@t4h.framework/zip 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,34 @@
+# @t4h.framework/zip
+
+## 0.2.0
+
+### Minor Changes
+
+- [#163](https://github.com/tech4humans-brasil/framework/pull/163) [`f7540fc`](https://github.com/tech4humans-brasil/framework/commit/f7540fcc38ee0da651677474e5bd825bcbecea9c) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `@t4h.framework/zip`: reading ZIP archives from inside a workflow.
+
+  `unzip(archive, options?)` extracts the entries into files and resolves with
+  `ZipEntry[]` — `{ path, binary, contentLength, compressedLength,
+compressionMethod, crc32, lastModifiedAt, directory }` — and
+  `list(archive, options?)` returns the same metadata without transferring any
+  content. `include`/`exclude` globs select what is extracted or listed,
+  `encoding` decodes legacy entry names and `contentType` labels the extracted
+  files.
+
+  Both read the archive back to front through `FileSystemClaim.slice`: the tail
+  of the file gives the whole listing (about a kilobyte on an archive without a
+  comment) and each entry is fetched by byte range, inflated in a stream and
+  written through `FileSystemClaim.write` with backpressure — content never
+  enters workflow memory or the history, and extracting one file out of a large
+  archive does not download the archive. A binary the claim cannot slice (SFTP,
+  HTTP) is streamed once into a durable copy first, the same trade `split` makes.
+
+  Every entry is verified against its CRC-32 and declared size while it flows to
+  storage, and the inflate is aborted the moment the output goes past that size,
+  so an entry that lies never writes more than it declares. Entry paths that
+  escape the extraction directory, encrypted entries and compression methods
+  other than stored and deflate are refused. ZIP64, data descriptors, archive
+  comments, UTF-8 and legacy names are handled.
+
+  This replaces hand-rolled lazy `Binary` subclasses that inflate on `stream()`
+  in App code: those are serialized as activity input, cannot be rehydrated after
+  a replay in another process, and have to lie about `contentLength`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Tech for humans
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/zip",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "ZIP extraction module for the T4H Framework",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/zip",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",