@zip.js/zip.js 2.8.29 → 2.8.31

package/lib/core/codec-worker.js

@@ -194,9 +194,6 @@ async function runWorker({ options, readable, writable, onTaskFinished }, config
 			try {
 				await initModule(config);
 			} catch {
-				// The WASM module failed to load. Fall back to the native CompressionStream only if the
-				// zlib codec that would otherwise run depends on that module; a self-contained codec
-				// supplied through config (e.g. the pure-JS port) stays usable and is kept as requested.
 				const ZlibStream = options.codecType.startsWith(CODEC_DEFLATE) ?
 					config.CompressionStreamZlib :
 					config.DecompressionStreamZlib;
@@ -274,7 +271,6 @@ async function runWebWorker(workerData, config) {
 		return resultValue;
 	} catch (error) {
 		await closeWritable();
-		// unblock the pipe watcher if the worker died before closing its end of the stream
 		abortPipe();
 		try {
 			await closed;
@@ -299,8 +295,6 @@ function watchClosedStream(writableSource) {
 	const abortController = new AbortController();
 	const { writable, readable } = new TransformStream();
 	const closed = readable.pipeTo(writableSource, { preventClose: true, preventAbort: true, signal: abortController.signal });
-	// the pipe can fail before `closed` is awaited (e.g. the destination write fails);
-	// mark the rejection as handled so it cannot kill the process in the meantime
 	closed.catch(() => { });
 	return { writable, closed, abortPipe: () => abortController.abort() };
 }
@@ -393,8 +387,6 @@ function onWorkerError(event, workerData) {
 		event.preventDefault();
 	}
 	const { rejectResult, writer, onTaskFinished } = workerData;
-	// the worker is unusable (e.g. its script failed to load); terminate it and
-	// fail the current task instead of letting it hang forever
 	terminateWorker(workerData);
 	if (rejectResult) {
 		rejectResult(event.error || new Error(event.message || ERROR_EVENT_TYPE));
@@ -446,8 +438,6 @@ function sendMessage(message, { worker, writer, transferStreams }) {
 async function onMessage({ data }, workerData) {
 	const { type, value, messageId, result, error } = data;
 	const { reader, writer, resolveResult, rejectResult, onTaskFinished, generation } = workerData;
-	// continuations below can settle after the worker slot has been reassigned to a new
-	// task (e.g. a pending pull read failing late); they must not touch the new task
 	const stale = () => workerData.generation != generation;
 	try {
 		if (error) {

package/lib/core/configuration.js

@@ -55,6 +55,22 @@ const DEFAULT_CONFIGURATION = {
 	DecompressionStream: typeof DecompressionStream != UNDEFINED_TYPE && DecompressionStream
 };
 
+const CONFIGURABLE_PROPERTY_NAMES = [
+	"baseURI",
+	"wasmURI",
+	"workerURI",
+	"chunkSize",
+	"maxWorkers",
+	"terminateWorkerTimeout",
+	"workerStarvationTimeout",
+	"useCompressionStream",
+	"useWebWorkers",
+	"CompressionStream",
+	"DecompressionStream",
+	"CompressionStreamZlib",
+	"DecompressionStreamZlib"
+];
+
 const config = Object.assign({}, DEFAULT_CONFIGURATION);
 
 export {
@@ -72,38 +88,10 @@ function getChunkSize(config) {
 }
 
 function configure(configuration) {
-	const {
-		baseURI,
-		chunkSize,
-		maxWorkers,
-		terminateWorkerTimeout,
-		workerStarvationTimeout,
-		useCompressionStream,
-		useWebWorkers,
-		CompressionStream,
-		DecompressionStream,
-		CompressionStreamZlib,
-		DecompressionStreamZlib,
-		workerURI,
-		wasmURI
-	} = configuration;
-	setIfDefined("baseURI", baseURI);
-	setIfDefined("wasmURI", wasmURI);
-	setIfDefined("workerURI", workerURI);
-	setIfDefined("chunkSize", chunkSize);
-	setIfDefined("maxWorkers", maxWorkers);
-	setIfDefined("terminateWorkerTimeout", terminateWorkerTimeout);
-	setIfDefined("workerStarvationTimeout", workerStarvationTimeout);
-	setIfDefined("useCompressionStream", useCompressionStream);
-	setIfDefined("useWebWorkers", useWebWorkers);
-	setIfDefined("CompressionStream", CompressionStream);
-	setIfDefined("DecompressionStream", DecompressionStream);
-	setIfDefined("CompressionStreamZlib", CompressionStreamZlib);
-	setIfDefined("DecompressionStreamZlib", DecompressionStreamZlib);
-}
-
-function setIfDefined(propertyName, propertyValue) {
-	if (propertyValue !== UNDEFINED_VALUE) {
-		config[propertyName] = propertyValue;
+	for (const propertyName of CONFIGURABLE_PROPERTY_NAMES) {
+		const propertyValue = configuration[propertyName];
+		if (propertyValue !== UNDEFINED_VALUE) {
+			config[propertyName] = propertyValue;
+		}
 	}
 }

package/lib/core/constants.js

@@ -104,7 +104,10 @@ const UNDEFINED_TYPE = "undefined";
 const FUNCTION_TYPE = "function";
 const OBJECT_TYPE = "object";
 
+const EMPTY_UINT8_ARRAY = new Uint8Array();
+
 export {
+	EMPTY_UINT8_ARRAY,
 	MAX_32_BITS,
 	MAX_16_BITS,
 	MAX_8_BITS,

package/lib/core/io.js

@@ -33,7 +33,8 @@ import {
 	UNDEFINED_VALUE,
 	INFINITY_VALUE,
 	FUNCTION_TYPE,
-	END_OF_CENTRAL_DIR_LENGTH
+	END_OF_CENTRAL_DIR_LENGTH,
+	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
 
@@ -71,26 +72,24 @@ class Stream {
 class Reader extends Stream {
 
 	get readable() {
+		return this.createReadable();
+	}
+
+	createReadable({ offset = 0, size, diskNumberStart, chunkSize = DEFAULT_CHUNK_SIZE } = {}) {
 		const reader = this;
-		const { chunkSize = DEFAULT_CHUNK_SIZE } = reader;
-		const readable = new ReadableStream({
-			start() {
-				this.chunkOffset = 0;
-			},
+		let chunkOffset = 0;
+		return new ReadableStream({
 			async pull(controller) {
-				const { offset = 0, size, diskNumberStart } = readable;
-				const { chunkOffset } = this;
 				const dataSize = size === UNDEFINED_VALUE ? chunkSize : Math.min(chunkSize, size - chunkOffset);
 				const data = await readUint8Array(reader, offset + chunkOffset, dataSize, diskNumberStart);
 				controller.enqueue(data);
 				if ((chunkOffset + chunkSize > size) || (size === UNDEFINED_VALUE && !data.length && dataSize)) {
 					controller.close();
 				} else {
-					this.chunkOffset += chunkSize;
+					chunkOffset += chunkSize;
 				}
 			}
 		});
-		return readable;
 	}
 }
 
@@ -229,8 +228,6 @@ class BlobWriter extends Stream {
 			}
 		});
 		writer.blob = new Response(transformStream.readable, { headers }).blob();
-		// mark early rejections (e.g. aborted pipe) as handled; awaiting getData() still
-		// surfaces them
 		writer.blob.catch(() => { });
 	}
 
@@ -392,7 +389,7 @@ async function readUint8ArrayHttpReader(httpReader, index, length, sendRequest,
 			return eocdCache;
 		}
 		if (index >= size || length === 0) {
-			return new Uint8Array();
+			return EMPTY_UINT8_ARRAY;
 		} else {
 			if (index + length > size) {
 				length = size - index;
@@ -449,8 +446,6 @@ async function getXMLHttpRequestData(httpReader) {
 async function getRequestData(httpReader, sendRequest) {
 	const response = await sendRequest(HTTP_METHOD_GET, httpReader, getHeaders(httpReader));
 	httpReader.data = new Uint8Array(await response.arrayBuffer());
-	// the downloaded content is authoritative, e.g. the Content-Length response header
-	// of the HEAD request can be the encoded size when the content is compressed
 	httpReader.size = httpReader.data.length;
 }
 
@@ -515,7 +510,6 @@ class HttpReader extends Reader {
 		super();
 		Object.assign(this, {
 			url,
-			// an explicit fetch implementation takes precedence over useXHR
 			reader: options.useXHR && !options.fetch ? new XHRReader(url, options) : new FetchReader(url, options)
 		});
 	}
@@ -654,7 +648,7 @@ class SplitDataReader extends Reader {
 				}
 			}
 		} else {
-			result = new Uint8Array();
+			result = EMPTY_UINT8_ARRAY;
 		}
 		reader.lastDiskNumber = Math.max(currentDiskNumber, reader.lastDiskNumber);
 		return result;
@@ -699,8 +693,6 @@ class SplitDataWriter extends Stream {
 					writer.diskOffset += diskSourceWriter.size;
 					writer.diskNumber++;
 					diskWriter = null;
-					// the next disk is not opened yet but its space is available; leaving a
-					// stale value here would force a new disk for every subsequent write
 					writer.availableSize = writer.maxSize;
 					if (chunk.length > availableSize) {
 						await this.write(chunk.subarray(availableSize));

package/lib/core/options.js

@@ -58,6 +58,11 @@ const OPTION_ENCODE_TEXT = "encodeText";
 const OPTION_OFFSET = "offset";
 const OPTION_USDZ = "usdz";
 const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
+const OPTION_STRICTNESS = "strictness";
+const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
+const STRICTNESS_STRICT = "strict";
+const STRICTNESS_BALANCED = "balanced";
+const STRICTNESS_TOLERANT = "tolerant";
 
 export {
 	OPTION_FILENAME_ENCODING,
@@ -91,5 +96,10 @@ export {
 	OPTION_ENCODE_TEXT,
 	OPTION_OFFSET,
 	OPTION_USDZ,
-	OPTION_UNIX_EXTRA_FIELD_TYPE
+	OPTION_UNIX_EXTRA_FIELD_TYPE,
+	OPTION_STRICTNESS,
+	OPTION_MAX_APPENDED_DATA_SIZE,
+	STRICTNESS_STRICT,
+	STRICTNESS_BALANCED,
+	STRICTNESS_TOLERANT
 };

package/lib/core/streams/aes-crypto-stream.js

@@ -29,7 +29,7 @@
 /* global crypto, TransformStream */
 // deno-lint-ignore-file no-this-alias
 
-import { UNDEFINED_VALUE, UNDEFINED_TYPE, FUNCTION_TYPE } from "../constants.js";
+import { UNDEFINED_VALUE, UNDEFINED_TYPE, FUNCTION_TYPE, EMPTY_UINT8_ARRAY } from "../constants.js";
 import { encodeText } from "./../util/encode-text.js";
 import {
 	cipher,
@@ -73,12 +73,7 @@ class AESDecryptionStream extends TransformStream {
 	constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly }) {
 		super({
 			start() {
-				Object.assign(this, {
-					ready: new Promise(resolve => this.resolveReady = resolve),
-					password: encodePassword(password, rawPassword),
-					strength: encryptionStrength - 1,
-					pending: new Uint8Array()
-				});
+				initAesCrypto(this, password, rawPassword, encryptionStrength);
 			},
 			async transform(chunk, controller) {
 				const aesCrypto = this;
@@ -113,7 +108,7 @@ class AESDecryptionStream extends TransformStream {
 					await ready;
 					const chunkToDecrypt = subarray(pending, 0, pending.length - SIGNATURE_LENGTH);
 					const originalSignature = subarray(pending, pending.length - SIGNATURE_LENGTH);
-					let decryptedChunkArray = new Uint8Array();
+					let decryptedChunkArray = EMPTY_UINT8_ARRAY;
 					if (chunkToDecrypt.length) {
 						const encryptedChunk = toBits(codecBytes, chunkToDecrypt);
 						hmac.update(encryptedChunk);
@@ -121,8 +116,6 @@ class AESDecryptionStream extends TransformStream {
 						decryptedChunkArray = fromBits(codecBytes, decryptedChunk);
 					}
 					const signature = subarray(fromBits(codecBytes, hmac.digest()), 0, SIGNATURE_LENGTH);
-					// branch-free comparison: accumulate the differences instead of
-					// short-circuiting on the first mismatching byte
 					let invalidSignature = pending.length < SIGNATURE_LENGTH ? 1 : 0;
 					for (let indexSignature = 0; indexSignature < SIGNATURE_LENGTH; indexSignature++) {
 						invalidSignature |= signature[indexSignature] ^ originalSignature[indexSignature];
@@ -144,12 +137,7 @@ class AESEncryptionStream extends TransformStream {
 		let stream;
 		super({
 			start() {
-				Object.assign(this, {
-					ready: new Promise(resolve => this.resolveReady = resolve),
-					password: encodePassword(password, rawPassword),
-					strength: encryptionStrength - 1,
-					pending: new Uint8Array()
-				});
+				initAesCrypto(this, password, rawPassword, encryptionStrength);
 			},
 			async transform(chunk, controller) {
 				const aesCrypto = this;
@@ -159,7 +147,7 @@ class AESEncryptionStream extends TransformStream {
 					resolveReady,
 					ready
 				} = aesCrypto;
-				let preamble = new Uint8Array();
+				let preamble = EMPTY_UINT8_ARRAY;
 				if (password) {
 					preamble = await createEncryptionKeys(aesCrypto, strength, password);
 					resolveReady();
@@ -179,7 +167,7 @@ class AESEncryptionStream extends TransformStream {
 				} = this;
 				if (hmac && ctr) {
 					await ready;
-					let encryptedChunkArray = new Uint8Array();
+					let encryptedChunkArray = EMPTY_UINT8_ARRAY;
 					if (pending.length) {
 						const encryptedChunk = ctr.update(toBits(codecBytes, pending));
 						hmac.update(encryptedChunk);
@@ -196,10 +184,18 @@ class AESEncryptionStream extends TransformStream {
 
 export {
 	AESDecryptionStream,
-	AESEncryptionStream,
-	ERR_INVALID_PASSWORD
+	AESEncryptionStream
 };
 
+function initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength) {
+	Object.assign(aesCrypto, {
+		ready: new Promise(resolve => aesCrypto.resolveReady = resolve),
+		password: encodePassword(password, rawPassword),
+		strength: encryptionStrength - 1,
+		pending: EMPTY_UINT8_ARRAY
+	});
+}
+
 function append(aesCrypto, input, output, paddingStart, paddingEnd, verifySignature) {
 	const {
 		ctr,

package/lib/core/streams/codecs/crc32.js

@@ -26,18 +26,30 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-const table = [];
-for (let i = 0; i < 256; i++) {
-	let t = i;
+// Slicing-by-8 CRC-32 (Intel / zlib). The eight 256-entry tables let the inner loop
+// consume 8 bytes per iteration with a shorter dependency chain, ~4x the byte-at-a-time
+// rate (measured ~320 -> ~1400 MB/s on 64KB chunks).
+//
+// Every table MUST stay a PACKED_SMI array: build with array literals (not `new Array(n)`,
+// which is HOLEY) and store the signed int32 XOR result (no `>>> 0`). An unsigned or holey
+// table becomes a V8 FixedDoubleArray whose every hot-loop lookup unboxes a double (~1.6x
+// slower). Signedness is irrelevant to the result — the reads mask/shift it and the final
+// `~crc` normalizes it. Do NOT reintroduce `>>> 0` here or switch to `new Array(256)`.
+const T = [[], [], [], [], [], [], [], []];
+for (let n = 0; n < 256; n++) {
+	let t = n;
 	for (let j = 0; j < 8; j++) {
-		if (t & 1) {
-			t = (t >>> 1) ^ 0xEDB88320;
-		} else {
-			t = t >>> 1;
-		}
+		t = (t & 1) ? (t >>> 1) ^ 0xEDB88320 : t >>> 1;
+	}
+	T[0][n] = t;
+}
+for (let n = 0; n < 256; n++) {
+	for (let k = 1; k < 8; k++) {
+		const previous = T[k - 1][n];
+		T[k][n] = (previous >>> 8) ^ T[0][previous & 0xFF];
 	}
-	table[i] = t;
 }
+const [T0, T1, T2, T3, T4, T5, T6, T7] = T;
 
 class Crc32 {
 
@@ -47,8 +59,24 @@ class Crc32 {
 
 	append(data) {
 		let crc = this.crc | 0;
-		for (let offset = 0, length = data.length | 0; offset < length; offset++) {
-			crc = (crc >>> 8) ^ table[(crc ^ data[offset]) & 0xFF];
+		const length = data.length | 0;
+		let offset = 0;
+		// Process 8 bytes per iteration over the typed-array body. DataView.getInt32(le)
+		// reads an unaligned little-endian word as a signed int32 (no double boxing), so no
+		// alignment or endianness handling is needed; data.buffer guards non-typed inputs.
+		if (length >= 8 && data.buffer) {
+			const view = new DataView(data.buffer, data.byteOffset, length);
+			const end = length - 8;
+			for (; offset <= end; offset += 8) {
+				const a = crc ^ view.getInt32(offset, true);
+				const b = view.getInt32(offset + 4, true);
+				crc = T7[a & 0xFF] ^ T6[(a >>> 8) & 0xFF] ^ T5[(a >>> 16) & 0xFF] ^ T4[(a >>> 24) & 0xFF] ^
+					T3[b & 0xFF] ^ T2[(b >>> 8) & 0xFF] ^ T1[(b >>> 16) & 0xFF] ^ T0[(b >>> 24) & 0xFF];
+			}
+		}
+		// Remaining tail (and non-typed inputs) byte-at-a-time with the base table.
+		for (; offset < length; offset++) {
+			crc = (crc >>> 8) ^ T0[(crc ^ data[offset]) & 0xFF];
 		}
 		this.crc = crc;
 	}

package/lib/core/streams/common-crypto.js

@@ -48,8 +48,6 @@ function getRandomValues(array) {
 	if (GET_RANDOM_VALUES_SUPPORTED) {
 		return crypto.getRandomValues(array);
 	} else {
-		// all supported runtimes expose crypto.getRandomValues; failing hard beats
-		// silently generating predictable encryption salts
 		throw new Error(ERR_UNSUPPORTED_CRYPTO_API);
 	}
 }

package/lib/core/streams/zip-crypto-stream.js

@@ -43,20 +43,13 @@ class ZipCryptoDecryptionStream extends TransformStream {
 	constructor({ password, rawPassword, passwordVerification, checkPasswordOnly }) {
 		super({
 			start() {
-				Object.assign(this, {
-					password,
-					rawPassword,
-					passwordVerification
-				});
-				createKeys(this, password, rawPassword);
+				initZipCrypto(this, password, rawPassword, passwordVerification);
 			},
 			transform(chunk, controller) {
 				const zipCrypto = this;
 				if (zipCrypto.password || zipCrypto.rawPassword) {
 					const decryptedHeader = decrypt(zipCrypto, chunk.subarray(0, HEADER_LENGTH));
 					zipCrypto.password = zipCrypto.rawPassword = null;
-					// verify the password with a branch-free comparison of the verification byte, mirroring
-					// the constant-time AES HMAC signature check
 					if ((decryptedHeader.at(-1) ^ zipCrypto.passwordVerification) != 0) {
 						throw new Error(ERR_INVALID_PASSWORD);
 					}
@@ -77,12 +70,7 @@ class ZipCryptoEncryptionStream extends TransformStream {
 	constructor({ password, rawPassword, passwordVerification }) {
 		super({
 			start() {
-				Object.assign(this, {
-					password,
-					rawPassword,
-					passwordVerification
-				});
-				createKeys(this, password, rawPassword);
+				initZipCrypto(this, password, rawPassword, passwordVerification);
 			},
 			transform(chunk, controller) {
 				const zipCrypto = this;
@@ -108,10 +96,18 @@ class ZipCryptoEncryptionStream extends TransformStream {
 
 export {
 	ZipCryptoDecryptionStream,
-	ZipCryptoEncryptionStream,
-	ERR_INVALID_PASSWORD
+	ZipCryptoEncryptionStream
 };
 
+function initZipCrypto(zipCrypto, password, rawPassword, passwordVerification) {
+	Object.assign(zipCrypto, {
+		password,
+		rawPassword,
+		passwordVerification
+	});
+	createKeys(zipCrypto, password, rawPassword);
+}
+
 function decrypt(target, input) {
 	const output = new Uint8Array(input.length);
 	for (let index = 0; index < input.length; index++) {

package/lib/core/streams/zip-entry-stream.js

@@ -48,21 +48,32 @@ const ERR_INVALID_UNCOMPRESSED_SIZE = "Invalid uncompressed size";
 const ERR_INVALID_COMPRESSED_DATA = "Invalid compressed data";
 const FORMAT_DEFLATE_RAW = "deflate-raw";
 const FORMAT_DEFLATE64_RAW = "deflate64-raw";
+const FORMAT_GZIP = "gzip";
+const GZIP_HEADER_LENGTH = 10;
+const GZIP_TRAILER_LENGTH = 8;
 
 class DeflateStream extends TransformStream {
 
 	constructor(options, { chunkSize, CompressionStreamZlib, CompressionStream }) {
 		super({});
-		const { compressed, encrypted, useCompressionStream, zipCrypto, signed, level } = options;
+		const { compressed, encrypted, useCompressionStream, zipCrypto, signed, level, deflate64 } = options;
 		const stream = this;
-		let crc32Stream, encryptionStream;
+		let crc32Stream, encryptionStream, gzipCrc32Stream;
 		let readable = super.readable;
-		if ((!encrypted || zipCrypto) && signed) {
+		const useGzipCrc32 = signed && compressed && !deflate64 && (!encrypted || zipCrypto) &&
+			Boolean(useCompressionStream && CompressionStream);
+		if ((!encrypted || zipCrypto) && signed && !useGzipCrc32) {
 			crc32Stream = new Crc32Stream();
 			readable = pipeThrough(readable, crc32Stream);
 		}
 		if (compressed) {
-			readable = pipeThroughCommpressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamZlib, CompressionStream);
+			if (useGzipCrc32) {
+				gzipCrc32Stream = new GzipToRawDeflateStream();
+				readable = pipeThroughBackpressured(readable, new CompressionStream(FORMAT_GZIP));
+				readable = pipeThrough(readable, gzipCrc32Stream);
+			} else {
+				readable = pipeThroughCommpressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamZlib, CompressionStream);
+			}
 		}
 		if (encrypted) {
 			if (zipCrypto) {
@@ -78,13 +89,64 @@ class DeflateStream extends TransformStream {
 				signature = encryptionStream.signature;
 			}
 			if ((!encrypted || zipCrypto) && signed) {
-				signature = new DataView(crc32Stream.value.buffer).getUint32(0);
+				signature = useGzipCrc32 ? gzipCrc32Stream.signature : new DataView(crc32Stream.value.buffer).getUint32(0);
 			}
 			stream.signature = signature;
 		});
 	}
 }
 
+class GzipToRawDeflateStream extends TransformStream {
+
+	constructor() {
+		// deno-lint-ignore prefer-const
+		let stream;
+		let headerLeft = GZIP_HEADER_LENGTH;
+		let tail = new Uint8Array(0);
+		super({
+			transform(chunk, controller) {
+				if (headerLeft) {
+					const dropped = Math.min(headerLeft, chunk.length);
+					headerLeft -= dropped;
+					chunk = chunk.subarray(dropped);
+					if (!chunk.length) {
+						return;
+					}
+				}
+				const available = tail.length + chunk.length;
+				if (available <= GZIP_TRAILER_LENGTH) {
+					const pending = new Uint8Array(available);
+					pending.set(tail);
+					pending.set(chunk, tail.length);
+					tail = pending;
+					return;
+				}
+				const emitLength = available - GZIP_TRAILER_LENGTH;
+				const output = new Uint8Array(emitLength);
+				const fromTail = Math.min(emitLength, tail.length);
+				output.set(tail.subarray(0, fromTail), 0);
+				if (emitLength > fromTail) {
+					output.set(chunk.subarray(0, emitLength - fromTail), fromTail);
+				}
+				controller.enqueue(output);
+				const nextTail = new Uint8Array(GZIP_TRAILER_LENGTH);
+				const tailRemaining = tail.length - fromTail;
+				if (tailRemaining) {
+					nextTail.set(tail.subarray(fromTail), 0);
+				}
+				nextTail.set(chunk.subarray(emitLength - fromTail), tailRemaining);
+				tail = nextTail;
+			},
+			flush() {
+				const dataView = new DataView(tail.buffer, tail.byteOffset, tail.byteLength);
+				stream.signature = dataView.getUint32(0, true);
+				stream.uncompressedSize = dataView.getUint32(4, true);
+			}
+		});
+		stream = this;
+	}
+}
+
 class InflateStream extends TransformStream {
 
 	constructor(options, { chunkSize, DecompressionStreamZlib, DecompressionStream }) {
@@ -157,11 +219,6 @@ function pipeThroughCommpressionStream(readable, useCompressionStream, options,
 			throw error;
 		}
 	}
-	// The native CompressionStream/DecompressionStream and the pure-JS zlib port do not signal
-	// backpressure on their writable side (their `ready` never pends), so a plain pipeThrough drains
-	// the whole source into them and peak memory grows with the entry size. Awaiting each write()
-	// paces the source to the codec's consumption rate, keeping streaming memory bounded. The WASM
-	// codec already backpressures, so this is a no-op cost for it.
 	return pipeThroughBackpressured(readable, codecStream);
 }
 
@@ -169,10 +226,6 @@ function pipeThrough(readable, transformStream) {
 	return readable.pipeThrough(transformStream);
 }
 
-// Like readable.pipeThrough(transformStream), but drives the writable side manually and awaits each
-// write() so that a codec which under-reports backpressure cannot pull the whole source into memory.
-// Errors propagate in both directions: a source error aborts the codec; a downstream cancel/error
-// (surfaced through the codec's writable rejecting) cancels the source.
 function pipeThroughBackpressured(readable, transformStream) {
 	const writer = transformStream.writable.getWriter();
 	const reader = readable.getReader();
@@ -201,7 +254,7 @@ async function abort(writer, error) {
 	try {
 		await writer.abort(error);
 	} catch {
-		// the writable may already be errored/closed
+		// ignored: the writable may already be errored/closed
 	}
 }
 
@@ -209,13 +262,10 @@ async function cancel(reader, error) {
 	try {
 		await reader.cancel(error);
 	} catch {
-		// the readable may already be errored/closed
+		// ignored: the readable may already be errored/closed
 	}
 }
 
-// DecompressionStream implementations can fail with a message-less TypeError on malformed
-// input; give these errors an identifiable message (errors raised by the other stages of
-// the pipeline, e.g. ERR_INVALID_PASSWORD, always carry a message and pass through as-is)
 function mapInflateStreamError(readable) {
 	const reader = readable.getReader();
 	return new ReadableStream({