@poe-platform/safe-bash 0.1.798 → 0.1.800

package/dist/safe-bash/command-chunks/chunk-364TMWBT.js

@@ -0,0 +1,946 @@
+import {
+  stripZip64,
+  zip64Directory,
+  zip64Extra,
+  zip64Fields,
+  zip64Member,
+  zipDescriptor,
+  zipDiskOffset,
+  zipDiskRecord,
+  zipEnd
+} from "./chunk-LE5LZNHE.js";
+import {
+  zipLzma
+} from "./chunk-2FGJYFWZ.js";
+import {
+  decryptZipPayload,
+  encryptZipPayload
+} from "./chunk-PII4YEZW.js";
+import {
+  crcTable
+} from "./chunk-H622NS6Z.js";
+import {
+  zipGrowRecords
+} from "./chunk-SEM36PG5.js";
+import {
+  aesExtra,
+  aesParameters,
+  decryptAesPayload,
+  encryptAesPayload
+} from "./chunk-UXSR5BZH.js";
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-zip-engine/src/zip-format.ts
+init_buffer();
+import { boundedCodec } from "../../safe-bash-compression-engine/bounded-codec.js";
+import { codec, CodecReader } from "../../safe-bash-compression-engine/codec.js";
+import { collectBytes, readBytes } from "../../safe-bash-contracts/index.js";
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { byteLength, concatBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { fail, text } from "../../safe-bash-io-engine/commands/archive/internal.js";
+var encoder = new TextEncoder();
+var cp437 = "\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557\u255D\u255C\u255B\u2510\u2514\u2534\u252C\u251C\u2500\u253C\u255E\u255F\u255A\u2554\u2569\u2566\u2560\u2550\u256C\u2567\u2568\u2564\u2565\u2559\u2558\u2552\u2553\u256B\u256A\u2518\u250C\u2588\u2584\u258C\u2590\u2580\u03B1\xDF\u0393\u03C0\u03A3\u03C3\xB5\u03C4\u03A6\u0398\u03A9\u03B4\u221E\u03C6\u03B5\u2229\u2261\xB1\u2265\u2264\u2320\u2321\xF7\u2248\xB0\u2219\xB7\u221A\u207F\xB2\u25A0\xA0";
+function crc32(bytes, previous = 0) {
+  let value = previous ^ 4294967295;
+  for (const byte of bytes) value = value >>> 8 ^ crcTable[(value ^ byte) & 255];
+  return (value ^ 4294967295) >>> 0;
+}
+function number(value, maximum, label) {
+  if (!Number.isSafeInteger(value) || value < 0 || value > maximum) fail(`ZIP ${label} limit exceeded or invalid value`);
+}
+function admit(limits, signal) {
+  signal.throwIfAborted();
+  for (const key of ["maxArchiveBytes", "maxEntryBytes", "maxTotalBytes", "maxMembers", "maxPathBytes", "maxDepth", "maxPaxBytes", "maxTextBytes", "maxPatternSteps", "chunkSize"]) {
+    if (limits[key] !== Infinity || key === "chunkSize") number(limits[key], Number.MAX_SAFE_INTEGER, key);
+  }
+  if (limits.chunkSize < 512 || limits.chunkSize > 1024 * 1024) fail("ZIP chunk size must be between 512 and 1048576");
+  return Math.min(limits.chunkSize, 64 * 1024);
+}
+function pathBytes(name, limits) {
+  if (name.length > Math.min(limits.maxPathBytes, 65535)) fail("ZIP path byte limit exceeded");
+  number(byteLength(name), Math.min(limits.maxPathBytes, limits.maxArchiveBytes, 65535), "path byte");
+  const bytes = encoder.encode(name);
+  if (!name || text(bytes) !== name || name.includes("\0")) fail("ZIP invalid or unsafe path");
+  number(bytes.length, Math.min(limits.maxPathBytes, 65535), "path byte");
+  const parts = name.split("/");
+  if (parts.at(-1) === "") parts.pop();
+  if (parts.some((part) => !part || part === "." || part === "..")) fail("ZIP unsafe traversal or absolute path");
+  number(parts.length, limits.maxDepth, "path depth");
+  return bytes;
+}
+function equal(first, second) {
+  return first.length === second.length && first.every((byte, index) => byte === second[index]);
+}
+function legacyName(bytes) {
+  let name = "";
+  for (const byte of bytes) name += byte < 128 ? String.fromCharCode(byte) : cp437[byte - 128];
+  return name;
+}
+function extras(bytes, rawName, comment, central, limits) {
+  number(bytes.length, Math.min(limits.maxPaxBytes, 65535), "extra field");
+  const result = {};
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const seen = /* @__PURE__ */ new Set();
+  let offset = 0;
+  while (offset < bytes.length) {
+    if (offset + 4 > bytes.length) fail("ZIP truncated extra field");
+    const identifier = view.getUint16(offset, true);
+    const length = view.getUint16(offset + 2, true);
+    offset += 4;
+    if (offset + length > bytes.length) fail("ZIP truncated extra field payload");
+    if (seen.has(identifier)) fail("ZIP duplicate extra field");
+    seen.add(identifier);
+    if (identifier === 1) {
+      if (!length || length > 28 || length % 4) fail("ZIP64 invalid extra field length");
+      result.zip64 = bytes.subarray(offset, offset + length);
+    }
+    if (identifier === 39169) {
+      if (length !== 7 || bytes[offset + 2] !== 65 || bytes[offset + 3] !== 69) fail("ZIP invalid AES extra field");
+      const aes = { version: view.getUint16(offset, true), strength: (bytes[offset + 4] + 1) * 64, method: view.getUint16(offset + 5, true) };
+      aesParameters(aes);
+      if (aes.method !== 0 && aes.method !== 8 && aes.method !== 12) fail("ZIP unsupported AES compression method");
+      result.aes = aes;
+    }
+    if (identifier === 23 || identifier === 24 || identifier === 25) fail("ZIP encryption is unsupported");
+    if (identifier === 28789 || identifier === 25461) {
+      if (length < 5 || bytes[offset] !== 1) fail("ZIP unsupported or truncated Unicode extra field");
+      const original = identifier === 28789 ? rawName : comment;
+      if (view.getUint32(offset + 1, true) !== crc32(original)) fail("ZIP Unicode extra field CRC mismatch");
+      const decoded = text(bytes.subarray(offset + 5, offset + length));
+      if (identifier === 28789) {
+        pathBytes(decoded, limits);
+        result.name = decoded;
+      } else number(length - 5, limits.maxTextBytes, "Unicode comment");
+    }
+    if (identifier === 21589) {
+      if (!length) fail("ZIP truncated timestamp extra field");
+      const flags = bytes[offset];
+      if (flags & ~7) fail("ZIP unsupported timestamp flags");
+      const count = (flags & 1) + (central ? 0 : (flags >>> 1 & 1) + (flags >>> 2 & 1));
+      if (length !== 1 + count * 4) fail("ZIP truncated or inconsistent timestamp extra field");
+      if (flags & 1) result.modified = view.getInt32(offset + 1, true) * 1e3;
+    }
+    offset += length;
+  }
+  return result;
+}
+function nameFrom(rawName, flags, metadata, limits) {
+  number(rawName.length, Math.min(limits.maxPathBytes, 65535), "raw path byte");
+  const raw = flags & 2048 ? text(rawName) : legacyName(rawName);
+  pathBytes(raw, limits);
+  if (flags & 2048 && metadata.name !== void 0 && metadata.name !== raw) fail("ZIP conflicting UTF-8 and Unicode extra names");
+  return metadata.name ?? raw;
+}
+function format(method, flags, version) {
+  number(flags, 65535, "general purpose flags");
+  if (flags & (64 | 8192)) fail("ZIP encryption is unsupported");
+  if (method === 99) {
+    if (!(flags & 1) || flags & ~2063 || version !== 51) fail("ZIP invalid AES flags or extraction version");
+    return;
+  }
+  if (method === 14 ? flags & ~2059 : flags & ~2063 || method !== 8 && flags & 6) fail("ZIP unsupported general purpose flags");
+  if (method === 14) {
+    if (version !== 63) fail("ZIP unsupported LZMA extraction version");
+    return;
+  }
+  if (method !== 0 && method !== 8 && method !== 12) fail("ZIP unsupported compression method");
+  if (version < (method === 12 ? 46 : method === 8 || flags & 8 && !(flags & 1) ? 20 : 10) || version > 20 && version !== 45 && version !== 46) fail("ZIP unsupported extraction version (including ZIP64)");
+}
+function dosModified(date, time) {
+  if (!date && !time) return new Date(1980, 0, 1);
+  const year = 1980 + (date >>> 9);
+  const month = (date >>> 5 & 15) - 1;
+  const day = date & 31;
+  const hours = time >>> 11;
+  const minutes = time >>> 5 & 63;
+  const seconds = (time & 31) * 2;
+  const result = new Date(Date.UTC(year, month, day, hours, minutes, seconds));
+  if (result.getUTCFullYear() !== year || result.getUTCMonth() !== month || result.getUTCDate() !== day || hours > 23 || minutes > 59 || seconds > 59) fail("ZIP invalid DOS timestamp");
+  return new Date(year, month, day, hours, minutes, seconds);
+}
+function attributeMode(versionMadeBy, externalAttributes, directory) {
+  const host = versionMadeBy >>> 8;
+  const unixMode = host === 3 || host === 19 ? externalAttributes >>> 16 : 0;
+  if (unixMode) return unixMode;
+  const mode = directory ? 16877 : 33188;
+  return externalAttributes & 1 ? mode & ~146 : mode;
+}
+function entryBounds(entry, limits) {
+  pathBytes(entry.name, limits);
+  number(entry.size, Math.min(limits.maxEntryBytes, limits.maxTotalBytes), "entry byte");
+  number(entry.data.length, limits.maxArchiveBytes, "compressed byte");
+  number(entry.crc32, 4294967295, "CRC32");
+  number(entry.mode, 65535, "mode");
+  format(entry.method, entry.flags ?? 2048, entry.method === 14 ? 63 : entry.method === 99 ? 51 : entry.method === 12 ? 46 : entry.method === 8 || (entry.flags ?? 0) & 9 ? 20 : 10);
+  if (entry.method === 99 && !entry.aes || entry.method !== 99 && entry.aes) fail("ZIP inconsistent AES metadata");
+  if (entry.aes) {
+    aesParameters(entry.aes);
+    if (entry.aes.method !== 0 && entry.aes.method !== 8 && entry.aes.method !== 12) fail("ZIP unsupported AES compression method");
+    if (entry.aes.version === 2 && entry.crc32 !== 0) fail("ZIP AE-2 CRC must be zero");
+  }
+  if (entry.directory !== entry.name.endsWith("/") || entry.directory && (entry.symlink || entry.size !== 0)) fail("ZIP inconsistent directory metadata");
+  const type = entry.mode & 61440;
+  const pipePayload = !entry.directory && !entry.symlink && type === 4096;
+  if (type !== 0 && !pipePayload && type !== (entry.directory ? 16384 : entry.symlink ? 40960 : 32768)) fail("ZIP unsupported or conflicting file type");
+  if (!Number.isFinite(entry.modified.getTime())) fail("ZIP invalid modification time");
+}
+async function copyBytes(source, destination, start, chunkSize, signal) {
+  for (let offset = 0; offset < source.length; offset += chunkSize) {
+    signal.throwIfAborted();
+    destination.set(source.subarray(offset, offset + chunkSize), start + offset);
+    if (offset + chunkSize < source.length) await yieldTurn(signal);
+  }
+}
+async function readZipArchive(bytes, limits, signal, profile = {}) {
+  const chunkSize = admit(limits, signal);
+  number(bytes.length, limits.maxArchiveBytes, "archive byte");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let end = -1;
+  let displacement = 0;
+  const lower = Math.max(0, bytes.length - 22 - 65535);
+  await yieldTurn(signal);
+  for (let offset2 = bytes.length - 22; offset2 >= lower; offset2--) {
+    if ((bytes.length - offset2) % 4096 === 0) signal.throwIfAborted();
+    if (view.getUint32(offset2, true) === 101010256 && offset2 + 22 + view.getUint16(offset2 + 20, true) === bytes.length) {
+      const size = view.getUint32(offset2 + 12, true);
+      const start = view.getUint32(offset2 + 16, true);
+      const zip64 = size === 4294967295 || start === 4294967295 || offset2 >= 20 && view.getUint32(offset2 - 20, true) === 117853008;
+      let candidateDisplacement = 0;
+      if (!zip64 && !profile.disks && start + size !== offset2) {
+        if (!profile.prefix || start + size > offset2 || offset2 - size < 0 || size && view.getUint32(offset2 - size, true) !== 33639248) continue;
+        candidateDisplacement = offset2 - size - start;
+      }
+      if (zip64 && profile.prefix && !profile.disks && offset2 >= 76 && view.getUint32(offset2 - 20, true) === 117853008) {
+        const declared = view.getBigUint64(offset2 - 12, true);
+        if (declared > BigInt(Number.MAX_SAFE_INTEGER)) fail("ZIP64 unsafe numeric field");
+        if (Number(declared) + 12 > offset2 - 20 || view.getUint32(Number(declared), true) !== 101075792) {
+          let found = -1;
+          const low = Math.max(0, offset2 - 76 - limits.maxPaxBytes);
+          for (let wide = offset2 - 76; wide >= low; wide--) {
+            if (offset2 - 76 - wide > limits.maxPatternSteps) fail("ZIP SFX scan work limit exceeded");
+            if ((offset2 - wide) % 4096 === 0) await yieldTurn(signal);
+            if (view.getUint32(wide, true) !== 101075792 || view.getBigUint64(wide + 4, true) !== BigInt(offset2 - 32 - wide)) continue;
+            if (found !== -1) fail("ZIP64 ambiguous SFX end records");
+            found = wide;
+          }
+          if (found < Number(declared)) continue;
+          candidateDisplacement = found - Number(declared);
+        }
+      }
+      if (end !== -1) fail("ZIP ambiguous end records");
+      end = offset2;
+      displacement = candidateDisplacement;
+    }
+  }
+  if (end === -1) fail("ZIP truncated or missing end of central directory");
+  const { members, centralStart, centralEnd, diskMembers, disk: finalDisk, zip64Disk, zip64DiskMembers } = zip64Directory(view, end, limits, profile.disks, displacement);
+  number(bytes.length - end - 22, limits.maxTextBytes, "archive comment");
+  const entries = [];
+  const spans = [];
+  const growSpans = /* @__PURE__ */ new Map();
+  let offset = centralStart;
+  let total = 0;
+  let finalMembers = 0;
+  let wideDiskMembers = 0;
+  for (let index = 0; index < members; index++) {
+    if (index > 0 && (index & 63) === 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+    if (!profile.disks || offset >= profile.disks.starts[finalDisk]) finalMembers++;
+    if (zip64Disk >= 0 && (!profile.disks || offset >= profile.disks.starts[zip64Disk] && offset < profile.disks.starts[zip64Disk] + profile.disks.lengths[zip64Disk])) wideDiskMembers++;
+    if (offset + 46 > centralEnd || view.getUint32(offset, true) !== 33639248) fail("ZIP truncated or invalid central header");
+    const versionMadeBy = view.getUint16(offset + 4, true);
+    const version = view.getUint16(offset + 6, true);
+    const flags = view.getUint16(offset + 8, true);
+    const method = view.getUint16(offset + 10, true);
+    format(method, flags, version);
+    const dosTime = view.getUint16(offset + 12, true);
+    const dosDate = view.getUint16(offset + 14, true);
+    const checksum = view.getUint32(offset + 16, true);
+    let compressedSize = view.getUint32(offset + 20, true);
+    let size = view.getUint32(offset + 24, true);
+    const nameLength = view.getUint16(offset + 28, true);
+    const extraLength = view.getUint16(offset + 30, true);
+    const commentLength = view.getUint16(offset + 32, true);
+    const internalAttributes = view.getUint16(offset + 36, true);
+    if (internalAttributes & ~1) fail("ZIP unsupported internal attributes");
+    const externalAttributes = view.getUint32(offset + 38, true);
+    let local = view.getUint32(offset + 42, true);
+    const disk = view.getUint16(offset + 34, true);
+    const next = offset + 46 + nameLength + extraLength + commentLength;
+    if (next > centralEnd) fail("ZIP truncated central metadata");
+    zipDiskRecord(profile.disks, offset, next);
+    number(commentLength, limits.maxTextBytes, "entry comment");
+    const rawName = bytes.subarray(offset + 46, offset + 46 + nameLength);
+    const centralExtra = bytes.subarray(offset + 46 + nameLength, next - commentLength);
+    const comment = bytes.subarray(next - commentLength, next);
+    if (flags & 2048) text(comment);
+    const centralMetadata = extras(centralExtra, rawName, comment, true, limits);
+    if (Boolean(centralMetadata.aes) !== (method === 99)) fail("ZIP inconsistent AES method and extra field");
+    const aes = centralMetadata.aes;
+    if (aes && aes.method !== 8 && flags & 6) fail("ZIP unsupported AES compression flags");
+    if (aes?.version === 2 && checksum !== 0) fail("ZIP AE-2 CRC must be zero");
+    if (version < 45 && (size === 4294967295 || compressedSize === 4294967295 || local === 4294967295 || disk === 65535)) fail("ZIP64 unsupported member extraction version");
+    const resolved = zip64Fields(centralMetadata.zip64, [size, compressedSize, local, disk === 65535 ? 4294967295 : disk]);
+    [size, compressedSize, local] = resolved;
+    local = zipDiskOffset(profile.disks, resolved[3], local);
+    local += displacement;
+    number(size, limits.maxEntryBytes, "entry byte");
+    number(compressedSize, limits.maxArchiveBytes, "compressed entry byte");
+    if (flags & 1 && compressedSize < (aes ? aesParameters(aes).saltBytes + 12 : 12)) fail("ZIP truncated encryption header");
+    if (aes?.method === 0 && compressedSize !== size + aesParameters(aes).saltBytes + 12) fail("ZIP AES stored size mismatch");
+    if (method === 0 && compressedSize !== size + (flags & 1 ? 12 : 0)) fail("ZIP stored size mismatch");
+    total += size;
+    number(total, limits.maxTotalBytes, "total byte");
+    const name = nameFrom(rawName, flags, centralMetadata, limits);
+    if (local + 30 > centralStart || view.getUint32(local, true) !== 67324752) fail("ZIP invalid local header span");
+    if (view.getUint16(local + 4, true) !== version || view.getUint16(local + 6, true) !== flags || view.getUint16(local + 8, true) !== method || view.getUint16(local + 10, true) !== dosTime || view.getUint16(local + 12, true) !== dosDate) fail("ZIP central/local metadata mismatch");
+    const localNameLength = view.getUint16(local + 26, true);
+    const localExtraLength = view.getUint16(local + 28, true);
+    const payloadStart = local + 30 + localNameLength + localExtraLength;
+    zipDiskRecord(profile.disks, local, payloadStart);
+    let payloadEnd = payloadStart + compressedSize;
+    if (payloadEnd > centralStart) fail("ZIP truncated or overlapping local payload");
+    const localName = bytes.subarray(local + 30, local + 30 + localNameLength);
+    if (!equal(rawName, localName)) fail("ZIP central/local filename mismatch");
+    const localExtra = bytes.subarray(local + 30 + localNameLength, payloadStart);
+    const localMetadata = extras(localExtra, localName, comment, false, limits);
+    if (aes ? !localMetadata.aes || aes.version !== localMetadata.aes.version || aes.strength !== localMetadata.aes.strength || aes.method !== localMetadata.aes.method : localMetadata.aes !== void 0) fail("ZIP central/local AES metadata mismatch");
+    const localEffective = nameFrom(localName, flags, localMetadata, limits);
+    if (localMetadata.name !== void 0 && localEffective !== name) fail("ZIP central/local Unicode name mismatch");
+    if (centralMetadata.modified !== void 0 && localMetadata.modified !== void 0 && centralMetadata.modified !== localMetadata.modified) fail("ZIP central/local timestamp mismatch");
+    const rawLocalSize = view.getUint32(local + 22, true);
+    const rawLocalCompressed = view.getUint32(local + 18, true);
+    if (version < 45 && (rawLocalSize === 4294967295 || rawLocalCompressed === 4294967295)) fail("ZIP64 unsupported member extraction version");
+    const [localSize, localCompressed] = zip64Fields(localMetadata.zip64, [rawLocalSize, rawLocalCompressed]);
+    for (const [actual, expected] of [[view.getUint32(local + 14, true), checksum], [localCompressed, compressedSize], [localSize, size]]) {
+      if (actual !== expected && (!(flags & 8) || actual !== 0)) fail("ZIP central/local size or CRC mismatch");
+    }
+    if (flags & 8) {
+      const matches = [];
+      for (const signed of [false, true]) {
+        const descriptor = payloadEnd + (signed ? 4 : 0);
+        const wide = rawLocalSize === 4294967295 || rawLocalCompressed === 4294967295;
+        const length = wide ? 20 : 12;
+        if (descriptor + length > centralStart || signed && view.getUint32(payloadEnd, true) !== 134695760 || view.getUint32(descriptor, true) !== checksum) continue;
+        const compressed = wide ? view.getBigUint64(descriptor + 4, true) : BigInt(view.getUint32(descriptor + 4, true));
+        const expanded = wide ? view.getBigUint64(descriptor + 12, true) : BigInt(view.getUint32(descriptor + 8, true));
+        if (compressed === BigInt(compressedSize) && expanded === BigInt(size)) matches.push(descriptor + length);
+      }
+      if (matches.length !== 1) fail("ZIP truncated, ambiguous or mismatched data descriptor");
+      zipDiskRecord(profile.disks, payloadEnd, matches[0]);
+      payloadEnd = matches[0];
+    }
+    const directory = name.endsWith("/");
+    if (Boolean(externalAttributes & 16) && !directory) fail("ZIP conflicting directory attributes");
+    const mode = attributeMode(versionMadeBy, externalAttributes, directory);
+    const symlink = (mode & 61440) === 40960;
+    const modified = dosModified(dosDate, dosTime);
+    const timestamp = centralMetadata.modified ?? localMetadata.modified;
+    if (timestamp !== void 0) modified.setTime(timestamp);
+    const entry = { name, data: bytes.subarray(payloadStart, payloadStart + compressedSize), size, method, crc32: checksum, modified, mode, directory, symlink, rawName, localName, comment, localExtra, centralExtra, flags, versionMadeBy, internalAttributes, externalAttributes, dosTime, dosDate };
+    if (aes) entry.aes = aes;
+    entryBounds(entry, limits);
+    if (profile.grow) {
+      if (centralMetadata.zip64 || localMetadata.zip64) entry.zip64 = true;
+      growSpans.set(entry, { start: local, end: payloadEnd });
+    }
+    entries.push(entry);
+    spans.push({ start: local, end: payloadEnd });
+    offset = next;
+  }
+  if (offset !== centralEnd) fail("ZIP central directory size or member count mismatch");
+  if (diskMembers !== 65535 && diskMembers !== finalMembers) fail("ZIP inconsistent per-disk member count");
+  if (zip64DiskMembers >= 0 && zip64DiskMembers !== wideDiskMembers) fail("ZIP64 inconsistent per-disk member count");
+  spans.sort((first, second) => first.start - second.start);
+  if (profile.disks && view.getUint32(0, true) !== 134695760) fail("ZIP missing split signature");
+  let covered = profile.disks ? 4 : profile.prefix ? spans[0]?.start ?? centralStart : 0;
+  for (const span of spans) {
+    if (span.start !== covered) fail("ZIP overlapping spans, gaps or self-extracting prefix are unsupported");
+    covered = span.end;
+  }
+  if (covered !== centralStart) fail("ZIP unreferenced local data is unsupported");
+  for (let entryIndex = 0; entryIndex < entries.length; entryIndex++) {
+    const entry = entries[entryIndex];
+    const span = growSpans.get(entry);
+    if (span) {
+      const record = new Uint8Array(span.end - span.start);
+      await copyBytes(bytes.subarray(span.start, span.end), record, 0, chunkSize, signal);
+      zipGrowRecords.set(entry, record);
+    }
+    const data = new Uint8Array(entry.data.length);
+    await copyBytes(entry.data, data, 0, chunkSize, signal);
+    entry.data = data;
+    entry.rawName = new Uint8Array(entry.rawName);
+    entry.localName = new Uint8Array(entry.localName);
+    entry.comment = new Uint8Array(entry.comment);
+    entry.localExtra = new Uint8Array(entry.localExtra);
+    entry.centralExtra = new Uint8Array(entry.centralExtra);
+    if (entryIndex > 0 && (entryIndex & 63) === 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+  }
+  return { entries, comment: new Uint8Array(bytes.subarray(end + 22)), ...profile.prefix ? { prefix: new Uint8Array(bytes.subarray(0, spans[0]?.start ?? centralStart)) } : {} };
+}
+async function* decodeZipEntry(entry, limits, signal, password) {
+  if (!entry.aes) {
+    yield* decodeZipContent(entry, limits, signal, password);
+    return;
+  }
+  admit(limits, signal);
+  entryBounds(entry, limits);
+  if (password === void 0) fail("ZIP password required");
+  const available = limits.maxBufferedFileBytes - entry.data.length * 2;
+  if (available < entry.size * 2) fail("ZIP AES authenticated staging limit exceeded");
+  const plaintext = await decryptAesPayload(entry.data, password, entry.aes, available, signal);
+  let verified;
+  try {
+    verified = await collectBytes(decodeZipContent(entry, limits, signal, password, plaintext), { ...Number.isFinite(Math.floor((available - plaintext.length) / 2)) ? { maxBytes: Math.floor((available - plaintext.length) / 2) } : {}, signal });
+    yield* wireChunks(verified, Math.min(limits.chunkSize, 65536), signal);
+  } finally {
+    plaintext.fill(0);
+    verified?.fill(0);
+  }
+}
+async function* decodeZipContent(entry, limits, signal, password, authenticated) {
+  const chunkSize = admit(limits, signal);
+  entryBounds(entry, limits);
+  if (entry.flags & 1 && password === void 0) fail("ZIP password required");
+  const input = (async function* () {
+    yield authenticated ?? entry.data;
+  })();
+  const decrypted = authenticated === void 0 && entry.flags & 1 ? decryptZipPayload(input, password, entry.flags & 8 ? (entry.dosTime ?? 0) >>> 8 : entry.crc32 >>> 24, signal) : input;
+  const reader = new CodecReader(decrypted, signal);
+  let length = 0;
+  let checksum = 0;
+  const method = entry.aes?.method ?? entry.method;
+  const source = method === 14 ? zipLzma(reader, signal, { decode: true, level: 1, eos: Boolean(entry.flags & 2), size: entry.size }) : method === 12 ? boundedCodec(reader, { format: "bzip2", decompress: true, level: 9, singleMember: true }, signal) : method === 8 ? codec(reader, { mode: "inflate-raw", chunkSize }, signal) : (async function* () {
+    for (; ; ) {
+      const chunk = await reader.chunk();
+      if (chunk === void 0) break;
+      yield new Uint8Array(chunk);
+      await yieldTurn(signal);
+    }
+  })();
+  try {
+    for await (const chunk of source) {
+      signal.throwIfAborted();
+      length += chunk.length;
+      number(length, Math.min(limits.maxEntryBytes, limits.maxTotalBytes, method === 14 ? entry.size : Number.MAX_SAFE_INTEGER), "decoded byte");
+      checksum = crc32(chunk, checksum);
+      yield chunk;
+    }
+    if (method !== 0 && await reader.chunk() !== void 0) fail("ZIP trailing compressed data");
+    if (length !== entry.size) fail("ZIP uncompressed size mismatch");
+    if (entry.aes?.version !== 2 && checksum !== entry.crc32) fail("ZIP CRC32 mismatch");
+  } finally {
+    await reader.close();
+  }
+}
+async function makeZipEntry(name, bytes, attributes, limits, signal, level = 6, forceCompression = false, method = "deflate") {
+  const chunkSize = admit(limits, signal);
+  const entry = { name, data: bytes, size: bytes.length, method: 0, crc32: 0, ...attributes, modified: new Date(attributes.modified.getTime()) };
+  entryBounds(entry, limits);
+  let textual = false;
+  let binary = false;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    if (level !== 0 && !entry.directory && !entry.symlink) {
+      for (let index = offset; index < Math.min(bytes.length, offset + chunkSize); index++) {
+        const byte = bytes[index];
+        if (byte <= 6 || byte >= 14 && byte <= 25 || byte >= 28 && byte <= 31) binary = true;
+        else if (byte === 9 || byte === 10 || byte === 13 || byte >= 32) textual = true;
+      }
+    }
+    entry.crc32 = crc32(bytes.subarray(offset, offset + chunkSize), entry.crc32);
+    if (offset + chunkSize < bytes.length) await yieldTurn(signal);
+    else signal.throwIfAborted();
+  }
+  if (level !== 0 && !entry.directory && !entry.symlink) entry.internalAttributes = !binary && textual ? 1 : 0;
+  const reader = new CodecReader((async function* () {
+    yield bytes;
+  })(), signal);
+  try {
+    if (level !== 0 && (bytes.length || forceCompression) && !entry.directory && !entry.symlink) {
+      const chunks = [];
+      let length = 0;
+      const source = method === "lzma" ? zipLzma(reader, signal, { decode: false, level, eos: true, size: bytes.length }) : method === "bzip2" ? boundedCodec(reader, { format: "bzip2", decompress: false, level }, signal) : codec(reader, { mode: "deflate-raw", chunkSize, level }, signal);
+      for await (const chunk of source) {
+        length += chunk.length;
+        if (length > limits.maxArchiveBytes) fail("ZIP compressed byte limit exceeded");
+        if (!forceCompression && length >= bytes.length) break;
+        chunks.push(new Uint8Array(chunk));
+      }
+      if (forceCompression || length < bytes.length) {
+        entry.data = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+          entry.data.set(chunk, offset);
+          offset += chunk.length;
+          if (offset < length) await yieldTurn(signal);
+          else signal.throwIfAborted();
+        }
+        entry.method = method === "lzma" ? 14 : method === "bzip2" ? 12 : 8;
+        if (entry.method === 14) entry.flags = 2050;
+        return entry;
+      }
+    }
+    entry.data = new Uint8Array(bytes.length);
+    await copyBytes(bytes, entry.data, 0, chunkSize, signal);
+    return entry;
+  } finally {
+    await reader.close();
+  }
+}
+function timestampExtra(modified) {
+  const seconds = Math.floor(modified.getTime() / 1e3);
+  if (seconds < -2147483648 || seconds > 2147483647) return new Uint8Array();
+  const bytes = new Uint8Array(9);
+  const view = new DataView(bytes.buffer);
+  view.setUint16(0, 21589, true);
+  view.setUint16(2, 5, true);
+  bytes[4] = 1;
+  view.setInt32(5, seconds, true);
+  return bytes;
+}
+function updateZipExtras(entry, previous, mode, limits) {
+  const fresh = mode === "strip" ? new Uint8Array() : timestampExtra(entry.modified);
+  const retained = [];
+  for (const [original, central] of [[previous?.localExtra, false], [previous?.centralExtra, true]]) {
+    const fields = [];
+    let length = fresh.length;
+    if (mode === "all" && original) {
+      extras(original, previous.rawName ?? pathBytes(previous.name, limits), previous.comment ?? new Uint8Array(), central, limits);
+      const view = new DataView(original.buffer, original.byteOffset, original.byteLength);
+      for (let offset2 = 0; offset2 < original.length; ) {
+        const identifier = view.getUint16(offset2, true);
+        const next = offset2 + 4 + view.getUint16(offset2 + 2, true);
+        if (identifier !== 1 && identifier !== 39169 && identifier !== 21589 && identifier !== 28789 && identifier !== 25461) {
+          fields.push(original.subarray(offset2, next));
+          length += next - offset2;
+        }
+        offset2 = next;
+      }
+    }
+    number(length, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const field of fields) {
+      bytes.set(field, offset);
+      offset += field.length;
+    }
+    bytes.set(fresh, offset);
+    retained.push(bytes);
+  }
+  return { ...entry, localExtra: retained[0], centralExtra: retained[1] };
+}
+function setZipEntryComment(entry, comment, limits) {
+  number(comment.length, Math.min(limits.maxTextBytes, 65535), "entry comment");
+  let flags = entry.flags ?? 2048;
+  if (flags & 2048) {
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(comment);
+    } catch {
+      flags &= ~2048;
+    }
+  }
+  const rawName = entry.rawName ?? pathBytes(entry.name, limits);
+  const needUnicodePath = !(flags & 2048) && legacyName(rawName) !== entry.name;
+  const metadata = [];
+  for (const [original, central] of [[entry.localExtra ?? timestampExtra(entry.modified), false], [entry.centralExtra ?? timestampExtra(entry.modified), true]]) {
+    extras(original, rawName, entry.comment ?? new Uint8Array(), central, limits);
+    const fields = [];
+    const view = new DataView(original.buffer, original.byteOffset, original.byteLength);
+    for (let offset = 0; offset < original.length; ) {
+      const identifier = view.getUint16(offset, true);
+      const next = offset + 4 + view.getUint16(offset + 2, true);
+      if (identifier !== 25461 && !(needUnicodePath && identifier === 28789)) fields.push(original.subarray(offset, next));
+      offset = next;
+    }
+    if (needUnicodePath) {
+      const name = pathBytes(entry.name, limits);
+      const field = new Uint8Array(9 + name.length);
+      const header = new DataView(field.buffer);
+      header.setUint16(0, 28789, true);
+      header.setUint16(2, 5 + name.length, true);
+      field[4] = 1;
+      header.setUint32(5, crc32(rawName), true);
+      field.set(name, 9);
+      fields.push(field);
+    }
+    const rebuilt = concatBytes(fields);
+    number(rebuilt.length, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    metadata.push(rebuilt);
+  }
+  return { ...entry, comment: new Uint8Array(comment), flags, localExtra: metadata[0], centralExtra: metadata[1] };
+}
+async function* streamZipArchive(archive, limits, signal, descriptors = false, forceZip64 = false, allowZip64 = true) {
+  const chunkSize = admit(limits, signal);
+  if (archive.entries.some((entry) => entry.encryption?.aes && !entry.directory)) {
+    number(archive.entries.length, limits.maxMembers, "member");
+    if (archive.entries.length > limits.maxPatternSteps) fail("ZIP archive work limit exceeded");
+    const entries = [];
+    let total2 = 0;
+    let stagedBytes = 0;
+    let retained = archive.entries.reduce((sum, entry) => sum + entry.data.length, 0);
+    number(retained, limits.maxArchiveBytes, "compressed byte");
+    for (const original of archive.entries) {
+      await yieldTurn(signal);
+      total2 += original.source ? 0 : original.size;
+      number(total2, limits.maxTotalBytes, "total byte");
+      if (!original.encryption?.aes || original.directory) {
+        entries.push(original);
+        continue;
+      }
+      entryBounds(original, limits);
+      const aes = { ...original.encryption.aes };
+      aesParameters(aes);
+      const maximum = Math.floor((limits.maxBufferedFileBytes - 28) / 6);
+      if (maximum < 0) fail("ZIP AES authenticated staging limit exceeded");
+      let entry = original;
+      if (original.source) {
+        const plaintext = await collectBytes(original.source, { ...Number.isFinite(Math.min(maximum, limits.maxEntryBytes, limits.maxTotalBytes - total2)) ? { maxBytes: Math.min(maximum, limits.maxEntryBytes, limits.maxTotalBytes - total2) } : {}, signal });
+        total2 += plaintext.length;
+        try {
+          if (original.expectedSize !== void 0 && plaintext.length !== original.expectedSize) fail("ZIP live input size mismatch");
+          const made = await makeZipEntry(original.name, plaintext, { modified: original.modified, mode: original.mode, directory: original.directory, symlink: original.symlink }, limits, signal, original.method === 0 ? 0 : original.level ?? 6, original.method !== 0, original.method === 14 ? "lzma" : original.method === 12 ? "bzip2" : "deflate");
+          entry = { ...original, ...made };
+          delete entry.source;
+          delete entry.expectedSize;
+        } finally {
+          plaintext.fill(0);
+        }
+      }
+      if (entry.data.length > maximum || entry.size > maximum) fail("ZIP AES authenticated staging limit exceeded");
+      const overhead = aesParameters(aes).saltBytes + 12;
+      retained += entry.data.length + overhead - original.data.length;
+      number(retained, limits.maxArchiveBytes, "encrypted byte");
+      const data = await encryptAesPayload((async function* () {
+        yield entry.data;
+      })(), { ...original.encryption, aes }, maximum, signal);
+      stagedBytes += data.length;
+      if (original.source) {
+        original.size = entry.size;
+        original.compressedSize = data.length;
+        original.crc32 = entry.crc32;
+        if (entry.internalAttributes !== void 0) original.internalAttributes = entry.internalAttributes;
+      }
+      const extra = aesExtra(aes, entry.method);
+      const append = (bytes2) => {
+        const joined = new Uint8Array(bytes2.length + extra.length);
+        joined.set(bytes2);
+        joined.set(extra, bytes2.length);
+        return joined;
+      };
+      const encrypted = {
+        ...entry,
+        data,
+        aes: { ...aes, method: entry.method },
+        method: 99,
+        crc32: aes.version === 2 ? 0 : entry.crc32,
+        flags: ((entry.flags ?? 2048) | 1) & ~6 | (descriptors || original.descriptors ? 8 : 0),
+        localExtra: append(entry.localExtra ?? timestampExtra(entry.modified)),
+        centralExtra: append(entry.centralExtra ?? timestampExtra(entry.modified))
+      };
+      delete encrypted.encryption;
+      entries.push(encrypted);
+    }
+    yield* streamZipArchive({ ...archive, entries, ...archive.onRetention ? { onRetention: (counters) => archive.onRetention({ ...counters, payloadBytes: counters.payloadBytes + stagedBytes }) } : {} }, limits, signal, descriptors, forceZip64, allowZip64);
+    return;
+  }
+  if (archive.entries.some((entry) => entry.encryption && !entry.source && !entry.directory)) {
+    const entries = [];
+    for (const original of archive.entries) {
+      if (!original.encryption || original.source || original.directory) {
+        entries.push(original);
+        continue;
+      }
+      entryBounds(original, limits);
+      number(original.data.length + 12, limits.maxArchiveBytes, "encrypted byte");
+      const rounded = new Date(Math.ceil(Math.floor(original.modified.getTime() / 1e3) / 2) * 2e3);
+      const time = original.dosTime ?? rounded.getHours() << 11 | rounded.getMinutes() << 5 | rounded.getSeconds() >>> 1;
+      const descriptor = descriptors || original.descriptors === true;
+      const data = await collectBytes(encryptZipPayload((async function* () {
+        yield original.data;
+      })(), original.encryption, descriptor ? time >>> 8 : original.crc32 >>> 24, signal), { ...Number.isFinite(limits.maxArchiveBytes) ? { maxBytes: limits.maxArchiveBytes } : {}, signal });
+      const entry = { ...original, data, dosTime: time, flags: (original.flags ?? 2048) | 1 | (descriptor ? 8 : 0) };
+      delete entry.encryption;
+      entries.push(entry);
+    }
+    yield* streamZipArchive({ ...archive, entries }, limits, signal, descriptors, forceZip64, allowZip64);
+    return;
+  }
+  number(archive.entries.length, limits.maxMembers, "member");
+  number(archive.comment.length, Math.min(limits.maxTextBytes, 65535), "archive comment");
+  const wideProfile = (entry) => {
+    const required = Math.max(entry.size, entry.data.length, entry.expectedSize ?? 0) >= 4294967295;
+    const unknown = entry.source !== void 0 && entry.zip64 !== false && allowZip64 && (entry.expectedSize === void 0 && limits.maxEntryBytes >= 4294967295 || entry.method !== 0 && limits.maxArchiveBytes >= 4294967295);
+    return forceZip64 || entry.zip64 === true || required || unknown;
+  };
+  let wideArchive = archive.entries.length >= 65535 || forceZip64 || archive.entries.some(wideProfile);
+  if (wideArchive && !allowZip64) fail("ZIP64 required but disabled");
+  let length = 22 + archive.comment.length + (wideArchive ? 76 : 0);
+  number(length, limits.maxArchiveBytes, "archive byte");
+  let localLength = 0;
+  let total = 0;
+  let metadataBytes = 0;
+  let work = 0;
+  const encoded = [];
+  await yieldTurn(signal);
+  for (const entry of archive.entries) {
+    if (++work > limits.maxPatternSteps) fail("ZIP archive work limit exceeded");
+    if ((work & 63) === 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+    entryBounds(entry, limits);
+    if (!entry.source && entry.method === 0 && entry.data.length !== entry.size + (entry.flags & 1 ? 12 : 0)) fail("ZIP stored size mismatch");
+    if (entry.source && (entry.data.length || entry.directory || entry.symlink)) fail("ZIP invalid live source profile");
+    if (entry.expectedSize !== void 0) number(entry.expectedSize, Math.min(limits.maxEntryBytes, limits.maxTotalBytes), "expected input byte");
+    if (entry.source) number(entry.level ?? 6, 9, "compression level");
+    total += entry.source ? 0 : entry.size;
+    number(total, limits.maxTotalBytes, "total byte");
+    const rawName = entry.rawName ?? pathBytes(entry.name, limits);
+    const descriptor = entry.flags & 1 || zipGrowRecords.has(entry) ? Boolean(entry.flags & 8) : (entry.source !== void 0 || descriptors || entry.descriptors === true) && !entry.directory;
+    const flags = (entry.flags ?? (entry.method === 14 ? 2050 : 2048)) & ~8 | (descriptor ? 8 : 0) | (entry.encryption && !entry.directory ? 1 : 0) | (entry.source && entry.method === 14 ? 2 : 0);
+    const comment = entry.comment ?? new Uint8Array();
+    number(comment.length, Math.min(limits.maxTextBytes, 65535), "entry comment");
+    if (flags & 2048) text(comment);
+    const originalLocalExtra = entry.localExtra ?? timestampExtra(entry.modified);
+    const originalLocalMetadata = extras(originalLocalExtra, rawName, comment, false, limits);
+    const wide = wideProfile(entry);
+    if (wide && (!allowZip64 || !forceZip64 && entry.zip64 === false)) fail("ZIP64 required but disabled");
+    const member = zip64Member(entry.size, entry.data.length, localLength, forceZip64 || entry.zip64 === true, allowZip64 && (forceZip64 || entry.zip64 !== false), wide && descriptor);
+    const originalCentralExtra = entry.centralExtra ?? timestampExtra(entry.modified);
+    const originalCentralMetadata = extras(originalCentralExtra, rawName, comment, true, limits);
+    const record = forceZip64 ? void 0 : zipGrowRecords.get(entry);
+    const localValues = descriptor && wide ? (entry.method === 12 || entry.method === 14) && !entry.source ? [entry.size, entry.data.length] : [0, 0] : [entry.size, entry.data.length].filter((value) => forceZip64 || entry.zip64 === true || value >= 4294967295);
+    const localExtraSize = record ? originalLocalExtra.length : originalLocalExtra.length - (originalLocalMetadata.zip64 ? originalLocalMetadata.zip64.length + 4 : 0) + (localValues.length ? 4 + localValues.length * 8 : 0);
+    const centralExtraSize = originalCentralExtra.length - (originalCentralMetadata.zip64 ? originalCentralMetadata.zip64.length + 4 : 0) + (member.values.length ? 4 + member.values.length * 8 : 0);
+    number(localExtraSize, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    number(centralExtraSize, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    const retainedSize = record ? record.length + 46 + rawName.length + centralExtraSize + comment.length : 76 + 2 * rawName.length + localExtraSize + centralExtraSize + comment.length + entry.data.length + (descriptor ? wide ? 24 : 16 : 0);
+    number(length + retainedSize, limits.maxArchiveBytes, "archive byte");
+    const localExtra = record ? originalLocalExtra : localValues.length ? zip64Extra(localValues, stripZip64(originalLocalExtra)) : stripZip64(originalLocalExtra);
+    const centralExtra = member.values.length ? zip64Extra(member.values, stripZip64(originalCentralExtra)) : stripZip64(originalCentralExtra);
+    const localMetadata = extras(localExtra, rawName, comment, false, limits);
+    const centralMetadata = extras(centralExtra, rawName, comment, true, limits);
+    if (entry.aes ? !localMetadata.aes || !centralMetadata.aes || [localMetadata.aes, centralMetadata.aes].some((aes) => aes.version !== entry.aes.version || aes.strength !== entry.aes.strength || aes.method !== entry.aes.method) : localMetadata.aes || centralMetadata.aes) fail("ZIP retained AES metadata mismatch");
+    if (nameFrom(rawName, flags, centralMetadata, limits) !== entry.name || localMetadata.name !== void 0 && nameFrom(rawName, flags, localMetadata, limits) !== entry.name || entry.localName && !equal(rawName, entry.localName)) fail("ZIP retained filename metadata mismatch");
+    if (localMetadata.modified !== void 0 && centralMetadata.modified !== void 0 && localMetadata.modified !== centralMetadata.modified) fail("ZIP retained timestamp metadata mismatch");
+    const rounded = new Date(Math.ceil(Math.floor(entry.modified.getTime() / 1e3) / 2) * 2e3);
+    const year = Math.max(1980, Math.min(2107, rounded.getFullYear()));
+    const date = entry.dosDate ?? year - 1980 << 9 | rounded.getMonth() + 1 << 5 | rounded.getDate();
+    const time = entry.dosTime ?? rounded.getHours() << 11 | rounded.getMinutes() << 5 | rounded.getSeconds() >>> 1;
+    number(date, 65535, "DOS date");
+    number(time, 65535, "DOS time");
+    const dosTimestamp = dosModified(date, time);
+    const extendedTimestamp = centralMetadata.modified ?? localMetadata.modified;
+    const timestampMatches = extendedTimestamp === void 0 ? ["getFullYear", "getMonth", "getDate", "getHours", "getMinutes", "getSeconds"].every((field) => dosTimestamp[field]() === rounded[field]()) : Math.floor(extendedTimestamp / 1e3) === Math.floor(entry.modified.getTime() / 1e3);
+    if (!timestampMatches) fail("ZIP retained or unrepresentable timestamp metadata mismatch");
+    for (const [value, maximum, label] of [[entry.versionMadeBy ?? 798, 65535, "creator version"], [entry.internalAttributes ?? 0, 65535, "internal attributes"], [entry.externalAttributes ?? 0, 4294967295, "external attributes"]]) number(value, maximum, label);
+    if ((entry.internalAttributes ?? 0) & ~1) fail("ZIP unsupported internal attributes");
+    if (entry.externalAttributes !== void 0) {
+      const mode = attributeMode(entry.versionMadeBy ?? 798, entry.externalAttributes, entry.directory);
+      if (mode !== entry.mode || Boolean(entry.externalAttributes & 16) && !entry.directory) fail("ZIP retained file attributes mismatch");
+    }
+    metadataBytes += 76 + 2 * rawName.length + localExtra.length + centralExtra.length + comment.length;
+    number(metadataBytes, limits.maxArchiveBytes, "metadata byte");
+    const localSize = record?.length ?? 30 + rawName.length + localExtra.length + entry.data.length + (descriptor ? wide ? 24 : 16 : 0);
+    length += localSize + 46 + rawName.length + centralExtra.length + comment.length;
+    number(length, limits.maxArchiveBytes, "archive byte");
+    const metadata = { ...entry, data: new Uint8Array() };
+    delete metadata.source;
+    delete metadata.encryption;
+    const item = { entry: metadata, rawName, wide, flags, localExtra, centralExtra, comment, date, time, offset: localLength, compressedSize: entry.data.length };
+    encoded.push(item);
+    archive.onRetention?.({ metadataBytes, payloadBytes: 0 });
+    localLength += localSize;
+  }
+  const plannedCentralSize = length - (22 + archive.comment.length + (wideArchive ? 76 : 0)) - localLength;
+  if (!wideArchive && (localLength >= 4294967295 || plannedCentralSize >= 4294967295)) {
+    if (!allowZip64) fail("ZIP64 required but disabled");
+    number(length + 76, limits.maxArchiveBytes, "archive byte");
+    length += 76;
+    wideArchive = true;
+  }
+  const refreshCentral = (item, size, compressed, offset) => {
+    const member = zip64Member(size, compressed, offset, forceZip64 || item.entry.zip64 === true, allowZip64 && (forceZip64 || item.entry.zip64 !== false), item.wide && Boolean(item.flags & 8));
+    const retained = stripZip64(item.centralExtra);
+    const extraSize = retained.length + (member.values.length ? 4 + member.values.length * 8 : 0);
+    number(extraSize, Math.min(limits.maxPaxBytes, 65535), "extra field");
+    const delta = extraSize - item.centralExtra.length;
+    const overhead = !wideArchive && member.wide ? 76 : 0;
+    number(length + delta + overhead, limits.maxArchiveBytes, "archive byte");
+    length += delta + overhead;
+    metadataBytes += delta;
+    wideArchive ||= member.wide;
+    item.centralExtra = member.values.length ? zip64Extra(member.values, retained) : retained;
+  };
+  localLength = 0;
+  for (const [index, item] of encoded.entries()) {
+    const entry = archive.entries[index];
+    const { rawName, wide, flags, localExtra, date, time } = item;
+    const descriptor = Boolean(flags & 8);
+    item.offset = localLength;
+    refreshCentral(item, entry.size, entry.data.length, localLength);
+    if (index > 0 && (index & 63) === 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+    const record = forceZip64 ? void 0 : zipGrowRecords.get(entry);
+    if (record) {
+      yield* wireChunks(record, chunkSize, signal);
+      localLength += record.length;
+      continue;
+    }
+    const offset = 0;
+    const bytes2 = new Uint8Array(30 + rawName.length + localExtra.length);
+    const view = new DataView(bytes2.buffer);
+    const version = entry.method === 14 ? 63 : entry.method === 99 ? 51 : entry.method === 12 ? 46 : wide || item.offset >= 4294967295 ? 45 : entry.method === 8 || flags & 9 ? 20 : 10;
+    view.setUint32(offset, 67324752, true);
+    view.setUint16(offset + 4, version, true);
+    view.setUint16(offset + 6, flags, true);
+    view.setUint16(offset + 8, entry.method, true);
+    view.setUint16(offset + 10, time, true);
+    view.setUint16(offset + 12, date, true);
+    const knownCompressedSpan = (entry.method === 12 || entry.method === 14) && !entry.source;
+    view.setUint32(offset + 14, flags & 8 && !knownCompressedSpan ? 0 : entry.crc32, true);
+    view.setUint32(offset + 18, wide && (descriptor || forceZip64 || entry.zip64 === true || entry.data.length >= 4294967295) ? 4294967295 : flags & 8 && !knownCompressedSpan ? 0 : entry.data.length, true);
+    view.setUint32(offset + 22, wide && (descriptor || forceZip64 || entry.zip64 === true || entry.size >= 4294967295) ? 4294967295 : flags & 8 && !knownCompressedSpan ? 0 : entry.size, true);
+    view.setUint16(offset + 26, rawName.length, true);
+    view.setUint16(offset + 28, localExtra.length, true);
+    bytes2.set(rawName, offset + 30);
+    bytes2.set(localExtra, offset + 30 + rawName.length);
+    yield* wireChunks(bytes2, chunkSize, signal);
+    if (entry.source) {
+      let size = 0;
+      let checksum = 0;
+      let textual = false;
+      let binary = false;
+      let previousSlab = 0;
+      const measured = (async function* () {
+        for await (const chunk of readBytes(entry.source, signal)) {
+          if (chunk.length === 0) {
+            if (++work > limits.maxPatternSteps) fail("ZIP archive work limit exceeded");
+            await yieldTurn(signal);
+            continue;
+          }
+          number(size + chunk.length, Math.min(limits.maxEntryBytes, limits.maxTotalBytes - total, entry.expectedSize ?? Number.MAX_SAFE_INTEGER), "input byte");
+          if (!wide) number(size + chunk.length, 4294967294, "classic input byte");
+          if (entry.method === 0) {
+            const overhead = !wideArchive && localLength + bytes2.length + item.compressedSize + chunk.length + (descriptor ? wide ? 24 : 16 : 0) >= 4294967295 ? 76 : 0;
+            number(length + chunk.length + overhead, limits.maxArchiveBytes, "archive byte");
+          }
+          for (let offset2 = 0; offset2 < chunk.length; offset2 += chunkSize) {
+            if (++work > limits.maxPatternSteps) fail("ZIP archive work limit exceeded");
+            const view2 = chunk.subarray(offset2, Math.min(chunk.length, offset2 + chunkSize));
+            size += view2.length;
+            checksum = crc32(view2, checksum);
+            if (entry.method !== 0) for (const byte of view2) {
+              if (byte <= 6 || byte >= 14 && byte <= 25 || byte >= 28 && byte <= 31) binary = true;
+              else if (byte === 9 || byte === 10 || byte === 13 || byte >= 32) textual = true;
+            }
+            archive.onRetention?.({ metadataBytes, payloadBytes: previousSlab + view2.length });
+            previousSlab = view2.length;
+            yield new Uint8Array(view2);
+            await yieldTurn(signal);
+          }
+        }
+        if (entry.expectedSize !== void 0 && size !== entry.expectedSize) fail("ZIP source changed while reading");
+      })();
+      const reader = new CodecReader(measured, signal);
+      const payload = entry.method === 14 ? zipLzma(reader, signal, { decode: false, level: entry.level ?? 6, eos: true, size: entry.expectedSize ?? 0 }) : entry.method === 12 ? boundedCodec(reader, { format: "bzip2", decompress: false, level: entry.level ?? 6 }, signal) : entry.method === 8 ? codec(reader, { mode: "deflate-raw", level: entry.level ?? 6, chunkSize }, signal) : measured;
+      item.compressedSize = 0;
+      try {
+        const wire = entry.encryption ? encryptZipPayload(payload, entry.encryption, time >>> 8, signal) : payload;
+        for await (const chunk of wire) {
+          if (++work > limits.maxPatternSteps) fail("ZIP archive work limit exceeded");
+          if (!wideArchive && localLength + bytes2.length + item.compressedSize + chunk.length + (descriptor ? wide ? 24 : 16 : 0) >= 4294967295) {
+            if (!allowZip64) fail("ZIP64 required but disabled");
+            number(length + chunk.length + 76, limits.maxArchiveBytes, "archive byte");
+            length += 76;
+            wideArchive = true;
+          }
+          number(length + chunk.length, limits.maxArchiveBytes, "archive byte");
+          if (!wide) number(item.compressedSize + chunk.length, 4294967294, "classic compressed byte");
+          length += chunk.length;
+          item.compressedSize += chunk.length;
+          yield chunk;
+          signal.throwIfAborted();
+        }
+      } finally {
+        await reader.close();
+      }
+      total += size;
+      item.entry.size = size;
+      item.entry.crc32 = checksum;
+      if (entry.method !== 0) item.entry.internalAttributes = !binary && textual ? 1 : 0;
+      refreshCentral(item, size, item.compressedSize, item.offset);
+      archive.onRetention?.({ metadataBytes, payloadBytes: 0 });
+      entry.size = size;
+      entry.crc32 = checksum;
+      entry.compressedSize = item.compressedSize;
+      if (item.entry.internalAttributes !== void 0) entry.internalAttributes = item.entry.internalAttributes;
+    } else yield* wireChunks(entry.data, chunkSize, signal);
+    localLength += bytes2.length + item.compressedSize + (descriptor ? wide ? 24 : 16 : 0);
+    if (flags & 8) {
+      const bytes3 = zipDescriptor(item.entry.crc32, item.compressedSize, item.entry.size, wide);
+      yield* wireChunks(bytes3, chunkSize, signal);
+    }
+  }
+  let centralSize = 0;
+  for (const [index, item] of encoded.entries()) {
+    if (index > 0 && (index & 63) === 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+    const { entry, rawName, wide, flags, centralExtra, comment, date, time, offset } = item;
+    const member = zip64Member(entry.size, item.compressedSize, offset, forceZip64 || entry.zip64 === true, allowZip64 && (forceZip64 || entry.zip64 !== false), wide && Boolean(flags & 8));
+    const record = forceZip64 ? void 0 : zipGrowRecords.get(archive.entries[index]);
+    const version = record ? new DataView(record.buffer, record.byteOffset, record.byteLength).getUint16(4, true) : entry.method === 14 ? 63 : entry.method === 99 ? 51 : entry.method === 12 ? 46 : wide || member.wide ? 45 : entry.method === 8 || flags & 9 ? 20 : 10;
+    const central = 0;
+    const bytes2 = new Uint8Array(46 + rawName.length + centralExtra.length + comment.length);
+    const view = new DataView(bytes2.buffer);
+    view.setUint32(central, 33639248, true);
+    view.setUint16(central + 4, entry.versionMadeBy ?? 798, true);
+    view.setUint16(central + 6, version, true);
+    view.setUint16(central + 8, flags, true);
+    view.setUint16(central + 10, entry.method, true);
+    view.setUint16(central + 12, time, true);
+    view.setUint16(central + 14, date, true);
+    view.setUint32(central + 16, entry.crc32, true);
+    view.setUint32(central + 20, member.compressed, true);
+    view.setUint32(central + 24, member.size, true);
+    view.setUint16(central + 28, rawName.length, true);
+    view.setUint16(central + 30, centralExtra.length, true);
+    view.setUint16(central + 32, comment.length, true);
+    view.setUint16(central + 36, entry.internalAttributes ?? 0, true);
+    const mode = entry.mode & 61440 ? entry.mode : entry.mode | (entry.directory ? 16384 : entry.symlink ? 40960 : 32768);
+    view.setUint32(central + 38, entry.externalAttributes ?? mode * 65536 + (entry.directory ? 16 : 0), true);
+    view.setUint32(central + 42, member.offset, true);
+    bytes2.set(rawName, central + 46);
+    bytes2.set(centralExtra, central + 46 + rawName.length);
+    bytes2.set(comment, central + 46 + rawName.length + centralExtra.length);
+    centralSize += bytes2.length;
+    yield* wireChunks(bytes2, chunkSize, signal);
+  }
+  number(localLength + centralSize + 22 + archive.comment.length + (wideArchive || centralSize >= 4294967295 || localLength >= 4294967295 ? 76 : 0), limits.maxArchiveBytes, "archive byte");
+  const bytes = zipEnd(encoded.length, centralSize, localLength, archive.comment, wideArchive, allowZip64);
+  yield* wireChunks(bytes, chunkSize, signal);
+}
+async function* wireChunks(bytes, chunkSize, signal) {
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    if (offset > 0) await yieldTurn(signal);
+    else signal.throwIfAborted();
+    yield new Uint8Array(bytes.subarray(offset, Math.min(bytes.length, offset + chunkSize)));
+    signal.throwIfAborted();
+  }
+}
+async function writeZipArchive(archive, limits, signal, descriptors = false, forceZip64 = false, allowZip64 = true) {
+  return collectBytes(streamZipArchive(archive, limits, signal, descriptors, forceZip64, allowZip64), { ...Number.isFinite(limits.maxArchiveBytes) ? { maxBytes: limits.maxArchiveBytes } : {}, signal });
+}
+
+export {
+  crc32,
+  readZipArchive,
+  decodeZipEntry,
+  makeZipEntry,
+  updateZipExtras,
+  setZipEntryComment,
+  streamZipArchive,
+  writeZipArchive
+};