@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.js

@@ -1,6 +1,7 @@
 import { classifyArchiveParserError } from "./archive-parser-errors.js";
 import { readFileSync } from "node:fs";
 import { Transform } from "node:stream";
+import { setImmediate } from "node:timers/promises";
 import { ArchiveFormatError } from "./archive-errors.js";
 // Node exposes WebAssembly without DOM globals; keep the private ABI types local.
 const wasm = globalThis.WebAssembly;
@@ -24,17 +25,14 @@ function parserError(message) {
         return mapped;
     return new ArchiveFormatError(message.replace(/^archive-header-invalid:/, "invalid TAR header:"));
 }
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export class TarParserStream extends Transform {
-    onMember;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export class TarWasmSession {
     abi;
-    constructor(limits, onMember) {
-        super();
-        this.onMember = onMember;
+    constructor(limits) {
         this.abi = instance();
         if (this.abi.init(limits.maxEntries, limits.maxMetaEntryBytes, limits.maxDecodedBytes, limits.maxManifestBytes, Number(process.platform === "win32")) !== 0) {
-            this.abi.dispose();
-            this.abi = undefined;
+            this.dispose();
             throw new RangeError("invalid TAR parser limits");
         }
     }
@@ -50,28 +48,133 @@ export class TarParserStream extends Transform {
         const abi = this.abi;
         return utf8Decoder.decode(this.bytes(abi.text_ptr(), abi.text_len()));
     }
-    _transform(chunk, _encoding, callback) {
-        try {
-            const abi = this.abi;
-            for (let offset = 0; offset < chunk.length; offset += 65536) {
-                const length = Math.min(65536, chunk.length - offset);
-                this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
-                // A member event can stop before the end of this already-copied inbox.
-                for (let consumed = 0; consumed < length;) {
-                    const used = abi.push(consumed, length - consumed);
-                    if (used < 0)
-                        throw parserError(this.text());
-                    if (used === 0 || used > length - consumed)
-                        throw new ArchiveFormatError("TAR WASM made no progress");
-                    consumed += used;
-                    const type = abi.member_type();
-                    if (type >= 0)
-                        this.onMember?.({
-                            path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
-                            mode: abi.member_mode(), offset: abi.member_offset(),
-                        });
+    parse(chunk, onMember) {
+        const abi = this.abi;
+        for (let offset = 0; offset < chunk.length; offset += 65536) {
+            const length = Math.min(65536, chunk.length - offset);
+            this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
+            // A member event can stop before the end of this already-copied inbox.
+            for (let consumed = 0; consumed < length;) {
+                const used = abi.push(consumed, length - consumed);
+                if (used < 0)
+                    throw parserError(this.text());
+                if (used === 0 || used > length - consumed)
+                    throw new ArchiveFormatError("TAR WASM made no progress");
+                consumed += used;
+                const type = abi.member_type();
+                if (type >= 0)
+                    onMember?.({
+                        path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
+                        mode: abi.member_mode(), offset: abi.member_offset(),
+                    });
+            }
+        }
+    }
+    finish() {
+        if (this.abi.finish() !== 0)
+            throw parserError(this.text());
+    }
+    codecError() {
+        const abi = this.abi;
+        return new ArchiveFormatError(utf8Decoder.decode(this.bytes(abi.codec_error_ptr(), abi.codec_error_len())));
+    }
+    async *decode(source, kind, signal) {
+        const abi = this.abi;
+        signal?.throwIfAborted();
+        if (abi.codec_init(kind === "tar-bzip2" ? 1 : 2) !== 0)
+            throw this.codecError();
+        let work = 0;
+        let calls = 0;
+        let unconsumedBoundary = false;
+        const step = (input) => {
+            signal?.throwIfAborted();
+            this.bytes(abi.codec_input_ptr(), input.length).set(input);
+            const result = abi.codec_push(input.length);
+            if (result < 0)
+                throw this.codecError();
+            const consumed = abi.codec_consumed(), produced = abi.codec_produced();
+            if (!Number.isInteger(consumed) || consumed < 0 || consumed > input.length ||
+                !Number.isInteger(produced) || produced < 0 || produced > 65536 ||
+                (result !== 0 && result !== 1) ||
+                (input.length > 0 && consumed === 0 && produced === 0 && (result !== 1 || unconsumedBoundary))) {
+                throw new ArchiveFormatError("compressed TAR WASM made no progress");
+            }
+            if (input.length > 0)
+                unconsumedBoundary = consumed === 0 && produced === 0;
+            work += consumed + produced;
+            calls++;
+            // The parser can grow this same memory, and the next codec call reuses it.
+            return { consumed, output: produced ? Buffer.from(this.bytes(abi.codec_output_ptr(), produced)) : undefined };
+        };
+        const empty = Buffer.alloc(0);
+        // Yield even for output-free skippable frames and arbitrarily small members.
+        const yieldIfNeeded = async () => {
+            if (work >= 256 * 1024 || calls >= 32) {
+                work = 0;
+                calls = 0;
+                await setImmediate(undefined, { signal });
+            }
+            signal?.throwIfAborted();
+        };
+        for await (const chunk of source) {
+            for (let offset = 0; offset < chunk.length;) {
+                const { consumed, output } = step(chunk.subarray(offset, offset + 65536));
+                offset += consumed;
+                if (output)
+                    yield output;
+                await yieldIfNeeded();
+                // A full output window can leave more decoded bytes with no new input.
+                if (output) {
+                    for (;;) {
+                        const drained = step(empty);
+                        if (drained.output)
+                            yield drained.output;
+                        await yieldIfNeeded();
+                        if (!drained.output)
+                            break;
+                    }
                 }
             }
+        }
+        // Physical EOF, rather than a selected range or TAR EOF, ends the decoder.
+        for (;;) {
+            const drained = step(empty);
+            if (drained.output)
+                yield drained.output;
+            await yieldIfNeeded();
+            if (!drained.output)
+                break;
+        }
+        if (abi.codec_finish() !== 0)
+            throw this.codecError();
+    }
+    dispose() {
+        const abi = this.abi;
+        this.abi = undefined;
+        if (abi) {
+            try {
+                abi.codec_dispose();
+            }
+            finally {
+                abi.dispose();
+            }
+        }
+    }
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export class TarParserStream extends Transform {
+    onMember;
+    session;
+    ownsSession;
+    constructor(limits, onMember, session) {
+        super();
+        this.onMember = onMember;
+        this.session = session ?? new TarWasmSession(limits);
+        this.ownsSession = session === undefined;
+    }
+    _transform(chunk, _encoding, callback) {
+        try {
+            this.session.parse(chunk, this.onMember);
             callback(null, chunk);
         }
         catch (error) {
@@ -80,8 +183,7 @@ export class TarParserStream extends Transform {
     }
     _flush(callback) {
         try {
-            if (this.abi.finish() !== 0)
-                throw parserError(this.text());
+            this.session.finish();
             callback();
         }
         catch (error) {
@@ -90,14 +192,12 @@ export class TarParserStream extends Transform {
     }
     _destroy(error, callback) {
         try {
-            this.abi?.dispose();
+            if (this.ownsSession)
+                this.session.dispose();
         }
         catch (cause) {
             error ??= cause instanceof Error ? cause : new Error(String(cause));
         }
-        finally {
-            this.abi = undefined;
-        }
         callback(error);
     }
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.d.ts

@@ -5,4 +5,3 @@ import { type ZipDirectoryEntry } from "./archive-zip-directory.js";
 export declare function admitZipBuffer(input: Uint8Array, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): number;
 /** The extraction input is private and immutable; read bounded metadata windows. */
 export declare function admitZipFile(archivePath: string, limits: ResolvedArchiveExtractLimits, deadline: ExtractionDeadline, onEntry?: (entry: ZipDirectoryEntry) => void): Promise<number>;
-//# sourceMappingURL=archive-zip-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.d.ts

@@ -1,2 +1 @@
 export declare function readZipCentralDirectoryEntryCount(buffer: Buffer | Uint8Array): number | null;
-//# sourceMappingURL=archive-zip-count.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.js

@@ -1,5 +1,6 @@
 // Conservative public count hint; strict admission must not rely on its fallback.
 const ZIP_EOCD_SIGNATURE = 0x06054b50;
+const ZIP_EOCD_SIGNATURE_BYTES = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
 const ZIP64_EOCD_SIGNATURE = 0x06064b50;
 const ZIP64_EOCD_LOCATOR_SIGNATURE = 0x07064b50;
 const ZIP_EOCD_MIN_BYTES = 22;
@@ -38,7 +39,26 @@ function findZipEndOfCentralDirectory(buffer) {
         return -1;
     }
     const minOffset = Math.max(0, buffer.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_EOCD_MAX_COMMENT_BYTES);
-    for (let offset = buffer.byteLength - ZIP_EOCD_MIN_BYTES; offset >= minOffset; offset -= 1) {
+    const lastOffset = buffer.byteLength - ZIP_EOCD_MIN_BYTES;
+    if (buffer.readUInt32LE(lastOffset) === ZIP_EOCD_SIGNATURE &&
+        buffer.readUInt16LE(lastOffset + ZIP_EOCD_COMMENT_LENGTH_OFFSET) === 0) {
+        return lastOffset;
+    }
+    const tail = buffer.subarray(minOffset);
+    let from = lastOffset - minOffset - 1;
+    // Keep the latest valid record semantics of this count hint. Bound native
+    // searches so dense false signatures retain the byte scan's cost.
+    for (let candidates = 0; candidates < 16 && from >= 0; candidates += 1) {
+        const found = tail.lastIndexOf(ZIP_EOCD_SIGNATURE_BYTES, from);
+        if (found < 0)
+            return -1;
+        const offset = minOffset + found;
+        const commentLength = buffer.readUInt16LE(offset + ZIP_EOCD_COMMENT_LENGTH_OFFSET);
+        if (offset + ZIP_EOCD_MIN_BYTES + commentLength === buffer.byteLength)
+            return offset;
+        from = found - 1;
+    }
+    for (let offset = minOffset + from; offset >= minOffset; offset -= 1) {
         if (buffer.readUInt32LE(offset) !== ZIP_EOCD_SIGNATURE) {
             continue;
         }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.d.ts

@@ -1,5 +1,5 @@
 import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
-import type { ArchiveEntryKind } from "./archive-policy.js";
+import type { ArchiveEntryKind } from "./archive-plan.js";
 export type ZipRead = {
     offset: number;
     length: number;
@@ -10,9 +10,12 @@ export type ZipDirectoryEntry = {
     creatorSystem: number;
     externalAttributes: number;
     size: number;
+    compressedSize: number;
+    compressionMethod: number;
+    crc32: number;
     path?: string;
     portableKey: string;
+    portableDirectory: boolean;
     kind: ArchiveEntryKind;
 };
 export declare function scanZipDirectory(size: number, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): ZipScan;
-//# sourceMappingURL=archive-zip-directory.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.js

@@ -1,5 +1,6 @@
 import { assertArchiveEntryCountWithinLimit, } from "./archive-limits.js";
 import { admitZipNames, zipExtraFields, zipFormat, zipUInt64 } from "./archive-zip-names.js";
+import { createArchiveOutputPathTracker } from "./archive-entry.js";
 function entryKind(attributes, directory) {
     const type = (attributes >>> 16) & 0o170000;
     // High-word symlinks remain links regardless of the creator or directory bits.
@@ -19,7 +20,8 @@ function* read(offset, length, bound) {
         zipFormat("truncated record");
     return bytes;
 }
-function endOffset(tail) {
+const END_SIGNATURE = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+function denseEndOffset(tail) {
     let found = -1;
     for (let offset = tail.length - 22; offset >= 0; offset--) {
         if (tail.readUInt32LE(offset) === 0x06054b50 && offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
@@ -32,6 +34,27 @@ function endOffset(tail) {
         zipFormat("end record missing");
     return found;
 }
+function endOffset(tail) {
+    let found = -1;
+    let from = 0;
+    // Sparse signatures use native search; dense attacker-controlled markers
+    // retain the bounded byte scan instead of one native call per marker.
+    for (let candidates = 0; candidates < 16; candidates++) {
+        const offset = tail.indexOf(END_SIGNATURE, from);
+        if (offset < 0 || offset > tail.length - 22) {
+            if (found < 0)
+                zipFormat("end record missing");
+            return found;
+        }
+        if (offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
+            if (found !== -1)
+                zipFormat("ambiguous end records");
+            found = offset;
+        }
+        from = offset + 1;
+    }
+    return denseEndOffset(tail);
+}
 function* zip64End(locator, locatorAt, size) {
     const advertised = zipUInt64(locator, 8);
     // Seek the advertised record, or the fixed ordinary record for a prefixed
@@ -164,6 +187,7 @@ export function* scanZipDirectory(size, limits, onEntry) {
     const directory = yield* layout(size);
     assertArchiveEntryCountWithinLimit(directory.count, limits);
     const seen = new Set();
+    const trackKnownPath = createArchiveOutputPathTracker();
     const spans = [];
     let at = directory.start;
     let count = 0;
@@ -204,6 +228,8 @@ export function* scanZipDirectory(size, limits, onEntry) {
         const localNames = yield* read(localAt + 30, localNameLength + localExtraLength, directory.start);
         const localExtra = zipExtraFields(localNames.subarray(localNameLength));
         const admittedName = admitZipNames({ central: centralName, local: localNames.subarray(0, localNameLength), flags, centralExtra, localExtra, seen });
+        if (admittedName.path !== undefined)
+            trackKnownPath(admittedName.path, admittedName.path);
         const localValues = wideValues(local, localExtra, false);
         const crc = central.readUInt32LE(16);
         if (!(flags & 8) && (local.readUInt32LE(14) !== crc || localValues.compressed !== values.compressed || localValues.uncompressed !== values.uncompressed)) {
@@ -224,6 +250,8 @@ export function* scanZipDirectory(size, limits, onEntry) {
         onEntry?.({
             index: count - 1, creatorSystem: central[5], externalAttributes: central.readUInt32LE(38),
             size: values.uncompressed, path: admittedName.path, portableKey: admittedName.portableKey,
+            compressedSize: values.compressed, compressionMethod: central.readUInt16LE(10), crc32: crc,
+            portableDirectory: admittedName.portableDirectory,
             kind: entryKind(central.readUInt32LE(38), admittedName.directory),
         });
         at = next;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.d.ts

@@ -1,8 +1,10 @@
-import { type ArchiveEntryModePolicy } from "./archive-policy.js";
+import type { ArchiveEntryKind } from "./archive-plan.js";
+import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
 export type ZipEntry = {
     name: string;
     dir: boolean;
     unixPermissions?: number | null;
+    dosPermissions?: number | null;
     _data?: {
         crc32?: number;
         uncompressedSize?: number;
@@ -10,12 +12,13 @@ export type ZipEntry = {
     nodeStream?: () => NodeJS.ReadableStream;
     async: (type: "nodebuffer") => Promise<Buffer>;
 };
-export declare function zipEntryIntegrityMetadata(entry: ZipEntry): {
-    crc32?: number;
-    uncompressedSize?: number;
-} | undefined;
-export declare function hasDeferredEmptyZipData(entry: ZipEntry): boolean;
-export declare function isZipSymlinkEntry(entry: ZipEntry): boolean;
-export declare function zipEntryMode(entry: ZipEntry, policy: ArchiveEntryModePolicy | undefined): number;
-export declare function zipEntryDeclaredSize(entry: ZipEntry): number;
-//# sourceMappingURL=archive-zip-entry.d.ts.map
+export type AdmittedZipEntry = Readonly<{
+    entry: ZipEntry;
+    name: string;
+    kind: ArchiveEntryKind;
+    mode: number | undefined;
+    size: number;
+    crc32: number;
+}>;
+/** Internal: create only after the complete decoder/admission association. */
+export declare function createAdmittedZipEntry(entry: ZipEntry, name: string, physical: ZipDirectoryEntry): AdmittedZipEntry;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.js

@@ -1,27 +1,10 @@
-import { resolveArchiveEntryMode, } from "./archive-policy.js";
-export function zipEntryIntegrityMetadata(entry) {
-    const data = entry._data;
-    if (!data || "then" in data)
-        return undefined;
-    return data;
-}
-export function hasDeferredEmptyZipData(entry) {
-    const data = entry._data;
-    return Boolean(data && "then" in data);
-}
-const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
-const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
-export function isZipSymlinkEntry(entry) {
-    return (typeof entry.unixPermissions === "number" &&
-        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE);
-}
-export function zipEntryMode(entry, policy) {
-    return resolveArchiveEntryMode({
-        kind: entry.dir ? "directory" : "file",
-        archivedMode: entry.unixPermissions,
-        policy,
-    });
-}
-export function zipEntryDeclaredSize(entry) {
-    return Math.max(0, Math.floor(zipEntryIntegrityMetadata(entry)?.uncompressedSize ?? 0));
+/** Internal: create only after the complete decoder/admission association. */
+export function createAdmittedZipEntry(entry, name, physical) {
+    const mode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : undefined;
+    entry.dir = physical.kind === "directory";
+    // Previously unsupported non-UNIX symlinks must also be recognizable to
+    // public preflight consumers using JSZip's conventional type inspection.
+    entry.unixPermissions = mode ?? (physical.kind === "symlink" ? 0o120000 : null);
+    entry.dosPermissions = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
+    return { entry, name, kind: physical.kind, mode, size: physical.size, crc32: physical.crc32 };
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.d.ts

@@ -1,5 +1,4 @@
 import { Transform } from "node:stream";
-import { type ZipEntry } from "./archive-zip-entry.js";
+import type { AdmittedZipEntry } from "./archive-zip-entry.js";
 export declare function normalizeZipIntegrityError(error: unknown): Error;
-export declare function createZipIntegrityTransform(entry: ZipEntry): Transform;
-//# sourceMappingURL=archive-zip-integrity.d.ts.map
+export declare function createZipIntegrityTransform(record: AdmittedZipEntry): Transform;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.js

@@ -1,6 +1,5 @@
 import { Transform } from "node:stream";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { hasDeferredEmptyZipData, zipEntryIntegrityMetadata, } from "./archive-zip-entry.js";
 import { updateCrc32 } from "./archive-crc32.js";
 export function normalizeZipIntegrityError(error) {
     if (error instanceof Error &&
@@ -9,18 +8,8 @@ export function normalizeZipIntegrityError(error) {
     }
     return error instanceof Error ? error : new Error(String(error));
 }
-export function createZipIntegrityTransform(entry) {
-    const metadata = zipEntryIntegrityMetadata(entry);
-    const deferredEmpty = hasDeferredEmptyZipData(entry);
-    const expectedCrc32 = deferredEmpty ? 0 : metadata?.crc32;
-    const expectedSize = deferredEmpty ? 0 : metadata?.uncompressedSize;
-    if (typeof expectedCrc32 !== "number" ||
-        !Number.isInteger(expectedCrc32) ||
-        typeof expectedSize !== "number" ||
-        !Number.isSafeInteger(expectedSize) ||
-        expectedSize < 0) {
-        throw new ArchiveFormatError(`zip entry has invalid integrity metadata: ${entry.name}`);
-    }
+export function createZipIntegrityTransform(record) {
+    const { entry, crc32: expectedCrc32, size: expectedSize } = record;
     let actualCrc32 = 0;
     let actualSize = 0;
     return new Transform({

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.d.ts

@@ -1,7 +1,12 @@
 import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
+import { type AdmittedZipEntry } from "./archive-zip-entry.js";
 export type ZipArchiveWithFiles = {
     files: Record<string, unknown>;
 };
+export type ZipArchiveAdmission = {
+    archive: ZipArchiveWithFiles;
+    entries: ReadonlyMap<string, AdmittedZipEntry>;
+};
+export declare function assertZipEntryBinding(archive: ZipArchiveWithFiles, record: AdmittedZipEntry, path: string): void;
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
-export declare function loadAdmittedZipArchive(buffer: Buffer | Uint8Array, admitted: ZipDirectoryEntry[]): Promise<ZipArchiveWithFiles>;
-//# sourceMappingURL=archive-zip-loader.d.ts.map
+export declare function loadAdmittedZipArchive(buffer: Buffer | Uint8Array, admitted: ZipDirectoryEntry[]): Promise<ZipArchiveAdmission>;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.js

@@ -1,57 +1,143 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
-import { validateArchiveEntryPath } from "./archive-entry.js";
-import { isZipSymlinkEntry } from "./archive-zip-entry.js";
+import { createArchiveOutputPathTracker, validateArchiveEntryPath } from "./archive-entry.js";
+import { createAdmittedZipEntry } from "./archive-zip-entry.js";
 import { zipPathKey } from "./archive-zip-names.js";
+export function assertZipEntryBinding(archive, record, path) {
+    const { entry } = record;
+    const name = entry.name;
+    validateArchiveEntryPath(name, { escapeLabel: "archive root" });
+    if (archive.files[record.name] !== entry || zipPathKey(name) !== path)
+        disagreement();
+}
+function disagreement() {
+    throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+}
+function collision() {
+    throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
+}
+function matchesData(value, physical) {
+    if (!value || typeof value !== "object")
+        return false;
+    const data = value;
+    return Number.isInteger(data.crc32) && data.crc32 >= -0x80000000 && data.crc32 <= 0xffffffff &&
+        (data.crc32 >>> 0) === physical.crc32 && data.uncompressedSize === physical.size &&
+        data.compressedSize === physical.compressedSize && typeof data.getContentWorker === "function" &&
+        data.compression?.magic === String.fromCharCode(physical.compressionMethod & 255, physical.compressionMethod >>> 8);
+}
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
 export async function loadAdmittedZipArchive(buffer, admitted) {
+    const physicalByPath = new Map();
+    const trackOutputPath = createArchiveOutputPathTracker();
+    for (const entry of admitted) {
+        trackOutputPath(entry.portableKey, entry.portableKey);
+        if (physicalByPath.has(entry.portableKey))
+            collision();
+        physicalByPath.set(entry.portableKey, entry);
+    }
     const JSZip = await importOptionalJsZip();
-    let archive;
+    const archive = new JSZip();
+    const originalFile = archive.file;
+    const originalDescriptor = Object.getOwnPropertyDescriptor(archive, "file");
+    const inserted = new Map();
+    const remaining = new Map(physicalByPath);
+    // JSZip's fileAdd can misclassify UNIX type bits as directories, rename an
+    // entry, and erase its payload. Intercept only this private instance's load.
+    Object.defineProperty(archive, "file", { configurable: true, writable: true,
+        value: function (...args) {
+            if (args.length === 1)
+                return originalFile.apply(this, args);
+            const [name, data, options] = args;
+            if (this !== archive || args.length !== 3 || typeof name !== "string" || !options || typeof options !== "object")
+                disagreement();
+            validateArchiveEntryPath(name);
+            const key = zipPathKey(name);
+            const physical = remaining.get(key);
+            if (!physical) {
+                if (physicalByPath.has(key))
+                    collision();
+                disagreement();
+            }
+            const fields = options;
+            const unixMode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : null;
+            const dosMode = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
+            const decoderDirectory = Boolean(physical.externalAttributes & 0x10) || physical.portableDirectory;
+            if (physical.index !== inserted.size || fields.unixPermissions !== unixMode || fields.dosPermissions !== dosMode ||
+                fields.dir !== decoderDirectory || !matchesData(data, physical))
+                disagreement();
+            const result = originalFile.call(this, name, data, {
+                ...fields, dir: false, unixPermissions: null, dosPermissions: null, createFolders: false,
+            });
+            const entry = archive.files[name];
+            if (!entry || typeof entry !== "object" || inserted.has(entry))
+                disagreement();
+            // fileAdd also substitutes an empty promise for declared-zero contents.
+            // Retain the original decoder object so size/CRC checks still read bytes.
+            entry._data = data;
+            inserted.set(entry, { physical, data });
+            remaining.delete(key);
+            return result;
+        },
+    });
     try {
-        archive = await JSZip.loadAsync(buffer);
+        const loaded = await archive.loadAsync(buffer, { createFolders: false });
+        if (loaded !== archive)
+            disagreement();
     }
     catch (error) {
+        if (error instanceof ArchiveFormatError || error instanceof ArchiveSecurityError)
+            throw error;
         throw new ArchiveFormatError(`invalid ZIP archive: ${error instanceof Error ? error.message : String(error)}`, { cause: error instanceof Error ? error : undefined });
     }
-    const names = Object.keys(archive.files);
-    if (names.length !== admitted.length) {
-        throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
-    }
-    // Object key order is not central-directory order (numeric names reorder).
-    // Use the admitted portable interpretation, including legacy UTF-8 decoding.
-    const physicalByPath = new Map();
-    for (const entry of admitted) {
-        physicalByPath.set(entry.portableKey, entry);
+    finally {
+        if (originalDescriptor)
+            Object.defineProperty(archive, "file", originalDescriptor);
+        else
+            Reflect.deleteProperty(archive, "file");
     }
+    const names = Object.keys(archive.files);
+    if (names.length !== admitted.length)
+        collision();
+    const normalized = [];
     for (const name of names) {
         validateArchiveEntryPath(name);
-        const key = zipPathKey(name);
-        const physical = physicalByPath.get(key);
         const entry = archive.files[name];
-        const entryName = entry.name;
-        let entryKey = key;
-        if (entryName !== name) {
-            validateArchiveEntryPath(entryName);
-            entryKey = zipPathKey(entryName);
-        }
-        const kind = isZipSymlinkEntry(entry) ? "symlink" : entry.dir ? "directory" : "file";
-        if (!physical || entryKey !== key || kind !== physical.kind) {
-            throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
-        }
-        physicalByPath.delete(key);
+        if (!entry || typeof entry.name !== "string")
+            disagreement();
+        validateArchiveEntryPath(entry.name);
+        const insertion = inserted.get(entry);
+        if (!insertion || zipPathKey(name) !== insertion.physical.portableKey || zipPathKey(entry.name) !== insertion.physical.portableKey ||
+            entry.dir !== false || entry.unixPermissions !== null || entry.dosPermissions !== null ||
+            entry._data !== insertion.data || !matchesData(entry._data, insertion.physical))
+            disagreement();
+        normalized[insertion.physical.index] = [name, entry, insertion.physical];
+        inserted.delete(entry);
     }
-    if (physicalByPath.size) {
-        throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+    if (remaining.size || inserted.size)
+        disagreement();
+    const files = Object.create(null);
+    const entries = new Map();
+    for (const [name, entry, physical] of normalized) {
+        const appendSlash = physical.kind === "directory" && !name.endsWith("/");
+        const normalizedName = appendSlash ? `${name}/` : name;
+        if (Object.hasOwn(files, normalizedName))
+            collision();
+        if (appendSlash) {
+            entry.name = `${entry.name}/`;
+        }
+        files[normalizedName] = entry;
+        entries.set(physical.portableKey, createAdmittedZipEntry(entry, normalizedName, physical));
     }
-    return archive;
+    archive.files = files;
+    return { archive, entries };
 }
 async function importOptionalJsZip() {
     try {
         const module = await import("jszip");
         const candidate = typeof module === "function" ? module : module.default;
-        if ((typeof candidate !== "object" && typeof candidate !== "function") ||
-            candidate === null ||
-            typeof candidate.loadAsync !== "function") {
-            throw new Error('Optional archive dependency "jszip" does not expose loadAsync().');
+        if (typeof candidate !== "function" ||
+            typeof candidate.prototype?.file !== "function" ||
+            typeof candidate.prototype?.loadAsync !== "function") {
+            throw new Error('Optional archive dependency "jszip" does not expose its constructor, file(), and loadAsync().');
         }
         return candidate;
     }