@bendyline/squisq-formats 1.4.2 → 2.0.1

package/dist/reader-B9L8Ucbj.d.ts

@@ -0,0 +1,140 @@
+import { c as ZipSafetyLimits } from './zipLimits-BOKCB7qk.js';
+
+/**
+ * OOXML Types
+ *
+ * Shared type definitions for all Office Open XML formats (DOCX, PPTX, XLSX).
+ * These model the common structural elements of the OOXML package format:
+ * relationships, content types, and core properties.
+ */
+/**
+ * An opened OOXML package. Instances are created only by `openPackage`; the
+ * archive remains private so every part read goes through the bounded reader.
+ */
+declare const ooxmlPackageBrand: unique symbol;
+interface OoxmlPackage {
+    /** Nominal brand: callers cannot manually construct a safety-bypassing package. */
+    readonly [ooxmlPackageBrand]: never;
+    /** Parsed [Content_Types].xml entries */
+    readonly contentTypes: ContentTypeMap;
+    /** Root-level relationships (_rels/.rels) */
+    readonly rootRelationships: readonly Relationship[];
+}
+/**
+ * Content type map built from [Content_Types].xml.
+ * Maps part paths → content type strings plus extension defaults.
+ */
+interface ContentTypeMap {
+    /** Explicit overrides: partName → contentType */
+    overrides: Map<string, string>;
+    /** Default extensions: extension → contentType */
+    defaults: Map<string, string>;
+}
+/**
+ * An OOXML relationship entry (from any _rels/*.rels file).
+ */
+interface Relationship {
+    /** Relationship ID (e.g., "rId1") */
+    id: string;
+    /** Relationship type URI (e.g., "http://...officedocument/...") */
+    type: string;
+    /** Target path or URL */
+    target: string;
+    /** "Internal" (default) or "External" for hyperlinks */
+    targetMode?: 'Internal' | 'External';
+}
+/**
+ * Document core properties from docProps/core.xml (Dublin Core metadata).
+ */
+interface CoreProperties {
+    title?: string;
+    subject?: string;
+    creator?: string;
+    keywords?: string;
+    description?: string;
+    lastModifiedBy?: string;
+    revision?: string;
+    created?: string;
+    modified?: string;
+}
+/**
+ * A part (file) that will be written into an OOXML package.
+ */
+interface PackagePart {
+    /** Path within the ZIP (e.g., "word/document.xml") */
+    path: string;
+    /** XML or text content (mutually exclusive with binaryContent) */
+    content?: string;
+    /** Binary content (mutually exclusive with content) */
+    binaryContent?: ArrayBuffer | Uint8Array;
+    /** MIME content type for [Content_Types].xml */
+    contentType: string;
+}
+/**
+ * A relationship to be written into a _rels/*.rels file.
+ * `sourcePart` identifies which part the relationship belongs to.
+ * Use "" (empty string) for root-level relationships (_rels/.rels).
+ */
+interface PendingRelationship {
+    /** The part this relationship belongs to ("" for root) */
+    sourcePart: string;
+    /** The relationship entry */
+    relationship: Relationship;
+}
+
+/**
+ * OOXML Package Reader
+ *
+ * Opens OOXML archives (.docx, .pptx, .xlsx) and parses their
+ * structural metadata: [Content_Types].xml, relationships, and
+ * core properties.
+ *
+ * Uses bounded JSZip member streams and a platform DOMParser (with the
+ * package-owned xmldom parser in Node/SSR) to parse XML.
+ */
+
+type OoxmlOpenOptions = ZipSafetyLimits;
+/**
+ * Open an OOXML package from raw data.
+ *
+ * Parses the ZIP archive, [Content_Types].xml, and root relationships.
+ *
+ * @param data - The raw .docx/.pptx/.xlsx file as ArrayBuffer or Blob
+ * @param limits - Optional archive count, size, and compression-ratio limits
+ * @returns A parsed OoxmlPackage
+ */
+declare function openPackage(data: ArrayBuffer | Blob, limits?: OoxmlOpenOptions): Promise<OoxmlPackage>;
+/**
+ * Parse relationships for a specific part.
+ *
+ * @param pkg - The OOXML package (or the zip directly)
+ * @param partPath - The part path (e.g., "word/document.xml").
+ *   Use "" for root-level relationships (_rels/.rels).
+ * @returns Array of relationship entries
+ */
+declare function getPartRelationships(pkg: OoxmlPackage, partPath: string): Promise<Relationship[]>;
+/**
+ * Extract an XML part from the package and parse it as a DOM Document.
+ *
+ * @param pkg - The OOXML package
+ * @param partPath - Path within the archive (e.g., "word/document.xml")
+ * @returns Parsed XML Document, or null if the part doesn't exist
+ */
+declare function getPartXml(pkg: OoxmlPackage, partPath: string): Promise<Document | null>;
+/**
+ * Extract a binary part from the package (e.g., an image from word/media/).
+ *
+ * @param pkg - The OOXML package
+ * @param partPath - Path within the archive
+ * @returns The binary content, or null if the part doesn't exist
+ */
+declare function getPartBinary(pkg: OoxmlPackage, partPath: string): Promise<ArrayBuffer | null>;
+/**
+ * Parse core document properties from docProps/core.xml.
+ *
+ * @param pkg - The OOXML package
+ * @returns Parsed core properties (all fields optional)
+ */
+declare function getCoreProperties(pkg: OoxmlPackage): Promise<CoreProperties>;
+
+export { type CoreProperties as C, type OoxmlOpenOptions as O, type PackagePart as P, type Relationship as R, type OoxmlPackage as a, type ContentTypeMap as b, type PendingRelationship as c, getPartBinary as d, getPartRelationships as e, getPartXml as f, getCoreProperties as g, openPackage as o };

package/dist/registry/index.d.ts

@@ -1,6 +1,17 @@
-import { Doc } from '@bendyline/squisq/schemas';
-import { MarkdownDocument } from '@bendyline/squisq/markdown';
+import { Doc, ThemeRegistry } from '@bendyline/squisq/schemas';
+import { TransformStyleInput, TransformStyleRegistry } from '@bendyline/squisq/transform';
+import { ParseOptions, StringifyOptions, MarkdownDocument } from '@bendyline/squisq/markdown';
 import { ContentContainer } from '@bendyline/squisq/storage';
+import { DocxImportOptions, DocxExportOptions } from '../docx/index.js';
+import { a as PptxImportOptions, P as PptxExportOptions } from '../import-K8mfc0fz.js';
+import { a as XlsxImportOptions, X as XlsxExportOptions } from '../export-D2NkylDT.js';
+import { CsvImportOptions, CsvExportOptions } from '../csv/index.js';
+import { PdfImportOptions, PdfExportOptions } from '../pdf/index.js';
+import { a as HtmlImportOptions, H as HtmlExportOptions } from '../import-DTkDxHmZ.js';
+import { EpubExportOptions } from '../epub/index.js';
+import { ContainerToZipOptions } from '../container/index.js';
+import { c as ZipSafetyLimits } from '../zipLimits-BOKCB7qk.js';
+import '../reader-B9L8Ucbj.js';
 
 /**
  * Format registry — shared types.
@@ -27,6 +38,30 @@ interface ConversionResult {
     /** Non-fatal notes accumulated during conversion (may be empty). */
     warnings: string[];
 }
+interface MarkdownFormatOptions {
+    parse?: ParseOptions;
+    stringify?: StringifyOptions;
+}
+/** Resource limits applied when importing a DBK/ZIP container. */
+type DbkFormatOptions = ZipSafetyLimits & ContainerToZipOptions;
+/**
+ * Strongly typed option bags for built-in formats. Import and export options
+ * share a bag because a single conversion may use the format on either side.
+ * Custom registries may add arbitrary keys through the intersection used by
+ * {@link ConvertOptions.formatOptions}.
+ */
+interface BuiltinFormatOptions {
+    md: MarkdownFormatOptions;
+    docx: DocxImportOptions & DocxExportOptions;
+    pptx: PptxImportOptions & PptxExportOptions;
+    xlsx: XlsxImportOptions & XlsxExportOptions;
+    csv: CsvImportOptions & CsvExportOptions;
+    pdf: PdfImportOptions & PdfExportOptions;
+    html: HtmlImportOptions & Partial<Omit<HtmlExportOptions, 'playerScript'>>;
+    htmlzip: Partial<Omit<HtmlExportOptions, 'playerScript'>>;
+    epub: EpubExportOptions;
+    dbk: DbkFormatOptions;
+}
 /**
  * A source normalized into every shape an exporter might need. `doc` is always
  * present; `markdownDoc` is present when the source was markdown-shaped (an
@@ -40,22 +75,37 @@ interface NormalizedInput {
 }
 /** Options threaded through `convert()` and into every format method. */
 interface ConvertOptions {
+    /** Cancel normalization, transformation, or export at the next bounded work boundary. */
+    signal?: AbortSignal;
     /** Registry to resolve formats against. Defaults to `defaultRegistry()`. */
     registry?: FormatRegistry;
     /** Explicit source format id (skips extension/byte sniffing). */
     from?: FormatId;
     /** Theme id to apply to the exported document. */
     themeId?: string;
-    /** Transform style id to apply before export. */
-    transformStyle?: string;
+    /** Explicit caller-owned registry for non-document custom themes. */
+    themeRegistry?: ThemeRegistry;
+    /** Built-in/registry id or call-scoped style to apply before export. */
+    transformStyle?: TransformStyleInput;
+    /** Explicit caller-owned registry used to resolve transform style ids. */
+    transformRegistry?: TransformStyleRegistry;
     /** Content-aware auto-templating when deriving a Doc from markdown. */
     autoTemplates?: boolean;
-    /** Title hint for exporters that support one (epub, html). */
+    /** Title hint for exporters that expose document metadata. */
     title?: string;
     /** Lazily resolve the standalone player IIFE bundle (required for HTML export). */
     resolvePlayerScript?: () => Promise<string>;
-    /** Per-format escape hatch for extra options. */
-    formatOptions?: Record<FormatId, Record<string, unknown>>;
+    /** Typed per-format options for built-ins; custom format ids remain extensible. */
+    formatOptions?: Partial<BuiltinFormatOptions> & Record<FormatId, unknown>;
+}
+/** Target-only options accepted after a source has already been normalized and transformed. */
+type PreparedExportOptions = Pick<ConvertOptions, 'signal' | 'title' | 'resolvePlayerScript' | 'formatOptions'>;
+/**
+ * An opaque normalized conversion snapshot. The source and transform pipeline
+ * has already completed; each call exports that same snapshot to one target.
+ */
+interface PreparedConversion {
+    convert(to: FormatId, options?: PreparedExportOptions): Promise<ConversionResult>;
 }
 /** Describes how a single format imports to / exports from the squisq model. */
 interface FormatDefinition {
@@ -154,6 +204,8 @@ declare function defaultFormats(): FormatDefinition[];
  * an optional transform, then hands off to the target format's exporter.
  */
 
+/** Normalize and transform a source once, then safely export that snapshot many times. */
+declare function prepareConversion(source: ConvertSource, options?: ConvertOptions): Promise<PreparedConversion>;
 /**
  * Convert a source document to a target format.
  *
@@ -164,4 +216,4 @@ declare function defaultFormats(): FormatDefinition[];
  */
 declare function convert(source: ConvertSource, to: FormatId, options?: ConvertOptions): Promise<ConversionResult>;
 
-export { BUILTIN_FORMAT_IDS, ConversionError, type ConversionErrorCode, type ConversionErrorOptions, type ConversionResult, type ConvertOptions, type ConvertSource, type FormatDefinition, type FormatId, type FormatRegistry, type NormalizedInput, convert, createRegistry, defaultFormats, defaultRegistry };
+export { BUILTIN_FORMAT_IDS, type BuiltinFormatOptions, ConversionError, type ConversionErrorCode, type ConversionErrorOptions, type ConversionResult, type ConvertOptions, type ConvertSource, type DbkFormatOptions, type FormatDefinition, type FormatId, type FormatRegistry, type MarkdownFormatOptions, type NormalizedInput, type PreparedConversion, type PreparedExportOptions, convert, createRegistry, defaultFormats, defaultRegistry, prepareConversion };

package/dist/registry/index.js

@@ -1,17 +1,22 @@
 import {
   BUILTIN_FORMAT_IDS,
-  ConversionError,
   convert,
   createRegistry,
   defaultFormats,
-  defaultRegistry
-} from "../chunk-RTS5XBZ7.js";
+  defaultRegistry,
+  prepareConversion
+} from "../chunk-HTW2M27H.js";
+import {
+  ConversionError
+} from "../chunk-ODL3SSPT.js";
+import "../chunk-FE6OJV6O.js";
 export {
   BUILTIN_FORMAT_IDS,
   ConversionError,
   convert,
   createRegistry,
   defaultFormats,
-  defaultRegistry
+  defaultRegistry,
+  prepareConversion
 };
 //# sourceMappingURL=index.js.map

package/dist/themeReader-DJKErl_j.d.ts

@@ -0,0 +1,56 @@
+import { a as OoxmlPackage } from './reader-B9L8Ucbj.js';
+
+/**
+ * OOXML theme reader — parses a `theme1.xml` part (DrawingML `a:theme`)
+ * into normalized color and font schemes.
+ *
+ * Shared by DOCX/PPTX/XLSX theme inference: all three formats carry the same
+ * theme part shape, differing only in where the part hangs (document/master/
+ * workbook relationships). This module never fails hard — unreadable slots
+ * degrade to fallbacks or absence, with a warning per degradation.
+ */
+
+/**
+ * The clrScheme slots as normalized `#rrggbb` strings. The four surface/text
+ * slots always resolve (falling back to black/white when degraded); accent and
+ * hyperlink slots are omitted when unresolvable.
+ */
+interface OoxmlColorScheme {
+    dk1: string;
+    lt1: string;
+    dk2: string;
+    lt2: string;
+    accent1?: string;
+    accent2?: string;
+    accent3?: string;
+    accent4?: string;
+    accent5?: string;
+    accent6?: string;
+    hlink?: string;
+    folHlink?: string;
+}
+interface OoxmlFontScheme {
+    /** `a:fontScheme > a:majorFont > a:latin@typeface` (headings). */
+    majorLatin?: string;
+    /** `a:fontScheme > a:minorFont > a:latin@typeface` (body). */
+    minorLatin?: string;
+}
+interface OoxmlTheme {
+    /** `a:theme@name` (e.g. "Office Theme", "Ion"). */
+    name?: string;
+    /** Absent when the theme carries no parseable `a:clrScheme`. */
+    colors?: OoxmlColorScheme;
+    /** Absent when the theme carries no `a:fontScheme` latin typefaces. */
+    fonts?: OoxmlFontScheme;
+    warnings: string[];
+}
+/** Parse an already-loaded theme part Document. */
+declare function parseThemeXml(themeDoc: Document): OoxmlTheme;
+/**
+ * Resolve the theme part related from `fromPartPath` (via `REL_THEME`) and
+ * parse it. Returns null when the part has no theme relationship or the
+ * target part is missing — callers decide whether that's an error.
+ */
+declare function readThemePart(pkg: OoxmlPackage, fromPartPath: string): Promise<OoxmlTheme | null>;
+
+export { type OoxmlColorScheme as O, type OoxmlFontScheme as a, type OoxmlTheme as b, parseThemeXml as p, readThemePart as r };

package/dist/xlsx/index.d.ts

@@ -1,69 +1,9 @@
 import { Doc } from '@bendyline/squisq/schemas';
-import { MarkdownDocument } from '@bendyline/squisq/markdown';
-
-/**
- * XLSX import — SpreadsheetML (.xlsx) → MarkdownDocument.
- *
- * Reuses the shared ooxml/ reader (zip + DOMParser). Reads the workbook's
- * sheet list, resolves each sheet part via relationships, pulls shared strings,
- * and turns each worksheet's cell grid into a markdown table (first row treated
- * as the header). By default every sheet is imported, each preceded by an H1 of
- * the sheet name; pass `options.sheet` (index or name) to import just one.
- */
-
-interface XlsxImportOptions {
-    /** Which sheet to import (0-based index or sheet name). Default: all sheets. */
-    sheet?: number | string;
-}
-declare function xlsxToMarkdownDoc(data: ArrayBuffer | Blob, options?: XlsxImportOptions): Promise<MarkdownDocument>;
-
-/**
- * XLSX export — MarkdownDocument → SpreadsheetML (.xlsx).
- *
- * Tables-only fidelity (honestly documented): every `table` node in the
- * markdown AST becomes one worksheet; all other content (headings, prose,
- * lists, images, …) is dropped except that the nearest preceding heading is
- * used to name the sheet. This mirrors the import side (`xlsxToMarkdownDoc`),
- * which turns each worksheet grid back into a markdown table.
- *
- * Cells are emitted as inline strings (`t="inlineStr"`) so no sharedStrings
- * part is needed, except values matching a plain-number pattern, which are
- * emitted as numeric cells. The package is assembled with the shared ooxml/
- * writer (auto-generates `[Content_Types].xml` + `_rels`), so only the
- * SpreadsheetML-specific parts (workbook, worksheets, styles) are written here.
- *
- * @example
- * ```ts
- * import { parseMarkdown } from '@bendyline/squisq/markdown';
- * import { markdownDocToXlsx } from '@bendyline/squisq-formats/xlsx';
- *
- * const md = parseMarkdown('# Metrics\n\n| A | B |\n| - | - |\n| 1 | 2 |');
- * const buffer = await markdownDocToXlsx(md);
- * ```
- */
-
-/**
- * Options for XLSX export.
- */
-interface XlsxExportOptions {
-    /** Workbook title (written to core properties). */
-    title?: string;
-    /** Workbook author (written to core properties). */
-    author?: string;
-    /** Prefix used for auto-named sheets when no heading precedes a table. Default: "Sheet". */
-    sheetNamePrefix?: string;
-}
-/**
- * Convert a MarkdownDocument to a .xlsx file (tables-only fidelity).
- *
- * Each markdown `table` becomes one worksheet; a document with no tables
- * yields a single empty sheet (a valid, openable file — never throws).
- */
-declare function markdownDocToXlsx(doc: MarkdownDocument, options?: XlsxExportOptions): Promise<ArrayBuffer>;
-/**
- * Convert a squisq Doc to a .xlsx file (via the markdown table model).
- */
-declare function docToXlsx(doc: Doc, options?: XlsxExportOptions): Promise<ArrayBuffer>;
+import { a as XlsxImportOptions } from '../export-D2NkylDT.js';
+export { X as XlsxExportOptions, d as docToXlsx, m as markdownDocToXlsx, x as xlsxToMarkdownDoc } from '../export-D2NkylDT.js';
+import '@bendyline/squisq/markdown';
+import '../reader-B9L8Ucbj.js';
+import '../zipLimits-BOKCB7qk.js';
 
 /**
  * @bendyline/squisq-formats XLSX Module
@@ -86,4 +26,4 @@ declare function docToXlsx(doc: Doc, options?: XlsxExportOptions): Promise<Array
  */
 declare function xlsxToDoc(data: ArrayBuffer | Blob, options?: XlsxImportOptions): Promise<Doc>;
 
-export { type XlsxExportOptions, type XlsxImportOptions, docToXlsx, markdownDocToXlsx, xlsxToDoc, xlsxToMarkdownDoc };
+export { XlsxImportOptions, xlsxToDoc };

package/dist/xlsx/index.js

@@ -3,10 +3,12 @@ import {
   markdownDocToXlsx,
   xlsxToDoc,
   xlsxToMarkdownDoc
-} from "../chunk-EHLGMSTE.js";
+} from "../chunk-VJJM2SSH.js";
 import "../chunk-PN52A5AA.js";
-import "../chunk-SHLPSADL.js";
+import "../chunk-U32AG3G3.js";
 import "../chunk-U4MRIFKL.js";
+import "../chunk-WC7WULGV.js";
+import "../chunk-FE6OJV6O.js";
 export {
   docToXlsx,
   markdownDocToXlsx,

package/dist/zipLimits-BOKCB7qk.d.ts

@@ -0,0 +1,31 @@
+/** ZIP safety policy, structured errors, path checks, and metadata validation. */
+
+interface ZipSafetyLimits {
+    /** Cooperatively cancel archive opening, validation, and member traversal. */
+    signal?: AbortSignal;
+    /** Maximum number of archive records, including directories. Default: 10,000. */
+    maxEntries?: number;
+    /** Maximum uncompressed bytes for one member. Defaults to maxUncompressedBytes. */
+    maxEntryUncompressedBytes?: number;
+    /** Maximum total uncompressed bytes across the archive. Default: 512 MiB. */
+    maxUncompressedBytes?: number;
+    /** Maximum uncompressed/compressed ratio for a member. Default: 1,000. */
+    maxCompressionRatio?: number;
+}
+type ZipSafetyErrorCode = 'invalid-limit' | 'invalid-archive' | 'unsafe-path' | 'invalid-entry-metadata' | 'too-many-entries' | 'entry-too-large' | 'archive-too-large' | 'compression-ratio-exceeded' | 'size-mismatch' | 'crc-mismatch' | 'decompression-failed';
+interface ZipSafetyErrorOptions {
+    path?: string;
+    limit?: number;
+    actual?: number;
+    cause?: unknown;
+}
+/** A stable, machine-readable error raised while validating or reading a ZIP. */
+declare class ZipSafetyError extends Error {
+    readonly code: ZipSafetyErrorCode;
+    readonly path?: string;
+    readonly limit?: number;
+    readonly actual?: number;
+    constructor(code: ZipSafetyErrorCode, message: string, options?: ZipSafetyErrorOptions);
+}
+
+export { ZipSafetyError as Z, type ZipSafetyErrorCode as a, type ZipSafetyErrorOptions as b, type ZipSafetyLimits as c };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bendyline/squisq-formats",
-  "version": "1.4.2",
+  "version": "2.0.1",
   "description": "Document format converters — DOCX, PDF, OOXML import/export",
   "license": "MIT",
   "author": "Bendyline",
@@ -86,6 +86,11 @@
       "types": "./dist/registry/index.d.ts",
       "import": "./dist/registry/index.js",
       "default": "./dist/registry/index.js"
+    },
+    "./infer": {
+      "types": "./dist/infer/index.d.ts",
+      "import": "./dist/infer/index.js",
+      "default": "./dist/infer/index.js"
     }
   },
   "scripts": {
@@ -94,7 +99,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@bendyline/squisq": "1.5.2",
+    "@xmldom/xmldom": "0.9.10",
+    "@bendyline/squisq": "2.0.1",
     "jszip": "3.10.1",
     "pdf-lib": "1.17.1",
     "pdfjs-dist": "4.10.38"

package/src/__tests__/container.test.ts

@@ -78,6 +78,13 @@ describe('containerToZip', () => {
     const data = await zip.file('image.png')!.async('uint8array');
     expect(data).toEqual(binaryData);
   });
+
+  it('refuses to create a ZIP with an unsafe container path', async () => {
+    const container = new MemoryContentContainer();
+    await container.writeFile('../outside.txt', new TextEncoder().encode('nope'));
+
+    await expect(containerToZip(container)).rejects.toThrow(/path is unsafe/i);
+  });
 });
 
 // ============================================
@@ -137,6 +144,40 @@ describe('zipToContainer', () => {
     const container = await zipToContainer(ab);
     expect(await container.readDocument()).toBe('# Read me');
   });
+
+  it('rejects archives that exceed the configured entry limit', async () => {
+    const zip = new JSZip();
+    zip.file('one.txt', '1');
+    zip.file('two.txt', '2');
+    const data = await zip.generateAsync({ type: 'arraybuffer' });
+    await expect(zipToContainer(data, { maxEntries: 1 })).rejects.toThrow(/archive has 2 files/);
+  });
+
+  it('rejects archives that exceed the configured uncompressed byte limit', async () => {
+    const zip = new JSZip();
+    zip.file('large.txt', '12345');
+    const data = await zip.generateAsync({ type: 'arraybuffer' });
+    await expect(zipToContainer(data, { maxUncompressedBytes: 4 })).rejects.toThrow(
+      /uncompressed content exceeds 4 byte limit/,
+    );
+  });
+
+  it('rejects traversal paths even when JSZip sanitizes their loaded key', async () => {
+    const zip = new JSZip();
+    zip.file('../outside.txt', 'nope');
+    const data = await zip.generateAsync({ type: 'arraybuffer' });
+
+    await expect(zipToContainer(data)).rejects.toThrow(/unsafe path.*\.\.\/outside\.txt/i);
+  });
+
+  it('rejects absolute and Windows-style archive paths', async () => {
+    for (const path of ['/absolute.txt', 'C:\\outside.txt']) {
+      const zip = new JSZip();
+      zip.file(path, 'nope');
+      const data = await zip.generateAsync({ type: 'arraybuffer' });
+      await expect(zipToContainer(data)).rejects.toThrow(/unsafe path/i);
+    }
+  });
 });
 
 // ============================================