unzipit 2.0.1 → 2.0.3

package/README.md

@@ -1,7 +1,7 @@
-# unzipit.js
+# unzipit
 
 <img src="./unzipit-no-anim.png" style="max-width: 640px">
-
+<!-- cut here -->
 Random access unzip library for browser and node based JavaScript
 
 [![Build and Deploy](https://github.com/greggman/unzipit/actions/workflows/build_and_deploy.yml/badge.svg)](https://github.com/greggman/unzipit/actions/workflows/build_and_deploy.yml)
@@ -90,7 +90,7 @@ You can also pass a [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Bl
 or your own `Reader`
 
 For using without a builder/bundler grab `unzipit.min.js` or `unzipit.module.js` from
-the [`dist`](https://github.com/greggman/unzipit/tree/master/dist) folder and
+the [`dist`](https://github.com/greggman/unzipit/tree/gh-pages/dist) folder and
 include with
 
 ```js
@@ -106,13 +106,13 @@ or
 or vs CDN
 
 ```js
-import * as unzipit from 'https://unpkg.com/unzipit@1.4.0/dist/unzipit.module.js';
+import * as unzipit from 'https://unpkg.com/unzipit@2.0.1/dist/unzipit.module.js';
 ```
 
 or
 
 ```html
-<script src="https://unpkg.com/unzipit@1.4.0/dist/unzipit.js"></script>
+<script src="https://unpkg.com/unzipit@2.0.1/dist/unzipit.js"></script>
 ```
 ## Node
 

package/dist/inflate-types.d.ts

@@ -0,0 +1,15 @@
+export interface InflateRequestData {
+    id: number;
+    type?: string;
+    src: Uint8Array<ArrayBuffer> | Blob;
+    uncompressedSize: number;
+}
+export interface InflateRequestMessage {
+    type: 'inflate';
+    data: InflateRequestData;
+}
+export interface InflateResultMessage {
+    id: number;
+    data?: ArrayBuffer | Blob;
+    error?: string;
+}

package/dist/unzipit-worker.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.1, license MIT */
+/* unzipit@2.0.3, license MIT */
 (function (factory) {
   typeof define === 'function' && define.amd ? define(factory) :
   factory();
@@ -47,18 +47,23 @@
   // then 50 blobs will be asked to be read at once.
   // If feels like that should happen at a higher level (user code)
   // or a lower level (the browser)?
-  async function decompressRaw(src) {
+  async function decompressRaw(src, maxLimit) {
       const ds = new DecompressionStream('deflate-raw');
       const writer = ds.writable.getWriter();
       writer.write(src).then(() => writer.close()).catch(() => { });
       const chunks = [];
       const reader = ds.readable.getReader();
+      let seen = 0;
       for (;;) {
           const { done, value } = await reader.read();
           if (done) {
               break;
           }
           chunks.push(value);
+          seen += value.byteLength;
+          if (typeof maxLimit === 'number' && seen > maxLimit) {
+              throw new Error(`decompressed size exceeds limit: ${seen} > ${maxLimit}`);
+          }
       }
       const size = chunks.reduce((s, c) => s + c.byteLength, 0);
       const result = new Uint8Array(size);
@@ -75,7 +80,9 @@
           const srcData = isBlob(src)
               ? await readBlobAsUint8Array(src)
               : new Uint8Array(src);
-          const dstData = await decompressRaw(srcData);
+          // Enforce declared uncompressedSize as the streaming limit
+          const limit = typeof req.uncompressedSize === 'number' ? req.uncompressedSize : undefined;
+          const dstData = await decompressRaw(srcData, limit);
           const transferables = [];
           let data;
           if (type) {
@@ -107,13 +114,11 @@
       const moduleId = 'node:worker_threads';
       import(moduleId).then(({ parentPort }) => {
           parentPort.on('message', (msg) => {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               handleMessage(msg, (m, t) => parentPort.postMessage(m, t));
           });
       });
   }
   else {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const workerSelf = self;
       workerSelf.addEventListener('message', (e) => {
           handleMessage(e.data, (m, t) => workerSelf.postMessage(m, t));

package/dist/unzipit-worker.min.js

@@ -1 +1 @@
-!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";var e,r;async function n(e){const r=await function(e){return e.arrayBuffer?e.arrayBuffer():new Promise((r,n)=>{const t=new FileReader;t.addEventListener("loadend",()=>{r(t.result)}),t.addEventListener("error",n),t.readAsArrayBuffer(e)})}(e);return new Uint8Array(r)}async function t(e,r){const{id:t,src:o,type:s}=e;try{const e=(a=o,"undefined"!=typeof Blob&&a instanceof Blob?await n(o):new Uint8Array(o)),i=await async function(e){const r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).then(()=>n.close()).catch(()=>{});const t=[],o=r.readable.getReader();for(;;){const{done:e,value:r}=await o.read();if(e)break;t.push(r)}const s=t.reduce((e,r)=>e+r.byteLength,0),a=new Uint8Array(s);let i=0;for(const e of t)a.set(e,i),i+=e.byteLength;return a}(e),d=[];let c;s?c=new Blob([i],{type:s}):(c=i.buffer,d.push(c)),r({id:t,data:c},d)}catch(e){console.error(e),r({id:t,error:`${e}`})}var a}function o(e,r){const{type:n,data:o}=e;if("inflate"!==n)throw new Error("no handler for type: "+n);t(o,r)}if("undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(e=null===process||void 0===process?void 0:process.versions)||void 0===e?void 0:e.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron)){import("node:worker_threads").then(({parentPort:e})=>{e.on("message",r=>{o(r,(r,n)=>e.postMessage(r,n))})})}else{const e=self;e.addEventListener("message",r=>{o(r.data,(r,n)=>e.postMessage(r,n))}),e.postMessage("start")}});
+!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";var e,r;async function n(e){const r=await function(e){return e.arrayBuffer?e.arrayBuffer():new Promise((r,n)=>{const o=new FileReader;o.addEventListener("loadend",()=>{r(o.result)}),o.addEventListener("error",n),o.readAsArrayBuffer(e)})}(e);return new Uint8Array(r)}async function o(e,r){const{id:o,src:t,type:s}=e;try{const a=(i=t,"undefined"!=typeof Blob&&i instanceof Blob?await n(t):new Uint8Array(t)),d="number"==typeof e.uncompressedSize?e.uncompressedSize:void 0,c=await async function(e,r){const n=new DecompressionStream("deflate-raw"),o=n.writable.getWriter();o.write(e).then(()=>o.close()).catch(()=>{});const t=[],s=n.readable.getReader();let i=0;for(;;){const{done:e,value:n}=await s.read();if(e)break;if(t.push(n),i+=n.byteLength,"number"==typeof r&&i>r)throw new Error(`decompressed size exceeds limit: ${i} > ${r}`)}const a=t.reduce((e,r)=>e+r.byteLength,0),d=new Uint8Array(a);let c=0;for(const e of t)d.set(e,c),c+=e.byteLength;return d}(a,d),f=[];let u;s?u=new Blob([c],{type:s}):(u=c.buffer,f.push(u)),r({id:o,data:u},f)}catch(e){console.error(e),r({id:o,error:`${e}`})}var i}function t(e,r){const{type:n,data:t}=e;if("inflate"!==n)throw new Error("no handler for type: "+n);o(t,r)}if("undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(e=null===process||void 0===process?void 0:process.versions)||void 0===e?void 0:e.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron)){import("node:worker_threads").then(({parentPort:e})=>{e.on("message",r=>{t(r,(r,n)=>e.postMessage(r,n))})})}else{const e=self;e.addEventListener("message",r=>{t(r.data,(r,n)=>e.postMessage(r,n))}),e.postMessage("start")}});

package/dist/unzipit-worker.module.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.1, license MIT */
+/* unzipit@2.0.3, license MIT */
 var _a, _b;
 function readBlobAsArrayBuffer(blob) {
     if (blob.arrayBuffer) {
@@ -42,18 +42,23 @@ const isNode = (typeof process !== 'undefined') &&
 // then 50 blobs will be asked to be read at once.
 // If feels like that should happen at a higher level (user code)
 // or a lower level (the browser)?
-async function decompressRaw(src) {
+async function decompressRaw(src, maxLimit) {
     const ds = new DecompressionStream('deflate-raw');
     const writer = ds.writable.getWriter();
     writer.write(src).then(() => writer.close()).catch(() => { });
     const chunks = [];
     const reader = ds.readable.getReader();
+    let seen = 0;
     for (;;) {
         const { done, value } = await reader.read();
         if (done) {
             break;
         }
         chunks.push(value);
+        seen += value.byteLength;
+        if (typeof maxLimit === 'number' && seen > maxLimit) {
+            throw new Error(`decompressed size exceeds limit: ${seen} > ${maxLimit}`);
+        }
     }
     const size = chunks.reduce((s, c) => s + c.byteLength, 0);
     const result = new Uint8Array(size);
@@ -70,7 +75,9 @@ async function inflate(req, postMessage) {
         const srcData = isBlob(src)
             ? await readBlobAsUint8Array(src)
             : new Uint8Array(src);
-        const dstData = await decompressRaw(srcData);
+        // Enforce declared uncompressedSize as the streaming limit
+        const limit = typeof req.uncompressedSize === 'number' ? req.uncompressedSize : undefined;
+        const dstData = await decompressRaw(srcData, limit);
         const transferables = [];
         let data;
         if (type) {
@@ -102,13 +109,11 @@ if (isNode) {
     const moduleId = 'node:worker_threads';
     import(moduleId).then(({ parentPort }) => {
         parentPort.on('message', (msg) => {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             handleMessage(msg, (m, t) => parentPort.postMessage(m, t));
         });
     });
 }
 else {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const workerSelf = self;
     workerSelf.addEventListener('message', (e) => {
         handleMessage(e.data, (m, t) => workerSelf.postMessage(m, t));

package/dist/unzipit.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.1, license MIT */
+/* unzipit@2.0.3, license MIT */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
   typeof define === 'function' && define.amd ? define(['exports'], factory) :
@@ -125,24 +125,30 @@
   // come in before a worker gets added to `workers`
   let numWorkers = 0;
   let canUseWorkers = true; // gets set to false if we can't start a worker
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const workers = [];
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const availableWorkers = [];
   const waitingForWorkerQueue = [];
   const currentlyProcessingIdToRequestMap = new Map();
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function handleResult(e) {
       makeWorkerAvailable(e.target);
       const { id, error, data } = e.data;
       const request = currentlyProcessingIdToRequestMap.get(id);
       currentlyProcessingIdToRequestMap.delete(id);
       if (error) {
-          request.reject(error);
+          // The worker can only structured-clone the error as a string, so wrap it
+          // back into an Error to match the rejection type of the non-worker path.
+          request.reject(new Error(error));
+          return;
       }
-      else {
-          request.resolve(data);
+      // Verify that the decompressed size matches the declared uncompressedSize
+      // Treat declared size as authoritative metadata that must be verified.
+      const expected = request.uncompressedSize;
+      const actual = data instanceof ArrayBuffer ? data.byteLength : data === null || data === void 0 ? void 0 : data.size;
+      if (typeof expected === 'number' && typeof actual === 'number' && expected !== actual) {
+          request.reject(new Error(`decompressed size mismatch. declared: ${expected}, actual: ${actual}`));
+          return;
       }
+      request.resolve(data);
   }
   // Because Firefox uses non-standard onerror to signal an error.
   function startWorker(url) {
@@ -164,28 +170,25 @@
   const workerHelper = (function () {
       if (isNode) {
           return {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async createWorker(url) {
                   const moduleId = 'node:worker_threads';
                   const { Worker } = await import(moduleId);
                   return new Worker(url);
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               addEventListener(worker, fn) {
-                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                  worker.on('message', (data) => {
+                  var _a;
+                  (_a = worker.on) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', (data) => {
                       fn({ target: worker, data });
                   });
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async terminate(worker) {
-                  await worker.terminate();
+                  var _a;
+                  await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
               },
           };
       }
       else {
           return {
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async createWorker(url) {
                   // I don't understand this security issue
                   // Apparently there is some iframe setting or http header
@@ -228,23 +231,23 @@
                   console.warn('workers will not be used');
                   throw new Error('can not start workers');
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               addEventListener(worker, fn) {
-                  worker.addEventListener('message', fn);
+                  var _a;
+                  // The browser delivers a MessageEvent whose `target` is the worker
+                  // and whose `data` is the InflateResultMessage, matching WorkerResultEvent.
+                  (_a = worker.addEventListener) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', fn);
               },
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
               async terminate(worker) {
-                  worker.terminate();
+                  var _a;
+                  await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
               },
           };
       }
   }());
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function makeWorkerAvailable(worker) {
       availableWorkers.push(worker);
       processWaitingForWorkerQueue();
   }
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async function getAvailableWorker() {
       if (availableWorkers.length === 0 && numWorkers < config.numWorkers) {
           ++numWorkers; // see comment at numWorkers declaration
@@ -261,7 +264,7 @@
       }
       return availableWorkers.pop();
   }
-  async function decompressRaw(src) {
+  async function decompressRaw(src, limit) {
       const ds = new DecompressionStream('deflate-raw');
       const writer = ds.writable.getWriter();
       // Do not await the write — doing so before reading causes a deadlock when
@@ -269,12 +272,19 @@
       writer.write(src).then(() => writer.close()).catch(() => { });
       const chunks = [];
       const reader = ds.readable.getReader();
+      let seen = 0;
       for (;;) {
           const { done, value } = await reader.read();
           if (done) {
               break;
           }
+          // If this chunk would push us past the configured/declared limit, abort
+          const newSeen = seen + value.byteLength;
+          if (typeof limit === 'number' && newSeen > limit) {
+              throw new Error(`decompressed size exceeds limit: ${newSeen} > ${limit}`);
+          }
           chunks.push(value);
+          seen = newSeen;
       }
       const size = chunks.reduce((s, c) => s + c.byteLength, 0);
       const result = new Uint8Array(size);
@@ -288,9 +298,15 @@
   // @param {Uint8Array} src
   // @param {string} [type] mime-type
   // @returns {ArrayBuffer|Blob} ArrayBuffer if type is falsy or Blob otherwise.
-  async function inflateRawLocal(src, type, resolve, reject) {
+  async function inflateRawLocal(src, uncompressedSize, type, resolve, reject) {
       try {
-          const dst = await decompressRaw(src);
+          const limit = uncompressedSize;
+          const dst = await decompressRaw(src, limit);
+          const actual = dst.byteLength;
+          if (typeof uncompressedSize === 'number' && actual !== uncompressedSize) {
+              reject(new Error(`decompressed size mismatch. declared: ${uncompressedSize}, actual: ${actual}`));
+              return;
+          }
           resolve(type ? new Blob([dst], { type }) : dst.buffer);
       }
       catch (e) {
@@ -298,6 +314,7 @@
       }
   }
   async function processWaitingForWorkerQueue() {
+      var _a;
       if (waitingForWorkerQueue.length === 0) {
           return;
       }
@@ -327,7 +344,7 @@
                   //if (!isBlob(src) && !isSharedArrayBuffer(src)) {
                   //  transferables.push(src);
                   //}
-                  worker.postMessage({
+                  (_a = worker.postMessage) === null || _a === void 0 ? void 0 : _a.call(worker, {
                       type: 'inflate',
                       data: {
                           id,
@@ -346,9 +363,14 @@
       // will then be on the queue. But if we fail to make workers then there
       // are pending requests.
       while (waitingForWorkerQueue.length) {
-          const { src, type, resolve, reject } = waitingForWorkerQueue.shift();
+          const { src, uncompressedSize, type, resolve, reject } = waitingForWorkerQueue.shift();
           const data = isBlob(src) ? await readBlobAsUint8Array(src) : src;
-          inflateRawLocal(data, type, resolve, reject);
+          try {
+              await inflateRawLocal(data, uncompressedSize, type, resolve, reject);
+          }
+          catch (e) {
+              reject(e);
+          }
       }
   }
   function setOptions$1(options) {

package/dist/unzipit.min.js

@@ -1 +1 @@
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).unzipit={})}(this,function(e){"use strict";var t,r;function n(e){return e.arrayBuffer?e.arrayBuffer():new Promise((t,r)=>{const n=new FileReader;n.addEventListener("loadend",()=>{t(n.result)}),n.addEventListener("error",r),n.readAsArrayBuffer(e)})}async function s(e){const t=await n(e);return new Uint8Array(t)}function o(e){return"undefined"!=typeof Blob&&e instanceof Blob}function i(e){return"undefined"!=typeof SharedArrayBuffer&&e instanceof SharedArrayBuffer}const a="undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(t=null===process||void 0===process?void 0:process.versions)||void 0===t?void 0:t.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron);class c{constructor(e){this.typedArray=e instanceof ArrayBuffer||i(e)?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}async getLength(){return this.typedArray.byteLength}async read(e,t){return new Uint8Array(this.typedArray.buffer,this.typedArray.byteOffset+e,t)}}class f{constructor(e){this.blob=e}async getLength(){return this.blob.size}async read(e,t){const r=this.blob.slice(e,e+t),s=await n(r);return new Uint8Array(s)}async sliceAsBlob(e,t,r=""){return this.blob.slice(e,e+t,r)}}const d={numWorkers:1,workerURL:"",useWorkers:!1};let l=0,u=0,h=!0;const w=[],p=[],y=[],m=new Map;function g(e){z(e.target);const{id:t,error:r,data:n}=e.data,s=m.get(t);m.delete(t),r?s.reject(r):s.resolve(n)}function b(e){return new Promise((t,r)=>{const n=new Worker(e);n.onmessage=e=>{"start"===e.data?(n.onerror=null,n.onmessage=null,t(n)):r(new Error(`unexpected message: ${e.data}`))},n.onerror=r})}const v=a?{async createWorker(e){const{Worker:t}=await import("node:worker_threads");return new t(e)},addEventListener(e,t){e.on("message",r=>{t({target:e,data:r})})},async terminate(e){await e.terminate()}}:{async createWorker(e){try{return await b(e)}catch(t){console.warn("could not load worker:",e)}let t;try{const r=await fetch(e,{mode:"cors"});if(!r.ok)throw new Error(`could not load: ${e}`);t=await r.text(),e=URL.createObjectURL(new Blob([t],{type:"application/javascript"}));const n=await b(e);return d.workerURL=e,n}catch(t){console.warn("could not load worker via fetch:",e)}if(void 0!==t)try{e=`data:application/javascript;base64,${btoa(t)}`;const r=await b(e);return d.workerURL=e,r}catch(e){console.warn("could not load worker via dataURI")}throw console.warn("workers will not be used"),new Error("can not start workers")},addEventListener(e,t){e.addEventListener("message",t)},async terminate(e){e.terminate()}};function z(e){p.push(e),E()}async function L(e,t,r,n){try{const n=await async function(e){const t=new DecompressionStream("deflate-raw"),r=t.writable.getWriter();r.write(e).then(()=>r.close()).catch(()=>{});const n=[],s=t.readable.getReader();for(;;){const{done:e,value:t}=await s.read();if(e)break;n.push(t)}const o=n.reduce((e,t)=>e+t.byteLength,0),i=new Uint8Array(o);let a=0;for(const e of n)i.set(e,a),a+=e.byteLength;return i}(e);r(t?new Blob([n],{type:t}):n.buffer)}catch(e){n(e)}}async function E(){if(0!==y.length){if(d.useWorkers&&h){const e=await async function(){if(0===p.length&&u<d.numWorkers){++u;try{const e=await v.createWorker(d.workerURL);w.push(e),p.push(e),v.addEventListener(e,g)}catch(e){h=!1}}return p.pop()}();if(h){if(e){if(0===y.length)return void z(e);const{id:t,src:r,uncompressedSize:n,type:s,resolve:o,reject:i}=y.shift();m.set(t,{id:t,src:r,uncompressedSize:n,type:s,resolve:o,reject:i});const a=[];e.postMessage({type:"inflate",data:{id:t,type:s,src:r,uncompressedSize:n}},a)}return}}for(;y.length;){const{src:e,type:t,resolve:r,reject:n}=y.shift();L(o(e)?await s(e):e,t,r,n)}}}function B(e,t,r){return new Promise((n,s)=>{y.push({src:e,uncompressedSize:t,type:r,resolve:n,reject:s,id:l++}),E()})}function S(e){e.splice(0,e.length)}class x{constructor(e,t){var r,n;this._reader=e,this._rawEntry=t,this.name=t.name,this.nameBytes=t.nameBytes,this.size=t.uncompressedSize,this.compressedSize=t.compressedSize,this.comment=t.comment,this.commentBytes=t.commentBytes,this.compressionMethod=t.compressionMethod,this.lastModDate=(r=t.lastModFileDate,n=t.lastModFileTime,new Date(1980+(r>>9&127),(r>>5&15)-1,31&r,n>>11&31,n>>5&63,2*(31&n),0)),this.isDirectory=0===t.uncompressedSize&&t.name.endsWith("/"),this.encrypted=!!(1&t.generalPurposeBitFlag),this.externalFileAttributes=t.externalFileAttributes,this.versionMadeBy=t.versionMadeBy}async blob(e="application/octet-stream"){return await async function(e,t,r){const{decompress:n,fileDataStart:s}=await D(e,t);if(!n){const n=await A(e,s,t.compressedSize,r);return o(n)?n:new Blob([n],{type:r})}const i=await A(e,s,t.compressedSize),a=await B((Uint8Array,i),t.uncompressedSize,r);return a}(this._reader,this._rawEntry,e)}async arrayBuffer(){return await async function(e,t){const{decompress:r,fileDataStart:n}=await D(e,t);if(!r){const r=await k(e,n,t.compressedSize);return 0===(s=r).byteOffset&&s.byteLength===s.buffer.byteLength?r.buffer:r.slice().buffer}var s;const o=await A(e,n,t.compressedSize);return await B((Uint8Array,o),t.uncompressedSize)}(this._reader,this._rawEntry)}async text(){const e=await this.arrayBuffer();return M(new Uint8Array(e))}async json(){const e=await this.text();return JSON.parse(e)}}async function k(e,t,r){return await e.read(t,r)}async function A(e,t,r,n){return e.sliceAsBlob?await e.sliceAsBlob(t,r,n):await e.read(t,r)}const $={unsigned:()=>0};function U(e,t){return e[t]+256*e[t+1]}function F(e,t){return e[t]+256*e[t+1]+65536*e[t+2]+16777216*e[t+3]}function O(e,t){return F(e,t)+4294967296*F(e,t+4)}const R=new TextDecoder;function M(e,t){return i(e.buffer)&&(e=new Uint8Array(e)),R.decode(e)}const W=117853008;async function N(e,t,r,n){const s=t-20,o=await k(e,s,20);if(F(o,0)!==W)throw new Error("invalid zip64 end of central directory locator signature");const i=O(o,8),a=await k(e,i,56);if(101075792!==F(a,0))throw new Error("invalid zip64 end of central directory record signature");const c=O(a,32),f=O(a,40);return j(e,O(a,48),f,c,r,n)}const T=33639248;async function j(e,t,r,n,s,o){let i=0;const a=await k(e,t,r),c=[];for(let e=0;e<n;++e){const e=a.subarray(i,i+46),t=F(e,0);if(t!==T)throw new Error(`invalid central directory file header signature: 0x${t.toString(16)}`);const r={versionMadeBy:U(e,4),versionNeededToExtract:U(e,6),generalPurposeBitFlag:U(e,8),compressionMethod:U(e,10),lastModFileTime:U(e,12),lastModFileDate:U(e,14),crc32:F(e,16),compressedSize:F(e,20),uncompressedSize:F(e,24),fileNameLength:U(e,28),extraFieldLength:U(e,30),fileCommentLength:U(e,32),internalFileAttributes:U(e,36),externalFileAttributes:F(e,38),relativeOffsetOfLocalHeader:F(e,42)};if(64&r.generalPurposeBitFlag)throw new Error("strong encryption is not supported");i+=46;const n=a.subarray(i,i+r.fileNameLength+r.extraFieldLength+r.fileCommentLength);r.generalPurposeBitFlag,r.nameBytes=n.slice(0,r.fileNameLength),r.name=M(r.nameBytes);const s=r.fileNameLength+r.extraFieldLength,o=n.slice(r.fileNameLength,s);r.extraFields=[];let f=0;for(;f<o.length-3;){const e=U(o,f+0),t=f+4,n=t+U(o,f+2);if(n>o.length)throw new Error("extra field length exceeds extra field buffer size");r.extraFields.push({id:e,data:o.slice(t,n)}),f=n}if(r.commentBytes=n.slice(s,s+r.fileCommentLength),r.comment=M(r.commentBytes),i+=n.length,4294967295===r.uncompressedSize||4294967295===r.compressedSize||4294967295===r.relativeOffsetOfLocalHeader){const e=r.extraFields.find(e=>1===e.id);if(!e)throw new Error("expected zip64 extended information extra field");const t=e.data;let n=0;if(4294967295===r.uncompressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include uncompressed size");r.uncompressedSize=O(t,n),n+=8}if(4294967295===r.compressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include compressed size");r.compressedSize=O(t,n),n+=8}if(4294967295===r.relativeOffsetOfLocalHeader){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include relative header offset");r.relativeOffsetOfLocalHeader=O(t,n),n+=8}}const d=r.extraFields.find(e=>28789===e.id&&e.data.length>=6&&1===e.data[0]&&F(e.data,1),$.unsigned());if(d&&(r.fileName=M(d.data.slice(5))),0===r.compressionMethod){let e=r.uncompressedSize;if(1&r.generalPurposeBitFlag&&(e+=12),r.compressedSize!==e)throw new Error(`compressed size mismatch for stored file: ${r.compressedSize} != ${e}`)}c.push(r)}return{zip:{comment:s,commentBytes:o},entries:c.map(t=>new x(e,t))}}async function D(e,t){if(1&t.generalPurposeBitFlag)throw new Error("encrypted entries not supported");const r=await k(e,t.relativeOffsetOfLocalHeader,30),n=await e.getLength(),s=F(r,0);if(67324752!==s)throw new Error(`invalid local file header signature: 0x${s.toString(16)}`);const o=U(r,26),i=U(r,28),a=t.relativeOffsetOfLocalHeader+r.length+o+i;let c;if(0===t.compressionMethod)c=!1;else{if(8!==t.compressionMethod)throw new Error(`unsupported compression method: ${t.compressionMethod}`);c=!0}const f=a,d=f+t.compressedSize;if(0!==t.compressedSize&&d>n)throw new Error(`file data overflows file bounds: ${f} +  ${t.compressedSize}  > ${n}`);return{decompress:c,fileDataStart:f}}async function P(e){let t;if("undefined"!=typeof Blob&&e instanceof Blob)t=new f(e);else if(e instanceof ArrayBuffer||e&&e.buffer&&e.buffer instanceof ArrayBuffer)t=new c(e);else if(i(e)||i(e.buffer))t=new c(e);else if("string"==typeof e){const r=await fetch(e);if(!r.ok)throw new Error(`failed http request ${e}, status: ${r.status}: ${r.statusText}`);const n=await r.blob();t=new f(n)}else{if("function"!=typeof e.getLength||"function"!=typeof e.read)throw new Error("unsupported source type");t=e}const r=await t.getLength();if(r>Number.MAX_SAFE_INTEGER)throw new Error(`file too large. size: ${r}. Only file sizes up 4503599627370496 bytes are supported`);return await async function(e,t){const r=Math.min(65557,t),n=t-r,s=await k(e,n,r);for(let t=r-22;t>=0;--t){if(101010256!==F(s,t))continue;const r=new Uint8Array(s.buffer,s.byteOffset+t,s.byteLength-t),o=U(r,4);if(0!==o)throw new Error(`multi-volume zip files are not supported. This is volume: ${o}`);const i=U(r,10),a=F(r,12),c=F(r,16),f=U(r,20),d=r.length-22;if(f!==d)throw new Error(`invalid comment length. expected: ${d}, actual: ${f}`);const l=new Uint8Array(r.buffer,r.byteOffset+22,f),u=M(l);return 65535===i||4294967295===c?await N(e,n+t,u,l):await j(e,c,a,i,u,l)}throw new Error("could not find end of central directory. maybe not zip file")}(t,r)}e.ArrayBufferReader=c,e.BlobReader=f,e.HTTPRangeReader=class{constructor(e){this.url=e}async getLength(){if(void 0===this.length){const e=await fetch(this.url,{method:"HEAD"});if(!e.ok)throw new Error(`failed http request ${this.url}, status: ${e.status}: ${e.statusText}`);if(this.length=parseInt(e.headers.get("content-length")),Number.isNaN(this.length))throw Error("could not get length")}return this.length}async read(e,t){if(0===t)return new Uint8Array(0);const r=await fetch(this.url,{headers:{Range:`bytes=${e}-${e+t-1}`}});if(!r.ok)throw new Error(`failed http request ${this.url}, status: ${r.status} offset: ${e} size: ${t}: ${r.statusText}`);const n=await r.arrayBuffer();return new Uint8Array(n)}},e.ZipEntry=x,e.cleanup=function(){!async function(){for(const e of w)await v.terminate(e);S(w),S(p),S(y),m.clear(),u=0,h=!0}()},e.setOptions=function(e){!function(e){d.workerURL=e.workerURL||d.workerURL,e.workerURL&&(d.useWorkers=!0),d.useWorkers=void 0!==e.useWorkers?e.useWorkers:d.useWorkers,d.numWorkers=e.numWorkers||d.numWorkers}(e)},e.unzip=async function(e){const{zip:t,entries:r}=await P(e);return{zip:t,entries:Object.fromEntries(r.map(e=>[e.name,e]))}},e.unzipRaw=P});
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).unzipit={})}(this,function(e){"use strict";var t,r;function n(e){return e.arrayBuffer?e.arrayBuffer():new Promise((t,r)=>{const n=new FileReader;n.addEventListener("loadend",()=>{t(n.result)}),n.addEventListener("error",r),n.readAsArrayBuffer(e)})}async function o(e){const t=await n(e);return new Uint8Array(t)}function s(e){return"undefined"!=typeof Blob&&e instanceof Blob}function i(e){return"undefined"!=typeof SharedArrayBuffer&&e instanceof SharedArrayBuffer}const a="undefined"!=typeof process&&!!(null===process||void 0===process?void 0:process.versions)&&void 0!==(null===(t=null===process||void 0===process?void 0:process.versions)||void 0===t?void 0:t.node)&&void 0===(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.electron);class c{constructor(e){this.typedArray=e instanceof ArrayBuffer||i(e)?new Uint8Array(e):new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}async getLength(){return this.typedArray.byteLength}async read(e,t){return new Uint8Array(this.typedArray.buffer,this.typedArray.byteOffset+e,t)}}class d{constructor(e){this.blob=e}async getLength(){return this.blob.size}async read(e,t){const r=this.blob.slice(e,e+t),o=await n(r);return new Uint8Array(o)}async sliceAsBlob(e,t,r=""){return this.blob.slice(e,e+t,r)}}const f={numWorkers:1,workerURL:"",useWorkers:!1};let l=0,u=0,h=!0;const p=[],w=[],m=[],y=new Map;function g(e){z(e.target);const{id:t,error:r,data:n}=e.data,o=y.get(t);if(y.delete(t),r)return void o.reject(new Error(r));const s=o.uncompressedSize,i=n instanceof ArrayBuffer?n.byteLength:null==n?void 0:n.size;"number"!=typeof s||"number"!=typeof i||s===i?o.resolve(n):o.reject(new Error(`decompressed size mismatch. declared: ${s}, actual: ${i}`))}function b(e){return new Promise((t,r)=>{const n=new Worker(e);n.onmessage=e=>{"start"===e.data?(n.onerror=null,n.onmessage=null,t(n)):r(new Error(`unexpected message: ${e.data}`))},n.onerror=r})}const v=a?{async createWorker(e){const{Worker:t}=await import("node:worker_threads");return new t(e)},addEventListener(e,t){var r;null===(r=e.on)||void 0===r||r.call(e,"message",r=>{t({target:e,data:r})})},async terminate(e){var t;await(null===(t=e.terminate)||void 0===t?void 0:t.call(e))}}:{async createWorker(e){try{return await b(e)}catch(t){console.warn("could not load worker:",e)}let t;try{const r=await fetch(e,{mode:"cors"});if(!r.ok)throw new Error(`could not load: ${e}`);t=await r.text(),e=URL.createObjectURL(new Blob([t],{type:"application/javascript"}));const n=await b(e);return f.workerURL=e,n}catch(t){console.warn("could not load worker via fetch:",e)}if(void 0!==t)try{e=`data:application/javascript;base64,${btoa(t)}`;const r=await b(e);return f.workerURL=e,r}catch(e){console.warn("could not load worker via dataURI")}throw console.warn("workers will not be used"),new Error("can not start workers")},addEventListener(e,t){var r;null===(r=e.addEventListener)||void 0===r||r.call(e,"message",t)},async terminate(e){var t;await(null===(t=e.terminate)||void 0===t?void 0:t.call(e))}};function z(e){w.push(e),E()}async function L(e,t,r,n,o){try{const s=t,i=await async function(e,t){const r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).then(()=>n.close()).catch(()=>{});const o=[],s=r.readable.getReader();let i=0;for(;;){const{done:e,value:r}=await s.read();if(e)break;const n=i+r.byteLength;if("number"==typeof t&&n>t)throw new Error(`decompressed size exceeds limit: ${n} > ${t}`);o.push(r),i=n}const a=o.reduce((e,t)=>e+t.byteLength,0),c=new Uint8Array(a);let d=0;for(const e of o)c.set(e,d),d+=e.byteLength;return c}(e,s),a=i.byteLength;if("number"==typeof t&&a!==t)return void o(new Error(`decompressed size mismatch. declared: ${t}, actual: ${a}`));n(r?new Blob([i],{type:r}):i.buffer)}catch(e){o(e)}}async function E(){var e;if(0!==m.length){if(f.useWorkers&&h){const t=await async function(){if(0===w.length&&u<f.numWorkers){++u;try{const e=await v.createWorker(f.workerURL);p.push(e),w.push(e),v.addEventListener(e,g)}catch(e){h=!1}}return w.pop()}();if(h){if(t){if(0===m.length)return void z(t);const{id:r,src:n,uncompressedSize:o,type:s,resolve:i,reject:a}=m.shift();y.set(r,{id:r,src:n,uncompressedSize:o,type:s,resolve:i,reject:a});const c=[];null===(e=t.postMessage)||void 0===e||e.call(t,{type:"inflate",data:{id:r,type:s,src:n,uncompressedSize:o}},c)}return}}for(;m.length;){const{src:e,uncompressedSize:t,type:r,resolve:n,reject:i}=m.shift(),a=s(e)?await o(e):e;try{await L(a,t,r,n,i)}catch(e){i(e)}}}}function B(e,t,r){return new Promise((n,o)=>{m.push({src:e,uncompressedSize:t,type:r,resolve:n,reject:o,id:l++}),E()})}function S(e){e.splice(0,e.length)}class x{constructor(e,t){var r,n;this._reader=e,this._rawEntry=t,this.name=t.name,this.nameBytes=t.nameBytes,this.size=t.uncompressedSize,this.compressedSize=t.compressedSize,this.comment=t.comment,this.commentBytes=t.commentBytes,this.compressionMethod=t.compressionMethod,this.lastModDate=(r=t.lastModFileDate,n=t.lastModFileTime,new Date(1980+(r>>9&127),(r>>5&15)-1,31&r,n>>11&31,n>>5&63,2*(31&n),0)),this.isDirectory=0===t.uncompressedSize&&t.name.endsWith("/"),this.encrypted=!!(1&t.generalPurposeBitFlag),this.externalFileAttributes=t.externalFileAttributes,this.versionMadeBy=t.versionMadeBy}async blob(e="application/octet-stream"){return await async function(e,t,r){const{decompress:n,fileDataStart:o}=await D(e,t);if(!n){const n=await k(e,o,t.compressedSize,r);return s(n)?n:new Blob([n],{type:r})}const i=await k(e,o,t.compressedSize),a=await B((Uint8Array,i),t.uncompressedSize,r);return a}(this._reader,this._rawEntry,e)}async arrayBuffer(){return await async function(e,t){const{decompress:r,fileDataStart:n}=await D(e,t);if(!r){const r=await A(e,n,t.compressedSize);return 0===(o=r).byteOffset&&o.byteLength===o.buffer.byteLength?r.buffer:r.slice().buffer}var o;const s=await k(e,n,t.compressedSize);return await B((Uint8Array,s),t.uncompressedSize)}(this._reader,this._rawEntry)}async text(){const e=await this.arrayBuffer();return M(new Uint8Array(e))}async json(){const e=await this.text();return JSON.parse(e)}}async function A(e,t,r){return await e.read(t,r)}async function k(e,t,r,n){return e.sliceAsBlob?await e.sliceAsBlob(t,r,n):await e.read(t,r)}const $={unsigned:()=>0};function U(e,t){return e[t]+256*e[t+1]}function F(e,t){return e[t]+256*e[t+1]+65536*e[t+2]+16777216*e[t+3]}function O(e,t){return F(e,t)+4294967296*F(e,t+4)}const R=new TextDecoder;function M(e,t){return i(e.buffer)&&(e=new Uint8Array(e)),R.decode(e)}const W=117853008;async function N(e,t,r,n){const o=t-20,s=await A(e,o,20);if(F(s,0)!==W)throw new Error("invalid zip64 end of central directory locator signature");const i=O(s,8),a=await A(e,i,56);if(101075792!==F(a,0))throw new Error("invalid zip64 end of central directory record signature");const c=O(a,32),d=O(a,40);return j(e,O(a,48),d,c,r,n)}const T=33639248;async function j(e,t,r,n,o,s){let i=0;const a=await A(e,t,r),c=[];for(let e=0;e<n;++e){const e=a.subarray(i,i+46),t=F(e,0);if(t!==T)throw new Error(`invalid central directory file header signature: 0x${t.toString(16)}`);const r={versionMadeBy:U(e,4),versionNeededToExtract:U(e,6),generalPurposeBitFlag:U(e,8),compressionMethod:U(e,10),lastModFileTime:U(e,12),lastModFileDate:U(e,14),crc32:F(e,16),compressedSize:F(e,20),uncompressedSize:F(e,24),fileNameLength:U(e,28),extraFieldLength:U(e,30),fileCommentLength:U(e,32),internalFileAttributes:U(e,36),externalFileAttributes:F(e,38),relativeOffsetOfLocalHeader:F(e,42)};if(64&r.generalPurposeBitFlag)throw new Error("strong encryption is not supported");i+=46;const n=a.subarray(i,i+r.fileNameLength+r.extraFieldLength+r.fileCommentLength);r.generalPurposeBitFlag,r.nameBytes=n.slice(0,r.fileNameLength),r.name=M(r.nameBytes);const o=r.fileNameLength+r.extraFieldLength,s=n.slice(r.fileNameLength,o);r.extraFields=[];let d=0;for(;d<s.length-3;){const e=U(s,d+0),t=d+4,n=t+U(s,d+2);if(n>s.length)throw new Error("extra field length exceeds extra field buffer size");r.extraFields.push({id:e,data:s.slice(t,n)}),d=n}if(r.commentBytes=n.slice(o,o+r.fileCommentLength),r.comment=M(r.commentBytes),i+=n.length,4294967295===r.uncompressedSize||4294967295===r.compressedSize||4294967295===r.relativeOffsetOfLocalHeader){const e=r.extraFields.find(e=>1===e.id);if(!e)throw new Error("expected zip64 extended information extra field");const t=e.data;let n=0;if(4294967295===r.uncompressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include uncompressed size");r.uncompressedSize=O(t,n),n+=8}if(4294967295===r.compressedSize){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include compressed size");r.compressedSize=O(t,n),n+=8}if(4294967295===r.relativeOffsetOfLocalHeader){if(n+8>t.length)throw new Error("zip64 extended information extra field does not include relative header offset");r.relativeOffsetOfLocalHeader=O(t,n),n+=8}}const f=r.extraFields.find(e=>28789===e.id&&e.data.length>=6&&1===e.data[0]&&F(e.data,1),$.unsigned());if(f&&(r.fileName=M(f.data.slice(5))),0===r.compressionMethod){let e=r.uncompressedSize;if(1&r.generalPurposeBitFlag&&(e+=12),r.compressedSize!==e)throw new Error(`compressed size mismatch for stored file: ${r.compressedSize} != ${e}`)}c.push(r)}return{zip:{comment:o,commentBytes:s},entries:c.map(t=>new x(e,t))}}async function D(e,t){if(1&t.generalPurposeBitFlag)throw new Error("encrypted entries not supported");const r=await A(e,t.relativeOffsetOfLocalHeader,30),n=await e.getLength(),o=F(r,0);if(67324752!==o)throw new Error(`invalid local file header signature: 0x${o.toString(16)}`);const s=U(r,26),i=U(r,28),a=t.relativeOffsetOfLocalHeader+r.length+s+i;let c;if(0===t.compressionMethod)c=!1;else{if(8!==t.compressionMethod)throw new Error(`unsupported compression method: ${t.compressionMethod}`);c=!0}const d=a,f=d+t.compressedSize;if(0!==t.compressedSize&&f>n)throw new Error(`file data overflows file bounds: ${d} +  ${t.compressedSize}  > ${n}`);return{decompress:c,fileDataStart:d}}async function P(e){let t;if("undefined"!=typeof Blob&&e instanceof Blob)t=new d(e);else if(e instanceof ArrayBuffer||e&&e.buffer&&e.buffer instanceof ArrayBuffer)t=new c(e);else if(i(e)||i(e.buffer))t=new c(e);else if("string"==typeof e){const r=await fetch(e);if(!r.ok)throw new Error(`failed http request ${e}, status: ${r.status}: ${r.statusText}`);const n=await r.blob();t=new d(n)}else{if("function"!=typeof e.getLength||"function"!=typeof e.read)throw new Error("unsupported source type");t=e}const r=await t.getLength();if(r>Number.MAX_SAFE_INTEGER)throw new Error(`file too large. size: ${r}. Only file sizes up 4503599627370496 bytes are supported`);return await async function(e,t){const r=Math.min(65557,t),n=t-r,o=await A(e,n,r);for(let t=r-22;t>=0;--t){if(101010256!==F(o,t))continue;const r=new Uint8Array(o.buffer,o.byteOffset+t,o.byteLength-t),s=U(r,4);if(0!==s)throw new Error(`multi-volume zip files are not supported. This is volume: ${s}`);const i=U(r,10),a=F(r,12),c=F(r,16),d=U(r,20),f=r.length-22;if(d!==f)throw new Error(`invalid comment length. expected: ${f}, actual: ${d}`);const l=new Uint8Array(r.buffer,r.byteOffset+22,d),u=M(l);return 65535===i||4294967295===c?await N(e,n+t,u,l):await j(e,c,a,i,u,l)}throw new Error("could not find end of central directory. maybe not zip file")}(t,r)}e.ArrayBufferReader=c,e.BlobReader=d,e.HTTPRangeReader=class{constructor(e){this.url=e}async getLength(){if(void 0===this.length){const e=await fetch(this.url,{method:"HEAD"});if(!e.ok)throw new Error(`failed http request ${this.url}, status: ${e.status}: ${e.statusText}`);if(this.length=parseInt(e.headers.get("content-length")),Number.isNaN(this.length))throw Error("could not get length")}return this.length}async read(e,t){if(0===t)return new Uint8Array(0);const r=await fetch(this.url,{headers:{Range:`bytes=${e}-${e+t-1}`}});if(!r.ok)throw new Error(`failed http request ${this.url}, status: ${r.status} offset: ${e} size: ${t}: ${r.statusText}`);const n=await r.arrayBuffer();return new Uint8Array(n)}},e.ZipEntry=x,e.cleanup=function(){!async function(){for(const e of p)await v.terminate(e);S(p),S(w),S(m),y.clear(),u=0,h=!0}()},e.setOptions=function(e){!function(e){f.workerURL=e.workerURL||f.workerURL,e.workerURL&&(f.useWorkers=!0),f.useWorkers=void 0!==e.useWorkers?e.useWorkers:f.useWorkers,f.numWorkers=e.numWorkers||f.numWorkers}(e)},e.unzip=async function(e){const{zip:t,entries:r}=await P(e);return{zip:t,entries:Object.fromEntries(r.map(e=>[e.name,e]))}},e.unzipRaw=P});

package/dist/unzipit.module.js

@@ -1,4 +1,4 @@
-/* unzipit@2.0.1, license MIT */
+/* unzipit@2.0.3, license MIT */
 var _a, _b;
 function readBlobAsArrayBuffer(blob) {
     if (blob.arrayBuffer) {
@@ -119,24 +119,30 @@ let nextId = 0;
 // come in before a worker gets added to `workers`
 let numWorkers = 0;
 let canUseWorkers = true; // gets set to false if we can't start a worker
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const workers = [];
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const availableWorkers = [];
 const waitingForWorkerQueue = [];
 const currentlyProcessingIdToRequestMap = new Map();
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 function handleResult(e) {
     makeWorkerAvailable(e.target);
     const { id, error, data } = e.data;
     const request = currentlyProcessingIdToRequestMap.get(id);
     currentlyProcessingIdToRequestMap.delete(id);
     if (error) {
-        request.reject(error);
+        // The worker can only structured-clone the error as a string, so wrap it
+        // back into an Error to match the rejection type of the non-worker path.
+        request.reject(new Error(error));
+        return;
     }
-    else {
-        request.resolve(data);
+    // Verify that the decompressed size matches the declared uncompressedSize
+    // Treat declared size as authoritative metadata that must be verified.
+    const expected = request.uncompressedSize;
+    const actual = data instanceof ArrayBuffer ? data.byteLength : data === null || data === void 0 ? void 0 : data.size;
+    if (typeof expected === 'number' && typeof actual === 'number' && expected !== actual) {
+        request.reject(new Error(`decompressed size mismatch. declared: ${expected}, actual: ${actual}`));
+        return;
     }
+    request.resolve(data);
 }
 // Because Firefox uses non-standard onerror to signal an error.
 function startWorker(url) {
@@ -158,28 +164,25 @@ function startWorker(url) {
 const workerHelper = (function () {
     if (isNode) {
         return {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async createWorker(url) {
                 const moduleId = 'node:worker_threads';
                 const { Worker } = await import(moduleId);
                 return new Worker(url);
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             addEventListener(worker, fn) {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                worker.on('message', (data) => {
+                var _a;
+                (_a = worker.on) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', (data) => {
                     fn({ target: worker, data });
                 });
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async terminate(worker) {
-                await worker.terminate();
+                var _a;
+                await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
             },
         };
     }
     else {
         return {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async createWorker(url) {
                 // I don't understand this security issue
                 // Apparently there is some iframe setting or http header
@@ -222,23 +225,23 @@ const workerHelper = (function () {
                 console.warn('workers will not be used');
                 throw new Error('can not start workers');
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             addEventListener(worker, fn) {
-                worker.addEventListener('message', fn);
+                var _a;
+                // The browser delivers a MessageEvent whose `target` is the worker
+                // and whose `data` is the InflateResultMessage, matching WorkerResultEvent.
+                (_a = worker.addEventListener) === null || _a === void 0 ? void 0 : _a.call(worker, 'message', fn);
             },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async terminate(worker) {
-                worker.terminate();
+                var _a;
+                await ((_a = worker.terminate) === null || _a === void 0 ? void 0 : _a.call(worker));
             },
         };
     }
 }());
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 function makeWorkerAvailable(worker) {
     availableWorkers.push(worker);
     processWaitingForWorkerQueue();
 }
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 async function getAvailableWorker() {
     if (availableWorkers.length === 0 && numWorkers < config.numWorkers) {
         ++numWorkers; // see comment at numWorkers declaration
@@ -255,7 +258,7 @@ async function getAvailableWorker() {
     }
     return availableWorkers.pop();
 }
-async function decompressRaw(src) {
+async function decompressRaw(src, limit) {
     const ds = new DecompressionStream('deflate-raw');
     const writer = ds.writable.getWriter();
     // Do not await the write — doing so before reading causes a deadlock when
@@ -263,12 +266,19 @@ async function decompressRaw(src) {
     writer.write(src).then(() => writer.close()).catch(() => { });
     const chunks = [];
     const reader = ds.readable.getReader();
+    let seen = 0;
     for (;;) {
         const { done, value } = await reader.read();
         if (done) {
             break;
         }
+        // If this chunk would push us past the configured/declared limit, abort
+        const newSeen = seen + value.byteLength;
+        if (typeof limit === 'number' && newSeen > limit) {
+            throw new Error(`decompressed size exceeds limit: ${newSeen} > ${limit}`);
+        }
         chunks.push(value);
+        seen = newSeen;
     }
     const size = chunks.reduce((s, c) => s + c.byteLength, 0);
     const result = new Uint8Array(size);
@@ -282,9 +292,15 @@ async function decompressRaw(src) {
 // @param {Uint8Array} src
 // @param {string} [type] mime-type
 // @returns {ArrayBuffer|Blob} ArrayBuffer if type is falsy or Blob otherwise.
-async function inflateRawLocal(src, type, resolve, reject) {
+async function inflateRawLocal(src, uncompressedSize, type, resolve, reject) {
     try {
-        const dst = await decompressRaw(src);
+        const limit = uncompressedSize;
+        const dst = await decompressRaw(src, limit);
+        const actual = dst.byteLength;
+        if (typeof uncompressedSize === 'number' && actual !== uncompressedSize) {
+            reject(new Error(`decompressed size mismatch. declared: ${uncompressedSize}, actual: ${actual}`));
+            return;
+        }
         resolve(type ? new Blob([dst], { type }) : dst.buffer);
     }
     catch (e) {
@@ -292,6 +308,7 @@ async function inflateRawLocal(src, type, resolve, reject) {
     }
 }
 async function processWaitingForWorkerQueue() {
+    var _a;
     if (waitingForWorkerQueue.length === 0) {
         return;
     }
@@ -321,7 +338,7 @@ async function processWaitingForWorkerQueue() {
                 //if (!isBlob(src) && !isSharedArrayBuffer(src)) {
                 //  transferables.push(src);
                 //}
-                worker.postMessage({
+                (_a = worker.postMessage) === null || _a === void 0 ? void 0 : _a.call(worker, {
                     type: 'inflate',
                     data: {
                         id,
@@ -340,9 +357,14 @@ async function processWaitingForWorkerQueue() {
     // will then be on the queue. But if we fail to make workers then there
     // are pending requests.
     while (waitingForWorkerQueue.length) {
-        const { src, type, resolve, reject } = waitingForWorkerQueue.shift();
+        const { src, uncompressedSize, type, resolve, reject } = waitingForWorkerQueue.shift();
         const data = isBlob(src) ? await readBlobAsUint8Array(src) : src;
-        inflateRawLocal(data, type, resolve, reject);
+        try {
+            await inflateRawLocal(data, uncompressedSize, type, resolve, reject);
+        }
+        catch (e) {
+            reject(e);
+        }
     }
 }
 function setOptions$1(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unzipit",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "random access unzip library for JavaScript",
   "type": "module",
   "main": "dist/unzipit.module.js",