unzipit 2.0.0 → 2.0.3

package/README.md

@@ -1,10 +1,10 @@
-# unzipit.js
+# unzipit
 
 <img src="./unzipit-no-anim.png" style="max-width: 640px">
-
+<!-- cut here -->
 Random access unzip library for browser and node based JavaScript
 
-![Build Status](https://github.com/greggman/unzipit/actions/workflows/test.yml/badge.svg)
+[![Build and Deploy](https://github.com/greggman/unzipit/actions/workflows/build_and_deploy.yml/badge.svg)](https://github.com/greggman/unzipit/actions/workflows/build_and_deploy.yml)
 [[Live Tests](https://greggman.github.io/unzipit/test/)]
 
 * Less than 5k gzipped without workers, Less than 6k with.
@@ -90,7 +90,7 @@ You can also pass a [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Bl
 or your own `Reader`
 
 For using without a builder/bundler grab `unzipit.min.js` or `unzipit.module.js` from
-the [`dist`](https://github.com/greggman/unzipit/tree/master/dist) folder and
+the [`dist`](https://github.com/greggman/unzipit/tree/gh-pages/dist) folder and
 include with
 
 ```js
@@ -106,13 +106,13 @@ or
 or vs CDN
 
 ```js
-import * as unzipit from 'https://unpkg.com/unzipit@1.4.0/dist/unzipit.module.js';
+import * as unzipit from 'https://unpkg.com/unzipit@2.0.1/dist/unzipit.module.js';
 ```
 
 or
 
 ```html
-<script src="https://unpkg.com/unzipit@1.4.0/dist/unzipit.js"></script>
+<script src="https://unpkg.com/unzipit@2.0.1/dist/unzipit.js"></script>
 ```
 ## Node
 
@@ -279,6 +279,7 @@ entries.forEach(entry => {
 Some libraries both zip and unzip.
 IMO those should be separate libraries as there is little if any code to share between
 both. Plenty of projects only need to do one or the other.
+[Here's the sister library for zip](https://greggman.github.io/zipup/).
 
 Similarly inflate and deflate libraries should be separate from zip, unzip libraries.
 You need one or the other not both. See zlib as an example.
@@ -336,6 +337,9 @@ manages them. They don't count as part of the JavaScript heap.
 In node, the examples with the file readers will only read the header and whatever entries' contents
 you ask for so similarly you can avoid having everything in memory except the things you read.
 
+# Zip Creation
+
+see: [zipup](https://greggman.github.io/zipup/)
 
 # API
 

package/dist/inflate-types.d.ts

@@ -0,0 +1,15 @@
+export interface InflateRequestData {
+    id: number;
+    type?: string;
+    src: Uint8Array<ArrayBuffer> | Blob;
+    uncompressedSize: number;
+}
+export interface InflateRequestMessage {
+    type: 'inflate';
+    data: InflateRequestData;
+}
+export interface InflateResultMessage {
+    id: number;
+    data?: ArrayBuffer | Blob;
+    error?: string;
+}

package/dist/unzipit-worker.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.0, license MIT */
+/* unzipit@2.0.3, license MIT */
 (function (factory) {
   typeof define === 'function' && define.amd ? define(factory) :
   factory();
@@ -47,18 +47,23 @@
   // then 50 blobs will be asked to be read at once.
   // If feels like that should happen at a higher level (user code)
   // or a lower level (the browser)?
-  async function decompressRaw(src) {
+  async function decompressRaw(src, maxLimit) {
       const ds = new DecompressionStream('deflate-raw');
       const writer = ds.writable.getWriter();
       writer.write(src).then(() => writer.close()).catch(() => { });
       const chunks = [];
       const reader = ds.readable.getReader();
+      let seen = 0;
       for (;;) {
           const { done, value } = await reader.read();
           if (done) {
               break;
           }
           chunks.push(value);
+          seen += value.byteLength;
+          if (typeof maxLimit === 'number' && seen > maxLimit) {
+              throw new Error(`decompressed size exceeds limit: ${seen} > ${maxLimit}`);
+          }
       }
       const size = chunks.reduce((s, c) => s + c.byteLength, 0);
       const result = new Uint8Array(size);
@@ -75,7 +80,9 @@
           const srcData = isBlob(src)
               ? await readBlobAsUint8Array(src)
               : new Uint8Array(src);
-          const dstData = await decompressRaw(srcData);
+          // Enforce declared uncompressedSize as the streaming limit
+          const limit = typeof req.uncompressedSize === 'number' ? req.uncompressedSize : undefined;
+          const dstData = await decompressRaw(srcData, limit);
           const transferables = [];
           let data;
           if (type) {
@@ -104,15 +111,14 @@
   if (isNode) {
       // Use dynamic import so this works in both CJS and ESM contexts.
       // The import of a built-in resolves before any messages can arrive.
-      import('worker_threads').then(({ parentPort }) => {
+      const moduleId = 'node:worker_threads';
+      import(moduleId).then(({ parentPort }) => {
           parentPort.on('message', (msg) => {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               handleMessage(msg, (m, t) => parentPort.postMessage(m, t));
           });
       });
   }
   else {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const workerSelf = self;
       workerSelf.addEventListener('message', (e) => {
           handleMessage(e.data, (m, t) => workerSelf.postMessage(m, t));

package/dist/unzipit-worker.min.js

@@ -1 +1 @@
-!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";var e,r;async function n(e){const r=await function(e){return e.arrayBuffer?e.arrayBuffer():new Promise((r,n)=>{const t=new FileReader;t.addEventListener("loadend",()=>{r(t.result)}),t.addEventListener("error",n),t.readAsArrayBuffer(e)})}(e);return new Uint8Array(r)}async function t(e,r){const{id:t,src:o,type:s}=e;try{const e=(a=o,"undefined"!=typeof Blob&&a instanceof Blob?await n(o):new Uint8Array(o)),i=await async function(e){const r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).then(()=>n.close()).catch(()=>{});const t=[],o=r.readable.getReader();for(;;){const{done:e,value:r}=await o.read();if(e)break;t.push(r)}const s=t.reduce((e,r)=>e+r.byteLength,0),a=new Uint8Array(s);let i=0;for(const e of t)a.set(e,i),i+=e.byteLength;return a}(e),d=[];let c;s?c=new Blob([i],{type:s}):(c=i.buffer,d.push(c)),r({id:t,data:c},d)}catch(e){console.error(e),r({id:t,error:`${e}`})}var a}function o(e,r){const{type:n,data:o}=e;if("inflate"!==n)throw new Error("no handler for type: "+n);t(o,r)}if("undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(e=null===process||void 0===process?void 0:process.versions)||void 0===e?void 0:e.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron))import("worker_threads").then(({parentPort:e})=>{e.on("message",r=>{o(r,(r,n)=>e.postMessage(r,n))})});else{const e=self;e.addEventListener("message",r=>{o(r.data,(r,n)=>e.postMessage(r,n))}),e.postMessage("start")}});
+!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";var e,r;async function n(e){const r=await function(e){return e.arrayBuffer?e.arrayBuffer():new Promise((r,n)=>{const o=new FileReader;o.addEventListener("loadend",()=>{r(o.result)}),o.addEventListener("error",n),o.readAsArrayBuffer(e)})}(e);return new Uint8Array(r)}async function o(e,r){const{id:o,src:t,type:s}=e;try{const a=(i=t,"undefined"!=typeof Blob&&i instanceof Blob?await n(t):new Uint8Array(t)),d="number"==typeof e.uncompressedSize?e.uncompressedSize:void 0,c=await async function(e,r){const n=new DecompressionStream("deflate-raw"),o=n.writable.getWriter();o.write(e).then(()=>o.close()).catch(()=>{});const t=[],s=n.readable.getReader();let i=0;for(;;){const{done:e,value:n}=await s.read();if(e)break;if(t.push(n),i+=n.byteLength,"number"==typeof r&&i>r)throw new Error(`decompressed size exceeds limit: ${i} > ${r}`)}const a=t.reduce((e,r)=>e+r.byteLength,0),d=new Uint8Array(a);let c=0;for(const e of t)d.set(e,c),c+=e.byteLength;return d}(a,d),f=[];let u;s?u=new Blob([c],{type:s}):(u=c.buffer,f.push(u)),r({id:o,data:u},f)}catch(e){console.error(e),r({id:o,error:`${e}`})}var i}function t(e,r){const{type:n,data:t}=e;if("inflate"!==n)throw new Error("no handler for type: "+n);o(t,r)}if("undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(e=null===process||void 0===process?void 0:process.versions)||void 0===e?void 0:e.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron)){import("node:worker_threads").then(({parentPort:e})=>{e.on("message",r=>{t(r,(r,n)=>e.postMessage(r,n))})})}else{const e=self;e.addEventListener("message",r=>{t(r.data,(r,n)=>e.postMessage(r,n))}),e.postMessage("start")}});

package/dist/unzipit-worker.module.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.0, license MIT */
+/* unzipit@2.0.3, license MIT */
 var _a, _b;
 function readBlobAsArrayBuffer(blob) {
     if (blob.arrayBuffer) {
@@ -42,18 +42,23 @@ const isNode = (typeof process !== 'undefined') &&
 // then 50 blobs will be asked to be read at once.
 // If feels like that should happen at a higher level (user code)
 // or a lower level (the browser)?
-async function decompressRaw(src) {
+async function decompressRaw(src, maxLimit) {
     const ds = new DecompressionStream('deflate-raw');
     const writer = ds.writable.getWriter();
     writer.write(src).then(() => writer.close()).catch(() => { });
     const chunks = [];
     const reader = ds.readable.getReader();
+    let seen = 0;
     for (;;) {
         const { done, value } = await reader.read();
         if (done) {
             break;
         }
         chunks.push(value);
+        seen += value.byteLength;
+        if (typeof maxLimit === 'number' && seen > maxLimit) {
+            throw new Error(`decompressed size exceeds limit: ${seen} > ${maxLimit}`);
+        }
     }
     const size = chunks.reduce((s, c) => s + c.byteLength, 0);
     const result = new Uint8Array(size);
@@ -70,7 +75,9 @@ async function inflate(req, postMessage) {
         const srcData = isBlob(src)
             ? await readBlobAsUint8Array(src)
             : new Uint8Array(src);
-        const dstData = await decompressRaw(srcData);
+        // Enforce declared uncompressedSize as the streaming limit
+        const limit = typeof req.uncompressedSize === 'number' ? req.uncompressedSize : undefined;
+        const dstData = await decompressRaw(srcData, limit);
         const transferables = [];
         let data;
         if (type) {
@@ -99,15 +106,14 @@ function handleMessage(msg, postMessage) {
 if (isNode) {
     // Use dynamic import so this works in both CJS and ESM contexts.
     // The import of a built-in resolves before any messages can arrive.
-    import('worker_threads').then(({ parentPort }) => {
+    const moduleId = 'node:worker_threads';
+    import(moduleId).then(({ parentPort }) => {
         parentPort.on('message', (msg) => {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             handleMessage(msg, (m, t) => parentPort.postMessage(m, t));
         });
     });
 }
 else {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const workerSelf = self;
     workerSelf.addEventListener('message', (e) => {
         handleMessage(e.data, (m, t) => workerSelf.postMessage(m, t));

package/dist/unzipit.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.0, license MIT */
+/* unzipit@2.0.3, license MIT */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
   typeof define === 'function' && define.amd ? define(['exports'], factory) :
@@ -125,24 +125,30 @@
   // come in before a worker gets added to `workers`
   let numWorkers = 0;
   let canUseWorkers = true; // gets set to false if we can't start a worker
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const workers = [];
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const availableWorkers = [];
   const waitingForWorkerQueue = [];
   const currentlyProcessingIdToRequestMap = new Map();
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function handleResult(e) {
       makeWorkerAvailable(e.target);
       const { id, error, data } = e.data;
       const request = currentlyProcessingIdToRequestMap.get(id);
       currentlyProcessingIdToRequestMap.delete(id);
       if (error) {
-          request.reject(error);
+          // The worker can only structured-clone the error as a string, so wrap it
+          // back into an Error to match the rejection type of the non-worker path.
+          request.reject(new Error(error));
+          return;
       }
-      else {
-          request.resolve(data);
+      // Verify that the decompressed size matches the declared uncompressedSize
+      // Treat declared size as authoritative metadata that must be verified.
+      const expected = request.uncompressedSize;
+      const actual = data instanceof ArrayBuffer ? data.byteLength : data === null || data === void 0 ? void 0 : data.size;
+      if (typeof expected === 'number' && typeof actual === 'number' && expected !== actual) {
+          request.reject(new Error(`decompressed size mismatch. declared: ${expected}, actual: ${actual}`));
+          return;
       }
+      request.resolve(data);
   }
   // Because Firefox uses non-standard onerror to signal an error.
   function startWorker(url) {
@@ -164,27 +170,25 @@
   const workerHelper = (function () {
       if (isNode) {
           return {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async createWorker(url) {
-                  const { Worker } = await import('worker_threads');
+                  const moduleId = 'node:worker_threads';
+                  const { Worker } = await import(moduleId);
                   return new Worker(url);
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               addEventListener(worker, fn) {
-                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                  worker.on('message', (data) => {
+                  var _a;
+                  (_a = worker.on) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', (data) => {
                       fn({ target: worker, data });
                   });
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async terminate(worker) {
-                  await worker.terminate();
+                  var _a;
+                  await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
               },
           };
       }
       else {
           return {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async createWorker(url) {
                   // I don't understand this security issue
                   // Apparently there is some iframe setting or http header
@@ -227,23 +231,23 @@
                   console.warn('workers will not be used');
                   throw new Error('can not start workers');
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               addEventListener(worker, fn) {
-                  worker.addEventListener('message', fn);
+                  var _a;
+                  // The browser delivers a MessageEvent whose `target` is the worker
+                  // and whose `data` is the InflateResultMessage, matching WorkerResultEvent.
+                  (_a = worker.addEventListener) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', fn);
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async terminate(worker) {
-                  worker.terminate();
+                  var _a;
+                  await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
               },
           };
       }
   }());
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function makeWorkerAvailable(worker) {
       availableWorkers.push(worker);
       processWaitingForWorkerQueue();
   }
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async function getAvailableWorker() {
       if (availableWorkers.length === 0 && numWorkers < config.numWorkers) {
           ++numWorkers; // see comment at numWorkers declaration
@@ -260,7 +264,7 @@
       }
       return availableWorkers.pop();
   }
-  async function decompressRaw(src) {
+  async function decompressRaw(src, limit) {
       const ds = new DecompressionStream('deflate-raw');
       const writer = ds.writable.getWriter();
       // Do not await the write — doing so before reading causes a deadlock when
@@ -268,12 +272,19 @@
       writer.write(src).then(() => writer.close()).catch(() => { });
       const chunks = [];
       const reader = ds.readable.getReader();
+      let seen = 0;
       for (;;) {
           const { done, value } = await reader.read();
           if (done) {
               break;
           }
+          // If this chunk would push us past the configured/declared limit, abort
+          const newSeen = seen + value.byteLength;
+          if (typeof limit === 'number' && newSeen > limit) {
+              throw new Error(`decompressed size exceeds limit: ${newSeen} > ${limit}`);
+          }
           chunks.push(value);
+          seen = newSeen;
       }
       const size = chunks.reduce((s, c) => s + c.byteLength, 0);
       const result = new Uint8Array(size);
@@ -287,9 +298,15 @@
   // @param {Uint8Array} src
   // @param {string} [type] mime-type
   // @returns {ArrayBuffer|Blob} ArrayBuffer if type is falsy or Blob otherwise.
-  async function inflateRawLocal(src, type, resolve, reject) {
+  async function inflateRawLocal(src, uncompressedSize, type, resolve, reject) {
       try {
-          const dst = await decompressRaw(src);
+          const limit = uncompressedSize;
+          const dst = await decompressRaw(src, limit);
+          const actual = dst.byteLength;
+          if (typeof uncompressedSize === 'number' && actual !== uncompressedSize) {
+              reject(new Error(`decompressed size mismatch. declared: ${uncompressedSize}, actual: ${actual}`));
+              return;
+          }
           resolve(type ? new Blob([dst], { type }) : dst.buffer);
       }
       catch (e) {
@@ -297,6 +314,7 @@
       }
   }
   async function processWaitingForWorkerQueue() {
+      var _a;
       if (waitingForWorkerQueue.length === 0) {
           return;
       }
@@ -326,7 +344,7 @@
                   //if (!isBlob(src) && !isSharedArrayBuffer(src)) {
                   //  transferables.push(src);
                   //}
-                  worker.postMessage({
+                  (_a = worker.postMessage) === null || _a === void 0 ? void 0 : _a.call(worker, {
                       type: 'inflate',
                       data: {
                           id,
@@ -345,9 +363,14 @@
       // will then be on the queue. But if we fail to make workers then there
       // are pending requests.
       while (waitingForWorkerQueue.length) {
-          const { src, type, resolve, reject } = waitingForWorkerQueue.shift();
+          const { src, uncompressedSize, type, resolve, reject } = waitingForWorkerQueue.shift();
           const data = isBlob(src) ? await readBlobAsUint8Array(src) : src;
-          inflateRawLocal(data, type, resolve, reject);
+          try {
+              await inflateRawLocal(data, uncompressedSize, type, resolve, reject);
+          }
+          catch (e) {
+              reject(e);
+          }
       }
   }
   function setOptions$1(options) {

package/dist/unzipit.min.js

@@ -1 +1 @@
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).unzipit={})}(this,function(e){"use strict";var t,r;function n(e){return e.arrayBuffer?e.arrayBuffer():new Promise((t,r)=>{const n=new FileReader;n.addEventListener("loadend",()=>{t(n.result)}),n.addEventListener("error",r),n.readAsArrayBuffer(e)})}async function s(e){const t=await n(e);return new Uint8Array(t)}function o(e){return"undefined"!=typeof Blob&&e instanceof Blob}function i(e){return"undefined"!=typeof SharedArrayBuffer&&e instanceof SharedArrayBuffer}const a="undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(t=null===process||void 0===process?void 0:process.versions)||void 0===t?void 0:t.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron);class c{constructor(e){this.typedArray=e instanceof ArrayBuffer||i(e)?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}async getLength(){return this.typedArray.byteLength}async read(e,t){return new Uint8Array(this.typedArray.buffer,this.typedArray.byteOffset+e,t)}}class f{constructor(e){this.blob=e}async getLength(){return this.blob.size}async read(e,t){const r=this.blob.slice(e,e+t),s=await n(r);return new Uint8Array(s)}async sliceAsBlob(e,t,r=""){return this.blob.slice(e,e+t,r)}}const d={numWorkers:1,workerURL:"",useWorkers:!1};let l=0,u=0,h=!0;const w=[],p=[],y=[],m=new Map;function g(e){z(e.target);const{id:t,error:r,data:n}=e.data,s=m.get(t);m.delete(t),r?s.reject(r):s.resolve(n)}function b(e){return new Promise((t,r)=>{const n=new Worker(e);n.onmessage=e=>{"start"===e.data?(n.onerror=null,n.onmessage=null,t(n)):r(new Error(`unexpected message: ${e.data}`))},n.onerror=r})}const v=a?{async createWorker(e){const{Worker:t}=await import("worker_threads");return new t(e)},addEventListener(e,t){e.on("message",r=>{t({target:e,data:r})})},async terminate(e){await e.terminate()}}:{async createWorker(e){try{return await b(e)}catch(t){console.warn("could not load worker:",e)}let t;try{const r=await fetch(e,{mode:"cors"});if(!r.ok)throw new Error(`could not load: ${e}`);t=await r.text(),e=URL.createObjectURL(new Blob([t],{type:"application/javascript"}));const n=await b(e);return d.workerURL=e,n}catch(t){console.warn("could not load worker via fetch:",e)}if(void 0!==t)try{e=`data:application/javascript;base64,${btoa(t)}`;const r=await b(e);return d.workerURL=e,r}catch(e){console.warn("could not load worker via dataURI")}throw console.warn("workers will not be used"),new Error("can not start workers")},addEventListener(e,t){e.addEventListener("message",t)},async terminate(e){e.terminate()}};function z(e){p.push(e),E()}async function L(e,t,r,n){try{const n=await async function(e){const t=new DecompressionStream("deflate-raw"),r=t.writable.getWriter();r.write(e).then(()=>r.close()).catch(()=>{});const n=[],s=t.readable.getReader();for(;;){const{done:e,value:t}=await s.read();if(e)break;n.push(t)}const o=n.reduce((e,t)=>e+t.byteLength,0),i=new Uint8Array(o);let a=0;for(const e of n)i.set(e,a),a+=e.byteLength;return i}(e);r(t?new Blob([n],{type:t}):n.buffer)}catch(e){n(e)}}async function E(){if(0!==y.length){if(d.useWorkers&&h){const e=await async function(){if(0===p.length&&u<d.numWorkers){++u;try{const e=await v.createWorker(d.workerURL);w.push(e),p.push(e),v.addEventListener(e,g)}catch(e){h=!1}}return p.pop()}();if(h){if(e){if(0===y.length)return void z(e);const{id:t,src:r,uncompressedSize:n,type:s,resolve:o,reject:i}=y.shift();m.set(t,{id:t,src:r,uncompressedSize:n,type:s,resolve:o,reject:i});const a=[];e.postMessage({type:"inflate",data:{id:t,type:s,src:r,uncompressedSize:n}},a)}return}}for(;y.length;){const{src:e,type:t,resolve:r,reject:n}=y.shift();L(o(e)?await s(e):e,t,r,n)}}}function B(e,t,r){return new Promise((n,s)=>{y.push({src:e,uncompressedSize:t,type:r,resolve:n,reject:s,id:l++}),E()})}function S(e){e.splice(0,e.length)}class x{constructor(e,t){var r,n;this._reader=e,this._rawEntry=t,this.name=t.name,this.nameBytes=t.nameBytes,this.size=t.uncompressedSize,this.compressedSize=t.compressedSize,this.comment=t.comment,this.commentBytes=t.commentBytes,this.compressionMethod=t.compressionMethod,this.lastModDate=(r=t.lastModFileDate,n=t.lastModFileTime,new Date(1980+(r>>9&127),(r>>5&15)-1,31&r,n>>11&31,n>>5&63,2*(31&n),0)),this.isDirectory=0===t.uncompressedSize&&t.name.endsWith("/"),this.encrypted=!!(1&t.generalPurposeBitFlag),this.externalFileAttributes=t.externalFileAttributes,this.versionMadeBy=t.versionMadeBy}async blob(e="application/octet-stream"){return await async function(e,t,r){const{decompress:n,fileDataStart:s}=await D(e,t);if(!n){const n=await A(e,s,t.compressedSize,r);return o(n)?n:new Blob([n],{type:r})}const i=await A(e,s,t.compressedSize),a=await B((Uint8Array,i),t.uncompressedSize,r);return a}(this._reader,this._rawEntry,e)}async arrayBuffer(){return await async function(e,t){const{decompress:r,fileDataStart:n}=await D(e,t);if(!r){const r=await k(e,n,t.compressedSize);return 0===(s=r).byteOffset&&s.byteLength===s.buffer.byteLength?r.buffer:r.slice().buffer}var s;const o=await A(e,n,t.compressedSize);return await B((Uint8Array,o),t.uncompressedSize)}(this._reader,this._rawEntry)}async text(){const e=await this.arrayBuffer();return M(new Uint8Array(e))}async json(){const e=await this.text();return JSON.parse(e)}}async function k(e,t,r){return await e.read(t,r)}async function A(e,t,r,n){return e.sliceAsBlob?await e.sliceAsBlob(t,r,n):await e.read(t,r)}const $={unsigned:()=>0};function U(e,t){return e[t]+256*e[t+1]}function F(e,t){return e[t]+256*e[t+1]+65536*e[t+2]+16777216*e[t+3]}function O(e,t){return F(e,t)+4294967296*F(e,t+4)}const R=new TextDecoder;function M(e,t){return i(e.buffer)&&(e=new Uint8Array(e)),R.decode(e)}const W=117853008;async function N(e,t,r,n){const s=t-20,o=await k(e,s,20);if(F(o,0)!==W)throw new Error("invalid zip64 end of central directory locator signature");const i=O(o,8),a=await k(e,i,56);if(101075792!==F(a,0))throw new Error("invalid zip64 end of central directory record signature");const c=O(a,32),f=O(a,40);return j(e,O(a,48),f,c,r,n)}const T=33639248;async function j(e,t,r,n,s,o){let i=0;const a=await k(e,t,r),c=[];for(let e=0;e<n;++e){const e=a.subarray(i,i+46),t=F(e,0);if(t!==T)throw new Error(`invalid central directory file header signature: 0x${t.toString(16)}`);const r={versionMadeBy:U(e,4),versionNeededToExtract:U(e,6),generalPurposeBitFlag:U(e,8),compressionMethod:U(e,10),lastModFileTime:U(e,12),lastModFileDate:U(e,14),crc32:F(e,16),compressedSize:F(e,20),uncompressedSize:F(e,24),fileNameLength:U(e,28),extraFieldLength:U(e,30),fileCommentLength:U(e,32),internalFileAttributes:U(e,36),externalFileAttributes:F(e,38),relativeOffsetOfLocalHeader:F(e,42)};if(64&r.generalPurposeBitFlag)throw new Error("strong encryption is not supported");i+=46;const n=a.subarray(i,i+r.fileNameLength+r.extraFieldLength+r.fileCommentLength);r.generalPurposeBitFlag,r.nameBytes=n.slice(0,r.fileNameLength),r.name=M(r.nameBytes);const s=r.fileNameLength+r.extraFieldLength,o=n.slice(r.fileNameLength,s);r.extraFields=[];let f=0;for(;f<o.length-3;){const e=U(o,f+0),t=f+4,n=t+U(o,f+2);if(n>o.length)throw new Error("extra field length exceeds extra field buffer size");r.extraFields.push({id:e,data:o.slice(t,n)}),f=n}if(r.commentBytes=n.slice(s,s+r.fileCommentLength),r.comment=M(r.commentBytes),i+=n.length,4294967295===r.uncompressedSize||4294967295===r.compressedSize||4294967295===r.relativeOffsetOfLocalHeader){const e=r.extraFields.find(e=>1===e.id);if(!e)throw new Error("expected zip64 extended information extra field");const t=e.data;let n=0;if(4294967295===r.uncompressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include uncompressed size");r.uncompressedSize=O(t,n),n+=8}if(4294967295===r.compressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include compressed size");r.compressedSize=O(t,n),n+=8}if(4294967295===r.relativeOffsetOfLocalHeader){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include relative header offset");r.relativeOffsetOfLocalHeader=O(t,n),n+=8}}const d=r.extraFields.find(e=>28789===e.id&&e.data.length>=6&&1===e.data[0]&&F(e.data,1),$.unsigned());if(d&&(r.fileName=M(d.data.slice(5))),0===r.compressionMethod){let e=r.uncompressedSize;if(1&r.generalPurposeBitFlag&&(e+=12),r.compressedSize!==e)throw new Error(`compressed size mismatch for stored file: ${r.compressedSize} != ${e}`)}c.push(r)}return{zip:{comment:s,commentBytes:o},entries:c.map(t=>new x(e,t))}}async function D(e,t){if(1&t.generalPurposeBitFlag)throw new Error("encrypted entries not supported");const r=await k(e,t.relativeOffsetOfLocalHeader,30),n=await e.getLength(),s=F(r,0);if(67324752!==s)throw new Error(`invalid local file header signature: 0x${s.toString(16)}`);const o=U(r,26),i=U(r,28),a=t.relativeOffsetOfLocalHeader+r.length+o+i;let c;if(0===t.compressionMethod)c=!1;else{if(8!==t.compressionMethod)throw new Error(`unsupported compression method: ${t.compressionMethod}`);c=!0}const f=a,d=f+t.compressedSize;if(0!==t.compressedSize&&d>n)throw new Error(`file data overflows file bounds: ${f} +  ${t.compressedSize}  > ${n}`);return{decompress:c,fileDataStart:f}}async function P(e){let t;if("undefined"!=typeof Blob&&e instanceof Blob)t=new f(e);else if(e instanceof ArrayBuffer||e&&e.buffer&&e.buffer instanceof ArrayBuffer)t=new c(e);else if(i(e)||i(e.buffer))t=new c(e);else if("string"==typeof e){const r=await fetch(e);if(!r.ok)throw new Error(`failed http request ${e}, status: ${r.status}: ${r.statusText}`);const n=await r.blob();t=new f(n)}else{if("function"!=typeof e.getLength||"function"!=typeof e.read)throw new Error("unsupported source type");t=e}const r=await t.getLength();if(r>Number.MAX_SAFE_INTEGER)throw new Error(`file too large. size: ${r}. Only file sizes up 4503599627370496 bytes are supported`);return await async function(e,t){const r=Math.min(65557,t),n=t-r,s=await k(e,n,r);for(let t=r-22;t>=0;--t){if(101010256!==F(s,t))continue;const r=new Uint8Array(s.buffer,s.byteOffset+t,s.byteLength-t),o=U(r,4);if(0!==o)throw new Error(`multi-volume zip files are not supported. This is volume: ${o}`);const i=U(r,10),a=F(r,12),c=F(r,16),f=U(r,20),d=r.length-22;if(f!==d)throw new Error(`invalid comment length. expected: ${d}, actual: ${f}`);const l=new Uint8Array(r.buffer,r.byteOffset+22,f),u=M(l);return 65535===i||4294967295===c?await N(e,n+t,u,l):await j(e,c,a,i,u,l)}throw new Error("could not find end of central directory. maybe not zip file")}(t,r)}e.ArrayBufferReader=c,e.BlobReader=f,e.HTTPRangeReader=class{constructor(e){this.url=e}async getLength(){if(void 0===this.length){const e=await fetch(this.url,{method:"HEAD"});if(!e.ok)throw new Error(`failed http request ${this.url}, status: ${e.status}: ${e.statusText}`);if(this.length=parseInt(e.headers.get("content-length")),Number.isNaN(this.length))throw Error("could not get length")}return this.length}async read(e,t){if(0===t)return new Uint8Array(0);const r=await fetch(this.url,{headers:{Range:`bytes=${e}-${e+t-1}`}});if(!r.ok)throw new Error(`failed http request ${this.url}, status: ${r.status} offset: ${e} size: ${t}: ${r.statusText}`);const n=await r.arrayBuffer();return new Uint8Array(n)}},e.ZipEntry=x,e.cleanup=function(){!async function(){for(const e of w)await v.terminate(e);S(w),S(p),S(y),m.clear(),u=0,h=!0}()},e.setOptions=function(e){!function(e){d.workerURL=e.workerURL||d.workerURL,e.workerURL&&(d.useWorkers=!0),d.useWorkers=void 0!==e.useWorkers?e.useWorkers:d.useWorkers,d.numWorkers=e.numWorkers||d.numWorkers}(e)},e.unzip=async function(e){const{zip:t,entries:r}=await P(e);return{zip:t,entries:Object.fromEntries(r.map(e=>[e.name,e]))}},e.unzipRaw=P});
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).unzipit={})}(this,function(e){"use strict";var t,r;function n(e){return e.arrayBuffer?e.arrayBuffer():new Promise((t,r)=>{const n=new FileReader;n.addEventListener("loadend",()=>{t(n.result)}),n.addEventListener("error",r),n.readAsArrayBuffer(e)})}async function o(e){const t=await n(e);return new Uint8Array(t)}function s(e){return"undefined"!=typeof Blob&&e instanceof Blob}function i(e){return"undefined"!=typeof SharedArrayBuffer&&e instanceof SharedArrayBuffer}const a="undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(t=null===process||void 0===process?void 0:process.versions)||void 0===t?void 0:t.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron);class c{constructor(e){this.typedArray=e instanceof ArrayBuffer||i(e)?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}async getLength(){return this.typedArray.byteLength}async read(e,t){return new Uint8Array(this.typedArray.buffer,this.typedArray.byteOffset+e,t)}}class d{constructor(e){this.blob=e}async getLength(){return this.blob.size}async read(e,t){const r=this.blob.slice(e,e+t),o=await n(r);return new Uint8Array(o)}async sliceAsBlob(e,t,r=""){return this.blob.slice(e,e+t,r)}}const f={numWorkers:1,workerURL:"",useWorkers:!1};let l=0,u=0,h=!0;const p=[],w=[],m=[],y=new Map;function g(e){z(e.target);const{id:t,error:r,data:n}=e.data,o=y.get(t);if(y.delete(t),r)return void o.reject(new Error(r));const s=o.uncompressedSize,i=n instanceof ArrayBuffer?n.byteLength:null==n?void 0:n.size;"number"!=typeof s||"number"!=typeof i||s===i?o.resolve(n):o.reject(new Error(`decompressed size mismatch. declared: ${s}, actual: ${i}`))}function b(e){return new Promise((t,r)=>{const n=new Worker(e);n.onmessage=e=>{"start"===e.data?(n.onerror=null,n.onmessage=null,t(n)):r(new Error(`unexpected message: ${e.data}`))},n.onerror=r})}const v=a?{async createWorker(e){const{Worker:t}=await import("node:worker_threads");return new t(e)},addEventListener(e,t){var r;null===(r=e.on)||void 0===r||r.call(e,"message",r=>{t({target:e,data:r})})},async terminate(e){var t;await(null===(t=e.terminate)||void 0===t?void 0:t.call(e))}}:{async createWorker(e){try{return await b(e)}catch(t){console.warn("could not load worker:",e)}let t;try{const r=await fetch(e,{mode:"cors"});if(!r.ok)throw new Error(`could not load: ${e}`);t=await r.text(),e=URL.createObjectURL(new Blob([t],{type:"application/javascript"}));const n=await b(e);return f.workerURL=e,n}catch(t){console.warn("could not load worker via fetch:",e)}if(void 0!==t)try{e=`data:application/javascript;base64,${btoa(t)}`;const r=await b(e);return f.workerURL=e,r}catch(e){console.warn("could not load worker via dataURI")}throw console.warn("workers will not be used"),new Error("can not start workers")},addEventListener(e,t){var r;null===(r=e.addEventListener)||void 0===r||r.call(e,"message",t)},async terminate(e){var t;await(null===(t=e.terminate)||void 0===t?void 0:t.call(e))}};function z(e){w.push(e),E()}async function L(e,t,r,n,o){try{const s=t,i=await async function(e,t){const r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).then(()=>n.close()).catch(()=>{});const o=[],s=r.readable.getReader();let i=0;for(;;){const{done:e,value:r}=await s.read();if(e)break;const n=i+r.byteLength;if("number"==typeof t&&n>t)throw new Error(`decompressed size exceeds limit: ${n} > ${t}`);o.push(r),i=n}const a=o.reduce((e,t)=>e+t.byteLength,0),c=new Uint8Array(a);let d=0;for(const e of o)c.set(e,d),d+=e.byteLength;return c}(e,s),a=i.byteLength;if("number"==typeof t&&a!==t)return void o(new Error(`decompressed size mismatch. declared: ${t}, actual: ${a}`));n(r?new Blob([i],{type:r}):i.buffer)}catch(e){o(e)}}async function E(){var e;if(0!==m.length){if(f.useWorkers&&h){const t=await async function(){if(0===w.length&&u<f.numWorkers){++u;try{const e=await v.createWorker(f.workerURL);p.push(e),w.push(e),v.addEventListener(e,g)}catch(e){h=!1}}return w.pop()}();if(h){if(t){if(0===m.length)return void z(t);const{id:r,src:n,uncompressedSize:o,type:s,resolve:i,reject:a}=m.shift();y.set(r,{id:r,src:n,uncompressedSize:o,type:s,resolve:i,reject:a});const c=[];null===(e=t.postMessage)||void 0===e||e.call(t,{type:"inflate",data:{id:r,type:s,src:n,uncompressedSize:o}},c)}return}}for(;m.length;){const{src:e,uncompressedSize:t,type:r,resolve:n,reject:i}=m.shift(),a=s(e)?await o(e):e;try{await L(a,t,r,n,i)}catch(e){i(e)}}}}function B(e,t,r){return new Promise((n,o)=>{m.push({src:e,uncompressedSize:t,type:r,resolve:n,reject:o,id:l++}),E()})}function S(e){e.splice(0,e.length)}class x{constructor(e,t){var r,n;this._reader=e,this._rawEntry=t,this.name=t.name,this.nameBytes=t.nameBytes,this.size=t.uncompressedSize,this.compressedSize=t.compressedSize,this.comment=t.comment,this.commentBytes=t.commentBytes,this.compressionMethod=t.compressionMethod,this.lastModDate=(r=t.lastModFileDate,n=t.lastModFileTime,new Date(1980+(r>>9&127),(r>>5&15)-1,31&r,n>>11&31,n>>5&63,2*(31&n),0)),this.isDirectory=0===t.uncompressedSize&&t.name.endsWith("/"),this.encrypted=!!(1&t.generalPurposeBitFlag),this.externalFileAttributes=t.externalFileAttributes,this.versionMadeBy=t.versionMadeBy}async blob(e="application/octet-stream"){return await async function(e,t,r){const{decompress:n,fileDataStart:o}=await D(e,t);if(!n){const n=await k(e,o,t.compressedSize,r);return s(n)?n:new Blob([n],{type:r})}const i=await k(e,o,t.compressedSize),a=await B((Uint8Array,i),t.uncompressedSize,r);return a}(this._reader,this._rawEntry,e)}async arrayBuffer(){return await async function(e,t){const{decompress:r,fileDataStart:n}=await D(e,t);if(!r){const r=await A(e,n,t.compressedSize);return 0===(o=r).byteOffset&&o.byteLength===o.buffer.byteLength?r.buffer:r.slice().buffer}var o;const s=await k(e,n,t.compressedSize);return await B((Uint8Array,s),t.uncompressedSize)}(this._reader,this._rawEntry)}async text(){const e=await this.arrayBuffer();return M(new Uint8Array(e))}async json(){const e=await this.text();return JSON.parse(e)}}async function A(e,t,r){return await e.read(t,r)}async function k(e,t,r,n){return e.sliceAsBlob?await e.sliceAsBlob(t,r,n):await e.read(t,r)}const $={unsigned:()=>0};function U(e,t){return e[t]+256*e[t+1]}function F(e,t){return e[t]+256*e[t+1]+65536*e[t+2]+16777216*e[t+3]}function O(e,t){return F(e,t)+4294967296*F(e,t+4)}const R=new TextDecoder;function M(e,t){return i(e.buffer)&&(e=new Uint8Array(e)),R.decode(e)}const W=117853008;async function N(e,t,r,n){const o=t-20,s=await A(e,o,20);if(F(s,0)!==W)throw new Error("invalid zip64 end of central directory locator signature");const i=O(s,8),a=await A(e,i,56);if(101075792!==F(a,0))throw new Error("invalid zip64 end of central directory record signature");const c=O(a,32),d=O(a,40);return j(e,O(a,48),d,c,r,n)}const T=33639248;async function j(e,t,r,n,o,s){let i=0;const a=await A(e,t,r),c=[];for(let e=0;e<n;++e){const e=a.subarray(i,i+46),t=F(e,0);if(t!==T)throw new Error(`invalid central directory file header signature: 0x${t.toString(16)}`);const r={versionMadeBy:U(e,4),versionNeededToExtract:U(e,6),generalPurposeBitFlag:U(e,8),compressionMethod:U(e,10),lastModFileTime:U(e,12),lastModFileDate:U(e,14),crc32:F(e,16),compressedSize:F(e,20),uncompressedSize:F(e,24),fileNameLength:U(e,28),extraFieldLength:U(e,30),fileCommentLength:U(e,32),internalFileAttributes:U(e,36),externalFileAttributes:F(e,38),relativeOffsetOfLocalHeader:F(e,42)};if(64&r.generalPurposeBitFlag)throw new Error("strong encryption is not supported");i+=46;const n=a.subarray(i,i+r.fileNameLength+r.extraFieldLength+r.fileCommentLength);r.generalPurposeBitFlag,r.nameBytes=n.slice(0,r.fileNameLength),r.name=M(r.nameBytes);const o=r.fileNameLength+r.extraFieldLength,s=n.slice(r.fileNameLength,o);r.extraFields=[];let d=0;for(;d<s.length-3;){const e=U(s,d+0),t=d+4,n=t+U(s,d+2);if(n>s.length)throw new Error("extra field length exceeds extra field buffer size");r.extraFields.push({id:e,data:s.slice(t,n)}),d=n}if(r.commentBytes=n.slice(o,o+r.fileCommentLength),r.comment=M(r.commentBytes),i+=n.length,4294967295===r.uncompressedSize||4294967295===r.compressedSize||4294967295===r.relativeOffsetOfLocalHeader){const e=r.extraFields.find(e=>1===e.id);if(!e)throw new Error("expected zip64 extended information extra field");const t=e.data;let n=0;if(4294967295===r.uncompressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include uncompressed size");r.uncompressedSize=O(t,n),n+=8}if(4294967295===r.compressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include compressed size");r.compressedSize=O(t,n),n+=8}if(4294967295===r.relativeOffsetOfLocalHeader){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include relative header offset");r.relativeOffsetOfLocalHeader=O(t,n),n+=8}}const f=r.extraFields.find(e=>28789===e.id&&e.data.length>=6&&1===e.data[0]&&F(e.data,1),$.unsigned());if(f&&(r.fileName=M(f.data.slice(5))),0===r.compressionMethod){let e=r.uncompressedSize;if(1&r.generalPurposeBitFlag&&(e+=12),r.compressedSize!==e)throw new Error(`compressed size mismatch for stored file: ${r.compressedSize} != ${e}`)}c.push(r)}return{zip:{comment:o,commentBytes:s},entries:c.map(t=>new x(e,t))}}async function D(e,t){if(1&t.generalPurposeBitFlag)throw new Error("encrypted entries not supported");const r=await A(e,t.relativeOffsetOfLocalHeader,30),n=await e.getLength(),o=F(r,0);if(67324752!==o)throw new Error(`invalid local file header signature: 0x${o.toString(16)}`);const s=U(r,26),i=U(r,28),a=t.relativeOffsetOfLocalHeader+r.length+s+i;let c;if(0===t.compressionMethod)c=!1;else{if(8!==t.compressionMethod)throw new Error(`unsupported compression method: ${t.compressionMethod}`);c=!0}const d=a,f=d+t.compressedSize;if(0!==t.compressedSize&&f>n)throw new Error(`file data overflows file bounds: ${d} +  ${t.compressedSize}  > ${n}`);return{decompress:c,fileDataStart:d}}async function P(e){let t;if("undefined"!=typeof Blob&&e instanceof Blob)t=new d(e);else if(e instanceof ArrayBuffer||e&&e.buffer&&e.buffer instanceof ArrayBuffer)t=new c(e);else if(i(e)||i(e.buffer))t=new c(e);else if("string"==typeof e){const r=await fetch(e);if(!r.ok)throw new Error(`failed http request ${e}, status: ${r.status}: ${r.statusText}`);const n=await r.blob();t=new d(n)}else{if("function"!=typeof e.getLength||"function"!=typeof e.read)throw new Error("unsupported source type");t=e}const r=await t.getLength();if(r>Number.MAX_SAFE_INTEGER)throw new Error(`file too large. size: ${r}. Only file sizes up 4503599627370496 bytes are supported`);return await async function(e,t){const r=Math.min(65557,t),n=t-r,o=await A(e,n,r);for(let t=r-22;t>=0;--t){if(101010256!==F(o,t))continue;const r=new Uint8Array(o.buffer,o.byteOffset+t,o.byteLength-t),s=U(r,4);if(0!==s)throw new Error(`multi-volume zip files are not supported. This is volume: ${s}`);const i=U(r,10),a=F(r,12),c=F(r,16),d=U(r,20),f=r.length-22;if(d!==f)throw new Error(`invalid comment length. expected: ${f}, actual: ${d}`);const l=new Uint8Array(r.buffer,r.byteOffset+22,d),u=M(l);return 65535===i||4294967295===c?await N(e,n+t,u,l):await j(e,c,a,i,u,l)}throw new Error("could not find end of central directory. maybe not zip file")}(t,r)}e.ArrayBufferReader=c,e.BlobReader=d,e.HTTPRangeReader=class{constructor(e){this.url=e}async getLength(){if(void 0===this.length){const e=await fetch(this.url,{method:"HEAD"});if(!e.ok)throw new Error(`failed http request ${this.url}, status: ${e.status}: ${e.statusText}`);if(this.length=parseInt(e.headers.get("content-length")),Number.isNaN(this.length))throw Error("could not get length")}return this.length}async read(e,t){if(0===t)return new Uint8Array(0);const r=await fetch(this.url,{headers:{Range:`bytes=${e}-${e+t-1}`}});if(!r.ok)throw new Error(`failed http request ${this.url}, status: ${r.status} offset: ${e} size: ${t}: ${r.statusText}`);const n=await r.arrayBuffer();return new Uint8Array(n)}},e.ZipEntry=x,e.cleanup=function(){!async function(){for(const e of p)await v.terminate(e);S(p),S(w),S(m),y.clear(),u=0,h=!0}()},e.setOptions=function(e){!function(e){f.workerURL=e.workerURL||f.workerURL,e.workerURL&&(f.useWorkers=!0),f.useWorkers=void 0!==e.useWorkers?e.useWorkers:f.useWorkers,f.numWorkers=e.numWorkers||f.numWorkers}(e)},e.unzip=async function(e){const{zip:t,entries:r}=await P(e);return{zip:t,entries:Object.fromEntries(r.map(e=>[e.name,e]))}},e.unzipRaw=P});

package/dist/unzipit.module.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.0, license MIT */
+/* unzipit@2.0.3, license MIT */
 var _a, _b;
 function readBlobAsArrayBuffer(blob) {
     if (blob.arrayBuffer) {
@@ -119,24 +119,30 @@ let nextId = 0;
 // come in before a worker gets added to `workers`
 let numWorkers = 0;
 let canUseWorkers = true; // gets set to false if we can't start a worker
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const workers = [];
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const availableWorkers = [];
 const waitingForWorkerQueue = [];
 const currentlyProcessingIdToRequestMap = new Map();
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 function handleResult(e) {
     makeWorkerAvailable(e.target);
     const { id, error, data } = e.data;
     const request = currentlyProcessingIdToRequestMap.get(id);
     currentlyProcessingIdToRequestMap.delete(id);
     if (error) {
-        request.reject(error);
+        // The worker can only structured-clone the error as a string, so wrap it
+        // back into an Error to match the rejection type of the non-worker path.
+        request.reject(new Error(error));
+        return;
     }
-    else {
-        request.resolve(data);
+    // Verify that the decompressed size matches the declared uncompressedSize
+    // Treat declared size as authoritative metadata that must be verified.
+    const expected = request.uncompressedSize;
+    const actual = data instanceof ArrayBuffer ? data.byteLength : data === null || data === void 0 ? void 0 : data.size;
+    if (typeof expected === 'number' && typeof actual === 'number' && expected !== actual) {
+        request.reject(new Error(`decompressed size mismatch. declared: ${expected}, actual: ${actual}`));
+        return;
     }
+    request.resolve(data);
 }
 // Because Firefox uses non-standard onerror to signal an error.
 function startWorker(url) {
@@ -158,27 +164,25 @@ function startWorker(url) {
 const workerHelper = (function () {
     if (isNode) {
         return {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async createWorker(url) {
-                const { Worker } = await import('worker_threads');
+                const moduleId = 'node:worker_threads';
+                const { Worker } = await import(moduleId);
                 return new Worker(url);
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             addEventListener(worker, fn) {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                worker.on('message', (data) => {
+                var _a;
+                (_a = worker.on) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', (data) => {
                     fn({ target: worker, data });
                 });
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async terminate(worker) {
-                await worker.terminate();
+                var _a;
+                await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
             },
         };
     }
     else {
         return {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async createWorker(url) {
                 // I don't understand this security issue
                 // Apparently there is some iframe setting or http header
@@ -221,23 +225,23 @@ const workerHelper = (function () {
                 console.warn('workers will not be used');
                 throw new Error('can not start workers');
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             addEventListener(worker, fn) {
-                worker.addEventListener('message', fn);
+                var _a;
+                // The browser delivers a MessageEvent whose `target` is the worker
+                // and whose `data` is the InflateResultMessage, matching WorkerResultEvent.
+                (_a = worker.addEventListener) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', fn);
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async terminate(worker) {
-                worker.terminate();
+                var _a;
+                await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
             },
         };
     }
 }());
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 function makeWorkerAvailable(worker) {
     availableWorkers.push(worker);
     processWaitingForWorkerQueue();
 }
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 async function getAvailableWorker() {
     if (availableWorkers.length === 0 && numWorkers < config.numWorkers) {
         ++numWorkers; // see comment at numWorkers declaration
@@ -254,7 +258,7 @@ async function getAvailableWorker() {
     }
     return availableWorkers.pop();
 }
-async function decompressRaw(src) {
+async function decompressRaw(src, limit) {
     const ds = new DecompressionStream('deflate-raw');
     const writer = ds.writable.getWriter();
     // Do not await the write — doing so before reading causes a deadlock when
@@ -262,12 +266,19 @@ async function decompressRaw(src) {
     writer.write(src).then(() => writer.close()).catch(() => { });
     const chunks = [];
     const reader = ds.readable.getReader();
+    let seen = 0;
     for (;;) {
         const { done, value } = await reader.read();
         if (done) {
             break;
         }
+        // If this chunk would push us past the configured/declared limit, abort
+        const newSeen = seen + value.byteLength;
+        if (typeof limit === 'number' && newSeen > limit) {
+            throw new Error(`decompressed size exceeds limit: ${newSeen} > ${limit}`);
+        }
         chunks.push(value);
+        seen = newSeen;
     }
     const size = chunks.reduce((s, c) => s + c.byteLength, 0);
     const result = new Uint8Array(size);
@@ -281,9 +292,15 @@ async function decompressRaw(src) {
 // @param {Uint8Array} src
 // @param {string} [type] mime-type
 // @returns {ArrayBuffer|Blob} ArrayBuffer if type is falsy or Blob otherwise.
-async function inflateRawLocal(src, type, resolve, reject) {
+async function inflateRawLocal(src, uncompressedSize, type, resolve, reject) {
     try {
-        const dst = await decompressRaw(src);
+        const limit = uncompressedSize;
+        const dst = await decompressRaw(src, limit);
+        const actual = dst.byteLength;
+        if (typeof uncompressedSize === 'number' && actual !== uncompressedSize) {
+            reject(new Error(`decompressed size mismatch. declared: ${uncompressedSize}, actual: ${actual}`));
+            return;
+        }
         resolve(type ? new Blob([dst], { type }) : dst.buffer);
     }
     catch (e) {
@@ -291,6 +308,7 @@ async function inflateRawLocal(src, type, resolve, reject) {
     }
 }
 async function processWaitingForWorkerQueue() {
+    var _a;
     if (waitingForWorkerQueue.length === 0) {
         return;
     }
@@ -320,7 +338,7 @@ async function processWaitingForWorkerQueue() {
                 //if (!isBlob(src) && !isSharedArrayBuffer(src)) {
                 //  transferables.push(src);
                 //}
-                worker.postMessage({
+                (_a = worker.postMessage) === null || _a === void 0 ? void 0 : _a.call(worker, {
                     type: 'inflate',
                     data: {
                         id,
@@ -339,9 +357,14 @@ async function processWaitingForWorkerQueue() {
     // will then be on the queue. But if we fail to make workers then there
     // are pending requests.
     while (waitingForWorkerQueue.length) {
-        const { src, type, resolve, reject } = waitingForWorkerQueue.shift();
+        const { src, uncompressedSize, type, resolve, reject } = waitingForWorkerQueue.shift();
         const data = isBlob(src) ? await readBlobAsUint8Array(src) : src;
-        inflateRawLocal(data, type, resolve, reject);
+        try {
+            await inflateRawLocal(data, uncompressedSize, type, resolve, reject);
+        }
+        catch (e) {
+            reject(e);
+        }
     }
 }
 function setOptions$1(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unzipit",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "random access unzip library for JavaScript",
   "type": "module",
   "main": "dist/unzipit.module.js",
@@ -10,11 +10,12 @@
     "node": ">=18"
   },
   "scripts": {
-    "build": "npm run build-js && npm run build-types && node build/copy.js node_modules/chai/index.js test/chai.js && node build/copy.js node_modules/mocha/mocha.js test/mocha.js && node build/copy.js node_modules/mocha/mocha.css test/mocha.css",
+    "build": "npm run build-js && npm run build-types && npm run build-ts-test && node build/copy.js node_modules/chai/index.js test/chai.js && node build/copy.js node_modules/mocha/mocha.js test/mocha.js && node build/copy.js node_modules/mocha/mocha.css test/mocha.css",
     "build-ci": "npm run build && node build/prep-for-deploy.js",
     "build-normal": "rollup -c",
     "build-js": "rollup -c",
     "build-types": "tsc -p tsconfig.build.json",
+    "build-ts-test": "rollup -c test/ts/rollup.test.config.js",
     "eslint": "eslint src/**/*.ts test/index.js test/node-test.js test/puppeteer.js test/tests/**/*.js",
     "test": "npm run test-node && npm run test-browser",
     "test-node": "mocha test/node-test.js",