@hachej/boring-files 0.2.1 → 0.2.3

package/dist/contracts.d.ts

@@ -132,6 +132,14 @@ export type PublicationRefusal = {
 } | {
     readonly kind: 'unavailable';
     readonly reason: string;
+}
+/** A change above the provider's byte limit: permanent for these bytes, nothing was written. */
+ | {
+    readonly kind: 'file_too_large';
+    readonly path: string;
+    readonly size: number;
+    readonly limit: number;
+    readonly reason: string;
 };
 export type PublicationOutcome = {
     readonly kind: 'committed';

package/dist/file-limits.d.ts

@@ -0,0 +1,10 @@
+import { FileError } from '@earendil-works/pi-durable/env';
+export declare const SQLITE_MAX_FILE_BYTES = 1900000;
+/** A limit is a non-negative safe integer of bytes. */
+export declare function assertLimit(value: unknown): asserts value is number;
+/**
+ * A write above the limit. Pi's `FileErrorCode` has no size code and Pi is not patched, so this is an `invalid` error whose message
+ * starts with the POSIX `EFBIG` name, like the other errors of the file system.
+ */
+export declare function fileTooLarge(path: string, size: number, limit: number): FileError;
+//# sourceMappingURL=file-limits.d.ts.map

package/dist/file-limits.js

@@ -0,0 +1,16 @@
+// The largest file a SQLite-backed workspace stores by default: a Durable Object's SQL storage caps one row (and so one file's bytes)
+// at 2 MB, so the default leaves headroom for the row's other columns. Disk and remote providers have no default limit.
+import { FileError } from '@earendil-works/pi-durable/env';
+export const SQLITE_MAX_FILE_BYTES = 1_900_000;
+/** A limit is a non-negative safe integer of bytes. */
+export function assertLimit(value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new TypeError('maxFileBytes must be a non-negative safe integer');
+}
+/**
+ * A write above the limit. Pi's `FileErrorCode` has no size code and Pi is not patched, so this is an `invalid` error whose message
+ * starts with the POSIX `EFBIG` name, like the other errors of the file system.
+ */
+export function fileTooLarge(path, size, limit) {
+    return new FileError('invalid', `EFBIG: file_too_large: ${size} bytes exceeds the ${limit} byte limit, '${path}'`, path);
+}

package/dist/file-types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The one place boring-files says what a file is: its extension, its media type (by name and by leading bytes), the viewer that
+ * opens it, the provider's temporary and hidden names, the workspace path a user or agent typed, and the name of a new upload.
+ * Callers import these; none keeps a copy. Pure: no Node, no DOM.
+ */
+/** The lower-case extension of the last path segment, or ''. */
+export declare const extensionOf: (path: string) => string;
+/** The IANA media type by extension. Anything not listed is `application/octet-stream` (see `mediaTypeOf`). Null-prototype: `constructor` or `__proto__` is not an entry. */
+export declare const MEDIA_TYPES: Readonly<Record<string, string>>;
+/** The IANA media type of a path, `application/octet-stream` when unknown. */
+export declare const mediaTypeOf: (path: string) => string;
+/** The media type a file's leading bytes name (a PDF, PNG, JPEG, GIF or WebP signature), or undefined. */
+export declare function sniffMediaType(head: Uint8Array): string | undefined;
+/** Which viewer opens a file. Anything not listed is shown as text when it decodes. */
+export type ViewerKind = 'markdown' | 'html' | 'canvas' | 'image' | 'pdf' | 'text';
+/** The viewer kind of a path: `markdown`, `html`, `canvas`, `image`, `pdf` or `text`. */
+export declare const viewerKindOf: (path: string) => ViewerKind;
+/** Binary viewers never decode a file as text, whatever its bytes look like (an SVG is text). */
+export declare const isBinaryKind: (path: string) => boolean;
+/** The basename of a new temporary file, for a provider's `uuid`. */
+export declare const temporaryFileName: (uuid: string) => string;
+/** Whether a path's last segment is one of the provider's temporary files (a lister hides them). */
+export declare const isTemporary: (path: string) => boolean;
+/** Names a presentation listing hides by default (dependency, build and internal folders, and the provider's own). Not an access policy. */
+export declare const HIDDEN_NAMES: ReadonlySet<string>;
+/** A path as a person or agent typed it, as a workspace-relative resource path: leading `./` segments removed. A leading `/` stays: it is not a workspace path, and the provider refuses it rather than reading it as a relative one. */
+export declare const workspacePath: (path: string) => string;
+/** A new upload's workspace path: `uploads/<stem>-<8 hex>.<ext>`, so a second `image.png` (every pasted screenshot has that name) is a new file beside the first. Whitespace becomes `_`, because a chat mention ends at a space. */
+export declare function uploadPath(name: string, randomSuffix: string): string;
+//# sourceMappingURL=file-types.d.ts.map

package/dist/file-types.js

@@ -0,0 +1,61 @@
+/**
+ * The one place boring-files says what a file is: its extension, its media type (by name and by leading bytes), the viewer that
+ * opens it, the provider's temporary and hidden names, the workspace path a user or agent typed, and the name of a new upload.
+ * Callers import these; none keeps a copy. Pure: no Node, no DOM.
+ */
+/** The lower-case extension of the last path segment, or ''. */
+export const extensionOf = (path) => { const dot = path.lastIndexOf('.'); return dot > path.lastIndexOf('/') ? path.slice(dot + 1).toLowerCase() : ''; };
+/** The IANA media type by extension. Anything not listed is `application/octet-stream` (see `mediaTypeOf`). Null-prototype: `constructor` or `__proto__` is not an entry. */
+export const MEDIA_TYPES = Object.assign(Object.create(null), {
+    md: 'text/markdown', markdown: 'text/markdown', html: 'text/html', htm: 'text/html', json: 'application/json', svg: 'image/svg+xml',
+    txt: 'text/plain', csv: 'text/csv', js: 'text/javascript', mjs: 'text/javascript', css: 'text/css', tldraw: 'application/vnd.tldraw+json',
+    png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', bmp: 'image/bmp', tif: 'image/tiff', tiff: 'image/tiff',
+    pdf: 'application/pdf', doc: 'application/msword', docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel', xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    ppt: 'application/vnd.ms-powerpoint', pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    odt: 'application/vnd.oasis.opendocument.text', ods: 'application/vnd.oasis.opendocument.spreadsheet', odp: 'application/vnd.oasis.opendocument.presentation',
+    rtf: 'application/rtf', epub: 'application/epub+zip',
+});
+/** The IANA media type of a path, `application/octet-stream` when unknown. */
+export const mediaTypeOf = (path) => MEDIA_TYPES[extensionOf(path)] ?? 'application/octet-stream';
+/** The media type a file's leading bytes name (a PDF, PNG, JPEG, GIF or WebP signature), or undefined. */
+export function sniffMediaType(head) {
+    const at = (signature, offset = 0) => signature.every((byte, index) => head[offset + index] === byte);
+    if (at([0x25, 0x50, 0x44, 0x46, 0x2d]))
+        return 'application/pdf';
+    if (at([0x89, 0x50, 0x4e, 0x47]))
+        return 'image/png';
+    if (at([0xff, 0xd8, 0xff]))
+        return 'image/jpeg';
+    if (at([0x47, 0x49, 0x46, 0x38]))
+        return 'image/gif';
+    if (at([0x52, 0x49, 0x46, 0x46]) && at([0x57, 0x45, 0x42, 0x50], 8))
+        return 'image/webp';
+    return undefined;
+}
+const VIEWER_KINDS = Object.assign(Object.create(null), {
+    md: 'markdown', markdown: 'markdown', html: 'html', htm: 'html', tldraw: 'canvas',
+    png: 'image', jpg: 'image', jpeg: 'image', gif: 'image', webp: 'image', svg: 'image', pdf: 'pdf',
+    txt: 'text', json: 'text', csv: 'text', js: 'text', mjs: 'text', css: 'text',
+});
+/** The viewer kind of a path: `markdown`, `html`, `canvas`, `image`, `pdf` or `text`. */
+export const viewerKindOf = (path) => VIEWER_KINDS[extensionOf(path)] ?? 'text';
+/** Binary viewers never decode a file as text, whatever its bytes look like (an SVG is text). */
+export const isBinaryKind = (path) => ['image', 'pdf'].includes(viewerKindOf(path)) && extensionOf(path) !== 'svg';
+/** The provider's temporary files are named `.boring-<uuid>.tmp` beside their target. They are removed when the provider opens and are never a resource. */
+const temporaryPattern = /^\.boring-[0-9a-f-]{36}\.tmp$/;
+/** The basename of a new temporary file, for a provider's `uuid`. */
+export const temporaryFileName = (uuid) => `.boring-${uuid}.tmp`;
+/** Whether a path's last segment is one of the provider's temporary files (a lister hides them). */
+export const isTemporary = (path) => temporaryPattern.test(path.slice(path.lastIndexOf('/') + 1));
+/** Names a presentation listing hides by default (dependency, build and internal folders, and the provider's own). Not an access policy. */
+export const HIDDEN_NAMES = new Set(['.git', '.boring', 'node_modules', 'dist', 'build', '.cache', '.next', 'coverage', '__pycache__']);
+/** A path as a person or agent typed it, as a workspace-relative resource path: leading `./` segments removed. A leading `/` stays: it is not a workspace path, and the provider refuses it rather than reading it as a relative one. */
+export const workspacePath = (path) => path.replace(/^(\.\/)+/, '');
+/** A new upload's workspace path: `uploads/<stem>-<8 hex>.<ext>`, so a second `image.png` (every pasted screenshot has that name) is a new file beside the first. Whitespace becomes `_`, because a chat mention ends at a space. */
+export function uploadPath(name, randomSuffix) {
+    const dot = name.lastIndexOf('.');
+    const [stem, extension] = dot > 0 ? [name.slice(0, dot), name.slice(dot)] : [name, ''];
+    const safe = (part) => part.replace(/\s+/g, '_');
+    return `uploads/${safe(stem)}-${randomSuffix}${safe(extension)}`;
+}

package/dist/journal.js

@@ -112,6 +112,9 @@ export function createWorkspaceJournal(db, options = {}) {
             const row = db.get('SELECT bytes, media_type FROM boring_history WHERE scope = ? AND path = ? AND revision = ?', scope, path, revision);
             if (!row)
                 return undefined;
+            // A zero-length BLOB can come back as no bytes (see sqlite-filesystem.ts): a saved empty file is an empty version.
+            if (row.bytes === null)
+                return { revision, bytes: new Uint8Array(), mediaType: text(row.media_type) };
             if (!(row.bytes instanceof Uint8Array))
                 throw new Error('Invalid stored bytes');
             return { revision, bytes: Uint8Array.from(row.bytes), mediaType: text(row.media_type) };

package/dist/publication-input.js

@@ -135,6 +135,12 @@ function publicationOutcome(value) {
         case 'committed': return { kind: 'committed', receipt: publicationReceipt(input.receipt) };
         case 'denied':
         case 'unavailable': return { kind: input.kind, reason: reason(input.reason) };
+        case 'file_too_large': {
+            const { path, size, limit } = input;
+            if (typeof path !== 'string' || typeof size !== 'number' || !Number.isSafeInteger(size) || typeof limit !== 'number' || !Number.isSafeInteger(limit))
+                throw new TypeError('Invalid size refusal');
+            return { kind: 'file_too_large', path, size, limit, reason: reason(input.reason) };
+        }
         case 'unknown': return { kind: 'unknown', operationId: identifier(input.operationId), reason: reason(input.reason) };
         case 'conflict': {
             if (!Array.isArray(input.current))

package/dist/sqlite-batch.d.ts

@@ -10,6 +10,9 @@ export interface SqliteBatch {
     readonly bytes: (path: string) => Uint8Array | null | undefined;
     /** Write a regular file at an absolute path, creating its missing parent directories. Throws a Pi `FileError` on failure. */
     readonly write: (path: string, bytes: Uint8Array) => void;
+    /** The one byte limit of this file system: native writes and publications both enforce it. */
+    readonly maxFileBytes: () => number;
+    readonly setMaxFileBytes: (limit: number) => void;
 }
 export declare const registerSqliteBatch: (fs: object, batch: SqliteBatch) => void;
 export declare const sqliteBatchOf: (fs: object) => SqliteBatch | undefined;

package/dist/sqlite-filesystem.d.ts

@@ -7,6 +7,8 @@ export interface SqliteFileSystemOptions {
     readonly workspace: string;
     /** The absolute working directory, created when missing (for example `/workspace`). Relative paths resolve against `cwd`. */
     readonly cwd: string;
+    /** The largest file a write may store (default `SQLITE_MAX_FILE_BYTES`, the row limit of a Durable Object). A larger write fails with `EFBIG`. */
+    readonly maxFileBytes?: number;
 }
 /** A Pi `FileSystem` plus the incarnation of its rows: new when the workspace was first created in this database. */
 export interface SqliteFileSystem extends FileSystem {

package/dist/sqlite-filesystem.js

@@ -1,4 +1,5 @@
 import { FileError, LineScanner, err, ok } from '@earendil-works/pi-durable/env';
+import { SQLITE_MAX_FILE_BYTES, assertLimit, fileTooLarge } from './file-limits.js';
 import { randomUUID } from './platform.js';
 import { registerSqliteBatch } from './sqlite-batch.js';
 function normalize(path) {
@@ -35,6 +36,8 @@ export function openSqliteFileSystem(options) {
     if (typeof options.cwd !== 'string' || !options.cwd.startsWith('/'))
         throw new TypeError('An absolute working directory is required');
     const now = () => Date.now();
+    let maxFileBytes = options.maxFileBytes ?? SQLITE_MAX_FILE_BYTES;
+    assertLimit(maxFileBytes);
     function row(path) {
         if (path === '/')
             return { kind: 'directory', size: 0, mtime: 0 };
@@ -71,9 +74,13 @@ export function openSqliteFileSystem(options) {
     /** Paths written, renamed or removed by this file system since the last comparison: reported as changed even when size and time look alike. */
     const touched = new Set();
     function bytes(path) {
-        if (existing(path).kind === 'directory')
+        const entry = existing(path);
+        if (entry.kind === 'directory')
             throw failure('is_directory', 'EISDIR', path, 'illegal operation on a directory');
         const found = db.get('SELECT bytes FROM boring_workspace_files WHERE workspace = ? AND path = ?', workspace, path);
+        // A zero-length BLOB can come back as no bytes (a NULL pointer through some engines): a file row with no bytes is an empty file.
+        if (found?.bytes === null && entry.kind === 'file')
+            return new Uint8Array();
         if (!(found?.bytes instanceof Uint8Array))
             throw fileError('unknown', 'Invalid stored bytes', path);
         return Uint8Array.from(found.bytes);
@@ -85,6 +92,8 @@ export function openSqliteFileSystem(options) {
     function write(path, content) {
         if (path === '/')
             throw failure('is_directory', 'EISDIR', path, 'illegal operation on a directory');
+        if (content.length > maxFileBytes)
+            throw fileTooLarge(path, content.length, maxFileBytes);
         const found = row(path);
         if (found?.kind === 'directory')
             throw failure('is_directory', 'EISDIR', path, 'illegal operation on a directory');
@@ -268,6 +277,9 @@ export function openSqliteFileSystem(options) {
             const added = encode(content);
             if (!row(absolute))
                 return write(absolute, added);
+            const grown = existing(absolute).size + added.length;
+            if (grown > maxFileBytes)
+                throw fileTooLarge(absolute, grown, maxFileBytes);
             const before = bytes(absolute), joined = new Uint8Array(before.length + added.length);
             joined.set(before);
             joined.set(added, before.length);
@@ -276,6 +288,9 @@ export function openSqliteFileSystem(options) {
         truncateFile: (path, size, context) => run(path, context, 'write', absolute => {
             if (!Number.isSafeInteger(size) || size < 0)
                 throw fileError('invalid', 'File size must be a non-negative safe integer', absolute);
+            // Checked before the buffer is allocated: a huge size is a size refusal, not an allocation failure.
+            if (size > maxFileBytes)
+                throw fileTooLarge(absolute, size, maxFileBytes);
             const before = bytes(absolute), after = new Uint8Array(size);
             after.set(before.subarray(0, size));
             write(absolute, after);
@@ -288,6 +303,10 @@ export function openSqliteFileSystem(options) {
             const moved = existing(from);
             if (from === to)
                 return;
+            // A moved file keeps its bytes, so a file (or a file below a moved directory) over the limit cannot replace another file by renaming.
+            const oversized = db.get(`SELECT path, length(bytes) AS size FROM boring_workspace_files WHERE ${subtree(from)} AND kind = 'file' AND length(bytes) > ? LIMIT 1`, ...subtreeArgs(from), maxFileBytes);
+            if (oversized)
+                throw fileTooLarge(oversized.path, Number(oversized.size), maxFileBytes);
             touched.add(from);
             touched.add(to);
             if (from === '/' || within(from, to))
@@ -416,6 +435,8 @@ export function openSqliteFileSystem(options) {
     };
     registerSqliteBatch(fs, {
         connection: db,
+        maxFileBytes: () => maxFileBytes,
+        setMaxFileBytes: limit => { assertLimit(limit); maxFileBytes = limit; },
         bytes: path => { const found = row(normalize(path)); return !found ? null : found.kind === 'directory' ? undefined : bytes(normalize(path)); },
         write: (path, content) => { const absolute = normalize(path); makeDirectory(dirname(absolute), true); write(absolute, content); notify(); },
     });

package/dist/workspace-catalog.js

@@ -1,9 +1,13 @@
 import ignore from 'ignore';
 import { identifier, locator } from './publication-input.js';
+import { HIDDEN_NAMES, isTemporary } from './file-types.js';
 import { RevisionError } from './revision-contracts.js';
-const hidden = new Set(['.git', '.boring', 'node_modules', 'dist', 'build', '.cache', '.next', 'coverage', '__pycache__']);
-const temporary = /^\.boring-[0-9a-f-]{36}\.tmp$/;
 const inside = (root, path) => path === root || path.startsWith(root === '/' ? '/' : `${root}/`);
+/** Basename first: a name that starts with the query, then one that contains it, then a match in the directories only. */
+const rank = (path, query) => {
+    const name = path.slice(path.lastIndexOf('/') + 1).toLowerCase();
+    return name.startsWith(query) ? '0' : name.includes(query) ? '1' : '2';
+};
 export function catalogPath(path, allowRoot = false) {
     if (allowRoot && path === '')
         return path;
@@ -47,10 +51,10 @@ export function createWorkspaceCatalog(options) {
     }
     function visible(entry, rules) {
         const name = entry.path.slice(entry.path.lastIndexOf('/') + 1);
-        if (temporary.test(name))
+        if (isTemporary(name))
             return false;
         if (config.defaults !== false) {
-            if (hidden.has(name))
+            if (HIDDEN_NAMES.has(name))
                 return false;
             let ignored = false;
             for (const rule of rules) {
@@ -111,7 +115,15 @@ export function createWorkspaceCatalog(options) {
             return entries;
         return entries.filter(entry => entry.path.slice(0, entry.path.lastIndexOf('/') + 1) === (directory ? `${directory}/` : ''));
     }
-    function page(entries, key, cursor, limit) {
+    // One traversal at a time, each started after its search was called: a search never reuses a walk that began before it, so its
+    // result reflects every change made before the call, and no two walks overlap.
+    let walking = Promise.resolve();
+    function files(access) {
+        const run = walking.then(() => collect('', true, access));
+        walking = run.then(() => undefined, () => undefined);
+        return run.then(entries => entries.filter(entry => entry.kind === 'file'));
+    }
+    function page(entries, key, cursor, limit, order) {
         const count = limit ?? 100;
         if (!Number.isSafeInteger(count) || count < 1 || count > 500)
             throw new RevisionError('invalid', 'Page limit must be between 1 and 500');
@@ -121,15 +133,15 @@ export function createWorkspaceCatalog(options) {
                 const value = JSON.parse(decodeURIComponent(cursor));
                 if (!Array.isArray(value) || value.length !== 2 || value[0] !== key || typeof value[1] !== 'string')
                     throw new Error();
-                after = catalogPath(value[1]);
+                after = order ? value[1] : catalogPath(value[1]);
             }
             catch {
                 throw new RevisionError('invalid', 'Invalid catalog cursor');
             }
         }
-        const sorted = entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0).filter(entry => entry.path > after);
+        const sorted = entries.map(entry => ({ entry, sort: order ? order(entry) : entry.path })).sort((a, b) => a.sort < b.sort ? -1 : a.sort > b.sort ? 1 : 0).filter(item => item.sort > after);
         const selected = sorted.slice(0, count), last = selected.at(-1);
-        return { entries: selected, ...(last && sorted.length > count ? { cursor: encodeURIComponent(JSON.stringify([key, last.path])) } : {}) };
+        return { entries: selected.map(item => item.entry), ...(last && sorted.length > count ? { cursor: encodeURIComponent(JSON.stringify([key, last.sort])) } : {}) };
     }
     return {
         list: async (request, access) => {
@@ -140,7 +152,8 @@ export function createWorkspaceCatalog(options) {
             if (typeof request.query !== 'string' || request.query.length > 1024)
                 throw new RevisionError('invalid', 'Invalid filename query');
             const query = request.query.toLowerCase();
-            return page((await collect('', true, access)).filter(entry => entry.kind === 'file' && entry.path.toLowerCase().includes(query)), `search:${query}`, request.cursor, request.limit);
+            const matches = (await files(access)).filter(entry => entry.path.toLowerCase().includes(query));
+            return page(matches, `search:${query}`, request.cursor, request.limit, entry => rank(entry.path, query) + entry.path);
         },
         history: async (path, access) => { check(access); identifier(access.scopeId); return options.saves(catalogPath(path)); },
     };

package/dist/workspace.d.ts

@@ -5,6 +5,7 @@ import type { ChangeFeedRequest, WorkspaceCatalog, WorkspaceChangeEvent } from '
 export type { ChangeFeedRequest, WorkspaceChangeEvent } from './revision-contracts.js';
 export type { WorkspaceCatalogOptions } from './workspace-catalog.js';
 import type { HistorySource, WorkspaceJournal } from './journal.js';
+export { isTemporary } from './file-types.js';
 import type { WorkspaceKey } from './workspace-identity.js';
 export type { WorkspaceKey } from './workspace-identity.js';
 export interface WorkspaceChange {
@@ -99,10 +100,14 @@ export interface WorkspaceProviderOptions {
     readonly changeBuffer?: number;
     /** How long the watcher stays open after the last change-feed listener leaves, in milliseconds (default 30 000). */
     readonly watchLingerMs?: number;
+    /**
+     * The largest file this workspace may store, in bytes. Over a SQLite file system (the SQLite and Durable Object providers) it sets
+     * that file system's one limit, so native writes and publications agree; default: the file system's own limit (`SQLITE_MAX_FILE_BYTES`
+     * unless opened otherwise). Over other file systems it applies to publications only, with no default.
+     */
+    readonly maxFileBytes?: number;
 }
 /** The Git blob id of `bytes` (`sha1("blob <length>\0" + bytes)`), computed without Git. */
 export declare function blobRevision(bytes: Uint8Array): Promise<string>;
-/** Whether a path is one of the provider's temporary files (a lister hides them). */
-export declare const isTemporary: (path: string) => boolean;
 export declare function createWorkspaceProvider(options: WorkspaceProviderOptions): WorkspaceResourceProvider;
 //# sourceMappingURL=workspace.d.ts.map

package/dist/workspace.js

@@ -2,7 +2,10 @@ import { createWorkspaceCatalog } from './workspace-catalog.js';
 import { committedChanges } from './journal.js';
 import { randomUUID, sha1 } from './platform.js';
 import { accessSnapshot, identifier, locator, publicationDigest, publicationSnapshot } from './publication-input.js';
+import { assertLimit, fileTooLarge } from './file-limits.js';
 import { journalConnectionOf, sqliteBatchOf } from './sqlite-batch.js';
+import { isTemporary, mediaTypeOf, temporaryFileName } from './file-types.js';
+export { isTemporary } from './file-types.js';
 const sameBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
 const queues = new WeakMap();
 /** One queue per file system object: two providers over the same `fs` share it. */
@@ -30,16 +33,6 @@ export async function blobRevision(bytes) {
     whole.set(bytes, header.length);
     return hex(await sha1(whole));
 }
-const mediaTypes = {
-    md: 'text/markdown', markdown: 'text/markdown', html: 'text/html', htm: 'text/html', json: 'application/json', svg: 'image/svg+xml', txt: 'text/plain', tldraw: 'application/vnd.tldraw+json',
-};
-function mediaTypeOf(path) {
-    return mediaTypes[path.slice(path.lastIndexOf('.') + 1).toLowerCase()] ?? 'application/octet-stream';
-}
-/** The provider's own temporary files. They are removed when the provider opens and are never a resource. */
-const temporaryPattern = /^\.boring-[0-9a-f-]{36}\.tmp$/;
-/** Whether a path is one of the provider's temporary files (a lister hides them). */
-export const isTemporary = (path) => temporaryPattern.test(path.slice(path.lastIndexOf('/') + 1));
 export function createWorkspaceProvider(options) {
     const { fs, journal } = options;
     const identity = options.identity;
@@ -58,6 +51,11 @@ export function createWorkspaceProvider(options) {
     const queue = queueFor(fs);
     /** Present when `fs` is the SQLite file system (`@hachej/boring-files/sqlite-filesystem`): multi-file batches then commit in one transaction. */
     const batch = sqliteBatchOf(fs);
+    if (options.maxFileBytes !== undefined) {
+        assertLimit(options.maxFileBytes);
+        batch?.setMaxFileBytes(options.maxFileBytes);
+    }
+    const limitOf = () => batch ? batch.maxFileBytes() : options.maxFileBytes;
     const historyScope = JSON.stringify([key.providerId, key.instanceId, key.incarnation, key.viewId]);
     const listeners = new Set();
     const known = new Map();
@@ -252,6 +250,15 @@ export function createWorkspaceProvider(options) {
             }
             if (journal.intent(operation))
                 return { kind: 'unknown', operationId: request.operationId, reason: 'An earlier attempt of this operation began and has no recorded outcome' };
+            // After the receipt and intent checks, so a replay of a committed operation keeps its result under a lower limit.
+            const limit = limitOf();
+            if (limit !== undefined) {
+                const oversized = changes.find(change => change.bytes.length > limit);
+                if (oversized) {
+                    const size = oversized.bytes.length, path = oversized.target.resource.path;
+                    return { kind: 'file_too_large', path, size, limit, reason: fileTooLarge(path, size, limit).message };
+                }
+            }
             journal.begin(operation, digest);
             let applying = false;
             const refuse = (reason) => { journal.cancel(operation); return { kind: 'unavailable', reason }; };
@@ -345,7 +352,7 @@ export function createWorkspaceProvider(options) {
                     if (!unchanged) {
                         applying = true;
                         const target = absolute(path);
-                        const temporary = `${target.slice(0, target.lastIndexOf('/'))}/.boring-${randomUUID()}.tmp`;
+                        const temporary = `${target.slice(0, target.lastIndexOf('/'))}/${temporaryFileName(randomUUID())}`;
                         const ctx = fsContext(access.signal);
                         const failure = async (reason) => { await fs.remove(temporary, { force: true }, fsContext()); return refuse(reason); };
                         if (change.kind === 'create') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-files",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "license": "MIT",
   "private": false,
   "type": "module",
@@ -81,12 +81,16 @@
     "./revision-handler": {
       "types": "./dist/revision-handler.d.ts",
       "import": "./dist/revision-handler.js"
+    },
+    "./file-types": {
+      "types": "./dist/file-types.d.ts",
+      "import": "./dist/file-types.js"
     }
   },
   "peerDependencies": {
-    "isomorphic-git": "1.42.6",
-    "@earendil-works/pi-durable": "1.1.0",
-    "@earendil-works/chord": "1.1.0"
+    "isomorphic-git": "^1.42.6",
+    "@earendil-works/pi-durable": "~1.1.0",
+    "@earendil-works/chord": "~1.1.0"
   },
   "peerDependenciesMeta": {
     "isomorphic-git": {