@zip.js/zip.js 2.8.49 → 2.8.51

package/dist/zip-core.js

@@ -4,7 +4,7 @@
 	(global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.zip = {}));
 })(this, (function (exports) { 'use strict';
 
-	const { Array, Object, String, Number, BigInt, Math, Date, Map, Set, Response, URL, Error, Uint8Array, Uint16Array, Uint32Array, DataView, Blob, Promise, TextEncoder, TextDecoder, document, crypto, btoa, TransformStream, ReadableStream, WritableStream, CompressionStream, DecompressionStream, navigator, Worker } = typeof globalThis !== 'undefined' ? globalThis : this || self;
+	const { Array, Object, String, Number, BigInt, Math, Date, Map, Set, Response, URL, Error, Uint8Array, Uint16Array, Uint32Array, DataView, Blob, Promise, TextEncoder, TextDecoder, document, crypto, btoa, TransformStream, ReadableStream, WritableStream, CompressionStream, DecompressionStream, navigator, Worker, Symbol, setTimeout, clearTimeout, structuredClone } = typeof globalThis !== 'undefined' ? globalThis : this || self;
 
 	var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 	/*
@@ -117,6 +117,8 @@
 	const UNDEFINED_TYPE = "undefined";
 	const FUNCTION_TYPE = "function";
 	const OBJECT_TYPE = "object";
+	const STRING_TYPE = "string";
+	const NUMBER_TYPE = "number";
 
 	const EMPTY_UINT8_ARRAY = new Uint8Array();
 
@@ -246,7 +248,7 @@
 	}
 
 	/*
-	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+	 Copyright (c) 2026 Gildas Lormeau. All rights reserved.
 
 	 Redistribution and use in source and binary forms, with or without
 	 modification, are permitted provided that the following conditions are met:
@@ -274,72 +276,19 @@
 	 */
 
 
-	const ERR_INVALID_CODEC_DEFINITION = "Invalid codec definition";
-	const ERR_RESERVED_COMPRESSION_METHOD = "Reserved compression method";
-	const ERR_INVALID_CODEC_MODULE = "Invalid codec module";
-
-	const STRING_TYPE = "string";
-	const RESERVED_COMPRESSION_METHODS = [
-		COMPRESSION_METHOD_STORE,
-		COMPRESSION_METHOD_DEFLATE,
-		COMPRESSION_METHOD_DEFLATE_64,
-		COMPRESSION_METHOD_AES
-	];
-
-	const registeredCodecs = new Map();
-	const codecStreams = new Map();
-
-	function registerCodec(codec = {}) {
-		const { compressionMethod, format, codecURI, CompressionStream, DecompressionStream, versionNeeded } = codec;
-		if (!Number.isInteger(compressionMethod) || compressionMethod < 0 || compressionMethod > MAX_16_BITS ||
-			typeof format != STRING_TYPE || !format.length) {
-			throw new Error(ERR_INVALID_CODEC_DEFINITION);
-		}
-		if (RESERVED_COMPRESSION_METHODS.includes(compressionMethod)) {
-			throw new Error(ERR_RESERVED_COMPRESSION_METHOD);
-		}
-		const hasStreams = typeof CompressionStream == FUNCTION_TYPE || typeof DecompressionStream == FUNCTION_TYPE;
-		if (!hasStreams && (typeof codecURI != STRING_TYPE || !codecURI.length)) {
-			throw new Error(ERR_INVALID_CODEC_DEFINITION);
-		}
-		registeredCodecs.set(compressionMethod, { compressionMethod, format, codecURI, versionNeeded });
-		if (hasStreams) {
-			setCodecStreams(format, { CompressionStream, DecompressionStream });
-		}
-	}
-
-	function unregisterCodec(compressionMethod) {
-		const codec = registeredCodecs.get(compressionMethod);
-		if (codec) {
-			registeredCodecs.delete(compressionMethod);
-			let formatUsed;
-			registeredCodecs.forEach(otherCodec => formatUsed = formatUsed || otherCodec.format == codec.format);
-			if (!formatUsed) {
-				codecStreams.delete(codec.format);
-			}
-		}
-	}
-
-	function getRegisteredCodec(compressionMethod) {
-		return registeredCodecs.get(compressionMethod);
-	}
-
-	function getCodecStreams(format) {
-		return codecStreams.get(format);
+	function concat(first, second) {
+		const result = new Uint8Array(first.length + second.length);
+		result.set(first);
+		result.set(second, first.length);
+		return result;
 	}
 
-	function setCodecStreams(format, streams) {
-		const { CompressionStream, DecompressionStream } = streams;
-		if (typeof CompressionStream != FUNCTION_TYPE && typeof DecompressionStream != FUNCTION_TYPE) {
-			throw new Error(ERR_INVALID_CODEC_MODULE);
-		}
-		codecStreams.set(format, { CompressionStream, DecompressionStream });
+	function toExactUint8Array(array) {
+		return array.byteOffset || array.byteLength != array.buffer.byteLength ? new Uint8Array(array) : array;
 	}
 
-	async function ensureCodecStreams(format, codecURI) {
-		if (!codecStreams.has(format) && codecURI) {
-			setCodecStreams(format, await import(/* webpackIgnore: true */ /* @vite-ignore */ codecURI));
-		}
+	function getDataView(array) {
+		return new DataView(array.buffer, array.byteOffset, array.byteLength);
 	}
 
 	/*
@@ -524,50 +473,6 @@
 		}
 	}
 
-	/*
-	 Copyright (c) 2026 Gildas Lormeau. All rights reserved.
-
-	 Redistribution and use in source and binary forms, with or without
-	 modification, are permitted provided that the following conditions are met:
-
-	 1. Redistributions of source code must retain the above copyright notice,
-	 this list of conditions and the following disclaimer.
-
-	 2. Redistributions in binary form must reproduce the above copyright
-	 notice, this list of conditions and the following disclaimer in
-	 the documentation and/or other materials provided with the distribution.
-
-	 3. The names of the authors may not be used to endorse or promote products
-	 derived from this software without specific prior written permission.
-
-	 THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
-	 INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-	 FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
-	 INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
-	 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-	 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
-	 OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-	 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-	 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-	 */
-
-
-	function concat(first, second) {
-		const result = new Uint8Array(first.length + second.length);
-		result.set(first);
-		result.set(second, first.length);
-		return result;
-	}
-
-	function toExactUint8Array(array) {
-		return array.byteOffset || array.byteLength != array.buffer.byteLength ? new Uint8Array(array) : array;
-	}
-
-	function getDataView(array) {
-		return new DataView(array.buffer, array.byteOffset, array.byteLength);
-	}
-
 	// Derived from https://github.com/xqdoo00o/jszip/blob/master/lib/sjcl.js and https://github.com/bitwiseshiftleft/sjcl
 
 	// deno-lint-ignore-file no-this-alias
@@ -1937,6 +1842,102 @@
 		});
 	}
 
+	/*
+	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+
+	 Redistribution and use in source and binary forms, with or without
+	 modification, are permitted provided that the following conditions are met:
+
+	 1. Redistributions of source code must retain the above copyright notice,
+	 this list of conditions and the following disclaimer.
+
+	 2. Redistributions in binary form must reproduce the above copyright
+	 notice, this list of conditions and the following disclaimer in
+	 the documentation and/or other materials provided with the distribution.
+
+	 3. The names of the authors may not be used to endorse or promote products
+	 derived from this software without specific prior written permission.
+
+	 THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
+	 INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+	 FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
+	 INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
+	 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+	 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+	 OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+	 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+	 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+	 */
+
+
+	const ERR_INVALID_CODEC_DEFINITION = "Invalid codec definition";
+	const ERR_RESERVED_COMPRESSION_METHOD = "Reserved compression method";
+	const ERR_INVALID_CODEC_MODULE = "Invalid codec module";
+
+	const RESERVED_COMPRESSION_METHODS = [
+		COMPRESSION_METHOD_STORE,
+		COMPRESSION_METHOD_DEFLATE,
+		COMPRESSION_METHOD_DEFLATE_64,
+		COMPRESSION_METHOD_AES
+	];
+
+	const registeredCodecs = new Map();
+	const codecStreams = new Map();
+
+	function registerCodec(codec = {}) {
+		const { compressionMethod, format, codecURI, CompressionStream, DecompressionStream, versionNeeded } = codec;
+		if (!Number.isInteger(compressionMethod) || compressionMethod < 0 || compressionMethod > MAX_16_BITS ||
+			typeof format != STRING_TYPE || !format.length) {
+			throw new Error(ERR_INVALID_CODEC_DEFINITION);
+		}
+		if (RESERVED_COMPRESSION_METHODS.includes(compressionMethod)) {
+			throw new Error(ERR_RESERVED_COMPRESSION_METHOD);
+		}
+		const hasStreams = typeof CompressionStream == FUNCTION_TYPE || typeof DecompressionStream == FUNCTION_TYPE;
+		if (!hasStreams && (typeof codecURI != STRING_TYPE || !codecURI.length)) {
+			throw new Error(ERR_INVALID_CODEC_DEFINITION);
+		}
+		registeredCodecs.set(compressionMethod, { compressionMethod, format, codecURI, versionNeeded });
+		if (hasStreams) {
+			setCodecStreams(format, { CompressionStream, DecompressionStream });
+		}
+	}
+
+	function unregisterCodec(compressionMethod) {
+		const codec = registeredCodecs.get(compressionMethod);
+		if (codec) {
+			registeredCodecs.delete(compressionMethod);
+			let formatUsed;
+			registeredCodecs.forEach(otherCodec => formatUsed = formatUsed || otherCodec.format == codec.format);
+			if (!formatUsed) {
+				codecStreams.delete(codec.format);
+			}
+		}
+	}
+
+	function getRegisteredCodec(compressionMethod) {
+		return registeredCodecs.get(compressionMethod);
+	}
+
+	function getCodecStreams(format) {
+		return codecStreams.get(format);
+	}
+
+	function setCodecStreams(format, streams) {
+		const { CompressionStream, DecompressionStream } = streams;
+		if (typeof CompressionStream != FUNCTION_TYPE && typeof DecompressionStream != FUNCTION_TYPE) {
+			throw new Error(ERR_INVALID_CODEC_MODULE);
+		}
+		codecStreams.set(format, { CompressionStream, DecompressionStream });
+	}
+
+	async function ensureCodecStreams(format, codecURI) {
+		if (!codecStreams.has(format) && codecURI) {
+			setCodecStreams(format, await import(/* webpackIgnore: true */ /* @vite-ignore */ codecURI));
+		}
+	}
+
 	/*
 	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
 
@@ -2490,8 +2491,8 @@
 	 1. Redistributions of source code must retain the above copyright notice,
 	 this list of conditions and the following disclaimer.
 
-	 2. Redistributions in binary form must reproduce the above copyright 
-	 notice, this list of conditions and the following disclaimer in 
+	 2. Redistributions in binary form must reproduce the above copyright
+	 notice, this list of conditions and the following disclaimer in
 	 the documentation and/or other materials provided with the distribution.
 
 	 3. The names of the authors may not be used to endorse or promote products
@@ -2510,20 +2511,15 @@
 	 */
 
 
-	const MODULE_WORKER_OPTIONS = { type: "module" };
-	const ERROR_EVENT_TYPE = "error";
-	const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
 	const ERR_WORKER_STARTUP_TIMEOUT = "Worker startup timeout";
 
-	let webWorkerSupported, webWorkerSource, webWorkerURI, webWorkerOptions, createWorkerFailed;
-	let transferStreamsSupported = true;
-	try {
-		transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
-	} catch {
-		// ignored
-	}
+	let webWorkerSupported, createWorkerFailed, webWorkerBackend;
 	let initModule = () => { };
 
+	function setWebWorkerBackend(backend) {
+		webWorkerBackend = backend;
+	}
+
 	async function supportsDeflate(config) {
 		const { CompressionStream: NativeStream, CompressionStreamFallback: FallbackStream } = config;
 		if (FallbackStream && !FallbackStream.requiresModule) {
@@ -2548,6 +2544,14 @@
 		createWorkerFailed = false;
 	}
 
+	function disableWebWorker(workerData) {
+		if (workerData.createWorker) {
+			createWorkerFailed = true;
+		} else {
+			webWorkerSupported = false;
+		}
+	}
+
 	class CodecWorker {
 
 		constructor(workerData, { readable, writable }, { options, config, streamOptions, useWebWorkers, transferStreams, workerURI, createWorker }, onTaskFinished) {
@@ -2600,7 +2604,7 @@
 				// deno-lint-ignore valid-typeof
 				webWorkerSupported = typeof Worker != UNDEFINED_TYPE;
 			}
-			return (useWebWorkers && ((webWorkerSupported && workerURI) || createWorker) ? createWebWorkerInterface : createWorkerInterface)(workerData, config);
+			return (useWebWorkers && webWorkerBackend && ((webWorkerSupported && workerURI) || createWorker) ? webWorkerBackend : createWorkerInterface)(workerData, config);
 		}
 	}
 
@@ -2644,60 +2648,6 @@
 		};
 	}
 
-	function createWebWorkerInterface(workerData, config) {
-		const { baseURI, chunkSize, workerStartupTimeout } = config;
-		let { wasmURI } = config;
-
-		if (!workerData.interface) {
-			// deno-lint-ignore valid-typeof
-			if (typeof wasmURI == FUNCTION_TYPE) {
-				wasmURI = wasmURI();
-			}
-			let worker;
-			try {
-				worker = getWebWorker(workerData.workerURI, baseURI, workerData);
-			} catch {
-				if (workerData.createWorker) {
-					createWorkerFailed = true;
-				} else {
-					webWorkerSupported = false;
-				}
-				return createWorkerInterface(workerData, config);
-			}
-			Object.assign(workerData, {
-				worker,
-				workerAlive: false,
-				terminated: false,
-				interface: {
-					run: async () => {
-						try {
-							return await runWebWorker(workerData, { chunkSize, wasmURI, baseURI, workerStartupTimeout });
-						} catch (error) {
-							if (error && error.workerStartupFailed) {
-								if (workerData.createWorker) {
-									createWorkerFailed = true;
-								} else {
-									webWorkerSupported = false;
-								}
-								releaseWorkerStreams(workerData);
-								return runWorker$1(workerData, config);
-							}
-							if (error && error.codecImportFailed) {
-								if (workerData.reader) {
-									releaseWorkerStreams(workerData);
-									return runWorker$1(workerData, config);
-								}
-								workerData.onTaskFinished();
-							}
-							throw error;
-						}
-					}
-				}
-			});
-		}
-		return workerData.interface;
-	}
-
 	async function runWorker$1({ options, readable, writable, onTaskFinished }, config) {
 		let codecStream;
 		try {
@@ -2746,6 +2696,95 @@
 		}
 	}
 
+	/*
+	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+
+	 Redistribution and use in source and binary forms, with or without
+	 modification, are permitted provided that the following conditions are met:
+
+	 1. Redistributions of source code must retain the above copyright notice,
+	 this list of conditions and the following disclaimer.
+
+	 2. Redistributions in binary form must reproduce the above copyright
+	 notice, this list of conditions and the following disclaimer in
+	 the documentation and/or other materials provided with the distribution.
+
+	 3. The names of the authors may not be used to endorse or promote products
+	 derived from this software without specific prior written permission.
+
+	 THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
+	 INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+	 FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
+	 INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
+	 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+	 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+	 OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+	 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+	 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+	 */
+
+
+	const MODULE_WORKER_OPTIONS = { type: "module" };
+	const ERROR_EVENT_TYPE = "error";
+	const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
+
+	let webWorkerSource, webWorkerURI, webWorkerOptions;
+	let transferStreamsSupported = true;
+	try {
+		transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
+	} catch {
+		// ignored
+	}
+
+	setWebWorkerBackend(createWebWorkerInterface);
+
+	function createWebWorkerInterface(workerData, config) {
+		const { baseURI, chunkSize, workerStartupTimeout } = config;
+		let { wasmURI } = config;
+
+		if (!workerData.interface) {
+			// deno-lint-ignore valid-typeof
+			if (typeof wasmURI == FUNCTION_TYPE) {
+				wasmURI = wasmURI();
+			}
+			let worker;
+			try {
+				worker = getWebWorker(workerData.workerURI, baseURI, workerData);
+			} catch {
+				disableWebWorker(workerData);
+				return createWorkerInterface(workerData, config);
+			}
+			Object.assign(workerData, {
+				worker,
+				workerAlive: false,
+				terminated: false,
+				interface: {
+					run: async () => {
+						try {
+							return await runWebWorker(workerData, { chunkSize, wasmURI, baseURI, workerStartupTimeout });
+						} catch (error) {
+							if (error && error.workerStartupFailed) {
+								disableWebWorker(workerData);
+								releaseWorkerStreams(workerData);
+								return runWorker$1(workerData, config);
+							}
+							if (error && error.codecImportFailed) {
+								if (workerData.reader) {
+									releaseWorkerStreams(workerData);
+									return runWorker$1(workerData, config);
+								}
+								workerData.onTaskFinished();
+							}
+							throw error;
+						}
+					}
+				}
+			});
+		}
+		return workerData.interface;
+	}
+
 	async function runWebWorker(workerData, config) {
 		let resolveResult, rejectResult;
 		const result = new Promise((resolve, reject) => {
@@ -3622,7 +3661,7 @@
 			forceRangeRequests,
 			combineSizeEocd
 		} = httpReader;
-		if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == "undefined" || preventHeadRequest)) {
+		if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == UNDEFINED_TYPE || preventHeadRequest)) {
 			const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, combineSizeEocd ? -END_OF_CENTRAL_DIR_LENGTH : undefined));
 			const acceptRanges = response.headers.get(HTTP_HEADER_ACCEPT_RANGES);
 			if (!forceRangeRequests && (!acceptRanges || acceptRanges.toLowerCase() != HTTP_RANGE_UNIT)) {
@@ -4475,9 +4514,13 @@
 	const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
 	const OPTION_LOCAL_EXTRA_FIELD = "localExtraField";
 	const OPTION_STRICTNESS = "strictness";
+	const OPTION_FILENAME_VALIDATION = "filenameValidation";
+	const OPTION_NORMALIZE_FILENAME = "normalizeFilename";
 	const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
 	const OPTION_DECRYPT_CENTRAL_DIRECTORY = "decryptCentralDirectory";
 	const OPTION_SIGN_CENTRAL_DIRECTORY = "signCentralDirectory";
+	const TEXT_TYPE_FILENAME = "filename";
+	const TEXT_TYPE_COMMENT = "comment";
 	const STRICTNESS_STRICT = "strict";
 	const STRICTNESS_BALANCED = "balanced";
 	const STRICTNESS_TOLERANT = "tolerant";
@@ -4524,6 +4567,11 @@
 	const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
 	const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 	const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
+	const ERR_UNSAFE_FILENAME = "Unsafe filename";
+	const ERR_INVALID_STRICTNESS = "Invalid strictness (must be 'strict', 'balanced' or 'tolerant')";
+	const ERR_INVALID_FILENAME_VALIDATION = "Invalid filenameValidation (must be 'strict', 'balanced' or 'tolerant')";
+	const ERR_INVALID_MAX_APPENDED_DATA_SIZE = "Invalid maxAppendedDataSize (must be a number greater than or equal to 0)";
+	const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
 	const CHARSET_UTF8 = "utf-8";
 	const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 	const CHARSET_CP437 = "cp437";
@@ -4545,6 +4593,10 @@
 			bytes: 8
 		}
 	};
+	const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+	const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+	const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+	const CENTRAL_DIRECTORY_REACHABLE = 2;
 
 	class ZipReader {
 
@@ -4573,6 +4625,8 @@
 			const checkAmbiguity = strictness == STRICTNESS_STRICT;
 			const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
 			const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue$1(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+			const filenameValidation = getFilenameValidation(getOptionValue$1(zipReader, options, OPTION_FILENAME_VALIDATION), strictness);
+			const normalizeFilename = getOptionValue$1(zipReader, options, OPTION_NORMALIZE_FILENAME);
 			const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 			if (!endOfDirectoryInfo) {
 				const signatureArray = await readUint8Array(reader, 0, 4);
@@ -4766,11 +4820,22 @@
 				const decode = getOptionValue$1(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 				const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 				const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
-				let filename = decode(rawFilename, rawFilenameEncoding);
+				let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
 				if (filename === UNDEFINED_VALUE) {
 					filename = decodeText(rawFilename, rawFilenameEncoding);
 				}
-				let comment = decode(rawComment, rawCommentEncoding);
+				if (normalizeFilename) {
+					const normalizedFilename = normalizeFilename(filename);
+					if (normalizedFilename !== UNDEFINED_VALUE) {
+						filename = normalizedFilename;
+					}
+				}
+				if (isUnsafeFilename(filename, filenameValidation)) {
+					const error = new Error(ERR_UNSAFE_FILENAME);
+					error.filename = filename;
+					throw error;
+				}
+				let comment = decode(rawComment, rawCommentEncoding, TEXT_TYPE_COMMENT);
 				if (comment === UNDEFINED_VALUE) {
 					comment = decodeText(rawComment, rawCommentEncoding);
 				}
@@ -4831,10 +4896,10 @@
 				entry.getData = (writer, options) => fileEntry.getData(writer, entry, zipReader.readRanges, options);
 				entry.arrayBuffer = async options => {
 					const writer = new TransformStream();
-					const [arrayBuffer] = await Promise.all([
-						streamToBlob(writer.readable).then(blob => blob.arrayBuffer()),
-						fileEntry.getData(writer, entry, zipReader.readRanges, options)]);
-					return arrayBuffer;
+					const arrayBufferPromise = streamToBlob(writer.readable).then(blob => blob.arrayBuffer());
+					arrayBufferPromise.catch(() => { });
+					await fileEntry.getData(writer, entry, zipReader.readRanges, options);
+					return arrayBufferPromise;
 				};
 				offset = endOffset;
 				const { onprogress } = options;
@@ -5085,7 +5150,7 @@
 					readRanges
 				});
 			}
-			let writable;
+			let writable, abortError;
 			try {
 				if (!checkOverlappingEntryOnly) {
 					if (checkPasswordOnly) {
@@ -5105,12 +5170,22 @@
 					writer.size += error.outputSize;
 				}
 				if (!checkPasswordOnly || error.message != ERR_ABORT_CHECK_PASSWORD) {
+					abortError = error;
 					throw error;
 				}
 			} finally {
 				const preventClose = getOptionValue$1(zipEntry, options, OPTION_PREVENT_CLOSE);
 				if (!preventClose && writable && !writable.locked) {
-					await writable.getWriter().close();
+					const writableWriter = writable.getWriter();
+					if (abortError) {
+						try {
+							await writableWriter.abort(abortError);
+						} catch {
+							// the error being propagated is more relevant; ignored
+						}
+					} else {
+						await writableWriter.close();
+					}
 				}
 			}
 			return checkPasswordOnly || checkOverlappingEntryOnly ? UNDEFINED_VALUE : writer.getData ? writer.getData() : writable;
@@ -5490,16 +5565,51 @@
 		return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 	}
 
+	function isStrictnessValue(value) {
+		return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
+	}
+
 	function getStrictness(strictness, checkAmbiguity) {
 		if (strictness === UNDEFINED_VALUE) {
 			return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
 		}
+		if (!isStrictnessValue(strictness)) {
+			throw new Error(ERR_INVALID_STRICTNESS);
+		}
 		return strictness;
 	}
 
+	function getFilenameValidation(filenameValidation, strictness) {
+		if (filenameValidation === UNDEFINED_VALUE) {
+			return strictness;
+		}
+		if (!isStrictnessValue(filenameValidation)) {
+			throw new Error(ERR_INVALID_FILENAME_VALIDATION);
+		}
+		return filenameValidation;
+	}
+
+	function isUnsafeFilename(filename, filenameValidation) {
+		if (filenameValidation == STRICTNESS_TOLERANT) {
+			return false;
+		}
+		const pathParts = filename.split("/");
+		if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
+			pathParts.pop();
+		}
+		if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+			return true;
+		}
+		return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+	}
+
 	function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 		if (maxAppendedDataSize !== UNDEFINED_VALUE) {
-			return maxAppendedDataSize;
+			const size = toNumber$1(maxAppendedDataSize);
+			if (typeof size != NUMBER_TYPE || Number.isNaN(size) || size < 0) {
+				throw new Error(ERR_INVALID_MAX_APPENDED_DATA_SIZE);
+			}
+			return size;
 		}
 		if (strictness == STRICTNESS_STRICT) {
 			return 0;
@@ -5510,12 +5620,6 @@
 		return MAX_16_BITS;
 	}
 
-	const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
-
-	const CENTRAL_DIRECTORY_UNREACHABLE = 0;
-	const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
-	const CENTRAL_DIRECTORY_REACHABLE = 2;
-
 	async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 		const { size } = reader;
 		const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
@@ -5651,6 +5755,10 @@
 		return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 	}
 
+	function toNumber$1(value) {
+		return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+	}
+
 	function getDate(timeRaw) {
 		const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 		return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
@@ -5689,12 +5797,16 @@
 		ERR_INVALID_AUTHENTICATION_CODE: ERR_INVALID_AUTHENTICATION_CODE,
 		ERR_INVALID_COMPRESSED_DATA: ERR_INVALID_COMPRESSED_DATA,
 		ERR_INVALID_CRC32: ERR_INVALID_CRC32,
+		ERR_INVALID_FILENAME_VALIDATION: ERR_INVALID_FILENAME_VALIDATION,
+		ERR_INVALID_MAX_APPENDED_DATA_SIZE: ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 		ERR_INVALID_PASSWORD: ERR_INVALID_PASSWORD,
 		ERR_INVALID_SIGNATURE: ERR_INVALID_SIGNATURE,
+		ERR_INVALID_STRICTNESS: ERR_INVALID_STRICTNESS,
 		ERR_INVALID_UNCOMPRESSED_SIZE: ERR_INVALID_UNCOMPRESSED_SIZE,
 		ERR_LOCAL_FILE_HEADER_NOT_FOUND: ERR_LOCAL_FILE_HEADER_NOT_FOUND,
 		ERR_OVERLAPPING_ENTRY: ERR_OVERLAPPING_ENTRY,
 		ERR_SPLIT_ZIP_FILE: ERR_SPLIT_ZIP_FILE,
+		ERR_UNSAFE_FILENAME: ERR_UNSAFE_FILENAME,
 		ERR_UNSUPPORTED_COMPRESSION: ERR_UNSUPPORTED_COMPRESSION$1,
 		ERR_UNSUPPORTED_ENCRYPTION: ERR_UNSUPPORTED_ENCRYPTION,
 		ERR_WORKER_STARTUP_TIMEOUT: ERR_WORKER_STARTUP_TIMEOUT,
@@ -5756,6 +5868,8 @@
 	const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 	const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 	const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
+	const ERR_INVALID_LEVEL = "Invalid level (must be integer 0..9)";
+	const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 	const ERR_INVALID_SIGNATURE_DATA = "Signature data exceeds 64KB";
 
 	const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
@@ -5763,6 +5877,7 @@
 	const VENDOR_VERSION_AE_1 = 1;
 	const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 	const UNIX_EXTRA_FIELD_TYPE = "unix";
+	const MAX_LEVEL = 9;
 
 	let workers = 0;
 	const pendingEntries = [];
@@ -5925,7 +6040,8 @@
 
 		remove(entry) {
 			const { filenames, files } = this;
-			if (typeof entry == "string") {
+			// deno-lint-ignore valid-typeof
+			if (typeof entry == STRING_TYPE) {
 				entry = files.get(entry);
 			}
 			if (entry && entry.filename !== UNDEFINED_VALUE) {
@@ -6063,20 +6179,20 @@
 		let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 		let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
 		const executable = getOptionValue(zipWriter, options, PROPERTY_NAME_EXECUTABLE);
-		const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
-		const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
-		let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
+		const uid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UID);
+		const gid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_GID);
+		let unixMode = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
 		let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 		let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 		let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 		let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
-		if (uid !== UNDEFINED_VALUE && (uid < 0 || uid > MAX_32_BITS)) {
+		if (uid !== UNDEFINED_VALUE && (!Number.isInteger(uid) || uid < 0 || uid > MAX_32_BITS)) {
 			throw new Error(ERR_INVALID_UID);
 		}
-		if (gid !== UNDEFINED_VALUE && (gid < 0 || gid > MAX_32_BITS)) {
+		if (gid !== UNDEFINED_VALUE && (!Number.isInteger(gid) || gid < 0 || gid > MAX_32_BITS)) {
 			throw new Error(ERR_INVALID_GID);
 		}
-		if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
+		if (unixMode !== UNDEFINED_VALUE && (!Number.isInteger(unixMode) || unixMode < 0 || unixMode > MAX_16_BITS)) {
 			throw new Error(ERR_INVALID_UNIX_MODE);
 		}
 		if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
@@ -6188,7 +6304,7 @@
 
 	function resolveMetadata(zipWriter, name, options) {
 		const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
-		let rawFilename = encode(name);
+		let rawFilename = encode(name, TEXT_TYPE_FILENAME);
 		if (rawFilename === UNDEFINED_VALUE) {
 			rawFilename = encodeText(name);
 		}
@@ -6196,7 +6312,7 @@
 			throw new Error(ERR_INVALID_ENTRY_NAME);
 		}
 		const comment = options[PROPERTY_NAME_COMMENT] || "";
-		let rawComment = encode(comment);
+		let rawComment = encode(comment, TEXT_TYPE_COMMENT);
 		if (rawComment === UNDEFINED_VALUE) {
 			rawComment = encodeText(comment);
 		}
@@ -6216,8 +6332,11 @@
 		if (!passThrough) {
 			password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
 			rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+			if ((password && typeof password != STRING_TYPE) || (rawPassword && !(rawPassword instanceof Uint8Array))) {
+				throw new Error(ERR_INVALID_PASSWORD_TYPE);
+			}
 		}
-		const encryptionStrength = getOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
+		const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 		const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 		const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
 		const ntfsTimestamp = getOptionValue(zipWriter, options, OPTION_NTFS_TIMESTAMP);
@@ -6235,7 +6354,10 @@
 			compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE && !registeredCodec) {
 			throw new Error(ERR_UNSUPPORTED_COMPRESSION);
 		}
-		let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
+		let level = getNumberOptionValue(zipWriter, options, OPTION_LEVEL);
+		if (level !== UNDEFINED_VALUE && (!Number.isInteger(level) || level < 0 || level > MAX_LEVEL)) {
+			throw new Error(ERR_INVALID_LEVEL);
+		}
 		if (zipWriter.options[OPTION_USDZ]) {
 			if (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) {
 				throw new Error(ERR_UNSUPPORTED_ENCRYPTION_USDZ);
@@ -6256,7 +6378,7 @@
 			useCompressionStream = false;
 		}
 		const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
+		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(Number.isInteger(encryptionStrength) && encryptionStrength >= 1 && encryptionStrength <= 3)) {
 			throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 		}
 		const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
@@ -7450,6 +7572,14 @@
 		return result === UNDEFINED_VALUE ? defaultValue : result;
 	}
 
+	function getNumberOptionValue(zipWriter, options, name, defaultValue) {
+		return toNumber(getOptionValue(zipWriter, options, name, defaultValue));
+	}
+
+	function toNumber(value) {
+		return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+	}
+
 	function getMaximumCompressedSize(uncompressedSize) {
 		return uncompressedSize + (5 * (Math.floor(uncompressedSize / 16383) + 1));
 	}
@@ -8059,12 +8189,17 @@
 	exports.ERR_INVALID_ENTRY_NAME = ERR_INVALID_ENTRY_NAME;
 	exports.ERR_INVALID_EXTRAFIELD_DATA = ERR_INVALID_EXTRAFIELD_DATA;
 	exports.ERR_INVALID_EXTRAFIELD_TYPE = ERR_INVALID_EXTRAFIELD_TYPE;
+	exports.ERR_INVALID_FILENAME_VALIDATION = ERR_INVALID_FILENAME_VALIDATION;
 	exports.ERR_INVALID_GID = ERR_INVALID_GID;
+	exports.ERR_INVALID_LEVEL = ERR_INVALID_LEVEL;
+	exports.ERR_INVALID_MAX_APPENDED_DATA_SIZE = ERR_INVALID_MAX_APPENDED_DATA_SIZE;
 	exports.ERR_INVALID_MSDOS_ATTRIBUTES = ERR_INVALID_MSDOS_ATTRIBUTES;
 	exports.ERR_INVALID_MSDOS_DATA = ERR_INVALID_MSDOS_DATA;
 	exports.ERR_INVALID_PASSWORD = ERR_INVALID_PASSWORD;
+	exports.ERR_INVALID_PASSWORD_TYPE = ERR_INVALID_PASSWORD_TYPE;
 	exports.ERR_INVALID_SIGNATURE = ERR_INVALID_SIGNATURE;
 	exports.ERR_INVALID_SIGNATURE_DATA = ERR_INVALID_SIGNATURE_DATA;
+	exports.ERR_INVALID_STRICTNESS = ERR_INVALID_STRICTNESS;
 	exports.ERR_INVALID_UID = ERR_INVALID_UID;
 	exports.ERR_INVALID_UNCOMPRESSED_SIZE = ERR_INVALID_UNCOMPRESSED_SIZE;
 	exports.ERR_INVALID_UNIX_EXTRA_FIELD_TYPE = ERR_INVALID_UNIX_EXTRA_FIELD_TYPE;
@@ -8078,6 +8213,7 @@
 	exports.ERR_SPLIT_ZIP_FILE = ERR_SPLIT_ZIP_FILE;
 	exports.ERR_UNDEFINED_READER = ERR_UNDEFINED_READER;
 	exports.ERR_UNDEFINED_UNCOMPRESSED_SIZE = ERR_UNDEFINED_UNCOMPRESSED_SIZE;
+	exports.ERR_UNSAFE_FILENAME = ERR_UNSAFE_FILENAME;
 	exports.ERR_UNSUPPORTED_COMPRESSION = ERR_UNSUPPORTED_COMPRESSION$1;
 	exports.ERR_UNSUPPORTED_CONTEXT = ERR_UNSUPPORTED_CONTEXT;
 	exports.ERR_UNSUPPORTED_CRYPTO_API = ERR_UNSUPPORTED_CRYPTO_API;