@stll/folio-core 0.64.1 → 0.65.0

package/dist/ai-edits/headless.js

@@ -56,7 +56,7 @@ import { TaggedError, panic } from "better-result";
 import { REVIEW_CARRIERS, finalizeParagraphFormatting, numberingLevelEntries, setDocumentBodyComments } from "@stll/docx-core/model";
 import { reconcileDocumentPartRelationships } from "@stll/docx-core/ops";
 import { EditorState } from "prosemirror-state";
-import JSZip from "jszip";
+import { ZipArchive } from "@stll/docx-core/zip";
 // src/ai-edits/headless.ts
 /**
 * Headless `.docx` review path: buffer -> apply AI edits -> buffer, with
@@ -1990,8 +1990,8 @@ var FolioDocxReviewer = class FolioDocxReviewer {
 			if (xml === null) return null;
 			const extension = media.path.split(".").at(-1)?.toLowerCase();
 			if (!extension || !/^[a-z0-9]+$/u.test(extension)) return null;
-			const originalZip = await JSZip.loadAsync(this.originalBuffer);
-			const existingPaths = new Set(Object.keys(originalZip.files).map((path) => path.toLowerCase()));
+			const originalZip = await ZipArchive.read(this.originalBuffer);
+			const existingPaths = new Set(originalZip.paths().map((path) => path.toLowerCase()));
 			let suffix = 1;
 			let path = `word/media/folio-import-${suffix}.${extension}`;
 			while (existingPaths.has(path.toLowerCase()) || this.baseDocument.package.media?.has(path) || this.importedMedia.has(path)) path = `word/media/folio-import-${++suffix}.${extension}`;

package/dist/compare/reproducible-package.d.ts

@@ -1 +1,6 @@
+/**
+ * Date comparison output from the comparison's timestamp. Imported entries
+ * retain source dates, and saves can stamp `dcterms:modified` from the wall
+ * clock; restamping both makes repeated comparisons reproducible.
+ */
 export declare const withFixedPackageDates: (buffer: ArrayBuffer, date: Date) => Promise<ArrayBuffer>;

package/dist/compare/reproducible-package.js

@@ -1,13 +1,12 @@
-import { decodeText, encodeUtf8 } from "../utils/textEncoding.js";
-import JSZip from "jszip";
-import { writeZipPart } from "@stll/docx-core/zip";
+import { decodeText } from "../utils/textEncoding.js";
+import { ZipArchive } from "@stll/docx-core/zip";
 // src/compare/reproducible-package.ts
 /**
 * Date comparison output from the comparison's timestamp. Imported entries
 * retain source dates, and saves can stamp `dcterms:modified` from the wall
 * clock; restamping both makes repeated comparisons reproducible.
 */
-/** JSZip deflate level `repackDocx` writes DOCX parts at. */
+/** ZipArchive deflate level `repackDocx` writes DOCX parts at. */
 const DOCX_COMPRESSION_LEVEL = 6;
 const CORE_PROPERTIES_PATH = "docProps/core.xml";
 const MODIFIED_ELEMENT = /<dcterms:modified[^<>]*>[^<]*<\/dcterms:modified>/u;
@@ -18,24 +17,12 @@ const MODIFIED_ELEMENT = /<dcterms:modified[^<>]*>[^<]*<\/dcterms:modified>/u;
 */
 const withFixedModifiedDate = (corePropsXml, date) => corePropsXml.replace(MODIFIED_ELEMENT, `<dcterms:modified xsi:type="dcterms:W3CDTF">${date.toISOString()}</dcterms:modified>`);
 const withFixedPackageDates = async (buffer, date) => {
-	const zip = await JSZip.loadAsync(buffer);
-	const coreProps = zip.file(CORE_PROPERTIES_PATH);
-	if (coreProps) writeZipPart({
-		zip,
-		path: CORE_PROPERTIES_PATH,
-		data: encodeUtf8(withFixedModifiedDate(await coreProps.async("uint8array").then((bytes) => decodeText(bytes, { ignoreBOM: true })), date)),
-		options: {
-			compression: "DEFLATE",
-			compressionOptions: { level: DOCX_COMPRESSION_LEVEL }
-		}
-	});
-	zip.forEach((_path, file) => {
-		file.date = date;
-	});
-	return await zip.generateAsync({
-		type: "arraybuffer",
-		compression: "DEFLATE",
-		compressionOptions: { level: DOCX_COMPRESSION_LEVEL }
-	});
+	const zip = await ZipArchive.read(buffer);
+	const coreProps = zip.entry(CORE_PROPERTIES_PATH);
+	if (coreProps) zip.set(CORE_PROPERTIES_PATH, withFixedModifiedDate(decodeText(await coreProps.bytes(), { ignoreBOM: true }), date));
+	return (await zip.generate({
+		level: DOCX_COMPRESSION_LEVEL,
+		modified: date
+	})).buffer;
 };
 export { withFixedPackageDates };

package/dist/docx/archiveInflation.d.ts

@@ -1,15 +1,10 @@
-import JSZip from "jszip";
-declare module "jszip" {
-  interface JSZipObject {
-    /**
-     * Chunked read of the entry content, missing from the published typings.
-     * `nodeStream` is this stream wrapped in a Node.js `Readable`, which
-     * browsers and web workers cannot provide; the stream itself is
-     * platform-neutral.
-     */
-    internalStream(type: "uint8array"): JSZip.JSZipStreamHelper<Uint8Array>;
-  }
-}
+/**
+ * Compression bounds for DOCX packages.
+ *
+ * The archive reader (`@stll/docx-core/zip`) checks every size an archive
+ * declares before anything inflates, and stops each inflation at its entry's
+ * declared size. The values here are the DOCX policy it is given.
+ */
 /**
  * Default ceiling on inflated bytes per compressed byte.
  *
@@ -26,100 +21,10 @@ export declare const DOCX_MAX_COMPRESSION_RATIO = 200;
  * matter. The byte caps still apply below this size.
  */
 export declare const DOCX_COMPRESSION_RATIO_GRACE_BYTES: number;
-/**
- * Upper bound on the central-directory records in `bytes`, counted without
- * parsing the archive and stopping once the count passes `stopAfter`.
- *
- * Every record JSZip reads starts with the record signature, so the number of
- * signature occurrences cannot be lower than the number of entries JSZip would
- * build, whatever the end-of-central-directory record claims.
- */
-export declare const countCentralDirectoryRecords: (bytes: Uint8Array, stopAfter: number) => number;
-/** Sizes a loaded entry declares in the central directory. */
-export type ZipEntrySizes = {
-  readonly compressedBytes: number | null;
-  readonly uncompressedBytes: number | null;
-};
-/** Declared sizes of an entry JSZip loaded from an archive. */
-export declare const getZipEntrySizes: (entry: JSZip.JSZipObject) => ZipEntrySizes;
-/**
- * Whether a loaded entry is stored rather than compressed. A stored entry
- * reads back exactly the bytes the archive carries, so it cannot expand.
- */
-export declare const isStoredZipEntry: (entry: JSZip.JSZipObject) => boolean;
 /**
  * Whether the per-entry ratio cap applies to a part. Markup and text parts
  * never compress anywhere near the cap. Binary parts can: an uncompressed
  * bitmap of one colour compresses like a run of one byte. Those stay bounded
  * by the byte caps and the package-wide ratio instead.
  */
-export declare const isRatioBoundedPart: (path: string) => boolean;
-/** The per-entry ratio cap for `path`: `maxRatio`, or none for a binary part. */
-export declare const compressionRatioLimitFor: (path: string, maxRatio: number) => number;
-type CompressionRatioCheck = {
-  inflatedBytes: number;
-  compressedBytes: number | null;
-  maxRatio: number;
-};
-/**
- * Whether `inflatedBytes` produced from `compressedBytes` passes the ratio cap.
- * Sizes under {@link DOCX_COMPRESSION_RATIO_GRACE_BYTES} never do, and an
- * unknown compressed size is left to the byte caps.
- */
-export declare const exceedsCompressionRatio: ({ inflatedBytes, compressedBytes, maxRatio }: CompressionRatioCheck) => boolean;
-/**
- * Inflated bytes charged across one package. `aborted` stops every inflation
- * sharing the budget at its next chunk, once one of them has failed the
- * package.
- */
-export type InflationBudget = {
-  readonly maxTotalBytes: number;
-  inflatedBytes: number;
-  aborted: boolean;
-};
-export declare const createInflationBudget: (maxTotalBytes: number) => InflationBudget;
-/**
- * The bound an inflation stopped at.
- *
- * - `declared-size` — the entry produced more than its declared size.
- * - `compression-ratio` — the entry passed the ratio cap for its compressed size.
- * - `entry` — the entry passed the per-entry cap the caller set.
- * - `total` — the package passed its cumulative budget.
- * - `aborted` — another inflation sharing the budget already failed.
- */
-export type InflationLimit = "declared-size" | "compression-ratio" | "entry" | "total" | "aborted";
-export type InflateEntryResult = {
-  readonly ok: true;
-  readonly bytes: Uint8Array<ArrayBuffer>;
-} | {
-  readonly ok: false;
-  readonly limit: InflationLimit;
-};
-export type InflateEntryOptions = {
-  entry: JSZip.JSZipObject;
-  /** Most bytes this entry may inflate to. */
-  maxEntryBytes: number;
-  /** Ratio cap while streaming; see {@link compressionRatioLimitFor}. */
-  maxCompressionRatio: number;
-  budget: InflationBudget;
-  /**
-   * `false` inflates the entry only to prove it stays within its bounds; the
-   * chunks are dropped and the result carries no bytes. A package part that
-   * is never read here is still inflated by a later save, so the bound has
-   * to be established for it too.
-   */
-  retain?: boolean;
-};
-/**
- * Inflate one entry chunk by chunk, checking every bound before a chunk is
- * kept. Pausing the stream abandons the rest of the entry, so a limit bounds
- * memory rather than reporting an overrun afterwards.
- *
- * The budget is charged as chunks arrive, which keeps concurrent inflations
- * of one package honest, and refunded when this entry stops at a limit or
- * fails, since none of its bytes are kept. Stream errors (a corrupt entry)
- * reject; limits resolve with `ok: false` for the caller to map onto its own
- * error or skip policy.
- */
-export declare const inflateEntryWithinLimits: ({ entry, maxEntryBytes, maxCompressionRatio, budget, retain }: InflateEntryOptions) => Promise<InflateEntryResult>;
-export {};
+export declare const isRatioBoundedPart: (path: string) => boolean;

package/dist/docx/archiveInflation.js

@@ -1,5 +1,12 @@
 // src/docx/archiveInflation.ts
 /**
+* Compression bounds for DOCX packages.
+*
+* The archive reader (`@stll/docx-core/zip`) checks every size an archive
+* declares before anything inflates, and stops each inflation at its entry's
+* declared size. The values here are the DOCX policy it is given.
+*/
+/**
 * Default ceiling on inflated bytes per compressed byte.
 *
 * Document parts in the repository's fixtures stay under 75:1, and parts over a
@@ -15,57 +22,6 @@ const DOCX_MAX_COMPRESSION_RATIO = 200;
 * matter. The byte caps still apply below this size.
 */
 const DOCX_COMPRESSION_RATIO_GRACE_BYTES = 4194304;
-const CENTRAL_DIRECTORY_RECORD_SIGNATURE = [
-	80,
-	75,
-	1,
-	2
-];
-/**
-* Upper bound on the central-directory records in `bytes`, counted without
-* parsing the archive and stopping once the count passes `stopAfter`.
-*
-* Every record JSZip reads starts with the record signature, so the number of
-* signature occurrences cannot be lower than the number of entries JSZip would
-* build, whatever the end-of-central-directory record claims.
-*/
-const countCentralDirectoryRecords = (bytes, stopAfter) => {
-	const [first, second, third, fourth] = CENTRAL_DIRECTORY_RECORD_SIGNATURE;
-	let count = 0;
-	let offset = bytes.indexOf(first);
-	while (offset !== -1 && offset + 3 < bytes.length) {
-		if (bytes[offset + 1] === second && bytes[offset + 2] === third && bytes[offset + 3] === fourth) {
-			count += 1;
-			if (count > stopAfter) return count;
-		}
-		offset = bytes.indexOf(first, offset + 1);
-	}
-	return count;
-};
-const finiteSize = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
-/** Declared sizes of an entry JSZip loaded from an archive. */
-const getZipEntrySizes = (entry) => {
-	const data = "_data" in entry ? entry._data : void 0;
-	if (typeof data !== "object" || data === null) return {
-		compressedBytes: null,
-		uncompressedBytes: null
-	};
-	return {
-		compressedBytes: "compressedSize" in data ? finiteSize(data.compressedSize) : null,
-		uncompressedBytes: "uncompressedSize" in data ? finiteSize(data.uncompressedSize) : null
-	};
-};
-const STORED_COMPRESSION_MAGIC = "\0\0";
-/**
-* Whether a loaded entry is stored rather than compressed. A stored entry
-* reads back exactly the bytes the archive carries, so it cannot expand.
-*/
-const isStoredZipEntry = (entry) => {
-	const data = "_data" in entry ? entry._data : void 0;
-	if (typeof data !== "object" || data === null || !("compression" in data)) return false;
-	const { compression } = data;
-	return typeof compression === "object" && compression !== null && "magic" in compression && compression.magic === STORED_COMPRESSION_MAGIC;
-};
 const RATIO_BOUNDED_EXTENSIONS = /* @__PURE__ */ new Set([
 	"xml",
 	"rels",
@@ -84,97 +40,4 @@ const RATIO_BOUNDED_EXTENSIONS = /* @__PURE__ */ new Set([
 * by the byte caps and the package-wide ratio instead.
 */
 const isRatioBoundedPart = (path) => RATIO_BOUNDED_EXTENSIONS.has(path.slice(path.lastIndexOf(".") + 1).toLowerCase());
-/** The per-entry ratio cap for `path`: `maxRatio`, or none for a binary part. */
-const compressionRatioLimitFor = (path, maxRatio) => isRatioBoundedPart(path) ? maxRatio : Number.POSITIVE_INFINITY;
-/**
-* Whether `inflatedBytes` produced from `compressedBytes` passes the ratio cap.
-* Sizes under {@link DOCX_COMPRESSION_RATIO_GRACE_BYTES} never do, and an
-* unknown compressed size is left to the byte caps.
-*/
-const exceedsCompressionRatio = ({ inflatedBytes, compressedBytes, maxRatio }) => compressedBytes !== null && inflatedBytes > 4194304 && inflatedBytes > compressedBytes * maxRatio;
-const createInflationBudget = (maxTotalBytes) => ({
-	maxTotalBytes,
-	inflatedBytes: 0,
-	aborted: false
-});
-const EMPTY_BYTES = /* @__PURE__ */ new Uint8Array(0);
-const concatChunks = (chunks, totalBytes) => {
-	const merged = new Uint8Array(totalBytes);
-	let offset = 0;
-	for (const chunk of chunks) {
-		merged.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return merged;
-};
-/**
-* Inflate one entry chunk by chunk, checking every bound before a chunk is
-* kept. Pausing the stream abandons the rest of the entry, so a limit bounds
-* memory rather than reporting an overrun afterwards.
-*
-* The budget is charged as chunks arrive, which keeps concurrent inflations
-* of one package honest, and refunded when this entry stops at a limit or
-* fails, since none of its bytes are kept. Stream errors (a corrupt entry)
-* reject; limits resolve with `ok: false` for the caller to map onto its own
-* error or skip policy.
-*/
-const inflateEntryWithinLimits = async ({ entry, maxEntryBytes, maxCompressionRatio, budget, retain = true }) => {
-	const { compressedBytes, uncompressedBytes } = getZipEntrySizes(entry);
-	return await new Promise((resolve, reject) => {
-		const stream = entry.internalStream("uint8array");
-		const chunks = [];
-		let entryBytes = 0;
-		let settled = false;
-		const settle = () => {
-			if (settled) return false;
-			settled = true;
-			return true;
-		};
-		const refund = () => {
-			budget.inflatedBytes -= entryBytes;
-		};
-		const stop = (limit) => {
-			if (!settle()) return;
-			stream.pause();
-			refund();
-			resolve({
-				ok: false,
-				limit
-			});
-		};
-		const limitFor = () => {
-			if (budget.aborted) return "aborted";
-			if (uncompressedBytes !== null && entryBytes > uncompressedBytes) return "declared-size";
-			if (exceedsCompressionRatio({
-				inflatedBytes: entryBytes,
-				compressedBytes,
-				maxRatio: maxCompressionRatio
-			})) return "compression-ratio";
-			if (entryBytes > maxEntryBytes) return "entry";
-			if (budget.inflatedBytes > budget.maxTotalBytes) return "total";
-			return null;
-		};
-		stream.on("data", (chunk) => {
-			if (settled) return;
-			entryBytes += chunk.length;
-			budget.inflatedBytes += chunk.length;
-			const limit = limitFor();
-			if (limit !== null) {
-				stop(limit);
-				return;
-			}
-			if (retain) chunks.push(chunk);
-		}).on("end", () => {
-			if (!settle()) return;
-			resolve({
-				ok: true,
-				bytes: retain ? concatChunks(chunks, entryBytes) : EMPTY_BYTES
-			});
-		}).on("error", (error) => {
-			if (!settle()) return;
-			refund();
-			reject(error);
-		}).resume();
-	});
-};
-export { DOCX_COMPRESSION_RATIO_GRACE_BYTES, DOCX_MAX_COMPRESSION_RATIO, compressionRatioLimitFor, countCentralDirectoryRecords, createInflationBudget, exceedsCompressionRatio, getZipEntrySizes, inflateEntryWithinLimits, isRatioBoundedPart, isStoredZipEntry };
+export { DOCX_COMPRESSION_RATIO_GRACE_BYTES, DOCX_MAX_COMPRESSION_RATIO, isRatioBoundedPart };

package/dist/docx/canonicalStoryRepack.js

@@ -5,7 +5,7 @@ import { readDocumentSectionFacts } from "./documentSectionFacts.js";
 import { parseDocx } from "./parser.js";
 import { assertSectionCarriersMatchModel } from "./rezip.js";
 import { serializeDocument } from "./serializer/documentSerializer.js";
-import JSZip from "jszip";
+import { ZipArchive } from "@stll/docx-core/zip";
 // src/docx/canonicalStoryRepack.ts
 /** Canonical snapshots own explicit section references; the PM projection does not. */
 const referenceKey = ({ element, type, rId }) => `${element}:${type}:${rId}`;
@@ -19,7 +19,7 @@ const xmlFingerprint = async (xml) => {
 const repackWithCanonicalStoryRemovals = async ({ document, repack }) => {
 	const originalBuffer = document.originalBuffer;
 	if (!originalBuffer) return repack();
-	const xml = await (await JSZip.loadAsync(originalBuffer)).file("word/document.xml")?.async("uint8array").then((bytes) => decodeText(bytes, { ignoreBOM: true }));
+	const xml = await (await ZipArchive.read(originalBuffer)).entry("word/document.xml")?.bytes().then((bytes) => decodeText(bytes, { ignoreBOM: true }));
 	if (!xml) return repack();
 	const before = readDocumentSectionFacts(xml);
 	const serializedXml = serializeDocument(document);

package/dist/docx/ensureParaIds.js

@@ -1,5 +1,4 @@
 import { deterministicHexId } from "../utils/hexId.js";
-import { encodeUtf8 } from "../utils/textEncoding.js";
 import { resolvePackageRelationshipTarget } from "./packageParts.js";
 import { spliceXml } from "./selectiveXmlPatch.js";
 import { loadDocxArchive } from "./server/boundedArchive.js";
@@ -7,8 +6,7 @@ import { scanStreamingXmlElements } from "./streamingXmlParser.js";
 import { resolveNamespaceUri } from "./xmlNamespaceContext.js";
 import { OFFICE_RELATIONSHIP_NAMESPACE_URIS, WORDPROCESSINGML_NAMESPACE_URIS, getAttribute, getChildElements, getLocalName, getNamespaceUri, parseXmlDocument, resolveAttributeNamespaceUri } from "./xmlParser.js";
 import { TaggedError } from "better-result";
-import JSZip from "jszip";
-import { writeZipPart } from "@stll/docx-core/zip";
+import { ZipArchive } from "@stll/docx-core/zip";
 // src/docx/ensureParaIds.ts
 /**
 * Headless `w14:paraId` normalization for a `.docx` buffer.
@@ -321,7 +319,7 @@ const mainDocumentPart = (rels, entries) => {
 /** OPC part names are case-insensitive; compare lowercased. */
 const isTargetPart = (path) => TARGET_PART_PATTERNS.some((pattern) => pattern.test(path.toLowerCase()));
 const toUint8Array = (docx) => docx instanceof Uint8Array ? docx : new Uint8Array(docx);
-const hasDigitalSignatureParts = (zip) => Object.values(zip.files).some(({ dir, name }) => !dir && name.toLowerCase().startsWith(DIGITAL_SIGNATURE_PART_PREFIX));
+const hasDigitalSignatureParts = (zip) => zip.entries().some(({ path }) => path.toLowerCase().startsWith(DIGITAL_SIGNATURE_PART_PREFIX));
 /**
 * Backfill `w14:paraId` on every paragraph of a `.docx` buffer. See the
 * module doc for the exact contract. Throws {@link EnsureParaIdsError} when
@@ -381,31 +379,18 @@ const ensureParaIdsInternal = async (docx, options) => {
 		alreadyComplete: true,
 		mintedParaIds: []
 	};
-	const zip = await JSZip.loadAsync(docx);
+	const zip = await ZipArchive.read(docx);
 	if (hasDigitalSignatureParts(zip) && options.allowSignedPackageMutation !== true) throw new EnsureParaIdsError({
 		reason: ENSURE_PARA_IDS_REASONS.SIGNED_PACKAGE,
 		message: "Refusing to normalize a digitally signed package because rewriting OOXML invalidates its signatures. Warn the user and pass allowSignedPackageMutation only if invalidation is acceptable."
 	});
 	for (const [partPath, content] of updates) {
-		const sourceEntry = zip.file(partPath);
-		if (sourceEntry === null) throw createEnsureParaIdsError(`Package part disappeared during normalization: ${partPath}`);
-		writeZipPart({
-			zip,
-			path: partPath,
-			data: encodeUtf8(content),
-			options: {
-				compression: "DEFLATE",
-				compressionOptions: { level: 6 },
-				date: sourceEntry.date
-			}
-		});
+		const sourceEntry = zip.entry(partPath);
+		if (sourceEntry === void 0) throw createEnsureParaIdsError(`Package part disappeared during normalization: ${partPath}`);
+		zip.set(partPath, content, { modified: sourceEntry.modified });
 	}
 	return {
-		docx: await zip.generateAsync({
-			type: "uint8array",
-			compression: "DEFLATE",
-			compressionOptions: { level: 6 }
-		}),
+		docx: await zip.generate({ level: 6 }),
 		assigned,
 		deduplicated,
 		alreadyComplete: false,

package/dist/docx/metadataPrivacy.js

@@ -1,9 +1,8 @@
-import { decodeText, encodeUtf8 } from "../utils/textEncoding.js";
-import { countCentralDirectoryRecords, createInflationBudget, inflateEntryWithinLimits } from "./archiveInflation.js";
+import { decodeText } from "../utils/textEncoding.js";
+import "./archiveInflation.js";
 import { elementToXml, getLocalName, parseXmlDocument } from "./xmlParser.js";
-import { TaggedError } from "better-result";
-import JSZip from "jszip";
-import { writeZipPart } from "@stll/docx-core/zip";
+import { Result, TaggedError } from "better-result";
+import { ZipArchive, ZipError } from "@stll/docx-core/zip";
 // src/docx/metadataPrivacy.ts
 const FOLIO_DOCUMENT_METADATA_PROPERTIES = Object.freeze([
 	"title",
@@ -57,40 +56,34 @@ const CORE_PROPERTIES_PATH_LOWER = "docprops/core.xml";
 * found — otherwise the privacy rewrite silently no-ops and the unscrubbed
 * buffer round-trips untouched.
 */
-const findZipEntryCaseInsensitive = (zip, lowerPath) => {
-	const direct = zip.file(lowerPath);
-	if (direct) return direct;
-	for (const [path, file] of Object.entries(zip.files)) if (!file.dir && path.toLowerCase() === lowerPath) return file;
-	return null;
-};
+const findZipEntryCaseInsensitive = (zip, lowerPath) => zip.entry(lowerPath) ?? zip.entries().find(({ path }) => path.toLowerCase() === lowerPath) ?? null;
 const loadPrivacyArchive = async (buffer) => {
 	if (buffer.byteLength > MAX_INPUT_BYTES) throw new FolioDocumentPrivacyArchiveError({
 		message: "Document privacy input exceeded the compressed-size limit",
 		reason: "input-too-large"
 	});
-	if (countCentralDirectoryRecords(new Uint8Array(buffer), MAX_ARCHIVE_ENTRIES) > MAX_ARCHIVE_ENTRIES) throw new FolioDocumentPrivacyArchiveError({
-		message: "Document privacy input exceeded the package-entry limit",
-		reason: "too-many-entries"
+	const read = await Result.tryPromise({
+		try: async () => await ZipArchive.read(buffer, { limits: {
+			maxEntries: MAX_ARCHIVE_ENTRIES,
+			maxCompressionRatio: 200
+		} }),
+		catch: (cause) => cause
 	});
-	let zip;
-	try {
-		zip = await JSZip.loadAsync(buffer);
-	} catch (cause) {
+	if (Result.isError(read)) {
+		const cause = read.error;
+		if (cause instanceof ZipError && cause.reason === "too-many-entries") throw new FolioDocumentPrivacyArchiveError({
+			message: "Document privacy input exceeded the package-entry limit",
+			reason: "too-many-entries"
+		});
 		throw new FolioDocumentPrivacyArchiveError({
 			message: "Document privacy input is not a readable package",
 			reason: "load-failed",
 			cause
 		});
 	}
-	if (Object.values(zip.files).length > MAX_ARCHIVE_ENTRIES) throw new FolioDocumentPrivacyArchiveError({
-		message: "Document privacy input exceeded the package-entry limit",
-		reason: "too-many-entries"
-	});
+	const zip = read.value;
 	const coreProperties = findZipEntryCaseInsensitive(zip, CORE_PROPERTIES_PATH_LOWER);
-	if (!coreProperties) return zip;
-	const data = "_data" in coreProperties ? coreProperties._data : void 0;
-	const declaredBytes = typeof data === "object" && data !== null && "uncompressedSize" in data ? data.uncompressedSize : void 0;
-	if (typeof declaredBytes !== "number" || declaredBytes > MAX_CORE_PROPERTIES_BYTES) throw new FolioDocumentPrivacyArchiveError({
+	if (coreProperties && coreProperties.size > MAX_CORE_PROPERTIES_BYTES) throw new FolioDocumentPrivacyArchiveError({
 		message: "Document privacy core properties exceeded the part-size limit",
 		reason: "core-properties-too-large"
 	});
@@ -119,22 +112,26 @@ const rewriteCorePropertiesPrivacy = (xml, transforms) => {
 	};
 };
 /**
-* Read the core-properties part within its size limit. The declared size was
-* checked when the archive loaded, but only the inflation itself can show that
-* the part is no larger than it claims.
+* Read the core-properties part. Its declared size was checked when the
+* archive loaded, and inflation stops at that size.
 */
 const readCoreProperties = async (entry) => {
-	const result = await inflateEntryWithinLimits({
-		entry,
-		maxEntryBytes: MAX_CORE_PROPERTIES_BYTES,
-		maxCompressionRatio: 200,
-		budget: createInflationBudget(MAX_CORE_PROPERTIES_BYTES)
-	});
-	if (!result.ok) throw new FolioDocumentPrivacyArchiveError({
-		message: "Document privacy core properties exceeded the part-size limit",
-		reason: "core-properties-too-large"
+	const read = await Result.tryPromise({
+		try: async () => await entry.bytes(),
+		catch: (cause) => cause
 	});
-	return decodeText(result.bytes, { ignoreBOM: true });
+	if (Result.isError(read)) {
+		const cause = read.error;
+		throw new FolioDocumentPrivacyArchiveError(cause instanceof ZipError && cause.reason === "declared-size-exceeded" ? {
+			message: "Document privacy core properties exceeded the part-size limit",
+			reason: "core-properties-too-large"
+		} : {
+			message: "Document privacy input is not a readable package",
+			reason: "load-failed",
+			cause
+		});
+	}
+	return decodeText(read.value, { ignoreBOM: true });
 };
 /** Rewrite selected package metadata fields without changing other package parts. */
 const rewriteDocxMetadataPrivacy = async (buffer, { transforms }) => {
@@ -156,16 +153,9 @@ const rewriteDocxMetadataPrivacy = async (buffer, { transforms }) => {
 			removedMetadataProperties: []
 		}
 	};
-	writeZipPart({
-		zip,
-		path: coreProperties.name,
-		data: encodeUtf8(rewritten.xml)
-	});
+	zip.set(coreProperties.path, rewritten.xml);
 	return {
-		buffer: await zip.generateAsync({
-			type: "arraybuffer",
-			compression: "DEFLATE"
-		}),
+		buffer: (await zip.generate()).buffer,
 		privacyReport: {
 			appliedTransforms,
 			removedMetadataProperties: rewritten.removedMetadataProperties

package/dist/docx/packageParts.d.ts

@@ -1,4 +1,4 @@
-import JSZip from "jszip";
+import { ZipArchive } from "@stll/docx-core/zip";
 /** Resolve an internal URI reference once, before comparing it with ZIP entries. */
 export declare const resolvePackageRelationshipTarget: (target: string, relsPath: string) => string | undefined;
 /**
@@ -13,7 +13,7 @@ export declare const resolvePackageRelationshipTarget: (target: string, relsPath
  */
 export declare const isUnsafePackagePath: (path: string) => boolean;
 /** Drop the entries whose path a save refuses. Every other part survives. */
-export declare const removeUnsafeEntries: (zip: JSZip) => void;
+export declare const removeUnsafeEntries: (zip: ZipArchive) => void;
 /** What reconciliation removed to make the package internally consistent. */
 export type PackageReferenceRepair = {
   /** Parts a relationship named that the package does not hold. */
@@ -41,7 +41,7 @@ export type PackageReferenceRepair = {
  * already-reconciled package therefore reports nothing and changes nothing,
  * which is what the repack tests assert about their own output.
  */
-export declare const reconcilePackageReferences: (zip: JSZip, compressionLevel: number) => Promise<PackageReferenceRepair>;
+export declare const reconcilePackageReferences: (zip: ZipArchive, compressionLevel: number) => Promise<PackageReferenceRepair>;
 /**
  * What {@link checkPackageIntegrity} found wrong with a package. Both fields
  * are empty for a package where every internal relationship resolves and
@@ -75,4 +75,4 @@ export type PackageIntegrityReport = {
  * or a corpus-gate invariant: one pass over the `.rels` parts building an id
  * census, one pass over the XML parts checking references against it.
  */
-export declare const checkPackageIntegrity: (zip: JSZip) => Promise<PackageIntegrityReport>;
+export declare const checkPackageIntegrity: (zip: ZipArchive) => Promise<PackageIntegrityReport>;