fix: remove shell interpretation from asset decryption

[DoctorDerek]

Closes #203

What changed

• isolates the ghost-asset CLI from its testable pipeline contract
• replaces shell-based unzip execution with in-process ZipCrypto extraction
• keeps the environment secret out of shell syntax and process arguments
• preserves both archive routes, overwrite behavior, path preservation, font-path flattening, missing-archive warnings, and the missing-secret open-source fallback
• rejects archive entries that resolve outside their configured destination
• converts all extraction failures into fixed, secret-free diagnostics and status 1

Library decision

The two existing archives were inspected without decrypting or printing their contents. Both use traditional PKWARE ZipCrypto with stored/deflated entries and no WinZip AES records.

@zip.js/zip.js was selected because it supports the exact formats in use, runs on Node.js, has zero third-party dependencies, supports strict ambiguity checks, and accepts the password in-process. This materially improves both security and Windows/Linux compatibility compared with execFileSync, which would remove shell interpretation but still expose the password in child-process arguments.

No existing pipeline documentation described the external unzip implementation, so no documentation change was required.

Verification

• formatting passed with no tracked follow-up changes
• ESLint passed
• strict TypeScript passed
• focused ghost-asset tests: 7/7 passed
• full Vitest suite: 49 files / 222 tests passed
• coverage: 99.66% statements, 99.30% branches, 100% functions, 99.71% lines
• production build passed with GHOST_ASSET_KEY_DOCTORDEREK_COM explicitly absent
• both existing archives passed strict metadata parsing
• font archive has zero flattened-name collisions
• git diff --check passed
• no archive, decrypted asset, vendor asset, password, receipt, private metadata, secret, or infrastructure setting changed

Deployment confirmation

The same-repository Vercel preview build can exercise the actual encrypted archives with the existing protected environment secret. No secret value is logged or exposed by this branch.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
doctor-derek	Ready	Preview	Aug 29, 2026 10:40pm

[github-actions]

🧹 ESLint

Quality check 1 of 3

✅ Zero warnings.

[github-actions]

🧪 Vitest

Quality check 2 of 3

✅ Vitest completed successfully.

 Test Files  49 passed (49)
      Tests  224 passed (224)
   Duration  18.04s (transform 1.28s, setup 11.87s, import 4.30s, tests 5.53s, environment 18.98s)

[github-actions]

🎭 Playwright

Quality check 3 of 3

✅ Playwright completed successfully.

Running 90 tests using 1 worker
  90 passed (3.2m)

Open preview deployment

[github-actions]

🗺️ XState v5 State Machine Diff Visualization

Architecture visualization

Base c8890fec6bbe → Head 90f7cbbd51ad

No XState state-machine topology changes detected.

Download canonical graphs, structured diff, Mermaid, and diagnostics

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (c8890fe) to head (90f7cbb).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #204   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           63        65    +2     
  Lines         1453      1515   +62     
  Branches       309       320   +11     
=========================================
+ Hits          1453      1515   +62     

Flag	Coverage Δ
vitest	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[DoctorDerek]

Code reviewed and approved. QA pass. Merging now.