@zip.js/zip.js 2.8.49 → 2.8.50

package/dist/zip-fs-core.js

@@ -4,7 +4,7 @@
 	(global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.zip = {}));
 })(this, (function (exports) { 'use strict';
 
-	const { Array, Object, String, Number, BigInt, Math, Date, Map, Set, Response, URL, Error, Uint8Array, Uint16Array, Uint32Array, DataView, Blob, Promise, TextEncoder, TextDecoder, document, crypto, btoa, TransformStream, ReadableStream, WritableStream, CompressionStream, DecompressionStream, navigator, Worker } = typeof globalThis !== 'undefined' ? globalThis : this || self;
+	const { Array, Object, String, Number, BigInt, Math, Date, Map, Set, Response, URL, Error, Uint8Array, Uint16Array, Uint32Array, DataView, Blob, Promise, TextEncoder, TextDecoder, document, crypto, btoa, TransformStream, ReadableStream, WritableStream, CompressionStream, DecompressionStream, navigator, Worker, Symbol, setTimeout, clearTimeout, structuredClone } = typeof globalThis !== 'undefined' ? globalThis : this || self;
 
 	/*
 	 Copyright (c) 2022 Gildas Lormeau. All rights reserved.
@@ -116,6 +116,8 @@
 	const UNDEFINED_TYPE = "undefined";
 	const FUNCTION_TYPE = "function";
 	const OBJECT_TYPE = "object";
+	const STRING_TYPE = "string";
+	const NUMBER_TYPE = "number";
 
 	const EMPTY_UINT8_ARRAY = new Uint8Array();
 
@@ -707,7 +709,7 @@
 			forceRangeRequests,
 			combineSizeEocd
 		} = httpReader;
-		if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == "undefined" || preventHeadRequest)) {
+		if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == UNDEFINED_TYPE || preventHeadRequest)) {
 			const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, combineSizeEocd ? -END_OF_CENTRAL_DIR_LENGTH : undefined));
 			const acceptRanges = response.headers.get(HTTP_HEADER_ACCEPT_RANGES);
 			if (!forceRangeRequests && (!acceptRanges || acceptRanges.toLowerCase() != HTTP_RANGE_UNIT)) {
@@ -3203,12 +3205,6 @@
 
 
 	const DEFAULT_CHUNK_SIZE = 64 * 1024;
-	const MESSAGE_EVENT_TYPE = "message";
-	const MESSAGE_START = "start";
-	const MESSAGE_PULL = "pull";
-	const MESSAGE_DATA = "data";
-	const MESSAGE_ACK_DATA = "ack";
-	const MESSAGE_CLOSE = "close";
 	const CODEC_DEFLATE = "deflate";
 	const CODEC_INFLATE = "inflate";
 
@@ -3331,8 +3327,8 @@
 	 1. Redistributions of source code must retain the above copyright notice,
 	 this list of conditions and the following disclaimer.
 
-	 2. Redistributions in binary form must reproduce the above copyright 
-	 notice, this list of conditions and the following disclaimer in 
+	 2. Redistributions in binary form must reproduce the above copyright
+	 notice, this list of conditions and the following disclaimer in
 	 the documentation and/or other materials provided with the distribution.
 
 	 3. The names of the authors may not be used to endorse or promote products
@@ -3350,19 +3346,6 @@
 	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 	 */
 
-
-	const MODULE_WORKER_OPTIONS = { type: "module" };
-	const ERROR_EVENT_TYPE = "error";
-	const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
-	const ERR_WORKER_STARTUP_TIMEOUT = "Worker startup timeout";
-
-	let webWorkerSupported, webWorkerSource, webWorkerURI, webWorkerOptions, createWorkerFailed;
-	let transferStreamsSupported = true;
-	try {
-		transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
-	} catch {
-		// ignored
-	}
 	let initModule = () => { };
 
 	async function supportsDeflate(config) {
@@ -3388,9 +3371,6 @@
 
 		constructor(workerData, { readable, writable }, { options, config, streamOptions, useWebWorkers, transferStreams, workerURI, createWorker }, onTaskFinished) {
 			const { signal } = streamOptions;
-			if (createWorkerFailed) {
-				createWorker = UNDEFINED_VALUE;
-			}
 			Object.assign(workerData, {
 				busy: true,
 				generation: (workerData.generation || 0) + 1,
@@ -3432,11 +3412,7 @@
 					}
 				}
 			});
-			if (webWorkerSupported === UNDEFINED_VALUE) {
-				// deno-lint-ignore valid-typeof
-				webWorkerSupported = typeof Worker != UNDEFINED_TYPE;
-			}
-			return (useWebWorkers && ((webWorkerSupported && workerURI) || createWorker) ? createWebWorkerInterface : createWorkerInterface)(workerData, config);
+			return (createWorkerInterface)(workerData, config);
 		}
 	}
 
@@ -3480,60 +3456,6 @@
 		};
 	}
 
-	function createWebWorkerInterface(workerData, config) {
-		const { baseURI, chunkSize, workerStartupTimeout } = config;
-		let { wasmURI } = config;
-
-		if (!workerData.interface) {
-			// deno-lint-ignore valid-typeof
-			if (typeof wasmURI == FUNCTION_TYPE) {
-				wasmURI = wasmURI();
-			}
-			let worker;
-			try {
-				worker = getWebWorker(workerData.workerURI, baseURI, workerData);
-			} catch {
-				if (workerData.createWorker) {
-					createWorkerFailed = true;
-				} else {
-					webWorkerSupported = false;
-				}
-				return createWorkerInterface(workerData, config);
-			}
-			Object.assign(workerData, {
-				worker,
-				workerAlive: false,
-				terminated: false,
-				interface: {
-					run: async () => {
-						try {
-							return await runWebWorker(workerData, { chunkSize, wasmURI, baseURI, workerStartupTimeout });
-						} catch (error) {
-							if (error && error.workerStartupFailed) {
-								if (workerData.createWorker) {
-									createWorkerFailed = true;
-								} else {
-									webWorkerSupported = false;
-								}
-								releaseWorkerStreams(workerData);
-								return runWorker$1(workerData, config);
-							}
-							if (error && error.codecImportFailed) {
-								if (workerData.reader) {
-									releaseWorkerStreams(workerData);
-									return runWorker$1(workerData, config);
-								}
-								workerData.onTaskFinished();
-							}
-							throw error;
-						}
-					}
-				}
-			});
-		}
-		return workerData.interface;
-	}
-
 	async function runWorker$1({ options, readable, writable, onTaskFinished }, config) {
 		let codecStream;
 		try {
@@ -3582,332 +3504,6 @@
 		}
 	}
 
-	async function runWebWorker(workerData, config) {
-		let resolveResult, rejectResult;
-		const result = new Promise((resolve, reject) => {
-			resolveResult = resolve;
-			rejectResult = reject;
-		});
-		Object.assign(workerData, {
-			reader: null,
-			writer: null,
-			resolveResult,
-			rejectResult,
-			result
-		});
-		const { readable, options } = workerData;
-		const { writable, closed, abortPipe } = watchClosedStream(workerData.writable);
-		let streamsTransferred;
-		try {
-			streamsTransferred = sendMessage({
-				type: MESSAGE_START,
-				options,
-				config,
-				readable,
-				writable
-			}, workerData);
-		} catch (error) {
-			abortPipe();
-			try {
-				await closed;
-			} catch {
-				// ignored
-			}
-			workerData.onTaskFinished();
-			throw error;
-		}
-		if (!streamsTransferred) {
-			Object.assign(workerData, {
-				reader: readable.getReader(),
-				writer: writable.getWriter()
-			});
-		}
-		const { workerStartupTimeout } = config;
-		if (!workerData.workerAlive && Number.isFinite(workerStartupTimeout) && workerStartupTimeout >= 0) {
-			workerData.startupTimeout = setTimeout(() => onStartupTimeout(workerData), workerStartupTimeout);
-		}
-		try {
-			const resultValue = await result;
-			await closeWritable();
-			await closed;
-			return resultValue;
-		} catch (error) {
-			await closeWritable();
-			abortPipe();
-			try {
-				await closed;
-			} catch {
-				// ignored
-			}
-			throw error;
-		}
-
-		async function closeWritable() {
-			if (!streamsTransferred && !writable.locked) {
-				try {
-					await writable.getWriter().close();
-				} catch {
-					// ignored
-				}
-			}
-		}
-	}
-
-	function watchClosedStream(writableSource) {
-		const abortController = new AbortController();
-		const { writable, readable } = new TransformStream();
-		const closed = readable.pipeTo(writableSource, { preventClose: true, preventAbort: true, signal: abortController.signal });
-		closed.catch(() => { });
-		return { writable, closed, abortPipe: () => abortController.abort() };
-	}
-
-	function releaseWorkerStreams(workerData) {
-		const { reader } = workerData;
-		if (reader) {
-			reader.releaseLock();
-		}
-		workerData.reader = null;
-		workerData.writer = null;
-	}
-
-	function terminateWorker$1(workerData) {
-		const { worker } = workerData;
-		if (worker) {
-			try {
-				worker.terminate();
-			} catch {
-				// ignored
-			}
-		}
-		workerData.interface = null;
-	}
-
-	function getWebWorker(url, baseURI, workerData, isModuleType, useBlobURI = true) {
-		const { createWorker } = workerData;
-		let worker, resolvedURI, resolvedOptions;
-		if (createWorker) {
-			worker = createWorker();
-		} else if (webWorkerURI === UNDEFINED_VALUE || webWorkerSource !== url) {
-			// deno-lint-ignore valid-typeof
-			const isFunctionURI = typeof url == FUNCTION_TYPE;
-			if (isFunctionURI) {
-				resolvedURI = url(useBlobURI);
-			} else {
-				resolvedURI = url;
-			}
-			const isDataURI = resolvedURI.startsWith("data:");
-			const isBlobURI = resolvedURI.startsWith("blob:");
-			if (isDataURI || isBlobURI) {
-				if (isModuleType === UNDEFINED_VALUE) {
-					isModuleType = false;
-				}
-				if (isModuleType) {
-					resolvedOptions = MODULE_WORKER_OPTIONS;
-				}
-				try {
-					worker = new Worker(resolvedURI, resolvedOptions);
-				} catch (error) {
-					if (isBlobURI) {
-						try {
-							URL.revokeObjectURL(resolvedURI);
-						} catch {
-							// ignored
-						}
-					}
-					if (isFunctionURI && isBlobURI) {
-						return getWebWorker(url, baseURI, workerData, isModuleType, false);
-					} else if (!isModuleType) {
-						return getWebWorker(url, baseURI, workerData, true, false);
-					} else {
-						throw error;
-					}
-				}
-			} else {
-				if (isModuleType === UNDEFINED_VALUE) {
-					isModuleType = true;
-				}
-				if (isModuleType) {
-					resolvedOptions = MODULE_WORKER_OPTIONS;
-				}
-				try {
-					resolvedURI = new URL(resolvedURI, baseURI);
-				} catch {
-					// ignored
-				}
-				try {
-					worker = new Worker(resolvedURI, resolvedOptions);
-				} catch (error) {
-					if (isModuleType) {
-						return getWebWorker(url, baseURI, workerData, false, useBlobURI);
-					} else {
-						throw error;
-					}
-				}
-			}
-			webWorkerSource = url;
-			webWorkerURI = resolvedURI;
-			webWorkerOptions = resolvedOptions;
-		} else {
-			worker = new Worker(webWorkerURI, webWorkerOptions);
-		}
-		worker.addEventListener(MESSAGE_EVENT_TYPE, event => {
-			workerData.workerAlive = true;
-			clearStartupTimeout(workerData);
-			onMessage(event, workerData);
-		});
-		worker.addEventListener(ERROR_EVENT_TYPE, event => onWorkerError(event, workerData));
-		worker.addEventListener(MESSAGE_ERROR_EVENT_TYPE, event => onWorkerError(event, workerData));
-		return worker;
-	}
-
-	function onStartupTimeout(workerData) {
-		workerData.startupTimeout = null;
-		if (workerData.workerAlive) {
-			return;
-		}
-		const { rejectResult, writer } = workerData;
-		terminateWorker$1(workerData);
-		workerData.worker = null;
-		if (rejectResult) {
-			const error = new Error(ERR_WORKER_STARTUP_TIMEOUT);
-			error.workerStartupFailed = true;
-			rejectResult(error);
-			if (writer) {
-				writer.releaseLock();
-			}
-		}
-	}
-
-	function clearStartupTimeout(workerData) {
-		const { startupTimeout } = workerData;
-		if (startupTimeout) {
-			clearTimeout(startupTimeout);
-			workerData.startupTimeout = null;
-		}
-	}
-
-	function onWorkerError(event, workerData) {
-		if (event.preventDefault) {
-			event.preventDefault();
-		}
-		clearStartupTimeout(workerData);
-		const { workerAlive, rejectResult, writer, onTaskFinished } = workerData;
-		terminateWorker$1(workerData);
-		if (!workerAlive) {
-			workerData.worker = null;
-		}
-		if (rejectResult) {
-			let error = event.error || new Error(event.message || ERROR_EVENT_TYPE);
-			if (!workerAlive) {
-				error = Object.assign(new Error(error.message || ERROR_EVENT_TYPE), { workerStartupFailed: true });
-			}
-			rejectResult(error);
-			if (writer) {
-				writer.releaseLock();
-			}
-			if (workerAlive) {
-				onTaskFinished();
-			}
-		}
-	}
-
-	function sendMessage(message, { worker, writer, transferStreams, workerAlive }) {
-		try {
-			const { value, readable, writable } = message;
-			const transferables = [];
-			if (value) {
-				message.value = toExactUint8Array(value);
-				transferables.push(message.value.buffer);
-			}
-			if (transferStreams && transferStreamsSupported && workerAlive) {
-				if (readable) {
-					transferables.push(readable);
-				}
-				if (writable) {
-					transferables.push(writable);
-				}
-			} else {
-				message.readable = message.writable = null;
-			}
-			if (transferables.length) {
-				try {
-					worker.postMessage(message, transferables);
-					return true;
-				} catch {
-					transferStreamsSupported = false;
-					message.readable = message.writable = null;
-					worker.postMessage(message);
-				}
-			} else {
-				worker.postMessage(message);
-			}
-		} catch (error) {
-			if (writer) {
-				writer.releaseLock();
-			}
-			throw error;
-		}
-	}
-
-	async function onMessage({ data }, workerData) {
-		const { type, value, messageId, result, error } = data;
-		const { reader, writer, resolveResult, rejectResult, onTaskFinished, generation } = workerData;
-		const stale = () => workerData.generation != generation;
-		try {
-			if (error) {
-				const { message, stack, code, name, outputSize, cause, codecImportFailed } = error;
-				const responseError = new Error(message);
-				Object.assign(responseError, { stack, code, name, outputSize });
-				if (cause) {
-					responseError.cause = Object.assign(new Error(cause.message), { name: cause.name });
-				}
-				if (codecImportFailed) {
-					responseError.codecImportFailed = true;
-				}
-				close(responseError);
-			} else {
-				if (type == MESSAGE_PULL) {
-					const { value, done } = await reader.read();
-					if (!stale()) {
-						sendMessage({ type: MESSAGE_DATA, value, done, messageId }, workerData);
-					}
-				}
-				if (type == MESSAGE_DATA) {
-					await writer.ready;
-					await writer.write(new Uint8Array(value));
-					if (!stale()) {
-						sendMessage({ type: MESSAGE_ACK_DATA, messageId }, workerData);
-					}
-				}
-				if (type == MESSAGE_CLOSE) {
-					close(null, result);
-				}
-			}
-		} catch (error) {
-			if (!stale()) {
-				terminateWorker$1(workerData);
-				close(error);
-			}
-		}
-
-		function close(error, result) {
-			if (stale()) {
-				return;
-			}
-			if (error) {
-				rejectResult(error);
-			} else {
-				resolveResult(result);
-			}
-			if (writer) {
-				writer.releaseLock();
-			}
-			if (!(error && error.codecImportFailed)) {
-				onTaskFinished();
-			}
-		}
-	}
-
 	/*
 	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
 
@@ -4350,9 +3946,13 @@
 	const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
 	const OPTION_LOCAL_EXTRA_FIELD = "localExtraField";
 	const OPTION_STRICTNESS = "strictness";
+	const OPTION_FILENAME_VALIDATION = "filenameValidation";
+	const OPTION_NORMALIZE_FILENAME = "normalizeFilename";
 	const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
 	const OPTION_DECRYPT_CENTRAL_DIRECTORY = "decryptCentralDirectory";
 	const OPTION_SIGN_CENTRAL_DIRECTORY = "signCentralDirectory";
+	const TEXT_TYPE_FILENAME = "filename";
+	const TEXT_TYPE_COMMENT = "comment";
 	const STRICTNESS_STRICT = "strict";
 	const STRICTNESS_BALANCED = "balanced";
 	const STRICTNESS_TOLERANT = "tolerant";
@@ -4399,6 +3999,11 @@
 	const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
 	const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 	const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
+	const ERR_UNSAFE_FILENAME = "Unsafe filename";
+	const ERR_INVALID_STRICTNESS = "Invalid strictness (must be 'strict', 'balanced' or 'tolerant')";
+	const ERR_INVALID_FILENAME_VALIDATION = "Invalid filenameValidation (must be 'strict', 'balanced' or 'tolerant')";
+	const ERR_INVALID_MAX_APPENDED_DATA_SIZE = "Invalid maxAppendedDataSize (must be a number greater than or equal to 0)";
+	const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
 	const CHARSET_UTF8 = "utf-8";
 	const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 	const CHARSET_CP437 = "cp437";
@@ -4420,6 +4025,10 @@
 			bytes: 8
 		}
 	};
+	const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+	const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+	const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+	const CENTRAL_DIRECTORY_REACHABLE = 2;
 
 	class ZipReader {
 
@@ -4448,6 +4057,8 @@
 			const checkAmbiguity = strictness == STRICTNESS_STRICT;
 			const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
 			const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue$1(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+			const filenameValidation = getFilenameValidation(getOptionValue$1(zipReader, options, OPTION_FILENAME_VALIDATION), strictness);
+			const normalizeFilename = getOptionValue$1(zipReader, options, OPTION_NORMALIZE_FILENAME);
 			const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 			if (!endOfDirectoryInfo) {
 				const signatureArray = await readUint8Array(reader, 0, 4);
@@ -4641,11 +4252,22 @@
 				const decode = getOptionValue$1(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 				const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 				const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
-				let filename = decode(rawFilename, rawFilenameEncoding);
+				let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
 				if (filename === UNDEFINED_VALUE) {
 					filename = decodeText(rawFilename, rawFilenameEncoding);
 				}
-				let comment = decode(rawComment, rawCommentEncoding);
+				if (normalizeFilename) {
+					const normalizedFilename = normalizeFilename(filename);
+					if (normalizedFilename !== UNDEFINED_VALUE) {
+						filename = normalizedFilename;
+					}
+				}
+				if (isUnsafeFilename(filename, filenameValidation)) {
+					const error = new Error(ERR_UNSAFE_FILENAME);
+					error.filename = filename;
+					throw error;
+				}
+				let comment = decode(rawComment, rawCommentEncoding, TEXT_TYPE_COMMENT);
 				if (comment === UNDEFINED_VALUE) {
 					comment = decodeText(rawComment, rawCommentEncoding);
 				}
@@ -4706,10 +4328,10 @@
 				entry.getData = (writer, options) => fileEntry.getData(writer, entry, zipReader.readRanges, options);
 				entry.arrayBuffer = async options => {
 					const writer = new TransformStream();
-					const [arrayBuffer] = await Promise.all([
-						streamToBlob(writer.readable).then(blob => blob.arrayBuffer()),
-						fileEntry.getData(writer, entry, zipReader.readRanges, options)]);
-					return arrayBuffer;
+					const arrayBufferPromise = streamToBlob(writer.readable).then(blob => blob.arrayBuffer());
+					arrayBufferPromise.catch(() => { });
+					await fileEntry.getData(writer, entry, zipReader.readRanges, options);
+					return arrayBufferPromise;
 				};
 				offset = endOffset;
 				const { onprogress } = options;
@@ -4920,7 +4542,7 @@
 					readRanges
 				});
 			}
-			let writable;
+			let writable, abortError;
 			try {
 				if (!checkOverlappingEntryOnly) {
 					if (checkPasswordOnly) {
@@ -4940,12 +4562,22 @@
 					writer.size += error.outputSize;
 				}
 				if (!checkPasswordOnly || error.message != ERR_ABORT_CHECK_PASSWORD) {
+					abortError = error;
 					throw error;
 				}
 			} finally {
 				const preventClose = getOptionValue$1(zipEntry, options, OPTION_PREVENT_CLOSE);
 				if (!preventClose && writable && !writable.locked) {
-					await writable.getWriter().close();
+					const writableWriter = writable.getWriter();
+					if (abortError) {
+						try {
+							await writableWriter.abort(abortError);
+						} catch {
+							// the error being propagated is more relevant; ignored
+						}
+					} else {
+						await writableWriter.close();
+					}
 				}
 			}
 			return checkPasswordOnly || checkOverlappingEntryOnly ? UNDEFINED_VALUE : writer.getData ? writer.getData() : writable;
@@ -5325,16 +4957,51 @@
 		return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 	}
 
+	function isStrictnessValue(value) {
+		return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
+	}
+
 	function getStrictness(strictness, checkAmbiguity) {
 		if (strictness === UNDEFINED_VALUE) {
 			return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
 		}
+		if (!isStrictnessValue(strictness)) {
+			throw new Error(ERR_INVALID_STRICTNESS);
+		}
 		return strictness;
 	}
 
+	function getFilenameValidation(filenameValidation, strictness) {
+		if (filenameValidation === UNDEFINED_VALUE) {
+			return strictness;
+		}
+		if (!isStrictnessValue(filenameValidation)) {
+			throw new Error(ERR_INVALID_FILENAME_VALIDATION);
+		}
+		return filenameValidation;
+	}
+
+	function isUnsafeFilename(filename, filenameValidation) {
+		if (filenameValidation == STRICTNESS_TOLERANT) {
+			return false;
+		}
+		const pathParts = filename.split("/");
+		if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
+			pathParts.pop();
+		}
+		if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+			return true;
+		}
+		return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+	}
+
 	function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 		if (maxAppendedDataSize !== UNDEFINED_VALUE) {
-			return maxAppendedDataSize;
+			const size = toNumber$1(maxAppendedDataSize);
+			if (typeof size != NUMBER_TYPE || Number.isNaN(size) || size < 0) {
+				throw new Error(ERR_INVALID_MAX_APPENDED_DATA_SIZE);
+			}
+			return size;
 		}
 		if (strictness == STRICTNESS_STRICT) {
 			return 0;
@@ -5345,12 +5012,6 @@
 		return MAX_16_BITS;
 	}
 
-	const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
-
-	const CENTRAL_DIRECTORY_UNREACHABLE = 0;
-	const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
-	const CENTRAL_DIRECTORY_REACHABLE = 2;
-
 	async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 		const { size } = reader;
 		const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
@@ -5486,6 +5147,10 @@
 		return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 	}
 
+	function toNumber$1(value) {
+		return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+	}
+
 	function getDate(timeRaw) {
 		const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 		return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
@@ -5524,15 +5189,18 @@
 		ERR_INVALID_AUTHENTICATION_CODE: ERR_INVALID_AUTHENTICATION_CODE,
 		ERR_INVALID_COMPRESSED_DATA: ERR_INVALID_COMPRESSED_DATA,
 		ERR_INVALID_CRC32: ERR_INVALID_CRC32,
+		ERR_INVALID_FILENAME_VALIDATION: ERR_INVALID_FILENAME_VALIDATION,
+		ERR_INVALID_MAX_APPENDED_DATA_SIZE: ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 		ERR_INVALID_PASSWORD: ERR_INVALID_PASSWORD,
 		ERR_INVALID_SIGNATURE: ERR_INVALID_SIGNATURE,
+		ERR_INVALID_STRICTNESS: ERR_INVALID_STRICTNESS,
 		ERR_INVALID_UNCOMPRESSED_SIZE: ERR_INVALID_UNCOMPRESSED_SIZE,
 		ERR_LOCAL_FILE_HEADER_NOT_FOUND: ERR_LOCAL_FILE_HEADER_NOT_FOUND,
 		ERR_OVERLAPPING_ENTRY: ERR_OVERLAPPING_ENTRY,
 		ERR_SPLIT_ZIP_FILE: ERR_SPLIT_ZIP_FILE,
+		ERR_UNSAFE_FILENAME: ERR_UNSAFE_FILENAME,
 		ERR_UNSUPPORTED_COMPRESSION: ERR_UNSUPPORTED_COMPRESSION$1,
 		ERR_UNSUPPORTED_ENCRYPTION: ERR_UNSUPPORTED_ENCRYPTION,
-		ERR_WORKER_STARTUP_TIMEOUT: ERR_WORKER_STARTUP_TIMEOUT,
 		ZipReader: ZipReader
 	});
 
@@ -5590,6 +5258,8 @@
 	const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 	const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 	const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
+	const ERR_INVALID_LEVEL = "Invalid level (must be integer 0..9)";
+	const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 	const ERR_INVALID_SIGNATURE_DATA = "Signature data exceeds 64KB";
 
 	const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
@@ -5597,6 +5267,7 @@
 	const VENDOR_VERSION_AE_1 = 1;
 	const INFOZIP_EXTRA_FIELD_TYPE$1 = "infozip";
 	const UNIX_EXTRA_FIELD_TYPE = "unix";
+	const MAX_LEVEL = 9;
 
 	let workers = 0;
 	const pendingEntries = [];
@@ -5759,7 +5430,8 @@
 
 		remove(entry) {
 			const { filenames, files } = this;
-			if (typeof entry == "string") {
+			// deno-lint-ignore valid-typeof
+			if (typeof entry == STRING_TYPE) {
 				entry = files.get(entry);
 			}
 			if (entry && entry.filename !== UNDEFINED_VALUE) {
@@ -5835,20 +5507,20 @@
 		let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 		let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
 		const executable = getOptionValue(zipWriter, options, PROPERTY_NAME_EXECUTABLE);
-		const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
-		const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
-		let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
+		const uid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UID);
+		const gid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_GID);
+		let unixMode = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
 		let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 		let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 		let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 		let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
-		if (uid !== UNDEFINED_VALUE && (uid < 0 || uid > MAX_32_BITS)) {
+		if (uid !== UNDEFINED_VALUE && (!Number.isInteger(uid) || uid < 0 || uid > MAX_32_BITS)) {
 			throw new Error(ERR_INVALID_UID);
 		}
-		if (gid !== UNDEFINED_VALUE && (gid < 0 || gid > MAX_32_BITS)) {
+		if (gid !== UNDEFINED_VALUE && (!Number.isInteger(gid) || gid < 0 || gid > MAX_32_BITS)) {
 			throw new Error(ERR_INVALID_GID);
 		}
-		if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
+		if (unixMode !== UNDEFINED_VALUE && (!Number.isInteger(unixMode) || unixMode < 0 || unixMode > MAX_16_BITS)) {
 			throw new Error(ERR_INVALID_UNIX_MODE);
 		}
 		if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE$1 && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
@@ -5960,7 +5632,7 @@
 
 	function resolveMetadata(zipWriter, name, options) {
 		const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
-		let rawFilename = encode(name);
+		let rawFilename = encode(name, TEXT_TYPE_FILENAME);
 		if (rawFilename === UNDEFINED_VALUE) {
 			rawFilename = encodeText(name);
 		}
@@ -5968,7 +5640,7 @@
 			throw new Error(ERR_INVALID_ENTRY_NAME);
 		}
 		const comment = options[PROPERTY_NAME_COMMENT] || "";
-		let rawComment = encode(comment);
+		let rawComment = encode(comment, TEXT_TYPE_COMMENT);
 		if (rawComment === UNDEFINED_VALUE) {
 			rawComment = encodeText(comment);
 		}
@@ -5988,8 +5660,11 @@
 		if (!passThrough) {
 			password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
 			rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+			if ((password && typeof password != STRING_TYPE) || (rawPassword && !(rawPassword instanceof Uint8Array))) {
+				throw new Error(ERR_INVALID_PASSWORD_TYPE);
+			}
 		}
-		const encryptionStrength = getOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
+		const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 		const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 		const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
 		const ntfsTimestamp = getOptionValue(zipWriter, options, OPTION_NTFS_TIMESTAMP);
@@ -6007,7 +5682,10 @@
 			compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE && !registeredCodec) {
 			throw new Error(ERR_UNSUPPORTED_COMPRESSION);
 		}
-		let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
+		let level = getNumberOptionValue(zipWriter, options, OPTION_LEVEL);
+		if (level !== UNDEFINED_VALUE && (!Number.isInteger(level) || level < 0 || level > MAX_LEVEL)) {
+			throw new Error(ERR_INVALID_LEVEL);
+		}
 		if (zipWriter.options[OPTION_USDZ]) {
 			if (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) {
 				throw new Error(ERR_UNSUPPORTED_ENCRYPTION_USDZ);
@@ -6028,7 +5706,7 @@
 			useCompressionStream = false;
 		}
 		const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
+		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(Number.isInteger(encryptionStrength) && encryptionStrength >= 1 && encryptionStrength <= 3)) {
 			throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 		}
 		const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
@@ -7222,6 +6900,14 @@
 		return result === UNDEFINED_VALUE ? defaultValue : result;
 	}
 
+	function getNumberOptionValue(zipWriter, options, name, defaultValue) {
+		return toNumber(getOptionValue(zipWriter, options, name, defaultValue));
+	}
+
+	function toNumber(value) {
+		return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+	}
+
 	function getMaximumCompressedSize(uncompressedSize) {
 		return uncompressedSize + (5 * (Math.floor(uncompressedSize / 16383) + 1));
 	}
@@ -7356,6 +7042,7 @@
 
 	const ERR_ENTRY_EXISTS = "Entry filename already exists";
 	const ERR_READABLE_CONSUMED = "Readable stream already consumed";
+	const ERR_ABORT_EXPORT = "zipjs-abort-export";
 	const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 	const INTERPRETED_EXTRA_FIELD_TYPES = new Set([
 		EXTRAFIELD_TYPE_ZIP64,
@@ -7464,8 +7151,9 @@
 				const uncompressedSize = zipEntry.data ? zipEntry.data.uncompressedSize : reader.size;
 				await Promise.all([initStream(reader), initStream(writer, uncompressedSize)]);
 				const { readable } = reader;
+				const { signal } = options;
 				zipEntry.uncompressedSize = reader.size;
-				await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable));
+				await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable), { signal });
 				return writer.getData ? writer.getData() : writer.writable;
 			}
 		}
@@ -7732,7 +7420,7 @@
 			for (const entry of entries) {
 				let parent = this;
 				try {
-					const path = entry.filename.split("/");
+					const path = entry.filename.split("/").filter(pathPart => pathPart != "" && pathPart != ".");
 					const name = path.pop();
 					path.forEach(pathPart => {
 						const previousParent = parent;
@@ -8107,6 +7795,39 @@
 		}
 	}
 
+	function forwardAbort(signal, abortController) {
+		if (!signal) {
+			return () => { };
+		}
+		if (signal.aborted) {
+			abortController.abort(signal.reason);
+			return () => { };
+		}
+		const abort = () => abortController.abort(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+		return () => signal.removeEventListener("abort", abort);
+	}
+
+	function isExportAborted(error) {
+		return Boolean(error) && error.message == ERR_ABORT_EXPORT;
+	}
+
+	function aggregateEntryErrors(errors) {
+		const [error] = errors;
+		const otherErrors = errors
+			.slice(1)
+			.flatMap(otherError => [otherError, ...(otherError && otherError.entryErrors || [])])
+			.filter(otherError => otherError !== error);
+		if (otherErrors.length) {
+			try {
+				error.entryErrors = [...(error.entryErrors || []), ...otherErrors];
+			} catch {
+				// ignored
+			}
+		}
+		return error;
+	}
+
 	function getUserExtraField(extraField) {
 		if (extraField) {
 			const userExtraField = new Map();
@@ -8227,8 +7948,9 @@
 	function addFileSystemHandle(zipEntry, handle, options) {
 		return addFile(zipEntry, handle, []);
 
-		async function addFile(parentEntry, handle, addedEntries) {
+		async function addFile(parentEntry, handle, addedEntries, parentName = "") {
 			if (handle) {
+				const entryName = parentName ? parentName + "/" + handle.name : handle.name;
 				try {
 					if (handle.isFile || handle.isDirectory) {
 						handle = await transformToFileSystemhandle(handle);
@@ -8250,12 +7972,18 @@
 						const directoryEntry = parentEntry.addDirectory(handle.name);
 						addedEntries.push(directoryEntry);
 						for await (const childHandle of handle.values()) {
-							await addFile(directoryEntry, childHandle, addedEntries);
+							await addFile(directoryEntry, childHandle, addedEntries, entryName);
 						}
 					}
 				} catch (error) {
-					const message = error.message + (handle ? " (" + handle.name + ")" : "");
-					throw new Error(message, { cause: error });
+					try {
+						if (error.entryName === UNDEFINED_VALUE) {
+							error.entryName = entryName;
+						}
+					} catch {
+						// ignored
+					}
+					throw error;
 				}
 			}
 			return addedEntries;
@@ -8265,15 +7993,32 @@
 	async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 		const totalSize = getTotalSize([zipEntry], "uncompressedSize");
 		const writtenSizes = new Map();
-		await exportChildren(zipEntry, directoryHandle);
+		const abortController = new AbortController();
+		const { signal } = abortController;
+		const releaseSignal = forwardAbort(options.signal, abortController);
+		const exportedEntryNames = [];
+		try {
+			await exportChildren(zipEntry, directoryHandle);
+		} catch (error) {
+			try {
+				error.exportedEntryNames = exportedEntryNames;
+			} catch {
+				// ignored
+			}
+			throw error;
+		} finally {
+			releaseSignal();
+		}
 		return directoryHandle;
 
 		async function exportChildren(entry, parentHandle) {
 			if (options.concurrent) {
 				const results = await Promise.allSettled(entry.children.map(child => exportChild(child, parentHandle)));
-				const failedResult = results.find(result => result.status == "rejected");
-				if (failedResult) {
-					throw failedResult.reason;
+				const rejectedResults = results.filter(result => result.status == "rejected");
+				if (rejectedResults.length) {
+					const failedResults = rejectedResults.filter(result => !isExportAborted(result.reason));
+					const reportedResults = failedResults.length ? failedResults : rejectedResults;
+					throw aggregateEntryErrors(reportedResults.map(result => result.reason));
 				}
 			} else {
 				for (const child of entry.children) {
@@ -8283,6 +8028,12 @@
 		}
 
 		async function exportChild(child, parentHandle) {
+			if (signal.aborted) {
+				if (isExportAborted(signal.reason)) {
+					return;
+				}
+				throw signal.reason;
+			}
 			try {
 				if (child.directory) {
 					const childDirectoryHandle = await parentHandle.getDirectoryHandle(child.name, { create: true });
@@ -8291,6 +8042,7 @@
 					const fileHandle = await parentHandle.getFileHandle(child.name, { create: true });
 					const writable = await fileHandle.createWritable();
 					await child.getData({ writable }, Object.assign({}, options, {
+						signal,
 						onprogress: async progress => {
 							if (options.onprogress) {
 								writtenSizes.set(child.id, progress);
@@ -8302,9 +8054,19 @@
 							}
 						}
 					}));
+					exportedEntryNames.push(child.getRelativeName(zipEntry));
 				}
 			} catch (error) {
-				throw new Error(error.message + (child ? " (" + child.name + ")" : ""), { cause: error });
+				abortController.abort(new Error(ERR_ABORT_EXPORT));
+				try {
+					if (error.entryName === UNDEFINED_VALUE) {
+						error.entryName = child.getRelativeName(zipEntry);
+						error.entryId = child.id;
+					}
+				} catch {
+					// ignored
+				}
+				throw error;
 			}
 		}
 	}