@j0hanz/filesystem-mcp 2.6.3 → 2.7.0

package/dist/core/file-uri.js

@@ -36,18 +36,23 @@ export function buildFileResourceUri(validPath) {
  * string, and watchers key on that string — a link and a `resourceUri` that
  * disagree hand the client two subscriptions for one file.
  */
-export function buildFileResourceLinkFor(uri, name, mimeType, size) {
+export function buildFileResourceLinkFor(uri, name, mimeType, size, 
+/** ISO-8601 mtime of the file the link names, when the caller has one. */
+lastModified) {
     return {
         type: 'resource_link',
         uri,
         name,
         mimeType,
         size,
-        annotations: { audience: ['user', 'assistant'] },
+        annotations: {
+            audience: ['user', 'assistant'],
+            ...(lastModified !== undefined ? { lastModified } : {}),
+        },
     };
 }
-function buildFileResourceLink(validPath, mimeType, size) {
-    return buildFileResourceLinkFor(buildFileResourceUri(validPath), basename(validPath), mimeType, size);
+function buildFileResourceLink(validPath, mimeType, size, lastModified) {
+    return buildFileResourceLinkFor(buildFileResourceUri(validPath), basename(validPath), mimeType, size, lastModified);
 }
 export function extractPath(uri) {
     const url = URL.parse(uri);
@@ -60,17 +65,17 @@ export function extractPath(uri) {
  * dry run — nothing was written, so the file on disk is still the one the
  * caller already has. None when the size is unknown or over the text-size cap —
  * the store serves the URI via readRaw, which would reject it with TOO_LARGE.
- * No link without a store to link into.
+ * File resources are read directly from disk, not from the result store.
+ * `lastModified` is the post-write mtime when the caller stat'd the file; a
+ * link without it is still valid.
  */
-export function writtenFileLinks(validPath, mimeType, size, options) {
-    if (options.dryRun || size === undefined || size > getMaxTextFileSize()) {
+export function writtenFileLinks(validPath, mimeType, size, dryRun = false, lastModified) {
+    if (dryRun || size === undefined || size > getMaxTextFileSize()) {
         return { resourceUri: undefined, resourceLink: undefined };
     }
     return {
         resourceUri: buildFileResourceUri(validPath),
-        resourceLink: options.resourceStore
-            ? buildFileResourceLink(validPath, mimeType, size)
-            : undefined,
+        resourceLink: buildFileResourceLink(validPath, mimeType, size, lastModified),
     };
 }
 /**
@@ -88,7 +93,7 @@ export function buildWrittenFileMeta(options) {
         lineCount: countLines(content),
         mimeType,
         kind,
-        ...writtenFileLinks(validPath, mimeType, size, options),
+        ...writtenFileLinks(validPath, mimeType, size, options.dryRun, options.lastModified),
     };
 }
 //# sourceMappingURL=file-uri.js.map

package/dist/core/file-uri.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-uri.js","sourceRoot":"","sources":["../../src/core/file-uri.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAE7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,yBAAyB,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,IAAY,EACZ,QAAgB,EAChB,IAAY;IAEZ,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG;QACH,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAY;IAC9E,OAAO,wBAAwB,CAC7B,oBAAoB,CAAC,SAAS,CAAC,EAC/B,QAAQ,CAAC,SAAS,CAAC,EACnB,QAAQ,EACR,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,EAAE,QAAQ,KAAK,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,QAAgB,EAChB,IAAwB,EACxB,OAAmF;IAEnF,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,kBAAkB,EAAE,EAAE,CAAC;QACxE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,OAAO,CAAC,aAAa;YACjC,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;YAClD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAKpC;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;QAC9B,QAAQ;QACR,IAAI;QACJ,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import type { ContentBlock } from '@modelcontextprotocol/server';\n\nimport { basename } from 'node:path';\n\nimport { detectMimeFromContent } from './mime.ts';\nimport { countLines } from './read.ts';\nimport type { FileKind } from './schema.ts';\nimport type { ResourceStore } from './store.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\n// Single owner of the `filesystem-mcp://file/` URI scheme — the template string,\n// the path→URI encoder, the URI→path decoder, the link blocks built from them,\n// and the post-write metadata block every write tool reports alongside them.\n\nexport const FILESYSTEM_FILE_URI_TEMPLATE = 'filesystem-mcp://file/{+path}';\n\n/**\n * The `{+path}` template-variable form of a path — what `completion/complete`\n * must return, since a client expands a suggestion into the template verbatim.\n * Unescaped, a '#' or '?' in a filename truncates the URI into a fragment or\n * query (silently naming a different path) and a '%' makes the decode throw.\n * Separators are restored so the value still reads as a path.\n */\nexport function encodeFileUriPath(validPath: string): string {\n  const posix = validPath.replace(/\\\\/g, '/');\n  return encodeURIComponent(posix).replace(/%2F/gi, '/');\n}\n\n/** Inverse of {@link encodeFileUriPath}; `undefined` on invalid percent-encoding. */\nexport function decodeFileUriPath(encoded: string): string | undefined {\n  try {\n    return decodeURIComponent(encoded);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildFileResourceUri(validPath: string): string {\n  return `filesystem-mcp://file/${encodeFileUriPath(validPath)}`;\n}\n\n/**\n * The link block for a URI already built by `buildFileResourceUri`. Callers that\n * hold the URI must use this rather than rebuilding from a path: a path that\n * differs only in case (the drive letter, on Windows) yields a *different* URI\n * string, and watchers key on that string — a link and a `resourceUri` that\n * disagree hand the client two subscriptions for one file.\n */\nexport function buildFileResourceLinkFor(\n  uri: string,\n  name: string,\n  mimeType: string,\n  size: number,\n): ContentBlock {\n  return {\n    type: 'resource_link',\n    uri,\n    name,\n    mimeType,\n    size,\n    annotations: { audience: ['user', 'assistant'] },\n  };\n}\n\nfunction buildFileResourceLink(validPath: string, mimeType: string, size: number): ContentBlock {\n  return buildFileResourceLinkFor(\n    buildFileResourceUri(validPath),\n    basename(validPath),\n    mimeType,\n    size,\n  );\n}\n\nexport function extractPath(uri: string): string | undefined {\n  const url = URL.parse(uri);\n  if (url?.protocol !== 'filesystem-mcp:' || url.host !== 'file') return undefined;\n  return decodeFileUriPath(url.pathname.slice(1));\n}\n\nexport interface WrittenFileMeta {\n  size: number;\n  lineCount: number;\n  mimeType: string;\n  kind: FileKind;\n  /** Undefined unless {@link writtenFileLinks} allows it: see there for when. */\n  resourceUri: string | undefined;\n  /** Undefined unless {@link writtenFileLinks} allows it: see there for when. */\n  resourceLink: ContentBlock | undefined;\n}\n\n/**\n * The URI and link a write tool may advertise for the file it wrote. None on a\n * dry run — nothing was written, so the file on disk is still the one the\n * caller already has. None when the size is unknown or over the text-size cap —\n * the store serves the URI via readRaw, which would reject it with TOO_LARGE.\n * No link without a store to link into.\n */\nexport function writtenFileLinks(\n  validPath: string,\n  mimeType: string,\n  size: number | undefined,\n  options: { resourceStore: ResourceStore | undefined; dryRun?: boolean | undefined },\n): Pick<WrittenFileMeta, 'resourceUri' | 'resourceLink'> {\n  if (options.dryRun || size === undefined || size > getMaxTextFileSize()) {\n    return { resourceUri: undefined, resourceLink: undefined };\n  }\n  return {\n    resourceUri: buildFileResourceUri(validPath),\n    resourceLink: options.resourceStore\n      ? buildFileResourceLink(validPath, mimeType, size)\n      : undefined,\n  };\n}\n\n/**\n * The block every write tool reports for the content it wrote (or, with\n * `dryRun`, would have written): size, line count, MIME, and whatever\n * {@link writtenFileLinks} allows it to advertise. Named fields, because\n * `validPath` and `content` are both strings and a positional swap type-checks.\n */\nexport function buildWrittenFileMeta(options: {\n  validPath: string;\n  content: string;\n  resourceStore: ResourceStore | undefined;\n  dryRun?: boolean | undefined;\n}): WrittenFileMeta {\n  const { validPath, content } = options;\n  const size = Buffer.byteLength(content, 'utf-8');\n  const { mimeType, kind } = detectMimeFromContent(validPath, content);\n  return {\n    size,\n    lineCount: countLines(content),\n    mimeType,\n    kind,\n    ...writtenFileLinks(validPath, mimeType, size, options),\n  };\n}\n"]}
+{"version":3,"file":"file-uri.js","sourceRoot":"","sources":["../../src/core/file-uri.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAE7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,yBAAyB,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,IAAY,EACZ,QAAgB,EAChB,IAAY;AACZ,0EAA0E;AAC1E,YAAqB;IAErB,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG;QACH,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;YAC/B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,QAAgB,EAChB,IAAY,EACZ,YAAqB;IAErB,OAAO,wBAAwB,CAC7B,oBAAoB,CAAC,SAAS,CAAC,EAC/B,QAAQ,CAAC,SAAS,CAAC,EACnB,QAAQ,EACR,IAAI,EACJ,YAAY,CACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,EAAE,QAAQ,KAAK,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,QAAgB,EAChB,IAAwB,EACxB,MAAM,GAAG,KAAK,EACd,YAAqB;IAErB,IAAI,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,kBAAkB,EAAE,EAAE,CAAC;QAChE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAKpC;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;QAC9B,QAAQ;QACR,IAAI;QACJ,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;KACrF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContentBlock } from '@modelcontextprotocol/server';\n\nimport { basename } from 'node:path';\n\nimport { detectMimeFromContent } from './mime.ts';\nimport type { FileKind } from './mime.ts';\nimport { countLines } from './read.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\n// Single owner of the `filesystem-mcp://file/` URI scheme — the template string,\n// the path→URI encoder, the URI→path decoder, the link blocks built from them,\n// and the post-write metadata block every write tool reports alongside them.\n\nexport const FILESYSTEM_FILE_URI_TEMPLATE = 'filesystem-mcp://file/{+path}';\n\n/**\n * The `{+path}` template-variable form of a path — what `completion/complete`\n * must return, since a client expands a suggestion into the template verbatim.\n * Unescaped, a '#' or '?' in a filename truncates the URI into a fragment or\n * query (silently naming a different path) and a '%' makes the decode throw.\n * Separators are restored so the value still reads as a path.\n */\nexport function encodeFileUriPath(validPath: string): string {\n  const posix = validPath.replace(/\\\\/g, '/');\n  return encodeURIComponent(posix).replace(/%2F/gi, '/');\n}\n\n/** Inverse of {@link encodeFileUriPath}; `undefined` on invalid percent-encoding. */\nexport function decodeFileUriPath(encoded: string): string | undefined {\n  try {\n    return decodeURIComponent(encoded);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildFileResourceUri(validPath: string): string {\n  return `filesystem-mcp://file/${encodeFileUriPath(validPath)}`;\n}\n\n/**\n * The link block for a URI already built by `buildFileResourceUri`. Callers that\n * hold the URI must use this rather than rebuilding from a path: a path that\n * differs only in case (the drive letter, on Windows) yields a *different* URI\n * string, and watchers key on that string — a link and a `resourceUri` that\n * disagree hand the client two subscriptions for one file.\n */\nexport function buildFileResourceLinkFor(\n  uri: string,\n  name: string,\n  mimeType: string,\n  size: number,\n  /** ISO-8601 mtime of the file the link names, when the caller has one. */\n  lastModified?: string,\n): ContentBlock {\n  return {\n    type: 'resource_link',\n    uri,\n    name,\n    mimeType,\n    size,\n    annotations: {\n      audience: ['user', 'assistant'],\n      ...(lastModified !== undefined ? { lastModified } : {}),\n    },\n  };\n}\n\nfunction buildFileResourceLink(\n  validPath: string,\n  mimeType: string,\n  size: number,\n  lastModified?: string,\n): ContentBlock {\n  return buildFileResourceLinkFor(\n    buildFileResourceUri(validPath),\n    basename(validPath),\n    mimeType,\n    size,\n    lastModified,\n  );\n}\n\nexport function extractPath(uri: string): string | undefined {\n  const url = URL.parse(uri);\n  if (url?.protocol !== 'filesystem-mcp:' || url.host !== 'file') return undefined;\n  return decodeFileUriPath(url.pathname.slice(1));\n}\n\nexport interface WrittenFileMeta {\n  size: number;\n  lineCount: number;\n  mimeType: string;\n  kind: FileKind;\n  /** Undefined unless {@link writtenFileLinks} allows it: see there for when. */\n  resourceUri: string | undefined;\n  /** Undefined unless {@link writtenFileLinks} allows it: see there for when. */\n  resourceLink: ContentBlock | undefined;\n}\n\n/**\n * The URI and link a write tool may advertise for the file it wrote. None on a\n * dry run — nothing was written, so the file on disk is still the one the\n * caller already has. None when the size is unknown or over the text-size cap —\n * the store serves the URI via readRaw, which would reject it with TOO_LARGE.\n * File resources are read directly from disk, not from the result store.\n * `lastModified` is the post-write mtime when the caller stat'd the file; a\n * link without it is still valid.\n */\nexport function writtenFileLinks(\n  validPath: string,\n  mimeType: string,\n  size: number | undefined,\n  dryRun = false,\n  lastModified?: string,\n): Pick<WrittenFileMeta, 'resourceUri' | 'resourceLink'> {\n  if (dryRun || size === undefined || size > getMaxTextFileSize()) {\n    return { resourceUri: undefined, resourceLink: undefined };\n  }\n  return {\n    resourceUri: buildFileResourceUri(validPath),\n    resourceLink: buildFileResourceLink(validPath, mimeType, size, lastModified),\n  };\n}\n\n/**\n * The block every write tool reports for the content it wrote (or, with\n * `dryRun`, would have written): size, line count, MIME, and whatever\n * {@link writtenFileLinks} allows it to advertise. Named fields, because\n * `validPath` and `content` are both strings and a positional swap type-checks.\n */\nexport function buildWrittenFileMeta(options: {\n  validPath: string;\n  content: string;\n  dryRun?: boolean | undefined;\n  lastModified?: string | undefined;\n}): WrittenFileMeta {\n  const { validPath, content } = options;\n  const size = Buffer.byteLength(content, 'utf-8');\n  const { mimeType, kind } = detectMimeFromContent(validPath, content);\n  return {\n    size,\n    lineCount: countLines(content),\n    mimeType,\n    kind,\n    ...writtenFileLinks(validPath, mimeType, size, options.dryRun, options.lastModified),\n  };\n}\n"]}

package/dist/core/fs.d.ts

@@ -44,7 +44,7 @@ export declare class GuardedFileSystem {
     }>;
     /**
      * Append to the existing file (created if missing). Deliberately NOT the
-     * atomicWriteFile temp+rename dance: the rename would swap in a fresh inode,
+     * writeFile temp+rename dance: the rename would swap in a fresh inode,
      * and the whole point of appending is to extend the file that's already
      * there — inode and mode survive by construction.
      */

package/dist/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAEL,EAAE,IAAI,IAAI,EAEV,KAAK,IAAI,OAAO,EAIhB,QAAQ,IAAI,UAAU,EAEtB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAIjB,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,SAAS,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1D,YAAY,EAAE,QAAQ,EAAE,CAAC;AACzB,YAAY,EAAE,KAAK,EAAE,CAAC;AA+FtB;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;IAI1B,IAAI,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzC,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzC,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAU/C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAO,GACjD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjC;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAO,GACjD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgEjC;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/E,EAAE,CACN,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC;IAQV,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAOnE,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAoB1D,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAmB9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAS3C,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAOjE,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAa9D;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAEL,EAAE,IAAI,IAAI,EAEV,KAAK,IAAI,OAAO,EAIhB,QAAQ,IAAI,UAAU,EAEtB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAIjB,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,SAAS,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1D,YAAY,EAAE,QAAQ,EAAE,CAAC;AACzB,YAAY,EAAE,KAAK,EAAE,CAAC;AAgCtB;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;IAI1B,IAAI,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzC,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzC,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAU/C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAO,GACjD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DjC;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAO,GACjD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgEjC;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/E,EAAE,CACN,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC;IAQV,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAOnE,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAoB1D,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAS3C,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAOjE,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAa9D;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/core/fs.js

@@ -31,59 +31,6 @@ async function resolveForWrite(pathGuard, filePath) {
     }
     return validPath;
 }
-async function atomicWriteFile(filePath, content, pathGuard, options = {}) {
-    const { signal } = options;
-    const validPath = await resolveForWrite(pathGuard, filePath);
-    const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);
-    const tempPath = `${validPath}.${tempSuffix}.tmp`;
-    // The rename below swaps in the temp file's inode, so the target would
-    // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600
-    // file to 0644 on every write. Carry the existing mode across instead.
-    let existingMode;
-    try {
-        existingMode = (await fsStat(validPath)).mode & 0o777;
-    }
-    catch (error) {
-        // ENOENT is the normal new-file case: the default mode is correct there.
-        // Anything else (EACCES, EIO) means the mode about to be overwritten could
-        // not be read, and the write will silently widen the file — say so rather
-        // than swallowing it.
-        if (!isNotFoundErrno(error)) {
-            Logger.warn(`atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`);
-        }
-    }
-    try {
-        signal?.throwIfAborted();
-        // Create the temp file already narrowed to the target's mode: a 0600
-        // file's new bytes must never sit at 0644 while the write is in flight.
-        // `wx` fails on a name collision instead of overwriting; the chmod below
-        // still restores bits the umask masked off at creation.
-        await fsWriteFile(tempPath, content, {
-            signal,
-            flag: 'wx',
-            ...(existingMode !== undefined ? { mode: existingMode } : {}),
-        });
-        if (existingMode !== undefined) {
-            await fsChmod(tempPath, existingMode);
-        }
-        // Last cancellation point. The rename IS the commit: once it starts the
-        // target may already be replaced, so it is never raced against the
-        // signal — a withAbort race would report a finished write as failed, and
-        // a client retry would apply it twice (same reasoning as appendFile).
-        signal?.throwIfAborted();
-        await fsRename(tempPath, validPath);
-    }
-    catch (error) {
-        try {
-            await fsUnlink(tempPath);
-        }
-        catch (cleanupError) {
-            Logger.warn(`Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`);
-        }
-        throw error;
-    }
-    return { validPath };
-}
 const CHAR_LF = 10;
 const LINE_COUNT_CHUNK_BYTES = 64 * 1024;
 /**
@@ -161,11 +108,61 @@ export class GuardedFileSystem {
         await fsRename(validOld, validNew);
     }
     async writeFile(filePath, content, options = {}) {
-        return atomicWriteFile(filePath, content, this.pathGuard, options);
+        const { signal } = options;
+        const validPath = await resolveForWrite(this.pathGuard, filePath);
+        const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);
+        const tempPath = `${validPath}.${tempSuffix}.tmp`;
+        // The rename below swaps in the temp file's inode, so the target would
+        // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600
+        // file to 0644 on every write. Carry the existing mode across instead.
+        let existingMode;
+        try {
+            existingMode = (await fsStat(validPath)).mode & 0o777;
+        }
+        catch (error) {
+            // ENOENT is the normal new-file case: the default mode is correct there.
+            // Anything else (EACCES, EIO) means the mode about to be overwritten could
+            // not be read, and the write will silently widen the file — say so rather
+            // than swallowing it.
+            if (!isNotFoundErrno(error)) {
+                Logger.warn(`atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`);
+            }
+        }
+        try {
+            signal?.throwIfAborted();
+            // Create the temp file already narrowed to the target's mode: a 0600
+            // file's new bytes must never sit at 0644 while the write is in flight.
+            // `wx` fails on a name collision instead of overwriting; the chmod below
+            // still restores bits the umask masked off at creation.
+            await fsWriteFile(tempPath, content, {
+                signal,
+                flag: 'wx',
+                ...(existingMode !== undefined ? { mode: existingMode } : {}),
+            });
+            if (existingMode !== undefined) {
+                await fsChmod(tempPath, existingMode);
+            }
+            // Last cancellation point. The rename IS the commit: once it starts the
+            // target may already be replaced, so it is never raced against the
+            // signal — a withAbort race would report a finished write as failed, and
+            // a client retry would apply it twice (same reasoning as appendFile).
+            signal?.throwIfAborted();
+            await fsRename(tempPath, validPath);
+        }
+        catch (error) {
+            try {
+                await fsUnlink(tempPath);
+            }
+            catch (cleanupError) {
+                Logger.warn(`Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`);
+            }
+            throw error;
+        }
+        return { validPath };
     }
     /**
      * Append to the existing file (created if missing). Deliberately NOT the
-     * atomicWriteFile temp+rename dance: the rename would swap in a fresh inode,
+     * writeFile temp+rename dance: the rename would swap in a fresh inode,
      * and the whole point of appending is to extend the file that's already
      * there — inode and mode survive by construction.
      */
@@ -290,7 +287,9 @@ export class GuardedFileSystem {
         return { validPath, content, stats };
     }
     async readRaw(filePath, options) {
+        options?.signal?.throwIfAborted();
         const validPath = await this.pathGuard.validateExistingPath(filePath);
+        options?.signal?.throwIfAborted();
         const stats = await withAbort(fsStat(validPath), options?.signal);
         assertFileStats(filePath, stats);
         // Enforce size limit before reading to avoid loading large files into memory.
@@ -299,7 +298,17 @@ export class GuardedFileSystem {
         if (stats.size > maxTextFileSize) {
             throw createTooLargeError(stats.size, maxTextFileSize, filePath);
         }
-        const content = await withAbort(fsReadFile(validPath), options?.signal);
+        let content;
+        try {
+            content = await fsReadFile(validPath, options);
+        }
+        catch (error) {
+            // Node wraps even a TimeoutError signal reason in AbortError.
+            if (error instanceof Error && error.name === 'AbortError') {
+                options?.signal?.throwIfAborted();
+            }
+            throw error;
+        }
         const mimeInfo = detectMimeFromContent(validPath, content);
         return {
             content,

package/dist/core/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,KAAK,IAAI,OAAO,EAChB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,OAAO,IAAI,SAAS,EACpB,QAAQ,IAAI,UAAU,EACtB,QAAQ,IAAI,UAAU,EACtB,MAAM,IAAI,QAAQ,EAClB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,EAClB,SAAS,IAAI,WAAW,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAoB,EAAE,QAAgB;IACnE,IAAI,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YACzF,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,OAAe,EACf,SAAoB,EACpB,UAAgD,EAAE;IAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,UAAU,MAAM,CAAC;IAElD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,YAAY,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,sBAAsB;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,qDAAqD,SAAS,0CAA0C,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE;YACnC,MAAM;YACN,IAAI,EAAE,IAAI;YACV,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxC,CAAC;QACD,wEAAwE;QACxE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,gCAAgC,QAAQ,uBAAuB,yBAAyB,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAC/I,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnD,SAAS,CAAC;YACR,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,UAAU,IAAI,SAAS,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,IAAI,KAAK,OAAO;oBAAE,QAAQ,EAAE,CAAC;gBACjC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,OAA8C;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,OAA0C;QAE1C,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClE,wEAAwE;QACxE,IAAI,QAAQ,KAAK,QAAQ;YAAE,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,OAAO,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAkB,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACvC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,eAAe;YACf,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;oBACvD,MAAM,CAAC,IAAI,CACT,kCAAkC,SAAS,2BAA2B,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAC/G,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,IAAY;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,QAAgB,EAAE,OAAoC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,EAAE,CACN,MAAc,EACd,WAAmB,EACnB,OAAoC;QAEpC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,IAAc;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,OAAiD;QAEjD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YACzB,6EAA6E;YAC7E,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,SAAS,EACnB,sBAAsB,OAAO,EAAE,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,YAAY,OAAO,SAAS,EACxF,QAAQ,EACR,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE;YACtE,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAkC;QAElC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAC5C,MAAM,CAAC,IAAI,CACT,kCAAkC,OAAO,KAAK,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAmC,EACnC,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { Stats } from 'node:fs';\nimport type { FileHandle } from 'node:fs/promises';\nimport {\n  chmod as fsChmod,\n  cp as fsCp,\n  lstat as fsLstat,\n  mkdir as fsMkdir,\n  open as fsOpen,\n  opendir as fsOpendir,\n  readFile as fsReadFile,\n  readlink as fsReadlink,\n  rename as fsRename,\n  rm as fsRm,\n  rmdir as fsRmdir,\n  stat as fsStat,\n  unlink as fsUnlink,\n  writeFile as fsWriteFile,\n} from 'node:fs/promises';\nimport { dirname, isAbsolute, resolve } from 'node:path';\n\nimport { withAbort } from './concurrency.ts';\nimport {\n  ErrorCode,\n  formatUnknownErrorMessage,\n  FsError,\n  isFsError,\n  isNodeError,\n  isNotFoundErrno,\n} from './errors.ts';\nimport { detectMimeFromContent } from './mime.ts';\nimport { Logger } from './observability.ts';\nimport type { EntryType as FileType } from './path-utils.ts';\nimport { respellCaseOnlyTarget } from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\nimport type { ReadFileResult, ReadSpec } from './read.ts';\nimport { assertFileStats, createTooLargeError, readFileWithStats } from './read.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\nexport type { FileType };\nexport type { Stats };\n\n// ─── Domain primitives ────────────────────────────────────────────────────────\n\n/**\n * validatePathForWrite + symlink resolution: a write aimed at a link must land\n * on its revalidated target, not create a new file beside the link. ENOENT is\n * the normal new-file case, so it falls through with the original path.\n */\nasync function resolveForWrite(pathGuard: PathGuard, filePath: string): Promise<string> {\n  let validPath = await pathGuard.validatePathForWrite(filePath);\n\n  try {\n    const stats = await fsLstat(validPath);\n    if (stats.isSymbolicLink()) {\n      const target = await fsReadlink(validPath);\n      const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(validPath), target);\n      validPath = await pathGuard.validatePathForWrite(resolvedTarget);\n    }\n  } catch (error) {\n    if (!isNotFoundErrno(error)) {\n      throw error;\n    }\n  }\n\n  return validPath;\n}\n\nasync function atomicWriteFile(\n  filePath: string,\n  content: string,\n  pathGuard: PathGuard,\n  options: { signal?: AbortSignal | undefined } = {},\n): Promise<{ validPath: string }> {\n  const { signal } = options;\n  const validPath = await resolveForWrite(pathGuard, filePath);\n\n  const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);\n  const tempPath = `${validPath}.${tempSuffix}.tmp`;\n\n  // The rename below swaps in the temp file's inode, so the target would\n  // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600\n  // file to 0644 on every write. Carry the existing mode across instead.\n  let existingMode: number | undefined;\n  try {\n    existingMode = (await fsStat(validPath)).mode & 0o777;\n  } catch (error) {\n    // ENOENT is the normal new-file case: the default mode is correct there.\n    // Anything else (EACCES, EIO) means the mode about to be overwritten could\n    // not be read, and the write will silently widen the file — say so rather\n    // than swallowing it.\n    if (!isNotFoundErrno(error)) {\n      Logger.warn(\n        `atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`,\n      );\n    }\n  }\n\n  try {\n    signal?.throwIfAborted();\n    // Create the temp file already narrowed to the target's mode: a 0600\n    // file's new bytes must never sit at 0644 while the write is in flight.\n    // `wx` fails on a name collision instead of overwriting; the chmod below\n    // still restores bits the umask masked off at creation.\n    await fsWriteFile(tempPath, content, {\n      signal,\n      flag: 'wx',\n      ...(existingMode !== undefined ? { mode: existingMode } : {}),\n    });\n    if (existingMode !== undefined) {\n      await fsChmod(tempPath, existingMode);\n    }\n    // Last cancellation point. The rename IS the commit: once it starts the\n    // target may already be replaced, so it is never raced against the\n    // signal — a withAbort race would report a finished write as failed, and\n    // a client retry would apply it twice (same reasoning as appendFile).\n    signal?.throwIfAborted();\n    await fsRename(tempPath, validPath);\n  } catch (error) {\n    try {\n      await fsUnlink(tempPath);\n    } catch (cleanupError) {\n      Logger.warn(\n        `Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`,\n      );\n    }\n    throw error;\n  }\n  return { validPath };\n}\n\nconst CHAR_LF = 10;\n\nconst LINE_COUNT_CHUNK_BYTES = 64 * 1024;\n\n/**\n * Line count for a file on disk, counting newline bytes in fixed 64 KiB\n * chunks so an arbitrarily large file (one append's result metadata) costs\n * bounded memory. NOT FileHandle.readLines: it decodes each physical line\n * whole, so a multi-GB single-line log OOMs the server after the append has\n * already landed — a reported failure invites a retry that appends twice.\n * Matches read.ts's countLines semantics: a trailing newline does not open\n * a new line, an unterminated final line counts, an empty file is 0.\n */\nexport async function countFileLines(filePath: string): Promise<number> {\n  const handle = await fsOpen(filePath, 'r');\n  try {\n    let newlines = 0;\n    let lastByte = 0;\n    let totalBytes = 0;\n    const chunk = Buffer.alloc(LINE_COUNT_CHUNK_BYTES);\n    for (;;) {\n      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);\n      if (bytesRead === 0) break;\n      totalBytes += bytesRead;\n      for (let i = 0; i < bytesRead; i++) {\n        const byte = chunk[i] ?? 0;\n        if (byte === CHAR_LF) newlines++;\n        lastByte = byte;\n      }\n    }\n    // totalBytes is the empty-file sentinel: a NUL (0x00) final byte is real\n    // content and must count as an unterminated final line, not \"empty\".\n    return totalBytes === 0 ? 0 : lastByte === CHAR_LF ? newlines : newlines + 1;\n  } finally {\n    await handle.close();\n  }\n}\n\nexport class GuardedFileSystem {\n  readonly pathGuard: PathGuard;\n\n  constructor(pathGuard: PathGuard) {\n    this.pathGuard = pathGuard;\n  }\n\n  async stat(\n    filePath: string,\n    options?: { signal?: AbortSignal | undefined },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async lstat(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const stats = await withAbort(fsLstat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async readlink(\n    filePath: string,\n    options?: Parameters<typeof fsReadlink>[1],\n  ): Promise<{ linkString: string; validPath: string }> {\n    // validateExistingPath resolves through the symlink, so readlink would always\n    // be handed the final target — a regular file — and fail EINVAL. This guard\n    // keeps the link itself while still enforcing containment and the denylist.\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const raw = await fsReadlink(validPath, options);\n    const linkString = Buffer.isBuffer(raw) ? raw.toString('utf-8') : raw;\n    return { linkString, validPath };\n  }\n\n  async mkdir(filePath: string, options?: Parameters<typeof fsMkdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForWrite(filePath);\n    await fsMkdir(validPath, options);\n  }\n\n  async rename(oldPath: string, newPath: string): Promise<void> {\n    // Not validateExistingPath: that resolves through a symlink, so renaming a\n    // link would rename its target and leave the link dangling.\n    const validOld = await this.pathGuard.validatePathForDelete(oldPath);\n    let validNew = await this.pathGuard.validatePathForWrite(newPath);\n    // Renaming a path onto itself is only meaningful as a case-only rename.\n    if (validOld === validNew) validNew = respellCaseOnlyTarget(newPath, validNew);\n    await fsRename(validOld, validNew);\n  }\n\n  async writeFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    return atomicWriteFile(filePath, content, this.pathGuard, options);\n  }\n\n  /**\n   * Append to the existing file (created if missing). Deliberately NOT the\n   * atomicWriteFile temp+rename dance: the rename would swap in a fresh inode,\n   * and the whole point of appending is to extend the file that's already\n   * there — inode and mode survive by construction.\n   */\n  async appendFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n    // Non-regular targets must be rejected before the open: 'a' on a FIFO\n    // (POSIX) blocks until a reader appears, and fsOpen takes no signal, so\n    // the call would hang unabortable and pin its concurrency slot. The\n    // overwrite path can't hang — it writes a temp file and renames over.\n    // resolveForWrite has already resolved any symlink to its target, so the\n    // lstat here doubles as the new-vs-existing probe for the cleanup below.\n    let existed = true;\n    try {\n      assertFileStats(validPath, await fsLstat(validPath));\n    } catch (error) {\n      if (!isNotFoundErrno(error)) throw error;\n      existed = false;\n    }\n    // fs.promises.appendFile takes no signal, so a withAbort race would\n    // report failure while the append still lands — a client retry then\n    // appends twice. A handle opened with 'a' gets a genuinely abortable\n    // FileHandle.writeFile instead, same as the writeFile path. 'a' on a\n    // missing target CREATES it, so: check the signal before the open, and\n    // if the call then fails after creating the file, remove what it made —\n    // an aborted or errored call must not leave a phantom file behind.\n    // The pre-open lstat only proves the file was missing a moment ago:\n    // 'ax' makes creation exclusive, so a racer that created it in between\n    // fails EEXIST, reopens plainly, and never claims cleanup rights over\n    // the winner's file.\n    signal?.throwIfAborted();\n    let created = false;\n    let handle: FileHandle;\n    if (existed) {\n      handle = await fsOpen(validPath, 'a');\n    } else {\n      try {\n        handle = await fsOpen(validPath, 'ax');\n        created = true;\n      } catch (error) {\n        if (!isNodeError(error) || error.code !== 'EEXIST') throw error;\n        handle = await fsOpen(validPath, 'a');\n      }\n    }\n    try {\n      signal?.throwIfAborted();\n      // Ceiling: an append is not transactional, so an abort landing\n      // mid-write can leave a prefix of the content on disk. Unwiring the\n      // signal would trade that for a silently-completed write; a client\n      // that retries is double-appending either way, so the abortable\n      // write stays.\n      await handle.writeFile(content, { signal });\n    } catch (error) {\n      if (created) {\n        await fsUnlink(validPath).catch((unlinkError: unknown) => {\n          Logger.warn(\n            `Failed to remove newly created ${validPath} after a failed append: ${formatUnknownErrorMessage(unlinkError)}`,\n          );\n        });\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    return { validPath };\n  }\n\n  /**\n   * Leading bytes of a file, for MIME sniffing without loading the whole\n   * file — an append's result must describe the resulting file (which may be\n   * a multi-GB log), not the chunk that was appended.\n   */\n  async readLeadingSample(filePath: string, size: number): Promise<Buffer> {\n    const { validPath } = await this.stat(filePath);\n    const handle = await fsOpen(validPath, 'r');\n    try {\n      const buffer = Buffer.alloc(size);\n      const { bytesRead } = await handle.read(buffer, 0, size, 0);\n      return buffer.subarray(0, bytesRead);\n    } finally {\n      await handle.close();\n    }\n  }\n\n  async rm(filePath: string, options?: Parameters<typeof fsRm>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRm(validPath, options);\n  }\n\n  async rmdir(filePath: string, options?: Parameters<typeof fsRmdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRmdir(validPath, options);\n  }\n\n  async cp(\n    source: string,\n    destination: string,\n    options?: Parameters<typeof fsCp>[2],\n  ): Promise<void> {\n    // As in rename: keep the link itself so callers passing verbatimSymlinks\n    // actually copy the link rather than a dereferenced target.\n    const validSource = await this.pathGuard.validatePathForDelete(source);\n    const validDest = await this.pathGuard.validatePathForWrite(destination);\n    await fsCp(validSource, validDest, options);\n  }\n\n  async readFile(filePath: string, spec: ReadSpec): Promise<ReadFileResult> {\n    spec.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), spec.signal);\n    return readFileWithStats(filePath, validPath, stats, spec);\n  }\n\n  async readEditableText(\n    filePath: string,\n    options?: { signal?: AbortSignal; tool?: string },\n  ): Promise<{ validPath: string; content: string; stats: Stats }> {\n    const { stats, validPath } = await this.stat(filePath, options);\n    const maxSize = getMaxTextFileSize();\n    if (stats.size > maxSize) {\n      // `tool` labels the TOO_LARGE message so the client sees which tool refused.\n      throw new FsError(\n        ErrorCode.TOO_LARGE,\n        `File too large for ${options?.tool ?? 'edit'} (${stats.size} bytes > ${maxSize} bytes)`,\n        filePath,\n        { size: stats.size, maxFileSize: maxSize },\n      );\n    }\n    const { content } = await readFileWithStats(filePath, validPath, stats, {\n      kind: 'full',\n      strictUtf8: true,\n      ...(options?.signal ? { signal: options.signal } : {}),\n    });\n    return { validPath, content, stats };\n  }\n\n  async readRaw(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ content: Buffer; mimeType: string; isBinary: boolean }> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    assertFileStats(filePath, stats);\n    // Enforce size limit before reading to avoid loading large files into memory.\n    // Binary detection is best-effort, but this is a hard limit.\n    const maxTextFileSize = getMaxTextFileSize();\n    if (stats.size > maxTextFileSize) {\n      throw createTooLargeError(stats.size, maxTextFileSize, filePath);\n    }\n    const content = await withAbort(fsReadFile(validPath), options?.signal);\n    const mimeInfo = detectMimeFromContent(validPath, content);\n    return {\n      content,\n      mimeType: mimeInfo.mimeType,\n      isBinary: mimeInfo.kind !== 'text',\n    };\n  }\n\n  async open(filePath: string): Promise<FileHandle> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    return fsOpen(validPath, 'r');\n  }\n\n  // Single resolution + stat: validateExistingPathDetailed resolves the real\n  // path (following symlinks, re-checking sensitivity) once, then we stat the\n  // resolved target. Replaces the tool-side validateExistingPathDetailed +\n  // fs.stat pair that re-validated through the free stat() guard.\n  async statDetailed(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ requestedPath: string; isSymlink: boolean; stats: Stats }> {\n    const { requestedPath, resolvedPath, isSymlink } =\n      await this.pathGuard.validateExistingPathDetailed(filePath);\n    const stats = await withAbort(fsStat(resolvedPath), options?.signal);\n    return { requestedPath, isSymlink, stats };\n  }\n\n  async hasChildrenUnchecked(dirPath: string): Promise<boolean> {\n    const dir = await fsOpendir(dirPath);\n    try {\n      const entry = await dir.read();\n      return entry !== null;\n    } finally {\n      await dir.close().catch((closeErr: unknown) => {\n        Logger.warn(\n          `Failed to close dir handle for ${dirPath}: ${formatUnknownErrorMessage(closeErr)}`,\n        );\n      });\n    }\n  }\n}\n\n/**\n * Returns whether `path` exists, treating \"not found\" as absent and logging any\n * other stat failure. Used for TOCTOU re-checks between plan and execute phases.\n */\nexport async function destExists(\n  fs: Pick<GuardedFileSystem, 'stat'>,\n  path: string,\n  label: string,\n): Promise<boolean> {\n  try {\n    await fs.stat(path);\n    return true;\n  } catch (err) {\n    const missing = isNotFoundErrno(err) || (isFsError(err) && err.code === ErrorCode.NOT_FOUND);\n    if (!missing) {\n      Logger.warn(`${label}: dest stat failed unexpectedly for \"${path}\": ${String(err)}`);\n    }\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/core/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,KAAK,IAAI,OAAO,EAChB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,OAAO,IAAI,SAAS,EACpB,QAAQ,IAAI,UAAU,EACtB,QAAQ,IAAI,UAAU,EACtB,MAAM,IAAI,QAAQ,EAClB,EAAE,IAAI,IAAI,EACV,KAAK,IAAI,OAAO,EAChB,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,EAClB,SAAS,IAAI,WAAW,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAoB,EAAE,QAAgB;IACnE,IAAI,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YACzF,SAAS,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnD,SAAS,CAAC;YACR,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,UAAU,IAAI,SAAS,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,IAAI,KAAK,OAAO;oBAAE,QAAQ,EAAE,CAAC;gBACjC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,OAA8C;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,OAA0C;QAE1C,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClE,wEAAwE;QACxE,IAAI,QAAQ,KAAK,QAAQ;YAAE,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,UAAU,MAAM,CAAC;QAElD,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CACT,qDAAqD,SAAS,0CAA0C,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,wDAAwD;YACxD,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE;gBACnC,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,gCAAgC,QAAQ,uBAAuB,yBAAyB,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAC/I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,OAAe,EACf,UAAgD,EAAE;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,eAAe,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAkB,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACvC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,eAAe;YACf,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;oBACvD,MAAM,CAAC,IAAI,CACT,kCAAkC,SAAS,2BAA2B,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAC/G,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,IAAY;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,QAAgB,EAAE,OAAoC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAuC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,EAAE,CACN,MAAc,EACd,WAAmB,EACnB,OAAoC;QAEpC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,IAAc;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,OAAiD;QAEjD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YACzB,6EAA6E;YAC7E,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,SAAS,EACnB,sBAAsB,OAAO,EAAE,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,YAAY,OAAO,SAAS,EACxF,QAAQ,EACR,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE;YACtE,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,OAAkC;QAElC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAkC;QAElC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAC5C,MAAM,CAAC,IAAI,CACT,kCAAkC,OAAO,KAAK,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAmC,EACnC,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { Stats } from 'node:fs';\nimport type { FileHandle } from 'node:fs/promises';\nimport {\n  chmod as fsChmod,\n  cp as fsCp,\n  lstat as fsLstat,\n  mkdir as fsMkdir,\n  open as fsOpen,\n  opendir as fsOpendir,\n  readFile as fsReadFile,\n  readlink as fsReadlink,\n  rename as fsRename,\n  rm as fsRm,\n  rmdir as fsRmdir,\n  stat as fsStat,\n  unlink as fsUnlink,\n  writeFile as fsWriteFile,\n} from 'node:fs/promises';\nimport { dirname, isAbsolute, resolve } from 'node:path';\n\nimport { withAbort } from './concurrency.ts';\nimport {\n  ErrorCode,\n  formatUnknownErrorMessage,\n  FsError,\n  isFsError,\n  isNodeError,\n  isNotFoundErrno,\n} from './errors.ts';\nimport { detectMimeFromContent } from './mime.ts';\nimport { Logger } from './observability.ts';\nimport type { EntryType as FileType } from './path-utils.ts';\nimport { respellCaseOnlyTarget } from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\nimport type { ReadFileResult, ReadSpec } from './read.ts';\nimport { assertFileStats, createTooLargeError, readFileWithStats } from './read.ts';\nimport { getMaxTextFileSize } from './util.ts';\n\nexport type { FileType };\nexport type { Stats };\n\n// ─── Domain primitives ────────────────────────────────────────────────────────\n\n/**\n * validatePathForWrite + symlink resolution: a write aimed at a link must land\n * on its revalidated target, not create a new file beside the link. ENOENT is\n * the normal new-file case, so it falls through with the original path.\n */\nasync function resolveForWrite(pathGuard: PathGuard, filePath: string): Promise<string> {\n  let validPath = await pathGuard.validatePathForWrite(filePath);\n\n  try {\n    const stats = await fsLstat(validPath);\n    if (stats.isSymbolicLink()) {\n      const target = await fsReadlink(validPath);\n      const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(validPath), target);\n      validPath = await pathGuard.validatePathForWrite(resolvedTarget);\n    }\n  } catch (error) {\n    if (!isNotFoundErrno(error)) {\n      throw error;\n    }\n  }\n\n  return validPath;\n}\n\nconst CHAR_LF = 10;\n\nconst LINE_COUNT_CHUNK_BYTES = 64 * 1024;\n\n/**\n * Line count for a file on disk, counting newline bytes in fixed 64 KiB\n * chunks so an arbitrarily large file (one append's result metadata) costs\n * bounded memory. NOT FileHandle.readLines: it decodes each physical line\n * whole, so a multi-GB single-line log OOMs the server after the append has\n * already landed — a reported failure invites a retry that appends twice.\n * Matches read.ts's countLines semantics: a trailing newline does not open\n * a new line, an unterminated final line counts, an empty file is 0.\n */\nexport async function countFileLines(filePath: string): Promise<number> {\n  const handle = await fsOpen(filePath, 'r');\n  try {\n    let newlines = 0;\n    let lastByte = 0;\n    let totalBytes = 0;\n    const chunk = Buffer.alloc(LINE_COUNT_CHUNK_BYTES);\n    for (;;) {\n      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);\n      if (bytesRead === 0) break;\n      totalBytes += bytesRead;\n      for (let i = 0; i < bytesRead; i++) {\n        const byte = chunk[i] ?? 0;\n        if (byte === CHAR_LF) newlines++;\n        lastByte = byte;\n      }\n    }\n    // totalBytes is the empty-file sentinel: a NUL (0x00) final byte is real\n    // content and must count as an unterminated final line, not \"empty\".\n    return totalBytes === 0 ? 0 : lastByte === CHAR_LF ? newlines : newlines + 1;\n  } finally {\n    await handle.close();\n  }\n}\n\nexport class GuardedFileSystem {\n  readonly pathGuard: PathGuard;\n\n  constructor(pathGuard: PathGuard) {\n    this.pathGuard = pathGuard;\n  }\n\n  async stat(\n    filePath: string,\n    options?: { signal?: AbortSignal | undefined },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async lstat(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ stats: Stats; validPath: string }> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const stats = await withAbort(fsLstat(validPath), options?.signal);\n    return { stats, validPath };\n  }\n\n  async readlink(\n    filePath: string,\n    options?: Parameters<typeof fsReadlink>[1],\n  ): Promise<{ linkString: string; validPath: string }> {\n    // validateExistingPath resolves through the symlink, so readlink would always\n    // be handed the final target — a regular file — and fail EINVAL. This guard\n    // keeps the link itself while still enforcing containment and the denylist.\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    const raw = await fsReadlink(validPath, options);\n    const linkString = Buffer.isBuffer(raw) ? raw.toString('utf-8') : raw;\n    return { linkString, validPath };\n  }\n\n  async mkdir(filePath: string, options?: Parameters<typeof fsMkdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForWrite(filePath);\n    await fsMkdir(validPath, options);\n  }\n\n  async rename(oldPath: string, newPath: string): Promise<void> {\n    // Not validateExistingPath: that resolves through a symlink, so renaming a\n    // link would rename its target and leave the link dangling.\n    const validOld = await this.pathGuard.validatePathForDelete(oldPath);\n    let validNew = await this.pathGuard.validatePathForWrite(newPath);\n    // Renaming a path onto itself is only meaningful as a case-only rename.\n    if (validOld === validNew) validNew = respellCaseOnlyTarget(newPath, validNew);\n    await fsRename(validOld, validNew);\n  }\n\n  async writeFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n\n    const tempSuffix = randomUUID().replace(/-/g, '').slice(0, 12);\n    const tempPath = `${validPath}.${tempSuffix}.tmp`;\n\n    // The rename below swaps in the temp file's inode, so the target would\n    // inherit fsWriteFile's default 0o666 & ~umask — silently widening a 0600\n    // file to 0644 on every write. Carry the existing mode across instead.\n    let existingMode: number | undefined;\n    try {\n      existingMode = (await fsStat(validPath)).mode & 0o777;\n    } catch (error) {\n      // ENOENT is the normal new-file case: the default mode is correct there.\n      // Anything else (EACCES, EIO) means the mode about to be overwritten could\n      // not be read, and the write will silently widen the file — say so rather\n      // than swallowing it.\n      if (!isNotFoundErrno(error)) {\n        Logger.warn(\n          `atomicWriteFile: cannot read the existing mode of ${validPath}; the write will use the default mode: ${formatUnknownErrorMessage(error)}`,\n        );\n      }\n    }\n\n    try {\n      signal?.throwIfAborted();\n      // Create the temp file already narrowed to the target's mode: a 0600\n      // file's new bytes must never sit at 0644 while the write is in flight.\n      // `wx` fails on a name collision instead of overwriting; the chmod below\n      // still restores bits the umask masked off at creation.\n      await fsWriteFile(tempPath, content, {\n        signal,\n        flag: 'wx',\n        ...(existingMode !== undefined ? { mode: existingMode } : {}),\n      });\n      if (existingMode !== undefined) {\n        await fsChmod(tempPath, existingMode);\n      }\n      // Last cancellation point. The rename IS the commit: once it starts the\n      // target may already be replaced, so it is never raced against the\n      // signal — a withAbort race would report a finished write as failed, and\n      // a client retry would apply it twice (same reasoning as appendFile).\n      signal?.throwIfAborted();\n      await fsRename(tempPath, validPath);\n    } catch (error) {\n      try {\n        await fsUnlink(tempPath);\n      } catch (cleanupError) {\n        Logger.warn(\n          `Failed to clean up temp file ${tempPath} after write error (${formatUnknownErrorMessage(error)}): ${formatUnknownErrorMessage(cleanupError)}`,\n        );\n      }\n      throw error;\n    }\n    return { validPath };\n  }\n\n  /**\n   * Append to the existing file (created if missing). Deliberately NOT the\n   * writeFile temp+rename dance: the rename would swap in a fresh inode,\n   * and the whole point of appending is to extend the file that's already\n   * there — inode and mode survive by construction.\n   */\n  async appendFile(\n    filePath: string,\n    content: string,\n    options: { signal?: AbortSignal | undefined } = {},\n  ): Promise<{ validPath: string }> {\n    const { signal } = options;\n    const validPath = await resolveForWrite(this.pathGuard, filePath);\n    // Non-regular targets must be rejected before the open: 'a' on a FIFO\n    // (POSIX) blocks until a reader appears, and fsOpen takes no signal, so\n    // the call would hang unabortable and pin its concurrency slot. The\n    // overwrite path can't hang — it writes a temp file and renames over.\n    // resolveForWrite has already resolved any symlink to its target, so the\n    // lstat here doubles as the new-vs-existing probe for the cleanup below.\n    let existed = true;\n    try {\n      assertFileStats(validPath, await fsLstat(validPath));\n    } catch (error) {\n      if (!isNotFoundErrno(error)) throw error;\n      existed = false;\n    }\n    // fs.promises.appendFile takes no signal, so a withAbort race would\n    // report failure while the append still lands — a client retry then\n    // appends twice. A handle opened with 'a' gets a genuinely abortable\n    // FileHandle.writeFile instead, same as the writeFile path. 'a' on a\n    // missing target CREATES it, so: check the signal before the open, and\n    // if the call then fails after creating the file, remove what it made —\n    // an aborted or errored call must not leave a phantom file behind.\n    // The pre-open lstat only proves the file was missing a moment ago:\n    // 'ax' makes creation exclusive, so a racer that created it in between\n    // fails EEXIST, reopens plainly, and never claims cleanup rights over\n    // the winner's file.\n    signal?.throwIfAborted();\n    let created = false;\n    let handle: FileHandle;\n    if (existed) {\n      handle = await fsOpen(validPath, 'a');\n    } else {\n      try {\n        handle = await fsOpen(validPath, 'ax');\n        created = true;\n      } catch (error) {\n        if (!isNodeError(error) || error.code !== 'EEXIST') throw error;\n        handle = await fsOpen(validPath, 'a');\n      }\n    }\n    try {\n      signal?.throwIfAborted();\n      // Ceiling: an append is not transactional, so an abort landing\n      // mid-write can leave a prefix of the content on disk. Unwiring the\n      // signal would trade that for a silently-completed write; a client\n      // that retries is double-appending either way, so the abortable\n      // write stays.\n      await handle.writeFile(content, { signal });\n    } catch (error) {\n      if (created) {\n        await fsUnlink(validPath).catch((unlinkError: unknown) => {\n          Logger.warn(\n            `Failed to remove newly created ${validPath} after a failed append: ${formatUnknownErrorMessage(unlinkError)}`,\n          );\n        });\n      }\n      throw error;\n    } finally {\n      await handle.close();\n    }\n    return { validPath };\n  }\n\n  /**\n   * Leading bytes of a file, for MIME sniffing without loading the whole\n   * file — an append's result must describe the resulting file (which may be\n   * a multi-GB log), not the chunk that was appended.\n   */\n  async readLeadingSample(filePath: string, size: number): Promise<Buffer> {\n    const { validPath } = await this.stat(filePath);\n    const handle = await fsOpen(validPath, 'r');\n    try {\n      const buffer = Buffer.alloc(size);\n      const { bytesRead } = await handle.read(buffer, 0, size, 0);\n      return buffer.subarray(0, bytesRead);\n    } finally {\n      await handle.close();\n    }\n  }\n\n  async rm(filePath: string, options?: Parameters<typeof fsRm>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRm(validPath, options);\n  }\n\n  async rmdir(filePath: string, options?: Parameters<typeof fsRmdir>[1]): Promise<void> {\n    const validPath = await this.pathGuard.validatePathForDelete(filePath);\n    await fsRmdir(validPath, options);\n  }\n\n  async cp(\n    source: string,\n    destination: string,\n    options?: Parameters<typeof fsCp>[2],\n  ): Promise<void> {\n    // As in rename: keep the link itself so callers passing verbatimSymlinks\n    // actually copy the link rather than a dereferenced target.\n    const validSource = await this.pathGuard.validatePathForDelete(source);\n    const validDest = await this.pathGuard.validatePathForWrite(destination);\n    await fsCp(validSource, validDest, options);\n  }\n\n  async readFile(filePath: string, spec: ReadSpec): Promise<ReadFileResult> {\n    spec.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    const stats = await withAbort(fsStat(validPath), spec.signal);\n    return readFileWithStats(filePath, validPath, stats, spec);\n  }\n\n  async readEditableText(\n    filePath: string,\n    options?: { signal?: AbortSignal; tool?: string },\n  ): Promise<{ validPath: string; content: string; stats: Stats }> {\n    const { stats, validPath } = await this.stat(filePath, options);\n    const maxSize = getMaxTextFileSize();\n    if (stats.size > maxSize) {\n      // `tool` labels the TOO_LARGE message so the client sees which tool refused.\n      throw new FsError(\n        ErrorCode.TOO_LARGE,\n        `File too large for ${options?.tool ?? 'edit'} (${stats.size} bytes > ${maxSize} bytes)`,\n        filePath,\n        { size: stats.size, maxFileSize: maxSize },\n      );\n    }\n    const { content } = await readFileWithStats(filePath, validPath, stats, {\n      kind: 'full',\n      strictUtf8: true,\n      ...(options?.signal ? { signal: options.signal } : {}),\n    });\n    return { validPath, content, stats };\n  }\n\n  async readRaw(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ content: Buffer; mimeType: string; isBinary: boolean }> {\n    options?.signal?.throwIfAborted();\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    options?.signal?.throwIfAborted();\n    const stats = await withAbort(fsStat(validPath), options?.signal);\n    assertFileStats(filePath, stats);\n    // Enforce size limit before reading to avoid loading large files into memory.\n    // Binary detection is best-effort, but this is a hard limit.\n    const maxTextFileSize = getMaxTextFileSize();\n    if (stats.size > maxTextFileSize) {\n      throw createTooLargeError(stats.size, maxTextFileSize, filePath);\n    }\n    let content: Buffer;\n    try {\n      content = await fsReadFile(validPath, options);\n    } catch (error) {\n      // Node wraps even a TimeoutError signal reason in AbortError.\n      if (error instanceof Error && error.name === 'AbortError') {\n        options?.signal?.throwIfAborted();\n      }\n      throw error;\n    }\n    const mimeInfo = detectMimeFromContent(validPath, content);\n    return {\n      content,\n      mimeType: mimeInfo.mimeType,\n      isBinary: mimeInfo.kind !== 'text',\n    };\n  }\n\n  async open(filePath: string): Promise<FileHandle> {\n    const validPath = await this.pathGuard.validateExistingPath(filePath);\n    return fsOpen(validPath, 'r');\n  }\n\n  // Single resolution + stat: validateExistingPathDetailed resolves the real\n  // path (following symlinks, re-checking sensitivity) once, then we stat the\n  // resolved target. Replaces the tool-side validateExistingPathDetailed +\n  // fs.stat pair that re-validated through the free stat() guard.\n  async statDetailed(\n    filePath: string,\n    options?: { signal?: AbortSignal },\n  ): Promise<{ requestedPath: string; isSymlink: boolean; stats: Stats }> {\n    const { requestedPath, resolvedPath, isSymlink } =\n      await this.pathGuard.validateExistingPathDetailed(filePath);\n    const stats = await withAbort(fsStat(resolvedPath), options?.signal);\n    return { requestedPath, isSymlink, stats };\n  }\n\n  async hasChildrenUnchecked(dirPath: string): Promise<boolean> {\n    const dir = await fsOpendir(dirPath);\n    try {\n      const entry = await dir.read();\n      return entry !== null;\n    } finally {\n      await dir.close().catch((closeErr: unknown) => {\n        Logger.warn(\n          `Failed to close dir handle for ${dirPath}: ${formatUnknownErrorMessage(closeErr)}`,\n        );\n      });\n    }\n  }\n}\n\n/**\n * Returns whether `path` exists, treating \"not found\" as absent and logging any\n * other stat failure. Used for TOCTOU re-checks between plan and execute phases.\n */\nexport async function destExists(\n  fs: Pick<GuardedFileSystem, 'stat'>,\n  path: string,\n  label: string,\n): Promise<boolean> {\n  try {\n    await fs.stat(path);\n    return true;\n  } catch (err) {\n    const missing = isNotFoundErrno(err) || (isFsError(err) && err.code === ErrorCode.NOT_FOUND);\n    if (!missing) {\n      Logger.warn(`${label}: dest stat failed unexpectedly for \"${path}\": ${String(err)}`);\n    }\n    return false;\n  }\n}\n"]}

package/dist/core/glob.d.ts

@@ -14,6 +14,12 @@ export interface GlobEntriesOptions {
     suppressErrors?: boolean;
     /** Skip what a walk should not surface: DEFAULT_EXCLUDED_NAMES and .gitignore. */
     skipIgnored?: boolean;
+    /**
+     * Topmost directory whose `.gitignore` may apply to this walk — the allowed
+     * root containing `cwd`. Ancestors of `cwd` up to and including it are
+     * consulted; nothing above it is ever read. Ignored without `skipIgnored`.
+     */
+    ignoreCeiling?: string;
     /** Bounds the `.gitignore` discovery `skipIgnored` runs before the walk. */
     signal?: AbortSignal;
 }

package/dist/core/glob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/core/glob.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAiBzD;AAoJD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAoND,wBAAuB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAkBzF"}
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/core/glob.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOlD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkBzD;AA6MD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAoND,wBAAuB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAuBzF"}

package/dist/core/glob.js

@@ -4,8 +4,10 @@ import ignore from 'ignore';
 import { processInParallel } from "./concurrency.js";
 import { formatUnknownErrorMessage } from "./errors.js";
 import { Logger } from "./observability.js";
-import { isWindowsDriveRelativePath, toPosixPath } from "./path-utils.js";
+import { isPathInsideDirectory, isWindowsDriveRelativePath, toPosixPath } from "./path-utils.js";
 import { MIB } from "./util.js";
+/** `..` bounded on both sides by a separator, a brace delimiter, or the pattern edge. */
+const TRAVERSAL_DOTDOT_RE = /(?:^|[/\\{,])\.\.(?=[/\\},]|$)/u;
 export function isSafeGlobSyntax(pattern) {
     if (!pattern || pattern.trim().length === 0) {
         return false;
@@ -16,10 +18,11 @@ export function isSafeGlobSyntax(pattern) {
     if (isWindowsDriveRelativePath(pattern)) {
         return false;
     }
-    // Covers every engine-specific traversal form too — `{a,..}` and `[..]` both
-    // contain '..', so they are rejected here. Keep this check whole-string: the
-    // per-form guards that used to follow it were unreachable because of it.
-    if (pattern.includes('..')) {
+    // Only a whole `..` — a path segment, or one alternative of a `{a,..}`
+    // brace set — can traverse. `..` inside a segment (`[...slug]`, `v1..2.md`,
+    // `[..]`) is a literal name or a character class, and PathGuard re-checks
+    // containment on every resolved entry regardless.
+    if (TRAVERSAL_DOTDOT_RE.test(pattern)) {
         return false;
     }
     return true;
@@ -49,13 +52,56 @@ async function loadGitignoreFiles(root, gitignorePaths, manager, signal) {
         }
     }, GLOB_BATCH_CONCURRENCY, signal);
 }
+/**
+ * Load `.gitignore` from each ancestor of `root` up to and including `ceiling`,
+ * farthest first. A rule set that ignores `root` itself is skipped: the caller
+ * named that directory on purpose, and applying the rule would empty the walk.
+ */
+async function loadAncestorGitignores(root, ceiling, manager, signal) {
+    const normalizedCeiling = resolve(ceiling);
+    const chain = [];
+    for (let dir = dirname(resolve(root));; dir = dirname(dir)) {
+        if (!isPathInsideDirectory(normalizedCeiling, dir))
+            break;
+        chain.push(dir);
+        if ((isPathInsideDirectory(dir, normalizedCeiling) &&
+            isPathInsideDirectory(normalizedCeiling, dir)) ||
+            dirname(dir) === dir) {
+            break;
+        }
+    }
+    for (const dir of chain.reverse()) {
+        signal?.throwIfAborted();
+        const file = join(dir, '.gitignore');
+        try {
+            const info = await lstat(file);
+            if (!info.isFile() || info.size > MAX_GITIGNORE_BYTES)
+                continue;
+            const matcher = ignore().add(await fsReadFile(file, { encoding: 'utf-8', signal }));
+            const prefix = toPosixPath(relative(dir, root));
+            if (matcher.test(`${prefix}/`).ignored)
+                continue;
+            manager.addAncestorMatcher(prefix, matcher);
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === 'AbortError')
+                throw error;
+            // ENOENT is the normal case (no .gitignore at this level); anything else is not worth a warning per walk
+        }
+    }
+}
 class GitignoreManager {
     matchers = new Map();
+    /** Rules from directories above the walk root, farthest first; `prefix` re-bases a walk-relative path to that directory. */
+    ancestors = [];
     addMatcher(dir, matcher) {
         this.matchers.set(dir, matcher);
     }
+    addAncestorMatcher(prefix, matcher) {
+        this.ancestors.push({ prefix, matcher });
+    }
     /** `null` when no `.gitignore` was found, so callers skip the filter entirely. */
-    static async load(root, signal, maxDepth) {
+    static async load(root, signal, maxDepth, ignoreCeiling) {
         const manager = new GitignoreManager();
         try {
             const gitignorePaths = [];
@@ -76,13 +122,16 @@ class GitignoreManager {
                 gitignorePaths.push(match);
             }
             await loadGitignoreFiles(root, gitignorePaths, manager, signal);
+            if (ignoreCeiling !== undefined) {
+                await loadAncestorGitignores(root, ignoreCeiling, manager, signal);
+            }
         }
         catch (error) {
             if (error instanceof Error && error.name === 'AbortError')
                 throw error;
             Logger.warn(`Failed to enumerate .gitignore files under ${root}: ${formatUnknownErrorMessage(error)}`);
         }
-        return manager.matchers.size === 0 ? null : manager;
+        return manager.matchers.size === 0 && manager.ancestors.length === 0 ? null : manager;
     }
     isIgnored(relativePath, isDirectory) {
         const normalized = toPosixPath(relativePath);
@@ -111,6 +160,13 @@ class GitignoreManager {
                 : `${posixPath}/`
             : posixPath;
         let ignored = false;
+        for (const { prefix, matcher } of this.ancestors) {
+            const res = matcher.test(`${prefix}/${pathToCheck}`);
+            if (res.ignored)
+                ignored = true;
+            if (res.unignored)
+                ignored = false;
+        }
         // Check root level
         const rootMatcher = this.matchers.get('');
         if (rootMatcher) {
@@ -308,7 +364,7 @@ async function* processGlobPattern(pattern, plan, seen, onlyFiles, filter) {
 }
 export async function* globEntries(options) {
     const gitignoreMatcher = options.skipIgnored
-        ? await GitignoreManager.load(options.cwd, options.signal, options.maxDepth)
+        ? await GitignoreManager.load(options.cwd, options.signal, options.maxDepth, options.ignoreCeiling)
         : null;
     const plan = normalizeGlobOptions(options);
     const seen = new Set();