const MAX_DEFINITIONS = 8192;
+/** Observed: 602 (on `NodeChange`). */
+export const MAX_FIELDS_PER_DEF = 4096;
+/** Observed: 38. */
+export const MAX_IDENTIFIER_LEN = 256;
+/** Bounds nested small arrays, which per-array caps alone do not. */
+export const MAX_DECODED_VALUES = 5_000_000;
+/** Absolute ceiling, on top of the remaining-bytes bound. */
+export const MAX_ARRAY_LEN = 1_000_000;
+
+export const KIND_ENUM = 0;
+export const KIND_STRUCT = 1;
+export const KIND_MESSAGE = 2;
+
+/** Kiwi's builtin type ids are negative; non-negative indexes a definition. */
+const TYPE_BOOL = -1;
+const TYPE_BYTE = -2;
+const TYPE_INT = -3;
+const TYPE_UINT = -4;
+const TYPE_FLOAT = -5;
+const TYPE_STRING = -6;
+const TYPE_INT64 = -7;
+const TYPE_UINT64 = -8;
+
+export class FigKiwiError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'FigKiwiError';
+  }
+}
+
+export interface KiwiField {
+  name: string;
+  type: number;
+  isArray: boolean;
+  /** Enum member value, or MESSAGE field id. Always 0 for a STRUCT field. */
+  value: number;
+}
+
+export interface KiwiDefinition {
+  name: string;
+  kind: number;
+  fields: KiwiField[];
+  /** MESSAGE field lookup by id, built once instead of scanning 602 fields per read. */
+  byId?: Map<number, KiwiField>;
+  /** ENUM member lookup by value. */
+  byValue?: Map<number, string>;
+}
+
+export type KiwiSchema = KiwiDefinition[];
+
+/** Bounds-checked cursor over the decoded chunk. */
+class Reader {
+  offset = 0;
+  constructor(readonly bytes: Uint8Array) {}
+
+  get remaining(): number {
+    return this.bytes.length - this.offset;
+  }
+
+  byte(): number {
+    if (this.offset >= this.bytes.length) throw new FigKiwiError('unexpected end of Kiwi data');
+    return this.bytes[this.offset++];
+  }
+
+  /** LEB128. Refused past 5 bytes rather than shifted past the 32-bit width. */
+  varuint(): number {
+    let value = 0;
+    let shift = 0;
+    for (;;) {
+      const b = this.byte();
+      value |= (b & 0x7f) << shift;
+      shift += 7;
+      if ((b & 0x80) === 0) break;
+      if (shift > 28) throw new FigKiwiError('malformed varuint: more than 5 bytes');
+    }
+    return value >>> 0;
+  }
+
+  varint(): number {
+    const v = this.varuint();
+    return v & 1 ? ~(v >>> 1) : v >>> 1;
+  }
+
+  varuint64(): bigint {
+    let value = 0n;
+    let shift = 0n;
+    for (;;) {
+      const b = this.byte();
+      value |= BigInt(b & 0x7f) << shift;
+      shift += 7n;
+      if ((b & 0x80) === 0) break;
+      if (shift > 63n) throw new FigKiwiError('malformed varuint64: more than 10 bytes');
+    }
+    return value;
+  }
+
+  /**
+   * Kiwi rotates a float's exponent into the low 8 bits so that zero and
+   * denormals encode as a single 0 byte. Getting the FRAMING right and this
+   * rotation wrong yields a stream that stays perfectly in sync while every
+   * coordinate decodes as 0 — see DDR-221 A4, which is why a fixture geometry
+   * assertion is a required test and not a nicety.
+   */
+  float(): number {
+    if (this.remaining >= 1 && this.bytes[this.offset] === 0) {
+      this.offset++;
+      return 0;
+    }
+    if (this.remaining < 4) throw new FigKiwiError('unexpected end of Kiwi data reading a float');
+    const b = this.bytes;
+    const o = this.offset;
+    let bits = (b[o] | (b[o + 1] << 8) | (b[o + 2] << 16) | (b[o + 3] << 24)) >>> 0;
+    this.offset += 4;
+    bits = ((bits << 23) | (bits >>> 9)) >>> 0;
+    FLOAT_VIEW.setUint32(0, bits, true);
+    return FLOAT_VIEW.getFloat32(0, true);
+  }
+
+  /** NUL-terminated UTF-8. An unterminated run refuses rather than overreading. */
+  string(maxLen = MAX_IDENTIFIER_LEN * 64): string {
+    const start = this.offset;
+    const limit = Math.min(this.bytes.length, start + maxLen);
+    let end = start;
+    while (end < limit && this.bytes[end] !== 0) end++;
+    if (end >= limit) {
+      throw new FigKiwiError(
+        end === this.bytes.length ? 'unterminated Kiwi string' : 'Kiwi string exceeds its limit'
+      );
+    }
+    this.offset = end + 1;
+    return TEXT_DECODER.decode(this.bytes.subarray(start, end));
+  }
+}
+
+const FLOAT_VIEW = new DataView(new ArrayBuffer(4));
+const TEXT_DECODER = new TextDecoder('utf-8', { fatal: false });
+
+function checkIdentifier(name: string, what: string): void {
+  if (name.length === 0) throw new FigKiwiError(`Kiwi ${what} has an empty name`);
+  if (name.length > MAX_IDENTIFIER_LEN) {
+    throw new FigKiwiError(
+      `Kiwi ${what} name is ${name.length} characters, over the ${MAX_IDENTIFIER_LEN} limit`
+    );
+  }
+}
+
+/**
+ * Parse the schema chunk. Note that cyclic and self-referencing definitions are
+ * LEGITIMATE — `Message`, `NodeChange` and `MessageType` all self-reference in
+ * the real schema, so refusing cycles would refuse every real file (DDR-221
+ * A2). Recursion is bounded at decode time by depth instead.
+ */
+export function parseKiwiSchema(bytes: Uint8Array): KiwiSchema {
+  const r = new Reader(bytes);
+  const count = r.varuint();
+  if (count > MAX_DEFINITIONS) {
+    throw new FigKiwiError(
+      `Kiwi schema declares ${count} definitions, over the ${MAX_DEFINITIONS} limit`
+    );
+  }
+
+  const defs: KiwiDefinition[] = [];
+  for (let i = 0; i < count; i++) {
+    const name = r.string();
+    checkIdentifier(name, 'definition');
+    const kind = r.byte();
+    if (kind !== KIND_ENUM && kind !== KIND_STRUCT && kind !== KIND_MESSAGE) {
+      throw new FigKiwiError(`Kiwi definition "${name}" has unknown kind ${kind}`);
+    }
+    const fieldCount = r.varuint();
+    if (fieldCount > MAX_FIELDS_PER_DEF) {
+      throw new FigKiwiError(
+        `Kiwi definition "${name}" declares ${fieldCount} fields, over the ${MAX_FIELDS_PER_DEF} limit`
+      );
+    }
+    const fields: KiwiField[] = [];
+    for (let f = 0; f < fieldCount; f++) {
+      const fieldName = r.string();
+      checkIdentifier(fieldName, 'field');
+      fields.push({
+        name: fieldName,
+        type: r.varint(),
+        isArray: r.byte() !== 0,
+        value: r.varuint(),
+      });
+    }
+    defs.push({ name, kind, fields });
+  }
+
+  if (r.remaining !== 0) {
+    throw new FigKiwiError(`Kiwi schema has ${r.remaining} trailing bytes`);
+  }
+
+  // Type indexes must resolve. A dangling index would otherwise surface as a
+  // confusing decode error deep inside the data chunk.
+  for (const def of defs) {
+    for (const field of def.fields) {
+      if (field.type >= 0 && field.type >= defs.length) {
+        throw new FigKiwiError(
+          `Kiwi field "${def.name}.${field.name}" references type index ${field.type}, out of range`
+        );
+      }
+      if (field.type < TYPE_UINT64) {
+        throw new FigKiwiError(
+          `Kiwi field "${def.name}.${field.name}" has unknown builtin type ${field.type}`
+        );
+      }
+    }
+    if (def.kind === KIND_MESSAGE) {
+      def.byId = new Map(def.fields.map((f) => [f.value, f]));
+    } else if (def.kind === KIND_ENUM) {
+      def.byValue = new Map(def.fields.map((f) => [f.value, f.name]));
+    }
+  }
+
+  return defs;
+}
+
+/**
+ * Resolve the document root STRICTLY (DDR-221 A8/F2).
+ *
+ * Locating the root by name alone is attacker-steerable: a hostile schema can
+ * omit `Message`, define two, or make it a STRUCT. Decoding the data against
+ * the wrong root does not necessarily fail — Kiwi MESSAGE framing is
+ * self-terminating — so it can yield a structurally valid, semantically WRONG
+ * tree, which is precisely the silent wrongness D3 exists to prevent.
+ */
+export function findRootDefinition(
+  schema: KiwiSchema,
+  rootName: string,
+  arrayField: string,
+  elementName: string
+): number {
+  const matches: number[] = [];
+  for (let i = 0; i < schema.length; i++) {
+    if (schema[i].name === rootName) matches.push(i);
+  }
+  if (matches.length === 0) throw new FigKiwiError(`Kiwi schema has no "${rootName}" definition`);
+  if (matches.length > 1) {
+    throw new FigKiwiError(`Kiwi schema defines "${rootName}" ${matches.length} times`);
+  }
+
+  const index = matches[0];
+  const def = schema[index];
+  if (def.kind !== KIND_MESSAGE) {
+    throw new FigKiwiError(`Kiwi "${rootName}" is not a message`);
+  }
+  const field = def.fields.find((f) => f.name === arrayField);
+  if (!field?.isArray || field.type < 0) {
+    throw new FigKiwiError(`Kiwi "${rootName}" has no "${arrayField}" array`);
+  }
+  if (schema[field.type]?.name !== elementName) {
+    throw new FigKiwiError(`Kiwi "${rootName}.${arrayField}" is not an array of "${elementName}"`);
+  }
+  return index;
+}
+
+interface DecodeState {
+  values: number;
+}
+
+/**
+ * Decode the data chunk against the schema. Returns plain data: prototype-less
+ * objects, arrays, numbers, bigints, booleans and strings.
+ */
+export function decodeKiwi(bytes: Uint8Array, schema: KiwiSchema, rootIndex: number): unknown {
+  const r = new Reader(bytes);
+  const state: DecodeState = { values: 0 };
+  const value = readValue(r, schema, rootIndex, 0, state);
+  if (r.remaining !== 0) {
+    throw new FigKiwiError(`Kiwi data has ${r.remaining} trailing bytes`);
+  }
+  return value;
+}
+
+function readValue(
+  r: Reader,
+  schema: KiwiSchema,
+  type: number,
+  depth: number,
+  state: DecodeState
+): unknown {
+  if (++state.values > MAX_DECODED_VALUES) {
+    throw new FigKiwiError(`Kiwi data exceeds the ${MAX_DECODED_VALUES}-value budget`);
+  }
+  if (depth > MAX_TREE_DEPTH) {
+    throw new FigKiwiError(`Kiwi data nests deeper than ${MAX_TREE_DEPTH} levels`);
+  }
+
+  if (type < 0) {
+    switch (type) {
+      case TYPE_BOOL:
+        return r.byte() !== 0;
+      case TYPE_BYTE:
+        return r.byte();
+      case TYPE_INT:
+        return r.varint();
+      case TYPE_UINT:
+        return r.varuint();
+      case TYPE_FLOAT:
+        return r.float();
+      case TYPE_STRING:
+        return r.string();
+      case TYPE_INT64:
+      case TYPE_UINT64:
+        return r.varuint64();
+      default:
+        throw new FigKiwiError(`unknown Kiwi builtin type ${type}`);
+    }
+  }
+
+  const def = schema[type];
+  if (!def) throw new FigKiwiError(`Kiwi type index ${type} is out of range`);
+
+  if (def.kind === KIND_ENUM) {
+    const raw = r.varuint();
+    // UNTRUSTED: the member NAME is schema-chosen (DDR-221 A8/F1). Unknown
+    // values keep a code-owned shape so nothing attacker-written can pose as a
+    // recognised member.
+    return def.byValue?.get(raw) ?? `UNKNOWN_${raw}`;
+  }
+
+  // `Object.create(null)`: field names are schema-chosen, and on a plain object
+  // `o["__proto__"] = v` would set this node's prototype to attacker data,
+  // giving it phantom inherited fields (DDR-221 A8/F3).
+  const out = Object.create(null) as Record<string, unknown>;
+
+  if (def.kind === KIND_STRUCT) {
+    for (const field of def.fields) {
+      out[field.name] = readField(r, schema, field, depth + 1, state);
+    }
+    return out;
+  }
+
+  for (;;) {
+    const id = r.varuint();
+    if (id === 0) break;
+    const field = def.byId?.get(id);
+    if (!field) {
+      throw new FigKiwiError(`Kiwi message "${def.name}" has no field with id ${id}`);
+    }
+    out[field.name] = readField(r, schema, field, depth + 1, state);
+  }
+  return out;
+}
+
+function readField(
+  r: Reader,
+  schema: KiwiSchema,
+  field: KiwiField,
+  depth: number,
+  state: DecodeState
+): unknown {
+  if (!field.isArray) return readValue(r, schema, field.type, depth, state);
+
+  const length = r.varuint();
+  if (length > MAX_ARRAY_LEN) {
+    throw new FigKiwiError(
+      `Kiwi array "${field.name}" declares ${length} elements, over the ${MAX_ARRAY_LEN} limit`
+    );
+  }
+  // A length prefix is a claim about a buffer we already hold. Even a
+  // zero-byte element type cannot produce more elements than bytes remain,
+  // because every element consumes at least the byte that terminates it.
+  if (length > r.remaining) {
+    throw new FigKiwiError(
+      `Kiwi array "${field.name}" declares ${length} elements with only ${r.remaining} bytes left`
+    );
+  }
+
+  const items = new Array(length);
+  for (let i = 0; i < length; i++) {
+    items[i] = readValue(r, schema, field.type, depth, state);
+  }
+  return items;
+}

package/apps/studio/figma/fig-zip.ts

@@ -0,0 +1,270 @@
+/**
+ * @file       figma/fig-zip.ts — the narrow ZIP reader behind the local `.fig` door.
+ * @scope      apps/studio/figma/fig-zip.ts
+ * @purpose    A `.fig`/`.jam` is a ZIP wrapping `canvas.fig` + `meta.json` +
+ *             `images/` (DDR-221 § Context). This reads exactly that archive
+ *             and REFUSES everything else.
+ *
+ * @invariant  DEPENDENCY-FREE. `node:zlib` only. `jszip` is already an
+ *             apps/studio dep and is deliberately NOT used (DDR-221 D2): it is
+ *             absent from the ROOT package.json, so reaching for it would make
+ *             `--fig` desktop-app-only on npm exactly the way `oxc-parser`
+ *             does for `--explode`.
+ *
+ * @invariant  NOT A GENERAL ZIP IMPLEMENTATION, on purpose. No zip64, no
+ *             encryption, no data descriptors, no multi-disk, no
+ *             central-directory recovery. One known producer writes these
+ *             files; refusing every shape it does not emit is the fail-loud
+ *             posture (DDR-221 D3), not a gap.
+ *
+ * @invariant  AN ENTRY NAME IS A LOOKUP KEY, NEVER A PATH (DDR-221 D6). No
+ *             value from this module is ever passed to `path.join`. The
+ *             traversal check below is defence in depth, not the reason
+ *             zip-slip cannot bite.
+ */
+
+import { crc32, inflateRawSync } from 'node:zlib';
+
+// ── Caps (DDR-221 D4) ───────────────────────────────────────────────────────
+// Measured baseline: the committed fixtures are 49 858 B / 64 574 B with 4
+// entries each, and a legitimate entry compresses ~2.5x.
+
+/** The user picked this file; generous on purpose. */
+export const MAX_ARCHIVE_BYTES = 256 * 1024 * 1024;
+/** `images/` can be large. 4 observed. */
+export const MAX_ARCHIVE_ENTRIES = 4096;
+/** ~80x the measured 2.5x. */
+export const MAX_ENTRY_RATIO = 200;
+/** Refuse a single entry claiming more than this, before inflating a byte. */
+export const MAX_ENTRY_BYTES = 128 * 1024 * 1024;
+
+const EOCD_SIG = 0x06054b50;
+const CD_SIG = 0x02014b50;
+const LFH_SIG = 0x04034b50;
+const EOCD_MIN = 22;
+/** ZIP's comment length field is 16-bit, so the EOCD starts within 64 KiB + 22. */
+const EOCD_SEARCH = 0xffff + EOCD_MIN;
+
+const METHOD_STORE = 0;
+const METHOD_DEFLATE = 8;
+
+const FLAG_ENCRYPTED = 0x0001;
+const FLAG_STRONG_ENCRYPTION = 0x0040;
+// Bit 3 (0x0008, "data descriptor") is deliberately absent: it is ALLOWED, and
+// Figma sets it. See the note at the flag check below for why it is harmless.
+
+/** The 32-bit sentinel that means "the real value is in a zip64 extra field". */
+const ZIP64_SENTINEL = 0xffffffff;
+
+export class FigZipError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'FigZipError';
+  }
+}
+
+export interface FigZipEntry {
+  /**
+   * UNTRUSTED. Attacker-chosen text from the archive. Never a path — callers
+   * match it against a literal, and it is bounded before it reaches any report.
+   */
+  name: string;
+  compressedSize: number;
+  uncompressedSize: number;
+  method: number;
+  crc: number;
+  localHeaderOffset: number;
+}
+
+/** A parsed central directory. Entry BYTES are read lazily, per entry. */
+export interface FigZip {
+  entries: FigZipEntry[];
+  get(name: string): Uint8Array | undefined;
+  has(name: string): boolean;
+}
+
+function u16(b: Uint8Array, o: number): number {
+  return b[o] | (b[o + 1] << 8);
+}
+
+function u32(b: Uint8Array, o: number): number {
+  return (b[o] | (b[o + 1] << 8) | (b[o + 2] << 16) | (b[o + 3] << 24)) >>> 0;
+}
+
+/**
+ * Reject a name that could be read as a path by a future caller who forgets the
+ * lookup-key rule. Also rejects the NUL that would truncate it in a C-string
+ * context, and the control characters that would corrupt a report line.
+ */
+function isSafeEntryName(name: string): boolean {
+  if (name.length === 0 || name.length > 512) return false;
+  if (name.startsWith('/') || name.startsWith('\\')) return false;
+  if (name.includes('\\')) return false;
+  if (/(^|\/)\.\.(\/|$)/.test(name)) return false;
+  if (/^[A-Za-z]:/.test(name)) return false;
+  // Control characters would corrupt a report line; refuse rather than strip.
+  for (let i = 0; i < name.length; i++) {
+    const c = name.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return false;
+  }
+  return true;
+}
+
+/**
+ * Find the End Of Central Directory record. Scans backwards over the comment
+ * field. A truncated or comment-forged archive refuses rather than guessing.
+ */
+function findEocd(buf: Uint8Array): number {
+  const start = Math.max(0, buf.length - EOCD_SEARCH);
+  for (let i = buf.length - EOCD_MIN; i >= start; i--) {
+    if (u32(buf, i) !== EOCD_SIG) continue;
+    // Only accept it if the declared comment length actually reaches the end,
+    // so a `PK\x05\x06` sequence inside compressed data cannot pose as the EOCD.
+    if (i + EOCD_MIN + u16(buf, i + 20) === buf.length) return i;
+  }
+  throw new FigZipError('not a ZIP archive: no end-of-central-directory record');
+}
+
+/**
+ * Parse the central directory of a `.fig`/`.jam`. Entry bytes are inflated on
+ * demand by `get()`, so opening a large archive costs the directory only.
+ */
+export function readFigZip(buf: Uint8Array): FigZip {
+  if (buf.length > MAX_ARCHIVE_BYTES) {
+    throw new FigZipError(
+      `archive is ${buf.length} bytes, over the ${MAX_ARCHIVE_BYTES}-byte limit`
+    );
+  }
+  if (buf.length < EOCD_MIN) throw new FigZipError('not a ZIP archive: too short');
+
+  const eocd = findEocd(buf);
+  const diskNum = u16(buf, eocd + 4);
+  const cdDisk = u16(buf, eocd + 6);
+  const count = u16(buf, eocd + 10);
+  const cdSize = u32(buf, eocd + 12);
+  const cdOffset = u32(buf, eocd + 16);
+
+  if (diskNum !== 0 || cdDisk !== 0) {
+    throw new FigZipError('multi-disk ZIP archives are not supported');
+  }
+  if (count === ZIP64_SENTINEL || cdSize === ZIP64_SENTINEL || cdOffset === ZIP64_SENTINEL) {
+    throw new FigZipError('zip64 archives are not supported');
+  }
+  if (count > MAX_ARCHIVE_ENTRIES) {
+    throw new FigZipError(
+      `archive declares ${count} entries, over the ${MAX_ARCHIVE_ENTRIES} limit`
+    );
+  }
+  if (cdOffset + cdSize > buf.length) {
+    throw new FigZipError('central directory extends past the end of the archive');
+  }
+
+  const entries: FigZipEntry[] = [];
+  let o = cdOffset;
+  for (let i = 0; i < count; i++) {
+    if (o + 46 > buf.length || u32(buf, o) !== CD_SIG) {
+      throw new FigZipError(`central directory entry ${i} is malformed`);
+    }
+    const flags = u16(buf, o + 8);
+    const method = u16(buf, o + 10);
+    const crc = u32(buf, o + 16);
+    const compressedSize = u32(buf, o + 20);
+    const uncompressedSize = u32(buf, o + 24);
+    const nameLen = u16(buf, o + 28);
+    const extraLen = u16(buf, o + 30);
+    const commentLen = u16(buf, o + 32);
+    const localHeaderOffset = u32(buf, o + 42);
+
+    if (flags & (FLAG_ENCRYPTED | FLAG_STRONG_ENCRYPTION)) {
+      throw new FigZipError('encrypted ZIP entries are not supported');
+    }
+    // FLAG_DATA_DESCRIPTOR is ALLOWED, and Figma's exporter does set it
+    // (measured on both committed fixtures — DDR-221 D3's first draft refused
+    // it from documentation and would have rejected every real file). It only
+    // means the LOCAL header's crc/sizes are zeroed and the real values trail
+    // the data. Harmless here: sizes and CRC are read from the central
+    // directory below, and the local header is consulted ONLY for its
+    // name/extra lengths to locate the data offset.
+    if (compressedSize === ZIP64_SENTINEL || uncompressedSize === ZIP64_SENTINEL) {
+      throw new FigZipError('zip64 entry sizes are not supported');
+    }
+    if (method !== METHOD_STORE && method !== METHOD_DEFLATE) {
+      throw new FigZipError(`unsupported ZIP compression method ${method}`);
+    }
+    if (o + 46 + nameLen > buf.length) throw new FigZipError('entry name runs past the archive');
+
+    const name = new TextDecoder('utf-8', { fatal: false }).decode(
+      buf.subarray(o + 46, o + 46 + nameLen)
+    );
+    if (!isSafeEntryName(name)) {
+      // Deliberately not echoed — it is attacker-chosen text (DDR-221 A8/F1).
+      throw new FigZipError(`archive entry ${i} has an unsafe name`);
+    }
+
+    // The declared size is a CLAIM. Refuse the claim before inflating anything;
+    // `get()` then verifies the delivery against it (DDR-221 D4).
+    if (uncompressedSize > MAX_ENTRY_BYTES) {
+      throw new FigZipError(
+        `entry "${name}" declares ${uncompressedSize} bytes, over the ${MAX_ENTRY_BYTES}-byte limit`
+      );
+    }
+    if (compressedSize > 0 && uncompressedSize / compressedSize > MAX_ENTRY_RATIO) {
+      throw new FigZipError(
+        `entry "${name}" declares a ${Math.round(uncompressedSize / compressedSize)}:1 compression ratio, over the ${MAX_ENTRY_RATIO}:1 limit`
+      );
+    }
+
+    entries.push({ name, compressedSize, uncompressedSize, method, crc, localHeaderOffset });
+    o += 46 + nameLen + extraLen + commentLen;
+  }
+
+  const byName = new Map(entries.map((e) => [e.name, e]));
+
+  function get(name: string): Uint8Array | undefined {
+    const e = byName.get(name);
+    if (!e) return undefined;
+
+    const lfh = e.localHeaderOffset;
+    if (lfh + 30 > buf.length || u32(buf, lfh) !== LFH_SIG) {
+      throw new FigZipError(`entry "${e.name}" has a malformed local header`);
+    }
+    // The local header's own name/extra lengths, NOT the central directory's:
+    // they are allowed to differ, and trusting the wrong one misreads the data
+    // offset.
+    const start = lfh + 30 + u16(buf, lfh + 26) + u16(buf, lfh + 28);
+    const end = start + e.compressedSize;
+    if (end > buf.length)
+      throw new FigZipError(`entry "${e.name}" runs past the end of the archive`);
+
+    const raw = buf.subarray(start, end);
+    let out: Uint8Array;
+    if (e.method === METHOD_STORE) {
+      out = raw;
+    } else {
+      // maxOutputLength is enforced BY the decompressor, so a bomb never
+      // allocates (DDR-221 D4, measured). +1 makes an over-long output trip
+      // the codec rather than pass a size check by exactly matching.
+      try {
+        out = inflateRawSync(raw, { maxOutputLength: e.uncompressedSize + 1 });
+      } catch (err) {
+        const code = (err as { code?: string }).code;
+        if (code === 'ERR_BUFFER_TOO_LARGE') {
+          throw new FigZipError(`entry "${e.name}" inflates past its declared size`);
+        }
+        throw new FigZipError(`entry "${e.name}" is not valid deflate data`);
+      }
+    }
+
+    if (out.length !== e.uncompressedSize) {
+      throw new FigZipError(
+        `entry "${e.name}" inflated to ${out.length} bytes, not the declared ${e.uncompressedSize}`
+      );
+    }
+    if (crc32(out) !== e.crc) {
+      throw new FigZipError(`entry "${e.name}" failed its CRC32 check`);
+    }
+    return out;
+  }
+
+  return { entries, get, has: (name: string) => byName.has(name) };
+}