@patrickdk77/archive-defuse 0.1.1 → 0.1.3

package/README.md

@@ -303,14 +303,34 @@ const result = JSON.parse(await zip.text('result.json'));
 
 - `name`, with "/" between folders. A name that ends in "/" is a folder.
 - `data`: bytes, text written as UTF-8, a stream such as a Node Readable, or a function that returns one of those. A function runs when the entry's turn comes, so a thousand downloads do not all open at once.
+- `size`, a file's length in bytes, for a stream whose length you know, such as a GridFS file's. Content that comes to another size fails the archive.
 - `linkTarget` for a symbolic link, `mode` for the permission bits, `mtime` for the time, and `store: true` to keep a ZIP entry uncompressed, which the `mimetype` entry of an ODF document needs.
 
-ZIP, tar and 7z need an entry's size before its data, so an entry given as a stream is read first, into memory up to `memoryThreshold` (8 MiB) and into a temporary file past it. ZIP entries are deflated at `level` 6. ZIP and 7z store an entry that compression gains nothing on, or that would compress past `ratioLimit`, 1,000 to 1 by default, so their archives read back under the default limits. A compressed tar and the output of `compress` have no stored form. Content that compresses past 1,000 to 1, such as a long run of zeros, stops `openArchive`, `decompress` and the inspection with LIMIT/RATIO. Raise `limits.compressionRatio` to read it.
+ZIP and 7z need a file's CRC and sizes before its data, so a file given as a stream is read first, into memory up to `memoryThreshold` (8 MiB) and into a temporary file past it. tar needs only the size. Bytes, text and a stream with `size` go straight out, and only a stream without one is read first. ZIP entries are deflated at `level` 6. ZIP and 7z store an entry that compression gains nothing on, or that would compress past `ratioLimit`, 1,000 to 1 by default, so their archives read back under the default limits. A compressed tar and the output of `compress` have no stored form. Content that compresses past 1,000 to 1, such as a long run of zeros, stops `openArchive`, `decompress` and the inspection with LIMIT/RATIO. Raise `limits.compressionRatio` to read it.
 
-`streaming: true` writes a ZIP archive the way archiver does, with no temporary file. Each file is deflated as its data arrives and goes straight to the sink, and a data descriptor after the data carries its CRC and sizes. Only zlib's buffers are held. A file with `store: true` and a link's target are held in memory, because a stored entry keeps its sizes in its header, and an empty file is stored. Two things of the default mode are lost. A file deflate cannot shrink is deflated anyway, and `ratioLimit` does not apply, since the entry is out before its ratio is known. An entry of 4 GiB or more gets eight-byte sizes in its descriptor. tar and 7z need each entry's size before its data, so `streaming` writes ZIP only. A 26 MB sheet given one row per chunk takes 0.75 seconds this way, and 1.2 in the default mode.
+`streaming: true` writes a ZIP archive the way archiver does, with no temporary file. Each file is deflated as its data arrives and goes straight to the sink, and a data descriptor after the data carries its CRC and sizes. Only zlib's buffers are held. A file with `store: true` and a link's target are held in memory, because a stored entry keeps its sizes in its header, and an empty file is stored. Two things of the default mode are lost. A file deflate cannot shrink is deflated anyway, and `ratioLimit` does not apply, since the entry is out before its ratio is known. A file whose size is known, from `size` or because it is bytes or text, gets ZIP64 fields in its local header when deflating it could pass 4 GiB, which tells a reader the descriptor's sizes are eight bytes. A stream without a size gets none, because some readers refuse ZIP64 fields an entry does not need. If such a stream reaches 4 GiB, its descriptor holds eight-byte sizes anyway, as archiver writes it. tar needs no option to stream, and 7z writes its header from every entry after the data, so `streaming` writes ZIP only. A 26 MB sheet given one row per chunk takes 0.75 seconds this way, and 1.2 in the default mode.
 
 Small chunks of an entry are gathered into 64 KiB pieces before they are compressed, so data given one row at a time compresses as fast as data given in large pieces.
 
+**Adding entries as you go.** `createArchiveWriter(format, options)` takes entries one at a time, the way archiver's `append` and `finalize` do, for code that finds them as it goes. `add(entry)` queues an entry and returns at once, so a synchronous callback can call it. Entries go out in the order added, and each waits in memory until its turn. `finish()` says no more entries come, and resolves once the end of the archive is written. `abort(reason)` stops the archive. `stream` is the archive as a Readable. Read it while you add entries, because the end of the archive is written only as the stream is read. A refused name, a failed stream or an abort fails the archive. The writer destroys `stream` with the error, `finish` rejects with it, and a later `add` throws a PackError whose `cause` is the error.
+
+```js
+const { createArchiveWriter } = require('@patrickdk77/archive-defuse');
+
+const zip = createArchiveWriter('zip', { streaming: true });
+const sent = pipeline(zip.stream, res);
+try {
+  zip.add({ name: 'mimetype', data: 'application/vnd.oasis.opendocument.text', store: true });
+  // Each picture goes into the archive as layout finds it, before content.xml exists.
+  const xml = render(doc, picture => zip.add({ name: `Pictures/${picture.name}`, data: picture.bytes }));
+  zip.add({ name: 'content.xml', data: xml });
+  zip.finish();
+} catch (e) {
+  zip.abort(e);
+}
+await sent;
+```
+
 `createArchive` throws a PackError, before it writes the entry, for a name the inspection would change. That covers an empty name, a NUL, an absolute path, a drive letter, a `..` part with or without dots and spaces after it, an empty or `.` part, a backslash, a control character or one that reorders text, and a part Windows cannot create, such as `con.txt`, `report:v2.txt` or a part that ends in a dot or a space. It also refuses a name that leaves its folder once NFKC normalization or Windows best fit changes it. NFKC turns two fullwidth full stops, U+FF0E, into `..`. Best fit turns a yen sign, U+00A5, into a backslash when a program on Japanese Windows converts the name to code page 932. A name with a yen sign is still written unless that conversion takes it out of its folder. Duplicate names are written as given.
 
 When an entry's stream fails, the sink is aborted instead of closed, and the Readable is destroyed with the error, so an upload or an HTTP response never ends with a partial archive that looks whole.
@@ -376,4 +396,4 @@ npm run format
 
 ## License
 
-MIT AND Apache-2.0. The package is MIT, in LICENSE. The LZMA and LZMA2 decoders and the LZMA encoder in `src/lzma1` come from lzma1 by Filip Seman, under the Apache License 2.0. Its text and a NOTICE that lists what changed sit next to them, and both ship in `dist/lzma1`. lzma1 ports that code from XZ for Java, which is 0BSD. The branch converters and the delta filter are ported from XZ for Java directly.
+MIT AND Apache-2.0. The package is MIT, in LICENSE. The LZMA and LZMA2 decoders and the LZMA encoder in `src/lzma1` come from lzma1 0.6.1 by Filip Seman, under the Apache License 2.0. Its text and a NOTICE that lists what changed sit next to them, and both ship in `dist/lzma1`. lzma1 ports that code from XZ for Java, which is 0BSD. The branch converters and the delta filter are ported from XZ for Java directly.

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { detectArchive, detectArchiveSource } from './detect';
 export { disarmArchive, disarmArchiveSource, inspectArchive, inspectArchiveSource } from './engine';
 export { allFindingSpecs } from './findings';
 export { bufferSink, bufferSource, fileSink, fileSource, writableSink } from './io';
-export { type CompressFormat, compress, compressStream, compressTo, createArchive, createArchiveBytes, createArchiveStream, type PackData, type PackEntry, PackError, type PackFormat, type PackOptions, } from './pack';
+export { type ArchiveWriter, type CompressFormat, compress, compressStream, compressTo, createArchive, createArchiveBytes, createArchiveStream, createArchiveWriter, type PackData, type PackEntry, PackError, type PackFormat, type PackOptions, } from './pack';
 export { archivePlugin, passThrough } from './plugins';
 export { COMBINATIONS, DEFAULT_BANDS, scoreFindings } from './score';
 export * from './types';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openArchive = exports.decompress = exports.ArchiveReadError = exports.scoreFindings = exports.DEFAULT_BANDS = exports.COMBINATIONS = exports.passThrough = exports.archivePlugin = exports.PackError = exports.createArchiveStream = exports.createArchiveBytes = exports.createArchive = exports.compressTo = exports.compressStream = exports.compress = exports.writableSink = exports.fileSource = exports.fileSink = exports.bufferSource = exports.bufferSink = exports.allFindingSpecs = exports.inspectArchiveSource = exports.inspectArchive = exports.disarmArchiveSource = exports.disarmArchive = exports.detectArchiveSource = exports.detectArchive = void 0;
+exports.openArchive = exports.decompress = exports.ArchiveReadError = exports.scoreFindings = exports.DEFAULT_BANDS = exports.COMBINATIONS = exports.passThrough = exports.archivePlugin = exports.PackError = exports.createArchiveWriter = exports.createArchiveStream = exports.createArchiveBytes = exports.createArchive = exports.compressTo = exports.compressStream = exports.compress = exports.writableSink = exports.fileSource = exports.fileSink = exports.bufferSource = exports.bufferSink = exports.allFindingSpecs = exports.inspectArchiveSource = exports.inspectArchive = exports.disarmArchiveSource = exports.disarmArchive = exports.detectArchiveSource = exports.detectArchive = void 0;
 var detect_1 = require("./detect");
 Object.defineProperty(exports, "detectArchive", { enumerable: true, get: function () { return detect_1.detectArchive; } });
 Object.defineProperty(exports, "detectArchiveSource", { enumerable: true, get: function () { return detect_1.detectArchiveSource; } });
@@ -38,6 +38,7 @@ Object.defineProperty(exports, "compressTo", { enumerable: true, get: function (
 Object.defineProperty(exports, "createArchive", { enumerable: true, get: function () { return pack_1.createArchive; } });
 Object.defineProperty(exports, "createArchiveBytes", { enumerable: true, get: function () { return pack_1.createArchiveBytes; } });
 Object.defineProperty(exports, "createArchiveStream", { enumerable: true, get: function () { return pack_1.createArchiveStream; } });
+Object.defineProperty(exports, "createArchiveWriter", { enumerable: true, get: function () { return pack_1.createArchiveWriter; } });
 Object.defineProperty(exports, "PackError", { enumerable: true, get: function () { return pack_1.PackError; } });
 var plugins_1 = require("./plugins");
 Object.defineProperty(exports, "archivePlugin", { enumerable: true, get: function () { return plugins_1.archivePlugin; } });

package/dist/index.mjs

@@ -1,3 +1,3 @@
 import cjs from './index.js';
-export const { detectArchive, detectArchiveSource, disarmArchive, disarmArchiveSource, inspectArchive, inspectArchiveSource, allFindingSpecs, bufferSink, bufferSource, fileSink, fileSource, writableSink, compress, compressStream, compressTo, createArchive, createArchiveBytes, createArchiveStream, PackError, archivePlugin, passThrough, COMBINATIONS, DEFAULT_BANDS, scoreFindings, ArchiveReadError, decompress, openArchive, ArchiveCategory, ArchiveDetail, ArchiveRisk } = cjs;
+export const { detectArchive, detectArchiveSource, disarmArchive, disarmArchiveSource, inspectArchive, inspectArchiveSource, allFindingSpecs, bufferSink, bufferSource, fileSink, fileSource, writableSink, compress, compressStream, compressTo, createArchive, createArchiveBytes, createArchiveStream, createArchiveWriter, PackError, archivePlugin, passThrough, COMBINATIONS, DEFAULT_BANDS, scoreFindings, ArchiveReadError, decompress, openArchive, ArchiveCategory, ArchiveDetail, ArchiveRisk } = cjs;
 export default cjs;

package/dist/lzma1/NOTICE

@@ -1,36 +1,50 @@
-The files in this directory come from lzma1 by Filip Seman, https://github.com/xseman/lzma1, under the Apache
-License 2.0 in LICENSE here. They come from the fork on branch feat/lzma2-decoder at commit
-19f319c68ed898619393a579d126ce06e3d5d704, which is lzma1 0.4.0 plus raw LZMA1 and LZMA2 decoding. lzma1 ports them
-from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+The files in this directory come from lzma1 0.6.1 by Filip Seman, https://github.com/xseman/lzma1, under the Apache
+License 2.0 in LICENSE here. They are the sources of tag v0.6.1, commit fc19ffcd4022b37297760c5dfec9292edf5875cd,
+which match the src folder of lzma1-0.6.1.tgz on npm. lzma1 ports them from XZ for Java (0BSD) by Lasse Collin and
+Igor Pavlov.
+
+archive-defuse carries a copy instead of depending on the npm package. lzma1 0.6.1 exports only its high-level API,
+and archive-defuse drives the streaming LZMA and LZMA2 decoders and the raw encoder below it: it needs the input bytes
+the data took and what follows it, and it restarts one encoder for each LZMA2 chunk it writes. lzma1 is also an ES
+module only, and archive-defuse compiles to CommonJS for Node 18 and later.
 
 Copied: crc32.ts, hash234.ts, hc4.ts, header.ts, lz-decoder.ts, lz-encoder.ts, lzma-coder.ts, lzma-decoder.ts,
 lzma-encoder.ts, lzma-encoder-fast.ts, lzma2-decoder.ts, range-coder.ts, range-decoder.ts and range-encoder.ts.
 
-lzma-defuse changed them as follows, and the files then moved into archive-defuse unchanged.
+archive-defuse changed them as follows.
 
 In every file:
 - Biome reformatted it to this package's style, with spaces for tabs and single quotes for double.
 - Imports drop the ".js" suffix, since this package compiles to CommonJS.
-- A first line names lzma1, its license and this NOTICE.
-
-In lzma-decoder.ts and lzma-encoder.ts, the box-drawing characters around section comments are now "--", since this
-package keeps its files ASCII.
-
-In hc4.ts, lz-decoder.ts, lz-encoder.ts, lzma-encoder.ts, lzma2-decoder.ts and range-encoder.ts, each function that
-assigned to its own parameter now copies the parameter into a local variable first. This package's lint rules forbid
-the assignment. The arithmetic is the same.
+- A first line names lzma1 0.6.1, its license and this NOTICE.
+
+This package's lint rules forbid assigning to a parameter, so these functions copy the parameter into a local
+variable first and work on the copy. The arithmetic is the same.
+- hc4.ts: skip().
+- lz-decoder.ts: repeat().
+- lz-encoder.ts: fillWindow().
+- lzma-encoder.ts: getNormalPrice() and getMatchedPrice() of the literal encoder, and encode() of the length encoder.
+- lzma2-decoder.ts: readChunkHeader(), decodeProps() and copyUncompressed().
+- range-decoder.ts: decodeDirectBits().
+- range-encoder.ts: getBitTreePrice(), getReverseBitTreePrice(), encodeReverseBitTree() and encodeDirectBits().
+
+In lzma-decoder.ts, the matched literal loop builds its mask with -bit where lzma1 writes (0 - bit). The lint rules
+read 0 - x as a type conversion. Both give 0 or -1 for a bit.
+
+In lzma-encoder.ts:
+- The empty body of the loop in encode() holds a comment.
+- The import of State from lzma-coder.ts is gone, since nothing in the file uses it and the compiler refuses unused
+  imports.
 
 In lzma-encoder-fast.ts:
 - getNextSymbol() throws if no matches were read, where it used a non-null assertion.
 - A chained assignment is now two assignments.
 
-In lzma-encoder.ts, the empty body of the loop in encode() holds a comment.
-
 In lzma2-decoder.ts:
 - The file defines INPUT_MARGIN itself instead of importing it from alone-decoder.ts, which this package does not
-  copy. The value is still 64.
+  copy. The value is lzma1's, 64.
 - A private method, currentLzma(), returns the LZMA decoder or throws "LZMA2 chunk without properties". It replaces
   two non-null assertions.
 
-crc32.ts, hash234.ts, header.ts, lzma-coder.ts, lzma-decoder.ts, range-coder.ts and range-decoder.ts have no changes
-beyond formatting and imports.
+crc32.ts, hash234.ts, header.ts, lzma-coder.ts, range-coder.ts have no changes beyond formatting, imports and the
+first line.

package/dist/lzma1/crc32.d.ts

@@ -1,4 +1,5 @@
 /**
- * CRC-32 (IEEE 802.3) lookup table. The match finders use it for hashing.
+ * CRC-32 (IEEE 802.3) lookup table. The match finders hash with a copy of
+ * it, so changing this array does not affect compression.
  */
 export declare const CRC32_TABLE: number[];

package/dist/lzma1/crc32.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CRC32_TABLE = void 0;
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
- * CRC-32 (IEEE 802.3) lookup table. The match finders use it for hashing.
+ * CRC-32 (IEEE 802.3) lookup table. The match finders hash with a copy of
+ * it, so changing this array does not affect compression.
  */
 exports.CRC32_TABLE = createCrc32Table();
 function createCrc32Table() {

package/dist/lzma1/hash234.d.ts

@@ -1,7 +1,9 @@
 /**
  * Hash tables of the last positions of 2-, 3- and 4-byte sequences.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/Hash234.java` and
+ * `CRC32Hash.java` (the table itself comes from `crc32.ts`), by Lasse
+ * Collin and Igor Pavlov.
  */
 export declare class Hash234 {
     private readonly hash4Mask;

package/dist/lzma1/hash234.js

@@ -1,9 +1,11 @@
 "use strict";
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
  * Hash tables of the last positions of 2-, 3- and 4-byte sequences.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/Hash234.java` and
+ * `CRC32Hash.java` (the table itself comes from `crc32.ts`), by Lasse
+ * Collin and Igor Pavlov.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Hash234 = void 0;
@@ -13,6 +15,9 @@ const HASH_2_SIZE = 1 << 10;
 const HASH_2_MASK = HASH_2_SIZE - 1;
 const HASH_3_SIZE = 1 << 16;
 const HASH_3_MASK = HASH_3_SIZE - 1;
+// An int32 copy saves converting the exported table's unsigned numbers on
+// every read; measured faster in fast mode.
+const CRC32_TABLE_INT32 = Int32Array.from(crc32_1.CRC32_TABLE);
 function getHash4Size(dictSize) {
     let h = dictSize - 1;
     h |= h >>> 1;
@@ -40,11 +45,11 @@ class Hash234 {
         this.hash4Mask = hash4Size - 1;
     }
     calcHashes(buf, off) {
-        let temp = crc32_1.CRC32_TABLE[buf[off]] ^ buf[off + 1];
+        let temp = CRC32_TABLE_INT32[buf[off]] ^ buf[off + 1];
         this.hash2Value = temp & HASH_2_MASK;
         temp ^= buf[off + 2] << 8;
         this.hash3Value = temp & HASH_3_MASK;
-        temp ^= crc32_1.CRC32_TABLE[buf[off + 3]] << 5;
+        temp ^= CRC32_TABLE_INT32[buf[off + 3]] << 5;
         this.hash4Value = temp & this.hash4Mask;
     }
     getHash2Pos() {

package/dist/lzma1/hc4.d.ts

@@ -4,7 +4,8 @@
  * Every position links to the previous position with the same 4-byte hash.
  * Faster than the binary tree finder but finds fewer long matches.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/HC4.java`, by
+ * Lasse Collin and Igor Pavlov.
  */
 import { LzEncoder, type LzEncoderConfig, Matches } from './lz-encoder';
 export declare class HC4 extends LzEncoder {
@@ -25,6 +26,6 @@ export declare class HC4 extends LzEncoder {
      */
     reset(): void;
     getMatches(): Matches;
-    skip(len: number): void;
+    skip(lenIn: number): void;
     private movePosition;
 }

package/dist/lzma1/hc4.js

@@ -1,12 +1,13 @@
 "use strict";
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
  * Hash chain match finder with 2-, 3- and 4-byte hashing.
  *
  * Every position links to the previous position with the same 4-byte hash.
  * Faster than the binary tree finder but finds fewer long matches.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/HC4.java`, by
+ * Lasse Collin and Igor Pavlov.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HC4 = void 0;
@@ -114,8 +115,9 @@ class HC4 extends lz_encoder_1.LzEncoder {
             }
         }
     }
-    skip(len) {
-        for (let left = len; left > 0; --left) {
+    skip(lenIn) {
+        let len = lenIn;
+        while (len-- > 0) {
             if (this.movePosition() !== 0) {
                 this.hash.calcHashes(this.buf, this.readPos);
                 this.chain[this.cyclicPos] = this.hash.getHash4Pos();

package/dist/lzma1/header.js

@@ -1,5 +1,5 @@
 "use strict";
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
  * The 13-byte header of the `.lzma` ("LZMA_Alone") format:
  *

package/dist/lzma1/lz-decoder.d.ts

@@ -6,16 +6,23 @@
  * so small outputs don't allocate the whole dictionary up front, unless
  * `preallocate` is set. Bytes are passed to `sink` before they get
  * overwritten.
+ *
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/LZDecoder.java`,
+ * by Lasse Collin and Igor Pavlov; the fixed dictionary buffer flushed by
+ * the caller became this growing buffer with a sink, and the Java code's
+ * mid-match output limit (`pendingLen`) is not needed, because
+ * `LzmaDecoder` enforces its output limit, the declared size or the end of
+ * an LZMA2 chunk, before each match.
  */
 export declare class LzDecoder {
-    private buf;
+    buf: Uint8Array;
     private readonly maxSize;
     private readonly sink;
     /** Next write position. */
-    private pos;
+    pos: number;
     /** Start of the bytes not yet passed to the sink. */
-    private start;
-    private wrapped;
+    start: number;
+    wrapped: boolean;
     /**
      * @param dictSize Largest distance a match may reach back
      * @param sink Receives decoded data. The chunk is only valid during the call.
@@ -26,16 +33,9 @@ export declare class LzDecoder {
     getByte(dist: number): number;
     putByte(byte: number): void;
     /** Copies `len` bytes starting `dist + 1` positions back. */
-    repeat(dist: number, length: number): void;
-    /**
-     * Copies `len` bytes of uncompressed data from `input` at `inPos`. XZ for
-     * Java copies up to the end of the buffer and leaves the rest to its
-     * caller; this copy continues past the end like `repeat`.
-     */
-    copyUncompressed(input: Uint8Array, offset: number, length: number): void;
-    /** Empties the dictionary, so matches can't reach back before this point. */
-    reset(): void;
+    repeat(dist: number, lenIn: number): void;
     /** Passes all pending bytes to the sink. */
     flush(): void;
-    private onBufferEnd;
+    /** Grows the buffer, or passes its bytes to the sink and wraps around. */
+    onBufferEnd(): void;
 }

package/dist/lzma1/lz-decoder.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LzDecoder = void 0;
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
  * Decoder-side LZ window: a circular buffer holding the most recent output
  * (the dictionary), which matches copy from.
@@ -10,8 +10,19 @@ exports.LzDecoder = void 0;
  * so small outputs don't allocate the whole dictionary up front, unless
  * `preallocate` is set. Bytes are passed to `sink` before they get
  * overwritten.
+ *
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/LZDecoder.java`,
+ * by Lasse Collin and Igor Pavlov; the fixed dictionary buffer flushed by
+ * the caller became this growing buffer with a sink, and the Java code's
+ * mid-match output limit (`pendingLen`) is not needed, because
+ * `LzmaDecoder` enforces its output limit, the declared size or the end of
+ * an LZMA2 chunk, before each match.
  */
 class LzDecoder {
+    // Not private: `copyUncompressed` and `resetDictionary` in
+    // lzma2-decoder.ts use them. As methods here they would ship in every
+    // bundle, and as a subclass they make LZMA2 decoding about 10% slower on
+    // Node.
     buf;
     maxSize;
     sink;
@@ -45,8 +56,8 @@ class LzDecoder {
         }
     }
     /** Copies `len` bytes starting `dist + 1` positions back. */
-    repeat(dist, length) {
-        let len = length;
+    repeat(dist, lenIn) {
+        let len = lenIn;
         const history = this.wrapped ? this.buf.length : this.pos;
         if (dist < 0 || dist >= history) {
             throw new Error('Corrupted input: match distance is too large');
@@ -75,36 +86,6 @@ class LzDecoder {
             }
         }
     }
-    /**
-     * Copies `len` bytes of uncompressed data from `input` at `inPos`. XZ for
-     * Java copies up to the end of the buffer and leaves the rest to its
-     * caller; this copy continues past the end like `repeat`.
-     */
-    copyUncompressed(input, offset, length) {
-        let inPos = offset;
-        let len = length;
-        while (len > 0) {
-            const copySize = Math.min(this.buf.length - this.pos, len);
-            this.buf.set(input.subarray(inPos, inPos + copySize), this.pos);
-            this.pos += copySize;
-            inPos += copySize;
-            len -= copySize;
-            if (this.pos === this.buf.length) {
-                this.onBufferEnd();
-            }
-        }
-    }
-    /** Empties the dictionary, so matches can't reach back before this point. */
-    reset() {
-        // In XZ for Java the caller flushes first. Here the sink has to get
-        // the pending bytes before the positions restart, or they are lost.
-        this.flush();
-        this.start = 0;
-        this.pos = 0;
-        this.wrapped = false;
-        // getByte(0) has to return 0x00 when nothing has been decoded.
-        this.buf[this.buf.length - 1] = 0x00;
-    }
     /** Passes all pending bytes to the sink. */
     flush() {
         if (this.pos > this.start) {
@@ -112,6 +93,7 @@ class LzDecoder {
         }
         this.start = this.pos;
     }
+    /** Grows the buffer, or passes its bytes to the sink and wraps around. */
     onBufferEnd() {
         if (!this.wrapped && this.buf.length < this.maxSize) {
             const grown = new Uint8Array(Math.min(this.buf.length * 2, this.maxSize));

package/dist/lzma1/lz-encoder.d.ts

@@ -6,7 +6,8 @@
  * read position gets close to the end of the buffer, the window is moved
  * back to the start of the buffer.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/LZEncoder.java`,
+ * `Matches.java` and `MatchLength.java`, by Lasse Collin and Igor Pavlov.
  */
 export type MatchFinderType = 'hc4' | 'bt4';
 /** Matches found at one position, sorted by increasing length. */
@@ -60,7 +61,7 @@ export declare abstract class LzEncoder {
      *
      * @returns number of bytes consumed; call again with the rest
      */
-    fillWindow(input: Uint8Array, off: number, length: number): number;
+    fillWindow(input: Uint8Array, off: number, lenIn: number): number;
     /** Marks the end of input so that the lookahead can be used up. */
     setFinishing(): void;
     isStarted(): boolean;

package/dist/lzma1/lz-encoder.js

@@ -1,5 +1,5 @@
 "use strict";
-// Copied from lzma1 (Apache-2.0, Copyright Filip Seman) and changed for lzma-defuse. NOTICE in this folder lists the changes.
+// Copied from lzma1 0.6.1 (Apache-2.0, Copyright Filip Seman) and changed for archive-defuse. NOTICE in this folder lists the changes.
 /**
  * Encoder-side LZ window and the base class of the match finders.
  *
@@ -8,7 +8,8 @@
  * read position gets close to the end of the buffer, the window is moved
  * back to the start of the buffer.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lz/LZEncoder.java`,
+ * `Matches.java` and `MatchLength.java`, by Lasse Collin and Igor Pavlov.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LzEncoder = exports.Matches = void 0;
@@ -83,11 +84,12 @@ class LzEncoder {
      *
      * @returns number of bytes consumed; call again with the rest
      */
-    fillWindow(input, off, length) {
+    fillWindow(input, off, lenIn) {
+        let len = lenIn;
         if (this.readPos >= this.buf.length - this.keepSizeAfter) {
             this.moveWindow();
         }
-        const len = Math.min(length, this.buf.length - this.writePos);
+        len = Math.min(len, this.buf.length - this.writePos);
         this.buf.set(input.subarray(off, off + len), this.writePos);
         this.writePos += len;
         if (this.writePos >= this.keepSizeAfter) {

package/dist/lzma1/lzma-coder.d.ts

@@ -1,7 +1,13 @@
 /**
  * Probability models and state machine shared by the LZMA encoder and decoder.
  *
- * Ported from XZ for Java (0BSD) by Lasse Collin and Igor Pavlov.
+ * Ported from XZ for Java (0BSD), `src/org/tukaani/xz/lzma/LZMACoder.java`
+ * and `State.java`, by Lasse Collin and Igor Pavlov.
+ *
+ * The nested coder classes of the Java code (`LiteralCoder.LiteralSubcoder`,
+ * `LengthCoder`) are top-level classes here, because TypeScript has no inner
+ * classes; subclasses in the encoder and decoder files pass their outer
+ * coder explicitly where Java captures it implicitly.
  */
 import { type Probs } from './range-coder';
 export declare const POS_STATES_MAX: number;
@@ -22,8 +28,9 @@ export declare const LEN_MID: number;
 export declare const LEN_HIGH: number;
 export declare const LEN_SIZE: number;
 export declare const DIST_STATES = 4;
+export declare const DIST_SLOTS: number;
+/** Bits of a distance slot: the depth of the slot bit trees. */
 export declare const DIST_SLOT_BITS = 6;
-export declare const DIST_SLOT_COUNT: number;
 export declare const DIST_MODEL_START = 4;
 export declare const DIST_MODEL_END = 14;
 export declare const FULL_DISTANCES: number;
@@ -32,24 +39,39 @@ export declare const ALIGN_SIZE: number;
 export declare const ALIGN_MASK: number;
 /** Number of recent match distances ("reps") that can be reused cheaply. */
 export declare const REPS = 4;
+/** Distances are coded with different probabilities for lengths 2, 3, 4 and 5+. */
+export declare function getDistState(len: number): number;
+/** Number of probabilities of a coder with `lc` and `lp` literal bits. */
+export declare function probsSize(lc: number, lp: number): number;
 /**
  * The coder state remembers the kinds of the most recent symbols
  * (literal, match, long rep, short rep). It selects which probabilities
  * are used for the next symbol.
  */
+export declare class State {
+    static readonly STATES = 12;
+    private state;
+    constructor(other?: State);
+    reset(): void;
+    get(): number;
+    set(other: State): void;
+    updateLiteral(): void;
+    updateMatch(): void;
+    updateLongRep(): void;
+    updateShortRep(): void;
+    isLiteral(): boolean;
+}
 export declare const STATES = 12;
-export declare const INITIAL_STATE = 0;
-export declare function isLiteralState(state: number): boolean;
 export declare function stateAfterLiteral(state: number): number;
 export declare function stateAfterMatch(state: number): number;
 export declare function stateAfterLongRep(state: number): number;
 export declare function stateAfterShortRep(state: number): number;
-/** Distances are coded with different probabilities for lengths 2, 3, 4 and 5+. */
-export declare function getDistState(len: number): number;
+export declare function isLiteralState(state: number): boolean;
 /**
  * Layout of the probability array. All probabilities of a coder live in one
- * `Uint16Array`, like in the LZMA SDK and liblzma: one allocation, one reset,
- * and the hot loops index a single array.
+ * `Uint16Array`, like in the LZMA SDK and liblzma, instead of the
+ * Java code's per-model arrays: one allocation, and the hot loops index a
+ * single array.
  *
  * Bit trees of `2^n` leaves occupy `2^n` entries starting at their offset;
  * index 0 of a tree is unused.
@@ -61,7 +83,7 @@ export declare const IS_REP1: number;
 export declare const IS_REP2: number;
 export declare const IS_REP0_LONG: number;
 /** Bit trees of 6 bits per distance state. */
-export declare const DIST_SLOTS: number;
+export declare const DIST_SLOT_OFFSET: number;
 /** Reverse bit trees for the low bits of distances in slots 4-13. */
 export declare const DIST_SPECIAL: number;
 /** Reverse bit tree for the lowest 4 bits of distances in slots 14+. */
@@ -77,17 +99,10 @@ export declare const LITERAL: number;
  * trees of all slots fill `FULL_DISTANCES - DIST_MODEL_END` entries.
  */
 export declare function distSpecialOffset(distSlot: number, base: number): number;
-/** Number of probabilities of a coder with `lc` and `lp` literal bits. */
-export declare function probsSize(lc: number, lp: number): number;
-/**
- * Probability models and coder state shared by the encoder and decoder.
- */
-export declare class LzmaCoder {
+export declare abstract class LzmaCoder {
     readonly posMask: number;
-    private readonly lc;
-    private readonly literalPosMask;
     readonly reps: Int32Array<ArrayBuffer>;
-    state: number;
+    readonly state: State;
     readonly probs: Probs;
     /**
      * @param probs Probability array to reuse, of `probsSize(lc, lp)` entries.
@@ -95,13 +110,22 @@ export declare class LzmaCoder {
      */
     constructor(lc: number, lp: number, pb: number, probs?: Probs);
     reset(): void;
-    /**
-     * Offset of the literal coder for a literal at `pos` after `prevByte`:
-     * selected by the high `lc` bits of the previous byte and the low `lp`
-     * bits of the position.
-     *
-     * Each literal coder has 0x300 probabilities: 0x100 for a plain bit
-     * tree, and 2 * 0x100 used while the bits still agree with the "match byte".
-     */
-    literalOffset(prevByte: number, pos: number): number;
+}
+export declare abstract class LiteralCoder {
+    private readonly lc;
+    private readonly literalPosMask;
+    constructor(lc: number, lp: number);
+    getSubcoderIndex(prevByte: number, pos: number): number;
+}
+export declare abstract class LiteralSubcoder {
+    readonly probs: Probs;
+    /** Offset of this subcoder's 0x300 probabilities in `probs`. */
+    readonly literalOffset: number;
+    constructor(probs: Probs, literalOffset: number);
+}
+export declare abstract class LengthCoder {
+    readonly probs: Probs;
+    /** Offset of this length coder in `probs`. */
+    readonly coder: number;
+    constructor(probs: Probs, coder: number);
 }