neozipkit 1.0.2 → 1.5.0

package/src/browser/zstd-browser-shim.ts

@@ -1,63 +1,143 @@
 /**
- * Browser stub for ZSTD — native zlib streaming is Node-only.
- * Browser builds alias `ZstdNode` to this module so the bad WASM codec is never shipped.
+ * Browser zstd codec for in-memory buffers.
+ * Uses CompressionStream / DecompressionStream ('zstd') so the old WASM codec stays out.
+ * Node builds use src/node/ZstdNode.ts (native zlib) instead of this file.
  */
 
-const ZSTD_BROWSER_UNSUPPORTED =
-  'ZSTD requires Node.js with native zlib support (Node.js >= 22.15 or >= 23.8). ' +
-  'Browser builds do not include a zstd codec; use Deflate or process zstd archives in Node.';
+import { Buffer } from 'buffer';
 
-function unsupported(): never {
-  throw new Error(ZSTD_BROWSER_UNSUPPORTED);
+/** Bytes accepted by the buffer zstd codec. */
+export type ZstdInput = Buffer | Uint8Array | ArrayBuffer;
+
+const ZSTD_UNAVAILABLE =
+  'This browser does not expose CompressionStream zstd. ' +
+  'Use a current Chromium or Safari, or inflate the archive in Node.';
+
+function asBytes(data: ZstdInput): Uint8Array {
+  if (data instanceof ArrayBuffer) return new Uint8Array(data);
+  return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+}
+
+function toBuffer(bytes: Uint8Array): Buffer {
+  return Buffer.from(bytes);
 }
 
 export function isNativeZstdAvailable(): boolean {
-  return false;
+  try {
+    if (typeof CompressionStream === 'undefined' || typeof DecompressionStream === 'undefined') {
+      return false;
+    }
+    // 'zstd' is not in the older CompressionFormat union.
+    new CompressionStream('zstd' as CompressionFormat);
+    new DecompressionStream('zstd' as CompressionFormat);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function mapCompressionLevel(level: number): number {
+  return Math.min(Math.max(1, Math.floor(level * 2.1)), 19);
 }
 
-export function mapCompressionLevel(_level: number): number {
-  return unsupported();
+function assertZstd(): void {
+  if (!isNativeZstdAvailable()) {
+    throw new Error(ZSTD_UNAVAILABLE);
+  }
+}
+
+async function transformZstd(data: Uint8Array, mode: 'compress' | 'decompress'): Promise<Uint8Array> {
+  assertZstd();
+  const Stream = mode === 'compress' ? CompressionStream : DecompressionStream;
+  const stream = new Stream('zstd' as CompressionFormat);
+  const copy = new Uint8Array(data.byteLength);
+  copy.set(data);
+  const writer = stream.writable.getWriter();
+  await writer.write(copy);
+  await writer.close();
+  const reader = stream.readable.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
 }
 
 export function createCompressTransform(_level?: number): never {
-  return unsupported();
+  throw new Error('Browser zstd uses buffer compress(); Node zlib transforms are not available.');
 }
 
 export function createDecompressTransform(): never {
-  return unsupported();
+  throw new Error('Browser zstd uses buffer decompress(); Node zlib transforms are not available.');
+}
+
+export async function compress(data: ZstdInput, _level?: number): Promise<Buffer> {
+  return toBuffer(await transformZstd(asBytes(data), 'compress'));
+}
+
+export async function decompress(data: ZstdInput): Promise<Buffer> {
+  return toBuffer(await transformZstd(asBytes(data), 'decompress'));
 }
 
-export async function compress(_data: Buffer, _level?: number): Promise<Buffer> {
-  return unsupported();
+export function compressSync(_data: ZstdInput, _level?: number): Buffer {
+  throw new Error('Browser zstd compress is async. Use compress().');
 }
 
-export async function decompress(_data: Buffer): Promise<Buffer> {
-  return unsupported();
+export function compressSyncAtLevel(data: ZstdInput, _zstdLevel?: number): Buffer {
+  return compressSync(data);
 }
 
-export function compressSync(_data: Buffer, _level?: number): Buffer {
-  return unsupported();
+export function decompressSync(_data: ZstdInput): Buffer {
+  throw new Error('Browser zstd decompress is async. Use decompress().');
 }
 
-export function decompressSync(_data: Buffer): Buffer {
-  return unsupported();
+export function asZstdBuffer(data: ZstdInput): Buffer {
+  return toBuffer(asBytes(data));
 }
 
 export async function compressChunks(
-  _readChunk: (position: number, size: number) => Buffer,
-  _totalSize: number,
-  _chunkSize: number,
-  _level: number,
+  readChunk: (position: number, size: number) => Buffer,
+  totalSize: number,
+  chunkSize: number,
+  level: number,
   _onPlainChunk?: (chunk: Buffer) => void,
-  _onCompressedChunk?: (chunk: Buffer) => void | Promise<void>
+  onCompressedChunk?: (chunk: Buffer) => void | Promise<void>
 ): Promise<number> {
-  return unsupported();
+  const parts: Buffer[] = [];
+  let position = 0;
+  while (position < totalSize) {
+    const size = Math.min(chunkSize, totalSize - position);
+    const chunk = readChunk(position, size);
+    parts.push(Buffer.from(chunk));
+    position += chunk.length;
+  }
+  const compressed = await compress(Buffer.concat(parts), level);
+  if (onCompressedChunk) {
+    await onCompressedChunk(compressed);
+  }
+  return compressed.length;
 }
 
 export async function* decompressStream(
-  _compressedStream: AsyncIterable<Buffer>
+  compressedStream: AsyncIterable<Buffer>
 ): AsyncGenerator<Buffer> {
-  unsupported();
+  const parts: Buffer[] = [];
+  for await (const chunk of compressedStream) {
+    parts.push(Buffer.from(chunk));
+  }
+  yield await decompress(Buffer.concat(parts));
 }
 
 export const ZstdNode = {
@@ -68,7 +148,9 @@ export const ZstdNode = {
   compress,
   decompress,
   compressSync,
+  compressSyncAtLevel,
   decompressSync,
+  asZstdBuffer,
   compressChunks,
   decompressStream,
 };

package/src/core/ZipCompress.ts

@@ -31,10 +31,16 @@ import { NeoCrypto, NEO_CRYPTO_ALGORITHM_AES256_V1 } from './encryption/NeoCrypt
 export interface CompressOptions {
   level?: number;             // Compression level (1-9, 0=store)
   password?: string | null;   // Password for encryption
-  encryptionMethod?: 'aes256' | 'zipcrypto' | 'neo-aes256'; // default WinZip AES when password set; 'neo-aes256' = NeoEncrypt extra 0x024E
+  encryptionMethod?: 'aes256' | 'zipcrypto' | 'neo-aes256'; // default NeoEncrypt when password set; 'aes256' = WinZip AE (method 99); 'neo-aes256' = Extra Field 0x024E
   useSHA256?: boolean;        // Whether to calculate SHA256 hash default is false
-  useZstd?: boolean;          // Whether to use Zstandard compression default is true
+  useZstd?: boolean;          // Use Zstandard (method 93); default false (Deflate). Node ≥ 22.15 required when true.
   bufferSize?: number;        // Override default buffer size
+  /**
+   * Force APPNOTE Zip64 Version 1 even when sizes/offsets/counts fit classic fields.
+   * Useful for testing Zip64 read/list/integrity without multi-GiB payloads.
+   * Node streaming writers emit Zip64 EOCD + locator and per-member Extra `0x0001`.
+   */
+  forceZip64?: boolean;
 }
 
 /**
@@ -132,20 +138,19 @@ export class ZipCompress {
     // Calculate hashes if needed
     if (hashCalculator) {
       hashCalculator.update(data);
-      if (!entry.crc || entry.crc === 0) {
-        entry.crc = hashCalculator.finalizeCRC32();
-      }
-      if (options?.useSHA256 && !entry.sha256) {
-        entry.sha256 = hashCalculator.finalizeSHA256();
-      }
+      hashCalculator.applyToEntry(entry, {
+        setCrc: !entry.crc || entry.crc === 0,
+        setSha256: !!(options?.useSHA256 && !entry.sha256),
+      });
       this.log(`Final hashes: CRC32=0x${entry.crc.toString(16).padStart(8, '0')}, SHA256=${entry.sha256 || 'N/A'}`);
     }
     
     // Encrypt if password provided
     const enc = options?.encryptionMethod;
     const useZipCrypto = enc === 'zipcrypto';
-    const useNeo = enc === 'neo-aes256';
-    const useAes = options?.password && !useZipCrypto && !useNeo;
+    // Explicit WinZip AE only when encryptionMethod is 'aes256'. Otherwise NeoEncrypt (default).
+    const useAes = enc === 'aes256';
+    const useNeo = !!options?.password && !useZipCrypto && !useAes;
     if (options?.password) {
       const label = useZipCrypto ? 'ZipCrypto' : useNeo ? 'NeoEncrypt (AES-256)' : 'WinZip AES-256';
       this.log(`Encrypting compressed data for entry: ${entry.filename} (method: ${label})`);
@@ -425,9 +430,11 @@ export class ZipCompress {
     hashCalculator.update(fileData);
     
     // Set hashes
-    entry.crc = hashCalculator.finalizeCRC32();
-    if (cmpOptions?.useSHA256) {
-      entry.sha256 = hashCalculator.finalizeSHA256();
+    hashCalculator.applyToEntry(entry, {
+      setCrc: true,
+      setSha256: !!cmpOptions?.useSHA256,
+    });
+    if (entry.sha256) {
       this.log(`SHA-256 calculated: ${entry.sha256}`);
     }
     

package/src/core/ZipCopy.ts

@@ -10,7 +10,14 @@
 
 import ZipEntry from './ZipEntry';
 import Zipkit from './Zipkit';
-import { LOCAL_HDR, CENTRAL_END, GP_FLAG } from './constants/Headers';
+import { LOCAL_HDR, GP_FLAG } from './constants/Headers';
+import {
+  assertBufferAllowsEntryZip64,
+  buildEndRecords,
+  dataDescriptorByteLength,
+  needsZip64SizeOrOffset,
+  ZIP64_BUFFER_SIZE_OFFSET_ERROR,
+} from './zip64/Zip64';
 
 /**
  * Options for copying ZIP files
@@ -174,9 +181,19 @@ export class ZipCopy {
     const localHeaderSize = this.calculateLocalHeaderSize(sourceBuffer, entry);
     
     // Determine total entry size
-    // For data descriptor entries, add 16 bytes for the data descriptor
+    // For data descriptor entries, add Zip64 (24) or classic (16) descriptor bytes
     const hasDataDescriptor = (entry.bitFlags & GP_FLAG.DATA_DESC) !== 0;
-    const totalEntrySize = localHeaderSize + entry.compressedSize + (hasDataDescriptor ? 16 : 0);
+    const descLen = hasDataDescriptor
+      ? dataDescriptorByteLength(entry.usesZip64Extra)
+      : 0;
+    const totalEntrySize = localHeaderSize + entry.compressedSize + descLen;
+
+    // Buffer copy must remain memory-feasible
+    assertBufferAllowsEntryZip64(
+      entry.uncompressedSize,
+      entry.compressedSize,
+      entry.localHdrOffset
+    );
 
     // Verify we have enough data in the buffer
     if (entry.localHdrOffset + totalEntrySize > sourceBuffer.length) {
@@ -264,6 +281,17 @@ export class ZipCopy {
     cloned.originalEntry = entry.originalEntry;
     cloned.inode = entry.inode;
 
+    cloned.usesZip64Extra = entry.usesZip64Extra;
+    if (entry.additionalExtra) {
+      cloned.additionalExtra = Buffer.from(entry.additionalExtra);
+    }
+    cloned.aesVersion = entry.aesVersion;
+    cloned.aesStrength = entry.aesStrength;
+    cloned.realCmpMethod = entry.realCmpMethod;
+    cloned.neoCryptoPayloadVersion = entry.neoCryptoPayloadVersion;
+    cloned.neoCryptoAlgorithm = entry.neoCryptoAlgorithm;
+    cloned.neoCryptoFlags = entry.neoCryptoFlags;
+
     return cloned;
   }
 
@@ -276,6 +304,19 @@ export class ZipCopy {
     zipComment: string,
     centralDirOffset: number
   ): Buffer {
+    if (
+      needsZip64SizeOrOffset(0, 0, 0, 0, centralDirOffset) ||
+      entries.some((e) =>
+        needsZip64SizeOrOffset(
+          e.uncompressedSize,
+          e.compressedSize,
+          e.localHdrOffset
+        )
+      )
+    ) {
+      throw new Error(ZIP64_BUFFER_SIZE_OFFSET_ERROR);
+    }
+
     const centralDirChunks: Buffer[] = [];
     for (const entry of entries) {
       centralDirChunks.push(entry.centralDirEntry());
@@ -283,32 +324,20 @@ export class ZipCopy {
     const centralDirBuffer = Buffer.concat(centralDirChunks);
     const centralDirSize = centralDirBuffer.length;
 
-    const commentBytes = Buffer.from(zipComment, 'utf8');
-    const commentLength = Math.min(commentBytes.length, 0xffff);
-
-    const eocdBuffer = Buffer.alloc(22 + commentLength);
-    let pos = 0;
-    eocdBuffer.writeUInt32LE(CENTRAL_END.SIGNATURE, pos);
-    pos += 4;
-    eocdBuffer.writeUInt16LE(0, pos);
-    pos += 2;
-    eocdBuffer.writeUInt16LE(0, pos);
-    pos += 2;
-    eocdBuffer.writeUInt16LE(entries.length, pos);
-    pos += 2;
-    eocdBuffer.writeUInt16LE(entries.length, pos);
-    pos += 2;
-    eocdBuffer.writeUInt32LE(centralDirSize, pos);
-    pos += 4;
-    eocdBuffer.writeUInt32LE(centralDirOffset, pos);
-    pos += 4;
-    eocdBuffer.writeUInt16LE(commentLength, pos);
-    pos += 2;
-    if (commentLength > 0) {
-      commentBytes.copy(eocdBuffer, pos, 0, commentLength);
+    if (needsZip64SizeOrOffset(0, 0, 0, centralDirSize, centralDirOffset)) {
+      throw new Error(ZIP64_BUFFER_SIZE_OFFSET_ERROR);
     }
 
-    return Buffer.concat([centralDirBuffer, eocdBuffer]);
+    const endRecords = buildEndRecords({
+      totalEntries: entries.length,
+      centralDirSize,
+      centralDirOffset,
+      zip64EocdOffset: centralDirOffset + centralDirSize,
+      archiveComment: zipComment,
+      allowSizeOffsetZip64: false,
+    });
+
+    return Buffer.concat([centralDirBuffer, endRecords]);
   }
 
   /**

package/src/core/ZipDecompress.ts

@@ -23,6 +23,7 @@ import Errors from './constants/Errors';
 import { CMP_METHOD } from './constants/Headers';
 import { ZipCrypto } from './encryption/ZipCrypto';
 import { AesCrypto } from './encryption/AesCrypto';
+import { HashCalculator } from './components/HashCalculator';
 
 export interface DecompressionResult {
   success: boolean;
@@ -189,18 +190,23 @@ class ZipDecompress {
       throw new Error(`Unsupported compression method: ${method}`);
     }
 
-    // Verify hash
+    // One pass: CRC + bare SHA-256 (0x014E) + v1 Merkle leaf — no second payload read
+    const hashCalc = new HashCalculator({ useSHA256: true });
+    hashCalc.update(outBuf);
+    const calculatedCRC = hashCalc.finalizeCRC32();
+    const calculatedHash = hashCalc.finalizeSHA256();
+    const leaf = hashCalc.finalizeMerkleLeafV1();
+    if (leaf) {
+      entry.merkleLeafV1 = leaf;
+    }
+
     if (!skipHashCheck) {
       if (entry.sha256) {
-        const isValid = this.zipkit.testSHA256(entry, outBuf);
-        if (!isValid) {
+        if (calculatedHash !== entry.sha256) {
           throw new Error(Errors.INVALID_SHA256);
         }
-      } else {
-        const isValid = this.zipkit.testCRC32(entry, outBuf);
-        if (!isValid) {
-          throw new Error(Errors.INVALID_CRC);
-        }
+      } else if (calculatedCRC !== entry.crc) {
+        throw new Error(Errors.INVALID_CRC);
       }
     }