@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -19,6 +19,7 @@ var b = helpers.b;
 var os = require("node:os");
 var path = require("node:path");
 var fs = require("node:fs");
+var zlib = require("node:zlib");
 
 async function testRoundTripExtract() {
   var z = b.archive.zip();
@@ -541,6 +542,10 @@ function buildZip64Store(name, data, crc, opts) {
   cdExtra.writeBigUInt64LE(BigInt(size), 4);
   cdExtra.writeBigUInt64LE(BigInt(size), 12);
   if (includeOffset) cdExtra.writeBigUInt64LE(BigInt(lfhOffset), 20);
+  // Adversarial CD-extra fixtures inject a hand-built extra block to drive
+  // the ZIP64 extended-information refusal branches (truncated / missing /
+  // multi-disk / value-too-large).
+  if (opts.cdExtraOverride) cdExtra = opts.cdExtraOverride;
 
   // Central directory header (46 bytes) with sentinel sizes.
   var cd = Buffer.alloc(46);
@@ -557,7 +562,7 @@ function buildZip64Store(name, data, crc, opts) {
   cd.writeUInt16LE(nameBuf.length, 28);
   cd.writeUInt16LE(cdExtra.length, 30);
   cd.writeUInt16LE(0, 32);             // comment len
-  cd.writeUInt16LE(0, 34);             // disk start
+  cd.writeUInt16LE(opts.diskSentinel === true ? U16_SENTINEL : 0, 34);  // disk start (sentinel when opted in)
   cd.writeUInt16LE(0, 36);             // internal attrs
   cd.writeUInt32LE(0, 38);             // external attrs
   cd.writeUInt32LE(includeOffset ? U32_SENTINEL : lfhOffset, 42);  // lfh offset (sentinel when opted in)
@@ -686,7 +691,629 @@ async function testZip64Read() {
     orphanErr && /zip64/.test(orphanErr.code || orphanErr.message));
 }
 
+// ---------------------------------------------------------------------------
+// Adversarial / defensive branch coverage — hand-built malformed archives.
+// The write side always emits well-formed classic archives, so the reader's
+// refusal + defensive paths (bad signatures, LFH/CD skew, ZIP64 trailer
+// corruption, entry-type policy, bomb caps, deflate decode) are driven from
+// hand-crafted fixtures decoded through the real b.archive.read.zip consumer
+// path (buffer / objectStore adapter).
+// ---------------------------------------------------------------------------
+
+var SIG_LFH_OK  = 0x04034b50;
+var SIG_CFH_OK  = 0x02014b50;
+var SIG_EOCD_OK = 0x06054b50;
+
+// External-attribute high-16-bit unix mode markers (mode << 16).
+var EXT_SYMLINK  = 0xA1FF0000;   // S_IFLNK
+var EXT_SOCKET   = 0xC0000000;   // S_IFSOCK
+var EXT_FIFO     = 0x10000000;   // S_IFIFO
+var EXT_CHARDEV  = 0x20000000;   // S_IFCHR
+var EXT_BLOCKDEV = 0x60000000;   // S_IFBLK
+var EXT_DIR      = 0x40000000;   // S_IFDIR
+
+// Build a classic (non-ZIP64) archive with full per-entry field control so a
+// single field can be corrupted to drive one refusal branch. Each spec:
+//   { name, data?, method?, usize?, csize?, crc?, flags?, externalAttrs?,
+//     lfhSig?, cdSig?, lfhMethod?, lfhCrc?, lfhCsize?, lfhUsize?, lfhName?,
+//     cdNameLen? }
+// opts: { eocdDiskNumber?, eocdCdDisk?, totalEntries? }
+function buildClassicZip(specs, opts) {
+  opts = opts || {};
+  var localParts = [];
+  var offsets = [];
+  var running = 0;
+  specs.forEach(function (s) {
+    var nameBuf = Buffer.from(s.name, "utf8");
+    var data = s.data || Buffer.alloc(0);
+    var usize = s.usize != null ? s.usize : data.length;
+    var csize = s.csize != null ? s.csize : data.length;
+    var crc = (s.crc != null ? s.crc : 0) >>> 0;
+    var method = s.method != null ? s.method : 0;
+    var lfh = Buffer.alloc(30);
+    lfh.writeUInt32LE((s.lfhSig != null ? s.lfhSig : SIG_LFH_OK) >>> 0, 0);
+    lfh.writeUInt16LE(20, 4);
+    lfh.writeUInt16LE(s.flags != null ? s.flags : 0, 6);
+    lfh.writeUInt16LE(s.lfhMethod != null ? s.lfhMethod : method, 8);
+    lfh.writeUInt16LE(0, 10);
+    lfh.writeUInt16LE(0x21, 12);
+    lfh.writeUInt32LE((s.lfhCrc != null ? s.lfhCrc : crc) >>> 0, 14);
+    lfh.writeUInt32LE((s.lfhCsize != null ? s.lfhCsize : csize) >>> 0, 18);
+    lfh.writeUInt32LE((s.lfhUsize != null ? s.lfhUsize : usize) >>> 0, 22);
+    var lfhNameBuf = s.lfhName != null ? Buffer.from(s.lfhName, "utf8") : nameBuf;
+    lfh.writeUInt16LE(lfhNameBuf.length, 26);
+    lfh.writeUInt16LE(0, 28);
+    var part = Buffer.concat([lfh, lfhNameBuf, data]);
+    offsets.push(running);
+    running += part.length;
+    localParts.push(part);
+  });
+  var localBlob = Buffer.concat(localParts);
+  var cdParts = [];
+  specs.forEach(function (s, i) {
+    var nameBuf = Buffer.from(s.name, "utf8");
+    var data = s.data || Buffer.alloc(0);
+    var usize = s.usize != null ? s.usize : data.length;
+    var csize = s.csize != null ? s.csize : data.length;
+    var crc = (s.crc != null ? s.crc : 0) >>> 0;
+    var method = s.method != null ? s.method : 0;
+    var cd = Buffer.alloc(46);
+    cd.writeUInt32LE((s.cdSig != null ? s.cdSig : SIG_CFH_OK) >>> 0, 0);
+    cd.writeUInt16LE(20, 4);
+    cd.writeUInt16LE(20, 6);
+    cd.writeUInt16LE(s.flags != null ? s.flags : 0, 8);
+    cd.writeUInt16LE(method, 10);
+    cd.writeUInt16LE(0, 12);
+    cd.writeUInt16LE(0x21, 14);
+    cd.writeUInt32LE(crc, 16);
+    cd.writeUInt32LE(csize >>> 0, 20);
+    cd.writeUInt32LE(usize >>> 0, 24);
+    cd.writeUInt16LE(s.cdNameLen != null ? s.cdNameLen : nameBuf.length, 28);
+    cd.writeUInt16LE(0, 30);
+    cd.writeUInt16LE(0, 32);
+    cd.writeUInt16LE(0, 34);
+    cd.writeUInt16LE(0, 36);
+    cd.writeUInt32LE(s.externalAttrs != null ? (s.externalAttrs >>> 0) : 0, 38);
+    cd.writeUInt32LE(offsets[i] >>> 0, 42);
+    cdParts.push(Buffer.concat([cd, nameBuf]));
+  });
+  var cdBlob = Buffer.concat(cdParts);
+  var eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(SIG_EOCD_OK, 0);
+  eocd.writeUInt16LE(opts.eocdDiskNumber != null ? opts.eocdDiskNumber : 0, 4);
+  eocd.writeUInt16LE(opts.eocdCdDisk != null ? opts.eocdCdDisk : 0, 6);
+  var total = opts.totalEntries != null ? opts.totalEntries : specs.length;
+  eocd.writeUInt16LE(total, 8);
+  eocd.writeUInt16LE(total, 10);
+  eocd.writeUInt32LE(cdBlob.length >>> 0, 12);
+  eocd.writeUInt32LE(localBlob.length >>> 0, 16);
+  eocd.writeUInt16LE(0, 20);
+  return Buffer.concat([localBlob, cdBlob, eocd]);
+}
+
+async function _inspectErr(bytes, opts) {
+  var e = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(bytes), opts).inspect(); }
+  catch (err) { e = err; }
+  return e;
+}
+
+async function _extractEntriesErr(bytes, opts, extractOpts) {
+  var e = null;
+  try {
+    var r = b.archive.read.zip(b.archive.adapters.buffer(bytes), opts);
+    for await (var x of r.extractEntries(extractOpts)) { void x; }
+  } catch (err) { e = err; }
+  return e;
+}
+
+function _hasCode(e, code) { return !!(e && (e.code || "").indexOf(code) !== -1); }
+
+// EOCD / central-directory structural refusals driven through inspect().
+async function testMalformedRefusals() {
+  var e1 = await _inspectErr(Buffer.alloc(10));
+  check("archive-read: sub-EOCD-size archive refused", _hasCode(e1, "archive-read/too-small"));
+
+  var e2 = await _inspectErr(Buffer.alloc(100));
+  check("archive-read: no-EOCD archive refused", _hasCode(e2, "archive-read/no-eocd"));
+
+  var e3 = await _inspectErr(buildClassicZip([{ name: "a.txt", data: Buffer.from("x") }], { eocdDiskNumber: 1 }));
+  check("archive-read: multi-disk EOCD refused", _hasCode(e3, "archive-read/multi-disk"));
+
+  var e4 = await _inspectErr(buildClassicZip([{ name: "a.txt", data: Buffer.from("x"), cdSig: 0xdeadbeef }]));
+  check("archive-read: bad central-directory signature refused", _hasCode(e4, "archive-read/bad-cd-signature"));
+
+  var e5 = await _inspectErr(buildClassicZip([{ name: "a.txt", data: Buffer.from("x") }], { totalEntries: 2 }));
+  check("archive-read: CD truncated (entry count overshoot) refused", _hasCode(e5, "archive-read/cd-truncated"));
+
+  var e6 = await _inspectErr(buildClassicZip([{ name: "a.txt", data: Buffer.from("x"), cdNameLen: 500 }]));
+  check("archive-read: CD variable-length overflow refused", _hasCode(e6, "archive-read/cd-truncated"));
+
+  var empty = await b.archive.read.zip(b.archive.adapters.buffer(buildClassicZip([]))).inspect();
+  check("archive-read: empty archive yields no entries", Array.isArray(empty) && empty.length === 0);
+}
+
+// LFH/CD skew defense — every mismatched field refuses the entry.
+async function testLfhCdSkewRefusals() {
+  var opts = { guardProfile: false };
+  function mk(spec) { return buildClassicZip([spec]); }
+
+  var e1 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), lfhSig: 0xdeadbeef }), opts);
+  check("archive-read: bad LFH signature refused", _hasCode(e1, "archive-read/bad-lfh-signature"));
+
+  var e2 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), method: 0, lfhMethod: 8 }), opts);
+  check("archive-read: LFH/CD method skew refused", _hasCode(e2, "archive-read/lfh-cd-skew"));
+
+  var e3 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), crc: 1, lfhCrc: 2 }), opts);
+  check("archive-read: LFH/CD crc skew refused", _hasCode(e3, "archive-read/lfh-cd-skew"));
+
+  var e4 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), lfhCsize: 99 }), opts);
+  check("archive-read: LFH/CD compressed-size skew refused", _hasCode(e4, "archive-read/lfh-cd-skew"));
+
+  var e5 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), lfhUsize: 99 }), opts);
+  check("archive-read: LFH/CD uncompressed-size skew refused", _hasCode(e5, "archive-read/lfh-cd-skew"));
+
+  var e6 = await _extractEntriesErr(mk({ name: "a.txt", data: Buffer.from("hi"), lfhName: "b.txt" }), opts);
+  check("archive-read: LFH/CD name skew refused", _hasCode(e6, "archive-read/lfh-cd-skew"));
+}
+
+// Zip-bomb caps that the round-trip happy path never trips.
+async function testBombPolicyEdges() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "hello");
+  var good = z.toBuffer();
+
+  var e1 = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(good), { bombPolicy: { maxEntries: 0 } }).inspect(); }
+  catch (err) { e1 = err; }
+  check("archive-read: maxEntries cap trips", _hasCode(e1, "archive-read/too-many-entries"));
+
+  // Highly compressible payload → expansion ratio well above the default 100.
+  var raw = Buffer.alloc(10000);
+  var deflated = zlib.deflateRawSync(raw);
+  var bytes = buildClassicZip([{ name: "z.bin", data: deflated, method: 8, usize: raw.length, csize: deflated.length }]);
+  var e2 = await _inspectErr(bytes);
+  check("archive-read: expansion-ratio cap trips", _hasCode(e2, "archive-read/expansion-ratio"));
+}
+
+// Deterministic, effectively incompressible bytes (sha256 chain off a fixed
+// seed) so the entry's real deflate ratio is stable across runs.
+function _incompressibleBytes(nBytes) {
+  var crypto = require("node:crypto");
+  var out = Buffer.alloc(nBytes);
+  var block = crypto.createHash("sha256").update("blamejs-archive-ratio-fixture").digest();
+  var pos = 0;
+  while (pos < nBytes) {
+    block = crypto.createHash("sha256").update(block).digest();
+    var n = Math.min(block.length, nBytes - pos);
+    block.copy(out, pos, 0, n);
+    pos += n;
+  }
+  return out;
+}
+
+// The per-entry inflate must honor the operator's bombPolicy.maxExpansionRatio,
+// not a stricter hardcoded default buried in the safeDecompress composition.
+// A ~55:1 entry sits far under the reader's own default cap (100) and under an
+// operator-raised cap (1000), yet the DEFLATE decode refused it because
+// _decompressEntry composed b.safeDecompress WITHOUT forwarding maxRatio, so
+// safeDecompress fell back to its own DEFAULT_MAX_RATIO (50) — silently
+// overriding the operator's policy for every entry that compresses better than
+// 50:1 (logs / JSON / zero-padded binaries). Root: archive-read/_decompressEntry.
+async function testExpansionRatioHonorsPolicy() {
+  var payload = Buffer.concat([_incompressibleBytes(1000), Buffer.alloc(60000, 0)]);
+  var deflated = zlib.deflateRawSync(payload);
+  var ratio = payload.length / deflated.length;
+  // Precondition: the fixture ratio must sit in (50, 100] — above safe-decompress's
+  // hardcoded 50 default, below the reader's own default policy cap of 100.
+  check("archive-read: ratio fixture lands in (50, 100]", ratio > 50 && ratio <= 100);
+
+  var bytes = buildClassicZip([{
+    name: "log.txt", data: deflated, method: 8,
+    usize: payload.length, csize: deflated.length,
+  }]);
+
+  // Operator RAISES the ratio cap to 1000 — comfortably above the ~55:1 entry.
+  var generous = {
+    maxEntries: 1000, maxExpansionRatio: 1000,
+    maxEntryDecompressedBytes: 128 * 1024 * 1024,
+    maxTotalDecompressedBytes: 4 * 1024 * 1024 * 1024,
+  };
+  var got = [];
+  for await (var e of b.archive.read.zip(b.archive.adapters.buffer(bytes),
+      { bombPolicy: generous, guardProfile: false }).extractEntries()) {
+    got.push(e);
+  }
+  check("archive-read: entry within operator maxExpansionRatio extracts (policy honored)",
+    got.length === 1 && got[0].bytes.equals(payload));
+
+  // Operator LOWERS the ratio cap below the entry's real ratio — still refused,
+  // proving the enforced cap tracks the operator value (not a hardcoded 50).
+  var strict = Object.assign({}, generous, { maxExpansionRatio: 30 });
+  var refused = null;
+  try {
+    var r2 = b.archive.read.zip(b.archive.adapters.buffer(bytes),
+      { bombPolicy: strict, guardProfile: false });
+    for await (var x of r2.extractEntries()) { void x; }
+  } catch (err) { refused = err; }
+  check("archive-read: entry above operator maxExpansionRatio refused",
+    _hasCode(refused, "archive-read/expansion-ratio"));
+}
+
+// STORE + DEFLATE + unsupported-method decode paths + inspect() method labels.
+async function testDecompressPaths() {
+  var opts = { guardProfile: false };
+
+  var payload = Buffer.from("deflate round-trip payload with some entropy 1234567890", "utf8");
+  var deflated = zlib.deflateRawSync(payload);
+  var dbytes = buildClassicZip([{ name: "d.txt", data: deflated, method: 8, usize: payload.length, csize: deflated.length }]);
+  var dr = b.archive.read.zip(b.archive.adapters.buffer(dbytes), opts);
+  var got = null;
+  for await (var e of dr.extractEntries()) { got = e; }
+  check("archive-read: DEFLATE entry inflates to exact bytes", got && got.bytes.equals(payload));
+  var di = await dr.inspect();
+  check("archive-read: inspect maps DEFLATE method label", di[0].method === "deflate");
+
+  var e2 = await _extractEntriesErr(buildClassicZip([{ name: "s.txt", data: Buffer.from("ABCDE"), csize: 5, usize: 7 }]), opts);
+  check("archive-read: STORE size mismatch refused", _hasCode(e2, "archive-read/store-size-mismatch"));
+
+  var umBytes = buildClassicZip([{ name: "u.bin", data: Buffer.from("QQ"), method: 99 }]);
+  var e3 = await _extractEntriesErr(umBytes, opts);
+  check("archive-read: unsupported method refused", _hasCode(e3, "archive-read/unsupported-method"));
+  var ui = await b.archive.read.zip(b.archive.adapters.buffer(umBytes), opts).inspect();
+  check("archive-read: inspect maps unknown method label", ui[0].method === "method-99");
+
+  var empBytes = buildClassicZip([{ name: "empty.txt", data: Buffer.alloc(0) }]);
+  var emptyGot = null;
+  for await (var ee of b.archive.read.zip(b.archive.adapters.buffer(empBytes), opts).extractEntries()) { emptyGot = ee; }
+  check("archive-read: empty entry yields zero-length buffer", emptyGot && emptyGot.bytes.length === 0);
+
+  // DEFLATE inflate-size mismatch — declared uncompressed size overstates the
+  // actual inflated length (still under the per-entry cap, so it reaches the
+  // post-inflate size check rather than a bomb refusal).
+  var infl = Buffer.from("0123456789", "utf8");
+  var inflDef = zlib.deflateRawSync(infl);
+  var inflBytes = buildClassicZip([{ name: "m.txt", data: inflDef, method: 8, usize: 20, csize: inflDef.length }]);
+  var e4 = await _extractEntriesErr(inflBytes, opts);
+  check("archive-read: DEFLATE inflate-size mismatch refused", _hasCode(e4, "archive-read/inflate-size-mismatch"));
+
+  // extractEntries skips directory entries (no bytes yielded for them).
+  var dirMix = buildClassicZip([
+    { name: "d", externalAttrs: EXT_DIR },
+    { name: "d/inner.txt", data: Buffer.from("in") },
+  ]);
+  var dirNames = [];
+  for await (var de of b.archive.read.zip(b.archive.adapters.buffer(dirMix), opts).extractEntries()) { dirNames.push(de.name); }
+  check("archive-read: extractEntries skips directory entries",
+    dirNames.length === 1 && dirNames[0] === "d/inner.txt");
+}
+
+// b.archive.read.zip factory adapter-shape guards.
+async function testZipFactoryAdapterGuards() {
+  var e1 = null;
+  try { b.archive.read.zip(null); } catch (err) { e1 = err; }
+  check("archive-read: null adapter refused", _hasCode(e1, "archive-read/bad-adapter"));
+
+  var e2 = null;
+  try { b.archive.read.zip({ kind: "bogus" }); } catch (err) { e2 = err; }
+  check("archive-read: wrong-kind adapter refused", _hasCode(e2, "archive-read/bad-adapter"));
+
+  var nodeStream = require("node:stream");
+  var readable = new nodeStream.Readable({ read: function () {} });
+  var e3 = null;
+  try { b.archive.read.zip(b.archive.adapters.trustedStream(readable)); }
+  catch (err) { e3 = err; }
+  finally { readable.destroy(); }
+  check("archive-read: trusted-stream adapter at random-access entry refused",
+    _hasCode(e3, "archive-read/wrong-entry-point"));
+}
+
+// Entry-type classification surfaced on inspect() for every unix mode marker.
+async function testEntryTypeClassification() {
+  var bytes = buildClassicZip([
+    { name: "link",     externalAttrs: EXT_SYMLINK,  data: Buffer.from("target") },
+    { name: "sock",     externalAttrs: EXT_SOCKET },
+    { name: "pipe",     externalAttrs: EXT_FIFO },
+    { name: "cdev",     externalAttrs: EXT_CHARDEV },
+    { name: "bdev",     externalAttrs: EXT_BLOCKDEV },
+    { name: "dattr",    externalAttrs: EXT_DIR },
+    { name: "dslash/",  data: Buffer.alloc(0) },
+    { name: "file.txt", data: Buffer.from("hi") },
+  ]);
+  var entries = await b.archive.read.zip(b.archive.adapters.buffer(bytes)).inspect();
+  var byName = {};
+  entries.forEach(function (e) { byName[e.name] = e.entryType; });
+  check("classify: symlink attrs",                byName["link"] === "symlink");
+  check("classify: socket attrs",                 byName["sock"] === "socket");
+  check("classify: fifo attrs",                   byName["pipe"] === "fifo");
+  check("classify: char device attrs",            byName["cdev"] === "device");
+  check("classify: block device attrs",           byName["bdev"] === "device");
+  check("classify: directory via unix mode attrs", byName["dattr"] === "directory");
+  check("classify: directory via trailing slash", byName["dslash/"] === "directory");
+  check("classify: regular file",                 byName["file.txt"] === "file");
+}
+
+// entryTypePolicy refuses dangerous-by-default entry types on both extract
+// paths (guardProfile:false isolates the type check from the guard cascade).
+async function testEntryTypePolicyRefusals() {
+  var opts = { guardProfile: false };
+  async function refuse(attrs, label) {
+    var bytes = buildClassicZip([{ name: "n", externalAttrs: attrs, data: Buffer.from("x") }]);
+    var e = await _extractEntriesErr(bytes, opts);
+    check("entry-type policy refuses " + label,
+      _hasCode(e, "archive-read/entry-type-refused") && (e.message || "").indexOf(label) !== -1);
+  }
+  await refuse(EXT_SYMLINK,  "symlink");
+  await refuse(EXT_CHARDEV,  "device");
+  await refuse(EXT_FIFO,     "fifo");
+  await refuse(EXT_SOCKET,   "socket");
+
+  var dest = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-artype-"));
+  var e = null;
+  try {
+    await b.archive.read.zip(
+      b.archive.adapters.buffer(buildClassicZip([{ name: "lnk", externalAttrs: EXT_SYMLINK, data: Buffer.from("t") }])), opts
+    ).extract({ destination: dest });
+  } catch (err) { e = err; }
+  finally { fs.rmSync(dest, { recursive: true, force: true }); }
+  check("entry-type policy refuses symlink on disk extract", _hasCode(e, "archive-read/entry-type-refused"));
+}
+
+// Encrypted entries are refused (this reader never decrypts) on both paths.
+async function testEncryptedEntryRefusal() {
+  var opts = { guardProfile: false };
+  var FLAG_ENCRYPTED = 0x0001;
+  var bytes = buildClassicZip([{ name: "enc.txt", data: Buffer.from("cipher"), flags: FLAG_ENCRYPTED }]);
+
+  var e1 = await _extractEntriesErr(bytes, opts);
+  check("archive-read: encrypted entry refused (extractEntries)", _hasCode(e1, "archive-read/encrypted-entry"));
+
+  var dest = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-enc-"));
+  var e2 = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(bytes), opts).extract({ destination: dest }); }
+  catch (err) { e2 = err; }
+  finally { fs.rmSync(dest, { recursive: true, force: true }); }
+  check("archive-read: encrypted entry refused (disk extract)", _hasCode(e2, "archive-read/encrypted-entry"));
+}
+
+// The raw-entry async generators on both reader variants.
+async function testEntriesGenerators() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "A");
+  z.addFile("b.txt", "B");
+  var bytes = z.toBuffer();
+
+  var names = [];
+  for await (var e of b.archive.read.zip(b.archive.adapters.buffer(bytes)).entries()) { names.push(e.name); }
+  check("archive-read: entries() random-access generator yields raw entries",
+    names.length === 2 && names.indexOf("a.txt") !== -1);
+
+  var nodeStream = require("node:stream");
+  var tnames = [];
+  var tr = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)));
+  for await (var te of tr.entries()) { tnames.push(te.name); }
+  check("archive-read: entries() trusted-stream generator yields entries", tnames.length === 2);
+}
+
+// Disk extract(): no-destination refusal, destination auto-create, directory
+// materialization, and atomic rollback of a partial extract on a later error.
+async function testExtractDirAndCleanup() {
+  var opts = { guardProfile: false };
+
+  var e0 = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(buildClassicZip([{ name: "a.txt", data: Buffer.from("x") }])), opts).extract({}); }
+  catch (err) { e0 = err; }
+  check("archive-read: extract without destination refused", _hasCode(e0, "archive-read/no-destination"));
+
+  var eEmpty = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(buildClassicZip([{ name: "a.txt", data: Buffer.from("x") }])), opts).extract({ destination: "" }); }
+  catch (err) { eEmpty = err; }
+  check("archive-read: extract with empty destination string refused", _hasCode(eEmpty, "archive-read/no-destination"));
+
+  var eBare = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(buildClassicZip([{ name: "a.txt", data: Buffer.from("x") }])), opts).extract(); }
+  catch (err) { eBare = err; }
+  check("archive-read: extract() with no options refused", _hasCode(eBare, "archive-read/no-destination"));
+
+  var base = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-extdir-"));
+  var dest = path.join(base, "nested-not-there");   // does not exist yet
+  try {
+    var dbytes = buildClassicZip([
+      { name: "subdir", externalAttrs: EXT_DIR },
+      { name: "subdir/f.txt", data: Buffer.from("inside\n") },
+    ]);
+    var res = await b.archive.read.zip(b.archive.adapters.buffer(dbytes), opts).extract({ destination: dest });
+    check("archive-read: extract auto-creates destination + writes file", res.bytesExtracted === 7);
+    check("archive-read: directory entry materialized", fs.existsSync(path.join(dest, "subdir")));
+    check("archive-read: file under directory restored",
+      fs.readFileSync(path.join(dest, "subdir", "f.txt"), "utf8") === "inside\n");
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+
+  var base2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-extcleanup-"));
+  try {
+    var mixed = buildClassicZip([
+      { name: "ok.txt",  data: Buffer.from("kept-until-rollback\n") },
+      { name: "bad.bin", data: Buffer.from("ZZ"), method: 99 },
+    ]);
+    var e2 = null;
+    try { await b.archive.read.zip(b.archive.adapters.buffer(mixed), opts).extract({ destination: base2 }); }
+    catch (err) { e2 = err; }
+    check("archive-read: extract aborts on a later bad entry", _hasCode(e2, "archive-read/unsupported-method"));
+    check("archive-read: partial file rolled back on abort", !fs.existsSync(path.join(base2, "ok.txt")));
+  } finally {
+    fs.rmSync(base2, { recursive: true, force: true });
+  }
+}
+
+// ZIP64 trailer (EOCD64 record + locator) corruption refusals.
+async function testZip64TrailerErrors() {
+  var payload = Buffer.from("zip64 trailer error fixtures", "utf8");
+  var z = b.archive.zip();
+  z.addFile("z.txt", payload);
+  var crc = (await b.archive.read.zip(b.archive.adapters.buffer(z.toBuffer())).inspect())[0].crc;
+
+  function base() { return buildZip64Store("z.txt", payload, crc); }
+  var LOC = 22 + 20;         // locator starts 42 bytes from EOF
+  var E64 = 22 + 20 + 56;    // eocd64 record starts 98 bytes from EOF
+
+  var b1 = base(); b1.writeUInt32LE(0xdeadbeef, b1.length - LOC);
+  var e1 = await _inspectErr(b1);
+  check("zip64: bad locator signature refused", _hasCode(e1, "archive-read/zip64-locator-missing"));
+
+  var b2 = base(); b2.writeUInt32LE(2, b2.length - LOC + 16);
+  var e2 = await _inspectErr(b2);
+  check("zip64: multi-disk locator refused", _hasCode(e2, "archive-read/multi-disk"));
+
+  var b3 = base(); b3.writeBigUInt64LE(BigInt(b3.length + 1000), b3.length - LOC + 8);
+  var e3 = await _inspectErr(b3);
+  check("zip64: EOCD64 offset past EOF refused", _hasCode(e3, "archive-read/zip64-eocd-out-of-range"));
+
+  var b4 = base(); b4.writeUInt32LE(0xdeadbeef, b4.length - E64);
+  var e4 = await _inspectErr(b4);
+  check("zip64: bad EOCD64 record signature refused", _hasCode(e4, "archive-read/zip64-eocd-bad-signature"));
+
+  // Classic EOCD carries a sentinel but sits at offset 0 — no room for a locator.
+  var tiny = Buffer.alloc(22);
+  tiny.writeUInt32LE(0x06054b50, 0);
+  tiny.writeUInt16LE(1, 8); tiny.writeUInt16LE(1, 10);
+  tiny.writeUInt32LE(0xffffffff, 12); tiny.writeUInt32LE(0xffffffff, 16);
+  var e5 = await _inspectErr(tiny);
+  check("zip64: sentinel with no room for locator refused", _hasCode(e5, "archive-read/zip64-locator-missing"));
+
+  // EOCD64 resolves cdSize to a literal 0xFFFFFFFF, which the CD walk still
+  // treats as an unresolved sentinel and refuses.
+  var b6 = base();
+  b6.writeBigUInt64LE(0xffffffffn, (b6.length - E64) + 40);
+  var e6 = await _inspectErr(b6);
+  check("zip64: EOCD64 leaves an unresolved sentinel refused", _hasCode(e6, "archive-read/zip64-eocd-unresolved"));
+}
+
+// ZIP64 extended-information extra field (§4.5.3) corruption refusals.
+async function testZip64ExtraErrors() {
+  var payload = Buffer.from("x", "utf8");
+  var z = b.archive.zip();
+  z.addFile("z.txt", payload);
+  var crc = (await b.archive.read.zip(b.archive.adapters.buffer(z.toBuffer())).inspect())[0].crc;
+
+  function zip64Extra(id, dataBuf) {
+    var e = Buffer.alloc(4 + dataBuf.length);
+    e.writeUInt16LE(id, 0);
+    e.writeUInt16LE(dataBuf.length, 2);
+    dataBuf.copy(e, 4);
+    return e;
+  }
+  function withExtra(extra, more) {
+    var o = { cdExtraOverride: extra };
+    if (more) { Object.keys(more).forEach(function (k) { o[k] = more[k]; }); }
+    return buildZip64Store("z.txt", payload, crc, o);
+  }
+
+  var huge = Buffer.alloc(16);
+  huge.writeBigUInt64LE(1n << 53n, 0);                    // > Number.MAX_SAFE_INTEGER
+  huge.writeBigUInt64LE(BigInt(payload.length), 8);
+  var e1 = await _inspectErr(withExtra(zip64Extra(0x0001, huge)));
+  check("zip64: extra value exceeding MAX_SAFE_INTEGER refused", _hasCode(e1, "archive-read/zip64-value-too-large"));
+
+  var e2 = await _inspectErr(withExtra(zip64Extra(0x0001, Buffer.alloc(0))));
+  check("zip64: extra truncated (uncompressed) refused", _hasCode(e2, "archive-read/zip64-extra-truncated"));
+
+  var e3 = await _inspectErr(withExtra(zip64Extra(0x0001, Buffer.alloc(8))));
+  check("zip64: extra truncated (compressed) refused", _hasCode(e3, "archive-read/zip64-extra-truncated"));
+
+  var e4 = await _inspectErr(withExtra(zip64Extra(0x0001, Buffer.alloc(16)), { offsetSentinel: true }));
+  check("zip64: extra truncated (lfh offset) refused", _hasCode(e4, "archive-read/zip64-extra-truncated"));
+
+  var e5 = await _inspectErr(withExtra(zip64Extra(0x0001, Buffer.alloc(24)), { offsetSentinel: true, diskSentinel: true }));
+  check("zip64: extra truncated (disk start) refused", _hasCode(e5, "archive-read/zip64-extra-truncated"));
+
+  var withDisk = Buffer.alloc(28); withDisk.writeUInt32LE(1, 24);
+  var e6 = await _inspectErr(withExtra(zip64Extra(0x0001, withDisk), { offsetSentinel: true, diskSentinel: true }));
+  check("zip64: non-zero disk start refused", _hasCode(e6, "archive-read/multi-disk"));
+
+  var e7 = await _inspectErr(withExtra(zip64Extra(0x9999, Buffer.alloc(0))));
+  check("zip64: sentinel with no 0x0001 extra block refused", _hasCode(e7, "archive-read/zip64-extra-missing"));
+
+  var badHeader = Buffer.alloc(4);
+  badHeader.writeUInt16LE(0x0001, 0);
+  badHeader.writeUInt16LE(100, 2);   // claims 100 bytes of data that aren't present
+  var e8 = await _inspectErr(withExtra(badHeader));
+  check("zip64: truncated extra header refused", _hasCode(e8, "archive-read/zip64-extra-missing"));
+
+  // A fully-present extra with a valid (zero) disk start resolves cleanly —
+  // the success side of the disk-start check.
+  var full = Buffer.alloc(28);
+  full.writeBigUInt64LE(BigInt(payload.length), 0);   // uncompressedSize
+  full.writeBigUInt64LE(BigInt(payload.length), 8);   // compressedSize
+  full.writeBigUInt64LE(0n, 16);                      // localHeaderOffset
+  full.writeUInt32LE(0, 24);                          // diskStart = 0 (valid, single-disk)
+  var okEntries = await b.archive.read.zip(
+    b.archive.adapters.buffer(withExtra(zip64Extra(0x0001, full), { offsetSentinel: true, diskSentinel: true }))
+  ).inspect();
+  check("zip64: full extra with disk-start 0 resolves the entry",
+    okEntries.length === 1 && okEntries[0].size === payload.length);
+}
+
+// objectStore adapter delivers size via resolveSize() (not a static .size),
+// exercising the reader's deferred-size EOCD-locate branch.
+async function testObjectStoreAdapterResolveSize() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "object-store payload");
+  var bytes = z.toBuffer();
+  var client = {
+    head: async function () { return { size: bytes.length }; },
+    get: async function (key, o) {
+      var start = o.range[0], end = o.range[1];
+      var slice = Buffer.allocUnsafe(end - start + 1);
+      bytes.copy(slice, 0, start, end + 1);
+      return slice;
+    },
+  };
+  var adapter = b.archive.adapters.objectStore(client, "incoming/a.zip");
+  var entries = await b.archive.read.zip(adapter).inspect();
+  check("archive-read: objectStore adapter resolveSize path decodes",
+    entries.length === 1 && entries[0].name === "a.txt");
+}
+
+// AbortSignal with a reason string surfaces the reason in the thrown message.
+async function testAbortWithReason() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "x");
+  var bytes = z.toBuffer();
+  var ac = new AbortController();
+  ac.abort("operator cancelled the read");
+  var e = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(bytes), { signal: ac.signal }).inspect(); }
+  catch (err) { e = err; }
+  check("archive-read: abort reason surfaced in message",
+    _hasCode(e, "archive-read/aborted") && (e.message || "").indexOf("operator cancelled") !== -1);
+
+  // A signal-like object whose aborted flag is set but that carries no reason
+  // exercises the no-reason message branch.
+  var e2 = null;
+  try { await b.archive.read.zip(b.archive.adapters.buffer(bytes), { signal: { aborted: true } }).inspect(); }
+  catch (err) { e2 = err; }
+  check("archive-read: aborted signal without a reason still refuses", _hasCode(e2, "archive-read/aborted"));
+}
+
 async function run() {
+  await testMalformedRefusals();
+  await testLfhCdSkewRefusals();
+  await testBombPolicyEdges();
+  await testExpansionRatioHonorsPolicy();
+  await testDecompressPaths();
+  await testZipFactoryAdapterGuards();
+  await testEntryTypeClassification();
+  await testEntryTypePolicyRefusals();
+  await testEncryptedEntryRefusal();
+  await testEntriesGenerators();
+  await testExtractDirAndCleanup();
+  await testZip64TrailerErrors();
+  await testZip64ExtraErrors();
+  await testObjectStoreAdapterResolveSize();
+  await testAbortWithReason();
   await testZip64Read();
   await testRoundTripExtract();
   await testExtractEntriesInMemory();