@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/portability-fidelity.test.js

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import { buildExportFidelityWarnings, normalizeExportFidelityCounts, } from "./portability-fidelity.js";
+const zeroCounts = {
+    labelDefinitions: 0,
+    issueLabelReferences: 0,
+    issueBlockerRelations: 0,
+    issueDocuments: 0,
+    issueWorkProducts: 0,
+    issueAttachments: 0,
+    approvals: 0,
+    costEvents: 0,
+    activityLogEntries: 0,
+    issueMonitors: 0,
+};
+describe("buildExportFidelityWarnings", () => {
+    it("returns no warnings when the export carries everything", () => {
+        expect(buildExportFidelityWarnings(zeroCounts)).toEqual([]);
+    });
+    it("emits no warnings for data the bundle now carries", () => {
+        expect(buildExportFidelityWarnings({
+            ...zeroCounts,
+            labelDefinitions: 2,
+            issueLabelReferences: 3,
+            issueBlockerRelations: 2,
+            issueDocuments: 1,
+            issueWorkProducts: 3,
+            issueAttachments: 4,
+            issueMonitors: 8,
+        })).toEqual([]);
+    });
+    it("emits one warning per unsupported data category with counts", () => {
+        const warnings = buildExportFidelityWarnings({
+            ...zeroCounts,
+            approvals: 5,
+            costEvents: 6,
+            activityLogEntries: 7,
+        });
+        expect(warnings.map((warning) => warning.code)).toEqual([
+            "approvals_not_exported",
+            "cost_history_not_exported",
+            "activity_history_not_exported",
+        ]);
+        expect(warnings.every((warning) => warning.severity === "warning")).toBe(true);
+        expect(warnings[0]?.message).toBe("5 approvals are not included in the export bundle.");
+        expect(warnings[1]?.message).toBe("6 cost events are not included in the export bundle.");
+    });
+});
+describe("normalizeExportFidelityCounts", () => {
+    it("round-trips a valid counts object", () => {
+        const counts = { ...zeroCounts, issueAttachments: 12 };
+        expect(normalizeExportFidelityCounts(counts)).toEqual(counts);
+    });
+    it("rejects non-objects, arrays, and missing keys", () => {
+        expect(normalizeExportFidelityCounts(null)).toBeNull();
+        expect(normalizeExportFidelityCounts([])).toBeNull();
+        expect(normalizeExportFidelityCounts("counts")).toBeNull();
+        const { issueMonitors: _dropped, ...partial } = zeroCounts;
+        expect(normalizeExportFidelityCounts(partial)).toBeNull();
+    });
+    it("rejects negative and non-finite values", () => {
+        expect(normalizeExportFidelityCounts({ ...zeroCounts, approvals: -1 })).toBeNull();
+        expect(normalizeExportFidelityCounts({ ...zeroCounts, approvals: Number.NaN })).toBeNull();
+        expect(normalizeExportFidelityCounts({ ...zeroCounts, approvals: Number.POSITIVE_INFINITY })).toBeNull();
+    });
+});
+//# sourceMappingURL=portability-fidelity.test.js.map

package/dist/portability-fidelity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-fidelity.test.js","sourceRoot":"","sources":["../src/portability-fidelity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,UAAU,GAAyB;IACvC,gBAAgB,EAAE,CAAC;IACnB,oBAAoB,EAAE,CAAC;IACvB,qBAAqB,EAAE,CAAC;IACxB,cAAc,EAAE,CAAC;IACjB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,CAAC;IACnB,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,kBAAkB,EAAE,CAAC;IACrB,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,2BAA2B,CAAC;YACjC,GAAG,UAAU;YACb,gBAAgB,EAAE,CAAC;YACnB,oBAAoB,EAAE,CAAC;YACvB,qBAAqB,EAAE,CAAC;YACxB,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,CAAC;YACpB,gBAAgB,EAAE,CAAC;YACnB,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG,2BAA2B,CAAC;YAC3C,GAAG,UAAU;YACb,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,kBAAkB,EAAE,CAAC;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACtD,wBAAwB;YACxB,2BAA2B;YAC3B,+BAA+B;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC;QAC3D,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,6BAA6B,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnF,MAAM,CAAC,6BAA6B,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3F,MAAM,CAAC,6BAA6B,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/portability-hash.d.ts

@@ -0,0 +1,5 @@
+export type NormalizedSha256 = `sha256:${string}`;
+export declare function normalizedContentHash(value: unknown): NormalizedSha256;
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256HexOfBytes(data: Uint8Array): string;
+//# sourceMappingURL=portability-hash.d.ts.map

package/dist/portability-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-hash.d.ts","sourceRoot":"","sources":["../src/portability-hash.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,UAAU,MAAM,EAAE,CAAC;AAElD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAEzD"}

package/dist/portability-hash.js

@@ -0,0 +1,20 @@
+import { createHash } from "node:crypto";
+export function normalizedContentHash(value) {
+    return `sha256:${createHash("sha256").update(canonicalJson(value)).digest("hex")}`;
+}
+export function canonicalJson(value) {
+    return JSON.stringify(sortJson(value));
+}
+export function sha256HexOfBytes(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+function sortJson(value) {
+    if (Array.isArray(value))
+        return value.map(sortJson);
+    if (typeof value !== "object" || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, sortJson(entry)]));
+}
+//# sourceMappingURL=portability-hash.js.map

package/dist/portability-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-hash.js","sourceRoot":"","sources":["../src/portability-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/portability-zip.d.ts

@@ -0,0 +1,15 @@
+import type { CompanyPortabilityFileEntry } from "./types/company-portability.js";
+export declare const MAX_ZIP_ENTRY_DECOMPRESSED_BYTES: number;
+export declare const MAX_ZIP_TOTAL_DECOMPRESSED_BYTES: number;
+export declare const binaryContentTypeByExtension: Record<string, string>;
+export declare function isBlobStorePath(pathValue: string): boolean;
+export declare function bytesToPortableFileEntry(pathValue: string, bytes: Uint8Array): CompanyPortabilityFileEntry;
+export interface ReadZipArchiveLimits {
+    maxEntryDecompressedBytes: number;
+    maxTotalDecompressedBytes: number;
+}
+export declare function readZipArchive(source: ArrayBuffer | Uint8Array, limits?: ReadZipArchiveLimits): Promise<{
+    rootPath: string | null;
+    files: Record<string, CompanyPortabilityFileEntry>;
+}>;
+//# sourceMappingURL=portability-zip.d.ts.map

package/dist/portability-zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-zip.d.ts","sourceRoot":"","sources":["../src/portability-zip.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAyBlF,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAClE,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAO/D,CAAC;AAqGF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,WAEhD;AAYD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,2BAA2B,CAc1G;AAKD,MAAM,WAAW,oBAAoB;IACnC,yBAAyB,EAAE,MAAM,CAAC;IAClC,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAiCD,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,GAAG,UAAU,EAChC,MAAM,GAAE,oBAAyC,GAChD,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;CACpD,CAAC,CAiGD"}

package/dist/portability-zip.js

@@ -0,0 +1,262 @@
+import { inflateRawSync } from "node:zlib";
+import path from "node:path";
+// Node-side reader for the company portability zip package. It produces the
+// exact `{ rootPath, files }` shape the inline import source carries, so the
+// server can accept a raw uploaded zip and feed the importer the same bundle
+// the browser used to expand and post as inline JSON. The browser has its own
+// reader in `ui/src/lib/zip.ts` (DecompressionStream); this one uses node zlib.
+// Both must stay byte-compatible with the writer in `ui/src/lib/zip.ts`.
+const textDecoder = new TextDecoder();
+// ignoreBOM keeps a leading BOM in the decoded text so text entries
+// re-encode to their original bytes; fatal surfaces invalid UTF-8.
+const strictTextDecoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+// Decompression-bomb guards. The compressed upload is already capped upstream
+// (multer/express.raw at PORTABLE_ZIP_UPLOAD_LIMIT_BYTES), but DEFLATE lets a
+// small compressed archive expand to gigabytes. Bound the expansion so a
+// malicious highly-compressible package cannot exhaust server memory: a
+// per-entry ceiling (passed to zlib as maxOutputLength, so it fails before
+// over-allocating) plus an aggregate ceiling across all entries. Both sit far
+// above any real company package yet far below what a bomb would need. These
+// are only fallback defaults: the server import route passes explicit limits
+// scaled from its configured upload cap. The per-entry ceiling stays at 512 MB
+// even for large caps because a text or base64 entry beyond that cannot
+// materialize as a JS string (V8's string length limit) regardless.
+export const MAX_ZIP_ENTRY_DECOMPRESSED_BYTES = 512 * 1024 * 1024;
+export const MAX_ZIP_TOTAL_DECOMPRESSED_BYTES = 1024 * 1024 * 1024;
+export const binaryContentTypeByExtension = {
+    ".gif": "image/gif",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+};
+function normalizeArchivePath(pathValue) {
+    return pathValue
+        .replace(/\\/g, "/")
+        .split("/")
+        .filter(Boolean)
+        .join("/");
+}
+function readUint16(source, offset) {
+    return source[offset] | (source[offset + 1] << 8);
+}
+function readUint32(source, offset) {
+    return (source[offset] |
+        (source[offset + 1] << 8) |
+        (source[offset + 2] << 16) |
+        (source[offset + 3] << 24)) >>> 0;
+}
+const LOCAL_FILE_SIGNATURE = 0x04034b50;
+const CENTRAL_DIRECTORY_SIGNATURE = 0x02014b50;
+const EOCD_SIGNATURE = 0x06054b50;
+// Locate the end-of-central-directory record by scanning back from the tail.
+// The record is 22 bytes plus an optional trailing comment (max 0xffff), so the
+// signature lives within the last 22 + 0xffff bytes; returns -1 when absent
+// (a truncated or non-zip upload), which the reader treats as fail-closed.
+function findEndOfCentralDirectoryOffset(bytes) {
+    const minOffset = Math.max(0, bytes.length - (22 + 0xffff));
+    for (let offset = bytes.length - 22; offset >= minOffset; offset -= 1) {
+        if (readUint32(bytes, offset) === EOCD_SIGNATURE)
+            return offset;
+    }
+    return -1;
+}
+// Fully validate the central directory the EOCD advertises against the local
+// entries actually read from the archive body. Trusting only the EOCD's entry
+// count is not enough: a truncated archive with a forged 22-byte EOCD whose
+// count matches the surviving local entries would otherwise be accepted, and the
+// importer would silently process a partial company package (dropping agents,
+// issues, and so on). This walks the real central directory and requires that:
+//   • it is fully present and sits immediately before the EOCD (no gap, no
+//     pointer past the buffer — a truncated tail fails here);
+//   • every record carries the central-directory signature and its lengths sum
+//     to exactly the declared directory size; and
+//   • every record references a real local file header, and the record count
+//     equals both the EOCD's declared count and the local entries parsed.
+function validateCentralDirectory(bytes, eocdOffset, localHeaderCount) {
+    const declaredEntryCount = readUint16(bytes, eocdOffset + 10);
+    const centralDirectorySize = readUint32(bytes, eocdOffset + 12);
+    const centralDirectoryStart = readUint32(bytes, eocdOffset + 16);
+    if (centralDirectoryStart > eocdOffset || centralDirectoryStart + centralDirectorySize !== eocdOffset) {
+        throw new Error("Invalid zip archive: central directory location is inconsistent (truncated or forged).");
+    }
+    const directoryEnd = centralDirectoryStart + centralDirectorySize;
+    let cursor = centralDirectoryStart;
+    let recordCount = 0;
+    while (cursor < directoryEnd) {
+        if (cursor + 46 > directoryEnd || readUint32(bytes, cursor) !== CENTRAL_DIRECTORY_SIGNATURE) {
+            throw new Error("Invalid zip archive: malformed central directory record.");
+        }
+        const fileNameLength = readUint16(bytes, cursor + 28);
+        const extraFieldLength = readUint16(bytes, cursor + 30);
+        const commentLength = readUint16(bytes, cursor + 32);
+        const localHeaderOffset = readUint32(bytes, cursor + 42);
+        if (localHeaderOffset + 4 > bytes.length || readUint32(bytes, localHeaderOffset) !== LOCAL_FILE_SIGNATURE) {
+            throw new Error("Invalid zip archive: central directory references a missing local entry.");
+        }
+        cursor += 46 + fileNameLength + extraFieldLength + commentLength;
+        recordCount += 1;
+    }
+    if (cursor !== directoryEnd) {
+        throw new Error("Invalid zip archive: central directory size does not match its records.");
+    }
+    if (recordCount !== declaredEntryCount || recordCount !== localHeaderCount) {
+        throw new Error(`Invalid zip archive: central directory declares ${declaredEntryCount} entries but ${localHeaderCount} local entries were read (truncated or corrupt).`);
+    }
+}
+function sharedArchiveRoot(paths) {
+    if (paths.length === 0)
+        return null;
+    const firstSegments = paths
+        .map((entry) => normalizeArchivePath(entry).split("/").filter(Boolean))
+        .filter((parts) => parts.length > 0);
+    if (firstSegments.length === 0)
+        return null;
+    const candidate = firstSegments[0][0];
+    return firstSegments.every((parts) => parts.length > 1 && parts[0] === candidate)
+        ? candidate
+        : null;
+}
+export function isBlobStorePath(pathValue) {
+    return /(^|\/)blobs\/[^/]+$/.test(normalizeArchivePath(pathValue));
+}
+function decodeStrictUtf8(bytes) {
+    let text;
+    try {
+        text = strictTextDecoder.decode(bytes);
+    }
+    catch {
+        return null;
+    }
+    return Buffer.from(text, "utf8").equals(Buffer.from(bytes)) ? text : null;
+}
+export function bytesToPortableFileEntry(pathValue, bytes) {
+    // Content-addressed blob entries are opaque bytes regardless of extension.
+    if (isBlobStorePath(pathValue)) {
+        return { encoding: "base64", data: Buffer.from(bytes).toString("base64"), contentType: "application/octet-stream" };
+    }
+    const contentType = binaryContentTypeByExtension[path.extname(pathValue).toLowerCase()];
+    if (contentType) {
+        return { encoding: "base64", data: Buffer.from(bytes).toString("base64"), contentType };
+    }
+    const text = decodeStrictUtf8(bytes);
+    if (text !== null)
+        return text;
+    // Bytes that are not valid UTF-8 must not be decoded lossily; fall back
+    // to base64 so they round-trip exactly.
+    return { encoding: "base64", data: Buffer.from(bytes).toString("base64"), contentType: "application/octet-stream" };
+}
+const DEFAULT_ZIP_LIMITS = {
+    maxEntryDecompressedBytes: MAX_ZIP_ENTRY_DECOMPRESSED_BYTES,
+    maxTotalDecompressedBytes: MAX_ZIP_TOTAL_DECOMPRESSED_BYTES,
+};
+function inflateZipEntry(compressionMethod, bytes, maxEntryDecompressedBytes) {
+    if (compressionMethod === 0) {
+        if (bytes.length > maxEntryDecompressedBytes) {
+            throw new Error(`Unsupported zip archive: a stored entry exceeds the ${maxEntryDecompressedBytes}-byte per-entry limit.`);
+        }
+        return bytes;
+    }
+    if (compressionMethod !== 8) {
+        throw new Error("Unsupported zip archive: only STORE and DEFLATE entries are supported.");
+    }
+    try {
+        // maxOutputLength makes zlib throw (ERR_BUFFER_TOO_LARGE) before it allocates
+        // past the per-entry ceiling, so a bomb entry never materializes in memory.
+        return new Uint8Array(inflateRawSync(bytes, { maxOutputLength: maxEntryDecompressedBytes }));
+    }
+    catch (error) {
+        if (error?.code === "ERR_BUFFER_TOO_LARGE") {
+            throw new Error(`Unsupported zip archive: a compressed entry expands beyond the ${maxEntryDecompressedBytes}-byte per-entry limit.`);
+        }
+        throw error;
+    }
+}
+export async function readZipArchive(source, limits = DEFAULT_ZIP_LIMITS) {
+    const { maxEntryDecompressedBytes, maxTotalDecompressedBytes } = limits;
+    const bytes = source instanceof Uint8Array ? source : new Uint8Array(source);
+    const entries = [];
+    let offset = 0;
+    // Count every local file header (including directory entries) so the tally can
+    // be reconciled against the central directory below; guard total expansion so
+    // a bomb split across many entries is still bounded.
+    let localHeaderCount = 0;
+    let totalDecompressedBytes = 0;
+    let reachedCentralDirectory = false;
+    while (offset + 4 <= bytes.length) {
+        const signature = readUint32(bytes, offset);
+        if (signature === CENTRAL_DIRECTORY_SIGNATURE || signature === EOCD_SIGNATURE) {
+            reachedCentralDirectory = true;
+            break;
+        }
+        if (signature !== LOCAL_FILE_SIGNATURE) {
+            throw new Error("Invalid zip archive: unsupported local file header.");
+        }
+        if (offset + 30 > bytes.length) {
+            throw new Error("Invalid zip archive: truncated local file header.");
+        }
+        const generalPurposeFlag = readUint16(bytes, offset + 6);
+        const compressionMethod = readUint16(bytes, offset + 8);
+        const compressedSize = readUint32(bytes, offset + 18);
+        const fileNameLength = readUint16(bytes, offset + 26);
+        const extraFieldLength = readUint16(bytes, offset + 28);
+        if ((generalPurposeFlag & 0x0008) !== 0) {
+            throw new Error("Unsupported zip archive: data descriptors are not supported.");
+        }
+        const nameOffset = offset + 30;
+        const bodyOffset = nameOffset + fileNameLength + extraFieldLength;
+        const bodyEnd = bodyOffset + compressedSize;
+        if (bodyEnd > bytes.length) {
+            throw new Error("Invalid zip archive: truncated file contents.");
+        }
+        localHeaderCount += 1;
+        const rawArchivePath = textDecoder.decode(bytes.slice(nameOffset, nameOffset + fileNameLength));
+        const archivePath = normalizeArchivePath(rawArchivePath);
+        const isDirectoryEntry = /\/$/.test(rawArchivePath.replace(/\\/g, "/"));
+        if (archivePath && !isDirectoryEntry) {
+            const entryBytes = inflateZipEntry(compressionMethod, bytes.slice(bodyOffset, bodyEnd), maxEntryDecompressedBytes);
+            totalDecompressedBytes += entryBytes.length;
+            if (totalDecompressedBytes > maxTotalDecompressedBytes) {
+                throw new Error(`Unsupported zip archive: decompressed contents exceed the ${maxTotalDecompressedBytes}-byte limit.`);
+            }
+            entries.push({
+                path: archivePath,
+                body: bytesToPortableFileEntry(archivePath, entryBytes),
+            });
+        }
+        offset = bodyEnd;
+    }
+    // A complete archive always ends with a central directory after its local
+    // entries. If the scan ran off the end of the buffer without reaching one, the
+    // upload was truncated at a record boundary — fail closed rather than import a
+    // leading fragment. Then fully validate the central directory the EOCD points
+    // at so a truncated tail with a forged EOCD (whose count happens to match the
+    // surviving entries) cannot smuggle in a partial import.
+    if (!reachedCentralDirectory) {
+        throw new Error("Invalid zip archive: truncated before the central directory.");
+    }
+    const eocdOffset = findEndOfCentralDirectoryOffset(bytes);
+    if (eocdOffset === -1) {
+        throw new Error("Invalid zip archive: missing end-of-central-directory record.");
+    }
+    validateCentralDirectory(bytes, eocdOffset, localHeaderCount);
+    const rootPath = sharedArchiveRoot(entries.map((entry) => entry.path));
+    const files = {};
+    for (const entry of entries) {
+        const normalizedPath = rootPath && entry.path.startsWith(`${rootPath}/`)
+            ? entry.path.slice(rootPath.length + 1)
+            : entry.path;
+        if (!normalizedPath)
+            continue;
+        // Two entries that normalize to the same path (e.g. `a/b` and `a//b`) make
+        // the package ambiguous; reject it rather than silently letting the later
+        // entry's contents win over the earlier one.
+        if (Object.prototype.hasOwnProperty.call(files, normalizedPath)) {
+            throw new Error(`Invalid zip archive: duplicate entry path "${normalizedPath}".`);
+        }
+        files[normalizedPath] = entry.body;
+    }
+    return { rootPath, files };
+}
+//# sourceMappingURL=portability-zip.js.map

package/dist/portability-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-zip.js","sourceRoot":"","sources":["../src/portability-zip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AAEzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,oEAAoE;AACpE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAErF,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAClE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnE,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IAClE,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,YAAY;CACtB,CAAC;AAEF,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO,SAAS;SACb,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB,EAAE,MAAc;IACpD,OAAO,MAAM,CAAC,MAAM,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB,EAAE,MAAc;IACpD,OAAO,CACL,MAAM,CAAC,MAAM,CAAE;QACf,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,CAC5B,KAAK,CAAC,CAAC;AACV,CAAC;AAED,MAAM,oBAAoB,GAAG,UAAU,CAAC;AACxC,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAC/C,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,SAAS,+BAA+B,CAAC,KAAiB;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAC5D,KAAK,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,cAAc;YAAE,OAAO,MAAM,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,8DAA8D;AAC9D,+EAA+E;AAC/E,kDAAkD;AAClD,6EAA6E;AAC7E,0EAA0E;AAC1E,SAAS,wBAAwB,CAAC,KAAiB,EAAE,UAAkB,EAAE,gBAAwB;IAC/F,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,oBAAoB,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,qBAAqB,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IACjE,IAAI,qBAAqB,GAAG,UAAU,IAAI,qBAAqB,GAAG,oBAAoB,KAAK,UAAU,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAClE,IAAI,MAAM,GAAG,qBAAqB,CAAC;IACnC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,OAAO,MAAM,GAAG,YAAY,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,EAAE,GAAG,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,2BAA2B,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,iBAAiB,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,iBAAiB,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,oBAAoB,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,EAAE,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACjE,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,WAAW,KAAK,kBAAkB,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,mDAAmD,kBAAkB,gBAAgB,gBAAgB,kDAAkD,CACxJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAe;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,aAAa,GAAG,KAAK;SACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACtE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;IACxC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,qBAAqB,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,KAAiB;IAC3E,2EAA2E;IAC3E,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACtH,CAAC;IACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,wEAAwE;IACxE,wCAAwC;IACxC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;AACtH,CAAC;AAUD,MAAM,kBAAkB,GAAyB;IAC/C,yBAAyB,EAAE,gCAAgC;IAC3D,yBAAyB,EAAE,gCAAgC;CAC5D,CAAC;AAEF,SAAS,eAAe,CAAC,iBAAyB,EAAE,KAAiB,EAAE,yBAAiC;IACtG,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,uDAAuD,yBAAyB,wBAAwB,CACzG,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC;QACH,8EAA8E;QAC9E,4EAA4E;QAC5E,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2C,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,kEAAkE,yBAAyB,wBAAwB,CACpH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAgC,EAChC,MAAM,GAAyB,kBAAkB;IAKjD,MAAM,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7E,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,+EAA+E;IAC/E,8EAA8E;IAC9E,qDAAqD;IACrD,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,uBAAuB,GAAG,KAAK,CAAC;IAEpC,OAAO,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,2BAA2B,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC9E,uBAAuB,GAAG,IAAI,CAAC;YAC/B,MAAM;QACR,CAAC;QACD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,iBAAiB,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,gBAAgB,CAAC;QAClE,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gBAAgB,IAAI,CAAC,CAAC;QACtB,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,WAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,eAAe,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACnH,sBAAsB,IAAI,UAAU,CAAC,MAAM,CAAC;YAC5C,IAAI,sBAAsB,GAAG,yBAAyB,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,6DAA6D,yBAAyB,cAAc,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,wBAAwB,CAAC,WAAW,EAAE,UAAU,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,UAAU,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,wBAAwB,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAgD,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,cAAc,GAClB,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;YAC/C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,2EAA2E;QAC3E,0EAA0E;QAC1E,6CAA6C;QAC7C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,8CAA8C,cAAc,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/portability-zip.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=portability-zip.test.d.ts.map

package/dist/portability-zip.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portability-zip.test.d.ts","sourceRoot":"","sources":["../src/portability-zip.test.ts"],"names":[],"mappings":""}

package/dist/portability-zip.test.js

@@ -0,0 +1,227 @@
+import { deflateRawSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+import { bytesToPortableFileEntry, isBlobStorePath, readZipArchive, } from "./portability-zip.js";
+// A minimal, faithful zip writer so the node reader can be round-tripped
+// against both STORE (method 0) and DEFLATE (method 8) entries. The layout
+// matches the browser writer in ui/src/lib/zip.ts: local file headers, then a
+// central directory, then the end-of-central-directory record.
+const crcTable = (() => {
+    const table = new Uint32Array(256);
+    for (let i = 0; i < 256; i += 1) {
+        let crc = i;
+        for (let bit = 0; bit < 8; bit += 1) {
+            crc = (crc & 1) === 1 ? (crc >>> 1) ^ 0xedb88320 : crc >>> 1;
+        }
+        table[i] = crc >>> 0;
+    }
+    return table;
+})();
+function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (const byte of bytes)
+        crc = (crc >>> 8) ^ crcTable[(crc ^ byte) & 0xff];
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function buildZip(entries, rootPath) {
+    const encoder = new TextEncoder();
+    const localChunks = [];
+    const centralChunks = [];
+    let localOffset = 0;
+    for (const entry of entries) {
+        const method = entry.method ?? 0;
+        const fileName = encoder.encode(`${rootPath}/${entry.path}`);
+        const checksum = crc32(entry.bytes);
+        const body = method === 8 ? deflateRawSync(Buffer.from(entry.bytes)) : Buffer.from(entry.bytes);
+        const localHeader = Buffer.alloc(30 + fileName.length);
+        localHeader.writeUInt32LE(0x04034b50, 0);
+        localHeader.writeUInt16LE(20, 4);
+        localHeader.writeUInt16LE(0x0800, 6);
+        localHeader.writeUInt16LE(method, 8);
+        localHeader.writeUInt32LE(checksum, 14);
+        localHeader.writeUInt32LE(body.length, 18);
+        localHeader.writeUInt32LE(entry.bytes.length, 22);
+        localHeader.writeUInt16LE(fileName.length, 26);
+        Buffer.from(fileName).copy(localHeader, 30);
+        const centralHeader = Buffer.alloc(46 + fileName.length);
+        centralHeader.writeUInt32LE(0x02014b50, 0);
+        centralHeader.writeUInt16LE(20, 4);
+        centralHeader.writeUInt16LE(20, 6);
+        centralHeader.writeUInt16LE(0x0800, 8);
+        centralHeader.writeUInt16LE(method, 10);
+        centralHeader.writeUInt32LE(checksum, 16);
+        centralHeader.writeUInt32LE(body.length, 20);
+        centralHeader.writeUInt32LE(entry.bytes.length, 24);
+        centralHeader.writeUInt16LE(fileName.length, 28);
+        centralHeader.writeUInt32LE(localOffset, 42);
+        Buffer.from(fileName).copy(centralHeader, 46);
+        localChunks.push(localHeader, body);
+        centralChunks.push(centralHeader);
+        localOffset += localHeader.length + body.length;
+    }
+    const centralDirectory = Buffer.concat(centralChunks);
+    const eocd = Buffer.alloc(22);
+    eocd.writeUInt32LE(0x06054b50, 0);
+    eocd.writeUInt16LE(entries.length, 8);
+    eocd.writeUInt16LE(entries.length, 10);
+    eocd.writeUInt32LE(centralDirectory.length, 12);
+    eocd.writeUInt32LE(localOffset, 16);
+    return new Uint8Array(Buffer.concat([...localChunks, centralDirectory, eocd]));
+}
+describe("isBlobStorePath", () => {
+    it("matches blobs/ entries at the archive root and under a package root", () => {
+        expect(isBlobStorePath("blobs/4f2d1c9a")).toBe(true);
+        expect(isBlobStorePath("paperclip-demo/blobs/4f2d1c9a")).toBe(true);
+        expect(isBlobStorePath("tasks/pap-1/TASK.md")).toBe(false);
+    });
+});
+describe("bytesToPortableFileEntry", () => {
+    it("keeps blobs/ entries as base64 octet streams regardless of extension", () => {
+        const bytes = new Uint8Array([0x00, 0x01, 0x80, 0xfe, 0xff]);
+        expect(bytesToPortableFileEntry("blobs/4f2d1c9a", bytes)).toEqual({
+            encoding: "base64",
+            data: Buffer.from(bytes).toString("base64"),
+            contentType: "application/octet-stream",
+        });
+    });
+    it("decodes valid UTF-8 entries to text and falls back to base64 for invalid bytes", () => {
+        const text = new TextEncoder().encode("# Notes\n\ncafé ✅\n");
+        expect(bytesToPortableFileEntry("tasks/pap-1/TASK.md", text)).toBe("# Notes\n\ncafé ✅\n");
+        const invalid = new Uint8Array([0x68, 0x69, 0xff, 0xfe, 0xc0]);
+        expect(bytesToPortableFileEntry("tasks/pap-1/raw", invalid)).toEqual({
+            encoding: "base64",
+            data: Buffer.from(invalid).toString("base64"),
+            contentType: "application/octet-stream",
+        });
+    });
+});
+describe("readZipArchive", () => {
+    it("round-trips STORE, DEFLATE, and base64 blob entries byte-exactly and strips the shared root", async () => {
+        const blobBytes = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x00, 0xff, 0x13, 0x37]);
+        // A text body large and repetitive enough that DEFLATE actually shrinks it,
+        // so the DEFLATE decode path is exercised, not just written.
+        const deflated = `# Weekly report\n${"paperclip ".repeat(512)}\n`;
+        const archive = buildZip([
+            { path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n"), method: 0 },
+            { path: "reports/weekly.md", bytes: new TextEncoder().encode(deflated), method: 8 },
+            { path: "blobs/4f2d1c9a", bytes: blobBytes, method: 0 },
+        ], "paperclip-demo");
+        await expect(readZipArchive(archive)).resolves.toEqual({
+            rootPath: "paperclip-demo",
+            files: {
+                "COMPANY.md": "---\nname: Demo\n---\n",
+                "reports/weekly.md": deflated,
+                "blobs/4f2d1c9a": {
+                    encoding: "base64",
+                    data: Buffer.from(blobBytes).toString("base64"),
+                    contentType: "application/octet-stream",
+                },
+            },
+        });
+    });
+    it("throws on a truncated archive so a partial upload fails closed", async () => {
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") }], "paperclip-demo");
+        // Chop the tail so a declared entry body runs past the end of the buffer.
+        const truncated = archive.slice(0, 40);
+        await expect(readZipArchive(truncated)).rejects.toThrow(/truncated|Invalid zip/i);
+    });
+    it("rejects data-descriptor entries the writer never emits", async () => {
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("hi") }], "paperclip-demo");
+        // Flip bit 0x0008 in the local header's general-purpose flag (offset 6).
+        archive[6] = archive[6] | 0x08;
+        await expect(readZipArchive(archive)).rejects.toThrow(/data descriptors/i);
+    });
+    // Locate the first central-directory file header so a test can lop off the
+    // whole directory + EOCD, leaving only intact local entries.
+    function centralDirectoryOffset(archive) {
+        for (let i = 0; i + 4 <= archive.length; i += 1) {
+            if (archive[i] === 0x50 && archive[i + 1] === 0x4b && archive[i + 2] === 0x01 && archive[i + 3] === 0x02) {
+                return i;
+            }
+        }
+        return -1;
+    }
+    it("rejects an archive truncated before the central directory", async () => {
+        const archive = buildZip([
+            { path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") },
+            { path: "agents/ceo/AGENTS.md", bytes: new TextEncoder().encode("---\nname: CEO\n---\n") },
+        ], "paperclip-demo");
+        // Keep every local entry intact but drop the directory + EOCD, mimicking an
+        // upload cut at a record boundary. The reader must not import the fragment.
+        const withoutDirectory = archive.slice(0, centralDirectoryOffset(archive));
+        await expect(readZipArchive(withoutDirectory)).rejects.toThrow(/truncated before the central directory/i);
+    });
+    it("rejects an archive whose end-of-central-directory record is missing", async () => {
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") }], "paperclip-demo");
+        // The central directory survives but the trailing 22-byte EOCD is gone.
+        await expect(readZipArchive(archive.slice(0, archive.length - 22))).rejects.toThrow(/end-of-central-directory/i);
+    });
+    it("rejects an archive whose central directory count does not match the entries read", async () => {
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") }], "paperclip-demo");
+        // Overstate the total-entries field (EOCD offset +10 → last 12 bytes in) so a
+        // silently-dropped central-directory record is caught.
+        archive[archive.length - 12] = 5;
+        archive[archive.length - 11] = 0;
+        await expect(readZipArchive(archive)).rejects.toThrow(/central directory declares 5 entries/i);
+    });
+    it("rejects a truncated archive re-terminated with a forged EOCD that matches the surviving entries", async () => {
+        // The exact silent-partial-import this reader guards against: an archive is
+        // cut after a complete leading local entry (losing the real central directory
+        // and EOCD), then re-terminated with a hand-forged 22-byte EOCD whose entry
+        // count matches the surviving local entry. An entry-count-only check would
+        // wave it through; validating the central directory it points at must not.
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") }], "paperclip-demo");
+        // Keep only the intact local entry (everything before the first central record).
+        const localOnly = archive.slice(0, centralDirectoryOffset(archive));
+        const forgedEocd = Buffer.alloc(22);
+        forgedEocd.writeUInt32LE(0x06054b50, 0);
+        forgedEocd.writeUInt16LE(1, 8); // entries on this disk
+        forgedEocd.writeUInt16LE(1, 10); // total entries — matches the one surviving local entry
+        forgedEocd.writeUInt32LE(0, 12); // central directory size (forged)
+        forgedEocd.writeUInt32LE(0, 16); // central directory offset (forged)
+        const forged = new Uint8Array(Buffer.concat([Buffer.from(localOnly), forgedEocd]));
+        await expect(readZipArchive(forged)).rejects.toThrow(/central directory location is inconsistent/i);
+    });
+    it("rejects a forged EOCD whose central directory offset points at non-directory bytes", async () => {
+        const archive = buildZip([{ path: "COMPANY.md", bytes: new TextEncoder().encode("---\nname: Demo\n---\n") }], "paperclip-demo");
+        const firstEntryOnly = archive.slice(0, centralDirectoryOffset(archive));
+        // A forged EOCD whose offset+size abut the record (passing the location
+        // check) but point into the local entry, which carries no directory signature.
+        const forgedEocd = Buffer.alloc(22);
+        forgedEocd.writeUInt32LE(0x06054b50, 0);
+        forgedEocd.writeUInt16LE(1, 8);
+        forgedEocd.writeUInt16LE(1, 10);
+        forgedEocd.writeUInt32LE(46, 12); // size
+        forgedEocd.writeUInt32LE(firstEntryOnly.length - 46, 16); // start = eocdOffset - size
+        const forged = new Uint8Array(Buffer.concat([Buffer.from(firstEntryOnly), forgedEocd]));
+        await expect(readZipArchive(forged)).rejects.toThrow(/malformed central directory record/i);
+    });
+    it("rejects two entries that normalize to the same path instead of silently overwriting", async () => {
+        const archive = buildZip([
+            { path: "docs/x.md", bytes: new TextEncoder().encode("first") },
+            { path: "docs//x.md", bytes: new TextEncoder().encode("second") },
+        ], "paperclip-demo");
+        await expect(readZipArchive(archive)).rejects.toThrow(/duplicate entry path "docs\/x\.md"/i);
+    });
+    it("bounds a highly compressible DEFLATE entry at the per-entry decompressed limit", async () => {
+        // Compresses tiny but expands to 8 KiB; a 1 KiB cap must reject it before it
+        // materializes. Real packages sit far under the 512 MB production default.
+        const bomb = new TextEncoder().encode("a".repeat(8 * 1024));
+        const archive = buildZip([{ path: "bomb.txt", bytes: bomb, method: 8 }], "paperclip-demo");
+        await expect(readZipArchive(archive, { maxEntryDecompressedBytes: 1024, maxTotalDecompressedBytes: 1 << 30 })).rejects.toThrow(/per-entry limit/i);
+    });
+    it("bounds a stored entry at the per-entry decompressed limit", async () => {
+        const stored = new TextEncoder().encode("b".repeat(4 * 1024));
+        const archive = buildZip([{ path: "big.bin", bytes: stored, method: 0 }], "paperclip-demo");
+        await expect(readZipArchive(archive, { maxEntryDecompressedBytes: 1024, maxTotalDecompressedBytes: 1 << 30 })).rejects.toThrow(/per-entry limit/i);
+    });
+    it("bounds the aggregate decompressed size across many entries", async () => {
+        const chunk = new TextEncoder().encode("c".repeat(600));
+        const archive = buildZip([
+            { path: "a.txt", bytes: chunk, method: 0 },
+            { path: "b.txt", bytes: chunk, method: 0 },
+        ], "paperclip-demo");
+        // Each entry is under the per-entry cap, but together they cross the total.
+        await expect(readZipArchive(archive, { maxEntryDecompressedBytes: 4096, maxTotalDecompressedBytes: 1000 })).rejects.toThrow(/exceed the 1000-byte limit/i);
+    });
+});
+//# sourceMappingURL=portability-zip.test.js.map