@zip.js/zip.js 2.15.0 → 2.16.1

package/dist/zip-fs-core.js

@@ -223,7 +223,7 @@
 	const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 	const ERR_INVALID_PASS_THROUGH_VALUE = "Invalid passThrough option (must be a boolean or 'compressed')";
 	const ERR_ABORTED = "The operation was aborted";
-	const ABORT_ERROR_NAME = "AbortError";
+	const ABORT_ERROR_NAME$1 = "AbortError";
 
 	function checkFunctionOption(value) {
 		if (value && typeof value != FUNCTION_TYPE) {
@@ -241,7 +241,7 @@
 
 	function throwIfAborted(signal) {
 		if (signal && signal.aborted) {
-			throw signal.reason === UNDEFINED_VALUE ? new DOMException(ERR_ABORTED, ABORT_ERROR_NAME) : signal.reason;
+			throw signal.reason === UNDEFINED_VALUE ? new DOMException(ERR_ABORTED, ABORT_ERROR_NAME$1) : signal.reason;
 		}
 	}
 
@@ -1283,12 +1283,12 @@
 	class AESDecryptionStream extends TransformStream {
 
 		constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly, checkAuthenticationCode = true }) {
+			const aesCrypto = {};
 			super({
 				start() {
-					initAesCrypto(this, password, rawPassword, encryptionStrength);
+					initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength);
 				},
 				async transform(chunk, controller) {
-					const aesCrypto = this;
 					const {
 						password,
 						strength,
@@ -1307,6 +1307,9 @@
 					} else {
 						await ready;
 					}
+					if (aesCrypto.discarded) {
+						return;
+					}
 					const output = new Uint8Array(chunk.length - AUTHENTICATION_CODE_LENGTH - ((chunk.length - AUTHENTICATION_CODE_LENGTH) % BLOCK_LENGTH));
 					controller.enqueue(append(aesCrypto, chunk, output, 0, AUTHENTICATION_CODE_LENGTH, true));
 				},
@@ -1315,9 +1318,12 @@
 						engine,
 						pendingInput,
 						ready
-					} = this;
+					} = aesCrypto;
 					if (engine) {
 						await ready;
+						if (aesCrypto.discarded) {
+							return;
+						}
 						const originalAuthenticationCode = subarray(pendingInput, pendingInput.length - AUTHENTICATION_CODE_LENGTH);
 						const decryptedChunkArray = new Uint8Array(subarray(pendingInput, 0, pendingInput.length - AUTHENTICATION_CODE_LENGTH));
 						engine.process(decryptedChunkArray, true);
@@ -1327,27 +1333,26 @@
 							invalidAuthenticationCode |= authenticationCode[indexByte] ^ originalAuthenticationCode[indexByte];
 						}
 						if (invalidAuthenticationCode && checkAuthenticationCode) {
-							throw new Error(ERR_INVALID_AUTHENTICATION_CODE);
+							controller.error(new Error(ERR_INVALID_AUTHENTICATION_CODE));
+							return;
 						}
 						controller.enqueue(decryptedChunkArray);
 					}
-				},
-				cancel() {
-					disposeEngine(this);
 				}
 			});
+			setDisposingReadable(this, aesCrypto);
 		}
 	}
 
 	class AESEncryptionStream extends TransformStream {
 
 		constructor({ password, rawPassword, encryptionStrength }) {
+			const aesCrypto = {};
 			super({
 				start() {
-					initAesCrypto(this, password, rawPassword, encryptionStrength);
+					initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength);
 				},
 				async transform(chunk, controller) {
-					const aesCrypto = this;
 					const {
 						password,
 						strength,
@@ -1361,6 +1366,9 @@
 					} else {
 						await ready;
 					}
+					if (aesCrypto.discarded) {
+						return;
+					}
 					const output = new Uint8Array(preamble.length + chunk.length - (chunk.length % BLOCK_LENGTH));
 					output.set(preamble, 0);
 					controller.enqueue(append(aesCrypto, chunk, output, preamble.length, 0, false));
@@ -1370,19 +1378,20 @@
 						engine,
 						pendingInput,
 						ready
-					} = this;
+					} = aesCrypto;
 					if (engine) {
 						await ready;
+						if (aesCrypto.discarded) {
+							return;
+						}
 						const encryptedChunkArray = new Uint8Array(pendingInput);
 						engine.process(encryptedChunkArray, false);
 						const authenticationCode = subarray(engine.digest(), 0, AUTHENTICATION_CODE_LENGTH);
 						controller.enqueue(concat(encryptedChunkArray, authenticationCode));
 					}
-				},
-				cancel() {
-					disposeEngine(this);
 				}
 			});
+			setDisposingReadable(this, aesCrypto);
 		}
 	}
 
@@ -1391,7 +1400,37 @@
 			ready: new Promise(resolve => aesCrypto.resolveReady = resolve),
 			password: encodePassword(password, rawPassword),
 			strength: encryptionStrength - 1,
-			pendingInput: EMPTY_UINT8_ARRAY
+			pendingInput: EMPTY_UINT8_ARRAY,
+			discarded: false
+		});
+	}
+
+	function setDisposingReadable(stream, aesCrypto) {
+		const reader = stream.readable.getReader();
+		const readable = new ReadableStream({
+			async pull(controller) {
+				try {
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
+				} catch (error) {
+					disposeEngine(aesCrypto);
+					reader.cancel(error).catch(() => { });
+					throw error;
+				}
+			},
+			cancel(reason) {
+				disposeEngine(aesCrypto);
+				return reader.cancel(reason);
+			}
+		});
+		Object.defineProperty(stream, "readable", {
+			get() {
+				return readable;
+			}
 		});
 	}
 
@@ -1424,7 +1463,9 @@
 		}
 	}
 
-	function disposeEngine({ engine }) {
+	function disposeEngine(aesCrypto) {
+		const { engine } = aesCrypto;
+		aesCrypto.discarded = true;
 		if (engine && engine.dispose) {
 			engine.dispose();
 		}
@@ -1441,6 +1482,9 @@
 		const keyLength = KEY_LENGTH[strength];
 		const compositeKey = await deriveKey(password, salt, keyLength * 2 + PASSWORD_VERIFICATION_LENGTH);
 		aesCrypto.engine = createEngine(subarray(compositeKey, 0, keyLength), subarray(compositeKey, keyLength, keyLength * 2));
+		if (aesCrypto.discarded) {
+			disposeEngine(aesCrypto);
+		}
 		return subarray(compositeKey, keyLength * 2);
 	}
 
@@ -1592,11 +1636,11 @@
 	}
 
 	function createKeys(target, password, rawPassword) {
-		const keys = [0x12345678, 0x23456789, 0x34567890];
+		const cryptoKeys = [0x12345678, 0x23456789, 0x34567890];
 		Object.assign(target, {
-			keys,
-			crcKey0: new Crc32(keys[0]),
-			crcKey2: new Crc32(keys[2])
+			cryptoKeys,
+			crcKey0: new Crc32(cryptoKeys[0]),
+			crcKey2: new Crc32(cryptoKeys[2])
 		});
 		if (rawPassword) {
 			for (let index = 0; index < rawPassword.length; index++) {
@@ -1610,17 +1654,17 @@
 	}
 
 	function updateKeys(target, byte) {
-		let [, key1] = target.keys;
+		let [, key1] = target.cryptoKeys;
 		target.crcKey0.append([byte]);
 		const key0 = ~target.crcKey0.get();
 		key1 = getInt32(Math.imul(getInt32(key1 + getInt8(key0)), 134775813) + 1);
 		target.crcKey2.append([key1 >>> 24]);
 		const key2 = ~target.crcKey2.get();
-		target.keys = [key0, key1, key2];
+		target.cryptoKeys = [key0, key1, key2];
 	}
 
 	function getByte(target) {
-		const temp = target.keys[2] | 2;
+		const temp = target.cryptoKeys[2] | 2;
 		return getInt8(Math.imul(temp, (temp ^ 1)) >>> 8);
 	}
 
@@ -1668,11 +1712,16 @@
 		const reader = readable.getReader();
 		return new ReadableStream({
 			async pull(controller) {
-				const { value, done } = await reader.read();
-				if (done) {
-					controller.close();
-				} else {
-					controller.enqueue(value);
+				try {
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
+				} catch (error) {
+					reader.cancel(error).catch(() => { });
+					throw error;
 				}
 			},
 			cancel(reason) {
@@ -1858,7 +1907,6 @@
 	const GZIP_HEADER_LENGTH = 10;
 	const GZIP_TRAILER_LENGTH = 8;
 	const GZIP_HEADER_BYTES = [0x1f, 0x8b, 0x08];
-	const GZIP_OUTPUT_STALL_TIMEOUT = 5000;
 
 	class DeflateStream extends TransformStream {
 
@@ -1869,7 +1917,7 @@
 			let crc32Stream, encryptionStream, gzipCrc32Stream;
 			let readable = super.readable;
 			const codecStreams = format && getCodecStreams(format);
-			const GzipCompressionStream = getGzipCompressionStream(useCompressionStream, CompressionStream, CompressionStreamFallback);
+			const GzipCompressionStream = getGzipCodecStream(useCompressionStream, CompressionStream, CompressionStreamFallback);
 			const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) && Boolean(GzipCompressionStream);
 			if ((!encrypted || zipCrypto) && computeCrc32 && !useGzipCrc32) {
 				crc32Stream = new Crc32Stream();
@@ -1886,6 +1934,9 @@
 					try {
 						readable = pipeThroughCompressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamFallback);
 					} catch (error) {
+						if (!useCompressionStream && CompressionStreamFallback) {
+							throw error;
+						}
 						let gzipStream;
 						try {
 							gzipStream = new CompressionStream(FORMAT_GZIP);
@@ -1955,74 +2006,134 @@
 	}
 
 	function pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, crc32) {
+		const writer = gzipStream.writable.getWriter();
+		const reader = gzipStream.readable.getReader();
+		const outputCrc32 = crc32 === UNDEFINED_VALUE ? new Crc32() : UNDEFINED_VALUE;
 		let outputLength = 0;
 		let inputDone = false;
-		let watchdogTimeout;
+		let trailerWritten = false;
+		let idleCheckArmed = false;
+		let readCount = 0;
+		let readPending = false;
 		let resolveTrailerReady, rejectTrailerReady;
 		const trailerReady = new Promise((resolve, reject) => {
 			resolveTrailerReady = resolve;
 			rejectTrailerReady = reject;
 		});
 		trailerReady.catch(() => { });
-		if (!outputSize) {
-			resolveTrailerReady();
-		}
-		const gzipWrapStream = new TransformStream({
-			start(controller) {
+		pump();
+		return new ReadableStream({
+			async pull(controller) {
+				try {
+					const { value, done } = await read();
+					if (done) {
+						controller.close();
+					} else {
+						outputLength += value.length;
+						if (outputLength > outputSize) {
+							throw new Error(ERR_INVALID_UNCOMPRESSED_SIZE);
+						}
+						if (outputCrc32) {
+							outputCrc32.append(value);
+						}
+						controller.enqueue(value);
+					}
+				} catch (error) {
+					rejectTrailerReady(error);
+					await cancel(reader, error);
+					throw trailerWritten ? getTrailerError(error) : error;
+				}
+			},
+			cancel(reason) {
+				rejectTrailerReady(reason);
+				return reader.cancel(reason);
+			}
+		});
+
+		async function pump() {
+			const inputReader = readable.getReader();
+			try {
 				const header = new Uint8Array(GZIP_HEADER_LENGTH);
 				header.set(GZIP_HEADER_BYTES);
-				controller.enqueue(header);
-			},
-			transform(chunk, controller) {
-				controller.enqueue(chunk);
-			},
-			async flush(controller) {
+				await writer.write(header);
+				for (; ;) {
+					await writer.ready;
+					const { value, done } = await inputReader.read();
+					if (done) {
+						break;
+					}
+					await writer.write(value);
+				}
 				inputDone = true;
-				startWatchdog();
-				try {
+				if (outputCrc32) {
+					if (readPending) {
+						armIdleCheck();
+					}
 					await trailerReady;
-				} finally {
-					stopWatchdog();
 				}
 				const trailer = new Uint8Array(GZIP_TRAILER_LENGTH);
 				const dataView = getDataView(trailer);
-				dataView.setUint32(0, crc32.get(), true);
+				dataView.setUint32(0, outputCrc32 ? outputCrc32.get() : crc32, true);
 				dataView.setUint32(4, outputSize, true);
-				controller.enqueue(trailer);
-			},
-			cancel(reason) {
-				rejectTrailerReady(reason);
+				trailerWritten = true;
+				await writer.write(trailer);
+				await writer.close();
+			} catch (error) {
+				await abort(writer, error);
+				await cancel(inputReader, error);
 			}
-		});
-		const outputStream = new TransformStream({
-			transform(chunk, controller) {
-				crc32.append(chunk);
-				outputLength += chunk.length;
-				if (outputLength >= outputSize) {
-					resolveTrailerReady();
-				} else if (inputDone) {
-					startWatchdog();
-				}
-				controller.enqueue(chunk);
-			},
-			cancel(reason) {
-				rejectTrailerReady(reason);
+		}
+
+		function read() {
+			readCount++;
+			readPending = true;
+			const result = reader.read();
+			result.then(onReadSettled, onReadSettled);
+			if (inputDone && outputCrc32) {
+				armIdleCheck();
 			}
-		});
-		readable = pipeThrough(readable, gzipWrapStream);
-		readable = pipeThroughBackpressured(readable, gzipStream);
-		return pipeThrough(readable, outputStream);
+			return result;
+		}
 
-		function startWatchdog() {
-			stopWatchdog();
-			watchdogTimeout = setTimeout(() => rejectTrailerReady(new Error(ERR_INVALID_UNCOMPRESSED_SIZE)), GZIP_OUTPUT_STALL_TIMEOUT);
+		function onReadSettled() {
+			readPending = false;
 		}
 
-		function stopWatchdog() {
-			clearTimeout(watchdogTimeout);
+		async function armIdleCheck() {
+			if (!idleCheckArmed) {
+				idleCheckArmed = true;
+				const count = readCount;
+				await nextTask();
+				idleCheckArmed = false;
+				if (readPending) {
+					if (readCount == count) {
+						resolveTrailerReady();
+					} else {
+						armIdleCheck();
+					}
+				}
+			}
+		}
+
+		function getTrailerError(error) {
+			const trailerError = new Error(outputLength == outputSize ? ERR_INVALID_CRC32 : ERR_INVALID_UNCOMPRESSED_SIZE);
+			trailerError.cause = error;
+			return trailerError;
 		}
 	}
 
+	function nextTask() {
+		return new Promise(resolve => {
+			const { port1, port2 } = new MessageChannel();
+			port2.onmessage = () => {
+				port1.close();
+				port2.close();
+				resolve();
+			};
+			port1.postMessage(UNDEFINED_VALUE);
+		});
+	}
+
 	class InflateStream extends TransformStream {
 
 		constructor(options, { chunkSize, DecompressionStreamFallback, DecompressionStream }) {
@@ -2043,20 +2154,32 @@
 				if (codecStreams) {
 					readable = pipeThroughBackpressured(readable, createCodecStream(codecStreams.DecompressionStream, format, { chunkSize, compressionMethod, rawBitFlag, uncompressedSize: outputSize }));
 				} else {
-					try {
-						readable = pipeThroughCompressionStream(readable, useCompressionStream, { chunkSize, deflate64 }, DecompressionStream, DecompressionStreamFallback);
-					} catch (error) {
-						if (deflate64 || outputSize === UNDEFINED_VALUE) {
-							throw error;
-						}
-						let gzipStream;
+					let gzipStream;
+					const GzipDecompressionStream = getGzipCodecStream(useCompressionStream, DecompressionStream, DecompressionStreamFallback);
+					if (checkCrc32 && !deflate64 && crc32 !== UNDEFINED_VALUE && outputSize !== UNDEFINED_VALUE && GzipDecompressionStream) {
 						try {
-							gzipStream = new DecompressionStream(FORMAT_GZIP);
+							gzipStream = new GzipDecompressionStream(FORMAT_GZIP, { chunkSize });
 						} catch {
-							throw error;
+							gzipStream = UNDEFINED_VALUE;
 						}
-						gzipCrc32 = new Crc32();
-						readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, gzipCrc32);
+					}
+					if (!gzipStream) {
+						try {
+							readable = pipeThroughCompressionStream(readable, useCompressionStream, { chunkSize, deflate64 }, DecompressionStream, DecompressionStreamFallback);
+						} catch (error) {
+							if (deflate64 || outputSize === UNDEFINED_VALUE || (!useCompressionStream && DecompressionStreamFallback)) {
+								throw error;
+							}
+							try {
+								gzipStream = new DecompressionStream(FORMAT_GZIP);
+							} catch {
+								throw error;
+							}
+						}
+					}
+					if (gzipStream) {
+						gzipCrc32 = true;
+						readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, crc32);
 					}
 				}
 				readable = mapInflateStreamError(readable);
@@ -2066,8 +2189,8 @@
 				readable = pipeThrough(readable, crc32Stream);
 			}
 			setReadable(this, readable, () => {
-				if (checkCrc32) {
-					const computedCrc32 = gzipCrc32 ? gzipCrc32.get() >>> 0 : new DataView(crc32Stream.value.buffer).getUint32(0, false);
+				if (crc32Stream) {
+					const computedCrc32 = new DataView(crc32Stream.value.buffer).getUint32(0, false);
 					if (crc32 != computedCrc32) {
 						throw new Error(ERR_INVALID_CRC32);
 					}
@@ -2124,11 +2247,11 @@
 		return new CodecStreamClass(format, options);
 	}
 
-	function getGzipCompressionStream(useCompressionStream, CompressionStreamNative, CompressionStreamFallback) {
-		if (useCompressionStream && CompressionStreamNative) {
-			return CompressionStreamNative;
-		} else if (CompressionStreamFallback && CompressionStreamFallback.requiresModule) {
-			return CompressionStreamFallback;
+	function getGzipCodecStream(useCompressionStream, CodecStreamNative, CodecStreamFallback) {
+		if (useCompressionStream && CodecStreamNative) {
+			return CodecStreamNative;
+		} else if (CodecStreamFallback && CodecStreamFallback.requiresModule) {
+			return CodecStreamFallback;
 		}
 	}
 
@@ -2198,10 +2321,15 @@
 		const reader = readable.getReader();
 		return new ReadableStream({
 			async pull(controller) {
-				let result;
 				try {
-					result = await reader.read();
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
 				} catch (error) {
+					await cancel(reader, error);
 					if (error && error.message) {
 						throw error;
 					}
@@ -2209,12 +2337,6 @@
 					mappedError.cause = error;
 					throw mappedError;
 				}
-				const { value, done } = result;
-				if (done) {
-					controller.close();
-				} else {
-					controller.enqueue(value);
-				}
 			},
 			cancel(reason) {
 				return reader.cancel(reason);
@@ -3726,10 +3848,11 @@
 
 		createReadable(options) {
 			const reader = this;
-			const { useRangeHeader, forceRangeRequests, size } = reader;
+			const { useRangeHeader, forceRangeRequests, size, eocdCache } = reader;
 			if ((useRangeHeader || forceRangeRequests) && size !== UNDEFINED_VALUE) {
 				const { offset = 0, size: readSize = size - offset } = options || {};
-				if (readSize > 0 && offset < size) {
+				const cached = eocdCache && offset >= size - eocdCache.length;
+				if (readSize > 0 && offset < size && !cached) {
 					return createRangeReadable(reader, offset, Math.min(readSize, size - offset));
 				}
 			}
@@ -5288,8 +5411,8 @@
 			const passThroughCompression = Boolean(passThrough);
 			const passThroughEncryption = passThrough === true;
 			checkPasswordOption(password, rawPassword);
-			password = password && password.length && password;
-			rawPassword = rawPassword && rawPassword.length && rawPassword;
+			password = password && password.length ? password : UNDEFINED_VALUE;
+			rawPassword = rawPassword && rawPassword.length ? rawPassword : UNDEFINED_VALUE;
 			if (extraFieldAES) {
 				if (extraFieldAES.originalCompressionMethod != COMPRESSION_METHOD_AES) {
 					throw new Error(ERR_UNSUPPORTED_COMPRESSION);
@@ -6050,7 +6173,7 @@
 	async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 		const { size } = reader;
 		const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
-		const remoteProbeBudget = { count: MAX_END_OF_CENTRAL_DIR_PROBES };
+		const remoteProbeBudget = { remaining: MAX_END_OF_CENTRAL_DIR_PROBES };
 		let endOfDirectoryInfo;
 		let plausibleEndOfDirectoryInfo;
 		let endOfDirectoryReachingEndCount = 0;
@@ -6143,8 +6266,8 @@
 		if (signatureOffset >= anchoredOffset) {
 			return getUint32$1(view, signatureOffset - anchoredOffset);
 		}
-		if (remoteProbeBudget.count > 0) {
-			remoteProbeBudget.count--;
+		if (remoteProbeBudget.remaining > 0) {
+			remoteProbeBudget.remaining--;
 			const signatureArray = await readUint8Array(reader, signatureOffset, 4);
 			return getUint32$1(getDataView(signatureArray), 0);
 		}
@@ -7060,9 +7183,11 @@
 		const passThrough = checkPassThroughOption(getOptionValue(zipWriter, options, OPTION_PASS_THROUGH));
 		const passThroughCompression = Boolean(passThrough);
 		const passThroughEncryption = passThrough === true;
-		const password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
-		const rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+		let password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
+		let rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
 		checkPasswordOption(password, rawPassword);
+		password = password && password.length ? password : UNDEFINED_VALUE;
+		rawPassword = rawPassword && rawPassword.length ? rawPassword : UNDEFINED_VALUE;
 		const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 		const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 		const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
@@ -8858,7 +8983,7 @@
 	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 	 */
 
-	const VERSION = "2.15.0";
+	const VERSION = "2.16.1";
 
 	/*
 	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
@@ -9351,7 +9476,11 @@
 	const ERR_INVALID_PASS_THROUGH = "Invalid passThrough option (use readerOptions.passThrough or set uncompressedSize for each entry)";
 	const ERR_INVALID_READER_OPTIONS = "Invalid readerOptions (must be an object)";
 	const ERR_UNSUPPORTED_PASS_THROUGH_VALUE = "The 'compressed' passThrough option is only supported by Entry#getData() and ZipWriter#add()";
+	const ERR_INVALID_PASSWORDS = "Invalid passwords option (must be an array of strings)";
+	const ERR_INVALID_REQUEST_PASSWORD = "Invalid requestPassword option (must be a function returning a string or undefined)";
 	const ERR_ABORT_EXPORT = "zipjs-abort-export";
+	const ABORT_ERROR_NAME = "AbortError";
+	const EMPTY_RAW_PASSWORD = new Uint8Array(0);
 
 	class ZipEntry {
 
@@ -9724,8 +9853,10 @@
 				zipReader = new ZipReader(reader, options);
 			}
 			checkPassThroughValue(options.passThrough);
+			checkPasswordCandidatesOptions(options);
 			const duplicates = checkDuplicatesOption(options.duplicates);
 			const importedEntries = [];
+			const passwordState = { known: [] };
 			const entries = await zipReader.getEntries(options);
 			for (const entry of entries) {
 				let parent = this;
@@ -9770,7 +9901,7 @@
 						}
 						importedEntries.push(addChild(parent, name, {
 							data: entry,
-							Reader: getZipBlobReader(Object.assign({}, options)),
+							Reader: getZipBlobReader(Object.assign({}, options), passwordState),
 							uncompressedSize: options.passThrough ? entry.compressedSize : entry.uncompressedSize,
 							passThrough: options.passThrough
 						}));
@@ -10099,7 +10230,7 @@
 		};
 	}
 
-	function getZipBlobReader(options) {
+	function getZipBlobReader(options, passwordState) {
 		return class extends Reader {
 
 			constructor(entry, options = {}) {
@@ -10112,12 +10243,12 @@
 				const zipBlobReader = this;
 				const readerOptions = Object.assign({}, options, zipBlobReader.options);
 				const { checkOverlappingEntry, checkOverlappingEntryOnly } = readerOptions;
-				const data = await zipBlobReader.entry.getData(new BlobWriter(), Object.assign(readerOptions, {
+				const data = await readEntryData(zipBlobReader.entry, Object.assign(readerOptions, {
 					checkPasswordOnly: false,
 					checkOverlappingEntry: checkOverlappingEntryOnly || checkOverlappingEntry,
 					checkOverlappingEntryOnly: false,
 					preventClose: false
-				}));
+				}), passwordState);
 				zipBlobReader.data = data;
 				zipBlobReader.blobReader = new BlobReader(data);
 				zipBlobReader.size = data.size;
@@ -10179,10 +10310,9 @@
 				await initStream(reader);
 			} catch (error) {
 				try {
+					error.entry = child;
 					error.entryId = child.id;
-					error.cause = {
-						entry: child
-					};
+					error.entryName = child.getRelativeName(entry);
 				} catch {
 					// ignored
 				}
@@ -10274,10 +10404,136 @@
 		}
 		if (readerOptions) {
 			checkPassThroughValue(readerOptions.passThrough);
+			checkPasswordCandidatesOptions(readerOptions);
 		}
 		return readerOptions;
 	}
 
+	function checkPasswordCandidatesOptions(options) {
+		const { passwords, requestPassword } = options;
+		if (passwords && (!Array.isArray(passwords) || passwords.some(password => typeof password != STRING_TYPE))) {
+			throw new Error(ERR_INVALID_PASSWORDS);
+		}
+		if (requestPassword && typeof requestPassword != FUNCTION_TYPE) {
+			throw new Error(ERR_INVALID_REQUEST_PASSWORD);
+		}
+	}
+
+	async function readEntryData(entry, options, passwordState) {
+		checkPasswordCandidatesOptions(options);
+		const { passwords, requestPassword, signal } = options;
+		options = Object.assign({}, options);
+		delete options.passwords;
+		delete options.requestPassword;
+		if (!entry.encrypted || options.passThrough || (!passwords && !requestPassword)) {
+			return entry.getData(new BlobWriter(), options);
+		}
+		const tried = new Set();
+		let error;
+		while (true) {
+			for (const candidate of getPasswordCandidates(options, passwordState, passwords)) {
+				if (!tried.has(candidate.key)) {
+					const result = await tryPasswordCandidate(candidate);
+					if (result.done) {
+						return result.data;
+					}
+					error = result.error;
+				}
+			}
+			if (!requestPassword) {
+				break;
+			}
+			if (passwordState.pendingPrompt) {
+				await passwordState.pendingPrompt;
+				continue;
+			}
+			let release;
+			passwordState.pendingPrompt = new Promise(resolve => release = resolve);
+			try {
+				const answer = await requestPassword(entry, error);
+				if (answer === UNDEFINED_VALUE || answer === null) {
+					break;
+				}
+				// deno-lint-ignore valid-typeof
+				if (typeof answer != STRING_TYPE) {
+					throw new Error(ERR_INVALID_REQUEST_PASSWORD);
+				}
+				const result = await tryPasswordCandidate(getPasswordCandidate(answer));
+				if (result.done) {
+					return result.data;
+				}
+				error = result.error;
+			} finally {
+				passwordState.pendingPrompt = UNDEFINED_VALUE;
+				release();
+			}
+		}
+		throw new Error(tried.size ? ERR_INVALID_PASSWORD : ERR_ENCRYPTED);
+
+		async function tryPasswordCandidate(candidate) {
+			tried.add(candidate.key);
+			const candidateOptions = Object.assign({}, options, candidate.options);
+			if (entry.zipCrypto) {
+				candidateOptions.checkCrc32 = true;
+				try {
+					await entry.getData(null, Object.assign({}, candidateOptions, { checkPasswordOnly: true }));
+				} catch (probeError) {
+					if (isInvalidPasswordError(probeError)) {
+						return { done: false, error: probeError };
+					}
+					throw probeError;
+				}
+			}
+			try {
+				const data = await entry.getData(new BlobWriter(), candidateOptions);
+				rememberPassword(passwordState, candidate);
+				return { done: true, data };
+			} catch (readError) {
+				if (isAbortError(readError, signal) || (!entry.zipCrypto && !isInvalidPasswordError(readError))) {
+					throw readError;
+				}
+				return { done: false, error: readError };
+			}
+		}
+	}
+
+	function isInvalidPasswordError(error) {
+		return isErrorObject(error) && error.message == ERR_INVALID_PASSWORD;
+	}
+
+	function isAbortError(error, signal) {
+		return Boolean(signal && signal.aborted) || (isErrorObject(error) && error.name == ABORT_ERROR_NAME);
+	}
+
+	function getPasswordCandidates(options, passwordState, passwords) {
+		const candidates = [];
+		const { password, rawPassword } = options;
+		if (rawPassword && rawPassword.length) {
+			candidates.push({ key: rawPassword, options: { password: "", rawPassword } });
+		}
+		if (password) {
+			candidates.push(getPasswordCandidate(password));
+		}
+		candidates.push(...passwordState.known);
+		if (passwords) {
+			candidates.push(...passwords.filter(password => password).map(getPasswordCandidate));
+		}
+		return candidates;
+	}
+
+	function getPasswordCandidate(password) {
+		return { key: password, options: { password, rawPassword: EMPTY_RAW_PASSWORD } };
+	}
+
+	function rememberPassword(passwordState, candidate) {
+		const { known } = passwordState;
+		const index = known.findIndex(knownCandidate => knownCandidate.key === candidate.key);
+		if (index != -1) {
+			known.splice(index, 1);
+		}
+		known.unshift(candidate);
+	}
+
 	function checkPassThroughValue(passThrough) {
 		if (checkPassThroughOption(passThrough) === PASS_THROUGH_COMPRESSED) {
 			throw new Error(ERR_UNSUPPORTED_PASS_THROUGH_VALUE);
@@ -10415,6 +10671,7 @@
 	async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 		const { onstart, onprogress, onend } = options;
 		checkPassThroughValue(options.passThrough);
+		checkPasswordCandidatesOptions(options);
 		const readerOptions = checkReaderOptions(options.readerOptions);
 		const abortController = new AbortController();
 		const { signal } = abortController;
@@ -10713,11 +10970,13 @@
 	exports.ERR_INVALID_MSDOS_ATTRIBUTES = ERR_INVALID_MSDOS_ATTRIBUTES;
 	exports.ERR_INVALID_MSDOS_DATA = ERR_INVALID_MSDOS_DATA;
 	exports.ERR_INVALID_PASSWORD = ERR_INVALID_PASSWORD;
+	exports.ERR_INVALID_PASSWORDS = ERR_INVALID_PASSWORDS;
 	exports.ERR_INVALID_PASSWORD_TYPE = ERR_INVALID_PASSWORD_TYPE;
 	exports.ERR_INVALID_PASS_THROUGH = ERR_INVALID_PASS_THROUGH;
 	exports.ERR_INVALID_PASS_THROUGH_VALUE = ERR_INVALID_PASS_THROUGH_VALUE;
 	exports.ERR_INVALID_READER = ERR_INVALID_READER;
 	exports.ERR_INVALID_READER_OPTIONS = ERR_INVALID_READER_OPTIONS;
+	exports.ERR_INVALID_REQUEST_PASSWORD = ERR_INVALID_REQUEST_PASSWORD;
 	exports.ERR_INVALID_SIGNAL = ERR_INVALID_SIGNAL;
 	exports.ERR_INVALID_SIGNATURE_DATA = ERR_INVALID_SIGNATURE_DATA;
 	exports.ERR_INVALID_STRICTNESS = ERR_INVALID_STRICTNESS;