omni-viewer-core 0.7.0 → 0.9.0

package/dist/parsers/archive/model.d.ts

@@ -7,36 +7,60 @@ export interface ArchiveEntry {
     modifiedAt?: string | number | Date;
     mimeType?: string;
     encrypted?: boolean;
+    /** Decoder-native compression method, for example `store`, `deflate`, or `lzma`. */
+    compressionMethod?: string;
+    /** Explicit compression state when the decoder exposes it. */
+    compressed?: boolean;
+    /** Optional integrity metadata retained for host UI and diagnostics. */
+    crc32?: number;
 }
+/** `encrypted` describes archive-wide encryption. Entry-level encryption is
+ * represented by {@link ArchiveEntry.encrypted}; adapters may provide both. */
 export interface ArchiveDocument {
     entries: readonly ArchiveEntry[];
+    encrypted?: boolean;
+}
+export interface ArchiveDecoderCapabilities {
+    /** Extensions/formats this concrete adapter can open. */
+    formats?: readonly string[];
+    /** `password` means the adapter can retry encrypted content with a password. */
+    encryption?: 'none' | 'detect' | 'password';
+    /** True when opening does not require buffering the complete archive. */
+    streaming?: boolean;
+    /** True when entries include `compressionMethod` and/or `compressed`. */
+    compressionMetadata?: boolean;
+}
+export interface ArchiveOpenOptions {
+    signal?: AbortSignal;
+    maxEntries?: number;
+    maxDecompressedBytes?: number;
+    /** Optional password supplied by a host-owned prompt. */
+    password?: string;
 }
 export interface ArchiveExtractOptions {
-    signal?: AbortSignal; /** Decoder must stop before allocating beyond this output size. */
+    signal?: AbortSignal;
+    /** Decoder must stop before allocating beyond this output size. */
     maxBytes: number;
+    /** Optional password supplied by a host-owned prompt. */
+    password?: string;
 }
 export interface OpenArchiveHandle {
     entries: readonly ArchiveEntry[];
+    encrypted?: boolean;
     extract(entryId: number, options: ArchiveExtractOptions): Promise<Uint8Array>;
     close(): void | Promise<void>;
 }
 export interface ArchiveDecoder {
-    openArchive(data: Uint8Array, options?: {
-        signal?: AbortSignal;
-        maxEntries?: number;
-        maxDecompressedBytes?: number;
-    }): Promise<OpenArchiveHandle>;
+    readonly capabilities?: ArchiveDecoderCapabilities;
+    openArchive(data: Uint8Array, options?: ArchiveOpenOptions): Promise<OpenArchiveHandle>;
 }
 /** Path/handle-based decoder that opens an archive without materializing the
  *  whole file in memory (e.g. an adapter wrapping the system `7z`/`tar`). Core
  *  drives listing and single-entry extraction lazily through the returned
  *  handle; it never receives the archive bytes. */
 export interface ArchiveStreamDecoder {
-    openArchive(options?: {
-        signal?: AbortSignal;
-        maxEntries?: number;
-        maxDecompressedBytes?: number;
-    }): Promise<OpenArchiveHandle>;
+    readonly capabilities?: ArchiveDecoderCapabilities;
+    openArchive(options?: ArchiveOpenOptions): Promise<OpenArchiveHandle>;
 }
 /** Streams one archive entry to an adapter-chosen destination without loading
  *  the entry into memory. Core never sees the bytes — the adapter owns the
@@ -45,5 +69,6 @@ export interface ArchiveStreamDecoder {
 export interface ArchiveEntrySaver {
     saveEntry(entry: ArchiveEntry, options: {
         signal?: AbortSignal;
+        password?: string;
     }): Promise<string | null>;
 }

package/dist/parsers/archive/worker.d.ts

@@ -1,15 +1,22 @@
-/** Protocol names shared by decoder-specific Worker adapters. */
+import type { ArchiveDecoderCapabilities } from './model.js';
+/** Protocol names shared by decoder-specific Worker adapters. Optional fields
+ * keep existing JSZip/libarchive workers source-compatible. */
 export type ArchiveWorkerRequest = {
     type: 'list';
+    password?: string;
 } | {
     type: 'extract';
     entryId: number;
+    maxBytes?: number;
+    password?: string;
 } | {
     type: 'close';
 };
 export type ArchiveWorkerResponse = {
     type: 'entries';
     entries: unknown[];
+    encrypted?: boolean;
+    capabilities?: ArchiveDecoderCapabilities;
 } | {
     type: 'bytes';
     data: Uint8Array;

package/dist/parsers/doc-binary/index.d.ts

@@ -1,5 +1,7 @@
-import type { ParseOutcome } from '../types.js';
+import type { ParseOptions, ParseOutcome } from '../types.js';
+import { type DocBinaryRuntimeDeps } from './vscode-parser.js';
 export { DocBinaryParser } from './vscode-parser.js';
+export type { DocBinaryRuntimeDeps } from './vscode-parser.js';
 export interface DocTextRun {
     text: string;
     bold?: boolean;
@@ -32,4 +34,24 @@ export interface DocBinaryDocument {
     sections: DocSection[];
     text: string;
 }
+/**
+ * Compatibility document used by the feature-complete legacy DOC renderer.
+ *
+ * The older parser currently preserves substantially more layout information
+ * than {@link DocBinaryDocument}. Wrapping its output in ParseOutcome keeps
+ * failures and diagnostics typed while the semantic parser catches up, without
+ * regressing tables, columns, images, and section layout.
+ */
+export interface DocBinaryHtmlDocument {
+    html: string;
+}
 export declare function parseDocBinary(input: Uint8Array): ParseOutcome<DocBinaryDocument>;
+/**
+ * Typed bridge for the feature-complete legacy DOC parser.
+ *
+ * Input-caused failures are returned rather than thrown. The viewer owns the
+ * separate HTML-to-DOM rendering and sanitization step.
+ */
+export declare function parseDocBinaryHtml(input: Uint8Array, deps?: DocBinaryRuntimeDeps, options?: ParseOptions): Promise<ParseOutcome<DocBinaryHtmlDocument>>;
+/** Cheap CFB directory-name probe used to keep xlsx lazy for ordinary DOC. */
+export declare function hasEmbeddedDocWorkbook(input: Uint8Array): boolean;

package/dist/parsers/doc-binary/index.js

@@ -1,3 +1,4 @@
+import { DocBinaryParser } from './vscode-parser.js';
 export { DocBinaryParser } from './vscode-parser.js';
 const FREESECT = 0xffffffff;
 const ENDOFCHAIN = 0xfffffffe;
@@ -22,13 +23,21 @@ export function parseDocBinary(input) {
         const table = cfb.getStream(fib.tableStreamName);
         if (!table)
             return failed('corrupted');
-        const pieces = parsePieceTable(table, fib);
+        const pieceTable = parsePieceTable(table, fib);
+        const pieces = pieceTable.pieces;
         if (pieces.length === 0)
             return failed('corrupted');
         const decoded = decodePieces(word, pieces);
         const mainText = normalize(decoded.slice(0, fib.ccpText || decoded.length));
         const headerText = fib.ccpHdd > 0 ? normalize(decoded.slice(fib.ccpText, fib.ccpText + fib.ccpHdd)) : '';
         const diagnostics = [];
+        if (pieceTable.recovered) {
+            diagnostics.push({
+                severity: 'warning',
+                code: 'recovered-corruption',
+                messageKey: 'diag.word.recovered-corruption'
+            });
+        }
         const blocks = buildBlocks(mainText);
         const images = extractImages(cfb);
         if (images.length)
@@ -46,9 +55,127 @@ export function parseDocBinary(input) {
         return outcome({ status: diagnostics.length ? 'partial' : 'ok', document: { sections: [section], text: mainText }, diagnostics });
     }
     catch (error) {
+        if (error instanceof DocPasswordRequiredError) {
+            return outcome({
+                status: 'failed',
+                failure: {
+                    code: 'password-required',
+                    retryable: true,
+                    messageKey: 'diag.word.password-required'
+                },
+                diagnostics: []
+            });
+        }
         return outcome({ status: 'failed', failure: { code: 'invalid-format', retryable: false, messageKey: 'diag.word.invalid-format' }, diagnostics: [{ severity: 'error', code: 'parse-error', messageKey: 'diag.word.invalid-format', location: error instanceof Error ? error.message : String(error) }] });
     }
 }
+/**
+ * Typed bridge for the feature-complete legacy DOC parser.
+ *
+ * Input-caused failures are returned rather than thrown. The viewer owns the
+ * separate HTML-to-DOM rendering and sanitization step.
+ */
+export async function parseDocBinaryHtml(input, deps = {}, options = {}) {
+    const started = Date.now();
+    const finish = (result) => ({
+        result,
+        execution: {
+            workerUsed: false,
+            hardLimitEnforced: false,
+            elapsedMillis: Date.now() - started
+        }
+    });
+    if (options.signal?.aborted) {
+        return finish({
+            status: 'failed',
+            failure: { code: 'aborted', retryable: true, messageKey: 'diag.aborted' },
+            diagnostics: []
+        });
+    }
+    if (options.limits?.maxInputBytes !== undefined &&
+        input.byteLength > options.limits.maxInputBytes) {
+        return finish({
+            status: 'failed',
+            failure: {
+                code: 'limit-exceeded',
+                retryable: false,
+                messageKey: 'diag.word.limit-exceeded'
+            },
+            diagnostics: []
+        });
+    }
+    if (isEncryptedDocBinary(input)) {
+        return finish({
+            status: 'failed',
+            failure: {
+                code: 'password-required',
+                retryable: true,
+                messageKey: 'diag.word.password-required'
+            },
+            diagnostics: []
+        });
+    }
+    const diagnostics = [];
+    if (hasRecoveredPieceTable(input)) {
+        diagnostics.push({
+            severity: 'warning',
+            code: 'recovered-corruption',
+            messageKey: 'diag.word.recovered-corruption'
+        });
+    }
+    const hasWorkbook = hasEmbeddedDocWorkbook(input);
+    if (hasWorkbook && !deps.xlsx) {
+        diagnostics.push({
+            severity: 'warning',
+            code: 'embedded-workbook-disabled',
+            messageKey: 'diag.word.embedded-workbook-disabled',
+            location: 'Workbook'
+        });
+    }
+    try {
+        const html = await DocBinaryParser.parseBytes(input, deps);
+        if (options.signal?.aborted) {
+            return finish({
+                status: 'failed',
+                failure: { code: 'aborted', retryable: true, messageKey: 'diag.aborted' },
+                diagnostics
+            });
+        }
+        return finish({
+            status: diagnostics.length ? 'partial' : 'ok',
+            document: { html },
+            diagnostics
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const passwordRequired = /password|encrypted|encryption/i.test(detail);
+        const corrupted = OLE_MAGIC.every((byte, index) => input[index] === byte) &&
+            /corrupt|invalid.*(?:cfb|ole)|missing .*stream|sector|fat|chain/i.test(detail);
+        const code = passwordRequired ? 'password-required' : corrupted ? 'corrupted' : 'invalid-format';
+        const messageKey = passwordRequired
+            ? 'diag.word.password-required'
+            : corrupted ? 'diag.word.corrupted' : 'diag.word.invalid-format';
+        diagnostics.push({ severity: 'error', code, messageKey, location: detail });
+        return finish({
+            status: 'failed',
+            failure: { code, retryable: passwordRequired, messageKey },
+            diagnostics
+        });
+    }
+}
+/** Cheap CFB directory-name probe used to keep xlsx lazy for ordinary DOC. */
+export function hasEmbeddedDocWorkbook(input) {
+    return containsAscii(input, 'Workbook') || containsUtf16Le(input, 'Workbook');
+}
+function containsAscii(input, text) {
+    const needle = [...text].map((char) => char.charCodeAt(0));
+    return indexOf(input, needle) >= 0;
+}
+function containsUtf16Le(input, text) {
+    const needle = [...text].flatMap((char) => [char.charCodeAt(0), 0]);
+    return indexOf(input, needle) >= 0;
+}
 function failed(code) {
     return outcome({ status: 'failed', failure: { code, retryable: false, messageKey: 'diag.word.invalid-format' }, diagnostics: [] });
 }
@@ -56,6 +183,9 @@ function parseFib(word) {
     if (word.length < 64 || u16(word, 0) !== 0xa5ec)
         throw new Error('invalid FIB');
     const flags = u16(word, 10);
+    if ((flags & 0x0100) !== 0 || (flags & 0x8000) !== 0) {
+        throw new DocPasswordRequiredError();
+    }
     const tableStreamName = ((flags >> 9) & 1) ? '1Table' : '0Table';
     let offset = 32;
     const csw = u16(word, offset);
@@ -72,20 +202,58 @@ function parseFib(word) {
     const [fcClx, lcbClx] = pair(33);
     return { tableStreamName, ccpText, ccpHdd, fcClx, lcbClx };
 }
+class DocPasswordRequiredError extends Error {
+    constructor() {
+        super('password required');
+        this.name = 'DocPasswordRequiredError';
+    }
+}
+function isEncryptedDocBinary(input) {
+    try {
+        const word = parseCfb(input).getStream('WordDocument');
+        if (!word || word.length < 12 || u16(word, 0) !== 0xa5ec)
+            return false;
+        const flags = u16(word, 10);
+        return (flags & 0x0100) !== 0 || (flags & 0x8000) !== 0;
+    }
+    catch {
+        return false;
+    }
+}
 function parsePieceTable(table, fib) {
-    if (fib.lcbClx <= 0 || fib.fcClx + fib.lcbClx > table.length)
-        return scanPieceTables(table);
+    if (fib.lcbClx <= 0 || fib.fcClx + fib.lcbClx > table.length) {
+        return { pieces: scanPieceTables(table), recovered: true };
+    }
     const clx = table.subarray(fib.fcClx, fib.fcClx + fib.lcbClx);
     let offset = 0;
     while (offset < clx.length && clx[offset] === 1) {
         if (offset + 3 > clx.length)
-            return [];
+            return { pieces: [], recovered: false };
         offset += 3 + u16(clx, offset + 1);
     }
-    if (clx[offset] !== 2 || offset + 5 > clx.length)
-        return scanPieceTables(table);
+    if (clx[offset] !== 2 || offset + 5 > clx.length) {
+        return { pieces: scanPieceTables(table), recovered: true };
+    }
     const length = u32(clx, offset + 1);
-    return decodePlc(clx.subarray(offset + 5, offset + 5 + length));
+    const pieces = decodePlc(clx.subarray(offset + 5, offset + 5 + length));
+    if (pieces.length)
+        return { pieces, recovered: false };
+    const recovered = scanPieceTables(table);
+    return { pieces: recovered, recovered: recovered.length > 0 };
+}
+function hasRecoveredPieceTable(input) {
+    try {
+        const cfb = parseCfb(input);
+        const word = cfb.getStream('WordDocument');
+        if (!word)
+            return false;
+        const fib = parseFib(word);
+        const table = cfb.getStream(fib.tableStreamName);
+        return table ? parsePieceTable(table, fib).recovered : false;
+    }
+    catch {
+        return false;
+    }
 }
 function scanPieceTables(table) {
     let best = [];

package/dist/parsers/parquet/index.d.ts

@@ -18,4 +18,18 @@ export interface ParquetParseOptions {
     rowStart?: number;
     signal?: AbortSignal;
 }
+/**
+ * Random-access source: hyparquet's `AsyncBuffer` shape. The decoder consumes it
+ * natively, so a lazy host (Blob range reads, Node `fs.open/read`) can supply one
+ * directly and only the footer + requested row-group pages are ever read
+ * (DESIGN.md 메모리 규율 — 랜덤액세스 입력). {@link parseParquet} remains the
+ * compatibility entry point for callers that already hold the whole file.
+ */
+export interface ParquetSource {
+    byteLength: number;
+    slice(start: number, end?: number): ArrayBuffer | Promise<ArrayBuffer>;
+}
+/** Parses from a fully in-memory buffer. Wraps the bytes into a {@link ParquetSource}. */
 export declare function parseParquet(data: Uint8Array, options?: ParquetParseOptions): Promise<ParquetDocument>;
+/** Parses from a random-access source, materializing only the footer + preview pages. */
+export declare function parseParquetSource(source: ParquetSource, options?: ParquetParseOptions): Promise<ParquetDocument>;

package/dist/parsers/parquet/index.js

@@ -2,23 +2,27 @@ import { parquetMetadataAsync, parquetReadObjects, parquetSchema } from 'hyparqu
 import { compressors } from 'hyparquet-compressors';
 export const PARQUET_PREVIEW_BYTES = 50 * 1024 * 1024;
 export const PARQUET_PREVIEW_ROWS = 10_000;
+/** Parses from a fully in-memory buffer. Wraps the bytes into a {@link ParquetSource}. */
 export async function parseParquet(data, options = {}) {
-    if (options.signal?.aborted)
-        throw new DOMException('Parsing was cancelled.', 'AbortError');
-    const file = {
+    const source = {
         byteLength: data.byteLength,
-        async slice(start, end) {
-            if (options.signal?.aborted)
-                throw new DOMException('Parsing was cancelled.', 'AbortError');
+        slice(start, end) {
             const part = data.subarray(start, end);
             return part.buffer.slice(part.byteOffset, part.byteOffset + part.byteLength);
         }
     };
+    return parseParquetSource(source, options);
+}
+/** Parses from a random-access source, materializing only the footer + preview pages. */
+export async function parseParquetSource(source, options = {}) {
+    if (options.signal?.aborted)
+        throw new DOMException('Parsing was cancelled.', 'AbortError');
+    const file = options.signal ? withAbort(source, options.signal) : source;
     const metadata = await parquetMetadataAsync(file);
     const schema = parquetSchema(metadata);
     const totalRows = Number(metadata.num_rows ?? 0);
     const rowStart = Math.max(0, options.rowStart ?? 0);
-    const shouldChunk = data.byteLength >= (options.maxPreviewBytes ?? PARQUET_PREVIEW_BYTES);
+    const shouldChunk = source.byteLength >= (options.maxPreviewBytes ?? PARQUET_PREVIEW_BYTES);
     const readOptions = { file, metadata, compressors };
     if (shouldChunk) {
         readOptions.rowStart = rowStart;
@@ -33,7 +37,18 @@ export async function parseParquet(data, options = {}) {
     const types = collectColumnTypes(schema);
     const rows = objects.map((row) => headers.map((header) => convertValue(row[header], types.get(header))));
     return { headers, rows, schema: convertValue(schema), totalRows, loadedRows: rows.length,
-        fileSizeBytes: data.byteLength, isLimited: shouldChunk && rowStart + rows.length < totalRows };
+        fileSizeBytes: source.byteLength, isLimited: shouldChunk && rowStart + rows.length < totalRows };
+}
+/** Wraps a source so each range read observes cancellation (parity with the buffer path). */
+function withAbort(source, signal) {
+    return {
+        byteLength: source.byteLength,
+        slice(start, end) {
+            if (signal.aborted)
+                throw new DOMException('Parsing was cancelled.', 'AbortError');
+            return source.slice(start, end);
+        }
+    };
 }
 function convertValue(value, type) {
     if (value == null || typeof value === 'string' || typeof value === 'boolean' || typeof value === 'number')

package/dist/parsers/pptx/index.d.ts

@@ -9,9 +9,11 @@ export interface PptxZipReader {
 }
 export interface PptxParserDeps {
     openZip(data: Uint8Array, options?: ParseOptions): Promise<PptxZipReader>;
+    renderMetafile?(input: Uint8Array, type: 'wmf' | 'emf', signal?: AbortSignal): Promise<string | Uint8Array | undefined>;
 }
 export { openPptxZip } from './zip-reader.js';
 import { parsePptxVscode } from './vscode.js';
 export { parsePptxVscode };
+export type { PptxVscodeParserDeps } from './vscode.js';
 export declare function parsePptxLegacy(input: Uint8Array, deps: PptxParserDeps, options?: ParseOptions): Promise<ParseOutcome<SlideDeck>>;
 export declare function parsePptx(input: Uint8Array, deps: PptxParserDeps, options?: ParseOptions): Promise<ParseOutcome<SlideDeck>>;

package/dist/parsers/pptx/index.js

@@ -87,5 +87,5 @@ catch {
 finally {
     await zip?.close?.();
 } }
-export async function parsePptx(input, deps, options = {}) { const full = await parsePptxVscode(input, options); if (full.result.status !== 'failed' || full.result.failure.code !== 'invalid-format')
+export async function parsePptx(input, deps, options = {}) { const full = await parsePptxVscode(input, options, { renderMetafile: deps.renderMetafile }); if (full.result.status !== 'failed' || full.result.failure.code !== 'invalid-format')
     return full; return parsePptxLegacy(input, deps, options); }

package/dist/parsers/pptx/limits.d.ts

@@ -0,0 +1,26 @@
+import type JSZip from 'jszip';
+import { type LimitViolation, type ParseOptions, type ResourceLimits } from '../types.js';
+export declare const PPTX_DEFAULT_LIMITS: Required<Pick<ResourceLimits, 'maxInputBytes' | 'maxEntries' | 'maxDecompressedBytes' | 'maxParseMillis'>>;
+export declare class PptxLimitError extends Error {
+    readonly violation: LimitViolation;
+    readonly location?: string | undefined;
+    constructor(violation: LimitViolation, location?: string | undefined);
+}
+export declare function pptxLimits(options: ParseOptions): ResourceLimits;
+export declare function preflightPptxZip(input: Uint8Array, limits: ResourceLimits): void;
+export declare class PptxParseGuard {
+    readonly options: ParseOptions;
+    readonly limits: ResourceLimits;
+    private readonly tracker;
+    constructor(options: ParseOptions, limits?: ResourceLimits);
+    checkpoint(location?: string): void;
+    addDecompressedBytes(bytes: number, location?: string): void;
+}
+/**
+ * Replaces JSZip's per-entry `async()` accumulator with a bounded streaming
+ * implementation. This is intentionally installed after central-directory
+ * preflight: declared limits reject ordinary ZIP bombs before inflate, while
+ * this wrapper catches lying headers and cancellation between 16 KiB chunks.
+ */
+export declare function installBoundedZipReaders(zip: JSZip, guard: PptxParseGuard): void;
+export declare function limitDiagnosticArgs(error: PptxLimitError): Record<string, string | number>;

package/dist/parsers/pptx/limits.js

@@ -0,0 +1,154 @@
+import { declaredZipEntryCount, declaredZipUncompressedBytes } from '../zip-scan.js';
+import { DEFAULT_LIMITS, LimitTracker } from '../types.js';
+export const PPTX_DEFAULT_LIMITS = {
+    maxInputBytes: 50 * 1024 * 1024,
+    maxEntries: Math.min(DEFAULT_LIMITS.maxEntries, 100_000),
+    maxDecompressedBytes: 256 * 1024 * 1024,
+    maxParseMillis: DEFAULT_LIMITS.maxParseMillis
+};
+export class PptxLimitError extends Error {
+    violation;
+    location;
+    constructor(violation, location) {
+        super(`PPTX parsing stopped: ${violation.kind}`);
+        this.violation = violation;
+        this.location = location;
+        this.name = 'PptxLimitError';
+    }
+}
+export function pptxLimits(options) {
+    return { ...PPTX_DEFAULT_LIMITS, ...options.limits };
+}
+export function preflightPptxZip(input, limits) {
+    const count = declaredZipEntryCount(input);
+    if (count !== null &&
+        Number.isFinite(count) &&
+        limits.maxEntries !== undefined &&
+        count > limits.maxEntries) {
+        throw new PptxLimitError({ kind: 'entries', count });
+    }
+    const decompressed = declaredZipUncompressedBytes(input);
+    if (decompressed !== null &&
+        Number.isFinite(decompressed) &&
+        limits.maxDecompressedBytes !== undefined &&
+        decompressed > limits.maxDecompressedBytes) {
+        throw new PptxLimitError({ kind: 'decompressed', bytes: decompressed });
+    }
+}
+export class PptxParseGuard {
+    options;
+    limits;
+    tracker;
+    constructor(options, limits = pptxLimits(options)) {
+        this.options = options;
+        this.limits = limits;
+        this.tracker = new LimitTracker(limits, options.signal);
+    }
+    checkpoint(location) {
+        const violation = this.tracker.checkpoint();
+        if (violation)
+            throw new PptxLimitError(violation, location);
+    }
+    addDecompressedBytes(bytes, location) {
+        this.tracker.addDecompressedBytes(bytes);
+        this.checkpoint(location);
+    }
+}
+function bytesToBase64(bytes) {
+    let binary = '';
+    const chunkSize = 0x8000;
+    for (let i = 0; i < bytes.length; i += chunkSize) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
+    }
+    return btoa(binary);
+}
+function convertBytes(bytes, type) {
+    switch (type.toLowerCase()) {
+        case 'text':
+        case 'string':
+            return new TextDecoder().decode(bytes);
+        case 'base64':
+            return bytesToBase64(bytes);
+        case 'arraybuffer':
+            return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        case 'array':
+            return Array.from(bytes);
+        case 'nodebuffer': {
+            const NodeBuffer = globalThis.Buffer;
+            return NodeBuffer ? NodeBuffer.from(bytes) : bytes;
+        }
+        default:
+            return bytes;
+    }
+}
+/**
+ * Replaces JSZip's per-entry `async()` accumulator with a bounded streaming
+ * implementation. This is intentionally installed after central-directory
+ * preflight: declared limits reject ordinary ZIP bombs before inflate, while
+ * this wrapper catches lying headers and cancellation between 16 KiB chunks.
+ */
+export function installBoundedZipReaders(zip, guard) {
+    for (const [entryPath, entry] of Object.entries(zip.files)) {
+        if (entry.dir)
+            continue;
+        let cachedBytes;
+        entry.async = (async (type) => {
+            guard.checkpoint(entryPath);
+            if (cachedBytes)
+                return convertBytes(cachedBytes, type);
+            const helper = entry.internalStream('uint8array');
+            const chunks = [];
+            let total = 0;
+            const bytes = await new Promise((resolve, reject) => {
+                let settled = false;
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    helper.pause();
+                    reject(error);
+                };
+                helper
+                    .on('data', (chunk) => {
+                    if (settled)
+                        return;
+                    try {
+                        guard.addDecompressedBytes(chunk.byteLength, entryPath);
+                        chunks.push(chunk);
+                        total += chunk.byteLength;
+                    }
+                    catch (error) {
+                        fail(error);
+                    }
+                })
+                    .on('error', fail)
+                    .on('end', () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    const output = new Uint8Array(total);
+                    let offset = 0;
+                    for (const chunk of chunks) {
+                        output.set(chunk, offset);
+                        offset += chunk.byteLength;
+                    }
+                    resolve(output);
+                })
+                    .resume();
+            });
+            guard.checkpoint(entryPath);
+            cachedBytes = bytes;
+            return convertBytes(bytes, type);
+        });
+    }
+}
+export function limitDiagnosticArgs(error) {
+    const { violation } = error;
+    if (violation.kind === 'entries')
+        return { kind: violation.kind, count: violation.count };
+    if (violation.kind === 'decompressed')
+        return { kind: violation.kind, bytes: violation.bytes };
+    if (violation.kind === 'time')
+        return { kind: violation.kind, elapsedMillis: violation.elapsedMillis };
+    return { kind: violation.kind };
+}