@zip.js/zip.js 2.8.26 → 2.8.29

package/dist/zip-core.js

@@ -50,6 +50,7 @@
 	const END_OF_CENTRAL_DIR_SIGNATURE = 0x06054b50;
 	const ZIP64_END_OF_CENTRAL_DIR_SIGNATURE = 0x06064b50;
 	const ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE = 0x07064b50;
+	const CENTRAL_FILE_HEADER_LENGTH = 46;
 	const END_OF_CENTRAL_DIR_LENGTH = 22;
 	const ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH = 20;
 	const ZIP64_END_OF_CENTRAL_DIR_LENGTH = 56;
@@ -97,9 +98,11 @@
 	const DIRECTORY_SIGNATURE = "/";
 
 	const HEADER_SIZE = 30;
+	const HEADER_OFFSET_VERSION = 0;
 	const HEADER_OFFSET_SIGNATURE = 10;
 	const HEADER_OFFSET_COMPRESSED_SIZE = 14;
 	const HEADER_OFFSET_UNCOMPRESSED_SIZE = 18;
+	const LOCAL_HEADER_COMMON_OFFSET = 4;
 
 	const MAX_DATE = new Date(2107, 11, 31);
 	const MIN_DATE = new Date(1980, 0, 1);
@@ -154,6 +157,7 @@
 		chunkSize: 64 * 1024,
 		maxWorkers,
 		terminateWorkerTimeout: 5000,
+		workerStarvationTimeout: 5000,
 		useWebWorkers: true,
 		useCompressionStream: true,
 		CompressionStream: typeof CompressionStream != UNDEFINED_TYPE && CompressionStream,
@@ -176,6 +180,7 @@
 			chunkSize,
 			maxWorkers,
 			terminateWorkerTimeout,
+			workerStarvationTimeout,
 			useCompressionStream,
 			useWebWorkers,
 			CompressionStream,
@@ -191,6 +196,7 @@
 		setIfDefined("chunkSize", chunkSize);
 		setIfDefined("maxWorkers", maxWorkers);
 		setIfDefined("terminateWorkerTimeout", terminateWorkerTimeout);
+		setIfDefined("workerStarvationTimeout", workerStarvationTimeout);
 		setIfDefined("useCompressionStream", useCompressionStream);
 		setIfDefined("useWebWorkers", useWebWorkers);
 		setIfDefined("CompressionStream", CompressionStream);
@@ -952,37 +958,6 @@
 		}
 	};
 
-	/**
-	 * Random values
-	 * @namespace
-	 */
-	const random = {
-		/** 
-		 * Generate random words with pure js, cryptographically not as strong & safe as native implementation.
-		 * @param {TypedArray} typedArray The array to fill.
-		 * @return {TypedArray} The random values.
-		 */
-		getRandomValues(typedArray) {
-			const words = new Uint32Array(typedArray.buffer);
-			const r = (m_w) => {
-				let m_z = 0x3ade68b1;
-				const mask = 0xffffffff;
-				return function () {
-					m_z = (0x9069 * (m_z & 0xFFFF) + (m_z >> 0x10)) & mask;
-					m_w = (0x4650 * (m_w & 0xFFFF) + (m_w >> 0x10)) & mask;
-					const result = ((((m_z << 0x10) + m_w) & mask) / 0x100000000) + .5;
-					return result * (Math.random() > .5 ? 1 : -1);
-				};
-			};
-			for (let i = 0, rcache; i < typedArray.length; i += 4) {
-				const _r = r((rcache || Math.random()) * 0x100000000);
-				rcache = _r() * 0x3ade67b7;
-				words[i / 4] = (_r() * 0x100000000) | 0;
-			}
-			return typedArray;
-		}
-	};
-
 	/** @fileOverview CTR mode implementation.
 	 *
 	 * Special thanks to Roy Nicholson for pointing out a bug in our
@@ -1213,12 +1188,15 @@
 	const ERR_INVALID_PASSWORD = "Invalid password";
 	const ERR_INVALID_SIGNATURE = "Invalid signature";
 	const ERR_ABORT_CHECK_PASSWORD = "zipjs-abort-check-password";
+	const ERR_UNSUPPORTED_CRYPTO_API = "Crypto API not supported";
 
 	function getRandomValues(array) {
 		if (GET_RANDOM_VALUES_SUPPORTED) {
 			return crypto.getRandomValues(array);
 		} else {
-			return random.getRandomValues(array);
+			// all supported runtimes expose crypto.getRandomValues; failing hard beats
+			// silently generating predictable encryption salts
+			throw new Error(ERR_UNSUPPORTED_CRYPTO_API);
 		}
 	}
 
@@ -1277,13 +1255,12 @@
 
 	class AESDecryptionStream extends TransformStream {
 
-		constructor({ password, rawPassword, signed, encryptionStrength, checkPasswordOnly }) {
+		constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly }) {
 			super({
 				start() {
 					Object.assign(this, {
 						ready: new Promise(resolve => this.resolveReady = resolve),
 						password: encodePassword(password, rawPassword),
-						signed,
 						strength: encryptionStrength - 1,
 						pending: new Uint8Array()
 					});
@@ -1312,7 +1289,6 @@
 				},
 				async flush(controller) {
 					const {
-						signed,
 						ctr,
 						hmac,
 						pending,
@@ -1329,13 +1305,15 @@
 							const decryptedChunk = ctr.update(encryptedChunk);
 							decryptedChunkArray = fromBits(codecBytes, decryptedChunk);
 						}
-						if (signed) {
-							const signature = subarray(fromBits(codecBytes, hmac.digest()), 0, SIGNATURE_LENGTH);
-							for (let indexSignature = 0; indexSignature < SIGNATURE_LENGTH; indexSignature++) {
-								if (signature[indexSignature] != originalSignature[indexSignature]) {
-									throw new Error(ERR_INVALID_SIGNATURE);
-								}
-							}
+						const signature = subarray(fromBits(codecBytes, hmac.digest()), 0, SIGNATURE_LENGTH);
+						// branch-free comparison: accumulate the differences instead of
+						// short-circuiting on the first mismatching byte
+						let invalidSignature = pending.length < SIGNATURE_LENGTH ? 1 : 0;
+						for (let indexSignature = 0; indexSignature < SIGNATURE_LENGTH; indexSignature++) {
+							invalidSignature |= signature[indexSignature] ^ originalSignature[indexSignature];
+						}
+						if (invalidSignature) {
+							throw new Error(ERR_INVALID_SIGNATURE);
 						}
 						controller.enqueue(decryptedChunkArray);
 					}
@@ -1407,11 +1385,11 @@
 			hmac,
 			pending
 		} = aesCrypto;
-		const inputLength = input.length - paddingEnd;
 		if (pending.length) {
 			input = concat(pending, input);
-			output = expand(output, inputLength - (inputLength % BLOCK_LENGTH));
 		}
+		const inputLength = input.length - paddingEnd;
+		output = expand(output, paddingStart + (inputLength - (inputLength % BLOCK_LENGTH)));
 		let offset;
 		for (offset = 0; offset <= inputLength - BLOCK_LENGTH; offset += BLOCK_LENGTH) {
 			const inputChunk = toBits(codecBytes, subarray(input, offset, offset + BLOCK_LENGTH));
@@ -1559,21 +1537,24 @@
 
 	class ZipCryptoDecryptionStream extends TransformStream {
 
-		constructor({ password, passwordVerification, checkPasswordOnly }) {
+		constructor({ password, rawPassword, passwordVerification, checkPasswordOnly }) {
 			super({
 				start() {
 					Object.assign(this, {
 						password,
+						rawPassword,
 						passwordVerification
 					});
-					createKeys(this, password);
+					createKeys(this, password, rawPassword);
 				},
 				transform(chunk, controller) {
 					const zipCrypto = this;
-					if (zipCrypto.password) {
+					if (zipCrypto.password || zipCrypto.rawPassword) {
 						const decryptedHeader = decrypt(zipCrypto, chunk.subarray(0, HEADER_LENGTH));
-						zipCrypto.password = null;
-						if (decryptedHeader.at(-1) != zipCrypto.passwordVerification) {
+						zipCrypto.password = zipCrypto.rawPassword = null;
+						// verify the password with a branch-free comparison of the verification byte, mirroring
+						// the constant-time AES HMAC signature check
+						if ((decryptedHeader.at(-1) ^ zipCrypto.passwordVerification) != 0) {
 							throw new Error(ERR_INVALID_PASSWORD);
 						}
 						chunk = chunk.subarray(HEADER_LENGTH);
@@ -1590,21 +1571,22 @@
 
 	class ZipCryptoEncryptionStream extends TransformStream {
 
-		constructor({ password, passwordVerification }) {
+		constructor({ password, rawPassword, passwordVerification }) {
 			super({
 				start() {
 					Object.assign(this, {
 						password,
+						rawPassword,
 						passwordVerification
 					});
-					createKeys(this, password);
+					createKeys(this, password, rawPassword);
 				},
 				transform(chunk, controller) {
 					const zipCrypto = this;
 					let output;
 					let offset;
-					if (zipCrypto.password) {
-						zipCrypto.password = null;
+					if (zipCrypto.password || zipCrypto.rawPassword) {
+						zipCrypto.password = zipCrypto.rawPassword = null;
 						const header = getRandomValues(new Uint8Array(HEADER_LENGTH));
 						header[HEADER_LENGTH - 1] = zipCrypto.passwordVerification;
 						output = new Uint8Array(chunk.length + header.length);
@@ -1639,25 +1621,31 @@
 		return output;
 	}
 
-	function createKeys(target, password) {
+	function createKeys(target, password, rawPassword) {
 		const keys = [0x12345678, 0x23456789, 0x34567890];
 		Object.assign(target, {
 			keys,
 			crcKey0: new Crc32(keys[0]),
 			crcKey2: new Crc32(keys[2])
 		});
-		for (let index = 0; index < password.length; index++) {
-			updateKeys(target, password.charCodeAt(index));
+		if (rawPassword) {
+			for (let index = 0; index < rawPassword.length; index++) {
+				updateKeys(target, rawPassword[index]);
+			}
+		} else {
+			for (let index = 0; index < password.length; index++) {
+				updateKeys(target, password.charCodeAt(index));
+			}
 		}
 	}
 
 	function updateKeys(target, byte) {
-		let [key0, key1, key2] = target.keys;
+		let [, key1] = target.keys;
 		target.crcKey0.append([byte]);
-		key0 = ~target.crcKey0.get();
+		const key0 = ~target.crcKey0.get();
 		key1 = getInt32(Math.imul(getInt32(key1 + getInt8(key0)), 134775813) + 1);
 		target.crcKey2.append([key1 >>> 24]);
-		key2 = ~target.crcKey2.get();
+		const key2 = ~target.crcKey2.get();
 		target.keys = [key0, key1, key2];
 	}
 
@@ -1704,6 +1692,7 @@
 
 
 	const ERR_INVALID_UNCOMPRESSED_SIZE = "Invalid uncompressed size";
+	const ERR_INVALID_COMPRESSED_DATA = "Invalid compressed data";
 	const FORMAT_DEFLATE_RAW = "deflate-raw";
 	const FORMAT_DEFLATE64_RAW = "deflate64-raw";
 
@@ -1760,6 +1749,7 @@
 			}
 			if (compressed) {
 				readable = pipeThroughCommpressionStream(readable, useCompressionStream, { chunkSize, deflate64 }, DecompressionStream, DecompressionStreamZlib, DecompressionStream);
+				readable = mapInflateStreamError(readable);
 			}
 			if ((!encrypted || zipCrypto) && signed) {
 				crc32Stream = new Crc32Stream();
@@ -1788,14 +1778,15 @@
 	function pipeThroughCommpressionStream(readable, useCompressionStream, options, CompressionStreamNative, CompressionStreamZlib, CompressionStream) {
 		const Stream = useCompressionStream && CompressionStreamNative ? CompressionStreamNative : CompressionStreamZlib || CompressionStream;
 		const format = options.deflate64 ? FORMAT_DEFLATE64_RAW : FORMAT_DEFLATE_RAW;
+		let codecStream;
 		try {
-			readable = pipeThrough(readable, new Stream(format, options));
+			codecStream = new Stream(format, options);
 		} catch (error) {
 			if (useCompressionStream) {
 				if (CompressionStreamZlib) {
-					readable = pipeThrough(readable, new CompressionStreamZlib(format, options));
+					codecStream = new CompressionStreamZlib(format, options);
 				} else if (CompressionStream) {
-					readable = pipeThrough(readable, new CompressionStream(format, options));
+					codecStream = new CompressionStream(format, options);
 				} else {
 					throw error;
 				}
@@ -1803,13 +1794,93 @@
 				throw error;
 			}
 		}
-		return readable;
+		// The native CompressionStream/DecompressionStream and the pure-JS zlib port do not signal
+		// backpressure on their writable side (their `ready` never pends), so a plain pipeThrough drains
+		// the whole source into them and peak memory grows with the entry size. Awaiting each write()
+		// paces the source to the codec's consumption rate, keeping streaming memory bounded. The WASM
+		// codec already backpressures, so this is a no-op cost for it.
+		return pipeThroughBackpressured(readable, codecStream);
 	}
 
 	function pipeThrough(readable, transformStream) {
 		return readable.pipeThrough(transformStream);
 	}
 
+	// Like readable.pipeThrough(transformStream), but drives the writable side manually and awaits each
+	// write() so that a codec which under-reports backpressure cannot pull the whole source into memory.
+	// Errors propagate in both directions: a source error aborts the codec; a downstream cancel/error
+	// (surfaced through the codec's writable rejecting) cancels the source.
+	function pipeThroughBackpressured(readable, transformStream) {
+		const writer = transformStream.writable.getWriter();
+		const reader = readable.getReader();
+		pump();
+		return transformStream.readable;
+
+		async function pump() {
+			try {
+				for (; ;) {
+					await writer.ready;
+					const result = await reader.read();
+					if (result.done) {
+						await writer.close();
+						break;
+					}
+					await writer.write(result.value);
+				}
+			} catch (error) {
+				await abort(writer, error);
+				await cancel(reader, error);
+			}
+		}
+	}
+
+	async function abort(writer, error) {
+		try {
+			await writer.abort(error);
+		} catch {
+			// the writable may already be errored/closed
+		}
+	}
+
+	async function cancel(reader, error) {
+		try {
+			await reader.cancel(error);
+		} catch {
+			// the readable may already be errored/closed
+		}
+	}
+
+	// DecompressionStream implementations can fail with a message-less TypeError on malformed
+	// input; give these errors an identifiable message (errors raised by the other stages of
+	// the pipeline, e.g. ERR_INVALID_PASSWORD, always carry a message and pass through as-is)
+	function mapInflateStreamError(readable) {
+		const reader = readable.getReader();
+		return new ReadableStream({
+			async pull(controller) {
+				let result;
+				try {
+					result = await reader.read();
+				} catch (error) {
+					if (error && error.message) {
+						throw error;
+					}
+					const mappedError = new Error(ERR_INVALID_COMPRESSED_DATA);
+					mappedError.cause = error;
+					throw mappedError;
+				}
+				const { value, done } = result;
+				if (done) {
+					controller.close();
+				} else {
+					controller.enqueue(value);
+				}
+			},
+			cancel(reason) {
+				return reader.cancel(reason);
+			}
+		});
+	}
+
 	/*
 	 Copyright (c) 2022 Gildas Lormeau. All rights reserved.
 
@@ -1839,6 +1910,7 @@
 	 */
 
 
+	const DEFAULT_CHUNK_SIZE$1 = 64 * 1024;
 	const MESSAGE_EVENT_TYPE = "message";
 	const MESSAGE_START = "start";
 	const MESSAGE_PULL = "pull";
@@ -1907,6 +1979,9 @@
 
 		constructor(chunkSize) {
 			let pendingChunk;
+			if (!(chunkSize >= 1)) {
+				chunkSize = DEFAULT_CHUNK_SIZE$1;
+			}
 			super({
 				transform,
 				flush(controller) {
@@ -1924,12 +1999,12 @@
 					chunk = newChunk;
 					pendingChunk = null;
 				}
-				if (chunk.length > chunkSize) {
-					controller.enqueue(chunk.slice(0, chunkSize));
-					transform(chunk.slice(chunkSize), controller);
-				} else {
-					pendingChunk = chunk;
+				let offset = 0;
+				while (chunk.length - offset > chunkSize) {
+					controller.enqueue(chunk.slice(offset, offset + chunkSize));
+					offset += chunkSize;
 				}
+				pendingChunk = offset ? chunk.slice(offset) : chunk;
 			}
 		}
 	}
@@ -1964,8 +2039,10 @@
 
 
 	const MODULE_WORKER_OPTIONS = { type: "module" };
+	const ERROR_EVENT_TYPE = "error";
+	const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
 
-	let webWorkerSupported, webWorkerURI, webWorkerOptions;
+	let webWorkerSupported, webWorkerSource, webWorkerURI, webWorkerOptions;
 	let transferStreamsSupported = true;
 	try {
 		transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
@@ -1980,8 +2057,9 @@
 			const { signal } = streamOptions;
 			Object.assign(workerData, {
 				busy: true,
+				generation: (workerData.generation || 0) + 1,
 				readable: readable
-					.pipeThrough(new ChunkStream(config.chunkSize))
+					.pipeThrough(new ChunkStream(getChunkSize(config)))
 					.pipeThrough(new ProgressWatcherStream(streamOptions), { signal }),
 				writable,
 				options: Object.assign({}, options),
@@ -2004,15 +2082,17 @@
 					});
 				},
 				onTaskFinished() {
-					const { resolveTerminated } = workerData;
-					if (resolveTerminated) {
-						workerData.resolveTerminated = null;
-						workerData.terminated = true;
-						workerData.worker.terminate();
-						resolveTerminated();
+					if (workerData.busy) {
+						const { resolveTerminated } = workerData;
+						if (resolveTerminated) {
+							workerData.resolveTerminated = null;
+							workerData.terminated = true;
+							workerData.worker.terminate();
+							resolveTerminated();
+						}
+						workerData.busy = false;
+						onTaskFinished(workerData);
 					}
-					workerData.busy = false;
-					onTaskFinished(workerData);
 				}
 			});
 			if (webWorkerSupported === UNDEFINED_VALUE) {
@@ -2081,6 +2161,7 @@
 			}
 			Object.assign(workerData, {
 				worker,
+				terminated: false,
 				interface: {
 					run: () => runWebWorker(workerData, { chunkSize, wasmURI, baseURI })
 				}
@@ -2096,7 +2177,15 @@
 				try {
 					await initModule(config);
 				} catch {
-					options.useCompressionStream = true;
+					// The WASM module failed to load. Fall back to the native CompressionStream only if the
+					// zlib codec that would otherwise run depends on that module; a self-contained codec
+					// supplied through config (e.g. the pure-JS port) stays usable and is kept as requested.
+					const ZlibStream = options.codecType.startsWith(CODEC_DEFLATE) ?
+						config.CompressionStreamZlib :
+						config.DecompressionStreamZlib;
+					if (!ZlibStream || ZlibStream.requiresModule) {
+						options.useCompressionStream = true;
+					}
 				}
 			}
 			codecStream = new CodecStream(options, config);
@@ -2135,37 +2224,85 @@
 			result
 		});
 		const { readable, options } = workerData;
-		const { writable, closed } = watchClosedStream(workerData.writable);
-		const streamsTransferred = sendMessage({
-			type: MESSAGE_START,
-			options,
-			config,
-			readable,
-			writable
-		}, workerData);
+		const { writable, closed, abortPipe } = watchClosedStream(workerData.writable);
+		let streamsTransferred;
+		try {
+			streamsTransferred = sendMessage({
+				type: MESSAGE_START,
+				options,
+				config,
+				readable,
+				writable
+			}, workerData);
+		} catch (error) {
+			abortPipe();
+			try {
+				await closed;
+			} catch {
+				// ignored
+			}
+			workerData.onTaskFinished();
+			throw error;
+		}
 		if (!streamsTransferred) {
 			Object.assign(workerData, {
 				reader: readable.getReader(),
 				writer: writable.getWriter()
 			});
 		}
-		const resultValue = await result;
-		if (!streamsTransferred) {
-			await writable.getWriter().close();
+		try {
+			const resultValue = await result;
+			await closeWritable();
+			await closed;
+			return resultValue;
+		} catch (error) {
+			await closeWritable();
+			// unblock the pipe watcher if the worker died before closing its end of the stream
+			abortPipe();
+			try {
+				await closed;
+			} catch {
+				// ignored
+			}
+			throw error;
+		}
+
+		async function closeWritable() {
+			if (!streamsTransferred && !writable.locked) {
+				try {
+					await writable.getWriter().close();
+				} catch {
+					// ignored
+				}
+			}
 		}
-		await closed;
-		return resultValue;
 	}
 
 	function watchClosedStream(writableSource) {
+		const abortController = new AbortController();
 		const { writable, readable } = new TransformStream();
-		const closed = readable.pipeTo(writableSource, { preventClose: true });
-		return { writable, closed };
+		const closed = readable.pipeTo(writableSource, { preventClose: true, preventAbort: true, signal: abortController.signal });
+		// the pipe can fail before `closed` is awaited (e.g. the destination write fails);
+		// mark the rejection as handled so it cannot kill the process in the meantime
+		closed.catch(() => { });
+		return { writable, closed, abortPipe: () => abortController.abort() };
+	}
+
+	function terminateWorker$1(workerData) {
+		const { worker } = workerData;
+		if (worker) {
+			try {
+				worker.terminate();
+			} catch {
+				// ignored
+			}
+		}
+		workerData.interface = null;
 	}
 
 	function getWebWorker(url, baseURI, workerData, isModuleType, useBlobURI = true) {
 		let worker, resolvedURI, resolvedOptions;
-		if (webWorkerURI === UNDEFINED_VALUE) {
+		if (webWorkerURI === UNDEFINED_VALUE || webWorkerSource !== url) {
 			// deno-lint-ignore valid-typeof
 			const isFunctionURI = typeof url == FUNCTION_TYPE;
 			if (isFunctionURI) {
@@ -2222,16 +2359,36 @@
 					}
 				}
 			}
+			webWorkerSource = url;
 			webWorkerURI = resolvedURI;
 			webWorkerOptions = resolvedOptions;
 		} else {
 			worker = new Worker(webWorkerURI, webWorkerOptions);
 		}
 		worker.addEventListener(MESSAGE_EVENT_TYPE, event => onMessage(event, workerData));
+		worker.addEventListener(ERROR_EVENT_TYPE, event => onWorkerError(event, workerData));
+		worker.addEventListener(MESSAGE_ERROR_EVENT_TYPE, event => onWorkerError(event, workerData));
 		return worker;
 	}
 
-	function sendMessage(message, { worker, writer, onTaskFinished, transferStreams }) {
+	function onWorkerError(event, workerData) {
+		if (event.preventDefault) {
+			event.preventDefault();
+		}
+		const { rejectResult, writer, onTaskFinished } = workerData;
+		// the worker is unusable (e.g. its script failed to load); terminate it and
+		// fail the current task instead of letting it hang forever
+		terminateWorker$1(workerData);
+		if (rejectResult) {
+			rejectResult(event.error || new Error(event.message || ERROR_EVENT_TYPE));
+			if (writer) {
+				writer.releaseLock();
+			}
+			onTaskFinished();
+		}
+	}
+
+	function sendMessage(message, { worker, writer, transferStreams }) {
 		try {
 			const { value, readable, writable } = message;
 			const transferables = [];
@@ -2265,14 +2422,16 @@
 			if (writer) {
 				writer.releaseLock();
 			}
-			onTaskFinished();
 			throw error;
 		}
 	}
 
 	async function onMessage({ data }, workerData) {
 		const { type, value, messageId, result, error } = data;
-		const { reader, writer, resolveResult, rejectResult, onTaskFinished } = workerData;
+		const { reader, writer, resolveResult, rejectResult, onTaskFinished, generation } = workerData;
+		// continuations below can settle after the worker slot has been reassigned to a new
+		// task (e.g. a pending pull read failing late); they must not touch the new task
+		const stale = () => workerData.generation != generation;
 		try {
 			if (error) {
 				const { message, stack, code, name, outputSize } = error;
@@ -2282,23 +2441,32 @@
 			} else {
 				if (type == MESSAGE_PULL) {
 					const { value, done } = await reader.read();
-					sendMessage({ type: MESSAGE_DATA, value, done, messageId }, workerData);
+					if (!stale()) {
+						sendMessage({ type: MESSAGE_DATA, value, done, messageId }, workerData);
+					}
 				}
 				if (type == MESSAGE_DATA) {
 					await writer.ready;
 					await writer.write(new Uint8Array(value));
-					sendMessage({ type: MESSAGE_ACK_DATA, messageId }, workerData);
+					if (!stale()) {
+						sendMessage({ type: MESSAGE_ACK_DATA, messageId }, workerData);
+					}
 				}
 				if (type == MESSAGE_CLOSE) {
 					close(null, result);
 				}
 			}
 		} catch (error) {
-			sendMessage({ type: MESSAGE_CLOSE, messageId }, workerData);
-			close(error);
+			if (!stale()) {
+				terminateWorker$1(workerData);
+				close(error);
+			}
 		}
 
 		function close(error, result) {
+			if (stale()) {
+				return;
+			}
 			if (error) {
 				rejectResult(error);
 			} else {
@@ -2342,6 +2510,8 @@
 
 	let pool = [];
 	const pendingRequests = [];
+	let starvationTimeout;
+	let starvationDelay;
 
 	let indexWorker = 0;
 
@@ -2368,14 +2538,20 @@
 				pool.push(workerData);
 				return new CodecWorker(workerData, stream, workerOptions, onTaskFinished);
 			} else {
-				return new Promise(resolve => pendingRequests.push({ resolve, stream, workerOptions }));
+				return new Promise(resolve => {
+					pendingRequests.push({ resolve, stream, workerOptions });
+					starvationDelay = config.workerStarvationTimeout;
+					armStarvationTimeout();
+				});
 			}
 		}
 
 		function onTaskFinished(workerData) {
+			clearStarvationTimeout();
 			if (pendingRequests.length) {
 				const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
 				resolve(new CodecWorker(workerData, stream, workerOptions, onTaskFinished));
+				armStarvationTimeout();
 			} else if (workerData.worker) {
 				clearTerminateTimeout(workerData);
 				terminateWorker(workerData, workerOptions);
@@ -2385,6 +2561,34 @@
 		}
 	}
 
+	function armStarvationTimeout() {
+		if (!starvationTimeout && pendingRequests.length && Number.isFinite(starvationDelay) && starvationDelay >= 0) {
+			starvationTimeout = setTimeout(onWorkerStarvation, starvationDelay);
+		}
+	}
+
+	function clearStarvationTimeout() {
+		if (starvationTimeout) {
+			clearTimeout(starvationTimeout);
+			starvationTimeout = null;
+		}
+	}
+
+	function onWorkerStarvation() {
+		starvationTimeout = null;
+		if (pendingRequests.length) {
+			const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
+			const inlineWorkerOptions = Object.assign({}, workerOptions, { useWebWorkers: false, workerURI: UNDEFINED_VALUE });
+			resolve(new CodecWorker({}, stream, inlineWorkerOptions, onInlineTaskFinished));
+			armStarvationTimeout();
+		}
+	}
+
+	function onInlineTaskFinished() {
+		clearStarvationTimeout();
+		armStarvationTimeout();
+	}
+
 	function terminateWorker(workerData, workerOptions) {
 		const { config } = workerOptions;
 		const { terminateWorkerTimeout } = config;
@@ -2455,6 +2659,7 @@
 
 	const CONTENT_TYPE_TEXT_PLAIN = "text/plain";
 	const HTTP_HEADER_CONTENT_LENGTH = "Content-Length";
+	const HTTP_HEADER_CONTENT_ENCODING = "Content-Encoding";
 	const HTTP_HEADER_CONTENT_RANGE = "Content-Range";
 	const HTTP_HEADER_ACCEPT_RANGES = "Accept-Ranges";
 	const HTTP_HEADER_RANGE = "Range";
@@ -2579,7 +2784,7 @@
 
 		writeUint8Array(array) {
 			const writer = this;
-			let indexArray = 0;
+			let indexArray;
 			let dataString = writer.pending;
 			const delta = writer.pending.length;
 			writer.pending = "";
@@ -2589,12 +2794,10 @@
 			for (; indexArray < array.length; indexArray++) {
 				writer.pending += String.fromCharCode(array[indexArray]);
 			}
-			if (dataString.length) {
-				if (dataString.length > 2) {
-					writer.data += btoa(dataString);
-				} else {
-					writer.pending += dataString;
-				}
+			if (dataString.length > 2) {
+				writer.data += btoa(dataString);
+			} else {
+				writer.pending = dataString + writer.pending;
 			}
 		}
 
@@ -2641,6 +2844,9 @@
 				}
 			});
 			writer.blob = new Response(transformStream.readable, { headers }).blob();
+			// mark early rejections (e.g. aborted pipe) as handled; awaiting getData() still
+			// surfaces them
+			writer.blob.catch(() => { });
 		}
 
 		getData() {
@@ -2725,7 +2931,8 @@
 			preventHeadRequest,
 			useRangeHeader,
 			forceRangeRequests,
-			combineSizeEocd
+			combineSizeEocd,
+			fetch
 		} = options;
 		options = Object.assign({}, options);
 		delete options.preventHeadRequest;
@@ -2733,13 +2940,15 @@
 		delete options.forceRangeRequests;
 		delete options.combineSizeEocd;
 		delete options.useXHR;
+		delete options.fetch;
 		Object.assign(httpReader, {
 			url,
 			options,
 			preventHeadRequest,
 			useRangeHeader,
 			forceRangeRequests,
-			combineSizeEocd
+			combineSizeEocd,
+			fetch
 		});
 	}
 
@@ -2758,7 +2967,10 @@
 				throw new Error(ERR_HTTP_RANGE);
 			} else {
 				if (combineSizeEocd) {
-					httpReader.eocdCache = new Uint8Array(await response.arrayBuffer());
+					const eocdCache = new Uint8Array(await response.arrayBuffer());
+					if (response.status == 206 && eocdCache.length == END_OF_CENTRAL_DIR_LENGTH) {
+						httpReader.eocdCache = eocdCache;
+					}
 				}
 				let contentSize;
 				const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
@@ -2804,7 +3016,18 @@
 				if (response.status != 206) {
 					throw new Error(ERR_HTTP_RANGE);
 				}
-				return new Uint8Array(await response.arrayBuffer());
+				const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
+				if (contentRangeHeader) {
+					const rangeStart = Number(contentRangeHeader.trim().split(/[\s-]+/)[1]);
+					if (!Number.isNaN(rangeStart) && rangeStart != index) {
+						throw new Error(ERR_HTTP_RANGE);
+					}
+				}
+				const data = new Uint8Array(await response.arrayBuffer());
+				if (data.length != length) {
+					throw new Error(ERR_HTTP_RANGE);
+				}
+				return data;
 			}
 		} else {
 			const { data } = httpReader;
@@ -2841,9 +3064,9 @@
 	async function getRequestData(httpReader, sendRequest) {
 		const response = await sendRequest(HTTP_METHOD_GET, httpReader, getHeaders(httpReader));
 		httpReader.data = new Uint8Array(await response.arrayBuffer());
-		if (!httpReader.size) {
-			httpReader.size = httpReader.data.length;
-		}
+		// the downloaded content is authoritative, e.g. the Content-Length response header
+		// of the HEAD request can be the encoded size when the content is compressed
+		httpReader.size = httpReader.data.length;
 	}
 
 	async function getContentLength(httpReader, sendRequest, getRequestData) {
@@ -2852,7 +3075,7 @@
 		} else {
 			const response = await sendRequest(HTTP_METHOD_HEAD, httpReader, getHeaders(httpReader));
 			const contentLength = response.headers.get(HTTP_HEADER_CONTENT_LENGTH);
-			if (contentLength) {
+			if (contentLength && !response.headers.get(HTTP_HEADER_CONTENT_ENCODING)) {
 				httpReader.size = Number(contentLength);
 			} else {
 				await getRequestData(httpReader, httpReader.options);
@@ -2860,8 +3083,8 @@
 		}
 	}
 
-	async function sendFetchRequest(method, { options, url }, headers) {
-		const response = await fetch(url, Object.assign({}, options, { method, headers }));
+	async function sendFetchRequest(method, { fetch: fetchFunction = fetch, options, url }, headers) {
+		const response = await fetchFunction(url, Object.assign({}, options, { method, headers }));
 		if (response.status < 400) {
 			return response;
 		} else {
@@ -2907,7 +3130,8 @@
 			super();
 			Object.assign(this, {
 				url,
-				reader: options.useXHR ? new XHRReader(url, options) : new FetchReader(url, options)
+				// an explicit fetch implementation takes precedence over useXHR
+				reader: options.useXHR && !options.fetch ? new XHRReader(url, options) : new FetchReader(url, options)
 			});
 		}
 
@@ -2932,8 +3156,7 @@
 	class HttpRangeReader extends HttpReader {
 
 		constructor(url, options = {}) {
-			options.useRangeHeader = true;
-			super(url, options);
+			super(url, Object.assign({}, options, { useRangeHeader: true }));
 		}
 	}
 
@@ -3007,7 +3230,7 @@
 			reader.lastDiskNumber = 0;
 			reader.lastDiskOffset = 0;
 			await Promise.all(readers.map(async (diskReader, indexDiskReader) => {
-				await diskReader.init();
+				await initStream(diskReader);
 				if (indexDiskReader != readers.length - 1) {
 					reader.lastDiskOffset += diskReader.size;
 				}
@@ -3091,14 +3314,26 @@
 						writer.diskOffset += diskSourceWriter.size;
 						writer.diskNumber++;
 						diskWriter = null;
-						await this.write(chunk.subarray(availableSize));
+						// the next disk is not opened yet but its space is available; leaving a
+						// stale value here would force a new disk for every subsequent write
+						writer.availableSize = writer.maxSize;
+						if (chunk.length > availableSize) {
+							await this.write(chunk.subarray(availableSize));
+						}
 					} else {
 						await writeChunk(chunk);
 					}
 				},
 				async close() {
-					await diskWriter.ready;
-					await closeDisk();
+					if (diskWriter) {
+						await diskWriter.ready;
+						await closeDisk();
+					}
+				},
+				async abort(reason) {
+					if (diskWriter) {
+						await diskWriter.abort(reason);
+					}
 				}
 			});
 			Object.defineProperty(writer, PROPERTY_NAME_WRITABLE, {
@@ -3113,7 +3348,6 @@
 					await diskWriter.ready;
 					await diskWriter.write(chunk);
 					diskSourceWriter.size += chunkLength;
-					writer.size += chunkLength;
 					writer.availableSize -= chunkLength;
 				}
 			}
@@ -3213,7 +3447,7 @@
 
 	/* global TextDecoder */
 
-	const CP437 = "\0☺☻♥♦♣♠•◘○◙♂♀♪♫☼►◄↕‼¶§▬↨↑↓→←∟↔▲▼ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒáíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ".split("");
+	const CP437 = "\0☺☻♥♦♣♠•◘○◙♂♀♪♫☼►◄↕‼¶§▬↨↑↓→←∟↔▲▼ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒáíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ".split("");
 	const VALID_CP437 = CP437.length == 256;
 
 	function decodeCP437(stringValue) {
@@ -3261,7 +3495,8 @@
 		if (encoding && encoding.trim().toLowerCase() == "cp437") {
 			return decodeCP437(value);
 		} else {
-			return new TextDecoder(encoding).decode(value);
+			// ignoreBOM keeps a leading U+FEFF in filenames/comments instead of dropping it
+			return new TextDecoder(encoding, { ignoreBOM: true }).decode(value);
 		}
 	}
 
@@ -3438,6 +3673,7 @@
 	const OPTION_CHECK_PASSWORD_ONLY = "checkPasswordOnly";
 	const OPTION_CHECK_OVERLAPPING_ENTRY_ONLY = "checkOverlappingEntryOnly";
 	const OPTION_CHECK_OVERLAPPING_ENTRY = "checkOverlappingEntry";
+	const OPTION_CHECK_AMBIGUITY = "checkAmbiguity";
 	const OPTION_CHECK_SIGNATURE = "checkSignature";
 	const OPTION_USE_WEB_WORKERS = "useWebWorkers";
 	const OPTION_USE_COMPRESSION_STREAM = "useCompressionStream";
@@ -3495,12 +3731,16 @@
 	const ERR_EXTRAFIELD_ZIP64_NOT_FOUND = "Zip64 extra field not found";
 	const ERR_ENCRYPTED = "File contains encrypted entry";
 	const ERR_UNSUPPORTED_ENCRYPTION = "Encryption method not supported";
-	const ERR_UNSUPPORTED_COMPRESSION = "Compression method not supported";
+	const ERR_UNSUPPORTED_COMPRESSION$1 = "Compression method not supported";
 	const ERR_SPLIT_ZIP_FILE = "Split zip file";
 	const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
+	const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 	const CHARSET_UTF8 = "utf-8";
 	const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 	const CHARSET_CP437 = "cp437";
+	// bits of the general purpose flag that change how an entry is interpreted; the level bits (1-2) are excluded
+	// because they are informative only
+	const BITFLAG_AMBIGUITY_MASK = BITFLAG_ENCRYPTED | BITFLAG_DATA_DESCRIPTOR | BITFLAG_LANG_ENCODING_FLAG;
 	const ZIP64_PROPERTIES = [
 		[PROPERTY_NAME_UNCOMPRESSED_SIZE, MAX_32_BITS],
 		[PROPERTY_NAME_COMPRESSED_SIZE, MAX_32_BITS],
@@ -3525,7 +3765,7 @@
 				reader: new GenericReader(reader),
 				options,
 				config: getConfiguration(),
-				readRanges: []
+				readRanges: new Map()
 			});
 		}
 
@@ -3558,21 +3798,30 @@
 			const commentOffset = endOfDirectoryInfo.offset;
 			const commentLength = getUint16(endOfDirectoryView, 20);
 			const appendedDataOffset = commentOffset + END_OF_CENTRAL_DIR_LENGTH + commentLength;
+			const checkAmbiguity = getOptionValue$1(zipReader, options, OPTION_CHECK_AMBIGUITY);
+			if (checkAmbiguity && appendedDataOffset != reader.size) {
+				throwAmbiguousArchive("appended data");
+			}
 			let lastDiskNumber = getUint16(endOfDirectoryView, 4);
 			const expectedLastDiskNumber = reader.lastDiskNumber || 0;
 			let diskNumber = getUint16(endOfDirectoryView, 6);
-			let filesLength = getUint16(endOfDirectoryView, 8);
+			let filesLength = getUint16(endOfDirectoryView, 10);
 			let prependedDataLength = 0;
-			let startOffset = 0;
+			let startOffset;
+			let zip64EndOfDirectory;
 			if (directoryDataOffset == MAX_32_BITS || directoryDataLength == MAX_32_BITS || filesLength == MAX_16_BITS || diskNumber == MAX_16_BITS) {
-				const endOfDirectoryLocatorArray = await readUint8Array(reader, endOfDirectoryInfo.offset - ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH, ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH);
+				const endOfDirectoryLocatorArray = endOfDirectoryInfo.offset >= ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH ?
+					await readUint8Array(reader, endOfDirectoryInfo.offset - ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH, ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH) :
+					new Uint8Array();
 				const endOfDirectoryLocatorView = getDataView$1(endOfDirectoryLocatorArray);
-				if (getUint32(endOfDirectoryLocatorView, 0) == ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE) {
+				if (endOfDirectoryLocatorArray.length == ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH &&
+					getUint32(endOfDirectoryLocatorView, 0) == ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE) {
 					directoryDataOffset = getBigUint64(endOfDirectoryLocatorView, 8);
 					let endOfDirectoryArray = await readUint8Array(reader, directoryDataOffset, ZIP64_END_OF_CENTRAL_DIR_LENGTH, -1);
 					let endOfDirectoryView = getDataView$1(endOfDirectoryArray);
-					const expectedDirectoryDataOffset = endOfDirectoryInfo.offset - ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH - ZIP64_END_OF_CENTRAL_DIR_LENGTH;
-					if (getUint32(endOfDirectoryView, 0) != ZIP64_END_OF_CENTRAL_DIR_SIGNATURE && directoryDataOffset != expectedDirectoryDataOffset) {
+					const expectedDirectoryDataOffset = endOfDirectoryInfo.offset - ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH - ZIP64_END_OF_CENTRAL_DIR_LENGTH - (reader.lastDiskOffset || 0);
+					if ((endOfDirectoryArray.length < ZIP64_END_OF_CENTRAL_DIR_LENGTH || getUint32(endOfDirectoryView, 0) != ZIP64_END_OF_CENTRAL_DIR_SIGNATURE) &&
+						directoryDataOffset != expectedDirectoryDataOffset && expectedDirectoryDataOffset >= 0) {
 						const originalDirectoryDataOffset = directoryDataOffset;
 						directoryDataOffset = expectedDirectoryDataOffset;
 						if (directoryDataOffset > originalDirectoryDataOffset) {
@@ -3581,24 +3830,36 @@
 						endOfDirectoryArray = await readUint8Array(reader, directoryDataOffset, ZIP64_END_OF_CENTRAL_DIR_LENGTH, -1);
 						endOfDirectoryView = getDataView$1(endOfDirectoryArray);
 					}
-					if (getUint32(endOfDirectoryView, 0) != ZIP64_END_OF_CENTRAL_DIR_SIGNATURE) {
+					if (endOfDirectoryArray.length < ZIP64_END_OF_CENTRAL_DIR_LENGTH || getUint32(endOfDirectoryView, 0) != ZIP64_END_OF_CENTRAL_DIR_SIGNATURE) {
 						throw new Error(ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND);
 					}
+					zip64EndOfDirectory = true;
 					if (lastDiskNumber == MAX_16_BITS) {
 						lastDiskNumber = getUint32(endOfDirectoryView, 16);
+					} else if (checkAmbiguity && lastDiskNumber != getUint32(endOfDirectoryView, 16)) {
+						throwAmbiguousArchive("mismatched zip64 end of central directory record");
 					}
 					if (diskNumber == MAX_16_BITS) {
 						diskNumber = getUint32(endOfDirectoryView, 20);
+					} else if (checkAmbiguity && diskNumber != getUint32(endOfDirectoryView, 20)) {
+						throwAmbiguousArchive("mismatched zip64 end of central directory record");
 					}
 					if (filesLength == MAX_16_BITS) {
 						filesLength = getBigUint64(endOfDirectoryView, 32);
+					} else if (checkAmbiguity && filesLength != getBigUint64(endOfDirectoryView, 32)) {
+						throwAmbiguousArchive("mismatched zip64 end of central directory record");
 					}
 					if (directoryDataLength == MAX_32_BITS) {
 						directoryDataLength = getBigUint64(endOfDirectoryView, 40);
+					} else if (checkAmbiguity && directoryDataLength != getBigUint64(endOfDirectoryView, 40)) {
+						throwAmbiguousArchive("mismatched zip64 end of central directory record");
 					}
-					directoryDataOffset -= directoryDataLength;
+					directoryDataOffset = getBigUint64(endOfDirectoryView, 48) + prependedDataLength;
 				}
 			}
+			const declaredDirectoryDataLength = directoryDataLength;
+			const centralDirectoryEndOffset = endOfDirectoryInfo.offset -
+				(zip64EndOfDirectory ? ZIP64_END_OF_CENTRAL_DIR_LENGTH + ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH : 0);
 			if (directoryDataOffset >= reader.size) {
 				prependedDataLength = reader.size - directoryDataOffset - directoryDataLength - END_OF_CENTRAL_DIR_LENGTH;
 				directoryDataOffset = reader.size - directoryDataLength - END_OF_CENTRAL_DIR_LENGTH;
@@ -3613,8 +3874,11 @@
 			let directoryArray = await readUint8Array(reader, directoryDataOffset, directoryDataLength, diskNumber);
 			let directoryView = getDataView$1(directoryArray);
 			if (directoryDataLength) {
-				const expectedDirectoryDataOffset = endOfDirectoryInfo.offset - directoryDataLength;
-				if (getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE && directoryDataOffset != expectedDirectoryDataOffset) {
+				if (directoryArray.length < 4) {
+					throw new Error(ERR_BAD_FORMAT);
+				}
+				const expectedDirectoryDataOffset = centralDirectoryEndOffset - directoryDataLength - (reader.lastDiskOffset || 0);
+				if (getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE && directoryDataOffset != expectedDirectoryDataOffset && diskNumber == lastDiskNumber) {
 					const originalDirectoryDataOffset = directoryDataOffset;
 					directoryDataOffset = expectedDirectoryDataOffset;
 					if (directoryDataOffset > originalDirectoryDataOffset) {
@@ -3624,8 +3888,8 @@
 					directoryView = getDataView$1(directoryArray);
 				}
 			}
-			const expectedDirectoryDataLength = endOfDirectoryInfo.offset - directoryDataOffset - (reader.lastDiskOffset || 0);
-			if (directoryDataLength != expectedDirectoryDataLength && expectedDirectoryDataLength >= 0) {
+			const expectedDirectoryDataLength = centralDirectoryEndOffset - directoryDataOffset - (reader.lastDiskOffset || 0);
+			if (directoryDataLength != expectedDirectoryDataLength && expectedDirectoryDataLength >= 0 && diskNumber == lastDiskNumber) {
 				directoryDataLength = expectedDirectoryDataLength;
 				directoryArray = await readUint8Array(reader, directoryDataOffset, directoryDataLength, diskNumber);
 				directoryView = getDataView$1(directoryArray);
@@ -3633,16 +3897,19 @@
 			if (directoryDataOffset < 0 || directoryDataOffset >= reader.size) {
 				throw new Error(ERR_BAD_FORMAT);
 			}
+			startOffset = directoryDataOffset;
 			const filenameEncoding = getOptionValue$1(zipReader, options, OPTION_FILENAME_ENCODING);
 			const commentEncoding = getOptionValue$1(zipReader, options, OPTION_COMMENT_ENCODING);
+			const filenames = checkAmbiguity ? new Set() : UNDEFINED_VALUE;
+			let duplicateFilename;
 			for (let indexFile = 0; indexFile < filesLength; indexFile++) {
 				const fileEntry = new ZipEntry(reader, config, zipReader.options);
-				if (getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE) {
+				if (offset + CENTRAL_FILE_HEADER_LENGTH > directoryArray.length || getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE) {
 					throw new Error(ERR_CENTRAL_DIRECTORY_NOT_FOUND);
 				}
 				readCommonHeader(fileEntry, directoryView, offset + 6);
 				const languageEncodingFlag = Boolean(fileEntry.bitFlag.languageEncodingFlag);
-				const filenameOffset = offset + 46;
+				const filenameOffset = offset + CENTRAL_FILE_HEADER_LENGTH;
 				const extraFieldOffset = filenameOffset + fileEntry.filenameLength;
 				const commentOffset = extraFieldOffset + fileEntry.extraFieldLength;
 				const versionMadeBy = getUint16(directoryView, offset + 4);
@@ -3663,7 +3930,7 @@
 					directory: Boolean(msdosAttributesRaw & FILE_ATTR_MSDOS_DIR_MASK),
 					archive: Boolean(msdosAttributesRaw & FILE_ATTR_MSDOS_ARCHIVE_MASK)
 				};
-				const offsetFileEntry = getUint32(directoryView, offset + 42) + prependedDataLength;
+				const offsetFileEntry = getUint32(directoryView, offset + 42);
 				const decode = getOptionValue$1(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 				const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 				const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
@@ -3676,6 +3943,7 @@
 					comment = decodeText(rawComment, rawCommentEncoding);
 				}
 				Object.assign(fileEntry, {
+					index: indexFile,
 					versionMadeBy,
 					msDosCompatible,
 					compressedSize: 0,
@@ -3695,8 +3963,15 @@
 					filename,
 					comment
 				});
-				startOffset = Math.max(offsetFileEntry, startOffset);
 				readCommonFooter(fileEntry, fileEntry, directoryView, offset + 6);
+				fileEntry.offset += prependedDataLength;
+				startOffset = Math.min(fileEntry.offset, startOffset);
+				if (checkAmbiguity) {
+					if (filenames.has(fileEntry.filename)) {
+						duplicateFilename = true;
+					}
+					filenames.add(fileEntry.filename);
+				}
 				const unixExternalUpper = (fileEntry.externalFileAttributes >> 16) & MAX_16_BITS;
 				if (fileEntry.unixMode === UNDEFINED_VALUE && (unixExternalUpper & (FILE_ATTR_UNIX_DEFAULT_MASK | FILE_ATTR_UNIX_EXECUTABLE_MASK | FILE_ATTR_UNIX_TYPE_DIR)) != 0) {
 					fileEntry.unixMode = unixExternalUpper;
@@ -3717,7 +3992,7 @@
 					internalFileAttribute: fileEntry.internalFileAttributes,
 					externalFileAttribute: fileEntry.externalFileAttributes,
 					executable,
-					directory: modeIsDir || upperIsDir || (msDosCompatible && msdosAttributes.directory) || (filename.endsWith(DIRECTORY_SIGNATURE) && !fileEntry.uncompressedSize),
+					directory: modeIsDir || upperIsDir || (msDosCompatible && msdosAttributes.directory) || (fileEntry.filename.endsWith(DIRECTORY_SIGNATURE) && !fileEntry.uncompressedSize),
 					zipCrypto: fileEntry.encrypted && !fileEntry.extraFieldAES
 				});
 				const entry = new Entry(fileEntry);
@@ -3740,6 +4015,15 @@
 				}
 				yield entry;
 			}
+			if (checkAmbiguity && offset != declaredDirectoryDataLength) {
+				throwAmbiguousArchive("trailing central directory data");
+			}
+			if (duplicateFilename) {
+				throwAmbiguousArchive("duplicate filename");
+			}
+			if (checkAmbiguity && (prependedDataLength || (filesLength && startOffset > 0))) {
+				throwAmbiguousArchive("prepended data");
+			}
 			const extractPrependedData = getOptionValue$1(zipReader, options, OPTION_EXTRACT_PREPENDED_DATA);
 			const extractAppendedData = getOptionValue$1(zipReader, options, OPTION_EXTRACT_APPENDED_DATA);
 			if (extractPrependedData) {
@@ -3779,9 +4063,21 @@
 						readable: (function () {
 							const { readable, writable } = new TransformStream();
 							if (value.getData) {
-								value.getData(writable);
+								getData();
 								return readable;
 							}
+
+							async function getData() {
+								try {
+									await value.getData(writable);
+								} catch (error) {
+									try {
+										await writable.abort(error);
+									} catch {
+										// ignored
+									}
+								}
+							}
 						})()
 					};
 					delete chunk.getData;
@@ -3806,6 +4102,7 @@
 			const zipEntry = this;
 			const {
 				reader,
+				index,
 				offset,
 				diskNumberStart,
 				extraFieldAES,
@@ -3831,27 +4128,42 @@
 			rawPassword = rawPassword && rawPassword.length && rawPassword;
 			if (extraFieldAES) {
 				if (extraFieldAES.originalCompressionMethod != COMPRESSION_METHOD_AES) {
-					throw new Error(ERR_UNSUPPORTED_COMPRESSION);
+					throw new Error(ERR_UNSUPPORTED_COMPRESSION$1);
 				}
 			}
 			if ((compressionMethod != COMPRESSION_METHOD_STORE && compressionMethod != COMPRESSION_METHOD_DEFLATE && compressionMethod != COMPRESSION_METHOD_DEFLATE_64) && !passThrough) {
-				throw new Error(ERR_UNSUPPORTED_COMPRESSION);
+				throw new Error(ERR_UNSUPPORTED_COMPRESSION$1);
 			}
-			if (getUint32(dataView, 0) != LOCAL_FILE_HEADER_SIGNATURE) {
+			if (dataArray.length < HEADER_SIZE || getUint32(dataView, 0) != LOCAL_FILE_HEADER_SIGNATURE) {
 				throw new Error(ERR_LOCAL_FILE_HEADER_NOT_FOUND);
 			}
 			readCommonHeader(localDirectory, dataView, 4);
 			const {
 				extraFieldLength,
-				filenameLength,
-				lastAccessDate,
-				creationDate
+				filenameLength
 			} = localDirectory;
-			localDirectory.rawExtraField = extraFieldLength ?
-				await readUint8Array(reader, offset + HEADER_SIZE + filenameLength, extraFieldLength, diskNumberStart) :
-				new Uint8Array();
+			const checkAmbiguity = getOptionValue$1(zipEntry, options, OPTION_CHECK_AMBIGUITY);
+			let rawLocalFilename = new Uint8Array();
+			if (checkAmbiguity && (filenameLength || extraFieldLength)) {
+				const trailingDataArray = await readUint8Array(reader, offset + HEADER_SIZE, filenameLength + extraFieldLength, diskNumberStart);
+				rawLocalFilename = trailingDataArray.subarray(0, filenameLength);
+				localDirectory.rawExtraField = trailingDataArray.subarray(filenameLength);
+			} else {
+				localDirectory.rawExtraField = extraFieldLength ?
+					await readUint8Array(reader, offset + HEADER_SIZE + filenameLength, extraFieldLength, diskNumberStart) :
+					new Uint8Array();
+			}
 			readCommonFooter(zipEntry, localDirectory, dataView, 4, true);
-			Object.assign(fileEntry, { lastAccessDate, creationDate });
+			if (checkAmbiguity) {
+				checkLocalDirectory(zipEntry, localDirectory, rawLocalFilename);
+			}
+			const { lastAccessDate, creationDate } = localDirectory;
+			if (lastAccessDate) {
+				fileEntry.lastAccessDate = lastAccessDate;
+			}
+			if (creationDate) {
+				fileEntry.creationDate = creationDate;
+			}
 			const encrypted = zipEntry.encrypted && localDirectory.encrypted && !passThrough;
 			const zipCrypto = encrypted && !extraFieldAES;
 			if (!passThrough) {
@@ -3897,7 +4209,7 @@
 					outputSize: passThrough ? compressedSize : uncompressedSize,
 					signature,
 					compressed: compressionMethod != 0 && !passThrough,
-					encrypted: zipEntry.encrypted && !passThrough,
+					encrypted,
 					useWebWorkers: getOptionValue$1(zipEntry, options, OPTION_USE_WEB_WORKERS),
 					useCompressionStream,
 					transferStreams: getOptionValue$1(zipEntry, options, OPTION_TRANSFER_STREAMS),
@@ -3911,6 +4223,7 @@
 				await detectOverlappingEntry({
 					reader,
 					fileEntry,
+					index,
 					offset,
 					diskNumberStart,
 					signature,
@@ -4013,7 +4326,7 @@
 			directory.extraFieldUnicodeComment = extraFieldUnicodeComment;
 		}
 		const extraFieldAES = extraField.get(EXTRAFIELD_TYPE_AES);
-		if (extraFieldAES) {
+		if (extraFieldAES && extraFieldAES.data.length >= 7) {
 			readExtraFieldAES(extraFieldAES, directory, compressionMethod);
 			directory.extraFieldAES = extraFieldAES;
 		} else {
@@ -4050,19 +4363,23 @@
 		directory.zip64 = true;
 		const extraFieldView = getDataView$1(extraFieldZip64.data);
 		const missingProperties = ZIP64_PROPERTIES.filter(([propertyName, max]) => directory[propertyName] == max);
+		const requiredLength = missingProperties.reduce((length, [, max]) => length + ZIP64_EXTRACTION[max].bytes, 0);
+		if (extraFieldZip64.data.length < requiredLength) {
+			throw new Error(ERR_EXTRAFIELD_ZIP64_NOT_FOUND);
+		}
 		for (let indexMissingProperty = 0, offset = 0; indexMissingProperty < missingProperties.length; indexMissingProperty++) {
 			const [propertyName, max] = missingProperties[indexMissingProperty];
-			if (directory[propertyName] == max) {
-				const extraction = ZIP64_EXTRACTION[max];
-				directory[propertyName] = extraFieldZip64[propertyName] = extraction.getValue(extraFieldView, offset);
-				offset += extraction.bytes;
-			} else if (extraFieldZip64[propertyName]) {
-				throw new Error(ERR_EXTRAFIELD_ZIP64_NOT_FOUND);
-			}
+			const extraction = ZIP64_EXTRACTION[max];
+			directory[propertyName] = extraFieldZip64[propertyName] = extraction.getValue(extraFieldView, offset);
+			offset += extraction.bytes;
 		}
 	}
 
 	function readExtraFieldUnicode(extraFieldUnicode, propertyName, rawPropertyName, directory, fileEntry) {
+		if (extraFieldUnicode.data.length < 5) {
+			extraFieldUnicode.valid = false;
+			return;
+		}
 		const extraFieldView = getDataView$1(extraFieldUnicode.data);
 		const crc32 = new Crc32();
 		crc32.append(fileEntry[rawPropertyName]);
@@ -4135,32 +4452,30 @@
 	function readExtraFieldUnix(extraField, directory, isInfoZip) {
 		try {
 			const view = getDataView$1(new Uint8Array(extraField.data));
-			let offset = 0;
-			const version = getUint8(view, offset++);
-			const uidSize = getUint8(view, offset++);
-			const uidBytes = extraField.data.subarray(offset, offset + uidSize);
-			offset += uidSize;
-			const uid = unpackUnixId(uidBytes);
-			const gidSize = getUint8(view, offset++);
-			const gidBytes = extraField.data.subarray(offset, offset + gidSize);
-			offset += gidSize;
-			const gid = unpackUnixId(gidBytes);
-			let unixMode = UNDEFINED_VALUE;
-			if (!isInfoZip && offset + 2 <= extraField.data.length) {
-				const base = extraField.data;
-				const modeView = new DataView(base.buffer, base.byteOffset + offset, 2);
-				unixMode = modeView.getUint16(0, true);
-			}
-			Object.assign(extraField, { version, uid, gid, unixMode });
+			let uid, gid;
+			if (isInfoZip) {
+				// Info-ZIP New Unix "ux" field (0x7875): version + variable-length uid/gid
+				let offset = 0;
+				const version = getUint8(view, offset++);
+				const uidSize = getUint8(view, offset++);
+				uid = unpackUnixId(extraField.data.subarray(offset, offset + uidSize));
+				offset += uidSize;
+				const gidSize = getUint8(view, offset++);
+				gid = unpackUnixId(extraField.data.subarray(offset, offset + gidSize));
+				Object.assign(extraField, { version, uid, gid });
+			} else if (extraField.data.length >= 4) {
+				// Info-ZIP Unix "Ux" field (0x7855): fixed 2-byte uid + gid (the file mode, if any, is
+				// carried in the external file attributes, not here)
+				uid = getUint16(view, 0);
+				gid = getUint16(view, 2);
+				Object.assign(extraField, { uid, gid });
+			}
 			if (uid !== UNDEFINED_VALUE) {
 				directory.uid = uid;
 			}
 			if (gid !== UNDEFINED_VALUE) {
 				directory.gid = gid;
 			}
-			if (unixMode !== UNDEFINED_VALUE) {
-				directory.unixMode = unixMode;
-			}
 		} catch {
 			// ignored
 		}
@@ -4174,6 +4489,9 @@
 	}
 
 	function readExtraFieldExtendedTimestamp(extraFieldExtendedTimestamp, directory, localDirectory) {
+		if (!extraFieldExtendedTimestamp.data.length) {
+			return;
+		}
 		const extraFieldView = getDataView$1(extraFieldExtendedTimestamp.data);
 		const flags = getUint8(extraFieldView, 0);
 		const timeProperties = [];
@@ -4199,7 +4517,8 @@
 		timeProperties.forEach((propertyName, indexProperty) => {
 			if (extraFieldExtendedTimestamp.data.length >= offset + 4) {
 				const time = getUint32(extraFieldView, offset);
-				directory[propertyName] = extraFieldExtendedTimestamp[propertyName] = new Date(time * 1000);
+				// the extended timestamp is a signed 32-bit time_t value
+				directory[propertyName] = extraFieldExtendedTimestamp[propertyName] = new Date((time | 0) * 1000);
 				const rawPropertyName = timeRawProperties[indexProperty];
 				extraFieldExtendedTimestamp[rawPropertyName] = time;
 			}
@@ -4210,6 +4529,7 @@
 	async function detectOverlappingEntry({
 		reader,
 		fileEntry,
+		index,
 		offset,
 		diskNumberStart,
 		signature,
@@ -4221,10 +4541,9 @@
 		readRanges
 	}) {
 		let diskOffset = 0;
-		if (diskNumberStart) {
-			for (let indexReader = 0; indexReader < diskNumberStart; indexReader++) {
-				const diskReader = reader.readers[indexReader];
-				diskOffset += diskReader.size;
+		if (diskNumberStart && reader.readers) {
+			for (let indexReader = 0; indexReader < Math.min(diskNumberStart, reader.readers.length); indexReader++) {
+				diskOffset += reader.readers[indexReader].size;
 			}
 		}
 		let dataDescriptorLength = 0;
@@ -4237,7 +4556,8 @@
 		}
 		if (dataDescriptorLength) {
 			const dataDescriptorArray = await readUint8Array(reader, dataOffset + compressedSize, dataDescriptorLength + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH, diskNumberStart);
-			const dataDescriptorSignature = getUint32(getDataView$1(dataDescriptorArray), 0) == DATA_DESCRIPTOR_RECORD_SIGNATURE;
+			const dataDescriptorSignature = dataDescriptorArray.length == dataDescriptorLength + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH &&
+				getUint32(getDataView$1(dataDescriptorArray), 0) == DATA_DESCRIPTOR_RECORD_SIGNATURE;
 			if (dataDescriptorSignature) {
 				const readSignature = getUint32(getDataView$1(dataDescriptorArray), 4);
 				let readCompressedSize;
@@ -4262,14 +4582,14 @@
 			end: diskOffset + dataOffset + compressedSize + dataDescriptorLength,
 			fileEntry
 		};
-		for (const otherRange of readRanges) {
-			if (otherRange.fileEntry != fileEntry && range.start >= otherRange.start && range.start < otherRange.end) {
+		for (const [otherIndex, otherRange] of readRanges) {
+			if (otherIndex != index && range.start < otherRange.end && otherRange.start < range.end) {
 				const error = new Error(ERR_OVERLAPPING_ENTRY);
 				error.overlappingEntry = otherRange.fileEntry;
 				throw error;
 			}
 		}
-		readRanges.push(range);
+		readRanges.set(index, range);
 	}
 
 	async function seekSignature(reader, signature, startOffset, minimumBytes, maximumLength) {
@@ -4294,6 +4614,35 @@
 		}
 	}
 
+	function checkLocalDirectory(zipEntry, localDirectory, rawLocalFilename) {
+		const { rawFilename } = zipEntry;
+		if (rawLocalFilename.length != rawFilename.length ||
+			rawLocalFilename.some((byteValue, indexByte) => byteValue != rawFilename[indexByte])) {
+			throwAmbiguousArchive("mismatched local file header (filename)");
+		}
+		if ((localDirectory.rawBitFlag & BITFLAG_AMBIGUITY_MASK) != (zipEntry.rawBitFlag & BITFLAG_AMBIGUITY_MASK)) {
+			throwAmbiguousArchive("mismatched local file header (general purpose bit flag)");
+		}
+		if (localDirectory.compressionMethod != zipEntry.compressionMethod) {
+			throwAmbiguousArchive("mismatched local file header (compression method)");
+		}
+		// when the data descriptor flag is set, the local signature and sizes are zeroed out; all-zero values are
+		// also tolerated when the flag is clear because some tools produce them (streaming writers predating bit 3)
+		if (!localDirectory.bitFlag.dataDescriptor &&
+			(localDirectory.signature || localDirectory.compressedSize || localDirectory.uncompressedSize) &&
+			(localDirectory.signature != zipEntry.signature ||
+				localDirectory.compressedSize != zipEntry.compressedSize ||
+				localDirectory.uncompressedSize != zipEntry.uncompressedSize)) {
+			throwAmbiguousArchive("mismatched local file header (signature or sizes)");
+		}
+	}
+
+	function throwAmbiguousArchive(reason) {
+		const error = new Error(ERR_AMBIGUOUS_ARCHIVE);
+		error.reason = reason;
+		throw error;
+	}
+
 	function getOptionValue$1(zipReader, options, name) {
 		return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 	}
@@ -4332,7 +4681,7 @@
 	}
 
 	function getDataView$1(array) {
-		return new DataView(array.buffer);
+		return new DataView(array.buffer, array.byteOffset, array.byteLength);
 	}
 
 	/*
@@ -4372,13 +4721,19 @@
 	const ERR_INVALID_ENCRYPTION_STRENGTH = "The strength must equal 1, 2, or 3";
 	const ERR_INVALID_EXTRAFIELD_TYPE = "Extra field type exceeds 65535";
 	const ERR_INVALID_EXTRAFIELD_DATA = "Extra field data exceeds 64KB";
+	// same message as the constant exported by zip-reader.js
+	const ERR_UNSUPPORTED_COMPRESSION = "Compression method not supported";
+	const MIN_UNIX_TIME = -2147483648;
+	const MAX_UNIX_TIME = 2147483647;
 	const ERR_UNSUPPORTED_FORMAT = "Zip64 is not supported (set the 'zip64' option to 'true')";
 	const ERR_UNDEFINED_UNCOMPRESSED_SIZE = "Undefined uncompressed size";
+	const ERR_UNDEFINED_READER = "Undefined reader";
 	const ERR_ZIP_NOT_EMPTY = "Zip file not empty";
 	const ERR_INVALID_UID = "Invalid uid (must be integer 0..2^32-1)";
 	const ERR_INVALID_GID = "Invalid gid (must be integer 0..2^32-1)";
 	const ERR_INVALID_UNIX_MODE = "Invalid UNIX mode (must be integer 0..65535)";
 	const ERR_INVALID_UNIX_EXTRA_FIELD_TYPE = "Invalid unixExtraFieldType (must be 'infozip' or 'unix')";
+	const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 	const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 	const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
 
@@ -4404,9 +4759,10 @@
 				files: new Map(),
 				filenames: new Set(),
 				offset: options[OPTION_OFFSET] === UNDEFINED_VALUE ? writer.size || writer.writable.size || 0 : options[OPTION_OFFSET],
-				pendingEntriesSize: 0,
+				initialOffset: options[OPTION_OFFSET] === UNDEFINED_VALUE ? 0 : options[OPTION_OFFSET] - (writer.size || writer.writable.size || 0),
 				pendingAddFileCalls: new Set(),
-				bufferedWrites: 0
+				bufferedWrites: 0,
+				lastFileEntry: UNDEFINED_VALUE
 			});
 		}
 
@@ -4415,17 +4771,18 @@
 				throw new Error(ERR_ZIP_NOT_EMPTY);
 			}
 			reader = new GenericReader(reader);
+			await initStream(reader);
 			const zipReader = new ZipReader(reader.readable);
 			const entries = await zipReader.getEntries();
 			await zipReader.close();
+			await initStream(this.writer);
 			await reader.readable.pipeTo(this.writer.writable, { preventClose: true, preventAbort: true });
 			this.writer.size = this.offset = reader.size;
 			this.filenames = new Set(entries.map(entry => entry.filename));
 			this.files = new Map(entries.map(entry => {
 				const {
 					version,
-					compressionMethod,
-					lastModDate,
+					rawLastModDate,
 					lastAccessDate,
 					creationDate,
 					rawFilename,
@@ -4438,6 +4795,7 @@
 					zip64
 				} = entry;
 				let {
+					compressionMethod,
 					rawExtraFieldZip64,
 					rawExtraFieldAES,
 					rawExtraFieldExtendedTimestamp,
@@ -4450,31 +4808,39 @@
 				rawExtraFieldAES = rawExtraFieldAES || new Uint8Array();
 				rawExtraFieldExtendedTimestamp = rawExtraFieldExtendedTimestamp || new Uint8Array();
 				rawExtraFieldNTFS = rawExtraFieldNTFS || new Uint8Array();
-				rawExtraFieldUnix = entry.rawExtraFieldUnix || new Uint8Array();
+				rawExtraFieldUnix = rawExtraFieldUnix || new Uint8Array();
 				rawExtraField = rawExtraField || new Uint8Array();
+				if (entry.extraFieldAES) {
+					compressionMethod = COMPRESSION_METHOD_AES;
+				}
 				const extraFieldLength = getLength(rawExtraFieldZip64, rawExtraFieldAES, rawExtraFieldExtendedTimestamp, rawExtraFieldNTFS, rawExtraFieldUnix, rawExtraField);
-				const zip64UncompressedSize = zip64 && uncompressedSize > MAX_32_BITS;
-				const zip64CompressedSize = zip64 && compressedSize > MAX_32_BITS;
+				const zip64UncompressedSize = zip64 && uncompressedSize >= MAX_32_BITS;
+				const zip64CompressedSize = zip64 && compressedSize >= MAX_32_BITS;
+				const bitFlagValue = (getBitFlag(level, languageEncodingFlag, dataDescriptor, encrypted, compressionMethod) & ~BITFLAG_LEVEL) | (level << 1);
 				const {
 					headerArray,
 					headerView
 				} = getHeaderArrayData({
 					version,
-					bitFlag: getBitFlag(level, languageEncodingFlag, dataDescriptor, encrypted, compressionMethod),
+					bitFlag: bitFlagValue,
 					compressionMethod,
 					uncompressedSize,
 					compressedSize,
-					lastModDate,
+					rawLastModDate,
 					rawFilename,
 					zip64CompressedSize,
 					zip64UncompressedSize,
 					extraFieldLength
 				});
+				const { signature } = entry;
+				if (signature !== UNDEFINED_VALUE) {
+					setUint32(headerView, HEADER_OFFSET_SIGNATURE, signature);
+				}
 				Object.assign(entry, {
 					zip64UncompressedSize,
 					zip64CompressedSize,
-					zip64Offset: zip64 && this.offset - diskOffset > MAX_32_BITS,
-					zip64DiskNumberStart: zip64 && diskNumber > MAX_16_BITS,
+					zip64Offset: zip64 && this.offset - diskOffset >= MAX_32_BITS,
+					zip64DiskNumberStart: zip64 && diskNumber >= MAX_16_BITS,
 					rawExtraFieldZip64,
 					rawExtraFieldAES,
 					rawExtraFieldExtendedTimestamp,
@@ -4492,6 +4858,7 @@
 
 		async add(name = "", reader, options = {}) {
 			const zipWriter = this;
+			options = Object.assign({}, options);
 			const {
 				pendingAddFileCalls,
 				config
@@ -4502,17 +4869,24 @@
 				await new Promise(resolve => pendingEntries.push(resolve));
 			}
 			let promiseAddFile;
+			let nameAdded;
 			try {
 				name = name.trim();
+				if (getOptionValue(zipWriter, options, PROPERTY_NAME_DIRECTORY) && !name.endsWith(DIRECTORY_SIGNATURE)) {
+					name += DIRECTORY_SIGNATURE;
+				}
 				if (zipWriter.filenames.has(name)) {
 					throw new Error(ERR_DUPLICATED_NAME);
 				}
 				zipWriter.filenames.add(name);
+				nameAdded = true;
 				promiseAddFile = addFile(zipWriter, name, reader, options);
 				pendingAddFileCalls.add(promiseAddFile);
 				return await promiseAddFile;
 			} catch (error) {
-				zipWriter.filenames.delete(name);
+				if (nameAdded) {
+					zipWriter.filenames.delete(name);
+				}
 				throw error;
 			} finally {
 				pendingAddFileCalls.delete(promiseAddFile);
@@ -4545,6 +4919,9 @@
 			const zipWriter = this;
 			const { pendingAddFileCalls, writer } = this;
 			const { writable } = writer;
+			if (getLength(comment) > MAX_16_BITS) {
+				throw new Error(ERR_INVALID_COMMENT);
+			}
 			while (pendingAddFileCalls.size) {
 				await Promise.allSettled(Array.from(pendingAddFileCalls));
 			}
@@ -4563,28 +4940,94 @@
 			const { readable, writable } = new TransformStream();
 			this.readable = readable;
 			this.zipWriter = new ZipWriter(writable, options);
+			this.pendingAddFileCalls = new Set();
 		}
 
 		transform(path) {
+			const zipWriter = this.zipWriter;
+			let streamController;
 			const { readable, writable } = new TransformStream({
-				flush: () => { this.zipWriter.close(); }
+				start(controller) {
+					streamController = controller;
+				},
+				flush: () => void closeArchive()
 			});
-			this.zipWriter.add(path, readable);
+			watchAddFileCall(this, this.zipWriter.add(path, readable), error => streamController.error(error));
 			return { readable: this.readable, writable };
+
+			async function closeArchive() {
+				try {
+					await zipWriter.close();
+				} catch (error) {
+					try {
+						await zipWriter.writer.writable.abort(error);
+					} catch {
+						// ignored
+					}
+				}
+			}
 		}
 
 		writable(path) {
-			const { readable, writable } = new TransformStream();
-			this.zipWriter.add(path, readable);
+			let streamController;
+			const { readable, writable } = new TransformStream({
+				start(controller) {
+					streamController = controller;
+				}
+			});
+			watchAddFileCall(this, this.zipWriter.add(path, readable), error => streamController.error(error));
 			return writable;
 		}
 
-		close(comment = UNDEFINED_VALUE, options = {}) {
+		async close(comment = UNDEFINED_VALUE, options = {}) {
+			await Promise.all(Array.from(this.pendingAddFileCalls));
 			return this.zipWriter.close(comment, options);
 		}
 	}
 
+	function watchAddFileCall(zipWriterStream, promiseAddFile, onerror) {
+		zipWriterStream.pendingAddFileCalls.add(promiseAddFile);
+		promiseAddFile.catch(error => {
+			try {
+				onerror(error);
+			} catch {
+				// ignored
+			}
+		});
+	}
+
 	async function addFile(zipWriter, name, reader, options) {
+		const attributesInfo = resolveAttributes(zipWriter, name, options);
+		({ name } = attributesInfo);
+		const metadataInfo = resolveMetadata(zipWriter, name, options);
+		const { comment } = metadataInfo;
+		const extraField = options[PROPERTY_NAME_EXTRA_FIELD];
+		zipWriter.files.set(name, UNDEFINED_VALUE);
+		let fileEntry;
+		try {
+			const sizesInfo = await resolveSizes(zipWriter, reader, metadataInfo, options);
+			({ reader } = sizesInfo);
+			const { diskOffset, diskNumber } = zipWriter.writer;
+			options = Object.assign({}, options, attributesInfo.resolvedOptions, metadataInfo.resolvedOptions, sizesInfo.resolvedOptions, {
+				internalFileAttribute: metadataInfo.resolvedOptions.internalFileAttributes,
+				externalFileAttribute: attributesInfo.resolvedOptions.externalFileAttributes,
+				signature: options[PROPERTY_NAME_SIGNATURE],
+				offset: zipWriter.offset - diskOffset,
+				diskNumberStart: diskNumber
+			});
+			const headerInfo = getHeaderInfo(options);
+			const dataDescriptorInfo = getDataDescriptorInfo(options);
+			const metadataSize = getLength(headerInfo.localHeaderArray, dataDescriptorInfo.dataDescriptorArray);
+			fileEntry = await getFileEntry(zipWriter, name, reader, { headerInfo, dataDescriptorInfo, metadataSize }, options);
+		} catch (error) {
+			zipWriter.files.delete(name);
+			throw error;
+		}
+		Object.assign(fileEntry, { name, comment, extraField });
+		return new Entry(fileEntry);
+	}
+
+	function resolveAttributes(zipWriter, name, options) {
 		name = name.trim();
 		let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 		let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
@@ -4592,7 +5035,7 @@
 		const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
 		const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
 		let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
-		const unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
+		let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 		let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 		let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 		let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
@@ -4608,6 +5051,13 @@
 		if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
 			throw new Error(ERR_INVALID_UNIX_EXTRA_FIELD_TYPE);
 		}
+		if (unixExtraFieldType === UNIX_EXTRA_FIELD_TYPE &&
+			((uid !== UNDEFINED_VALUE && uid > MAX_16_BITS) || (gid !== UNDEFINED_VALUE && gid > MAX_16_BITS))) {
+			throw new Error(ERR_INVALID_UNIX_ID_SIZE);
+		}
+		if (unixExtraFieldType === UNDEFINED_VALUE && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
+			unixExtraFieldType = INFOZIP_EXTRA_FIELD_TYPE;
+		}
 		let msdosAttributesRaw = getOptionValue(zipWriter, options, PROPERTY_NAME_MSDOS_ATTRIBUTES_RAW);
 		let msdosAttributes = getOptionValue(zipWriter, options, PROPERTY_NAME_MSDOS_ATTRIBUTES);
 		const hasUnixMetadata = uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE || unixMode !== UNDEFINED_VALUE || unixExtraFieldType;
@@ -4678,6 +5128,27 @@
 		if (hasMsDosProvided) {
 			externalFileAttributes = (externalFileAttributes & MAX_32_BITS) | (msdosAttributesRaw & MAX_8_BITS);
 		}
+		return {
+			name,
+			resolvedOptions: {
+				versionMadeBy,
+				msDosCompatible,
+				externalFileAttributes,
+				unixExternalUpper,
+				uid,
+				gid,
+				unixMode,
+				unixExtraFieldType,
+				setuid,
+				setgid,
+				sticky,
+				msdosAttributesRaw,
+				msdosAttributes
+			}
+		};
+	}
+
+	function resolveMetadata(zipWriter, name, options) {
 		const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
 		let rawFilename = encode(name);
 		if (rawFilename === UNDEFINED_VALUE) {
@@ -4716,10 +5187,14 @@
 		const transferStreams = getOptionValue(zipWriter, options, OPTION_TRANSFER_STREAMS, true);
 		const bufferedWrite = getOptionValue(zipWriter, options, OPTION_BUFFERED_WRITE);
 		const createTempStream = getOptionValue(zipWriter, options, OPTION_CREATE_TEMP_STREAM);
-		const dataDescriptorSignature = getOptionValue(zipWriter, options, OPTION_DATA_DESCRIPTOR_SIGNATURE, false);
+		const dataDescriptorSignature = getOptionValue(zipWriter, options, OPTION_DATA_DESCRIPTOR_SIGNATURE, true);
 		const signal = getOptionValue(zipWriter, options, OPTION_SIGNAL);
 		const useUnicodeFileNames = getOptionValue(zipWriter, options, OPTION_USE_UNICODE_FILE_NAMES, true);
 		const compressionMethod = getOptionValue(zipWriter, options, PROPERTY_NAME_COMPRESSION_METHOD);
+		if (!passThrough && compressionMethod !== UNDEFINED_VALUE &&
+			compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE) {
+			throw new Error(ERR_UNSUPPORTED_COMPRESSION);
+		}
 		let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
 		let useCompressionStream = getOptionValue(zipWriter, options, OPTION_USE_COMPRESSION_STREAM);
 		let dataDescriptor = getOptionValue(zipWriter, options, OPTION_DATA_DESCRIPTOR);
@@ -4735,7 +5210,7 @@
 		if (!useCompressionStream && (zipWriter.config.CompressionStream === UNDEFINED_VALUE && zipWriter.config.CompressionStreamZlib === UNDEFINED_VALUE)) {
 			level = 0;
 		}
-		let zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
+		const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
 		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
 			throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 		}
@@ -4746,6 +5221,7 @@
 			let offset = 0;
 			extraField.forEach(data => extraFieldSize += 4 + getLength(data));
 			rawExtraField = new Uint8Array(extraFieldSize);
+			const rawExtraFieldView = getDataView(rawExtraField);
 			extraField.forEach((data, type) => {
 				if (type > MAX_16_BITS) {
 					throw new Error(ERR_INVALID_EXTRAFIELD_TYPE);
@@ -4753,22 +5229,72 @@
 				if (getLength(data) > MAX_16_BITS) {
 					throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
 				}
-				arraySet(rawExtraField, new Uint16Array([type]), offset);
-				arraySet(rawExtraField, new Uint16Array([getLength(data)]), offset + 2);
+				setUint16(rawExtraFieldView, offset, type);
+				setUint16(rawExtraFieldView, offset + 2, getLength(data));
 				arraySet(rawExtraField, data, offset + 4);
 				offset += 4 + getLength(data);
 			});
 		}
+		return {
+			comment,
+			resolvedOptions: {
+				rawFilename,
+				rawComment,
+				version,
+				lastModDate,
+				lastAccessDate,
+				creationDate,
+				internalFileAttributes,
+				passThrough,
+				password,
+				rawPassword,
+				encryptionStrength,
+				zipCrypto,
+				extendedTimestamp,
+				keepOrder,
+				useWebWorkers,
+				transferStreams,
+				bufferedWrite,
+				createTempStream,
+				dataDescriptorSignature,
+				signal,
+				useUnicodeFileNames,
+				compressionMethod,
+				level,
+				useCompressionStream,
+				dataDescriptor,
+				zip64,
+				rawExtraField
+			}
+		};
+	}
+
+	async function resolveSizes(zipWriter, reader, { resolvedOptions: metadata }, options) {
+		const { passThrough, zipCrypto, password, rawPassword, encryptionStrength } = metadata;
+		let { dataDescriptor, zip64, level, compressionMethod } = metadata;
 		let maximumCompressedSize = 0;
-		let maximumEntrySize = 0;
 		let uncompressedSize = 0;
 		if (passThrough) {
+			// the headers of a passThrough entry describe the payload verbatim: without a
+			// reader they would declare content that is not there
+			if (!reader) {
+				throw new Error(ERR_UNDEFINED_READER);
+			}
 			uncompressedSize = options[PROPERTY_NAME_UNCOMPRESSED_SIZE];
 			if (uncompressedSize === UNDEFINED_VALUE) {
 				throw new Error(ERR_UNDEFINED_UNCOMPRESSED_SIZE);
 			}
 		}
 		const zip64Enabled = zip64 === true;
+		const encrypted = getOptionValue(zipWriter, options, PROPERTY_NAME_ENCRYPTED);
+		// entries without a reader have no payload: write them as empty stored files instead of
+		// declaring a compressed or encrypted content that does not exist
+		const encryptedEntry = Boolean(reader) && (Boolean((password && getLength(password)) || (rawPassword && getLength(rawPassword))) || (passThrough && encrypted));
+		if (!reader) {
+			level = 0;
+			compressionMethod = COMPRESSION_METHOD_STORE;
+		}
+		const encryptionOverhead = encryptedEntry ? (zipCrypto ? 12 : 16 + encryptionStrength * 4) : 0;
 		if (reader) {
 			reader = new GenericReader(reader);
 			await initStream(reader);
@@ -4781,16 +5307,15 @@
 					}
 				} else {
 					options.uncompressedSize = uncompressedSize = reader.size;
-					maximumCompressedSize = getMaximumCompressedSize(uncompressedSize);
+					maximumCompressedSize = getMaximumCompressedSize(uncompressedSize) + encryptionOverhead;
 				}
 			} else {
 				options.uncompressedSize = uncompressedSize;
-				maximumCompressedSize = getMaximumCompressedSize(uncompressedSize);
+				maximumCompressedSize = getMaximumCompressedSize(uncompressedSize) + encryptionOverhead;
 			}
 		}
-		const { diskOffset, diskNumber } = zipWriter.writer;
-		const zip64UncompressedSize = zip64Enabled || uncompressedSize > MAX_32_BITS;
-		const zip64CompressedSize = zip64Enabled || maximumCompressedSize > MAX_32_BITS;
+		const zip64UncompressedSize = zip64Enabled || uncompressedSize >= MAX_32_BITS;
+		const zip64CompressedSize = zip64Enabled || maximumCompressedSize >= MAX_32_BITS;
 		if (zip64UncompressedSize || zip64CompressedSize) {
 			if (zip64 === false) {
 				throw new Error(ERR_UNSUPPORTED_FORMAT);
@@ -4799,73 +5324,19 @@
 			}
 		}
 		zip64 = zip64 || false;
-		const encrypted = getOptionValue(zipWriter, options, PROPERTY_NAME_ENCRYPTED);
-		options = Object.assign({}, options, {
-			rawFilename,
-			rawComment,
-			version,
-			versionMadeBy,
-			lastModDate,
-			lastAccessDate,
-			creationDate,
-			rawExtraField,
-			zip64,
-			zip64UncompressedSize,
-			zip64CompressedSize,
-			password,
-			rawPassword,
-			level,
-			useWebWorkers,
-			transferStreams,
-			encryptionStrength,
-			extendedTimestamp,
-			zipCrypto,
-			bufferedWrite,
-			createTempStream,
-			keepOrder,
-			useUnicodeFileNames,
-			dataDescriptor,
-			dataDescriptorSignature,
-			signal,
-			msDosCompatible,
-			internalFileAttribute: internalFileAttributes,
-			internalFileAttributes,
-			externalFileAttribute: externalFileAttributes,
-			externalFileAttributes,
-			useCompressionStream,
-			passThrough,
-			encrypted: Boolean((password && getLength(password)) || (rawPassword && getLength(rawPassword))) || (passThrough && encrypted),
-			signature: options[PROPERTY_NAME_SIGNATURE],
-			compressionMethod,
-			uncompressedSize,
-			offset: zipWriter.offset - diskOffset,
-			diskNumberStart: diskNumber,
-			uid,
-			gid,
-			setuid,
-			setgid,
-			sticky,
-			unixMode,
-			msdosAttributesRaw,
-			msdosAttributes,
-			unixExternalUpper
-		});
-		const headerInfo = getHeaderInfo(options);
-		const dataDescriptorInfo = getDataDescriptorInfo(options);
-		const metadataSize = getLength(headerInfo.localHeaderArray, dataDescriptorInfo.dataDescriptorArray);
-		maximumEntrySize = metadataSize + maximumCompressedSize;
-		if (zipWriter.options[OPTION_USDZ]) {
-			maximumEntrySize += maximumEntrySize + 64;
-		}
-		zipWriter.pendingEntriesSize += maximumEntrySize;
-		let fileEntry;
-		try {
-			fileEntry = await getFileEntry(zipWriter, name, reader, { headerInfo, dataDescriptorInfo, metadataSize }, options);
-		} finally {
-			zipWriter.pendingEntriesSize -= maximumEntrySize;
-		}
-		Object.assign(fileEntry, { name, comment, extraField });
-		return new Entry(fileEntry);
+		return {
+			reader,
+			resolvedOptions: {
+				dataDescriptor,
+				zip64,
+				zip64UncompressedSize,
+				zip64CompressedSize,
+				uncompressedSize,
+				level,
+				compressionMethod,
+				encrypted: encryptedEntry
+			}
+		};
 	}
 
 	async function getFileEntry(zipWriter, name, reader, entryInfo, options) {
@@ -4882,37 +5353,40 @@
 			headerInfo
 		} = entryInfo;
 		const usdz = zipWriter.options[OPTION_USDZ];
-		const previousFileEntry = Array.from(files.values()).pop();
+		const previousFileEntry = zipWriter.lastFileEntry;
 		let fileEntry = {};
 		let bufferedWrite;
 		let releaseLockWriter;
 		let releaseLockCurrentFileEntry;
 		let writingBufferedEntryData;
 		let writingEntryData;
+		let writerSizeBeforeEntry;
+		let flushedBufferedSize = 0;
 		let fileWriter;
 		files.set(name, fileEntry);
+		zipWriter.lastFileEntry = fileEntry;
 		try {
 			let lockPreviousFileEntry;
 			if (keepOrder) {
 				lockPreviousFileEntry = previousFileEntry && previousFileEntry.lock;
 				requestLockCurrentFileEntry();
 			}
-			if ((options.bufferedWrite || !keepOrder || zipWriter.writerLocked || zipWriter.bufferedWrites || !dataDescriptor) && !usdz) {
+			if (options.bufferedWrite || !keepOrder || zipWriter.writerLocked || zipWriter.bufferedWrites || !dataDescriptor) {
+				bufferedWrite = true;
+				zipWriter.bufferedWrites++;
 				if (options.createTempStream) {
 					fileWriter = await options.createTempStream();
 				} else {
 					fileWriter = new TransformStream(UNDEFINED_VALUE, UNDEFINED_VALUE, { highWaterMark: INFINITY_VALUE });
 				}
 				fileWriter.size = 0;
-				bufferedWrite = true;
-				zipWriter.bufferedWrites++;
 				await initStream(writer);
 			} else {
 				fileWriter = writer;
 				await requestLockWriter();
 			}
 			await initStream(fileWriter);
-			const { writable, diskOffset } = writer;
+			const { diskOffset } = writer;
 			if (zipWriter.addSplitZipSignature) {
 				delete zipWriter.addSplitZipSignature;
 				const signatureArray = new Uint8Array(4);
@@ -4921,21 +5395,20 @@
 				await writeData(writer, signatureArray);
 				zipWriter.offset += 4;
 			}
-			if (usdz) {
+			if (usdz && !bufferedWrite) {
 				appendExtraFieldUSDZ(entryInfo, zipWriter.offset - diskOffset);
 			}
-			const {
-				localHeaderView,
-				localHeaderArray
-			} = headerInfo;
+			const { localHeaderArray } = headerInfo;
 			if (!bufferedWrite) {
 				await lockPreviousFileEntry;
-				await skipDiskIfNeeded(writable);
+				await skipDiskIfNeeded();
 			}
-			const { diskNumber } = writer;
-			fileEntry.diskNumberStart = diskNumber;
+			const diskNumberStart = writer.diskNumber;
+			const entryOffset = getSegmentOffset(zipWriter, writer);
+			fileEntry.diskNumberStart = diskNumberStart;
 			if (!bufferedWrite) {
 				writingEntryData = true;
+				writerSizeBeforeEntry = writer.size;
 				await writeData(fileWriter, localHeaderArray);
 			}
 			fileEntry = await createFileEntry(reader, fileWriter, fileEntry, entryInfo, zipWriter.config, options);
@@ -4948,16 +5421,24 @@
 				await Promise.all([fileWriter.writable.getWriter().close(), lockPreviousFileEntry]);
 				await requestLockWriter();
 				writingBufferedEntryData = true;
+				writerSizeBeforeEntry = writer.size;
+				await skipDiskIfNeeded();
 				fileEntry.diskNumberStart = writer.diskNumber;
-				fileEntry.offset = zipWriter.offset - writer.diskOffset;
-				updateLocalHeader(fileEntry, localHeaderView, options);
-				await skipDiskIfNeeded(writable);
-				await writeData(writer, localHeaderArray);
-				await fileWriter.readable.pipeTo(writable, { preventClose: true, preventAbort: true, signal });
+				fileEntry.offset = getSegmentOffset(zipWriter, writer);
+				if (usdz) {
+					// the padding depends on the entry offset, only known now that the writer is locked
+					const previousMetadataSize = entryInfo.metadataSize;
+					appendExtraFieldUSDZ(entryInfo, zipWriter.offset - writer.diskOffset);
+					fileEntry.size += entryInfo.metadataSize - previousMetadataSize;
+				}
+				updateLocalHeader(fileEntry, headerInfo.localHeaderView, options);
+				await writeData(writer, headerInfo.localHeaderArray);
+				await flushBufferedData(fileWriter.readable, writer, signal, chunkLength => flushedBufferedSize += chunkLength);
 				writer.size += fileWriter.size;
 				writingBufferedEntryData = false;
 			} else {
-				fileEntry.offset = zipWriter.offset - diskOffset;
+				fileEntry.diskNumberStart = diskNumberStart;
+				fileEntry.offset = entryOffset;
 			}
 			zipWriter.offset += fileEntry.size;
 			return fileEntry;
@@ -4971,10 +5452,9 @@
 						// ignored
 					}
 				}
+				zipWriter.offset += writer.size - writerSizeBeforeEntry;
 				if (bufferedWrite) {
-					zipWriter.offset += fileWriter.size;
-				} else {
-					zipWriter.offset = fileWriter.size;
+					zipWriter.offset += flushedBufferedSize;
 				}
 			}
 			files.delete(name);
@@ -5005,10 +5485,10 @@
 			await lockWriter;
 		}
 
-		async function skipDiskIfNeeded(writable) {
+		async function skipDiskIfNeeded() {
 			if (getLength(headerInfo.localHeaderArray) > writer.availableSize) {
 				writer.availableSize = 0;
-				await writeData(writable, new Uint8Array());
+				await writeData(writer, new Uint8Array());
 			}
 		}
 	}
@@ -5149,6 +5629,10 @@
 					uncompressedSize = result.inputSize;
 					signature = result.signature;
 				}
+				if ((!zip64CompressedSize && compressedSize >= MAX_32_BITS) ||
+					(!zip64UncompressedSize && uncompressedSize >= MAX_32_BITS)) {
+					throw new Error(ERR_UNSUPPORTED_FORMAT);
+				}
 			} catch (error) {
 				if (error.outputSize !== UNDEFINED_VALUE) {
 					writer.size += error.outputSize;
@@ -5211,35 +5695,28 @@
 			uncompressedSize
 		} = options;
 		let { version, compressionMethod } = options;
-		const compressed = !directory && (level > 0 || (level === UNDEFINED_VALUE && compressionMethod !== 0));
+		const compressed = !directory && (compressionMethod === UNDEFINED_VALUE
+			? (level === UNDEFINED_VALUE || level > 0)
+			: compressionMethod !== COMPRESSION_METHOD_STORE);
 		let rawLocalExtraFieldZip64;
 		const uncompressedFile = passThrough || !compressed;
-		const zip64ExtraFieldComplete = zip64 && (options.bufferedWrite || ((!zip64UncompressedSize && !zip64CompressedSize) || uncompressedFile));
-		if (zip64) {
-			let rawLocalExtraFieldZip64Length = 4;
-			if (zip64UncompressedSize) {
-				rawLocalExtraFieldZip64Length += 8;
-			}
-			if (zip64CompressedSize) {
-				rawLocalExtraFieldZip64Length += 8;
-			}
-			rawLocalExtraFieldZip64 = new Uint8Array(rawLocalExtraFieldZip64Length);
-			const rawLocalExtraFieldZip64View = getDataView(rawLocalExtraFieldZip64);
-			setUint16(rawLocalExtraFieldZip64View, 0, EXTRAFIELD_TYPE_ZIP64);
-			setUint16(rawLocalExtraFieldZip64View, 2, getLength(rawLocalExtraFieldZip64) - 4);
+		// entries without a data descriptor are always buffered (cf. getFileEntry), so the
+		// zip64 extra field values can be patched into the local header before flushing it
+		const zip64ExtraFieldComplete = zip64 && (options.bufferedWrite || !dataDescriptor || ((!zip64UncompressedSize && !zip64CompressedSize) || uncompressedFile));
+		const writeLocalExtraFieldZip64 = zip64ExtraFieldComplete || (zip64 && dataDescriptor && (zip64UncompressedSize || zip64CompressedSize));
+		if (zip64 && (zip64UncompressedSize || zip64CompressedSize)) {
+			// APPNOTE 4.5.3: the zip64 extra field of a local header must include both the
+			// uncompressed and compressed size fields
+			const length = 4 + 16;
+			const extraFieldZip64 = createRecordWriter(length);
+			extraFieldZip64.uint16(EXTRAFIELD_TYPE_ZIP64);
+			extraFieldZip64.uint16(length - 4);
+			rawLocalExtraFieldZip64 = extraFieldZip64.array;
 			if (zip64ExtraFieldComplete) {
-				const rawLocalExtraFieldZip64View = getDataView(rawLocalExtraFieldZip64);
-				let rawLocalExtraFieldZip64Offset = 4;
-				if (zip64UncompressedSize) {
-					setBigUint64(rawLocalExtraFieldZip64View, rawLocalExtraFieldZip64Offset, BigInt(uncompressedSize));
-					rawLocalExtraFieldZip64Offset += 8;
-				}
-				if (zip64CompressedSize && uncompressedFile) {
-					setBigUint64(rawLocalExtraFieldZip64View, rawLocalExtraFieldZip64Offset, BigInt(uncompressedSize));
-					rawLocalExtraFieldZip64Offset += 8;
-				}
-				if (rawLocalExtraFieldZip64Offset == 4) {
-					rawLocalExtraFieldZip64 = new Uint8Array();
+				extraFieldZip64.uint64(uncompressedSize);
+				if (uncompressedFile) {
+					const encryptionOverhead = encrypted ? (zipCrypto ? 12 : 16 + encryptionStrength * 4) : 0;
+					extraFieldZip64.uint64(passThrough ? 0 : uncompressedSize + encryptionOverhead);
 				}
 			}
 		} else {
@@ -5247,11 +5724,11 @@
 		}
 		let rawExtraFieldAES;
 		if (encrypted && !zipCrypto) {
-			rawExtraFieldAES = new Uint8Array(getLength(EXTRAFIELD_DATA_AES) + 2);
-			const extraFieldAESView = getDataView(rawExtraFieldAES);
-			setUint16(extraFieldAESView, 0, EXTRAFIELD_TYPE_AES);
-			arraySet(rawExtraFieldAES, EXTRAFIELD_DATA_AES, 2);
-			setUint8(extraFieldAESView, 8, encryptionStrength);
+			const extraFieldAES = createRecordWriter(getLength(EXTRAFIELD_DATA_AES) + 2);
+			extraFieldAES.uint16(EXTRAFIELD_TYPE_AES);
+			extraFieldAES.bytes(EXTRAFIELD_DATA_AES);
+			rawExtraFieldAES = extraFieldAES.array;
+			rawExtraFieldAES[8] = encryptionStrength;
 		} else {
 			rawExtraFieldAES = new Uint8Array();
 		}
@@ -5259,33 +5736,38 @@
 		let rawExtraFieldExtendedTimestamp;
 		let extraFieldExtendedTimestampFlag;
 		if (extendedTimestamp) {
-			rawExtraFieldExtendedTimestamp = new Uint8Array(9 + (lastAccessDate ? 4 : 0) + (creationDate ? 4 : 0));
-			const extraFieldExtendedTimestampView = getDataView(rawExtraFieldExtendedTimestamp);
-			setUint16(extraFieldExtendedTimestampView, 0, EXTRAFIELD_TYPE_EXTENDED_TIMESTAMP);
-			setUint16(extraFieldExtendedTimestampView, 2, getLength(rawExtraFieldExtendedTimestamp) - 4);
-			extraFieldExtendedTimestampFlag = 0x1 + (lastAccessDate ? 0x2 : 0) + (creationDate ? 0x4 : 0);
-			setUint8(extraFieldExtendedTimestampView, 4, extraFieldExtendedTimestampFlag);
-			let offset = 5;
-			setUint32(extraFieldExtendedTimestampView, offset, Math.floor(lastModDate.getTime() / 1000));
-			offset += 4;
-			if (lastAccessDate) {
-				setUint32(extraFieldExtendedTimestampView, offset, Math.floor(lastAccessDate.getTime() / 1000));
-				offset += 4;
-			}
-			if (creationDate) {
-				setUint32(extraFieldExtendedTimestampView, offset, Math.floor(creationDate.getTime() / 1000));
+			const lastModTimeUnix = getTimeUnix(lastModDate);
+			if (inUnixTimeRange(lastModTimeUnix)) {
+				const extraFieldTimestampLength = 9 + (lastAccessDate ? 4 : 0) + (creationDate ? 4 : 0);
+				const extraFieldTimestamp = createRecordWriter(extraFieldTimestampLength);
+				extraFieldExtendedTimestampFlag = 0x1 + (lastAccessDate ? 0x2 : 0) + (creationDate ? 0x4 : 0);
+				extraFieldTimestamp.uint16(EXTRAFIELD_TYPE_EXTENDED_TIMESTAMP);
+				extraFieldTimestamp.uint16(extraFieldTimestampLength - 4);
+				extraFieldTimestamp.uint8(extraFieldExtendedTimestampFlag);
+				extraFieldTimestamp.uint32(lastModTimeUnix);
+				if (lastAccessDate) {
+					extraFieldTimestamp.uint32(clampUnixTime(getTimeUnix(lastAccessDate)));
+				}
+				if (creationDate) {
+					extraFieldTimestamp.uint32(clampUnixTime(getTimeUnix(creationDate)));
+				}
+				rawExtraFieldExtendedTimestamp = extraFieldTimestamp.array;
+			} else {
+				// the date cannot be stored as a 32-bit time_t; the NTFS field replaces it
+				rawExtraFieldExtendedTimestamp = new Uint8Array();
 			}
 			try {
-				rawExtraFieldNTFS = new Uint8Array(36);
-				const extraFieldNTFSView = getDataView(rawExtraFieldNTFS);
 				const lastModTimeNTFS = getTimeNTFS(lastModDate);
-				setUint16(extraFieldNTFSView, 0, EXTRAFIELD_TYPE_NTFS);
-				setUint16(extraFieldNTFSView, 2, 32);
-				setUint16(extraFieldNTFSView, 8, EXTRAFIELD_TYPE_NTFS_TAG1);
-				setUint16(extraFieldNTFSView, 10, 24);
-				setBigUint64(extraFieldNTFSView, 12, lastModTimeNTFS);
-				setBigUint64(extraFieldNTFSView, 20, getTimeNTFS(lastAccessDate) || lastModTimeNTFS);
-				setBigUint64(extraFieldNTFSView, 28, getTimeNTFS(creationDate) || lastModTimeNTFS);
+				const extraFieldNTFS = createRecordWriter(36);
+				extraFieldNTFS.uint16(EXTRAFIELD_TYPE_NTFS);
+				extraFieldNTFS.uint16(32);
+				extraFieldNTFS.skip(4);
+				extraFieldNTFS.uint16(EXTRAFIELD_TYPE_NTFS_TAG1);
+				extraFieldNTFS.uint16(24);
+				extraFieldNTFS.uint64(lastModTimeNTFS);
+				extraFieldNTFS.uint64(getTimeNTFS(lastAccessDate) || lastModTimeNTFS);
+				extraFieldNTFS.uint64(getTimeNTFS(creationDate) || lastModTimeNTFS);
+				rawExtraFieldNTFS = extraFieldNTFS.array;
 			} catch {
 				rawExtraFieldNTFS = new Uint8Array();
 			}
@@ -5294,41 +5776,27 @@
 		}
 		let rawExtraFieldUnix;
 		try {
-			const { uid, gid, unixMode, setuid, setgid, sticky, unixExtraFieldType } = options;
-			if (unixExtraFieldType && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE || unixMode !== UNDEFINED_VALUE)) {
+			const { uid, gid, unixExtraFieldType } = options;
+			if (unixExtraFieldType == INFOZIP_EXTRA_FIELD_TYPE && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
 				const uidBytes = packUnixId(uid);
 				const gidBytes = packUnixId(gid);
-				let modeArray = new Uint8Array();
-				if (unixExtraFieldType == UNIX_EXTRA_FIELD_TYPE && unixMode !== UNDEFINED_VALUE) {
-					let modeToWrite = unixMode & MAX_16_BITS;
-					if (setuid) {
-						modeToWrite |= FILE_ATTR_UNIX_SETUID_MASK;
-					}
-					if (setgid) {
-						modeToWrite |= FILE_ATTR_UNIX_SETGID_MASK;
-					}
-					if (sticky) {
-						modeToWrite |= FILE_ATTR_UNIX_STICKY_MASK;
-					}
-					modeArray = new Uint8Array(2);
-					const modeDataView = new DataView(modeArray.buffer);
-					modeDataView.setUint16(0, modeToWrite, true);
-				}
-				const payloadLength = 3 + uidBytes.length + gidBytes.length + modeArray.length;
-				rawExtraFieldUnix = new Uint8Array(4 + payloadLength);
-				const rawExtraFieldUnixView = getDataView(rawExtraFieldUnix);
-				setUint16(rawExtraFieldUnixView, 0, unixExtraFieldType == INFOZIP_EXTRA_FIELD_TYPE ? EXTRAFIELD_TYPE_INFOZIP : EXTRAFIELD_TYPE_UNIX);
-				setUint16(rawExtraFieldUnixView, 2, payloadLength);
-				setUint8(rawExtraFieldUnixView, 4, 1);
-				setUint8(rawExtraFieldUnixView, 5, uidBytes.length);
-				let offset = 6;
-				arraySet(rawExtraFieldUnix, uidBytes, offset);
-				offset += uidBytes.length;
-				setUint8(rawExtraFieldUnixView, offset, gidBytes.length);
-				offset++;
-				arraySet(rawExtraFieldUnix, gidBytes, offset);
-				offset += gidBytes.length;
-				arraySet(rawExtraFieldUnix, modeArray, offset);
+				const payloadLength = 3 + uidBytes.length + gidBytes.length;
+				const extraFieldUnix = createRecordWriter(4 + payloadLength);
+				extraFieldUnix.uint16(EXTRAFIELD_TYPE_INFOZIP);
+				extraFieldUnix.uint16(payloadLength);
+				extraFieldUnix.uint8(1);
+				extraFieldUnix.uint8(uidBytes.length);
+				extraFieldUnix.bytes(uidBytes);
+				extraFieldUnix.uint8(gidBytes.length);
+				extraFieldUnix.bytes(gidBytes);
+				rawExtraFieldUnix = extraFieldUnix.array;
+			} else if (unixExtraFieldType == UNIX_EXTRA_FIELD_TYPE && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
+				const extraFieldUnix = createRecordWriter(8);
+				extraFieldUnix.uint16(EXTRAFIELD_TYPE_UNIX);
+				extraFieldUnix.uint16(4);
+				extraFieldUnix.uint16((uid === UNDEFINED_VALUE ? 0 : uid) & MAX_16_BITS);
+				extraFieldUnix.uint16((gid === UNDEFINED_VALUE ? 0 : gid) & MAX_16_BITS);
+				rawExtraFieldUnix = extraFieldUnix.array;
 			} else {
 				rawExtraFieldUnix = new Uint8Array();
 			}
@@ -5346,8 +5814,11 @@
 			rawExtraFieldAES[9] = compressionMethod;
 			compressionMethod = COMPRESSION_METHOD_AES;
 		}
-		const localExtraFieldZip64Length = zip64ExtraFieldComplete ? getLength(rawLocalExtraFieldZip64) : 0;
+		const localExtraFieldZip64Length = writeLocalExtraFieldZip64 ? getLength(rawLocalExtraFieldZip64) : 0;
 		const extraFieldLength = localExtraFieldZip64Length + getLength(rawExtraFieldAES, rawExtraFieldExtendedTimestamp, rawExtraFieldNTFS, rawExtraFieldUnix, rawExtraField);
+		if (extraFieldLength > MAX_16_BITS) {
+			throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
+		}
 		const {
 			headerArray,
 			headerView,
@@ -5363,29 +5834,27 @@
 			zip64UncompressedSize,
 			extraFieldLength
 		});
-		let localHeaderOffset = HEADER_SIZE;
-		const localHeaderArray = new Uint8Array(localHeaderOffset + getLength(rawFilename) + extraFieldLength);
+		const localHeader = createRecordWriter(HEADER_SIZE + getLength(rawFilename) + extraFieldLength);
+		const localHeaderArray = localHeader.array;
 		const localHeaderView = getDataView(localHeaderArray);
-		setUint32(localHeaderView, 0, LOCAL_FILE_HEADER_SIGNATURE);
-		arraySet(localHeaderArray, headerArray, 4);
-		arraySet(localHeaderArray, rawFilename, localHeaderOffset);
-		localHeaderOffset += getLength(rawFilename);
-		if (zip64ExtraFieldComplete) {
-			arraySet(localHeaderArray, rawLocalExtraFieldZip64, localHeaderOffset);
-		}
-		localHeaderOffset += localExtraFieldZip64Length;
-		arraySet(localHeaderArray, rawExtraFieldAES, localHeaderOffset);
-		localHeaderOffset += getLength(rawExtraFieldAES);
-		arraySet(localHeaderArray, rawExtraFieldExtendedTimestamp, localHeaderOffset);
-		localHeaderOffset += getLength(rawExtraFieldExtendedTimestamp);
-		arraySet(localHeaderArray, rawExtraFieldNTFS, localHeaderOffset);
-		localHeaderOffset += getLength(rawExtraFieldNTFS);
-		arraySet(localHeaderArray, rawExtraFieldUnix, localHeaderOffset);
-		localHeaderOffset += getLength(rawExtraFieldUnix);
-		arraySet(localHeaderArray, rawExtraField, localHeaderOffset);
+		localHeader.uint32(LOCAL_FILE_HEADER_SIGNATURE);
+		localHeader.bytes(headerArray);
+		localHeader.bytes(rawFilename);
+		if (writeLocalExtraFieldZip64) {
+			localHeader.bytes(rawLocalExtraFieldZip64);
+		}
+		localHeader.bytes(rawExtraFieldAES);
+		localHeader.bytes(rawExtraFieldExtendedTimestamp);
+		localHeader.bytes(rawExtraFieldNTFS);
+		localHeader.bytes(rawExtraFieldUnix);
+		localHeader.bytes(rawExtraField);
 		if (dataDescriptor) {
-			setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + 4, 0);
-			setUint32(localHeaderView, HEADER_OFFSET_UNCOMPRESSED_SIZE + 4, 0);
+			if (!zip64CompressedSize) {
+				setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, 0);
+			}
+			if (!zip64UncompressedSize) {
+				setUint32(localHeaderView, HEADER_OFFSET_UNCOMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, 0);
+			}
 		}
 		return {
 			localHeaderArray,
@@ -5412,7 +5881,7 @@
 	function appendExtraFieldUSDZ(entryInfo, zipWriterOffset) {
 		const { headerInfo } = entryInfo;
 		let { localHeaderArray, extraFieldLength } = headerInfo;
-		let localHeaderArrayView = getDataView(localHeaderArray);
+		let localHeaderArrayView;
 		let extraBytesLength = 64 - ((zipWriterOffset + getLength(localHeaderArray)) % 64);
 		if (extraBytesLength < 4) {
 			extraBytesLength += 64;
@@ -5420,13 +5889,14 @@
 		const rawExtraFieldUSDZ = new Uint8Array(extraBytesLength);
 		const extraFieldUSDZView = getDataView(rawExtraFieldUSDZ);
 		setUint16(extraFieldUSDZView, 0, EXTRAFIELD_TYPE_USDZ);
-		setUint16(extraFieldUSDZView, 2, extraBytesLength - 2);
+		setUint16(extraFieldUSDZView, 2, extraBytesLength - 4);
 		const previousLocalHeaderArray = localHeaderArray;
 		headerInfo.localHeaderArray = localHeaderArray = new Uint8Array(getLength(previousLocalHeaderArray) + extraBytesLength);
 		arraySet(localHeaderArray, previousLocalHeaderArray);
 		arraySet(localHeaderArray, rawExtraFieldUSDZ, getLength(previousLocalHeaderArray));
 		localHeaderArrayView = getDataView(localHeaderArray);
 		setUint16(localHeaderArrayView, 28, extraFieldLength + extraBytesLength);
+		headerInfo.localHeaderView = localHeaderArrayView;
 		entryInfo.metadataSize += extraBytesLength;
 	}
 
@@ -5549,37 +6019,32 @@
 	}, localHeaderView, { dataDescriptor }) {
 		if (!dataDescriptor) {
 			if (!encrypted) {
-				setUint32(localHeaderView, HEADER_OFFSET_SIGNATURE + 4, signature);
+				setUint32(localHeaderView, HEADER_OFFSET_SIGNATURE + LOCAL_HEADER_COMMON_OFFSET, signature);
 			}
 			if (!zip64CompressedSize) {
-				setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + 4, compressedSize);
+				setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, compressedSize);
 			}
 			if (!zip64UncompressedSize) {
-				setUint32(localHeaderView, HEADER_OFFSET_UNCOMPRESSED_SIZE + 4, uncompressedSize);
+				setUint32(localHeaderView, HEADER_OFFSET_UNCOMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, uncompressedSize);
 			}
 		}
 		if (zip64 && localExtraFieldZip64Length) {
-			let localHeaderOffset = HEADER_SIZE + getLength(rawFilename) + 4;
-			if (zip64UncompressedSize) {
-				setBigUint64(localHeaderView, localHeaderOffset, BigInt(uncompressedSize));
-				localHeaderOffset += 8;
-			}
-			if (zip64CompressedSize) {
-				setBigUint64(localHeaderView, localHeaderOffset, BigInt(compressedSize));
-				localHeaderOffset += 8;
-			}
+			// the local zip64 extra field always contains both size slots
+			const localHeaderOffset = HEADER_SIZE + getLength(rawFilename) + 4;
+			setBigUint64(localHeaderView, localHeaderOffset, BigInt(uncompressedSize));
+			setBigUint64(localHeaderView, localHeaderOffset + 8, BigInt(compressedSize));
 		}
 	}
 
 
 	async function closeFile(zipWriter, comment, options) {
-		const { files, writer } = zipWriter;
-		const { diskOffset } = writer;
-		let { diskNumber } = writer;
-		let offset = 0;
+		const directoryDataLength = createDirectoryRecords(zipWriter.files);
+		const { cdStartDiskNumber, cdStartDiskOffset } = await writeDirectoryRecords(zipWriter, directoryDataLength, options);
+		await writeEndOfDirectoryRecord(zipWriter, comment, options, { cdStartDiskNumber, cdStartDiskOffset, directoryDataLength });
+	}
+
+	function createDirectoryRecords(files) {
 		let directoryDataLength = 0;
-		let directoryOffset = zipWriter.offset - diskOffset;
-		let filesLength = files.size;
 		for (const [, fileEntry] of files) {
 			const {
 				rawFilename,
@@ -5596,24 +6061,27 @@
 				uncompressedSize,
 				compressedSize
 			} = fileEntry;
-			const zip64Offset = fileEntry.offset > MAX_32_BITS;
-			const zip64DiskNumberStart = fileEntry.diskNumberStart > MAX_16_BITS;
+			const zip64Offset = fileEntry.offset >= MAX_32_BITS;
+			const zip64DiskNumberStart = fileEntry.diskNumberStart >= MAX_16_BITS;
 			let rawExtraFieldZip64;
 			if (zip64Offset || zip64DiskNumberStart || zip64UncompressedSize || zip64CompressedSize) {
-				let length = 4;
-				if (zip64UncompressedSize) length += 8;
-				if (zip64CompressedSize) length += 8;
-				if (zip64Offset) length += 8;
-				if (zip64DiskNumberStart) length += 4;
-				rawExtraFieldZip64 = new Uint8Array(length);
-				const zip64View = getDataView(rawExtraFieldZip64);
-				setUint16(zip64View, 0, EXTRAFIELD_TYPE_ZIP64);
-				setUint16(zip64View, 2, length - 4);
-				let zip64FieldOffset = 4;
-				if (zip64UncompressedSize) { setBigUint64(zip64View, zip64FieldOffset, BigInt(uncompressedSize)); zip64FieldOffset += 8; }
-				if (zip64CompressedSize) { setBigUint64(zip64View, zip64FieldOffset, BigInt(compressedSize)); zip64FieldOffset += 8; }
-				if (zip64Offset) { setBigUint64(zip64View, zip64FieldOffset, BigInt(fileEntry.offset)); zip64FieldOffset += 8; }
-				if (zip64DiskNumberStart) { setUint32(zip64View, zip64FieldOffset, fileEntry.diskNumberStart); }
+				const length = 4 + (zip64UncompressedSize ? 8 : 0) + (zip64CompressedSize ? 8 : 0) + (zip64Offset ? 8 : 0) + (zip64DiskNumberStart ? 4 : 0);
+				const extraFieldZip64 = createRecordWriter(length);
+				extraFieldZip64.uint16(EXTRAFIELD_TYPE_ZIP64);
+				extraFieldZip64.uint16(length - 4);
+				if (zip64UncompressedSize) {
+					extraFieldZip64.uint64(uncompressedSize);
+				}
+				if (zip64CompressedSize) {
+					extraFieldZip64.uint64(compressedSize);
+				}
+				if (zip64Offset) {
+					extraFieldZip64.uint64(fileEntry.offset);
+				}
+				if (zip64DiskNumberStart) {
+					extraFieldZip64.uint32(fileEntry.diskNumberStart);
+				}
+				rawExtraFieldZip64 = extraFieldZip64.array;
 			} else {
 				rawExtraFieldZip64 = new Uint8Array();
 			}
@@ -5621,32 +6089,41 @@
 			fileEntry.zip64Offset = zip64Offset;
 			fileEntry.zip64DiskNumberStart = zip64DiskNumberStart;
 			let rawExtraFieldTimestamp;
-			if (extendedTimestamp) {
-				rawExtraFieldTimestamp = new Uint8Array(9);
-				const extraFieldExtendedTimestampView = getDataView(rawExtraFieldTimestamp);
-				setUint16(extraFieldExtendedTimestampView, 0, EXTRAFIELD_TYPE_EXTENDED_TIMESTAMP);
-				setUint16(extraFieldExtendedTimestampView, 2, 5);
-				setUint8(extraFieldExtendedTimestampView, 4, extraFieldExtendedTimestampFlag);
-				setUint32(extraFieldExtendedTimestampView, 5, Math.floor(lastModDate.getTime() / 1000));
+			const lastModTimeUnix = getTimeUnix(lastModDate);
+			if (extendedTimestamp && inUnixTimeRange(lastModTimeUnix)) {
+				const extraFieldTimestamp = createRecordWriter(9);
+				extraFieldTimestamp.uint16(EXTRAFIELD_TYPE_EXTENDED_TIMESTAMP);
+				extraFieldTimestamp.uint16(5);
+				extraFieldTimestamp.uint8(extraFieldExtendedTimestampFlag);
+				extraFieldTimestamp.uint32(lastModTimeUnix);
+				rawExtraFieldTimestamp = extraFieldTimestamp.array;
 			} else {
 				rawExtraFieldTimestamp = new Uint8Array();
 			}
 			fileEntry.rawExtraFieldExtendedTimestamp = rawExtraFieldTimestamp;
-			directoryDataLength += 46 +
-				getLength(
-					rawFilename,
-					rawComment,
-					rawExtraFieldZip64,
-					rawExtraFieldAES,
-					rawExtraFieldNTFS,
-					rawExtraFieldUnix,
-					rawExtraFieldTimestamp,
-					rawExtraField);
+			const extraFieldLength = getLength(
+				rawExtraFieldZip64,
+				rawExtraFieldAES,
+				rawExtraFieldNTFS,
+				rawExtraFieldUnix,
+				rawExtraFieldTimestamp,
+				rawExtraField);
+			if (extraFieldLength > MAX_16_BITS) {
+				throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
+			}
+			directoryDataLength += CENTRAL_FILE_HEADER_LENGTH + getLength(rawFilename, rawComment) + extraFieldLength;
 		}
+		return directoryDataLength;
+	}
+
+	async function writeDirectoryRecords(zipWriter, directoryDataLength, options) {
+		const { files, writer } = zipWriter;
 		const directoryArray = new Uint8Array(directoryDataLength);
-		const directoryView = getDataView(directoryArray);
 		await initStream(writer);
+		let offset = 0;
 		let directoryDiskOffset = 0;
+		let cdStartDiskNumber = writer.diskNumber;
+		let cdStartDiskOffset = writer.diskOffset;
 		for (const [indexFileEntry, fileEntry] of Array.from(files.values()).entries()) {
 			const {
 				offset: fileEntryOffset,
@@ -5672,52 +6149,46 @@
 				compressedSize
 			} = fileEntry;
 			const extraFieldLength = getLength(rawExtraFieldZip64, rawExtraFieldAES, rawExtraFieldExtendedTimestamp, rawExtraFieldNTFS, rawExtraFieldUnix, rawExtraField);
-			setUint32(directoryView, offset, CENTRAL_FILE_HEADER_SIGNATURE);
-			setUint16(directoryView, offset + 4, versionMadeBy);
+			const directoryRecordLength = CENTRAL_FILE_HEADER_LENGTH + getLength(rawFilename, rawComment) + extraFieldLength;
+			if (offset + directoryRecordLength - directoryDiskOffset > writer.availableSize) {
+				await writeData(writer, directoryArray.slice(directoryDiskOffset, offset));
+				directoryDiskOffset = offset;
+				writer.availableSize = 0;
+				await writeData(writer, new Uint8Array());
+			}
+			if (indexFileEntry == 0) {
+				cdStartDiskNumber = writer.diskNumber;
+				cdStartDiskOffset = writer.diskOffset;
+			}
 			if (!zip64UncompressedSize) {
 				setUint32(headerView, HEADER_OFFSET_UNCOMPRESSED_SIZE, uncompressedSize);
 			}
 			if (!zip64CompressedSize) {
 				setUint32(headerView, HEADER_OFFSET_COMPRESSED_SIZE, compressedSize);
 			}
-			arraySet(directoryArray, headerArray, offset + 6);
-			let directoryOffset = offset + HEADER_SIZE;
-			setUint16(directoryView, directoryOffset, extraFieldLength);
-			directoryOffset += 2;
-			setUint16(directoryView, directoryOffset, getLength(rawComment));
-			directoryOffset += 2;
-			setUint16(directoryView, directoryOffset, zip64DiskNumberStart ? MAX_16_BITS : diskNumberStart);
-			directoryOffset += 2;
-			setUint16(directoryView, directoryOffset, internalFileAttributes);
-			directoryOffset += 2;
-			if (externalFileAttributes) {
-				setUint32(directoryView, directoryOffset, externalFileAttributes);
-			}
-			directoryOffset += 4;
-			setUint32(directoryView, directoryOffset, zip64Offset ? MAX_32_BITS : fileEntryOffset);
-			directoryOffset += 4;
-			arraySet(directoryArray, rawFilename, directoryOffset);
-			directoryOffset += getLength(rawFilename);
-			arraySet(directoryArray, rawExtraFieldZip64, directoryOffset);
-			directoryOffset += getLength(rawExtraFieldZip64);
-			arraySet(directoryArray, rawExtraFieldAES, directoryOffset);
-			directoryOffset += getLength(rawExtraFieldAES);
-			arraySet(directoryArray, rawExtraFieldExtendedTimestamp, directoryOffset);
-			directoryOffset += getLength(rawExtraFieldExtendedTimestamp);
-			arraySet(directoryArray, rawExtraFieldNTFS, directoryOffset);
-			directoryOffset += getLength(rawExtraFieldNTFS);
-			arraySet(directoryArray, rawExtraFieldUnix, directoryOffset);
-			directoryOffset += getLength(rawExtraFieldUnix);
-			arraySet(directoryArray, rawExtraField, directoryOffset);
-			directoryOffset += getLength(rawExtraField);
-			arraySet(directoryArray, rawComment, directoryOffset);
-			directoryOffset += getLength(rawComment);
-			if (offset - directoryDiskOffset > writer.availableSize) {
-				writer.availableSize = 0;
-				await writeData(writer, directoryArray.slice(directoryDiskOffset, offset));
-				directoryDiskOffset = offset;
-			}
-			offset = directoryOffset;
+			if ((zip64Offset || zip64DiskNumberStart) && fileEntry.version < VERSION_ZIP64) {
+				setUint16(headerView, HEADER_OFFSET_VERSION, VERSION_ZIP64);
+			}
+			const directoryRecord = createRecordWriter(directoryRecordLength);
+			directoryRecord.uint32(CENTRAL_FILE_HEADER_SIGNATURE);
+			directoryRecord.uint16(versionMadeBy);
+			directoryRecord.bytes(headerArray.subarray(0, HEADER_SIZE - 4 - 2));
+			directoryRecord.uint16(extraFieldLength);
+			directoryRecord.uint16(getLength(rawComment));
+			directoryRecord.uint16(zip64DiskNumberStart ? MAX_16_BITS : diskNumberStart);
+			directoryRecord.uint16(internalFileAttributes);
+			directoryRecord.uint32(externalFileAttributes);
+			directoryRecord.uint32(zip64Offset ? MAX_32_BITS : fileEntryOffset);
+			directoryRecord.bytes(rawFilename);
+			directoryRecord.bytes(rawExtraFieldZip64);
+			directoryRecord.bytes(rawExtraFieldAES);
+			directoryRecord.bytes(rawExtraFieldExtendedTimestamp);
+			directoryRecord.bytes(rawExtraFieldNTFS);
+			directoryRecord.bytes(rawExtraFieldUnix);
+			directoryRecord.bytes(rawExtraField);
+			directoryRecord.bytes(rawComment);
+			arraySet(directoryArray, directoryRecord.array, offset);
+			offset += directoryRecordLength;
 			if (options.onprogress) {
 				try {
 					await options.onprogress(indexFileEntry + 1, files.size, new Entry(fileEntry));
@@ -5727,36 +6198,53 @@
 			}
 		}
 		await writeData(writer, directoryDiskOffset ? directoryArray.slice(directoryDiskOffset) : directoryArray);
+		return { cdStartDiskNumber, cdStartDiskOffset };
+	}
+
+	async function writeEndOfDirectoryRecord(zipWriter, comment, options, cdInfo) {
+		const { writer } = zipWriter;
+		const { cdStartDiskNumber, cdStartDiskOffset } = cdInfo;
+		let { directoryDataLength } = cdInfo;
+		let filesLength = zipWriter.files.size;
+		let diskNumber = cdStartDiskNumber;
+		let directoryOffset = zipWriter.offset - cdStartDiskOffset - (cdStartDiskNumber ? zipWriter.initialOffset : 0);
 		let lastDiskNumber = writer.diskNumber;
-		const { availableSize } = writer;
-		if (availableSize < END_OF_CENTRAL_DIR_LENGTH) {
+		if (writer.availableSize < END_OF_CENTRAL_DIR_LENGTH) {
 			lastDiskNumber++;
 		}
 		let zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-		if (directoryOffset > MAX_32_BITS || directoryDataLength > MAX_32_BITS || filesLength > MAX_16_BITS || lastDiskNumber > MAX_16_BITS) {
+		if (directoryOffset >= MAX_32_BITS || directoryDataLength >= MAX_32_BITS || filesLength >= MAX_16_BITS || lastDiskNumber >= MAX_16_BITS) {
 			if (zip64 === false) {
 				throw new Error(ERR_UNSUPPORTED_FORMAT);
 			} else {
 				zip64 = true;
 			}
 		}
-		const endOfdirectoryArray = new Uint8Array(zip64 ? ZIP64_END_OF_CENTRAL_DIR_TOTAL_LENGTH : END_OF_CENTRAL_DIR_LENGTH);
-		const endOfdirectoryView = getDataView(endOfdirectoryArray);
-		offset = 0;
+		const commentLength = getLength(comment);
+		if (commentLength > MAX_16_BITS) {
+			throw new Error(ERR_INVALID_COMMENT);
+		}
+		const endOfdirectoryRecord = createRecordWriter(zip64 ? ZIP64_END_OF_CENTRAL_DIR_TOTAL_LENGTH : END_OF_CENTRAL_DIR_LENGTH);
+		if (getLength(endOfdirectoryRecord.array) + commentLength > writer.availableSize) {
+			writer.availableSize = 0;
+			await writeData(writer, new Uint8Array());
+		}
+		lastDiskNumber = writer.diskNumber;
 		if (zip64) {
-			setUint32(endOfdirectoryView, 0, ZIP64_END_OF_CENTRAL_DIR_SIGNATURE);
-			setBigUint64(endOfdirectoryView, 4, BigInt(44));
-			setUint16(endOfdirectoryView, 12, 45);
-			setUint16(endOfdirectoryView, 14, 45);
-			setUint32(endOfdirectoryView, 16, lastDiskNumber);
-			setUint32(endOfdirectoryView, 20, diskNumber);
-			setBigUint64(endOfdirectoryView, 24, BigInt(filesLength));
-			setBigUint64(endOfdirectoryView, 32, BigInt(filesLength));
-			setBigUint64(endOfdirectoryView, 40, BigInt(directoryDataLength));
-			setBigUint64(endOfdirectoryView, 48, BigInt(directoryOffset));
-			setUint32(endOfdirectoryView, 56, ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE);
-			setBigUint64(endOfdirectoryView, 64, BigInt(directoryOffset) + BigInt(directoryDataLength));
-			setUint32(endOfdirectoryView, 72, lastDiskNumber + 1);
+			endOfdirectoryRecord.uint32(ZIP64_END_OF_CENTRAL_DIR_SIGNATURE);
+			endOfdirectoryRecord.uint64(44);
+			endOfdirectoryRecord.uint16(45);
+			endOfdirectoryRecord.uint16(45);
+			endOfdirectoryRecord.uint32(lastDiskNumber);
+			endOfdirectoryRecord.uint32(diskNumber);
+			endOfdirectoryRecord.uint64(filesLength);
+			endOfdirectoryRecord.uint64(filesLength);
+			endOfdirectoryRecord.uint64(directoryDataLength);
+			endOfdirectoryRecord.uint64(directoryOffset);
+			endOfdirectoryRecord.uint32(ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE);
+			endOfdirectoryRecord.uint32(lastDiskNumber);
+			endOfdirectoryRecord.uint64(BigInt(zipWriter.offset) + BigInt(directoryDataLength) - BigInt(writer.diskOffset) - BigInt(writer.diskNumber ? zipWriter.initialOffset : 0));
+			endOfdirectoryRecord.uint32(lastDiskNumber + 1);
 			const supportZip64SplitFile = getOptionValue(zipWriter, options, OPTION_SUPPORT_ZIP64_SPLIT_FILE, true);
 			if (supportZip64SplitFile) {
 				lastDiskNumber = MAX_16_BITS;
@@ -5765,29 +6253,40 @@
 			filesLength = MAX_16_BITS;
 			directoryOffset = MAX_32_BITS;
 			directoryDataLength = MAX_32_BITS;
-			offset += ZIP64_END_OF_CENTRAL_DIR_LENGTH + ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH;
-		}
-		setUint32(endOfdirectoryView, offset, END_OF_CENTRAL_DIR_SIGNATURE);
-		setUint16(endOfdirectoryView, offset + 4, lastDiskNumber);
-		setUint16(endOfdirectoryView, offset + 6, diskNumber);
-		setUint16(endOfdirectoryView, offset + 8, filesLength);
-		setUint16(endOfdirectoryView, offset + 10, filesLength);
-		setUint32(endOfdirectoryView, offset + 12, directoryDataLength);
-		setUint32(endOfdirectoryView, offset + 16, directoryOffset);
-		const commentLength = getLength(comment);
-		if (commentLength) {
-			if (commentLength <= MAX_16_BITS) {
-				setUint16(endOfdirectoryView, offset + 20, commentLength);
-			} else {
-				throw new Error(ERR_INVALID_COMMENT);
-			}
 		}
-		await writeData(writer, endOfdirectoryArray);
+		endOfdirectoryRecord.uint32(END_OF_CENTRAL_DIR_SIGNATURE);
+		endOfdirectoryRecord.uint16(lastDiskNumber);
+		endOfdirectoryRecord.uint16(diskNumber);
+		endOfdirectoryRecord.uint16(filesLength);
+		endOfdirectoryRecord.uint16(filesLength);
+		endOfdirectoryRecord.uint32(directoryDataLength);
+		endOfdirectoryRecord.uint32(directoryOffset);
+		endOfdirectoryRecord.uint16(commentLength);
+		await writeData(writer, endOfdirectoryRecord.array);
 		if (commentLength) {
 			await writeData(writer, comment);
 		}
 	}
 
+	function createRecordWriter(length) {
+		const array = new Uint8Array(length);
+		const view = getDataView(array);
+		let offset = 0;
+		return {
+			array,
+			uint8: value => { setUint8(view, offset, value); offset += 1; },
+			uint16: value => { setUint16(view, offset, value); offset += 2; },
+			uint32: value => { setUint32(view, offset, value); offset += 4; },
+			uint64: value => { setBigUint64(view, offset, BigInt(value)); offset += 8; },
+			bytes: value => { arraySet(array, value, offset); offset += getLength(value); },
+			skip: count => offset += count
+		};
+	}
+
+	function getSegmentOffset(zipWriter, writer) {
+		return zipWriter.offset - writer.diskOffset - (writer.diskNumber ? zipWriter.initialOffset : 0);
+	}
+
 	async function writeData(writer, array) {
 		const { writable } = writer;
 		const streamWriter = writable.getWriter();
@@ -5800,12 +6299,40 @@
 		}
 	}
 
+	async function flushBufferedData(readable, writer, signal, onChunkWritten) {
+		const streamWriter = writer.writable.getWriter();
+		try {
+			await readable.pipeTo(new WritableStream({
+				async write(chunk) {
+					await streamWriter.ready;
+					await streamWriter.write(chunk);
+					onChunkWritten(getLength(chunk));
+				}
+			}), { preventClose: true, preventAbort: true, signal });
+		} finally {
+			streamWriter.releaseLock();
+		}
+	}
+
 	function getTimeNTFS(date) {
 		if (date) {
 			return ((BigInt(date.getTime()) + BigInt(11644473600000)) * BigInt(10000));
 		}
 	}
 
+	function getTimeUnix(date) {
+		return Math.floor(date.getTime() / 1000);
+	}
+
+	// the extended timestamp extra field stores dates as signed 32-bit time_t values
+	function inUnixTimeRange(timeUnix) {
+		return timeUnix >= MIN_UNIX_TIME && timeUnix <= MAX_UNIX_TIME;
+	}
+
+	function clampUnixTime(timeUnix) {
+		return Math.min(MAX_UNIX_TIME, Math.max(MIN_UNIX_TIME, timeUnix));
+	}
+
 	function getOptionValue(zipWriter, options, name, defaultValue) {
 		const result = options[name] === UNDEFINED_VALUE ? zipWriter.options[name] : options[name];
 		return result === UNDEFINED_VALUE ? defaultValue : result;
@@ -5836,7 +6363,7 @@
 	}
 
 	function getDataView(array) {
-		return new DataView(array.buffer);
+		return new DataView(array.buffer, array.byteOffset, array.byteLength);
 	}
 
 	function getLength(...arrayLikes) {
@@ -5852,30 +6379,39 @@
 		uncompressedSize,
 		compressedSize,
 		lastModDate,
+		rawLastModDate,
 		rawFilename,
 		zip64CompressedSize,
 		zip64UncompressedSize,
 		extraFieldLength
 	}) {
-		const headerArray = new Uint8Array(HEADER_SIZE - 4);
+		const headerRecord = createRecordWriter(HEADER_SIZE - 4);
+		const headerArray = headerRecord.array;
 		const headerView = getDataView(headerArray);
-		setUint16(headerView, 0, version);
-		setUint16(headerView, 2, bitFlag);
-		setUint16(headerView, 4, compressionMethod);
-		const dateArray = new Uint32Array(1);
-		const dateView = getDataView(dateArray);
-		setUint16(dateView, 0, (((lastModDate.getHours() << 6) | lastModDate.getMinutes()) << 5) | lastModDate.getSeconds() / 2);
-		setUint16(dateView, 2, ((((lastModDate.getFullYear() - 1980) << 4) | (lastModDate.getMonth() + 1)) << 5) | lastModDate.getDate());
-		const rawLastModDate = dateArray[0];
-		setUint32(headerView, 6, rawLastModDate);
+		headerRecord.uint16(version);
+		headerRecord.uint16(bitFlag);
+		headerRecord.uint16(compressionMethod);
+		if (rawLastModDate === UNDEFINED_VALUE) {
+			const dateArray = new Uint32Array(1);
+			const dateView = getDataView(dateArray);
+			setUint16(dateView, 0, (((lastModDate.getHours() << 6) | lastModDate.getMinutes()) << 5) | lastModDate.getSeconds() / 2);
+			setUint16(dateView, 2, ((((lastModDate.getFullYear() - 1980) << 4) | (lastModDate.getMonth() + 1)) << 5) | lastModDate.getDate());
+			rawLastModDate = dateArray[0];
+		}
+		headerRecord.uint32(rawLastModDate);
+		headerRecord.skip(4);
 		if (zip64CompressedSize || compressedSize !== UNDEFINED_VALUE) {
-			setUint32(headerView, HEADER_OFFSET_COMPRESSED_SIZE, zip64CompressedSize ? MAX_32_BITS : compressedSize);
+			headerRecord.uint32(zip64CompressedSize ? MAX_32_BITS : compressedSize);
+		} else {
+			headerRecord.skip(4);
 		}
 		if (zip64UncompressedSize || uncompressedSize !== UNDEFINED_VALUE) {
-			setUint32(headerView, HEADER_OFFSET_UNCOMPRESSED_SIZE, zip64UncompressedSize ? MAX_32_BITS : uncompressedSize);
+			headerRecord.uint32(zip64UncompressedSize ? MAX_32_BITS : uncompressedSize);
+		} else {
+			headerRecord.skip(4);
 		}
-		setUint16(headerView, 22, getLength(rawFilename));
-		setUint16(headerView, 24, extraFieldLength);
+		headerRecord.uint16(getLength(rawFilename));
+		headerRecord.uint16(extraFieldLength);
 		return {
 			headerArray,
 			headerView,
@@ -5980,6 +6516,7 @@
 	exports.BlobWriter = BlobWriter;
 	exports.Data64URIReader = Data64URIReader;
 	exports.Data64URIWriter = Data64URIWriter;
+	exports.ERR_AMBIGUOUS_ARCHIVE = ERR_AMBIGUOUS_ARCHIVE;
 	exports.ERR_BAD_FORMAT = ERR_BAD_FORMAT;
 	exports.ERR_CENTRAL_DIRECTORY_NOT_FOUND = ERR_CENTRAL_DIRECTORY_NOT_FOUND;
 	exports.ERR_DUPLICATED_NAME = ERR_DUPLICATED_NAME;
@@ -5989,6 +6526,7 @@
 	exports.ERR_EXTRAFIELD_ZIP64_NOT_FOUND = ERR_EXTRAFIELD_ZIP64_NOT_FOUND;
 	exports.ERR_HTTP_RANGE = ERR_HTTP_RANGE;
 	exports.ERR_INVALID_COMMENT = ERR_INVALID_COMMENT;
+	exports.ERR_INVALID_COMPRESSED_DATA = ERR_INVALID_COMPRESSED_DATA;
 	exports.ERR_INVALID_ENCRYPTION_STRENGTH = ERR_INVALID_ENCRYPTION_STRENGTH;
 	exports.ERR_INVALID_ENTRY_COMMENT = ERR_INVALID_ENTRY_COMMENT;
 	exports.ERR_INVALID_ENTRY_NAME = ERR_INVALID_ENTRY_NAME;
@@ -6001,8 +6539,9 @@
 	exports.ERR_LOCAL_FILE_HEADER_NOT_FOUND = ERR_LOCAL_FILE_HEADER_NOT_FOUND;
 	exports.ERR_OVERLAPPING_ENTRY = ERR_OVERLAPPING_ENTRY;
 	exports.ERR_SPLIT_ZIP_FILE = ERR_SPLIT_ZIP_FILE;
+	exports.ERR_UNDEFINED_READER = ERR_UNDEFINED_READER;
 	exports.ERR_UNDEFINED_UNCOMPRESSED_SIZE = ERR_UNDEFINED_UNCOMPRESSED_SIZE;
-	exports.ERR_UNSUPPORTED_COMPRESSION = ERR_UNSUPPORTED_COMPRESSION;
+	exports.ERR_UNSUPPORTED_COMPRESSION = ERR_UNSUPPORTED_COMPRESSION$1;
 	exports.ERR_UNSUPPORTED_ENCRYPTION = ERR_UNSUPPORTED_ENCRYPTION;
 	exports.ERR_UNSUPPORTED_FORMAT = ERR_UNSUPPORTED_FORMAT;
 	exports.ERR_ZIP_NOT_EMPTY = ERR_ZIP_NOT_EMPTY;