@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/interchange/bagit.mjs

@@ -0,0 +1,342 @@
+import { zipSync } from 'fflate';
+import { extractBoundedZipEntries } from "./bounded-zip-extraction.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, MAX_INVESTIGATION_MANIFEST_DOCUMENT_BYTES, } from "../contracts/investigation-package-limits.mjs";
+// Payload admission follows selected evidence files. Separate tag and path
+// bounds limit metadata parsing and directory work, not the BagIt specification.
+export const MAX_BAGIT_PAYLOAD_FILES = MAX_INVESTIGATION_MANIFEST_ARTIFACTS;
+export const MAX_BAGIT_PAYLOAD_BYTES = MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES;
+export const MAX_BAGIT_FILE_BYTES = MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES;
+export const MAX_BAGIT_TAG_FILES = 32;
+export const MAX_BAGIT_TAG_BYTES = MAX_INVESTIGATION_MANIFEST_DOCUMENT_BYTES;
+export const MAX_BAGIT_TOTAL_TAG_BYTES = 4 * MAX_BAGIT_TAG_BYTES;
+export const MAX_BAGIT_PATH_BYTES = 1024;
+export const MAX_BAGIT_DEPTH = 16;
+export const MAX_BAGIT_FILES = MAX_BAGIT_PAYLOAD_FILES + MAX_BAGIT_TAG_FILES;
+export const MAX_BAGIT_ENTRIES = MAX_BAGIT_FILES * (MAX_BAGIT_DEPTH + 1);
+export const MAX_BAGIT_ZIP_BYTES = MAX_BAGIT_PAYLOAD_BYTES + MAX_BAGIT_TOTAL_TAG_BYTES
+    + MAX_BAGIT_ENTRIES * (76 + 2 * MAX_BAGIT_PATH_BYTES) + 65_557;
+export class UnsupportedBagItError extends TypeError {
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const order = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const payloadManifest = /^manifest-([a-z0-9]{1,32})\.txt$/u;
+const tagManifest = /^tagmanifest-([a-z0-9]{1,32})\.txt$/u;
+/** A deliberately portable path profile; no path is silently rewritten. */
+export function bagItPath(value) {
+    if (typeof value !== 'string' || !value || value.length > MAX_BAGIT_PATH_BYTES
+        || encoder.encode(value).byteLength > MAX_BAGIT_PATH_BYTES
+        || decoder.decode(encoder.encode(value)) !== value || /[\x00-\x1f\x7f\\:<>"|?*]/u.test(value)) {
+        throw new TypeError('BagIt contains an unsupported or unsafe path.');
+    }
+    const parts = (value.endsWith('/') ? value.slice(0, -1) : value).split('/');
+    if (parts[0]?.startsWith(' ') || parts.length > MAX_BAGIT_DEPTH || parts.some(part => !part || part === '.' || part === '..'
+        || /[. ]$/u.test(part) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(part))) {
+        throw new TypeError('BagIt contains an unsupported or unsafe path.');
+    }
+    return value;
+}
+export function bagItEntryMaximum(path) {
+    bagItPath(path);
+    return path.endsWith('/') ? 0 : path.startsWith('data/') ? MAX_BAGIT_FILE_BYTES : MAX_BAGIT_TAG_BYTES;
+}
+/** Validate metadata before file reads or allocation; directories end in '/'. */
+function admission() {
+    const names = new Map(), directories = new Set(), spelling = new Map();
+    let files = 0, tags = 0, payloadBytes = 0, tagBytes = 0, count = 0;
+    return (entry) => {
+        if (++count > MAX_BAGIT_ENTRIES)
+            throw new TypeError('BagIt exceeds its entry limit.');
+        const path = bagItPath(entry.path), directory = path.endsWith('/');
+        const raw = directory ? path.slice(0, -1) : path, key = raw.normalize('NFC').toLowerCase();
+        if (names.has(key) || (!directory && directories.has(key)))
+            throw new TypeError('BagIt contains colliding paths.');
+        names.set(key, directory);
+        const parts = raw.split('/');
+        while (parts.length) {
+            const parent = parts.join('/'), normal = parent.normalize('NFC').toLowerCase();
+            if (spelling.has(normal) && spelling.get(normal) !== parent)
+                throw new TypeError('BagIt contains colliding path spellings.');
+            spelling.set(normal, parent);
+            if (parent !== raw || directory) {
+                if (names.get(normal) === false)
+                    throw new TypeError('BagIt contains a file-directory collision.');
+                directories.add(normal);
+            }
+            parts.pop();
+        }
+        if (!Number.isSafeInteger(entry.byteLength) || entry.byteLength < 0 || entry.byteLength > bagItEntryMaximum(path))
+            throw new TypeError('BagIt entry exceeds its byte limit.');
+        if (directory)
+            return;
+        if (path === 'data')
+            throw new TypeError('BagIt data must be a directory.');
+        if (path.startsWith('data/')) {
+            files++;
+            payloadBytes += entry.byteLength;
+        }
+        else {
+            tags++;
+            tagBytes += entry.byteLength;
+        }
+        if (files > MAX_BAGIT_PAYLOAD_FILES || tags > MAX_BAGIT_TAG_FILES
+            || payloadBytes > MAX_BAGIT_PAYLOAD_BYTES || tagBytes > MAX_BAGIT_TOTAL_TAG_BYTES)
+            throw new TypeError('BagIt exceeds its file or combined byte limit.');
+    };
+}
+export function assertBagItSelection(entries) {
+    if (!Array.isArray(entries) || entries.length > MAX_BAGIT_ENTRIES)
+        throw new TypeError('BagIt exceeds its entry limit.');
+    const admit = admission();
+    for (const entry of entries)
+        admit(entry);
+}
+function capture(input) {
+    if (!(input instanceof Map) || input.size > MAX_BAGIT_ENTRIES)
+        throw new TypeError('BagIt requires bounded selected file entries.');
+    const entries = [...input].map(([path, bytes]) => {
+        if (!(bytes instanceof Uint8Array) || !(bytes.buffer instanceof ArrayBuffer))
+            throw new TypeError('BagIt requires non-shared file bytes.');
+        return { path, byteLength: bytes.byteLength };
+    });
+    assertBagItSelection(entries);
+    return new Map([...input].map(([path, bytes]) => [path, new Uint8Array(bytes)]));
+}
+function lines(bytes) {
+    const text = decoder.decode(bytes);
+    if (text.startsWith('\uFEFF') || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/u.test(text))
+        throw new TypeError('BagIt text tags must be UTF-8 without a byte-order mark or control characters.');
+    const result = text.split(/\r\n|\r|\n/u);
+    if (result.at(-1) === '')
+        result.pop();
+    return result;
+}
+function manifestPath(value) {
+    // RFC 8493 escapes only percent, CR and LF, not URL path separators.
+    if (/%(?!25|0[dDaA])/u.test(value))
+        throw new TypeError('BagIt manifest contains an unsupported path escape.');
+    return bagItPath(value.replace(/%(25|0d|0a)/giu, (_, code) => String.fromCharCode(Number.parseInt(code, 16))));
+}
+function readManifest(name, bytes, tag, resolvePath) {
+    const code = (tag ? tagManifest : payloadManifest).exec(name)?.[1];
+    const algorithm = code === 'sha256' || code === 'sha512' ? code : null;
+    const rows = new Map();
+    for (const line of lines(bytes)) {
+        const match = /^([a-fA-F0-9]{1,512})[ \t]+(.+)$/u.exec(line);
+        if (!match || (algorithm && match[1].length !== (algorithm === 'sha256' ? 64 : 128)))
+            throw new TypeError('BagIt manifest has an invalid checksum line.');
+        const path = resolvePath(manifestPath(match[2]));
+        if (path.endsWith('/') || (tag ? path.startsWith('data/') || tagManifest.test(path) : !path.startsWith('data/')) || rows.has(path))
+            throw new TypeError('BagIt manifest has a duplicate or misplaced entry.');
+        if (rows.size >= (tag ? MAX_BAGIT_TAG_FILES : MAX_BAGIT_PAYLOAD_FILES))
+            throw new TypeError('BagIt manifest exceeds its entry limit.');
+        rows.set(path, match[1].toLowerCase());
+    }
+    return { name, algorithm, rows };
+}
+async function checksum(bytes, algorithm) {
+    if (!(bytes.buffer instanceof ArrayBuffer))
+        throw new TypeError('BagIt requires non-shared bytes.');
+    const digest = await crypto.subtle.digest(algorithm === 'sha256' ? 'SHA-256' : 'SHA-512', new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength));
+    return [...new Uint8Array(digest)].map(byte => byte.toString(16).padStart(2, '0')).join('');
+}
+function readFetch(bytes, resolvePath) {
+    const entries = new Map();
+    if (!bytes)
+        return entries;
+    for (const line of lines(bytes)) {
+        const match = /^([a-z][a-z0-9+.-]*:[^\s]{1,8192})[ \t]+(-|[0-9]{1,16})[ \t]+(.+)$/iu.exec(line);
+        if (!match)
+            throw new TypeError('BagIt fetch declaration is malformed.');
+        const uri = match[1];
+        if (/[^a-zA-Z0-9._~:/?\[\]@!$&'()*+,;=%-]/u.test(uri) || /%(?![a-fA-F0-9]{2})/u.test(uri))
+            throw new TypeError('BagIt fetch declaration requires an absolute URI without a fragment.');
+        try {
+            new URL(uri);
+        }
+        catch {
+            throw new TypeError('BagIt fetch declaration requires a valid absolute URI.');
+        }
+        const path = resolvePath(manifestPath(match[3]));
+        const size = match[2] === '-' ? null : Number(match[2]);
+        if (!path.startsWith('data/') || path.endsWith('/') || entries.has(path) || entries.size >= MAX_BAGIT_PAYLOAD_FILES
+            || (size !== null && !Number.isSafeInteger(size)))
+            throw new TypeError('BagIt fetch declaration is invalid.');
+        // The URI is deliberately neither retained nor dereferenced.
+        entries.set(path, size);
+    }
+    return entries;
+}
+function payloadOxum(bytes) {
+    if (!bytes)
+        return null;
+    let current = null;
+    let oxum = null;
+    const finish = () => {
+        if (current?.name !== 'payload-oxum')
+            return;
+        if (oxum !== null || !/^[0-9]{1,16}\.[0-9]{1,16}$/u.test(current.value))
+            throw new TypeError('BagIt payload size declaration is invalid or repeated.');
+        oxum = current.value;
+    };
+    for (const line of lines(bytes)) {
+        if (/^[ \t]/u.test(line)) {
+            if (!current)
+                throw new TypeError('BagIt metadata continuation has no field.');
+            current.value += ` ${line.trim()}`;
+        }
+        else {
+            finish();
+            const match = /^([^:]+):[ \t](.*)$/u.exec(line);
+            if (!match || match[1] !== match[1].trim())
+                throw new TypeError('BagIt metadata field is malformed.');
+            current = { name: match[1].toLowerCase(), value: match[2] };
+        }
+    }
+    finish();
+    return oxum;
+}
+/** Checks every declared checksum. Payload content is never interpreted. */
+export async function inspectBagItEntries(input) {
+    const files = capture(input), declaration = files.get('bagit.txt');
+    if (!declaration)
+        throw new TypeError('BagIt declaration is missing.');
+    const declared = lines(declaration);
+    if (declared.length !== 2 || !/^BagIt-Version: [0-9]+\.[0-9]+$/u.test(declared[0]) || !/^Tag-File-Character-Encoding: .+$/u.test(declared[1]))
+        throw new TypeError('BagIt declaration is malformed.');
+    if (declared[0] !== 'BagIt-Version: 1.0' || declared[1].toLowerCase() !== 'tag-file-character-encoding: utf-8')
+        throw new UnsupportedBagItError('Only BagIt 1.0 with UTF-8 text tags is supported.');
+    if (!files.has('data/') && ![...files.keys()].some(path => path.startsWith('data/')))
+        throw new TypeError('BagIt payload directory is missing.');
+    // Admission has already refused ambiguous normalised names. This unique NFC
+    // fallback accommodates filesystems that change Unicode normalisation.
+    const normalisedPaths = new Map([...files.keys()].map(path => [path.normalize('NFC'), path]));
+    const resolvePath = (path) => files.has(path) ? path : normalisedPaths.get(path.normalize('NFC')) ?? path.normalize('NFC');
+    const manifests = [...files].filter(([name]) => payloadManifest.test(name)).map(([name, bytes]) => readManifest(name, bytes, false, resolvePath));
+    const tagManifests = [...files].filter(([name]) => tagManifest.test(name)).map(([name, bytes]) => readManifest(name, bytes, true, resolvePath));
+    if (!manifests.length)
+        throw new TypeError('BagIt requires a payload manifest.');
+    const payload = [...files.keys()].filter(path => path.startsWith('data/') && !path.endsWith('/'));
+    const required = new Set(manifests.flatMap(manifest => [...manifest.rows.keys()]));
+    if (required.size > MAX_BAGIT_PAYLOAD_FILES)
+        throw new TypeError('BagIt exceeds its declared payload limit.');
+    const issues = new Set();
+    if (manifests.some(manifest => required.size !== manifest.rows.size || [...required].some(path => !manifest.rows.has(path))))
+        issues.add('Payload manifests disagree about file membership.');
+    if (payload.some(path => !required.has(path)))
+        issues.add('A payload file is absent from the payload manifests.');
+    if (tagManifests.some(manifest => manifests.some(payload => !manifest.rows.has(payload.name))))
+        issues.add('A tag manifest does not list every payload manifest.');
+    const fetch = readFetch(files.get('fetch.txt'), resolvePath);
+    if ([...fetch.keys()].some(path => manifests.some(manifest => !manifest.rows.has(path))))
+        issues.add('A fetch entry is absent from a payload manifest.');
+    if ([...fetch].some(([path, size]) => size !== null && files.has(path) && files.get(path).byteLength !== size))
+        issues.add('A present payload does not match its fetch byte declaration.');
+    const missingTags = tagManifests.some(manifest => [...manifest.rows.keys()].some(path => !files.has(path)));
+    const filesPresent = !missingTags && [...required].every(path => files.has(path));
+    const payloadBytes = payload.reduce((sum, path) => sum + files.get(path).byteLength, 0);
+    const oxum = payloadOxum(files.get('bag-info.txt'));
+    if (filesPresent && oxum !== null && oxum.split('.').map(Number).join('.') !== `${payloadBytes}.${payload.length}`)
+        issues.add('Payload-Oxum does not match the selected payload.');
+    const complete = filesPresent && issues.size === 0;
+    const digests = new Map();
+    const tagStates = new Map();
+    const states = new Map([...new Set([...required, ...payload])].sort(order).map(path => [path, files.has(path) ? 'verified' : 'missing']));
+    for (const manifest of [...manifests, ...tagManifests]) {
+        for (const [path, expected] of manifest.rows) {
+            const bytes = files.get(path);
+            if (!bytes)
+                continue;
+            const targetStates = path.startsWith('data/') ? states : tagStates;
+            if (!targetStates.has(path))
+                targetStates.set(path, 'verified');
+            if (!manifest.algorithm) {
+                if (targetStates.get(path) === 'verified')
+                    targetStates.set(path, 'unverified');
+                continue;
+            }
+            const key = `${manifest.algorithm}:${path}`;
+            const actual = digests.get(key) ?? await checksum(bytes, manifest.algorithm);
+            digests.set(key, actual);
+            if (actual !== expected) {
+                issues.add('A declared checksum does not match its selected file.');
+                targetStates.set(path, 'mismatch');
+            }
+        }
+    }
+    for (const path of payload)
+        if (!required.has(path))
+            states.set(path, 'unverified');
+    const unsupportedManifests = [...manifests, ...tagManifests].filter(manifest => !manifest.algorithm).length;
+    const state = issues.size ? 'invalid' : !complete ? 'incomplete' : unsupportedManifests ? 'unsupported' : 'valid';
+    const contents = new Map();
+    const entries = [...states].map(([path, entryState], index) => {
+        const id = `artifact-${index + 1}`, bytes = files.get(path);
+        if (bytes && entryState === 'verified' && state === 'valid')
+            contents.set(id, bytes);
+        return { id, byteLength: bytes?.byteLength ?? null, state: entryState };
+    });
+    return { review: {
+            version: '1.0', state, complete, checksumsVerified: state === 'valid',
+            algorithms: [...new Set([...manifests, ...tagManifests].flatMap(manifest => manifest.algorithm ? [manifest.algorithm] : []))].sort(order),
+            unsupportedManifests, payloadBytes, tagFiles: [...files.keys()].filter(path => !path.startsWith('data/') && !path.endsWith('/')).length,
+            verifiedTagFiles: [...tagStates.values()].filter(state => state === 'verified').length, fetchEntries: fetch.size, fetchMissing: [...fetch.keys()].filter(path => !files.has(path)).length,
+            entries, issues: [...issues],
+        }, contents, inputBytes: [...files.values()].reduce((sum, bytes) => sum + bytes.byteLength, 0) };
+}
+export function encodeBagItEntries(input) {
+    const files = capture(input);
+    const bytes = zipSync(Object.fromEntries([...files].sort(([left], [right]) => order(left, right))), { level: 0, mtime: new Date(1980, 0, 1) });
+    if (bytes.byteLength > MAX_BAGIT_ZIP_BYTES)
+        throw new TypeError('BagIt ZIP exceeds its byte limit.');
+    return bytes;
+}
+export function readBagItZip(input) {
+    if (!(input instanceof Uint8Array) || !(input.buffer instanceof ArrayBuffer) || input.byteLength < 22 || input.byteLength > MAX_BAGIT_ZIP_BYTES)
+        throw new TypeError('BagIt ZIP requires bounded non-shared input bytes.');
+    const admit = admission();
+    return extractBoundedZipEntries(input, {
+        keyForName: bagItPath, maximumEntries: MAX_BAGIT_ENTRIES,
+        maximumSelectedBytes: MAX_BAGIT_PAYLOAD_BYTES + MAX_BAGIT_TOTAL_TAG_BYTES,
+        selectedBytesExceededMessage: 'BagIt exceeds its combined byte limit.', metadataMismatchMessage: 'BagIt ZIP metadata or CRC is invalid.',
+        inspect(entry, metadata) {
+            if (metadata.kind === 'special' || (metadata.kind === 'directory' && !entry.name.endsWith('/'))
+                || (metadata.kind === 'file' && entry.name.endsWith('/')))
+                throw new TypeError('BagIt ZIP entries must be ordinary files or directories, not symbolic links or special files.');
+            admit({ path: entry.name, byteLength: entry.originalSize });
+            return { key: entry.name, selected: true, maximumBytes: bagItEntryMaximum(entry.name), exceededMessage: 'BagIt entry exceeds its byte limit.' };
+        },
+    }).files;
+}
+/** Creates SHA-512 by default; SHA-256 is also interoperable. */
+export async function prepareBagItEntries(payload, tags = new Map(), algorithm = 'sha512') {
+    if (algorithm !== 'sha256' && algorithm !== 'sha512')
+        throw new UnsupportedBagItError('BagIt creation supports SHA-256 or SHA-512.');
+    if (!(payload instanceof Map) || payload.size > MAX_BAGIT_PAYLOAD_FILES || !(tags instanceof Map) || tags.size > MAX_BAGIT_TAG_FILES - 4)
+        throw new TypeError('BagIt creation exceeds its file limit.');
+    const files = new Map([['data/', new Uint8Array()]]);
+    for (const [path, bytes] of payload) {
+        if (!bagItPath(path).startsWith('data/') || path.endsWith('/'))
+            throw new TypeError('BagIt payload paths must be files below data/.');
+        files.set(path, bytes);
+    }
+    for (const [path, bytes] of tags) {
+        if (path.startsWith('data/') || path.endsWith('/') || ['bagit.txt', 'bag-info.txt', 'fetch.txt'].includes(path) || payloadManifest.test(path) || tagManifest.test(path))
+            throw new TypeError('BagIt additional tag conflicts with a format-owned file.');
+        files.set(path, bytes);
+    }
+    files.set('bagit.txt', encoder.encode('BagIt-Version: 1.0\nTag-File-Character-Encoding: UTF-8\n'));
+    files.set('bag-info.txt', encoder.encode(`Payload-Oxum: ${[...payload.values()].reduce((sum, bytes) => sum + bytes.byteLength, 0)}.${payload.size}\n`));
+    const owned = capture(files);
+    const manifest = [];
+    for (const path of [...payload.keys()].sort(order))
+        manifest.push(`${await checksum(owned.get(path), algorithm)}  ${path.replaceAll('%', '%25')}`);
+    owned.set(`manifest-${algorithm}.txt`, encoder.encode(manifest.length ? `${manifest.join('\n')}\n` : ''));
+    const tagRows = [];
+    for (const [path, bytes] of [...owned].sort(([left], [right]) => order(left, right)))
+        if (!path.startsWith('data/'))
+            tagRows.push(`${await checksum(bytes, algorithm)}  ${path.replaceAll('%', '%25')}`);
+    owned.set(`tagmanifest-${algorithm}.txt`, encoder.encode(`${tagRows.join('\n')}\n`));
+    assertBagItSelection([...owned].map(([path, bytes]) => ({ path, byteLength: bytes.byteLength })));
+    return owned;
+}

package/packages/interchange/bounded-zip-extraction.mjs

@@ -0,0 +1,278 @@
+import { Unzip, UnzipInflate, unzipSync, } from 'fflate';
+import { updateCrc32 } from "./crc32.mjs";
+const INPUT_CHUNK_BYTES = 1_024;
+const END_OF_CENTRAL_DIRECTORY_SIGNATURE = 0x06054b50;
+const CENTRAL_DIRECTORY_SIGNATURE = 0x02014b50;
+const LOCAL_FILE_HEADER_SIGNATURE = 0x04034b50;
+const DATA_DESCRIPTOR_SIGNATURE = 0x08074b50;
+const MAX_ZIP_COMMENT_BYTES = 0xffff;
+function concat(chunks, total) {
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+function equalBytes(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    for (let index = 0; index < left.byteLength; index += 1) {
+        if (left[index] !== right[index])
+            return false;
+    }
+    return true;
+}
+function inspectZipDirectory(input, maximumEntries, mismatchMessage) {
+    if (input.byteLength < 22)
+        throw new Error(mismatchMessage);
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const earliestEndRecord = Math.max(0, input.byteLength - 22 - MAX_ZIP_COMMENT_BYTES);
+    let endRecordOffset = -1;
+    for (let offset = input.byteLength - 22; offset >= earliestEndRecord; offset -= 1) {
+        if (view.getUint32(offset, true) !== END_OF_CENTRAL_DIRECTORY_SIGNATURE)
+            continue;
+        const commentBytes = view.getUint16(offset + 20, true);
+        if (offset + 22 + commentBytes === input.byteLength) {
+            endRecordOffset = offset;
+            break;
+        }
+    }
+    if (endRecordOffset < 0)
+        throw new Error(mismatchMessage);
+    const disk = view.getUint16(endRecordOffset + 4, true);
+    const directoryDisk = view.getUint16(endRecordOffset + 6, true);
+    const diskEntries = view.getUint16(endRecordOffset + 8, true);
+    const entryCount = view.getUint16(endRecordOffset + 10, true);
+    const directoryBytes = view.getUint32(endRecordOffset + 12, true);
+    const directoryOffset = view.getUint32(endRecordOffset + 16, true);
+    if (disk !== 0
+        || directoryDisk !== 0
+        || diskEntries !== entryCount
+        || entryCount === 0xffff
+        || entryCount > maximumEntries
+        || directoryBytes === 0xffff_ffff
+        || directoryOffset === 0xffff_ffff
+        || directoryOffset + directoryBytes !== endRecordOffset) {
+        throw new Error(mismatchMessage);
+    }
+    const entries = [];
+    let offset = directoryOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (offset > endRecordOffset - 46 || view.getUint32(offset, true) !== CENTRAL_DIRECTORY_SIGNATURE) {
+            throw new Error(mismatchMessage);
+        }
+        const flags = view.getUint16(offset + 8, true);
+        const compression = view.getUint16(offset + 10, true);
+        const crc32 = view.getUint32(offset + 16, true);
+        const compressedSize = view.getUint32(offset + 20, true);
+        const originalSize = view.getUint32(offset + 24, true);
+        const nameBytes = view.getUint16(offset + 28, true);
+        const extraBytes = view.getUint16(offset + 30, true);
+        const commentBytes = view.getUint16(offset + 32, true);
+        const startingDisk = view.getUint16(offset + 34, true);
+        const host = view.getUint16(offset + 4, true) >>> 8;
+        const attributes = view.getUint32(offset + 38, true);
+        const unixType = host === 3 ? (attributes >>> 16) & 0xf000 : 0;
+        const kind = unixType === 0x8000 ? 'file' : unixType === 0x4000 ? 'directory'
+            : unixType !== 0 ? 'special' : (attributes & 0x10) !== 0 ? 'directory' : 'unspecified';
+        const localHeaderOffset = view.getUint32(offset + 42, true);
+        const nextOffset = offset + 46 + nameBytes + extraBytes + commentBytes;
+        if ((flags & 1) !== 0
+            || compressedSize === 0xffff_ffff
+            || originalSize === 0xffff_ffff
+            || localHeaderOffset === 0xffff_ffff
+            || startingDisk !== 0
+            || nextOffset > endRecordOffset
+            || localHeaderOffset > directoryOffset - 30
+            || view.getUint32(localHeaderOffset, true) !== LOCAL_FILE_HEADER_SIGNATURE) {
+            throw new Error(mismatchMessage);
+        }
+        const localFlags = view.getUint16(localHeaderOffset + 6, true);
+        const localCompression = view.getUint16(localHeaderOffset + 8, true);
+        const localCrc32 = view.getUint32(localHeaderOffset + 14, true);
+        const localCompressedSize = view.getUint32(localHeaderOffset + 18, true);
+        const localOriginalSize = view.getUint32(localHeaderOffset + 22, true);
+        const localNameBytes = view.getUint16(localHeaderOffset + 26, true);
+        const localExtraBytes = view.getUint16(localHeaderOffset + 28, true);
+        const localDataOffset = localHeaderOffset + 30 + localNameBytes + localExtraBytes;
+        const dataEnd = localDataOffset + compressedSize;
+        if (localFlags !== flags
+            || localCompression !== compression
+            || localDataOffset > directoryOffset
+            || dataEnd > directoryOffset
+            || !equalBytes(input.subarray(offset + 46, offset + 46 + nameBytes), input.subarray(localHeaderOffset + 30, localHeaderOffset + 30 + localNameBytes))) {
+            throw new Error(mismatchMessage);
+        }
+        let localRegionEnd = dataEnd;
+        if ((flags & 8) !== 0) {
+            if ((localCrc32 !== 0 && localCrc32 !== crc32)
+                || (localCompressedSize !== 0 && localCompressedSize !== compressedSize)
+                || (localOriginalSize !== 0 && localOriginalSize !== originalSize)) {
+                throw new Error(mismatchMessage);
+            }
+            const unsignedDescriptorMatches = dataEnd <= directoryOffset - 12
+                && view.getUint32(dataEnd, true) === crc32
+                && view.getUint32(dataEnd + 4, true) === compressedSize
+                && view.getUint32(dataEnd + 8, true) === originalSize;
+            const signedDescriptorMatches = dataEnd <= directoryOffset - 16
+                && view.getUint32(dataEnd, true) === DATA_DESCRIPTOR_SIGNATURE
+                && view.getUint32(dataEnd + 4, true) === crc32
+                && view.getUint32(dataEnd + 8, true) === compressedSize
+                && view.getUint32(dataEnd + 12, true) === originalSize;
+            if (!signedDescriptorMatches && !unsignedDescriptorMatches)
+                throw new Error(mismatchMessage);
+            localRegionEnd = dataEnd + (signedDescriptorMatches ? 16 : 12);
+        }
+        else if (localCrc32 !== crc32
+            || localCompressedSize !== compressedSize
+            || localOriginalSize !== originalSize) {
+            throw new Error(mismatchMessage);
+        }
+        entries.push(Object.freeze({
+            kind,
+            crc32,
+            compression,
+            compressedSize,
+            originalSize,
+            localHeaderOffset,
+            localRegionEnd,
+        }));
+        offset = nextOffset;
+    }
+    if (offset !== endRecordOffset)
+        throw new Error(mismatchMessage);
+    const localOrder = [...entries].sort((left, right) => left.localHeaderOffset - right.localHeaderOffset);
+    for (let index = 0; index < localOrder.length; index += 1) {
+        const entry = localOrder[index];
+        const next = localOrder[index + 1];
+        if (entry.localRegionEnd > (next?.localHeaderOffset ?? directoryOffset)) {
+            throw new Error(mismatchMessage);
+        }
+    }
+    return Object.freeze(entries);
+}
+function extractBoundedZipEntries(input, options) {
+    if (!(input instanceof Uint8Array)
+        || !Number.isSafeInteger(options.maximumEntries)
+        || options.maximumEntries < 1
+        || !Number.isSafeInteger(options.maximumSelectedBytes)
+        || options.maximumSelectedBytes < 0) {
+        throw new TypeError('Bounded ZIP extraction received invalid input.');
+    }
+    const directory = inspectZipDirectory(input, options.maximumEntries, options.metadataMismatchMessage);
+    const plans = new Map();
+    let directoryIndex = 0;
+    unzipSync(input, {
+        filter(info) {
+            const directoryEntry = directory[directoryIndex];
+            directoryIndex += 1;
+            if (!directoryEntry
+                || info.compression !== directoryEntry.compression
+                || info.size !== directoryEntry.compressedSize
+                || info.originalSize !== directoryEntry.originalSize) {
+                throw new Error(options.metadataMismatchMessage);
+            }
+            const selection = options.inspect(info, { kind: directoryEntry.kind });
+            if (!selection
+                || typeof selection.key !== 'string'
+                || !selection.key
+                || typeof selection.selected !== 'boolean'
+                || !Number.isSafeInteger(selection.maximumBytes)
+                || selection.maximumBytes < 0
+                || typeof selection.exceededMessage !== 'string'
+                || !selection.exceededMessage) {
+                throw new TypeError('Bounded ZIP extraction received an invalid entry plan.');
+            }
+            if (plans.has(selection.key))
+                throw new Error(options.metadataMismatchMessage);
+            plans.set(selection.key, Object.freeze({ info, directory: directoryEntry, selection }));
+            return false;
+        },
+    });
+    if (directoryIndex !== directory.length)
+        throw new Error(options.metadataMismatchMessage);
+    const files = new Map();
+    const localEntries = new Set();
+    let selectedBytes = 0;
+    let failure = null;
+    const unzip = new Unzip((file) => {
+        try {
+            const key = options.keyForName(file.name);
+            const plan = plans.get(key);
+            if (!plan
+                || localEntries.has(key)
+                || file.name !== plan.info.name
+                || file.compression !== plan.info.compression
+                || (file.size !== undefined && file.size !== plan.info.size)
+                || (file.originalSize !== undefined && file.originalSize !== plan.info.originalSize)) {
+                throw new Error(options.metadataMismatchMessage);
+            }
+            localEntries.add(key);
+            // Unselected entries are structurally inspected but are not decompressed or
+            // CRC-validated because their payload is outside the caller's import scope.
+            if (!plan.selection.selected)
+                return;
+            const chunks = [];
+            let entryBytes = 0;
+            let crc32State = 0xffff_ffff;
+            file.ondata = (error, chunk, final) => {
+                if (failure)
+                    throw failure;
+                if (error || !(chunk instanceof Uint8Array)) {
+                    failure = error || new Error(options.metadataMismatchMessage);
+                    file.terminate();
+                    throw failure;
+                }
+                if (chunk.byteLength > plan.selection.maximumBytes - entryBytes) {
+                    failure = new Error(plan.selection.exceededMessage);
+                    file.terminate();
+                    throw failure;
+                }
+                if (chunk.byteLength > options.maximumSelectedBytes - selectedBytes) {
+                    failure = new Error(options.selectedBytesExceededMessage);
+                    file.terminate();
+                    throw failure;
+                }
+                entryBytes += chunk.byteLength;
+                selectedBytes += chunk.byteLength;
+                crc32State = updateCrc32(crc32State, chunk);
+                if (chunk.byteLength)
+                    chunks.push(chunk.slice());
+                if (final) {
+                    const actualCrc32 = (crc32State ^ 0xffff_ffff) >>> 0;
+                    if (entryBytes !== plan.info.originalSize || actualCrc32 !== plan.directory.crc32) {
+                        failure = new Error(options.metadataMismatchMessage);
+                        file.terminate();
+                        throw failure;
+                    }
+                    files.set(plan.info.name, concat(chunks, entryBytes));
+                }
+            };
+            file.start();
+        }
+        catch (cause) {
+            failure = cause;
+            throw cause;
+        }
+    });
+    unzip.register(UnzipInflate);
+    try {
+        for (let offset = 0; offset < input.byteLength; offset += INPUT_CHUNK_BYTES) {
+            const end = Math.min(input.byteLength, offset + INPUT_CHUNK_BYTES);
+            unzip.push(input.subarray(offset, end), end === input.byteLength);
+            if (failure)
+                throw failure;
+        }
+    }
+    catch (cause) {
+        throw failure || cause;
+    }
+    const selectedCount = [...plans.values()].filter((plan) => plan.selection.selected).length;
+    if (localEntries.size !== plans.size || files.size !== selectedCount) {
+        throw new Error(options.metadataMismatchMessage);
+    }
+    return Object.freeze({ files, entryCount: plans.size });
+}
+export { extractBoundedZipEntries };

package/packages/interchange/crc32.mjs

@@ -0,0 +1,17 @@
+const TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let index = 0; index < table.length; index += 1) {
+        let value = index;
+        for (let bit = 0; bit < 8; bit += 1)
+            value = (value & 1) !== 0 ? 0xedb8_8320 ^ (value >>> 1) : value >>> 1;
+        table[index] = value >>> 0;
+    }
+    return table;
+})();
+/** Incremental ZIP/GZIP CRC state; initialise and finalise with 0xffffffff. */
+export function updateCrc32(state, bytes) {
+    let next = state >>> 0;
+    for (const byte of bytes)
+        next = TABLE[(next ^ byte) & 0xff] ^ (next >>> 8);
+    return next >>> 0;
+}