@jwilleke/ngdpbase-types 5.26.0 → 5.27.0

package/lib/src/security/PolicyInformationPoint.d.ts

@@ -209,6 +209,12 @@ declare class PolicyInformationPoint extends BaseManager {
      * none when it is not running.
      */
     subjectEnabledAddons(ctx: ActorContext): Promise<string[]>;
+    /**
+     * {@link subjectEnabledAddons} for a page decision (#1964): none for no
+     * subject, and none when the lookup fails — an `addon:<slug>` entry then
+     * matches nobody, never everyone.
+     */
+    private enabledAddonsOf;
     private userManager;
     private roleManager;
     /**
@@ -326,7 +332,9 @@ declare class PolicyInformationPoint extends BaseManager {
      * - __Tier 0.5, author-lock__, `edit` only. It only denies: an author, or a
      *   subject holding `admin-system` (#1431 7b), falls through to Tier 1+.
      * - __Tier 1, frontmatter__ `access[action]` / `audience`. Page-level, and
-     *   overrides global policy when it states a rule (#1054).
+     *   overrides global policy when it states a rule (#1054). An `audience`
+     *   covers every action, and a subject holding `admin-system` is its one
+     *   exception; `access` has none (#1964).
      * - __Tier 2.__ For a share visitor the share IS the policy (#1222); for
      *   anyone else, global policy.
      * - __Default deny.__ Nothing below Tier 2 grants — JSPWiki's page-body ACL
@@ -439,10 +447,25 @@ declare class PolicyInformationPoint extends BaseManager {
      */
     canUserAccessMediaItem(userContext: UserContext | null | undefined, item: MediaItem): Promise<boolean>;
     /**
-     * Check front matter audience / access fields (Tier 1.5).
+     * Check front matter audience / access fields (Tier 1).
      * Returns a decision object; decided=false means no front matter restriction — fall through.
+     *
+     * An audience that leaves the subject out refuses every action, unless the
+     * subject holds `admin-system` (#1964, operator 2026-10-23): asked only
+     * then. `access[action]` has no such exception.
      */
     private checkFrontmatterAccess;
+    /**
+     * Does the page's `audience` admit this subject (#1964)? True when the page
+     * names no audience, the subject matches it, or the subject holds
+     * `admin-system`. The same rule Tier 1 applies, asked by PageManager's
+     * write door, so a write cannot reach a page its writer is outside the
+     * audience of — whatever route it came by. Records nothing; the door does.
+     *
+     * @param userContext - the subject, as given
+     * @param metadata - the page's current frontmatter
+     */
+    audienceAdmits(userContext: UserContext | null | undefined, metadata: PageFrontmatter | null | undefined): Promise<boolean>;
     /**
      * Record/audit an access decision.
      * Accepts either a single object or positional args for backward compatibility.

package/lib/src/types/Config.d.ts

@@ -121,6 +121,8 @@ export interface WikiConfig {
      * counting every failure inside it (#1916). Default: 60.
      */
     'ngdpbase.mail.failure-notice.window-minutes': number;
+    /** The most a message's attachments may total, in bytes (#1974). Default: 10485760. */
+    'ngdpbase.mail.attachments.max-bytes': number;
     /**
      * Anti-spam: max submissions per IP per `window-minutes` window before
      * the 429 trips (#670 Phase E). Default: 5.

package/lib/src/utils/addonHost.d.ts

@@ -15,6 +15,8 @@
  *   the add-on (#1973);
  * - `setEnabledForPerson` sets this add-on's own per-person switch (#1963),
  *   bound to its slug, so it can never set another add-on's;
+ * - `registerShim` and `registerReceiver` (#1979, ICE) register into the import
+ *   engine under this add-on's slug, and only the names its manifest declares;
  * - the egress tools (`resolveEgressPolicy`, `validateUrl`,
  *   `createGuardedElasticsearchClient`, `refusedNodeMessage`) and `isAtLeast`
  *   are core's own pure functions, handed on unchanged, so an add-on never
@@ -36,6 +38,8 @@ import { createGuardedElasticsearchClient, refusedNodeMessage } from '../http/gu
 import { isAtLeast } from './version.js';
 import { recordAuditEvent } from './auditEvents.js';
 import { addonAuditEventName } from './auditEventNames.js';
+import type { IceReceiver, IceShim } from '../ice/types.js';
+import type { AddonManifest } from '../managers/AddonsManager.js';
 /** The values core offers an add-on, under the names they were imported as. */
 export interface AddonHost {
     readonly ApiContext: typeof ApiContext;
@@ -76,7 +80,21 @@ export interface AddonHost {
     readonly refusedNodeMessage: typeof refusedNodeMessage;
     /** Whether an `x.y.z` version is at least another; throws on a version that is not `x.y.z`. */
     readonly isAtLeast: typeof isAtLeast;
+    /**
+     * #1979 (ICE, D6): register an import shim, as `<slug>.<shim.name>`. Call it
+     * in `register`. Refused when the manifest's `shims` does not name it.
+     * Returns the shim's id; site configuration switches it on and off.
+     */
+    readonly registerShim: (shim: IceShim) => string;
+    /**
+     * #1979 (ICE, D4): register a receiver — your manager's own door for what
+     * shims produce — as `<slug>.<receiver.name>`. Refused when the manifest's
+     * `receivers` does not name it. Returns the receiver's id.
+     */
+    readonly registerReceiver: (receiver: IceReceiver) => string;
 }
+/** What the host may register for an add-on: the shim and receiver names its manifest declares (#1979). */
+export type AddonIceDeclaration = Pick<AddonManifest, 'shims' | 'receivers'>;
 /** Sets one add-on's per-person switch; core binds the slug when it builds the host (#1963). */
 export type PersonSwitchSetter = (ctx: ActorContext, on: boolean) => Promise<void>;
 /**
@@ -94,6 +112,9 @@ export declare function addonDeclaredAuditEvents(addonDefaults: Record<string, u
  * @param setEnabledForPerson - This add-on's switch setter, slug already bound
  *   (`AddonsManager` supplies it); without one, the host's setter refuses
  * @param engine - The running engine, which names the system principal for
- *   `systemContext`; without one (a test) it is core's fallback principal
+ *   `systemContext` and holds the import engine `registerShim` reaches;
+ *   without one (a test) it is core's fallback principal, and no registry
+ * @param manifest - The add-on's manifest (`ngdpbase` in its package.json):
+ *   the shims and receivers it may register (#1979)
  */
-export declare function buildAddonHost(slug: string, addonDefaults: Record<string, unknown>, setEnabledForPerson?: PersonSwitchSetter, engine?: Parameters<typeof systemContext>[0]): AddonHost;
+export declare function buildAddonHost(slug: string, addonDefaults: Record<string, unknown>, setEnabledForPerson?: PersonSwitchSetter, engine?: Parameters<typeof systemContext>[0], manifest?: AddonIceDeclaration | null): AddonHost;

package/lib/src/utils/addonHost.js

@@ -15,6 +15,8 @@
  *   the add-on (#1973);
  * - `setEnabledForPerson` sets this add-on's own per-person switch (#1963),
  *   bound to its slug, so it can never set another add-on's;
+ * - `registerShim` and `registerReceiver` (#1979, ICE) register into the import
+ *   engine under this add-on's slug, and only the names its manifest declares;
  * - the egress tools (`resolveEgressPolicy`, `validateUrl`,
  *   `createGuardedElasticsearchClient`, `refusedNodeMessage`) and `isAtLeast`
  *   are core's own pure functions, handed on unchanged, so an add-on never
@@ -64,10 +66,29 @@ function refuseUndeclared(slug, name, declared) {
  * @param setEnabledForPerson - This add-on's switch setter, slug already bound
  *   (`AddonsManager` supplies it); without one, the host's setter refuses
  * @param engine - The running engine, which names the system principal for
- *   `systemContext`; without one (a test) it is core's fallback principal
+ *   `systemContext` and holds the import engine `registerShim` reaches;
+ *   without one (a test) it is core's fallback principal, and no registry
+ * @param manifest - The add-on's manifest (`ngdpbase` in its package.json):
+ *   the shims and receivers it may register (#1979)
  */
-export function buildAddonHost(slug, addonDefaults, setEnabledForPerson = noPersonSwitch, engine) {
+export function buildAddonHost(slug, addonDefaults, setEnabledForPerson = noPersonSwitch, engine, manifest) {
     const declared = addonDeclaredAuditEvents(addonDefaults);
+    const names = (list) => new Set(Array.isArray(list) ? list.filter((n) => typeof n === 'string') : []);
+    const iceDeclared = { shim: names(manifest?.shims), receiver: names(manifest?.receivers) };
+    const iceRegistry = (what, name) => {
+        const allowed = iceDeclared[what];
+        if (typeof name !== 'string' || !allowed.has(name)) {
+            const message = `Add-on '${slug}' may register only the ${what}s its manifest declares ("ngdpbase": { "${what}s": [...] } in package.json); ` +
+                `'${String(name)}' is not one of them (declared: ${allowed.size > 0 ? [...allowed].sort().join(', ') : 'none'}).`;
+            logger.error(`[addons] ${message}`);
+            throw new Error(message);
+        }
+        const registry = engine?.getManager('ImportManager');
+        if (typeof registry?.registerShim !== 'function' || typeof registry.registerReceiver !== 'function') {
+            throw new Error(`register${what === 'shim' ? 'Shim' : 'Receiver'} is not available: this host was built without a site's ImportManager`);
+        }
+        return registry;
+    };
     const hostAddonAuditEventName = (name) => {
         const checked = addonAuditEventName(name);
         refuseUndeclared(slug, name, declared);
@@ -90,6 +111,8 @@ export function buildAddonHost(slug, addonDefaults, setEnabledForPerson = noPers
         logger: logger.child({ addon: slug }),
         guardedFetch,
         setEnabledForPerson,
+        registerShim: (shim) => iceRegistry('shim', shim?.name).registerShim(slug, shim),
+        registerReceiver: (receiver) => iceRegistry('receiver', receiver?.name).registerReceiver(slug, receiver),
         resolveEgressPolicy,
         validateUrl,
         createGuardedElasticsearchClient,

package/lib/src/utils/frontmatterAccess.d.ts

@@ -2,8 +2,8 @@
  * frontmatterAccess — the single implementation of ACL Tier 1 (#1054).
  *
  * A page's frontmatter can restrict who may act on it, via `access[<action>]`
- * or, for viewing, `audience`. Two subsystems needed that answer and each had
- * its own version of it, which is how they came to disagree:
+ * or `audience`, which covers every action (#1964). Two subsystems needed
+ * that answer and each had its own version of it, which is how they came to disagree:
  *
  *   - `PolicyInformationPoint.checkFrontmatterAccess` decided a request, correctly.
  *   - `VersioningFileProvider.getRecentChanges` decided a listing, and only
@@ -22,7 +22,7 @@
 export interface AccessMetadataLike {
     /** `{ view: ['role'], edit: [...] }` — per-action principal lists. */
     access?: unknown;
-    /** Shorthand for `access.view`. */
+    /** Who may act on the page at all; administrators excepted (#1964). */
     audience?: unknown;
 }
 export interface FrontmatterDecision {
@@ -34,21 +34,64 @@ export interface FrontmatterDecision {
     matched?: string;
 }
 /**
- * Principals permitted to perform `action`, or null when the page states no
- * rule and the caller should fall through to global policy.
- *
- * `access[action]` wins; `audience` is the shorthand and applies to `view`
- * only. An empty list counts as no rule — a page saying `audience: []`
- * restricts nobody, which matters because a bare `access:` key parses that way.
+ * The page's `audience`, or null when it names none (#1964, operator
+ * 2026-10-23). An audience restricts EVERY action: someone outside it may
+ * neither read nor edit the page.
+ */
+export declare function audiencePrincipals(metadata: AccessMetadataLike | null | undefined): string[] | null;
+/**
+ * The page's `access[action]` list, or null when it states none. It applies
+ * to that action only, and to everyone — administrators included.
+ */
+export declare function accessPrincipals(metadata: AccessMetadataLike | null | undefined, action: string): string[] | null;
+/**
+ * The entry `addon:<slug>` (#1964): "people who turned on the per-person
+ * add-on <slug>". It is matched only against the viewer's enabled add-ons,
+ * never against a role or a username.
+ */
+export declare const ADDON_PRINCIPAL_PREFIX = "addon:";
+/**
+ * Whether deciding `action` on this page needs the viewer's enabled add-ons —
+ * so a caller asks for them only when the page names one (#1964).
  */
-export declare function resolveFrontmatterPrincipals(metadata: AccessMetadataLike | null | undefined, action: string): string[] | null;
+export declare function namesAddonPrincipal(metadata: AccessMetadataLike | null | undefined, action: string): boolean;
+/**
+ * Every add-on slug the page names in `audience` or in any `access` list, once
+ * each, in the order first named — for the warning about a slug that can match
+ * nobody (#1964).
+ */
+export declare function addonAudienceSlugs(metadata: AccessMetadataLike | null | undefined): string[];
+/**
+ * Whether the page's audience leaves this viewer out — true only when it
+ * names one and nothing in it matches. The caller then asks whether the
+ * viewer is an administrator, the one exception (#1964), and passes the
+ * answer to {@link decideFrontmatterAccess}; it asks only when this is true.
+ */
+export declare function audienceExcludes(metadata: AccessMetadataLike | null | undefined, viewerPrincipals: readonly string[], enabledAddons?: readonly string[]): boolean;
+/** The `matched` an administrator outside the audience is admitted by. */
+export declare const AUDIENCE_ADMIN_MATCH = "admin-system";
 /**
  * Decide Tier 1 for a viewer described as a flat principal list — their roles
  * plus their username. Callers holding a `UserContext` should pass
  * `[...roles, username]`; the provider layer already works in these terms.
  *
+ * Two rules, in order (#1964, operator 2026-10-23):
+ *
+ * - __`audience`__ applies to every action. Someone it leaves out may neither
+ *   read nor edit the page: every action is refused. The one exception is an
+ *   administrator — a viewer holding `admin-system`, which the caller decides
+ *   and passes as `isAdmin` (this module never reads a role for it). For
+ *   `view`, a viewer the audience admits is allowed; for any other action it
+ *   only lets them through to `access` and then policy.
+ * - __`access[action]`__ applies to that action, to everyone, administrators
+ *   included. When the page states it, it decides.
+ *
+ * An `addon:<slug>` entry matches only when `<slug>` is in `enabledAddons`,
+ * the viewer's enabled per-person add-ons (#1964); a caller that does not
+ * supply them matches no such entry, so it can under-list but never leak.
+ *
  * Denies when the page states a rule and nothing matches. That default is the
  * point: a listing that treats "no match" as "show it" is the bug this exists
  * to prevent.
  */
-export declare function decideFrontmatterAccess(metadata: AccessMetadataLike | null | undefined, viewerPrincipals: readonly string[], action: string): FrontmatterDecision;
+export declare function decideFrontmatterAccess(metadata: AccessMetadataLike | null | undefined, viewerPrincipals: readonly string[], action: string, enabledAddons?: readonly string[], isAdmin?: boolean): FrontmatterDecision;

package/lib/src/utils/importRunSummary.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Per-run summary persistence for NCM / import conversion outcomes (#738).
+ *
+ * Writes one JSON file per import run under FAST_STORAGE (configurable via
+ * `ngdpbase.import.runs-dir`, default `./data/import-runs`). Each file's
+ * name is the ISO timestamp of `startedAt`, sanitised for filesystem use.
+ *
+ * The trend view (admin-import.ejs) reads the last N summaries via
+ * listRecentRuns() to surface dominant failure causes across runs.
+ *
+ * Append-only by design. Retention is operator-managed for now — the
+ * directory can grow indefinitely; a future cleanup job (or admin button)
+ * can prune. Listed as a follow-up in the #738 acceptance criteria.
+ */
+/** Compact per-run record persisted to disk. */
+export interface ImportRunSummary {
+    /** Stable id; same as the filename without `.json`. */
+    runId: string;
+    /** ISO-8601 timestamp of when the run started. */
+    startedAt: string;
+    /** ISO-8601 timestamp of when the run finished (may equal startedAt for trivial runs). */
+    finishedAt: string;
+    /** What kind of import surfaced this run (`paste`, `url`, `file`, `ingest:<sourceId>`). */
+    importType: string;
+    /**
+     * Who initiated the run — `ImportOptions.actorContext.username` (#1236): the
+     * request's subject for a manual import, the system principal for a job.
+     */
+    actor: string;
+    /**
+     * True when the run was a job with no person behind it (a JobContext whose
+     * origin is boot, schedule or operator) — lets the trend view distinguish
+     * "alice triggered an import" from "scheduled feed ingested overnight".
+     * False for a request, or a request-origin job.
+     */
+    isSystem?: boolean;
+    /** Where the run came from: `request`, `boot`, `schedule` or `operator` (#1236). Absent on records written before it. */
+    origin?: string;
+    /** Total items the run attempted. */
+    total: number;
+    /** Items successfully converted to pages. */
+    converted: number;
+    /** Items intentionally skipped (e.g. duplicates). */
+    skipped: number;
+    /** Items that failed to convert. */
+    failed: number;
+    /**
+     * Counts of ConversionWarning.kind values aggregated across all items in the run.
+     * Keys are flat (no colon-subkinds today) per the #738 design decision.
+     */
+    kindCounts: Record<string, number>;
+}
+/** Aggregate a flat list of ConversionWarning-like objects into kindCounts. */
+export declare function tallyWarnings(warnings: Array<{
+    kind: string;
+}> | undefined): Record<string, number>;
+/** Write a single per-run summary. Idempotent for same runId. Best-effort — errors logged, never thrown. */
+export declare function writeRunSummary(runsDir: string, summary: ImportRunSummary): Promise<void>;
+/**
+ * Return the most-recent N run summaries, newest first. Filenames are ISO
+ * timestamps so lexicographic sort is chronological. Missing/empty dir
+ * returns []. Malformed individual files are skipped, not fatal.
+ */
+export declare function listRecentRuns(runsDir: string, limit?: number): Promise<ImportRunSummary[]>;

package/lib/src/utils/ncmNotify.d.ts

@@ -0,0 +1,30 @@
+/**
+ * NCM conversion → /admin/notifications (#728 Phase 2 Slice 5d)
+ *
+ * Operator decision 2026-05-17: on **non-preview** NCM conversion paths
+ * (bulk import, #685 ingestion, MCP) — where no human sees the preview — a
+ * summary of the conversion warnings is pushed to the existing
+ * `/admin/notifications` centre via `NotificationManager` (the same
+ * subsystem `MediaManager` already feeds), so admins get an actionable
+ * per-event alert. Distinct from #738 (aggregate metrics/trend).
+ *
+ * Engine-coupled glue lives here (not in `src/converters/ncm/`, which is
+ * kept pure). Best-effort and non-blocking — notification failure must never
+ * fail a conversion.
+ *
+ * @module utils/ncmNotify
+ */
+interface EngineLike {
+    getManager(name: string): unknown;
+}
+/**
+ * Push an admin notification summarising NCM conversion warnings.
+ * No-op when there are no warnings or NotificationManager is unavailable.
+ *
+ * @param engine   Wiki engine (structural — just needs getManager)
+ * @param source   Human label for the path, e.g. "Import jspwiki", "MCP create_page"
+ * @param target   The page/file that was converted
+ * @param warnings Flattened `"kind: detail"` strings
+ */
+export declare function notifyNcmConversion(engine: EngineLike, source: string, target: string, warnings: string[]): void;
+export {};

package/lib/src/utils/privateStoreImport.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Reading a takeout handed back for import (#1472) — the mirror of
+ * `privateStoreExport.ts`.
+ *
+ * Pure: entries in, a description of what they hold out. No I/O, no access
+ * decision, no write. The door that acts on it is
+ * `ImportManager.importOwnStoreTakeout`.
+ *
+ * What a takeout is, as #1387 writes it: one `{store}/` folder holding each
+ * page as `{title}.md` with full frontmatter, files under `attachments/`, and
+ * `files-index.json` mapping each file's id to its path in the archive. The
+ * reader is lenient about the one thing people change — the folder. Someone
+ * who extracts a takeout and zips it again may add a level, or zip the
+ * contents with no folder at all, so the takeout's root is found rather than
+ * assumed.
+ */
+import type { ZipEntry } from './zipArchive.js';
+/** One page of a takeout. */
+export type TakeoutPage = {
+    /** Where it was in the archive — how the report names a page that failed. */
+    archivePath: string;
+    /** From the frontmatter, else the file's name. */
+    title: string;
+    /** From the frontmatter. Absent for a page written by hand. */
+    uuid?: string;
+    /** The frontmatter, as written. */
+    metadata: Record<string, unknown>;
+    body: string;
+};
+/** One file of a takeout. */
+export type TakeoutFile = {
+    archivePath: string;
+    /** Its id where it came from, when the file index names it. */
+    oldId?: string;
+    /** The name it was uploaded with. */
+    name: string;
+    encodingFormat?: string;
+    description?: string;
+    bytes: Buffer;
+};
+export type ParsedTakeout = {
+    pages: TakeoutPage[];
+    files: TakeoutFile[];
+    /** Archive members that are neither a page nor a file, left alone. */
+    ignored: string[];
+};
+/** What a takeout's entries hold. */
+export declare function readTakeout(entries: readonly ZipEntry[]): ParsedTakeout;
+/** `body` with every `/attachments/{old}` link pointed at its new id. */
+export declare function rewriteAttachmentLinks(body: string, ids: ReadonlyMap<string, string>): string;
+/** Whether `body` links to the file `id`. */
+export declare function linksToAttachment(body: string, id: string): boolean;
+/**
+ * The first free title of `title`, `title (imported)`, `title (imported 2)` …
+ * (operator, 2026-09-25): a DIFFERENT page already holding the title keeps it,
+ * and the import lands beside it.
+ */
+export declare function freeImportTitle(title: string, isTaken: (candidate: string) => Promise<boolean>): Promise<string>;

package/lib/src/utils/zipArchive.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Writing a zip archive from bytes already in hand (#1387).
+ *
+ * A takeout lands on the owner's laptop or phone, and that decides the format:
+ * iOS, iPadOS, Android, Windows and macOS all open a `.zip` by tapping it,
+ * while `.tar.gz` needs a third-party app on exactly the devices people carry.
+ *
+ * This is the only archive the system writes, and `readZip` below is the only
+ * one it reads: a takeout handed back for import (#1472). The instance backup does not use
+ * one: it carries private files as base64 inside the backup document (#1387),
+ * so there is nothing to unpack on restore.
+ *
+ * Bytes in, one Buffer out: a takeout is decrypted, and nothing decrypted may
+ * be staged on the server's disk, so there is no file for a packer to read.
+ *
+ * Written here rather than taken from a library because the zip container is
+ * small and completely specified, while every candidate library wants to read
+ * from or write to the filesystem. The tests extract each archive with an
+ * independent implementation and compare the bytes, so this is checked against
+ * a real reader rather than against its own assumptions.
+ *
+ * Deliberately NOT implemented: zip64. An archive over 4 GiB, a member over
+ * 4 GiB, or more than 65,535 members is refused with a clear error rather than
+ * written as something an extractor would mis-read. A store that large wants
+ * streaming and zip64 together, which is its own piece of work.
+ */
+/** One file to put in the archive. */
+export type ZipEntry = {
+    /** Path inside the archive, `/`-separated, no leading slash. */
+    path: string;
+    bytes: Buffer;
+    /** Defaults to now. Zip stores 2-second resolution, and nothing before 1980. */
+    mtime?: Date;
+};
+export declare function crc32(buf: Buffer): number;
+/**
+ * A zip archive of the given entries, as one Buffer.
+ *
+ * Entries are deflated when that makes them smaller — markdown compresses well,
+ * and a phone on mobile data is the expected destination — and stored as-is
+ * when it does not, which is the usual outcome for photos and other media.
+ */
+export declare function packZip(entries: readonly ZipEntry[]): Promise<Buffer>;
+/** Limits on what `readZip` will unpack, so an upload cannot exhaust memory. */
+export type ZipReadLimits = {
+    /** Most members accepted. */
+    maxEntries: number;
+    /** Most bytes accepted once everything is inflated. */
+    maxTotalBytes: number;
+};
+/**
+ * The files in a zip archive, as bytes in memory (#1472).
+ *
+ * Read from the central directory, which is the archive's own table of
+ * contents, so a member written with a data descriptor — what a streaming
+ * writer, or an OS re-zipping a folder, produces — is read the same as any
+ * other. Directory entries are dropped, and so is what macOS adds when it
+ * zips a folder (`__MACOSX/`, `.DS_Store`): they are not anyone's data.
+ *
+ * Refused, with an error naming why, rather than read as something else:
+ *
+ *   - a path that would climb out of wherever it is extracted — absolute, or
+ *     holding a `..` segment, with `\` read as the separator it is on Windows;
+ *   - encryption, zip64, split archives, and any method but stored and deflate;
+ *   - a member whose inflated bytes do not match the size or CRC the archive
+ *     declares for it;
+ *   - more members, or more inflated bytes, than `limits` allow. Inflating is
+ *     capped per member at what is left of the budget, so a small archive
+ *     that expands enormously stops at the budget, not at the machine's memory.
+ */
+export declare function readZip(archive: Buffer, limits: ZipReadLimits): ZipEntry[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilleke/ngdpbase-types",
-  "version": "5.26.0",
+  "version": "5.27.0",
   "description": "TypeScript types for ngdpbase add-ons, and a test kit of core's own values. A dev dependency, versioned with ngdpbase.",
   "license": "Apache-2.0",
   "author": "Jim Willeke",