chore: initialize POM 2 repo (docs guards green; release gates recorded NOT RUN pending install)

tests/zip.test.ts

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createZip, verifyZip } from "../src/zip";
+
+test("ZIP creation verifies central directory, decompression, size, CRC and hash", async () => {
+  const root = await mkdtemp(join(tmpdir(), "pom-zip-"));
+  try {
+    const source = join(root, "artifact.md");
+    const archive = join(root, "delivery.zip");
+    await writeFile(source, "# Verified artifact\n\nCanonical content.\n");
+    await createZip(archive, [{ absolutePath: source, archivePath: "docs/artifact.md" }]);
+    const result = await verifyZip(archive);
+    assert.equal(result.members.length, 1);
+    assert.equal(result.members[0].path, "docs/artifact.md");
+    assert.match(result.members[0].crc32, /^[0-9a-f]{8}$/);
+    assert.match(result.sha256, /^[0-9a-f]{64}$/);
+    await assert.rejects(createZip(join(root, "bad.zip"), [
+      { absolutePath: source, archivePath: "same.md" },
+      { absolutePath: source, archivePath: "same.md" },
+    ]), /Duplicate archive member/);
+    await assert.rejects(createZip(join(root, "escape.zip"), [{ absolutePath: source, archivePath: "../escape.md" }]), /Unsafe archive member/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("malformed ZIP is rejected", async () => {
+  const root = await mkdtemp(join(tmpdir(), "pom-bad-zip-"));
+  try {
+    const bad = join(root, "bad.zip");
+    await writeFile(bad, Buffer.from("PK\\x03\\x04not-a-real-archive"));
+    await assert.rejects(verifyZip(bad));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});