@zip.js/zip.js 2.8.29 → 2.8.30

package/dist/zip-core.js

@@ -239,18 +239,30 @@
 	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 	 */
 
-	const table = [];
-	for (let i = 0; i < 256; i++) {
-		let t = i;
+	// Slicing-by-8 CRC-32 (Intel / zlib). The eight 256-entry tables let the inner loop
+	// consume 8 bytes per iteration with a shorter dependency chain, ~4x the byte-at-a-time
+	// rate (measured ~320 -> ~1400 MB/s on 64KB chunks).
+	//
+	// Every table MUST stay a PACKED_SMI array: build with array literals (not `new Array(n)`,
+	// which is HOLEY) and store the signed int32 XOR result (no `>>> 0`). An unsigned or holey
+	// table becomes a V8 FixedDoubleArray whose every hot-loop lookup unboxes a double (~1.6x
+	// slower). Signedness is irrelevant to the result — the reads mask/shift it and the final
+	// `~crc` normalizes it. Do NOT reintroduce `>>> 0` here or switch to `new Array(256)`.
+	const T = [[], [], [], [], [], [], [], []];
+	for (let n = 0; n < 256; n++) {
+		let t = n;
 		for (let j = 0; j < 8; j++) {
-			if (t & 1) {
-				t = (t >>> 1) ^ 0xEDB88320;
-			} else {
-				t = t >>> 1;
-			}
+			t = (t & 1) ? (t >>> 1) ^ 0xEDB88320 : t >>> 1;
 		}
-		table[i] = t;
+		T[0][n] = t;
 	}
+	for (let n = 0; n < 256; n++) {
+		for (let k = 1; k < 8; k++) {
+			const previous = T[k - 1][n];
+			T[k][n] = (previous >>> 8) ^ T[0][previous & 0xFF];
+		}
+	}
+	const [T0, T1, T2, T3, T4, T5, T6, T7] = T;
 
 	class Crc32 {
 
@@ -260,8 +272,24 @@
 
 		append(data) {
 			let crc = this.crc | 0;
-			for (let offset = 0, length = data.length | 0; offset < length; offset++) {
-				crc = (crc >>> 8) ^ table[(crc ^ data[offset]) & 0xFF];
+			const length = data.length | 0;
+			let offset = 0;
+			// Process 8 bytes per iteration over the typed-array body. DataView.getInt32(le)
+			// reads an unaligned little-endian word as a signed int32 (no double boxing), so no
+			// alignment or endianness handling is needed; data.buffer guards non-typed inputs.
+			if (length >= 8 && data.buffer) {
+				const view = new DataView(data.buffer, data.byteOffset, length);
+				const end = length - 8;
+				for (; offset <= end; offset += 8) {
+					const a = crc ^ view.getInt32(offset, true);
+					const b = view.getInt32(offset + 4, true);
+					crc = T7[a & 0xFF] ^ T6[(a >>> 8) & 0xFF] ^ T5[(a >>> 16) & 0xFF] ^ T4[(a >>> 24) & 0xFF] ^
+						T3[b & 0xFF] ^ T2[(b >>> 8) & 0xFF] ^ T1[(b >>> 16) & 0xFF] ^ T0[(b >>> 24) & 0xFF];
+				}
+			}
+			// Remaining tail (and non-typed inputs) byte-at-a-time with the base table.
+			for (; offset < length; offset++) {
+				crc = (crc >>> 8) ^ T0[(crc ^ data[offset]) & 0xFF];
 			}
 			this.crc = crc;
 		}
@@ -1695,21 +1723,40 @@
 	const ERR_INVALID_COMPRESSED_DATA = "Invalid compressed data";
 	const FORMAT_DEFLATE_RAW = "deflate-raw";
 	const FORMAT_DEFLATE64_RAW = "deflate64-raw";
+	const FORMAT_GZIP = "gzip";
+	const GZIP_HEADER_LENGTH = 10;
+	const GZIP_TRAILER_LENGTH = 8;
 
 	class DeflateStream extends TransformStream {
 
 		constructor(options, { chunkSize, CompressionStreamZlib, CompressionStream }) {
 			super({});
-			const { compressed, encrypted, useCompressionStream, zipCrypto, signed, level } = options;
+			const { compressed, encrypted, useCompressionStream, zipCrypto, signed, level, deflate64 } = options;
 			const stream = this;
-			let crc32Stream, encryptionStream;
+			let crc32Stream, encryptionStream, gzipCrc32Stream;
 			let readable = super.readable;
-			if ((!encrypted || zipCrypto) && signed) {
+			// The gzip trailer carries a CRC-32 of the uncompressed data (same polynomial as zip),
+			// computed in native code for free during compression. On the native CompressionStream,
+			// harvest it instead of running a separate CRC pass: compress as gzip, then strip the
+			// fixed 10-byte header and 8-byte trailer to recover the exact raw-deflate payload
+			// (byte-identical to a deflate-raw compression) while capturing the CRC. The CRC becomes
+			// available at end-of-stream, exactly like Crc32Stream, so nothing downstream (data
+			// descriptor, central directory, ZipCrypto) needs it any earlier. Not applied for the
+			// pure-JS/WASM ports (a separate slice-by-8 CRC pass is as fast or faster there).
+			const useGzipCrc32 = signed && compressed && !deflate64 && (!encrypted || zipCrypto) &&
+				Boolean(useCompressionStream && CompressionStream);
+			if ((!encrypted || zipCrypto) && signed && !useGzipCrc32) {
 				crc32Stream = new Crc32Stream();
 				readable = pipeThrough(readable, crc32Stream);
 			}
 			if (compressed) {
-				readable = pipeThroughCommpressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamZlib, CompressionStream);
+				if (useGzipCrc32) {
+					gzipCrc32Stream = new GzipToRawDeflateStream();
+					readable = pipeThroughBackpressured(readable, new CompressionStream(FORMAT_GZIP));
+					readable = pipeThrough(readable, gzipCrc32Stream);
+				} else {
+					readable = pipeThroughCommpressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamZlib, CompressionStream);
+				}
 			}
 			if (encrypted) {
 				if (zipCrypto) {
@@ -1725,13 +1772,74 @@
 					signature = encryptionStream.signature;
 				}
 				if ((!encrypted || zipCrypto) && signed) {
-					signature = new DataView(crc32Stream.value.buffer).getUint32(0);
+					signature = useGzipCrc32 ? gzipCrc32Stream.signature : new DataView(crc32Stream.value.buffer).getUint32(0);
 				}
 				stream.signature = signature;
 			});
 		}
 	}
 
+	// Converts a gzip stream into its raw-deflate payload while capturing the CRC-32 from the gzip
+	// trailer. The CompressionStream gzip header is always the fixed 10-byte form (FLG=0, no optional
+	// fields) per the Compression Streams spec, so it is stripped by length; the trailer is the last
+	// 8 bytes (CRC-32 LE, then ISIZE LE). Bounded memory: at most GZIP_TRAILER_LENGTH bytes are held
+	// back across chunks. The signature is read big-endian-agnostically as a number, matching the
+	// value Crc32Stream produces, so the writer path is unchanged.
+	class GzipToRawDeflateStream extends TransformStream {
+
+		constructor() {
+			// deno-lint-ignore prefer-const
+			let stream;
+			let headerLeft = GZIP_HEADER_LENGTH;
+			let tail = new Uint8Array(0);
+			super({
+				transform(chunk, controller) {
+					if (headerLeft) {
+						const dropped = Math.min(headerLeft, chunk.length);
+						headerLeft -= dropped;
+						chunk = chunk.subarray(dropped);
+						if (!chunk.length) {
+							return;
+						}
+					}
+					const available = tail.length + chunk.length;
+					if (available <= GZIP_TRAILER_LENGTH) {
+						const pending = new Uint8Array(available);
+						pending.set(tail);
+						pending.set(chunk, tail.length);
+						tail = pending;
+						return;
+					}
+					// Emit everything except the trailing GZIP_TRAILER_LENGTH bytes as a standalone,
+					// right-sized Uint8Array. Consumers may read chunk.buffer directly (e.g. custom
+					// writers), so an aliased subarray of a larger buffer would leak the held-back
+					// trailer bytes. Bytes are copied exactly once, into `output` or `tail`.
+					const emitLength = available - GZIP_TRAILER_LENGTH;
+					const output = new Uint8Array(emitLength);
+					const fromTail = Math.min(emitLength, tail.length);
+					output.set(tail.subarray(0, fromTail), 0);
+					if (emitLength > fromTail) {
+						output.set(chunk.subarray(0, emitLength - fromTail), fromTail);
+					}
+					controller.enqueue(output);
+					const nextTail = new Uint8Array(GZIP_TRAILER_LENGTH);
+					const tailRemaining = tail.length - fromTail;
+					if (tailRemaining) {
+						nextTail.set(tail.subarray(fromTail), 0);
+					}
+					nextTail.set(chunk.subarray(emitLength - fromTail), tailRemaining);
+					tail = nextTail;
+				},
+				flush() {
+					const dataView = new DataView(tail.buffer, tail.byteOffset, tail.byteLength);
+					stream.signature = dataView.getUint32(0, true);
+					stream.uncompressedSize = dataView.getUint32(4, true);
+				}
+			});
+			stream = this;
+		}
+	}
+
 	class InflateStream extends TransformStream {
 
 		constructor(options, { chunkSize, DecompressionStreamZlib, DecompressionStream }) {
@@ -3693,6 +3801,11 @@
 	const OPTION_OFFSET = "offset";
 	const OPTION_USDZ = "usdz";
 	const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
+	const OPTION_STRICTNESS = "strictness";
+	const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
+	const STRICTNESS_STRICT = "strict";
+	const STRICTNESS_BALANCED = "balanced";
+	const STRICTNESS_TOLERANT = "tolerant";
 
 	/*
 	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
@@ -3782,7 +3895,11 @@
 				throw new Error(ERR_BAD_FORMAT);
 			}
 			reader.chunkSize = getChunkSize(config);
-			const endOfDirectoryInfo = await seekSignature(reader, END_OF_CENTRAL_DIR_SIGNATURE, reader.size, END_OF_CENTRAL_DIR_LENGTH, MAX_16_BITS * 16);
+			const strictness = getStrictness(getOptionValue$1(zipReader, options, OPTION_STRICTNESS), getOptionValue$1(zipReader, options, OPTION_CHECK_AMBIGUITY));
+			const checkAmbiguity = strictness == STRICTNESS_STRICT;
+			const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
+			const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue$1(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+			const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 			if (!endOfDirectoryInfo) {
 				const signatureArray = await readUint8Array(reader, 0, 4);
 				const signatureView = getDataView$1(signatureArray);
@@ -3792,14 +3909,18 @@
 					throw new Error(ERR_EOCDR_NOT_FOUND);
 				}
 			}
+			// two or more end-anchored records that each dereference to a valid central directory cannot be told
+			// apart (see comment_length ⟺ EOF): the archive is genuinely ambiguous, so refuse rather than guess
+			if (rejectAmbiguousEndOfDirectory && endOfDirectoryReachingEndCount > 1) {
+				throwAmbiguousArchive("multiple end of central directory records");
+			}
 			const endOfDirectoryView = getDataView$1(endOfDirectoryInfo);
 			let directoryDataLength = getUint32(endOfDirectoryView, 12);
 			let directoryDataOffset = getUint32(endOfDirectoryView, 16);
 			const commentOffset = endOfDirectoryInfo.offset;
 			const commentLength = getUint16(endOfDirectoryView, 20);
 			const appendedDataOffset = commentOffset + END_OF_CENTRAL_DIR_LENGTH + commentLength;
-			const checkAmbiguity = getOptionValue$1(zipReader, options, OPTION_CHECK_AMBIGUITY);
-			if (checkAmbiguity && appendedDataOffset != reader.size) {
+			if (reader.size - appendedDataOffset > maxAppendedDataSize) {
 				throwAmbiguousArchive("appended data");
 			}
 			let lastDiskNumber = getUint16(endOfDirectoryView, 4);
@@ -3878,14 +3999,28 @@
 					throw new Error(ERR_BAD_FORMAT);
 				}
 				const expectedDirectoryDataOffset = centralDirectoryEndOffset - directoryDataLength - (reader.lastDiskOffset || 0);
-				if (getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE && directoryDataOffset != expectedDirectoryDataOffset && diskNumber == lastDiskNumber) {
-					const originalDirectoryDataOffset = directoryDataOffset;
-					directoryDataOffset = expectedDirectoryDataOffset;
-					if (directoryDataOffset > originalDirectoryDataOffset) {
-						prependedDataLength += directoryDataOffset - originalDirectoryDataOffset;
+				if (directoryDataOffset != expectedDirectoryDataOffset && diskNumber == lastDiskNumber) {
+					// the reconciled offset (the directory ends exactly where the canonical record begins) is anchored
+					// to the unforgeable end of the archive; the stored offset is not. Prefer the reconciled offset
+					// unless the stored one points at a directory and the reconciled one does not — that exception
+					// keeps a corrupt declared directory length from sending the read astray, while still moving off a
+					// stored offset that only looks valid because an append remnant left the previous (identically
+					// laid out) directory sitting there.
+					const storedPointsAtDirectory = getUint32(directoryView, offset) == CENTRAL_FILE_HEADER_SIGNATURE;
+					let reconcile = !storedPointsAtDirectory;
+					if (!reconcile && expectedDirectoryDataOffset >= 0 && expectedDirectoryDataOffset + 4 <= reader.size) {
+						const expectedSignatureArray = await readUint8Array(reader, expectedDirectoryDataOffset, 4, diskNumber);
+						reconcile = getUint32(getDataView$1(expectedSignatureArray), 0) == CENTRAL_FILE_HEADER_SIGNATURE;
+					}
+					if (reconcile) {
+						const originalDirectoryDataOffset = directoryDataOffset;
+						directoryDataOffset = expectedDirectoryDataOffset;
+						if (directoryDataOffset > originalDirectoryDataOffset) {
+							prependedDataLength += directoryDataOffset - originalDirectoryDataOffset;
+						}
+						directoryArray = await readUint8Array(reader, directoryDataOffset, directoryDataLength, diskNumber);
+						directoryView = getDataView$1(directoryArray);
 					}
-					directoryArray = await readUint8Array(reader, directoryDataOffset, directoryDataLength, diskNumber);
-					directoryView = getDataView$1(directoryArray);
 				}
 			}
 			const expectedDirectoryDataLength = centralDirectoryEndOffset - directoryDataOffset - (reader.lastDiskOffset || 0);
@@ -4142,7 +4277,7 @@
 				extraFieldLength,
 				filenameLength
 			} = localDirectory;
-			const checkAmbiguity = getOptionValue$1(zipEntry, options, OPTION_CHECK_AMBIGUITY);
+			const checkAmbiguity = getStrictness(getOptionValue$1(zipEntry, options, OPTION_STRICTNESS), getOptionValue$1(zipEntry, options, OPTION_CHECK_AMBIGUITY)) == STRICTNESS_STRICT;
 			let rawLocalFilename = new Uint8Array();
 			if (checkAmbiguity && (filenameLength || extraFieldLength)) {
 				const trailingDataArray = await readUint8Array(reader, offset + HEADER_SIZE, filenameLength + extraFieldLength, diskNumberStart);
@@ -4592,26 +4727,191 @@
 		readRanges.set(index, range);
 	}
 
-	async function seekSignature(reader, signature, startOffset, minimumBytes, maximumLength) {
-		const signatureArray = new Uint8Array(4);
-		const signatureView = getDataView$1(signatureArray);
-		setUint32$1(signatureView, 0, signature);
-		const maximumBytes = minimumBytes + maximumLength;
-		return (await seek(minimumBytes)) || await seek(Math.min(maximumBytes, startOffset));
-
-		async function seek(length) {
-			const offset = startOffset - length;
-			const bytes = await readUint8Array(reader, offset, length);
-			for (let indexByte = bytes.length - minimumBytes; indexByte >= 0; indexByte--) {
-				if (bytes[indexByte] == signatureArray[0] && bytes[indexByte + 1] == signatureArray[1] &&
-					bytes[indexByte + 2] == signatureArray[2] && bytes[indexByte + 3] == signatureArray[3]) {
-					return {
-						offset: offset + indexByte,
-						buffer: bytes.slice(indexByte, indexByte + minimumBytes).buffer
-					};
+	function getStrictness(strictness, checkAmbiguity) {
+		if (strictness === UNDEFINED_VALUE) {
+			// `checkAmbiguity: true` is kept as a backward-compatible alias for the strictest mode
+			return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
+		}
+		return strictness;
+	}
+
+	function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
+		if (maxAppendedDataSize !== UNDEFINED_VALUE) {
+			return maxAppendedDataSize;
+		}
+		if (strictness == STRICTNESS_STRICT) {
+			// the comment must reach the end of the file: no trailing data tolerated
+			return 0;
+		}
+		if (strictness == STRICTNESS_TOLERANT) {
+			return Infinity;
+		}
+		// balanced: tolerate up to a legal comment's worth of trailing data (a 16-bit length); beyond that the
+		// trailing bytes cannot hide inside a comment, so they are treated as a second thing bolted onto the file
+		return MAX_16_BITS;
+	}
+
+	// cap on how many out-of-window central directory probes the scan below may issue. A legitimate archive needs
+	// at most a couple (the canonical record, plus one more to detect genuine ambiguity); every other reachability
+	// check is served from the tail window already in memory. The cap keeps an archive whose comment is stuffed
+	// with unreachable end-anchored records from forcing an unbounded number of (potentially remote) reads.
+	const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+
+	// reachability rankings for an end-anchored candidate record (see getCentralDirectoryReachability)
+	const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+	const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+	const CENTRAL_DIRECTORY_REACHABLE = 2;
+
+	// Locates the authoritative end of central directory record. The canonical record is the last one whose
+	// declared comment reaches exactly the end of the file ("end-anchored") and that points to a central directory
+	// ("reachable"); earlier signatures (stale append remnants, bytes embedded in a comment) are ignored. When two
+	// or more end-anchored records point to a central directory the archive is ambiguous, and the count is returned
+	// so the caller can refuse it. A record that reaches the end of the file but points to no central directory (an
+	// empty archive) is only "plausible": it cannot be corroborated, so it never counts towards ambiguity and is
+	// chosen only when no reachable record exists — otherwise an empty record forged in a comment could outrank the
+	// genuine directory. When no record is end-anchored (appended data or an oversized comment), falls back to the
+	// last record within the tolerated window that points to a directory (see seekEndOfCentralDirectory).
+	async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
+		const { size } = reader;
+		// an end-anchored record can only live within the last END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS bytes,
+		// since the comment length that ties it to the end of the file is a 16-bit field
+		const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
+		const anchoredOffset = size - anchoredLength;
+		const anchoredArray = await readUint8Array(reader, anchoredOffset, anchoredLength);
+		const anchoredView = getDataView$1(anchoredArray);
+		const remoteProbeBudget = { count: MAX_END_OF_CENTRAL_DIR_PROBES };
+		let endOfDirectoryInfo;
+		let plausibleEndOfDirectoryInfo;
+		let endOfDirectoryReachingEndCount = 0;
+		for (let indexByte = anchoredArray.length - END_OF_CENTRAL_DIR_LENGTH; indexByte >= 0; indexByte--) {
+			if (getUint32(anchoredView, indexByte) == END_OF_CENTRAL_DIR_SIGNATURE) {
+				const offset = anchoredOffset + indexByte;
+				const commentLength = getUint16(anchoredView, indexByte + 20);
+				// end-anchored: the declared comment extends exactly to the end of the file. The comment length is
+				// attacker-controlled, but the reconciliation against the (unforgeable) end of file is not.
+				if (offset + END_OF_CENTRAL_DIR_LENGTH + commentLength == size) {
+					const reachability = await getCentralDirectoryReachability(reader, anchoredView, anchoredOffset, indexByte, offset, size, remoteProbeBudget);
+					if (reachability == CENTRAL_DIRECTORY_REACHABLE) {
+						if (!endOfDirectoryInfo) {
+							endOfDirectoryInfo = {
+								offset,
+								buffer: anchoredArray.slice(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH).buffer
+							};
+						}
+						endOfDirectoryReachingEndCount++;
+						// the canonical record (highest offset) is found first; a second one is enough to flag ambiguity
+						if (!rejectAmbiguous || endOfDirectoryReachingEndCount > 1) {
+							break;
+						}
+					} else if (reachability == CENTRAL_DIRECTORY_PLAUSIBLE && !plausibleEndOfDirectoryInfo) {
+						plausibleEndOfDirectoryInfo = {
+							offset,
+							buffer: anchoredArray.slice(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH).buffer
+						};
+					}
+				}
+			}
+		}
+		if (!endOfDirectoryInfo) {
+			// no record points to a directory: prefer a plausible (empty) end-anchored record before scanning the
+			// tolerated window for a bare signature
+			endOfDirectoryInfo = plausibleEndOfDirectoryInfo;
+		}
+		if (!endOfDirectoryInfo) {
+			endOfDirectoryInfo = await seekEndOfCentralDirectory(reader, maxAppendedDataSize, remoteProbeBudget);
+		}
+		return { endOfDirectoryInfo, endOfDirectoryReachingEndCount };
+	}
+
+	// Fallback for findEndOfCentralDirectory when no record is end-anchored: appended data or an oversized comment
+	// pushed the record's declared comment past the end of the file, so its position can no longer be reconciled
+	// against the end of the file. Scans the tolerated window from the end and returns the first record that points
+	// to a central directory, so a stray signature embedded in appended data cannot hijack discovery (which the
+	// anchored scan already prevents for anchored records). Falls back to the first plausible (empty) record, then
+	// to the last bare signature, so a degenerate archive still opens as before. The window ends at the file, so the
+	// same in-window / metered reads as the anchored scan apply.
+	async function seekEndOfCentralDirectory(reader, maxAppendedDataSize, remoteProbeBudget) {
+		const { size } = reader;
+		const searchLength = Math.min(size, maxAppendedDataSize == Infinity ? size :
+			END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS + maxAppendedDataSize);
+		const searchOffset = size - searchLength;
+		const searchArray = await readUint8Array(reader, searchOffset, searchLength);
+		const searchView = getDataView$1(searchArray);
+		let firstSignatureInfo, plausibleInfo;
+		for (let indexByte = searchArray.length - END_OF_CENTRAL_DIR_LENGTH; indexByte >= 0; indexByte--) {
+			if (getUint32(searchView, indexByte) == END_OF_CENTRAL_DIR_SIGNATURE) {
+				const offset = searchOffset + indexByte;
+				const record = { offset, buffer: searchArray.slice(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH).buffer };
+				if (!firstSignatureInfo) {
+					firstSignatureInfo = record;
 				}
+				const reachability = await getCentralDirectoryReachability(reader, searchView, searchOffset, indexByte, offset, size, remoteProbeBudget);
+				if (reachability == CENTRAL_DIRECTORY_REACHABLE) {
+					return record;
+				}
+				if (reachability == CENTRAL_DIRECTORY_PLAUSIBLE && !plausibleInfo) {
+					plausibleInfo = record;
+				}
+			}
+		}
+		return plausibleInfo || firstSignatureInfo;
+	}
+
+	// Ranks how strongly an end-anchored candidate record is backed by an actual central directory, used to decide
+	// which record is canonical and which count towards ambiguity. It is intentionally conservative and does not
+	// fully parse the directory (the caller does that for the canonical record):
+	//   - REACHABLE: the record dereferences a central directory (a central file header signature at the
+	//     reconciled offset), or, for a zip64 record, the zip64 locator that a genuine zip64 archive places
+	//     immediately before it. Only these count towards ambiguity.
+	//   - PLAUSIBLE: the record describes an empty archive, which has no central directory to dereference. Its
+	//     fields are indistinguishable from an empty end of central directory record forged inside a comment, so it
+	//     is accepted only as a last resort and never inflates the ambiguity count.
+	//   - UNREACHABLE: neither — stale append remnant or signature bytes embedded in a comment.
+	// Signatures are read from the tail window (`view`, spanning `[anchoredOffset, size)`) when they fall inside it;
+	// only a target below the window costs a (possibly remote) read, metered by `remoteProbeBudget` so a stuffed
+	// comment cannot amplify into an unbounded number of requests.
+	async function getCentralDirectoryReachability(reader, view, anchoredOffset, indexByte, offset, size, remoteProbeBudget) {
+		const filesLength = getUint16(view, indexByte + 10);
+		const directoryDataLength = getUint32(view, indexByte + 12);
+		const directoryDataOffset = getUint32(view, indexByte + 16);
+		if (filesLength == MAX_16_BITS || directoryDataLength == MAX_32_BITS || directoryDataOffset == MAX_32_BITS) {
+			// saturated fields imply a zip64 record; corroborate it with the zip64 end of central directory locator
+			// that sits immediately before it, so saturated bytes inside a comment cannot masquerade as one
+			const locatorSignature = await readSignature(reader, view, anchoredOffset, offset - ZIP64_END_OF_CENTRAL_DIR_LOCATOR_LENGTH, size, remoteProbeBudget);
+			return locatorSignature == ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIGNATURE ? CENTRAL_DIRECTORY_REACHABLE : CENTRAL_DIRECTORY_UNREACHABLE;
+		}
+		if (!filesLength && !directoryDataLength) {
+			// a valid empty archive has no central directory to dereference
+			return CENTRAL_DIRECTORY_PLAUSIBLE;
+		}
+		// the central directory ends where this record starts; reconcile the stored offset against that actual
+		// position (see stored_cd_offset ⟺ eocd_pos − cd_size) so prepended data does not hide the directory
+		for (const centralDirectoryOffset of [offset - directoryDataLength, directoryDataOffset]) {
+			if (await readSignature(reader, view, anchoredOffset, centralDirectoryOffset, size, remoteProbeBudget) == CENTRAL_FILE_HEADER_SIGNATURE) {
+				return CENTRAL_DIRECTORY_REACHABLE;
 			}
 		}
+		return CENTRAL_DIRECTORY_UNREACHABLE;
+	}
+
+	// Reads a 4-byte little-endian signature at `signatureOffset`, served from the tail window (`view`, spanning
+	// `[anchoredOffset, size)`) when it falls inside it and otherwise from a metered (possibly remote) read. Returns
+	// UNDEFINED_VALUE when the position is out of range or the out-of-window read budget is exhausted.
+	async function readSignature(reader, view, anchoredOffset, signatureOffset, size, remoteProbeBudget) {
+		if (signatureOffset < 0 || signatureOffset + 4 > size) {
+			return UNDEFINED_VALUE;
+		}
+		if (signatureOffset >= anchoredOffset) {
+			// the target sits inside the tail window already in memory: no extra read needed
+			return getUint32(view, signatureOffset - anchoredOffset);
+		}
+		if (remoteProbeBudget.count > 0) {
+			remoteProbeBudget.count--;
+			const signatureArray = await readUint8Array(reader, signatureOffset, 4);
+			return getUint32(getDataView$1(signatureArray), 0);
+		}
+		// out of budget: leave this candidate unverified rather than issue another read
+		return UNDEFINED_VALUE;
 	}
 
 	function checkLocalDirectory(zipEntry, localDirectory, rawLocalFilename) {
@@ -4676,10 +4976,6 @@
 		return Number(view.getBigUint64(offset, true));
 	}
 
-	function setUint32$1(view, offset, value) {
-		view.setUint32(offset, value, true);
-	}
-
 	function getDataView$1(array) {
 		return new DataView(array.buffer, array.byteOffset, array.byteLength);
 	}
@@ -5469,6 +5765,17 @@
 			if (releaseLockWriter) {
 				releaseLockWriter();
 			}
+			// A buffered entry uses a temporary stream (see `createTempStream`). When that stream is
+			// backed by a resource (a file, an OPFS handle, ...) it must be released on every exit path,
+			// including the error path where the stream is otherwise abandoned without being closed or
+			// cancelled. `dispose()` is optional and best-effort so it never masks the original outcome.
+			if (bufferedWrite && fileWriter && fileWriter.dispose) {
+				try {
+					await fileWriter.dispose();
+				} catch {
+					// ignored
+				}
+			}
 		}
 
 		function requestLockCurrentFileEntry() {
@@ -6506,6 +6813,177 @@
 	 */
 
 
+	const DEFAULT_THRESHOLD = 1024 * 1024;
+	const DEFAULT_DIRECTORY_NAME = ".zip.js-temp";
+
+	// Builds a `createTempStream` factory (see `ZipWriter`'s option of the same name) that spills the
+	// data of a buffered entry to the Origin Private File System (OPFS) instead of keeping it in memory.
+	//
+	// It is meant for the buffered-write path (keep-order concurrent `add()`, non-seekable output, ...),
+	// where the compressed data of an entry has to be held until the writer is free. In memory that data
+	// grows with the entry size; here it is written to an OPFS file and streamed back, so peak memory
+	// stays bounded.
+	//
+	// It is hybrid on purpose: an entry stays fully in memory until it exceeds `thresholdBytes`, and only
+	// then spills to a file. Small entries never touch the disk, so a workload made of many tiny entries
+	// keeps the speed of the in-memory default; only genuinely large entries pay for (and benefit from)
+	// the file round-trip.
+	//
+	// OPFS is a browser/worker feature; there is no fallback here. Feature-detect
+	// `navigator.storage.getDirectory` (or inject `getDirectory`) before using it, and let the writer use
+	// its in-memory default elsewhere.
+	//
+	// Options:
+	//   thresholdBytes  spill to a file once a buffered entry exceeds this size (default 1 MiB).
+	//   directoryName   name of the OPFS sub-directory holding the temp files (default ".zip.js-temp").
+	//   getDirectory    returns (or resolves to) the root `FileSystemDirectoryHandle`. Defaults to
+	//                   `navigator.storage.getDirectory()`. Inject it to run inside a worker with a
+	//                   pre-obtained handle, or to test against a mock.
+	function createOPFSTempStream(options = {}) {
+		const {
+			thresholdBytes = DEFAULT_THRESHOLD,
+			directoryName = DEFAULT_DIRECTORY_NAME,
+			getDirectory = () => navigator.storage.getDirectory()
+		} = options;
+		// The temp directory is resolved once and shared by every entry of this factory.
+		let directoryHandlePromise;
+		function getTempDirectory() {
+			if (!directoryHandlePromise) {
+				directoryHandlePromise = Promise.resolve(getDirectory())
+					.then(root => root.getDirectoryHandle(directoryName, { create: true }));
+			}
+			return directoryHandlePromise;
+		}
+		return async function () {
+			const memoryChunks = [];
+			let bufferedSize = 0;
+			let spilled = false;
+			let fileName, fileHandle, fileWriter, fileReader;
+
+			// Move whatever is buffered in memory to a fresh OPFS file, then keep writing to that file.
+			// `FileSystemWritableFileStream` is a `WritableStream`, so it is driven through the standard
+			// writer API rather than its non-standard `write()`/`seek()` convenience methods.
+			async function spillToFile() {
+				const directoryHandle = await getTempDirectory();
+				fileName = crypto.randomUUID();
+				fileHandle = await directoryHandle.getFileHandle(fileName, { create: true });
+				fileWriter = (await fileHandle.createWritable()).getWriter();
+				spilled = true;
+				for (const chunk of memoryChunks) {
+					await fileWriter.write(chunk);
+				}
+				// Release the in-memory copy; from now on data lives in the file.
+				memoryChunks.length = 0;
+			}
+
+			const writable = new WritableStream({
+				async write(chunk) {
+					if (spilled) {
+						await fileWriter.write(chunk);
+					} else {
+						memoryChunks.push(chunk);
+						bufferedSize += chunk.length;
+						if (bufferedSize > thresholdBytes) {
+							await spillToFile();
+						}
+					}
+				},
+				async close() {
+					if (fileWriter) {
+						await fileWriter.close();
+						fileWriter = null;
+					}
+				}
+			});
+
+			// The writer always closes `writable` before reading `readable`, so `spilled` is final by the
+			// time `pull` runs. It is read lazily here (not in `start`, which runs at construction time,
+			// before anything is written and before `spilled` is known).
+			let memoryIndex = 0;
+			const readable = new ReadableStream({
+				async pull(controller) {
+					if (spilled) {
+						if (!fileReader) {
+							const file = await fileHandle.getFile();
+							fileReader = file.stream().getReader();
+						}
+						const { value, done } = await fileReader.read();
+						if (done) {
+							controller.close();
+						} else {
+							controller.enqueue(value);
+						}
+					} else if (memoryIndex < memoryChunks.length) {
+						controller.enqueue(memoryChunks[memoryIndex++]);
+					} else {
+						controller.close();
+					}
+				},
+				async cancel(reason) {
+					if (fileReader) {
+						await fileReader.cancel(reason);
+					}
+				}
+			}, { highWaterMark: 0 });
+			// highWaterMark 0: do not pull (and possibly close on an empty buffer) until the consumer
+			// actually reads, which the writer only does once the data has been fully written.
+
+			// Called by the writer on every exit path (success, error, abort). Best-effort: it must never
+			// throw. Closes any still-open file writer, then deletes the temp file.
+			async function dispose() {
+				if (fileWriter) {
+					try {
+						await fileWriter.close();
+					} catch {
+						// ignored
+					}
+					fileWriter = null;
+				}
+				if (fileName) {
+					try {
+						const directoryHandle = await getTempDirectory();
+						await directoryHandle.removeEntry(fileName);
+					} catch {
+						// ignored
+					}
+					fileHandle = fileName = null;
+				}
+				memoryChunks.length = 0;
+			}
+
+			return { writable, readable, dispose };
+		};
+	}
+
+	/*
+	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+
+	 Redistribution and use in source and binary forms, with or without
+	 modification, are permitted provided that the following conditions are met:
+
+	 1. Redistributions of source code must retain the above copyright notice,
+	 this list of conditions and the following disclaimer.
+
+	 2. Redistributions in binary form must reproduce the above copyright
+	 notice, this list of conditions and the following disclaimer in
+	 the documentation and/or other materials provided with the distribution.
+
+	 3. The names of the authors may not be used to endorse or promote products
+	 derived from this software without specific prior written permission.
+
+	 THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
+	 INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+	 FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
+	 INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
+	 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+	 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+	 OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+	 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+	 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+	 */
+
+
 	try {
 		configure({ baseURI: (typeof document === 'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('zip-core.js', document.baseURI).href)) });
 	} catch {
@@ -6560,6 +7038,7 @@
 	exports.ZipWriter = ZipWriter;
 	exports.ZipWriterStream = ZipWriterStream;
 	exports.configure = configure;
+	exports.createOPFSTempStream = createOPFSTempStream;
 	exports.getMimeType = getMimeType;
 	exports.terminateWorkers = terminateWorkers;