@push.rocks/smartarchive 5.2.3 → 5.3.0

package/dist_ts_shared/errors.d.ts

@@ -23,6 +23,31 @@ export declare class ArchiveFormatError extends SmartArchiveError {
 export declare class StreamError extends SmartArchiveError {
     constructor(message: string);
 }
+/**
+ * Stable ZIP error codes for bounded selective extraction
+ */
+export declare const ZIP_ERROR_CODES: {
+    readonly INVALID_LIMIT: "ZIP_INVALID_LIMIT";
+    readonly INVALID_ARCHIVE: "ZIP_INVALID_ARCHIVE";
+    readonly UNSUPPORTED_FEATURE: "ZIP_UNSUPPORTED_FEATURE";
+    readonly ARCHIVE_SIZE_LIMIT: "ZIP_ARCHIVE_SIZE_LIMIT";
+    readonly ENTRY_COUNT_LIMIT: "ZIP_ENTRY_COUNT_LIMIT";
+    readonly SELECTED_ENTRY_COUNT_LIMIT: "ZIP_SELECTED_ENTRY_COUNT_LIMIT";
+    readonly COMPRESSED_SIZE_LIMIT: "ZIP_COMPRESSED_SIZE_LIMIT";
+    readonly UNCOMPRESSED_SIZE_LIMIT: "ZIP_UNCOMPRESSED_SIZE_LIMIT";
+    readonly TOTAL_UNCOMPRESSED_SIZE_LIMIT: "ZIP_TOTAL_UNCOMPRESSED_SIZE_LIMIT";
+    readonly DUPLICATE_SELECTED_PATH: "ZIP_DUPLICATE_SELECTED_PATH";
+    readonly COMPRESSED_SIZE_MISMATCH: "ZIP_COMPRESSED_SIZE_MISMATCH";
+    readonly UNCOMPRESSED_SIZE_MISMATCH: "ZIP_UNCOMPRESSED_SIZE_MISMATCH";
+    readonly CRC_MISMATCH: "ZIP_CRC_MISMATCH";
+};
+export type TZipErrorCode = typeof ZIP_ERROR_CODES[keyof typeof ZIP_ERROR_CODES];
+/**
+ * ZIP-specific extraction error
+ */
+export declare class ZipError extends SmartArchiveError {
+    constructor(message: string, code: TZipErrorCode);
+}
 /**
  * BZIP2 error codes for programmatic error handling
  */

package/dist_ts_shared/errors.js

@@ -39,6 +39,33 @@ export class StreamError extends SmartArchiveError {
         this.name = 'StreamError';
     }
 }
+/**
+ * Stable ZIP error codes for bounded selective extraction
+ */
+export const ZIP_ERROR_CODES = {
+    INVALID_LIMIT: 'ZIP_INVALID_LIMIT',
+    INVALID_ARCHIVE: 'ZIP_INVALID_ARCHIVE',
+    UNSUPPORTED_FEATURE: 'ZIP_UNSUPPORTED_FEATURE',
+    ARCHIVE_SIZE_LIMIT: 'ZIP_ARCHIVE_SIZE_LIMIT',
+    ENTRY_COUNT_LIMIT: 'ZIP_ENTRY_COUNT_LIMIT',
+    SELECTED_ENTRY_COUNT_LIMIT: 'ZIP_SELECTED_ENTRY_COUNT_LIMIT',
+    COMPRESSED_SIZE_LIMIT: 'ZIP_COMPRESSED_SIZE_LIMIT',
+    UNCOMPRESSED_SIZE_LIMIT: 'ZIP_UNCOMPRESSED_SIZE_LIMIT',
+    TOTAL_UNCOMPRESSED_SIZE_LIMIT: 'ZIP_TOTAL_UNCOMPRESSED_SIZE_LIMIT',
+    DUPLICATE_SELECTED_PATH: 'ZIP_DUPLICATE_SELECTED_PATH',
+    COMPRESSED_SIZE_MISMATCH: 'ZIP_COMPRESSED_SIZE_MISMATCH',
+    UNCOMPRESSED_SIZE_MISMATCH: 'ZIP_UNCOMPRESSED_SIZE_MISMATCH',
+    CRC_MISMATCH: 'ZIP_CRC_MISMATCH',
+};
+/**
+ * ZIP-specific extraction error
+ */
+export class ZipError extends SmartArchiveError {
+    constructor(message, code) {
+        super(message, code);
+        this.name = 'ZipError';
+    }
+}
 /**
  * BZIP2 error codes for programmatic error handling
  */
@@ -59,4 +86,4 @@ export const BZIP2_ERROR_CODES = {
 export function throwBzip2Error(message, code) {
     throw new Bzip2Error(message, code);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2hhcmVkL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBRzFDLFlBQVksT0FBZSxFQUFFLElBQVk7UUFDdkMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxtQkFBbUIsQ0FBQztRQUNoQyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQiwrREFBK0Q7UUFDL0QsSUFBSSxLQUFLLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUM1QixLQUFLLENBQUMsaUJBQWlCLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNsRCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sVUFBVyxTQUFRLGlCQUFpQjtJQUMvQyxZQUFZLE9BQWUsRUFBRSxPQUFlLGFBQWE7UUFDdkQsS0FBSyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNyQixJQUFJLENBQUMsSUFBSSxHQUFHLFlBQVksQ0FBQztJQUMzQixDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxrQkFBbUIsU0FBUSxpQkFBaUI7SUFDdkQsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsSUFBSSxHQUFHLG9CQUFvQixDQUFDO0lBQ25DLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFdBQVksU0FBUSxpQkFBaUI7SUFDaEQsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDL0IsSUFBSSxDQUFDLElBQUksR0FBRyxhQUFhLENBQUM7SUFDNUIsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRztJQUMvQixlQUFlLEVBQUUsZ0JBQWdCO0lBQ2pDLGVBQWUsRUFBRSx1QkFBdUI7SUFDeEMsWUFBWSxFQUFFLG9CQUFvQjtJQUNsQyxrQkFBa0IsRUFBRSxxQkFBcUI7SUFDekMsZUFBZSxFQUFFLHVCQUF1QjtJQUN4QyxlQUFlLEVBQUUsdUJBQXVCO0lBQ3hDLGdCQUFnQixFQUFFLHdCQUF3QjtJQUMxQyxnQkFBZ0IsRUFBRSx3QkFBd0I7SUFDMUMsYUFBYSxFQUFFLHFCQUFxQjtDQUM1QixDQUFDO0FBSVg7O0dBRUc7QUFDSCxNQUFNLFVBQVUsZUFBZSxDQUFDLE9BQWUsRUFBRSxJQUFxQjtJQUNwRSxNQUFNLElBQUksVUFBVSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN0QyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2hhcmVkL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBRzFDLFlBQVksT0FBZSxFQUFFLElBQVk7UUFDdkMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxtQkFBbUIsQ0FBQztRQUNoQyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQiwrREFBK0Q7UUFDL0QsSUFBSSxLQUFLLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUM1QixLQUFLLENBQUMsaUJBQWlCLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNsRCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sVUFBVyxTQUFRLGlCQUFpQjtJQUMvQyxZQUFZLE9BQWUsRUFBRSxPQUFlLGFBQWE7UUFDdkQsS0FBSyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNyQixJQUFJLENBQUMsSUFBSSxHQUFHLFlBQVksQ0FBQztJQUMzQixDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxrQkFBbUIsU0FBUSxpQkFBaUI7SUFDdkQsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsSUFBSSxHQUFHLG9CQUFvQixDQUFDO0lBQ25DLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFdBQVksU0FBUSxpQkFBaUI7SUFDaEQsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDL0IsSUFBSSxDQUFDLElBQUksR0FBRyxhQUFhLENBQUM7SUFDNUIsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUc7SUFDN0IsYUFBYSxFQUFFLG1CQUFtQjtJQUNsQyxlQUFlLEVBQUUscUJBQXFCO0lBQ3RDLG1CQUFtQixFQUFFLHlCQUF5QjtJQUM5QyxrQkFBa0IsRUFBRSx3QkFBd0I7SUFDNUMsaUJBQWlCLEVBQUUsdUJBQXVCO0lBQzFDLDBCQUEwQixFQUFFLGdDQUFnQztJQUM1RCxxQkFBcUIsRUFBRSwyQkFBMkI7SUFDbEQsdUJBQXVCLEVBQUUsNkJBQTZCO0lBQ3RELDZCQUE2QixFQUFFLG1DQUFtQztJQUNsRSx1QkFBdUIsRUFBRSw2QkFBNkI7SUFDdEQsd0JBQXdCLEVBQUUsOEJBQThCO0lBQ3hELDBCQUEwQixFQUFFLGdDQUFnQztJQUM1RCxZQUFZLEVBQUUsa0JBQWtCO0NBQ3hCLENBQUM7QUFJWDs7R0FFRztBQUNILE1BQU0sT0FBTyxRQUFTLFNBQVEsaUJBQWlCO0lBQzdDLFlBQVksT0FBZSxFQUFFLElBQW1CO1FBQzlDLEtBQUssQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDLElBQUksR0FBRyxVQUFVLENBQUM7SUFDekIsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRztJQUMvQixlQUFlLEVBQUUsZ0JBQWdCO0lBQ2pDLGVBQWUsRUFBRSx1QkFBdUI7SUFDeEMsWUFBWSxFQUFFLG9CQUFvQjtJQUNsQyxrQkFBa0IsRUFBRSxxQkFBcUI7SUFDekMsZUFBZSxFQUFFLHVCQUF1QjtJQUN4QyxlQUFlLEVBQUUsdUJBQXVCO0lBQ3hDLGdCQUFnQixFQUFFLHdCQUF3QjtJQUMxQyxnQkFBZ0IsRUFBRSx3QkFBd0I7SUFDMUMsYUFBYSxFQUFFLHFCQUFxQjtDQUM1QixDQUFDO0FBSVg7O0dBRUc7QUFDSCxNQUFNLFVBQVUsZUFBZSxDQUFDLE9BQWUsRUFBRSxJQUFxQjtJQUNwRSxNQUFNLElBQUksVUFBVSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN0QyxDQUFDIn0=

package/dist_ts_shared/index.d.ts

@@ -1,6 +1,6 @@
 export * from './interfaces.js';
 export * from './errors.js';
-export { ZipTools, ZipDecompressionTransform } from './classes.ziptools.js';
+export { ZipTools } from './classes.ziptools.js';
 export { GzipTools } from './classes.gziptools.js';
 export { TarTools } from './classes.tartools.js';
 export { Bzip2Tools } from './classes.bzip2tools.js';

package/dist_ts_shared/index.js

@@ -4,11 +4,11 @@ export * from './interfaces.js';
 // Error classes
 export * from './errors.js';
 // Tool classes
-export { ZipTools, ZipDecompressionTransform } from './classes.ziptools.js';
+export { ZipTools } from './classes.ziptools.js';
 export { GzipTools } from './classes.gziptools.js';
 export { TarTools } from './classes.tartools.js';
 export { Bzip2Tools } from './classes.bzip2tools.js';
 // BZIP2 internals (for advanced usage)
 export { unbzip2Stream } from './bzip2/index.js';
 export { Bzip2 } from './bzip2/bzip2.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zaGFyZWQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsNkNBQTZDO0FBRTdDLHVCQUF1QjtBQUN2QixjQUFjLGlCQUFpQixDQUFDO0FBRWhDLGdCQUFnQjtBQUNoQixjQUFjLGFBQWEsQ0FBQztBQUU1QixlQUFlO0FBQ2YsT0FBTyxFQUFFLFFBQVEsRUFBRSx5QkFBeUIsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQzVFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNuRCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDakQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXJELHVDQUF1QztBQUN2QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDakQsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zaGFyZWQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsNkNBQTZDO0FBRTdDLHVCQUF1QjtBQUN2QixjQUFjLGlCQUFpQixDQUFDO0FBRWhDLGdCQUFnQjtBQUNoQixjQUFjLGFBQWEsQ0FBQztBQUU1QixlQUFlO0FBQ2YsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNuRCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDakQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXJELHVDQUF1QztBQUN2QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDakQsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDIn0=

package/dist_ts_shared/interfaces.d.ts

@@ -69,6 +69,41 @@ export interface IArchiveEntryInfo {
     /** File mode/permissions */
     mode?: number;
 }
+/**
+ * ZIP entry metadata available before selective decompression
+ */
+export interface IZipEntryInfo extends IArchiveEntryInfo {
+    /** Compressed size in bytes */
+    compressedSize: number;
+    /** ZIP compression method from the central directory */
+    compressionMethod: number;
+}
+/**
+ * Required limits for security-sensitive selective ZIP extraction
+ */
+export interface ISelectiveZipExtractionOptions {
+    /** Select entries using metadata parsed before decompression */
+    filter: (entry: IZipEntryInfo) => boolean;
+    /** Maximum bytes accepted for the complete ZIP archive */
+    maxArchiveBytes: number;
+    /** Maximum number of entries in the complete ZIP archive */
+    maxEntries: number;
+    /** Maximum number of selected entries */
+    maxSelectedEntries: number;
+    /** Maximum compressed bytes for each selected entry */
+    maxCompressedEntryBytes: number;
+    /** Maximum uncompressed bytes for each selected entry */
+    maxUncompressedEntryBytes: number;
+    /** Maximum total uncompressed bytes across selected entries */
+    maxTotalUncompressedBytes: number;
+}
+/**
+ * One entry returned by selective ZIP extraction
+ */
+export interface IExtractedZipEntry {
+    path: string;
+    content: Uint8Array;
+}
 /**
  * Result of archive analysis
  */

package/dist_ts_shared/plugins.ziptools.d.ts

@@ -0,0 +1,3 @@
+import * as fflate from 'fflate';
+import * as pako from 'pako';
+export { fflate, pako };

package/dist_ts_shared/plugins.ziptools.js

@@ -0,0 +1,4 @@
+import * as fflate from 'fflate';
+import * as pako from 'pako';
+export { fflate, pako };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy56aXB0b29scy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NoYXJlZC9wbHVnaW5zLnppcHRvb2xzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMifQ==

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartarchive',
-    version: '5.1.0',
+    version: '5.3.0',
     description: 'A library for working with archive files, providing utilities for compressing and decompressing data.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsMEJBQTBCO0lBQ2hDLE9BQU8sRUFBRSxPQUFPO0lBQ2hCLFdBQVcsRUFBRSx1R0FBdUc7Q0FDckgsQ0FBQSJ9

package/dist_ts_web/index.d.ts

@@ -1 +1 @@
-export * from '../ts_shared/index.js';
+export * from '../dist_ts_shared/index.js';

package/dist_ts_web/index.js

@@ -1,4 +1,4 @@
 // ts_web - Browser-compatible entry point
 // Re-exports everything from ts_shared
-export * from '../ts_shared/index.js';
+export * from '../dist_ts_shared/index.js';
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c193ZWIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMENBQTBDO0FBQzFDLHVDQUF1QztBQUV2QyxjQUFjLHVCQUF1QixDQUFDIn0=

package/dist_ts_web/plugins.d.ts

@@ -1 +1 @@
-export * from '../ts_shared/plugins.js';
+export * from '../dist_ts_shared/plugins.js';

package/dist_ts_web/plugins.js

@@ -1,4 +1,4 @@
 // Browser-compatible plugins for ts_web
 // Re-export from ts_shared
-export * from '../ts_shared/plugins.js';
+export * from '../dist_ts_shared/plugins.js';
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3dlYi9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLHdDQUF3QztBQUN4QywyQkFBMkI7QUFDM0IsY0FBYyx5QkFBeUIsQ0FBQyJ9

package/dist_ts_web/zip.d.ts

@@ -0,0 +1,3 @@
+export { ZipTools } from '../dist_ts_shared/classes.ziptools.js';
+export { ZIP_ERROR_CODES, ZipError, type TZipErrorCode } from '../dist_ts_shared/errors.js';
+export type { IExtractedZipEntry, ISelectiveZipExtractionOptions, IZipEntryInfo, } from '../dist_ts_shared/interfaces.js';

package/dist_ts_web/zip.js

@@ -0,0 +1,3 @@
+export { ZipTools } from '../dist_ts_shared/classes.ziptools.js';
+export { ZIP_ERROR_CODES, ZipError } from '../dist_ts_shared/errors.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiemlwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViL3ppcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDNUQsT0FBTyxFQUFFLGVBQWUsRUFBRSxRQUFRLEVBQXNCLE1BQU0sd0JBQXdCLENBQUMifQ==

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@push.rocks/smartarchive",
-  "version": "5.2.3",
+  "version": "5.3.0",
   "description": "A library for working with archive files, providing utilities for compressing and decompressing data.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
   "exports": {
     ".": "./dist_ts/index.js",
-    "./web": "./dist_ts_web/index.js"
+    "./web": "./dist_ts_web/index.js",
+    "./web/zip": "./dist_ts_web/zip.js"
   },
   "repository": {
     "type": "git",
@@ -33,6 +34,7 @@
     "fflate": "^0.8.2",
     "file-type": "^22.0.1",
     "modern-tar": "^0.7.6",
+    "pako": "^3.0.1",
     "tar-stream": "^3.2.0"
   },
   "devDependencies": {
@@ -76,7 +78,7 @@
   ],
   "scripts": {
     "test": "(tstest test/ --verbose)",
-    "build": "tsbuild --web",
+    "build": "tsbuild tsfolders",
     "buildDocs": "tsdoc"
   }
 }

package/readme.hints.md

@@ -15,7 +15,7 @@ Modes are mutually exclusive - you cannot mix extraction and creation methods in
 
 - **SmartArchive** - Main class with fluent API for all operations
 - **TarTools** - TAR-specific operations (pack/extract)
-- **ZipTools** - ZIP-specific operations using fflate
+- **ZipTools** - ZIP creation/general extraction using fflate plus bounded selective extraction using strict metadata validation and pako
 - **GzipTools** - GZIP compression/decompression using fflate
 - **Bzip2Tools** - BZIP2 decompression (extract only, no creation)
 - **ArchiveAnalyzer** - Format detection via magic bytes
@@ -23,6 +23,7 @@ Modes are mutually exclusive - you cannot mix extraction and creation methods in
 ## Dependencies
 
 - **fflate** - Pure JS compression for ZIP/GZIP (works in browser)
+- **pako** - Browser-compatible raw DEFLATE stream used where exact compressed-input consumption must be verified
 - **tar-stream** - TAR archive handling
 - **file-type** - MIME type detection via magic bytes
 - **@push.rocks/smartfile** - SmartFile and StreamFile classes
@@ -73,6 +74,19 @@ tstest test/test.node+deno.ts --verbose  # Run specific test
 
 Tests use a Verdaccio registry URL (`verdaccio.lossless.digital`) for test archives.
 
+## Bounded ZIP Extraction
+
+`ZipTools.extractSelectedZipEntries()` is separate from the compatibility-oriented `extractZip()` and streaming transform. It is intended for untrusted archives where selection must happen before decompression.
+
+Browser consumers that need an isolated dependency graph should import it from `@push.rocks/smartarchive/web/zip`. Node consumers use the normal package root. The Node `ZipTools` subclass preserves streaming, `SmartFile`, and `StreamFile` support while delegating bounded extraction to the shared implementation.
+
+- All limits are required and must be positive safe integers.
+- `maxArchiveBytes` and `maxEntries` cover the whole archive; the remaining limits cover selected entries only.
+- The parser supports single-disk, non-ZIP64 archives and validates exact central/local record relationships without assuming matching record order.
+- Paths are canonical ASCII or UTF-8. Unicode path extras, absolute paths, backslashes, dot segments, encryption, and ambiguous descriptors fail closed.
+- Only selected stored/DEFLATE entries are decoded. Compressed input is fed in fixed 16 KiB slices, and pako exposes exact consumed-input state so trailing compressed bytes are rejected.
+- Peak selected-output memory is bounded by retained output, one 16 KiB decoder chunk, and one additional output copy while combining chunks. Callers own the configured trust ceilings.
+
 ## Key Files
 
 - `ts/classes.smartarchive.ts` - Main SmartArchive class with fluent API

package/readme.md

@@ -1,6 +1,6 @@
 # @push.rocks/smartarchive 📦
 
-A powerful, streaming-first archive manipulation library with a fluent builder API. Works seamlessly in **Node.js**, **Deno**, and **browsers**.
+A powerful, streaming-first archive manipulation library with a fluent builder API for Node.js and Deno, plus an isolated browser entrypoint for ZIP operations.
 
 ## Issue Reporting and Security
 
@@ -16,8 +16,9 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 - 🔧 **Flexible I/O** – Work with files, URLs, streams, and buffers seamlessly
 - 🛠️ **Modern TypeScript** – Full type safety and excellent IDE support
 - 🔄 **Dual-mode operation** – Extract existing archives OR create new ones
-- 🦕 **Cross-runtime** – Works in Node.js, Deno, and browsers
-- 🌐 **Browser-ready** – Dedicated browser bundle with zero Node.js dependencies
+- 🦕 **Cross-runtime ZIP tools** – ZIP operations work in Node.js, Deno, and browsers
+- 🌐 **Browser-ready ZIP entrypoint** – `@push.rocks/smartarchive/web/zip` has no Node.js runtime dependencies
+- **Bounded ZIP selection** - Validate archive structure and extract only selected entries under explicit limits
 
 ## Installation 📥
 
@@ -72,59 +73,32 @@ await SmartArchive.create()
   .extract('./node_modules/lodash');
 ```
 
-## Browser Usage 🌐
+## Browser ZIP Usage 🌐
 
-smartarchive provides a dedicated browser-compatible bundle with no Node.js dependencies:
+Use the isolated ZIP subpath in browsers so the module graph contains no Node.js runtime dependencies:
 
 ```typescript
-// Import from the /web subpath for browser environments
-import { TarTools, ZipTools, GzipTools, Bzip2Tools } from '@push.rocks/smartarchive/web';
+import { ZipTools } from '@push.rocks/smartarchive/web/zip';
 
-// Create a TAR archive in the browser
-const tarTools = new TarTools();
-const tarBuffer = await tarTools.packFiles([
-  { archivePath: 'hello.txt', content: 'Hello from the browser!' },
-  { archivePath: 'data.json', content: JSON.stringify({ browser: true }) }
-]);
-
-// Create a TAR.GZ archive
-const tgzBuffer = await tarTools.packFilesToTarGz([
-  { archivePath: 'file.txt', content: 'Compressed!' }
-], 6);
-
-// Extract a TAR archive
-const entries = await tarTools.extractTar(tarBuffer);
-for (const entry of entries) {
-  console.log(`${entry.path}: ${entry.content.length} bytes`);
-}
-
-// Work with ZIP files
 const zipTools = new ZipTools();
 const zipBuffer = await zipTools.createZip([
-  { archivePath: 'doc.txt', content: 'Document content' }
+  { archivePath: 'manifest.json', content: JSON.stringify({ name: 'example' }) }
 ], 6);
 
 const zipEntries = await zipTools.extractZip(zipBuffer);
 
-// GZIP compression
-const gzipTools = new GzipTools();
-const compressed = gzipTools.compressSync(new TextEncoder().encode('Hello World'), 6);
-const decompressed = gzipTools.decompressSync(compressed);
+// Security-sensitive extraction validates first and only decompresses matches
+const manifests = await zipTools.extractSelectedZipEntries(zipBuffer, {
+  filter: entry => entry.path === 'manifest.json',
+  maxArchiveBytes: 64 * 1024 * 1024,
+  maxEntries: 10_000,
+  maxSelectedEntries: 1,
+  maxCompressedEntryBytes: 1024 * 1024,
+  maxUncompressedEntryBytes: 1024 * 1024,
+  maxTotalUncompressedBytes: 1024 * 1024,
+});
 ```
 
-### Browser Bundle Exports
-
-The `/web` subpath exports these browser-compatible tools:
-
-| Export | Description |
-|--------|-------------|
-| `TarTools` | Create and extract TAR and TAR.GZ archives |
-| `ZipTools` | Create and extract ZIP archives |
-| `GzipTools` | GZIP compression and decompression |
-| `Bzip2Tools` | BZIP2 decompression (extraction only) |
-
-> 💡 **Note:** The browser bundle does **not** include `SmartArchive` (which requires filesystem access). Use the individual tool classes for browser applications.
-
 ## Core Concepts 💡
 
 ### Fluent Builder Pattern
@@ -469,8 +443,23 @@ const entries = await zipTools.extractZip(zipBuffer);
 for (const entry of entries) {
   console.log(`${entry.path}: ${entry.content.length} bytes`);
 }
+
+// Extract selected entries with explicit resource limits
+const selectedEntries = await zipTools.extractSelectedZipEntries(zipBuffer, {
+  filter: entry => entry.path === 'data.bin',
+  maxArchiveBytes: 64 * 1024 * 1024,
+  maxEntries: 10_000,
+  maxSelectedEntries: 1,
+  maxCompressedEntryBytes: 2 * 1024 * 1024,
+  maxUncompressedEntryBytes: 8 * 1024 * 1024,
+  maxTotalUncompressedBytes: 8 * 1024 * 1024,
+});
 ```
 
+`extractSelectedZipEntries()` is the fail-closed API for untrusted ZIP input. It parses and validates the complete central directory and referenced local records before running the filter, then decompresses only selected entries. Archive and entry-count limits apply to the whole ZIP; compressed, uncompressed, selected-count, and total-output limits apply only to selected entries.
+
+The bounded API intentionally accepts a strict interoperable subset: single-disk, non-ZIP64 archives with canonical ASCII or UTF-8 paths. Selected entries may be stored or DEFLATE-compressed. It rejects encrypted entries, ambiguous metadata, duplicate selected paths, overlapping records, trailing DEFLATE bytes, size mismatches, and CRC mismatches with `ZipError` and stable `ZIP_ERROR_CODES`. Existing `extractZip()` behavior is unchanged for trusted inputs requiring broader compatibility.
+
 ### In-memory round-trip
 
 ```typescript
@@ -558,13 +547,13 @@ fileStream.on('data', async (file) => {
 
 ## Supported Formats 📋
 
-| Format | Extension(s) | Extract | Create | Browser |
-|--------|--------------|---------|--------|---------|
-| TAR | `.tar` | ✅ | ✅ | ✅ |
-| TAR.GZ / TGZ | `.tar.gz`, `.tgz` | ✅ | ✅ | ✅ |
-| ZIP | `.zip` | ✅ | ✅ | ✅ |
-| GZIP | `.gz` | ✅ | ✅ | ✅ |
-| BZIP2 | `.bz2` | ✅ | ❌ | ✅ |
+| Format | Extension(s) | Extract | Create |
+|--------|--------------|---------|--------|
+| TAR | `.tar` | ✅ | ✅ |
+| TAR.GZ / TGZ | `.tar.gz`, `.tgz` | ✅ | ✅ |
+| ZIP | `.zip` | ✅ | ✅ |
+| GZIP | `.gz` | ✅ | ✅ |
+| BZIP2 | `.bz2` | ✅ | ❌ |
 
 ## Type Definitions
 
@@ -608,7 +597,7 @@ interface IArchiveInfo {
 1. **Use streaming for large files** – `.toStreamFiles()` processes entries one at a time without loading the entire archive
 2. **Choose appropriate compression** – Use 1-3 for speed, 6 (default) for balance, 9 for maximum compression
 3. **Filter early** – Use `.include()`/`.exclude()` to skip unwanted entries before processing
-4. **Use Uint8Array in browsers** – The browser bundle works with `Uint8Array` for optimal performance
+4. **Use Uint8Array in browsers** – The browser ZIP entrypoint works with `Uint8Array`
 
 ## Error Handling 🛡️
 
@@ -634,7 +623,7 @@ try {
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](license) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 
@@ -646,7 +635,7 @@ Use of these trademarks must comply with Task Venture Capital GmbH's Trademark G
 
 ### Company Information
 
-Task Venture Capital GmbH
+Task Venture Capital GmbH<br>
 Registered at District Court Bremen HRB 35230 HB, Germany
 
 For any legal inquiries or further information, please contact us via email at hello@task.vc.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartarchive',
-  version: '5.2.3',
+  version: '5.3.0',
   description: 'A library for working with archive files, providing utilities for compressing and decompressing data.'
 }

package/ts/classes.smartarchive.ts

@@ -11,7 +11,7 @@ import type {
 // Import browser-compatible tools from ts_shared
 import { Bzip2Tools } from '../ts_shared/classes.bzip2tools.js';
 import { GzipTools } from '../ts_shared/classes.gziptools.js';
-import { ZipTools } from '../ts_shared/classes.ziptools.js';
+import { ZipTools } from './classes.ziptools.js';
 
 // Import Node.js-extended TarTools
 import { TarTools } from './classes.tartools.js';

package/ts/classes.ziptools.ts

@@ -0,0 +1,75 @@
+import * as plugins from './plugins.js';
+import type { IArchiveEntry, TCompressionLevel } from '../ts_shared/interfaces.js';
+import { ZipTools as SharedZipTools } from '../ts_shared/classes.ziptools.js';
+
+/**
+ * Node.js streaming ZIP decompression transform
+ */
+export class ZipDecompressionTransform extends plugins.smartstream.SmartDuplex<Uint8Array, plugins.smartfile.StreamFile> {
+  private streamtools!: plugins.smartstream.IStreamTools;
+  private unzipper = new plugins.fflate.Unzip(async (fileArg) => {
+    let resultBuffer: Uint8Array;
+    fileArg.ondata = async (_flateError, dat, final) => {
+      if (resultBuffer) {
+        const combined = new Uint8Array(resultBuffer.length + dat.length);
+        combined.set(resultBuffer);
+        combined.set(dat, resultBuffer.length);
+        resultBuffer = combined;
+      } else {
+        resultBuffer = new Uint8Array(dat);
+      }
+      if (final) {
+        const streamFile = plugins.smartfile.StreamFile.fromBuffer(Buffer.from(resultBuffer));
+        streamFile.relativeFilePath = fileArg.name;
+        this.streamtools.push(streamFile);
+      }
+    };
+    fileArg.start();
+  });
+
+  constructor() {
+    super({
+      objectMode: true,
+      writeFunction: async (chunkArg, streamtoolsArg) => {
+        this.streamtools ? null : (this.streamtools = streamtoolsArg);
+        const chunk = chunkArg instanceof Uint8Array ? chunkArg : new Uint8Array(chunkArg);
+        this.unzipper.push(chunk, false);
+        return null;
+      },
+      finalFunction: async () => {
+        this.unzipper.push(new Uint8Array(0), true);
+        await plugins.smartdelay.delayFor(0);
+        await this.streamtools.push(null);
+        return null;
+      },
+    });
+    this.unzipper.register(plugins.fflate.UnzipInflate);
+  }
+}
+
+/**
+ * Node.js ZIP tools with SmartFile and StreamFile creation support
+ */
+export class ZipTools extends SharedZipTools {
+  public getDecompressionStream(): ZipDecompressionTransform {
+    return new ZipDecompressionTransform();
+  }
+
+  public override async createZip(
+    entries: IArchiveEntry[],
+    compressionLevel?: TCompressionLevel,
+  ): Promise<Uint8Array> {
+    const normalizedEntries: IArchiveEntry[] = [];
+    for (const entry of entries) {
+      if (entry.content instanceof plugins.smartfile.SmartFile) {
+        normalizedEntries.push({ ...entry, content: new Uint8Array(entry.content.contents) });
+      } else if (entry.content instanceof plugins.smartfile.StreamFile) {
+        const buffer = await entry.content.getContentAsBuffer();
+        normalizedEntries.push({ ...entry, content: new Uint8Array(buffer) });
+      } else {
+        normalizedEntries.push(entry);
+      }
+    }
+    return super.createZip(normalizedEntries, compressionLevel);
+  }
+}

package/ts/index.ts

@@ -9,3 +9,6 @@ export * from './classes.archiveanalyzer.js';
 
 // Node.js-specific: Extended TarTools with streaming support (overrides shared TarTools)
 export { TarTools, type ITarPackFileOptions } from './classes.tartools.js';
+
+// Node.js-specific: Extended ZipTools with streaming and SmartFile support
+export { ZipTools, ZipDecompressionTransform } from './classes.ziptools.js';