@openclaw/fs-safe 0.5.1 → 0.5.3

package/dist/archive-read.js

@@ -2,14 +2,16 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { Readable } from "node:stream";
 import { readFileHandleBounded } from "./bounded-read.js";
-import { ArchiveFormatError } from "./archive-errors.js";
+import { ArchiveFormatError, ArchiveSecurityError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
+import { formatErrorDetail } from "./error-detail.js";
 import { normalizeArchiveEntryPath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { resolveArchiveKind } from "./archive-kind.js";
 import { DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_META_ENTRY_BYTES, ArchiveLimitError, ARCHIVE_LIMIT_ERROR_CODE, } from "./archive-limits.js";
 import { readTarEntryInfo } from "./archive-tar.js";
 import { preflightTarMetadata } from "./archive-tar-meta.js";
-import { importOptionalTar } from "./archive-tar-runtime.js";
+import { importOptionalTar, normalizeTarParserError } from "./archive-tar-runtime.js";
 import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
+import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { getNativeBinding } from "./native.js";
@@ -20,7 +22,7 @@ function normalizedRequestedEntry(entryPath) {
     validateArchiveEntryPath(entryPath, { escapeLabel: "archive root" });
     const normalized = normalizeArchiveEntryPath(entryPath).replace(/^\.\//, "");
     if (!normalized || normalized.endsWith("/")) {
-        throw new Error(`archive entry is not a file: ${entryPath}`);
+        throw new Error(`archive entry is not a file: ${formatErrorDetail(entryPath)}`);
     }
     return normalized;
 }
@@ -96,16 +98,18 @@ async function readZipEntry(buffer, entryPath, maxBytes) {
     });
     const entry = archive.files[entryPath];
     if (!entry || entry.dir) {
-        throw new Error(`archive entry not found: ${entryPath}`);
+        throw new Error(`archive entry not found: ${formatErrorDetail(entryPath)}`);
     }
     if (typeof entry.unixPermissions === "number" &&
         (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE) {
-        throw new Error(`archive entry is a link: ${entryPath}`);
+        throw new Error(`archive entry is a link: ${formatErrorDetail(entryPath)}`);
     }
     const stream = typeof entry.nodeStream === "function"
         ? entry.nodeStream()
         : Readable.from(await entry.async("nodebuffer"));
-    return await readStreamBounded(stream, maxBytes);
+    const integrity = createZipIntegrityTransform(entry);
+    stream.once("error", (error) => integrity.destroy(normalizeZipIntegrityError(error)));
+    return await readStreamBounded(stream.pipe(integrity), maxBytes);
 }
 async function readTarEntry(archivePath, entryPath, maxBytes) {
     const tar = await importOptionalTar();
@@ -114,33 +118,49 @@ async function readTarEntry(archivePath, entryPath, maxBytes) {
         maxMetaEntryBytes: DEFAULT_MAX_META_ENTRY_BYTES,
     });
     let matched;
-    await tar.t({
-        file: archivePath,
-        strict: true,
-        maxMetaEntrySize: DEFAULT_MAX_META_ENTRY_BYTES,
-        onReadEntry(entry) {
-            const info = readTarEntryInfo(entry);
-            validateArchiveEntryPath(info.path, { escapeLabel: "archive root" });
-            const normalized = normalizeArchiveEntryPath(info.path).replace(/^\.\//, "");
-            if (normalized !== entryPath) {
-                entry.resume();
-                return;
-            }
-            if (info.type !== "File" && info.type !== "OldFile" && info.type !== "ContiguousFile") {
-                matched = Promise.reject(new Error(`archive entry is not a file: ${entryPath}`));
-                entry.resume();
-                return;
-            }
-            if (info.size > maxBytes) {
-                matched = Promise.reject(new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT));
-                entry.resume();
-                return;
-            }
-            matched = readStreamBounded(entry, maxBytes);
-        },
-    });
+    let entryError;
+    const seenPaths = new Set();
+    try {
+        await tar.t({
+            file: archivePath,
+            strict: true,
+            maxMetaEntrySize: DEFAULT_MAX_META_ENTRY_BYTES,
+            onReadEntry(entry) {
+                const info = readTarEntryInfo(entry);
+                validateArchiveEntryPath(info.path, { escapeLabel: "archive root" });
+                const normalized = normalizeArchiveEntryPath(info.path).replace(/^\.\//, "");
+                if (seenPaths.has(normalized)) {
+                    entryError ??= new ArchiveSecurityError("entry-path", `archive contains duplicate entry path: ${formatErrorDetail(normalized)}`);
+                    entry.resume();
+                    return;
+                }
+                seenPaths.add(normalized);
+                if (normalized !== entryPath) {
+                    entry.resume();
+                    return;
+                }
+                if (info.type !== "File" && info.type !== "OldFile" && info.type !== "ContiguousFile") {
+                    entryError ??= new Error(`archive entry is not a file: ${formatErrorDetail(entryPath)}`);
+                    entry.resume();
+                    return;
+                }
+                if (info.size > maxBytes) {
+                    entryError ??= new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
+                    entry.resume();
+                    return;
+                }
+                matched = readStreamBounded(entry, maxBytes);
+            },
+        });
+    }
+    catch (error) {
+        throw normalizeTarParserError(error);
+    }
+    if (entryError) {
+        throw entryError;
+    }
     if (!matched) {
-        throw new Error(`archive entry not found: ${entryPath}`);
+        throw new Error(`archive entry not found: ${formatErrorDetail(entryPath)}`);
     }
     return await matched;
 }
@@ -161,19 +181,24 @@ export async function readArchiveEntry(archivePath, entryPath, options) {
                 const signal = new AbortController().signal;
                 const manifest = await native.inspectArchiveNative(staged.path, kind, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, signal);
                 let rawEntryPath;
+                const seenPaths = new Set();
                 for (const entry of manifest) {
                     validateArchiveEntryPath(entry.path, { escapeLabel: "archive root" });
                     const normalized = normalizeArchiveEntryPath(entry.path).replace(/^\.\//, "");
+                    if (seenPaths.has(normalized)) {
+                        throw new ArchiveSecurityError("entry-path", `archive contains duplicate entry path: ${formatErrorDetail(normalized)}`);
+                    }
+                    seenPaths.add(normalized);
                     if (normalized === requestedEntry) {
                         if (entry.kind !== "file") {
-                            throw new Error(`archive entry is not a file: ${entryPath}`);
+                            throw new Error(`archive entry is not a file: ${formatErrorDetail(entryPath)}`);
                         }
                         rawEntryPath = entry.path;
-                        break;
                     }
                 }
-                if (!rawEntryPath)
-                    throw new Error(`archive entry not found: ${entryPath}`);
+                if (!rawEntryPath) {
+                    throw new Error(`archive entry not found: ${formatErrorDetail(entryPath)}`);
+                }
                 return await native.readArchiveEntryNative(staged.path, kind, rawEntryPath, options.maxBytes, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_META_ENTRY_BYTES, signal);
             }
             catch (error) {
@@ -181,7 +206,7 @@ export async function readArchiveEntry(archivePath, entryPath, options) {
                     error.message.includes(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT)) {
                     throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
                 }
-                if (error instanceof Error && error.message.includes("archive-header-invalid")) {
+                if (error instanceof Error && isArchiveFormatErrorMessage(error.message)) {
                     throw new ArchiveFormatError(error.message, { cause: error });
                 }
                 throw error;

package/dist/archive-staging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-staging.d.ts","sourceRoot":"","sources":["../src/archive-staging.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,EAErB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAkC1F,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnF;AA4DD,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAyHD,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Bb;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFhB;AAED,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAE7F"}
+{"version":3,"file":"archive-staging.d.ts","sourceRoot":"","sources":["../src/archive-staging.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,EAErB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAkC1F,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnF;AA4DD,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAyHD,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Bb;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFhB;AAED,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAE7F"}

package/dist/archive-staging.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, } from "./directory-guard.js";
 import { ArchiveSecurityError, } from "./archive-errors.js";
 import { FsSafeError } from "./errors.js";
+import { formatErrorDetail } from "./error-detail.js";
 import { resolveOpenedFileRealPathForHandle, root } from "./root.js";
 import { isNotFoundPathError, isPathInside } from "./path.js";
 import { resolveSecureTempRoot } from "./secure-temp-dir.js";
@@ -12,7 +13,7 @@ const ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK = "archive entry traverses symlink i
 const ARCHIVE_STAGING_MODE = 0o700;
 export { ArchiveSecurityError } from "./archive-errors.js";
 function symlinkTraversalError(originalPath) {
-    return new ArchiveSecurityError("destination-symlink-traversal", `${ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK}: ${originalPath}`);
+    return new ArchiveSecurityError("destination-symlink-traversal", `${ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK}: ${formatErrorDetail(originalPath)}`);
 }
 async function createDirectoryIdentityGuard(dir) {
     try {
@@ -306,7 +307,7 @@ export async function mergeExtractedTreeIntoDestination(params) {
                 continue;
             }
             if (!sourceStat.isFile()) {
-                throw new Error(`archive staging contains unsupported entry: ${originalPath}`);
+                throw new Error(`archive staging contains unsupported entry: ${formatErrorDetail(originalPath)}`);
             }
             await prepareArchiveOutputPath({
                 destinationDir: params.destinationDir,

package/dist/archive-tar-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar-meta.d.ts","sourceRoot":"","sources":["../src/archive-tar-meta.ts"],"names":[],"mappings":"AAuIA,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"archive-tar-meta.d.ts","sourceRoot":"","sources":["../src/archive-tar-meta.ts"],"names":[],"mappings":"AAqJA,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}

package/dist/archive-tar-meta.js

@@ -19,7 +19,13 @@ class TarMetadataMeter extends Transform {
     parseSize() {
         const field = this.block.subarray(124, 136);
         if ((field[0] ?? 0) & 0x80) {
-            const value = field.readBigUInt64BE(4);
+            if (field[0] !== 0x80) {
+                throw this.invalid("base-256 size is negative or malformed");
+            }
+            let value = 0n;
+            for (const byte of field.subarray(1)) {
+                value = (value << 8n) | BigInt(byte);
+            }
             if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
                 throw this.invalid("base-256 size exceeds the safe integer range");
             }
@@ -40,6 +46,14 @@ class TarMetadataMeter extends Transform {
             this.state = { kind: "header" };
             return;
         }
+        const nameEnd = this.block.subarray(0, 100).indexOf(0);
+        const name = this.block.subarray(0, nameEnd < 0 ? 100 : nameEnd);
+        if (name.length === 0) {
+            throw this.invalid("entry path is empty");
+        }
+        if (this.block[156] !== 0x35 && name.at(-1) === 0x2f) {
+            throw this.invalid("non-directory entry path ends with a separator");
+        }
         const size = this.parseSize();
         const type = this.block[156];
         if ([0x78, 0x67, 0x4c, 0x4b, 0x58].includes(type ?? -1) && size > this.maxMetaEntryBytes) {

package/dist/archive-tar-runtime.d.ts

@@ -40,4 +40,5 @@ export type TarModule = {
     }): Promise<unknown>;
 };
 export declare function importOptionalTar(): Promise<TarModule>;
+export declare function normalizeTarParserError(error: unknown): unknown;
 //# sourceMappingURL=archive-tar-runtime.d.ts.map

package/dist/archive-tar-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar-runtime.d.ts","sourceRoot":"","sources":["../src/archive-tar-runtime.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,GAAG;IAC9C,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IAChF,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACnE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,SAAS,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,KAAK,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,CAAC;IAC/E,CAAC,CAAC,OAAO,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,aAAa,EAAE,KAAK,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QACrE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;KAClD,GAAG,SAAS,CAAC;IACd,CAAC,CAAC,OAAO,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;KACvE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC;AAEF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAS5D"}
+{"version":3,"file":"archive-tar-runtime.d.ts","sourceRoot":"","sources":["../src/archive-tar-runtime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,GAAG;IAC9C,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IAChF,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACnE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,SAAS,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,KAAK,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,CAAC;IAC/E,CAAC,CAAC,OAAO,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,aAAa,EAAE,KAAK,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QACrE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;KAClD,GAAG,SAAS,CAAC;IACd,CAAC,CAAC,OAAO,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;KACvE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC;AAEF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAS5D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS/D"}

package/dist/archive-tar-runtime.js

@@ -1,3 +1,4 @@
+import { ArchiveFormatError } from "./archive-errors.js";
 export async function importOptionalTar() {
     try {
         return await import("tar");
@@ -6,3 +7,13 @@ export async function importOptionalTar() {
         throw new Error('Optional archive dependency "tar" is not installed. Install it to use TAR archive helpers from @openclaw/fs-safe/archive.', { cause });
     }
 }
+export function normalizeTarParserError(error) {
+    const code = error?.code;
+    if (typeof code !== "string" || !code.startsWith("TAR_")) {
+        return error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return new ArchiveFormatError(`invalid TAR archive: ${message}`, {
+        cause: error instanceof Error ? error : undefined,
+    });
+}

package/dist/archive-tar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar.d.ts","sourceRoot":"","sources":["../src/archive-tar.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAyB7D;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CA2CnC"}
+{"version":3,"file":"archive-tar.d.ts","sourceRoot":"","sources":["../src/archive-tar.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAI7B,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAyB7D;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAgDnC"}

package/dist/archive-tar.js

@@ -1,7 +1,8 @@
-import { resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
+import { createArchiveOutputPathTracker, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, resolveExtractLimits, } from "./archive-limits.js";
 import { archiveEntryKindFromTarType, shouldExtractArchiveEntry, } from "./archive-policy.js";
 import { ArchiveSecurityError } from "./archive-errors.js";
+import { formatErrorDetail } from "./error-detail.js";
 const BLOCKED_TAR_ENTRY_TYPES = new Set([
     "SymbolicLink",
     "Link",
@@ -37,7 +38,10 @@ export function createTarEntryPreflightChecker(params) {
     const limits = resolveExtractLimits(params.limits);
     let entryCount = 0;
     const budget = createByteBudgetTracker(limits);
+    const trackOutputPath = createArchiveOutputPathTracker();
     return (entry) => {
+        entryCount += 1;
+        assertArchiveEntryCountWithinLimit(entryCount, limits);
         validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
         const relPath = stripArchivePath(entry.path, strip);
         if (!relPath) {
@@ -45,14 +49,13 @@ export function createTarEntryPreflightChecker(params) {
         }
         validateArchiveEntryPath(relPath, { escapeLabel: params.escapeLabel });
         assertArchiveEntryPathComponentsWithinLimit(relPath, limits);
+        trackOutputPath(relPath, entry.path);
         resolveArchiveOutputPath({
             rootDir: params.rootDir,
             relPath,
             originalPath: entry.path,
             escapeLabel: params.escapeLabel,
         });
-        entryCount += 1;
-        assertArchiveEntryCountWithinLimit(entryCount, limits);
         const kind = archiveEntryKindFromTarType(entry.type);
         if (!shouldExtractArchiveEntry({
             filter: params.entryFilter,
@@ -62,8 +65,9 @@ export function createTarEntryPreflightChecker(params) {
             return false;
         }
         if (BLOCKED_TAR_ENTRY_TYPES.has(entry.type)) {
-            throw new ArchiveSecurityError("entry-link", `tar entry is a link: ${entry.path}`);
+            throw new ArchiveSecurityError("entry-link", `tar entry is a link: ${formatErrorDetail(entry.path)}`);
         }
+        budget.startEntry();
         budget.addEntrySize(entry.size);
         return true;
     };

package/dist/archive-zip-entry.d.ts

@@ -4,11 +4,17 @@ export type ZipEntry = {
     dir: boolean;
     unixPermissions?: number;
     _data?: {
+        crc32?: number;
         uncompressedSize?: number;
-    };
+    } | PromiseLike<unknown>;
     nodeStream?: () => NodeJS.ReadableStream;
     async: (type: "nodebuffer") => Promise<Buffer>;
 };
+export declare function zipEntryIntegrityMetadata(entry: ZipEntry): {
+    crc32?: number;
+    uncompressedSize?: number;
+} | undefined;
+export declare function hasDeferredEmptyZipData(entry: ZipEntry): boolean;
 export declare function isZipSymlinkEntry(entry: ZipEntry): boolean;
 export declare function zipEntryMode(entry: ZipEntry, policy: ArchiveEntryModePolicy | undefined): number;
 export declare function zipEntryDeclaredSize(entry: ZipEntry): number;

package/dist/archive-zip-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-zip-entry.d.ts","sourceRoot":"","sources":["../src/archive-zip-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,cAAc,CAAC;IACzC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAK1D;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACzC,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"archive-zip-entry.d.ts","sourceRoot":"","sources":["../src/archive-zip-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7E,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,cAAc,CAAC;IACzC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,QAAQ,GACd;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAI3D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAGhE;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAK1D;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACzC,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAE5D"}

package/dist/archive-zip-entry.js

@@ -1,4 +1,14 @@
 import { resolveArchiveEntryMode, } from "./archive-policy.js";
+export function zipEntryIntegrityMetadata(entry) {
+    const data = entry._data;
+    if (!data || "then" in data)
+        return undefined;
+    return data;
+}
+export function hasDeferredEmptyZipData(entry) {
+    const data = entry._data;
+    return Boolean(data && "then" in data);
+}
 const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
 const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
 export function isZipSymlinkEntry(entry) {
@@ -13,5 +23,5 @@ export function zipEntryMode(entry, policy) {
     });
 }
 export function zipEntryDeclaredSize(entry) {
-    return Math.max(0, Math.floor(entry._data?.uncompressedSize ?? 0));
+    return Math.max(0, Math.floor(zipEntryIntegrityMetadata(entry)?.uncompressedSize ?? 0));
 }

package/dist/archive-zip-integrity.d.ts

@@ -0,0 +1,5 @@
+import { Transform } from "node:stream";
+import { type ZipEntry } from "./archive-zip-entry.js";
+export declare function normalizeZipIntegrityError(error: unknown): Error;
+export declare function createZipIntegrityTransform(entry: ZipEntry): Transform;
+//# sourceMappingURL=archive-zip-integrity.d.ts.map

package/dist/archive-zip-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-zip-integrity.d.ts","sourceRoot":"","sources":["../src/archive-zip-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,wBAAwB,CAAC;AAkBhC,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAQhE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,CAgCtE"}

package/dist/archive-zip-integrity.js

@@ -0,0 +1,54 @@
+import { Transform } from "node:stream";
+import { ArchiveFormatError } from "./archive-errors.js";
+import { hasDeferredEmptyZipData, zipEntryIntegrityMetadata, } from "./archive-zip-entry.js";
+const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
+    let value = index;
+    for (let bit = 0; bit < 8; bit += 1) {
+        value = (value & 1) !== 0 ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
+    }
+    return value >>> 0;
+});
+function updateCrc32(previous, buffer) {
+    let crc = previous ^ -1;
+    for (const byte of buffer) {
+        crc = (crc >>> 8) ^ (CRC32_TABLE[(crc ^ byte) & 0xff] ?? 0);
+    }
+    return (crc ^ -1) >>> 0;
+}
+export function normalizeZipIntegrityError(error) {
+    if (error instanceof Error &&
+        error.message.includes("uncompressed data size mismatch")) {
+        return new ArchiveFormatError(`invalid ZIP entry data: ${error.message}`, { cause: error });
+    }
+    return error instanceof Error ? error : new Error(String(error));
+}
+export function createZipIntegrityTransform(entry) {
+    const metadata = zipEntryIntegrityMetadata(entry);
+    const deferredEmpty = hasDeferredEmptyZipData(entry);
+    const expectedCrc32 = deferredEmpty ? 0 : metadata?.crc32;
+    const expectedSize = deferredEmpty ? 0 : metadata?.uncompressedSize;
+    if (typeof expectedCrc32 !== "number" ||
+        !Number.isInteger(expectedCrc32) ||
+        typeof expectedSize !== "number" ||
+        !Number.isSafeInteger(expectedSize) ||
+        expectedSize < 0) {
+        throw new ArchiveFormatError(`zip entry has invalid integrity metadata: ${entry.name}`);
+    }
+    let actualCrc32 = 0;
+    let actualSize = 0;
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            const buffer = chunk instanceof Buffer ? chunk : Buffer.from(chunk);
+            actualCrc32 = updateCrc32(actualCrc32, buffer);
+            actualSize += buffer.byteLength;
+            callback(null, buffer);
+        },
+        flush(callback) {
+            if (actualSize !== expectedSize || actualCrc32 !== (expectedCrc32 >>> 0)) {
+                callback(new ArchiveFormatError(`zip entry integrity check failed: ${entry.name}`));
+                return;
+            }
+            callback();
+        },
+    });
+}

package/dist/archive-zip-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-zip-preflight.d.ts","sourceRoot":"","sources":["../src/archive-zip-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAiLF,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAU5F;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAW9B"}
+{"version":3,"file":"archive-zip-preflight.d.ts","sourceRoot":"","sources":["../src/archive-zip-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAiLF,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAU5F;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA0B9B"}

package/dist/archive-zip-preflight.js

@@ -1,4 +1,5 @@
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, assertArchiveEntryCountWithinLimit, resolveExtractLimits, } from "./archive-limits.js";
+import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
 const ZIP_EOCD_SIGNATURE = 0x06054b50;
 const ZIP64_EOCD_SIGNATURE = 0x06064b50;
 const ZIP64_EOCD_LOCATOR_SIGNATURE = 0x07064b50;
@@ -148,7 +149,17 @@ export async function loadZipArchiveWithPreflight(buffer, limits) {
         assertArchiveEntryCountWithinLimit(entryCount, resolvedLimits);
     }
     const JSZip = await importOptionalJsZip();
-    return await JSZip.loadAsync(buffer);
+    let archive;
+    try {
+        archive = await JSZip.loadAsync(buffer);
+    }
+    catch (error) {
+        throw new ArchiveFormatError(`invalid ZIP archive: ${error instanceof Error ? error.message : String(error)}`, { cause: error instanceof Error ? error : undefined });
+    }
+    if (entryCount !== null && Object.keys(archive.files).length !== entryCount) {
+        throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
+    }
+    return archive;
 }
 async function importOptionalJsZip() {
     try {

package/dist/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,8BAA8B,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AAiNpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiKjF"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AA6DA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,8BAA8B,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AAoNpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkKjF"}

package/dist/archive.js

@@ -3,7 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
+import { createArchiveOutputPathTracker, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { createPipelineTimeoutError, waitForDeadline, withExtractionDeadline, } from "./archive-deadline.js";
 import { assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, } from "./archive-limits.js";
 import { resolveArchiveKind } from "./archive-kind.js";
@@ -11,13 +11,14 @@ import { mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepar
 import { createTarEntryPreflightChecker, readTarEntryInfo, } from "./archive-tar.js";
 import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
 import { isZipSymlinkEntry, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
+import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { FsSafeError } from "./errors.js";
 import { ArchiveSecurityError } from "./archive-errors.js";
 import { extractNativeArchive } from "./archive-native.js";
 import { stageArchiveFileForExtraction } from "./archive-input.js";
 import { getNativeBinding } from "./native.js";
 import { resolveArchiveEntryMode, shouldExtractArchiveEntry, } from "./archive-policy.js";
-import { importOptionalTar } from "./archive-tar-runtime.js";
+import { importOptionalTar, normalizeTarParserError } from "./archive-tar-runtime.js";
 import { preflightTarMetadata } from "./archive-tar-meta.js";
 import { writeSiblingTempFile } from "./sibling-temp.js";
 export { isWindowsDrivePath, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
@@ -81,10 +82,10 @@ async function writeZipFileEntry(params) {
                     handleClosedByStream = true;
                 });
                 try {
-                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), writable, { signal: params.deadline.signal });
+                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), createZipIntegrityTransform(params.entry), writable, { signal: params.deadline.signal });
                 }
                 catch (err) {
-                    throw createPipelineTimeoutError(err, params.deadline);
+                    throw normalizeZipIntegrityError(createPipelineTimeoutError(err, params.deadline));
                 }
                 params.deadline.check();
                 if (!handleClosedByStream) {
@@ -127,6 +128,7 @@ async function extractZip(params) {
         const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
         assertArchiveEntryCountWithinLimit(entries.length, limits);
         const budget = createByteBudgetTracker(limits);
+        const trackOutputPath = createArchiveOutputPathTracker();
         await withStagedArchiveDestination({
             destinationRealDir,
             run: async (stagingDir) => {
@@ -142,6 +144,7 @@ async function extractZip(params) {
                         continue;
                     }
                     assertArchiveEntryPathComponentsWithinLimit(output.relPath, limits);
+                    trackOutputPath(output.relPath, entry.name);
                     const isSymlink = isZipSymlinkEntry(entry);
                     const entryKind = isSymlink ? "symlink" : entry.dir ? "directory" : "file";
                     const entrySize = zipEntryDeclaredSize(entry);
@@ -263,6 +266,7 @@ export async function extractArchive(params) {
                                     const info = readTarEntryInfo(entry);
                                     const accepted = checkTarEntrySafety(info);
                                     if (accepted) {
+                                        entry.path = normalizeArchiveEntryPath(info.path);
                                         const relPath = stripArchivePath(info.path, Math.max(0, Math.floor(params.stripComponents ?? 0)));
                                         if (relPath) {
                                             acceptedEntries.push({
@@ -306,7 +310,7 @@ export async function extractArchive(params) {
                             });
                         }
                         catch (error) {
-                            throw createPipelineTimeoutError(error, deadline);
+                            throw normalizeTarParserError(createPipelineTimeoutError(error, deadline));
                         }
                         for (const accepted of acceptedEntries) {
                             const outputPath = resolveArchiveOutputPath({

package/dist/bounded-read-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAkBnE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,MAAM,EAAE;QAAE,gBAAgB,IAAI,MAAM,CAAC,cAAc,CAAA;KAAE,CAAA;CAAE,EACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAAC,cAAc,CAGvB"}
+{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,aAAa,CAAC;AAGlD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAwBnE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,MAAM,EAAE;QAAE,gBAAgB,IAAI,MAAM,CAAC,cAAc,CAAA;KAAE,CAAA;CAAE,EACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAAC,cAAc,CAWvB"}

package/dist/bounded-read-stream.js

@@ -1,6 +1,10 @@
-import { Transform } from "node:stream";
+import { pipeline, Transform } from "node:stream";
 import { FsSafeError } from "./errors.js";
 export function createMaxBytesTransform(maxBytes) {
+    if (maxBytes !== Number.POSITIVE_INFINITY &&
+        (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) {
+        throw new RangeError("maxBytes must be a non-negative safe integer or Infinity");
+    }
     let bytes = 0;
     return new Transform({
         transform(chunk, _encoding, callback) {
@@ -16,5 +20,12 @@ export function createMaxBytesTransform(maxBytes) {
 }
 export function createBoundedReadStream(opened, maxBytes) {
     const stream = opened.handle.createReadStream();
-    return maxBytes === undefined ? stream : stream.pipe(createMaxBytesTransform(maxBytes));
+    if (maxBytes === undefined) {
+        return stream;
+    }
+    const bounded = createMaxBytesTransform(maxBytes);
+    // pipeline couples teardown in both directions: source failures reach the
+    // returned stream, and an early consumer close destroys the file stream.
+    pipeline(stream, bounded, () => undefined);
+    return bounded;
 }

package/dist/deny-mutations.d.ts

@@ -1,3 +1,4 @@
+export declare function resolveMutationComparablePaths(rawPath: string): Promise<Set<string>>;
 export type DenyMutationPolicy = {
     paths?: readonly string[];
     prefixes?: readonly string[];

package/dist/deny-mutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deny-mutations.d.ts","sourceRoot":"","sources":["../src/deny-mutations.ts"],"names":[],"mappings":"AAmDA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAqBF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,kBAAkB,GAAG,SAAS,EAC7C,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,kBAAkB,GAAG,SAAS,CAWhC"}
+{"version":3,"file":"deny-mutations.d.ts","sourceRoot":"","sources":["../src/deny-mutations.ts"],"names":[],"mappings":"AAKA,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAI1F;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAqBF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,kBAAkB,GAAG,SAAS,EAC7C,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,kBAAkB,GAAG,SAAS,CAWhC"}