@openclaw/fs-safe 0.6.0 → 0.7.1

package/dist/archive-tar-meta.d.ts

@@ -1,6 +1,34 @@
+import { Transform } from "node:stream";
+import { type TarMeterLimits } from "./archive-limits.js";
+import type { TarEntryInfo } from "./archive-tar.js";
+export declare class TarMetadataMeter extends Transform {
+    private readonly limits;
+    private readonly onMember?;
+    private readonly block;
+    private blockLength;
+    private state;
+    private pendingPax;
+    private readonly pendingGnu;
+    private pendingGnuPath;
+    private zeroBlocks;
+    private entries;
+    private remainingDecodedBytes;
+    private manifestBytes;
+    constructor(limits: TarMeterLimits, onMember?: ((entry: TarEntryInfo) => void) | undefined);
+    private countMember;
+    private invalid;
+    private paddedSize;
+    private parseSize;
+    private finishHeader;
+    private finishSparseHeader;
+    private meter;
+    _transform(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null, data?: Buffer) => void): void;
+    _flush(callback: (error?: Error | null) => void): void;
+}
 export declare function preflightTarMetadata(params: {
     archivePath: string;
-    maxMetaEntryBytes: number;
+    limits: TarMeterLimits;
     signal?: AbortSignal;
+    onMember?: (entry: TarEntryInfo) => void;
 }): Promise<void>;
 //# sourceMappingURL=archive-tar-meta.d.ts.map

package/dist/archive-tar-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar-meta.d.ts","sourceRoot":"","sources":["../src/archive-tar-meta.ts"],"names":[],"mappings":"AA8LA,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"archive-tar-meta.d.ts","sourceRoot":"","sources":["../src/archive-tar-meta.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAY,MAAM,aAAa,CAAC;AAIlD,OAAO,EAAqE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI7H,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAWrD,qBAAa,gBAAiB,SAAQ,SAAS;IAYjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAkB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAX/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,aAAa,CAAK;IAE1B,YAA6B,MAAM,EAAE,cAAc,EAAmB,QAAQ,CAAC,GAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,aAAA,EAM7G;IAED,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,YAAY;IA6EpB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,KAAK;IAyCJ,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAc3H;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAM9D;CACF;AAaD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}

package/dist/archive-tar-meta.js

@@ -3,22 +3,49 @@ import { Transform, Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError } from "./archive-limits.js";
+import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, tarManifestEntryCost } from "./archive-limits.js";
 import { parseLocalPax, paxMemberSize } from "./archive-tar-pax.js";
-class TarMetadataMeter extends Transform {
-    maxMetaEntryBytes;
+import { validateGnuMetadata } from "./archive-tar-gnu.js";
+import { rawTarMember } from "./archive-tar-admission.js";
+import { validateTarHeader } from "./archive-tar-header.js";
+// Keep raw framing aligned with native/src/tar_meter.rs, before either parser.
+export class TarMetadataMeter extends Transform {
+    limits;
+    onMember;
     block = Buffer.alloc(512);
     blockLength = 0;
     state = { kind: "header" };
     pendingPax;
-    pendingGnu = false;
-    constructor(maxMetaEntryBytes) {
+    pendingGnu = new Set();
+    pendingGnuPath;
+    zeroBlocks = 0;
+    entries = 0;
+    remainingDecodedBytes;
+    manifestBytes = 0;
+    constructor(limits, onMember) {
         super();
-        this.maxMetaEntryBytes = maxMetaEntryBytes;
+        this.limits = limits;
+        this.onMember = onMember;
+        if (!Number.isSafeInteger(limits.maxDecodedBytes) || limits.maxDecodedBytes < 0) {
+            throw new RangeError("maxDecodedBytes must be a non-negative safe integer");
+        }
+        this.remainingDecodedBytes = limits.maxDecodedBytes;
+    }
+    countMember() {
+        if (this.entries >= this.limits.maxEntries) {
+            throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_COUNT_EXCEEDS_LIMIT);
+        }
+        this.entries += 1;
     }
     invalid(message) {
         return new ArchiveFormatError(`invalid TAR header: ${message}`);
     }
+    paddedSize(size) {
+        const padded = Math.ceil(size / 512) * 512;
+        if (!Number.isSafeInteger(padded))
+            throw this.invalid("entry padding exceeds the safe integer range");
+        return padded;
+    }
     parseSize() {
         const field = this.block.subarray(124, 136);
         if ((field[0] ?? 0) & 0x80) {
@@ -35,10 +62,13 @@ class TarMetadataMeter extends Transform {
             return Number(value);
         }
         const zero = field.indexOf(0);
+        if (zero >= 0 && field.subarray(zero).some((byte) => byte !== 0 && byte !== 0x20)) {
+            throw this.invalid("size has non-padding bytes after NUL");
+        }
         const bytes = field.subarray(0, zero < 0 ? field.length : zero);
         if (bytes.some((byte) => byte > 0x7f))
             throw this.invalid("size is not ASCII octal");
-        const text = bytes.toString("ascii").trim();
+        const text = bytes.toString("ascii").replace(/^ +| +$/g, "");
         if (!text || !/^[0-7]+$/.test(text))
             throw this.invalid("size is not valid octal");
         const value = Number.parseInt(text, 8);
@@ -50,54 +80,56 @@ class TarMetadataMeter extends Transform {
         if (this.block.every((byte) => byte === 0)) {
             if (this.pendingPax)
                 throw this.invalid("dangling PAX metadata");
-            this.pendingGnu = false;
+            if (this.pendingGnu.size)
+                throw this.invalid("dangling GNU metadata");
             this.blockLength = 0;
-            this.state = { kind: "header" };
+            this.zeroBlocks += 1;
+            this.state = { kind: this.zeroBlocks === 2 ? "eof" : "header" };
             return;
         }
+        if (this.zeroBlocks !== 0)
+            throw this.invalid("nonzero header after one TAR zero block");
+        validateTarHeader(this.block);
         const nameEnd = this.block.subarray(0, 100).indexOf(0);
         const name = this.block.subarray(0, nameEnd < 0 ? 100 : nameEnd);
         if (name.length === 0) {
             throw this.invalid("entry path is empty");
         }
-        if (this.block[156] !== 0x35 && name.at(-1) === 0x2f) {
+        if (![0x35, 0x44].includes(this.block[156]) && name.at(-1) === 0x2f) {
             throw this.invalid("non-directory entry path ends with a separator");
         }
         let size = this.parseSize();
+        let padded = this.paddedSize(size);
         const type = this.block[156];
-        if ([0x78, 0x67, 0x4c, 0x4b, 0x58, 0x4e].includes(type) && size > this.maxMetaEntryBytes) {
+        // Directory/link headers cannot carry bodies; PAX/GNU metadata can.
+        if ([0x31, 0x32, 0x35].includes(type) && size !== 0) {
+            throw this.invalid("directory or link has a nonzero body size");
+        }
+        if ([0x78, 0x67, 0x4c, 0x4b, 0x58, 0x4e].includes(type) && size > this.limits.maxMetaEntryBytes) {
             throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.META_ENTRY_SIZE_EXCEEDS_LIMIT);
         }
         if (type === 0x67 || type === 0x58 || type === 0x4e) {
             throw this.invalid("global/old PAX and old GNU metadata are not supported");
         }
-        if (type === 0x78) {
-            if (this.pendingPax || this.pendingGnu || size === 0)
-                throw this.invalid("empty, repeated or mixed PAX metadata");
+        if (type === 0x78 || type === 0x4c || type === 0x4b) {
+            const metadataType = type === 0x78 ? "pax" : type === 0x4c ? "L" : "K";
+            if (this.pendingPax || size === 0 || (metadataType === "pax" ? this.pendingGnu.size : this.pendingGnu.has(metadataType))) {
+                throw this.invalid("empty, repeated or mixed PAX/GNU metadata");
+            }
             const magic = this.block.subarray(257, 265).toString("latin1");
             if (magic !== "ustar\0" + "00" && magic !== "ustar  \0")
-                throw this.invalid("unrecognized PAX header format");
-            const padded = Math.ceil(size / 512) * 512;
-            if (!Number.isSafeInteger(padded))
-                throw this.invalid("entry padding exceeds the safe integer range");
-            this.state = { kind: "pax", body: Buffer.alloc(size), used: 0, padding: padded - size };
+                throw this.invalid("unrecognized PAX/GNU header format");
+            if (metadataType !== "pax")
+                this.pendingGnu.add(metadataType);
+            this.state = { kind: "metadata", type: metadataType, body: Buffer.alloc(size), used: 0, padding: padded - size };
             this.blockLength = 0;
             return;
         }
         // Sparse headers retain their metadata-limit-before-format-error ordering.
         if (this.pendingPax && type !== 0x53) {
             size = paxMemberSize(this.pendingPax, type, size, this.block);
-            this.pendingPax = undefined;
-        }
-        if (type === 0x4c || type === 0x4b) {
-            this.pendingGnu = true;
         }
-        else {
-            this.pendingGnu = false;
-        }
-        const padded = Math.ceil(size / 512) * 512;
-        if (!Number.isSafeInteger(padded))
-            throw this.invalid("entry padding exceeds the safe integer range");
+        padded = this.paddedSize(size);
         if (type === 0x53) {
             if (this.block[482] !== 0 && this.block[482] !== 1) {
                 throw this.invalid("GNU sparse extension flag is not 0 or 1");
@@ -108,13 +140,27 @@ class TarMetadataMeter extends Transform {
             this.state = { kind: "sparse", dataRemaining: padded, metaBytes: 0 };
         }
         else {
+            this.countMember();
+            if (this.pendingGnuPath && /[\\/]$/.test(this.pendingGnuPath) && ![0x35, 0x44].includes(type)) {
+                throw this.invalid("GNU effective non-directory path ends with a separator");
+            }
+            const entry = rawTarMember(this.block, size, this.pendingPax?.path ?? this.pendingGnuPath);
+            const cost = tarManifestEntryCost(entry.path);
+            if (cost > this.limits.maxManifestBytes - this.manifestBytes) {
+                throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.MANIFEST_SIZE_EXCEEDS_LIMIT);
+            }
+            this.manifestBytes += cost;
+            this.onMember?.(entry);
+            this.pendingPax = undefined;
+            this.pendingGnu.clear();
+            this.pendingGnuPath = undefined;
             this.state = padded === 0 ? { kind: "header" } : { kind: "data", remaining: padded };
         }
         this.blockLength = 0;
     }
     finishSparseHeader(state) {
         const metaBytes = state.metaBytes + 512;
-        if (metaBytes > this.maxMetaEntryBytes) {
+        if (metaBytes > this.limits.maxMetaEntryBytes) {
             throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.META_ENTRY_SIZE_EXCEEDS_LIMIT);
         }
         if (this.block[504] !== 0 && this.block[504] !== 1) {
@@ -131,14 +177,25 @@ class TarMetadataMeter extends Transform {
     meter(chunk) {
         let offset = 0;
         while (offset < chunk.length) {
-            if (this.state.kind === "pax") {
+            if (this.state.kind === "eof") {
+                if (chunk.subarray(offset).some((byte) => byte !== 0))
+                    throw this.invalid("nonzero data after TAR EOF");
+                return;
+            }
+            if (this.state.kind === "metadata") {
                 const state = this.state;
                 const take = Math.min(state.body.length - state.used, chunk.length - offset);
                 chunk.copy(state.body, state.used, offset, offset + take);
                 state.used += take;
                 offset += take;
                 if (state.used === state.body.length) {
-                    this.pendingPax = parseLocalPax(state.body);
+                    if (state.type === "pax")
+                        this.pendingPax = parseLocalPax(state.body);
+                    else {
+                        const name = validateGnuMetadata(state.body, state.type);
+                        if (state.type === "L")
+                            this.pendingGnuPath = name;
+                    }
                     this.state = state.padding === 0 ? { kind: "header" } : { kind: "data", remaining: state.padding };
                 }
                 continue;
@@ -164,7 +221,15 @@ class TarMetadataMeter extends Transform {
     }
     _transform(chunk, _encoding, callback) {
         try {
-            this.meter(chunk);
+            const admitted = Math.min(chunk.length, this.remainingDecodedBytes);
+            this.meter(chunk.subarray(0, admitted));
+            this.remainingDecodedBytes -= admitted;
+            if (admitted < chunk.length) {
+                // Inspect only the overflow probe, never scan an unbounded tail.
+                if (this.state.kind === "eof" && chunk[admitted] !== 0)
+                    throw this.invalid("nonzero data after TAR EOF");
+                throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.DECODED_SIZE_EXCEEDS_LIMIT);
+            }
             callback(null, chunk);
         }
         catch (error) {
@@ -174,8 +239,12 @@ class TarMetadataMeter extends Transform {
     _flush(callback) {
         if (this.pendingPax)
             callback(this.invalid("dangling PAX metadata"));
-        else if (this.state.kind === "header" && this.blockLength === 0)
+        else if (this.pendingGnu.size)
+            callback(this.invalid("dangling GNU metadata"));
+        else if (this.state.kind === "eof")
             callback();
+        else if (this.state.kind === "header" && this.blockLength === 0)
+            callback(this.invalid("missing two-block TAR EOF"));
         else
             callback(this.invalid(this.state.kind === "header" ? "truncated TAR header" : "truncated TAR entry"));
     }
@@ -193,7 +262,7 @@ async function isGzip(filePath) {
 }
 export async function preflightTarMetadata(params) {
     const input = fs.createReadStream(params.archivePath);
-    const meter = new TarMetadataMeter(params.maxMetaEntryBytes);
+    const meter = new TarMetadataMeter(params.limits, params.onMember);
     const sink = new Writable({ write(_chunk, _encoding, callback) { callback(); } });
     if (await isGzip(params.archivePath)) {
         await pipeline(input, createGunzip(), meter, sink, { signal: params.signal });

package/dist/archive-tar-runtime.d.ts

@@ -12,6 +12,7 @@ export type TarParser = NodeJS.WritableStream & {
     on(event: "error", listener: (error: Error) => void): TarParser;
     on(event: "end", listener: () => void): TarParser;
 };
+export declare const NODE_TAR_RATIO_DISABLED: number;
 export type TarModule = {
     Parser: new (options: {
         strict: true;
@@ -28,6 +29,7 @@ export type TarModule = {
         noMtime: true;
         strict: true;
         maxMetaEntrySize: number;
+        maxDecompressionRatio: number;
         filter?(this: TarParser, entryPath: string, entry: unknown): boolean;
         onReadEntry(this: unknown, entry: unknown): void;
     }): TarParser;
@@ -35,6 +37,7 @@ export type TarModule = {
         file: string;
         strict: true;
         maxMetaEntrySize: number;
+        maxDecompressionRatio: number;
         onReadEntry(entry: AsyncIterable<unknown> & {
             resume(): void;
         }): void;

package/dist/archive-tar-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar-runtime.d.ts","sourceRoot":"","sources":["../src/archive-tar-runtime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,GAAG;IAC9C,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IAChF,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACnE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,SAAS,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,KAAK,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,CAAC;IAC/E,CAAC,CAAC,OAAO,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QACrE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;KAClD,GAAG,SAAS,CAAC;IACd,CAAC,CAAC,OAAO,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;KACvE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC;AAEF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAS5D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS/D"}
+{"version":3,"file":"archive-tar-runtime.d.ts","sourceRoot":"","sources":["../src/archive-tar-runtime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,GAAG;IAC9C,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IAChF,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,SAAS,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACnE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,SAAS,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC;CACnD,CAAC;AAIF,eAAO,MAAM,uBAAuB,QAA2B,CAAC;AAEhE,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,KAAK,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,CAAC;IAC/E,CAAC,CAAC,OAAO,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,aAAa,EAAE,KAAK,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC;QACd,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QACrE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;KAClD,GAAG,SAAS,CAAC;IACd,CAAC,CAAC,OAAO,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,IAAI,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;KACvE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC;AAEF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAS5D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS/D"}

package/dist/archive-tar-runtime.js

@@ -1,4 +1,7 @@
 import { ArchiveFormatError } from "./archive-errors.js";
+// Both callers parse an immutable staged stream only after fs-safe's complete
+// decoded-byte admission, so node-tar must not add backend-specific policy.
+export const NODE_TAR_RATIO_DISABLED = Number.POSITIVE_INFINITY;
 export async function importOptionalTar() {
     try {
         return await import("tar");

package/dist/archive-tar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-tar.d.ts","sourceRoot":"","sources":["../src/archive-tar.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAI7B,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAyB7D;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAgDnC"}
+{"version":3,"file":"archive-tar.d.ts","sourceRoot":"","sources":["../src/archive-tar.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAI7B,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAyB7D;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAqDnC"}

package/dist/archive-tar.js

@@ -43,7 +43,10 @@ export function createTarEntryPreflightChecker(params) {
         entryCount += 1;
         assertArchiveEntryCountWithinLimit(entryCount, limits);
         validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
-        const relPath = stripArchivePath(entry.path, strip);
+        const canonicalPath = stripArchivePath(entry.path, 0);
+        if (!canonicalPath)
+            return false;
+        const relPath = stripArchivePath(canonicalPath, strip);
         if (!relPath) {
             return false;
         }
@@ -60,13 +63,16 @@ export function createTarEntryPreflightChecker(params) {
         if (!shouldExtractArchiveEntry({
             filter: params.entryFilter,
             onFiltered: params.onFiltered,
-            entry: { path: entry.path, kind, size: entry.size },
+            entry: { path: canonicalPath, kind, size: entry.size },
         })) {
             return false;
         }
         if (BLOCKED_TAR_ENTRY_TYPES.has(entry.type)) {
             throw new ArchiveSecurityError("entry-link", `tar entry is a link: ${formatErrorDetail(entry.path)}`);
         }
+        // Accepted unsupported records remain omitted, as in the native plan.
+        if (kind === "other")
+            return false;
         budget.startEntry();
         budget.addEntrySize(entry.size);
         return true;

package/dist/archive-zip-names.js

@@ -1,5 +1,5 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
-import { validateArchiveEntryPath } from "./archive-entry.js";
+import { stripArchivePath, validateArchiveEntryPath } from "./archive-entry.js";
 import { updateCrc32 } from "./archive-crc32.js";
 export function zipFormat(message) {
     throw new ArchiveFormatError(`invalid ZIP metadata: ${message}`);
@@ -40,7 +40,7 @@ function utf8(bytes) {
     }
 }
 function key(name) {
-    return name.replaceAll("\\", "/").split("/").filter((part) => part && part !== ".").join("/");
+    return stripArchivePath(name, 0) ?? "";
 }
 function originalName(name, flags) {
     // ASCII path syntax is encoding-independent. Do not reinterpret legacy bytes

package/dist/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,8BAA8B,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AAoNpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwKjF"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AA+DA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,8BAA8B,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AAyNpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6KjF"}

package/dist/archive.js

@@ -5,7 +5,7 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createArchiveOutputPathTracker, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { createPipelineTimeoutError, waitForDeadline, withExtractionDeadline, } from "./archive-deadline.js";
-import { assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, } from "./archive-limits.js";
+import { assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, resolveTarMeterLimits, } from "./archive-limits.js";
 import { resolveArchiveKind } from "./archive-kind.js";
 import { mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
 import { createTarEntryPreflightChecker, readTarEntryInfo, } from "./archive-tar.js";
@@ -17,9 +17,10 @@ import { ArchiveSecurityError } from "./archive-errors.js";
 import { extractNativeArchive } from "./archive-native.js";
 import { stageArchiveFileForExtraction } from "./archive-input.js";
 import { getNativeBinding } from "./native.js";
-import { resolveArchiveEntryMode, shouldExtractArchiveEntry, } from "./archive-policy.js";
-import { importOptionalTar, normalizeTarParserError } from "./archive-tar-runtime.js";
+import { resolveArchiveEntryMode, resolveArchiveFilteredEntryPolicy, shouldExtractArchiveEntry, } from "./archive-policy.js";
+import { importOptionalTar, NODE_TAR_RATIO_DISABLED, normalizeTarParserError } from "./archive-tar-runtime.js";
 import { preflightTarMetadata } from "./archive-tar-meta.js";
+import { createTarAdmissionPlan } from "./archive-tar-admission.js";
 import { writeSiblingTempFile } from "./sibling-temp.js";
 export { isWindowsDrivePath, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 export { resolveArchiveKind, resolvePackedRootDir } from "./archive-kind.js";
@@ -45,12 +46,16 @@ async function readZipEntryStream(entry) {
 }
 function resolveZipOutputPath(params) {
     validateArchiveEntryPath(params.entryPath);
-    const relPath = stripArchivePath(params.entryPath, params.strip);
+    const canonicalPath = stripArchivePath(params.entryPath, 0);
+    if (!canonicalPath)
+        return null;
+    const relPath = stripArchivePath(canonicalPath, params.strip);
     if (!relPath) {
         return null;
     }
     validateArchiveEntryPath(relPath);
     return {
+        canonicalPath,
         relPath,
         outPath: resolveArchiveOutputPath({
             rootDir: params.destinationDir,
@@ -72,7 +77,6 @@ async function writeZipFileEntry(params) {
     try {
         await writeSiblingTempFile({
             dir: path.dirname(destinationPath),
-            tempPrefix: `.${path.basename(destinationPath)}.fs-safe-archive`,
             chmodDir: false,
             mode: params.mode,
             writeTemp: async (tempPath) => {
@@ -151,7 +155,7 @@ async function extractZip(params) {
                     if (!shouldExtractArchiveEntry({
                         filter: params.entryFilter,
                         onFiltered: params.onFiltered,
-                        entry: { path: entry.name, kind: entryKind, size: entrySize },
+                        entry: { path: output.canonicalPath, kind: entryKind, size: entrySize },
                     })) {
                         continue;
                     }
@@ -166,6 +170,7 @@ async function extractZip(params) {
                         outPath: output.outPath,
                         originalPath: entry.name,
                         isDirectory: entry.dir,
+                        deadline: params.deadline,
                     });
                     if (entry.dir) {
                         await fs.chmod(output.outPath, mode);
@@ -184,6 +189,7 @@ async function extractZip(params) {
                     sourceDir: stagingRealDir,
                     destinationDir: params.destDir,
                     destinationRealDir,
+                    deadline: params.deadline,
                 });
                 params.deadline.check();
             },
@@ -194,11 +200,14 @@ async function extractZip(params) {
     }
 }
 export async function extractArchive(params) {
+    const onFiltered = resolveArchiveFilteredEntryPolicy(params.onFiltered);
     const kind = params.kind ?? resolveArchiveKind(params.archivePath);
     if (!kind) {
         throw new Error(`unsupported archive: ${params.archivePath}`);
     }
     const label = kind === "zip" ? "extract zip" : "extract tar";
+    const limits = resolveExtractLimits(params.limits);
+    const tarLimits = resolveTarMeterLimits(limits);
     const native = getNativeBinding();
     if (native) {
         await withExtractionDeadline(params.timeoutMs, label, async (deadline) => extractNativeArchive({
@@ -207,11 +216,12 @@ export async function extractArchive(params) {
             destDir: params.destDir,
             kind,
             stripComponents: params.stripComponents,
-            limits: params.limits,
+            limits,
+            tarLimits,
             deadline,
             entryModes: params.entryModes,
             entryFilter: params.entryFilter,
-            onFiltered: params.onFiltered,
+            onFiltered,
         }));
         return;
     }
@@ -222,17 +232,18 @@ export async function extractArchive(params) {
     if (kind === "tar") {
         await withExtractionDeadline(params.timeoutMs, label, async (deadline) => {
             const tar = await importOptionalTar();
-            const limits = resolveExtractLimits(params.limits);
             const stagedArchive = await stageArchiveFileForExtraction({
                 archivePath: params.archivePath,
                 limits,
                 deadline,
             });
             try {
+                const manifest = [];
                 await preflightTarMetadata({
                     archivePath: stagedArchive.path,
-                    maxMetaEntryBytes: limits.maxMetaEntryBytes,
+                    limits: tarLimits,
                     signal: deadline.signal,
+                    onMember: (entry) => { manifest.push(entry); },
                 });
                 deadline.check();
                 const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
@@ -246,13 +257,14 @@ export async function extractArchive(params) {
                             stripComponents: params.stripComponents,
                             limits,
                             entryFilter: params.entryFilter,
-                            onFiltered: params.onFiltered,
+                            onFiltered,
                         });
+                        const admission = createTarAdmissionPlan(manifest, (entry) => {
+                            deadline.check();
+                            return checkTarEntrySafety(entry);
+                        }, strip);
                         const acceptedEntries = [];
-                        // A canonical cwd is not enough here: tar can still follow
-                        // pre-existing child symlinks in the live destination tree.
-                        // Extract into a private staging dir first, then merge through
-                        // the same safe-open boundary checks used by direct file writes.
+                        // Extract privately, then merge through the safe-open boundary.
                         const extractor = tar.x({
                             cwd: stagingDir,
                             // fs-safe owns stripping: node-tar counts the `.` and empty path
@@ -265,20 +277,16 @@ export async function extractArchive(params) {
                             preserveOwner: false,
                             noMtime: true,
                             strict: true,
-                            maxMetaEntrySize: limits.maxMetaEntryBytes,
+                            maxMetaEntrySize: tarLimits.maxMetaEntryBytes,
+                            maxDecompressionRatio: NODE_TAR_RATIO_DISABLED,
                             filter(_entryPath, entry) {
                                 try {
                                     const info = readTarEntryInfo(entry);
-                                    if (!checkTarEntrySafety(info)) {
-                                        return false;
-                                    }
-                                    const relPath = stripArchivePath(info.path, strip);
+                                    const relPath = admission.consume(info);
                                     if (!relPath) {
                                         return false;
                                     }
-                                    // Hand node-tar the exact path this entry was validated,
-                                    // limited and collision-checked under, and that the mode
-                                    // pass below resolves after extraction.
+                                    // Writes and the mode pass use the admitted output identity.
                                     entry.path = relPath;
                                     acceptedEntries.push({
                                         path: relPath,
@@ -306,8 +314,7 @@ export async function extractArchive(params) {
                                 }
                                 catch (err) {
                                     const error = err instanceof Error ? err : new Error(String(err));
-                                    // Node's EventEmitter calls listeners with `this` bound to the
-                                    // emitter (tar.Unpack), which exposes Parser.abort().
+                                    // EventEmitter binds `this` to tar.Unpack, exposing abort().
                                     const emitter = this;
                                     emitter.abort?.(error);
                                 }
@@ -321,19 +328,23 @@ export async function extractArchive(params) {
                         catch (error) {
                             throw normalizeTarParserError(createPipelineTimeoutError(error, deadline));
                         }
+                        admission.finish();
                         for (const accepted of acceptedEntries) {
+                            deadline.check();
                             const outputPath = resolveArchiveOutputPath({
                                 rootDir: stagingDir,
                                 relPath: accepted.path,
                                 originalPath: accepted.path,
                             });
                             await fs.chmod(outputPath, accepted.mode);
+                            deadline.check();
                         }
                         deadline.check();
                         await mergeExtractedTreeIntoDestination({
                             sourceDir: stagingDir,
                             destinationDir: params.destDir,
                             destinationRealDir,
+                            deadline,
                         });
                         deadline.check();
                     },
@@ -349,10 +360,10 @@ export async function extractArchive(params) {
         archivePath: params.archivePath,
         destDir: params.destDir,
         stripComponents: params.stripComponents,
-        limits: params.limits,
+        limits,
         deadline,
         entryModes: params.entryModes,
         entryFilter: params.entryFilter,
-        onFiltered: params.onFiltered,
+        onFiltered,
     }));
 }

package/dist/atomic.d.ts

@@ -1,4 +1,4 @@
-export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicRestoreCleanup, type ReplaceFileAtomicRestoreFailureDetails, type ReplaceFileAtomicResult, type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
+export { replaceFileAtomic, replaceFileAtomicSync, type RenameIdentityPolicy, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicRestoreCleanup, type ReplaceFileAtomicRestoreFailureDetails, type ReplaceFileAtomicResult, type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
 export { writeTextAtomic, type WriteTextAtomicOptions } from "./text-atomic.js";
 export { replaceDirectoryAtomic, type ReplaceDirectoryAtomicOptions } from "./replace-directory.js";
 export { movePathWithCopyFallback, type MovePathWithCopyFallbackOptions } from "./move-path.js";

package/dist/atomic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomic.d.ts","sourceRoot":"","sources":["../src/atomic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,sCAAsC,EAC3C,KAAK,uBAAuB,EAC5B,KAAK,oCAAoC,EACzC,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,GAClC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"atomic.d.ts","sourceRoot":"","sources":["../src/atomic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,sCAAsC,EAC3C,KAAK,uBAAuB,EAC5B,KAAK,oCAAoC,EACzC,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,GAClC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/bounded-read-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,aAAa,CAAC;AAGlD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAwBnE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,MAAM,EAAE;QAAE,gBAAgB,IAAI,MAAM,CAAC,cAAc,CAAA;KAAE,CAAA;CAAE,EACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAAC,cAAc,CAWvB"}
+{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,aAAa,CAAC;AAIlD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAmBnE;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,MAAM,EAAE;QAAE,gBAAgB,IAAI,MAAM,CAAC,cAAc,CAAA;KAAE,CAAA;CAAE,EACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAAC,cAAc,CAWvB"}

package/dist/bounded-read-stream.js

@@ -1,10 +1,8 @@
 import { pipeline, Transform } from "node:stream";
+import { normalizeMaxBytes } from "./byte-budget.js";
 import { FsSafeError } from "./errors.js";
 export function createMaxBytesTransform(maxBytes) {
-    if (maxBytes !== Number.POSITIVE_INFINITY &&
-        (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) {
-        throw new RangeError("maxBytes must be a non-negative safe integer or Infinity");
-    }
+    normalizeMaxBytes(maxBytes);
     let bytes = 0;
     return new Transform({
         transform(chunk, _encoding, callback) {