@openclaw/fs-safe 0.8.1 → 0.8.3

package/docs/contributing.md

@@ -19,7 +19,16 @@ manager version declared in `package.json`.
 pnpm build
 ```
 
-Runs `tsc -p tsconfig.json`. Output lands in `dist/`. The package's `prepack` hook re-runs the build before publishing — manual `pnpm build` is only required when you want to inspect the output or run a freshly-built copy locally.
+Runs TypeScript compilation and builds the portable Rust TAR parser for
+`wasm32-unknown-unknown`. Contributors need Rust (the native crate's declared
+minimum or newer) and `rustup target add wasm32-unknown-unknown`; Alpine's
+packaged toolchain uses `rust-wasm`. `pnpm archive:wasm` rebuilds just the parser.
+The import-free asset lands at `dist/archive-parser.wasm`; source tests and
+compiled consumers both resolve that generated artifact. Run `pnpm build`
+before source tests in a fresh checkout. Do not commit `dist/` or built WASM.
+Consumers receive the asset in the npm package and need no compiler.
+
+Output lands in `dist/`. The package's `prepack` hook re-runs the build before publishing — manual `pnpm build` is only required when you want to inspect the output or run a freshly-built copy locally.
 
 ## Test
 
@@ -59,8 +68,33 @@ pnpm check
 This runs the filesystem boundary checks, build, tests, and package
 tarball/import validation.
 
+### Real TAR producers
+
+After installing the freshly packed root (and optionally its freshly built host
+binding) in a disposable consumer, run:
+
+```bash
+pnpm archive:producer-smoke ./consumer off
+pnpm archive:producer-smoke ./consumer require
+```
+
+This uses a child bound to canonical cwd/device/inode running `/usr/bin/tar -czf - .`
+with unchanged stdout, and npm tar, on synthetic Unicode/newline/long-name files,
+then the installed package API for exact payload hashes and bounded reads.
+It also rejects a valid PAX override attached to an invalid raw UTF-8 field.
+The `require` command must resolve the freshly packed native binding; the
+`off` command uses the installed WASM asset. No live user files are read.
+
 ### Native consumer installs
 
+The CI Node 24 and native jobs also run `node scripts/device-path-proof.mjs off`
+and `node scripts/device-path-proof.mjs require` against the built package.
+This extracts real ZIP files and checks bounded member reads, preserving reserved
+device-like names on POSIX while rejecting them and ignored-space aliases on
+Windows. It also verifies ordinary secret reads and typed device-path rejection
+without replacing filesystem functions. Run after `pnpm build`, and build the
+host binding with `pnpm native:build` before the `require` case.
+
 After `pnpm build` and a fresh `pnpm native:build`, run `pnpm package:smoke`.
 It packs the real root and host binding, then runs root-only npm and the
 declared pnpm version against a disposable loopback registry. The root's exact

package/docs/install.md

@@ -85,7 +85,7 @@ Use the main entry for the common surface, or the focused subpaths when you want
 
 ## Runtime dependencies
 
-`@openclaw/fs-safe` lists `jszip` and `tar` as optional dependencies for JavaScript ZIP/TAR [archive extraction](archive.md). They are loaded lazily; the JavaScript archive fallback requires the corresponding codec and reports a missing-optional-dependency error without it. Public subpaths remain safe to import with all optional dependencies omitted, but imports do not prove native availability.
+`@openclaw/fs-safe` bundles an import-free WASM build of its Rust TAR parser for guarded JavaScript TAR/gzip [archive extraction](archive.md), including installs with optional dependencies omitted. ZIP fallback uses lazily loaded optional `jszip` and reports a missing-dependency error without it. Public subpaths remain safe to import with all optional dependencies omitted, but imports do not prove native availability.
 
 There are no peer dependencies. Exact-version optional packages carry the seven
 native targets and npm-compatible OS, CPU, and Linux libc filters install only

package/docs/native-helper.md

@@ -29,6 +29,11 @@ The equivalent environment variables are `FS_SAFE_NATIVE_MODE` and `OPENCLAW_FS_
 | `off` | Do not load a native package. Use the guarded JavaScript path deterministically. |
 | `require` | Throw `FsSafeError("helper-unavailable")` instead of falling back when an operation needs the native binding and it cannot load. |
 
+TAR/gzip in the guarded JavaScript path uses a bundled, import-free WASM build
+of the same Rust parser used by native. `off` still disables native filesystem
+code; it does not disable this portable parser. ZIP fallback still requires
+optional `jszip`, and zstd/bzip2 remain native-only.
+
 Configure the mode once during startup. Loading is lazy and cached; changing from `auto` to `require` after a failed load changes failure policy but does not repeatedly probe the binary.
 
 [`tempWorkspace()` and its scoped/sync variants](temp.md#private-temp-workspaces)

package/docs/native.md

@@ -64,13 +64,15 @@ returns a bounded manifest. TypeScript applies the shared path, filter, strip,
 mode, and byte policies and returns an index-bound extraction plan. Rust then
 creates only those planned entries beneath a private staging descriptor.
 
-A raw meter sits between decompression and the TAR crate, with matching
-TypeScript admission before node-tar. It parses 512-byte headers and bounded
-local PAX `x` metadata, using supported effective sizes to locate the following
-member body. GNU long-name/link `L`/`K` payloads remain
-supported. `maxMetaEntryBytes` bounds each metadata body before allocation;
-unsupported global/old metadata and sparse forms fail closed rather than being
-interpreted as ordinary members. See [bounded local PAX support](archive.md#bounded-local-pax-support).
+The `fs-safe-archive-core` Rust workspace crate owns TAR framing, paths, types,
+mode decoding, GNU metadata, and byte-counted local PAX records. The native
+binding and bundled WASM module compile the same source. No `tar::Archive` or
+Node TAR parser reinterprets admitted identities or sizes. Executors replay
+admitted payload ranges after complete bounded admission; native writes retain
+the platform's descriptor-relative primitives, while fallback writes retain
+the guarded Node staging/publication boundary. ZIP behavior is unchanged.
+`maxMetaEntryBytes` bounds bodies before allocation; unsupported global/old
+metadata and sparse forms fail closed. See [bounded local PAX support](archive.md#bounded-local-pax-support).
 
 Every raw pass receives only TypeScript's resolved `maxEntries`,
 `maxMetaEntryBytes`, and `maxDecodedBytes`. Shared resolution caps metadata and
@@ -88,11 +90,15 @@ integer maximum. Every native pass receives that same cap and charges headers,
 metadata, bodies, padding, EOF blocks, and trailing zeros. It rejects overflow
 with `archive-decoded-size-exceeds-limit`; no ratio policy is implied.
 Extraction and entry reads drain the metered reader through physical EOF after
-TAR iteration. Trailing framing or decoded-limit failures propagate before
+admitted-range replay. Trailing framing or decoded-limit failures propagate before
 directory modes are finalized, staging is published, or selected bytes return.
+Native gzip uses the existing flate2 member decoder with an explicit bounded
+member/padding transition; JavaScript retains Node gunzip and validates its
+unconsumed compressed suffix. Only all-zero physical padding after a complete
+validated trailer is accepted, still within the original archive-byte budget.
 Native reads stop at framing boundaries so a rejected header does not request
 its body from the decoder; codec buffering can still read ahead internally.
-Inspection finishes the complete bounded framing pass before parsing. Directory
+Inspection finishes the complete bounded framing pass before returning its manifest. Directory
 and link bodies, missing two-block EOF, and nonzero trailers reject on both
 backends, as detailed in [raw TAR framing](archive.md#raw-tar-framing). Raw and
 padded sizes above JavaScript's safe-integer maximum reject as invalid framing
@@ -155,7 +161,7 @@ remain TypeScript-owned. What changes is the syscall strength or availability:
 | Capability | Native path | Guarded JavaScript path |
 |---|---|---|
 | Root-relative opens/mutations | Descriptor-relative beneath operations. Pinned writes create parents and publish both replacement and no-replace targets relative to open directory descriptors. Linux reports `kernel-atomic`; macOS and Windows report `best-effort`. macOS uses `O_RESOLVE_BENEATH` when available plus an `F_GETPATH` detector, while Windows rejects reparse traversal in the object-manager call. | Reports `best-effort`: component-wise alias checks, no-follow opens where Node exposes them, private temp/rename, and post-operation identity verification. A same-privilege peer can replace a writable parent after a guard assertion but before Node resolves the pathname mutation; the mutation may land outside the intended root before the post-check detects it. |
-| ZIP/TAR/gzip | Rust streaming decode and fd-relative output creation. | JSZip/node-tar into a private stage, then the same guarded merge policy. |
+| ZIP/TAR/gzip | Rust streaming decode and fd-relative output creation. | Optional JSZip or bundled WASM TAR into guarded private staging, then the same guarded merge policy. |
 | Zstd/bzip2 TAR | Supported. | Unsupported; typed `helper-unavailable`. |
 | Publication copy | Clone, Linux `copy_file_range`, async native SHA-256. | Exclusive `wx` byte loop and Node SHA-256 with the same content/identity fences. |
 | `rename-noreplace` | Atomic platform no-replace rename. | Unsupported; no emulation by check-then-rename. |

package/docs/secret-file.md

@@ -91,6 +91,11 @@ credential must also fail on broad permissions or unexpected ownership.
 the same pinned-handle validation, byte cap, trimming, error codes, and strict
 versus missing-is-undefined naming semantics.
 
+Both readers reject known unsafe device and process-fd paths with `device-path`
+before inspection, and check the resolved target before opening it. This includes
+Windows reserved device names and ignored-space aliases such as `nul .txt`.
+Optional readers propagate this error instead of treating the secret as missing.
+
 Both sync and async readers compare lossless bigint identities from the preview,
 opened descriptor, resolved target, and current input path before reading. POSIX
 opens are nonblocking, so a raced FIFO is rejected by descriptor type instead of

package/docs/staged-file.md

@@ -66,8 +66,12 @@ Strings are UTF-8. `mode` is the requested **published** mode and defaults to
 `0600`; exact final modes, including `000`, are supported. The unpublished file
 stays at `0600` throughout preparation and any awaited application checks.
 After rename succeeds and the published entry passes identity validation, the
-owner applies the requested mode through its retained file descriptor and
-synchronizes the file. No parent is created or chmodded.
+owner applies the requested mode through its retained file descriptor. Content
+was synchronized during preparation; publication always synchronizes the parent.
+Modes retaining owner read/write skip the extra mode-only file sync, so a crash
+may leave the tighter staged `0600` instead of the wider requested mode. Modes
+removing owner read or write, and corrections of an observed wider staged mode,
+retain the post-chmod file sync. No parent is created or chmodded.
 Creation uses an exclusive, no-follow, close-on-exec open of a generated direct
 child name. Writes use that descriptor. Inspection uses non-following metadata
 operations, never a potentially blocking reopen of the leaf.

package/docs/writing.md

@@ -84,6 +84,11 @@ final verification uses a descriptor retained by the writer rather than reopenin
 the published file. The requested mode is not relaxed for verification.
 Publication verification compares exact bigint descriptor and pathname identities,
 including large file indexes that cannot be represented by a JavaScript number.
+Native publication syncs content before rename and always syncs the parent directory.
+Modes that retain owner read/write skip the extra mode-only file sync: after a
+crash, the file may retain staged mode `0o600` instead of the wider requested mode.
+Modes that remove owner read or write, and corrections of observed wider staging
+permissions, keep the post-chmod file sync.
 Later reads still obey OS permissions, and access checks on a pre-existing
 destination are unchanged. The explicit FUSE compatibility policy still requires
 a readable destination to prove matching content when rename changes its identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -24,6 +24,7 @@
     "provenance": true
   },
   "files": [
+    "dist/archive-parser.wasm",
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "dist/**/*.d.ts.map",
@@ -126,7 +127,7 @@
   "scripts": {
     "benchmark": "node scripts/benchmark.mjs",
     "benchmark:publish": "pnpm build && node scripts/bench-publish.mjs",
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "build": "node scripts/prepack-build.mjs",
     "lint:file-size": "node scripts/check-file-size.mjs",
     "lint:fs-boundary": "node scripts/check-fs-boundary-primitives.mjs",
     "prepack": "node scripts/prepack-build.mjs",
@@ -139,7 +140,7 @@
     "docs:check": "node scripts/check-doc-examples.mjs",
     "docs:site": "node scripts/build-docs-site.mjs",
     "native:build": "pnpm --filter @openclaw/fs-safe-native-build build",
-    "native:test": "cargo test --manifest-path native/Cargo.toml",
+    "native:test": "cargo test --workspace",
     "pack:check": "pnpm build && node scripts/check-pack.mjs",
     "public-api:update": "pnpm build && node scripts/check-pack.mjs --update-public-api",
     "package:collect": "node scripts/check-release-packages.mjs --output release-artifacts",
@@ -150,32 +151,34 @@
     "crabbox:hydrate": "crabbox actions hydrate",
     "crabbox:run": "crabbox run",
     "crabbox:stop": "crabbox stop",
-    "crabbox:warmup": "crabbox warmup"
+    "crabbox:warmup": "crabbox warmup",
+    "archive:wasm": "node scripts/build-archive-wasm.mjs",
+    "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.8.1",
-    "@openclaw/fs-safe-darwin-x64": "0.8.1",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.8.1",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.8.1",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.8.1",
-    "@openclaw/fs-safe-linux-x64-musl": "0.8.1",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.8.1",
-    "jszip": "^3.10.1",
-    "tar": "7.5.22"
+    "@openclaw/fs-safe-darwin-arm64": "0.8.3",
+    "@openclaw/fs-safe-darwin-x64": "0.8.3",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.8.3",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.8.3",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.8.3",
+    "@openclaw/fs-safe-linux-x64-musl": "0.8.3",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.8.3",
+    "jszip": "^3.10.1"
   },
   "devDependencies": {
     "@emnapi/runtime": "2.0.0-alpha.4",
-    "@napi-rs/cli": "3.8.6",
+    "@napi-rs/cli": "3.9.0",
     "@types/node": "^26.4.1",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "5.0.0",
     "fast-check": "^4.9.0",
     "istanbul-lib-coverage": "3.2.2",
     "istanbul-lib-report": "3.0.1",
     "istanbul-reports": "3.2.0",
     "sigstore": "5.0.0",
+    "tar": "7.5.22",
     "typescript": "^7.0.2",
     "vite": "8.2.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "engines": {
     "node": ">=22"

package/dist/archive-tar-admission.d.ts

@@ -1,7 +0,0 @@
-import type { TarEntryInfo } from "./archive-tar.js";
-export declare function rawTarMember(header: Buffer, size: number, effectivePath?: string): TarEntryInfo;
-export declare function createTarAdmissionPlan(manifest: readonly TarEntryInfo[], check: (entry: TarEntryInfo) => boolean, strip: number): {
-    consume(entry: TarEntryInfo): string | null;
-    finish(): void;
-};
-//# sourceMappingURL=archive-tar-admission.d.ts.map

package/dist/archive-tar-admission.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive-tar-admission.d.ts","sourceRoot":"","sources":["../src/archive-tar-admission.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAYrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,CAS/F;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,KAAK,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,EACvC,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,IAAI,IAAI,CAAA;CAAE,CAmBjE"}

package/dist/archive-tar-admission.js

@@ -1,43 +0,0 @@
-import { ArchiveFormatError } from "./archive-errors.js";
-import { stripArchivePath, validateArchiveEntryPath } from "./archive-entry.js";
-import { readTarHeaderPaths } from "./archive-tar-header.js";
-// node-tar's normalFsTypes/ReadEntry switch. All other non-metadata types
-// bypass both its filter and entry event; they still belong to our manifest.
-// Header.decode normalizes NUL to "0" before choosing the emitted File type.
-const visibleTypes = new Map([
-    [0, "File"], [0x30, "File"], [0x31, "Link"], [0x32, "SymbolicLink"],
-    [0x33, "CharacterDevice"], [0x34, "BlockDevice"], [0x35, "Directory"],
-    [0x36, "FIFO"], [0x37, "ContiguousFile"], [0x44, "GNUDumpDir"],
-]);
-export function rawTarMember(header, size, effectivePath) {
-    const { name, prefix } = readTarHeaderPaths(header);
-    validateArchiveEntryPath(name);
-    validateArchiveEntryPath(prefix);
-    const rawPath = prefix ? `${prefix}/${name}` : name;
-    validateArchiveEntryPath(rawPath);
-    const path = effectivePath ?? rawPath;
-    validateArchiveEntryPath(path);
-    return { path, size, type: visibleTypes.get(header[156]) ?? "Unsupported" };
-}
-export function createTarAdmissionPlan(manifest, check, strip) {
-    const visible = [];
-    for (const entry of manifest) {
-        const accepted = check(entry);
-        if (entry.type !== "Unsupported") {
-            visible.push({ entry, output: accepted ? stripArchivePath(entry.path, strip) : null });
-        }
-    }
-    let index = 0;
-    const mismatch = () => new ArchiveFormatError("invalid TAR header: parser disagrees with raw admission");
-    return {
-        consume(actual) {
-            const expected = visible[index++];
-            if (!expected || expected.entry.type !== actual.type || expected.entry.size !== actual.size ||
-                stripArchivePath(expected.entry.path, 0) !== stripArchivePath(actual.path, 0))
-                throw mismatch();
-            return expected.output;
-        },
-        finish() { if (index !== visible.length)
-            throw mismatch(); },
-    };
-}

package/dist/archive-tar-gnu.d.ts

@@ -1,2 +0,0 @@
-export declare function validateGnuMetadata(body: Buffer, type: "L" | "K"): string;
-//# sourceMappingURL=archive-tar-gnu.d.ts.map

package/dist/archive-tar-gnu.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive-tar-gnu.d.ts","sourceRoot":"","sources":["../src/archive-tar-gnu.ts"],"names":[],"mappings":"AAKA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAazE"}

package/dist/archive-tar-gnu.js

@@ -1,20 +0,0 @@
-import { ArchiveFormatError } from "./archive-errors.js";
-import { validateArchiveEntryPath } from "./archive-entry.js";
-// Keep the byte grammar aligned with native/src/tar_meter.rs. Parsers differ
-// on embedded NULs and malformed UTF-8, so validate before either sees a name.
-export function validateGnuMetadata(body, type) {
-    const value = body.at(-1) === 0 ? body.subarray(0, -1) : body;
-    if (!value.length || value.includes(0)) {
-        throw new ArchiveFormatError("invalid GNU metadata: empty name or embedded NUL");
-    }
-    let name;
-    try {
-        name = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(value);
-    }
-    catch {
-        throw new ArchiveFormatError("invalid GNU metadata: name is not valid UTF-8");
-    }
-    if (type === "L")
-        validateArchiveEntryPath(name);
-    return name;
-}

package/dist/archive-tar-header.d.ts

@@ -1,8 +0,0 @@
-export declare function validateTarChecksum(header: Buffer): void;
-export declare function readTarHeaderPaths(header: Buffer): {
-    name: string;
-    prefix: string;
-    linkname: string;
-};
-export declare function validateTarHeader(header: Buffer): void;
-//# sourceMappingURL=archive-tar-header.d.ts.map

package/dist/archive-tar-header.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive-tar-header.d.ts","sourceRoot":"","sources":["../src/archive-tar-header.ts"],"names":[],"mappings":"AAGA,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAWxD;AAcD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CASrG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAUtD"}

package/dist/archive-tar-header.js

@@ -1,47 +0,0 @@
-import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
-const utf8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
-export function validateTarChecksum(header) {
-    const field = header.subarray(148, 156);
-    const end = field.indexOf(0);
-    const digits = field.subarray(0, end < 0 ? field.length : end).toString("latin1").replace(/^ +| +$/g, "");
-    const sum = header.reduce((total, byte, index) => total + (index >= 148 && index < 156 ? 32 : byte), 0);
-    // Require an in-field delimiter: node-tar otherwise reads into the typeflag.
-    if (!/^[0-7]+$/.test(digits) || ![0, 32].includes(field[7]) ||
-        (end >= 0 && field.subarray(end).some((byte) => byte !== 0 && byte !== 32)) ||
-        Number.parseInt(digits, 8) !== sum) {
-        throw new ArchiveFormatError("invalid TAR header: checksum failure");
-    }
-}
-function fixedField(field) {
-    const zero = field.indexOf(0);
-    if (zero >= 0 && field.subarray(zero).some((byte) => byte !== 0)) {
-        throw new ArchiveSecurityError("entry-path", "tar entry path contains bytes after NUL");
-    }
-    try {
-        return utf8.decode(field.subarray(0, zero < 0 ? field.length : zero));
-    }
-    catch {
-        throw new ArchiveSecurityError("entry-path", "tar entry path is not valid UTF-8");
-    }
-}
-export function readTarHeaderPaths(header) {
-    // node-tar's star layout uses a 130-byte prefix followed by atime/ctime.
-    const prefixEnd = header[475] === 0 ? 475 : 500;
-    return {
-        name: fixedField(header.subarray(0, 100)),
-        prefix: header.subarray(257, 265).equals(Buffer.from("ustar\0" + "00"))
-            ? fixedField(header.subarray(345, prefixEnd)) : "",
-        linkname: fixedField(header.subarray(157, 257)),
-    };
-}
-export function validateTarHeader(header) {
-    validateTarChecksum(header);
-    const { linkname } = readTarHeaderPaths(header);
-    const isLink = header[156] === 0x31 || header[156] === 0x32;
-    if (isLink && !linkname) {
-        throw new ArchiveFormatError("invalid TAR header: linkname required on a link header");
-    }
-    if (!isLink && linkname) {
-        throw new ArchiveFormatError("invalid TAR header: linkname forbidden on a non-link header");
-    }
-}

package/dist/archive-tar-meta.d.ts

@@ -1,34 +0,0 @@
-import { Transform } from "node:stream";
-import { type TarMeterLimits } from "./archive-limits.js";
-import type { TarEntryInfo } from "./archive-tar.js";
-export declare class TarMetadataMeter extends Transform {
-    private readonly limits;
-    private readonly onMember?;
-    private readonly block;
-    private blockLength;
-    private state;
-    private pendingPax;
-    private readonly pendingGnu;
-    private pendingGnuPath;
-    private zeroBlocks;
-    private entries;
-    private remainingDecodedBytes;
-    private manifestBytes;
-    constructor(limits: TarMeterLimits, onMember?: ((entry: TarEntryInfo) => void) | undefined);
-    private countMember;
-    private invalid;
-    private paddedSize;
-    private parseSize;
-    private finishHeader;
-    private finishSparseHeader;
-    private meter;
-    _transform(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null, data?: Buffer) => void): void;
-    _flush(callback: (error?: Error | null) => void): void;
-}
-export declare function preflightTarMetadata(params: {
-    archivePath: string;
-    limits: TarMeterLimits;
-    signal?: AbortSignal;
-    onMember?: (entry: TarEntryInfo) => void;
-}): Promise<void>;
-//# sourceMappingURL=archive-tar-meta.d.ts.map

package/dist/archive-tar-meta.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive-tar-meta.d.ts","sourceRoot":"","sources":["../src/archive-tar-meta.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAY,MAAM,aAAa,CAAC;AAIlD,OAAO,EAAqE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI7H,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAWrD,qBAAa,gBAAiB,SAAQ,SAAS;IAYjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAkB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAX/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,aAAa,CAAK;IAE1B,YAA6B,MAAM,EAAE,cAAc,EAAmB,QAAQ,CAAC,GAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,aAAA,EAM7G;IAED,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,YAAY;IA6EpB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,KAAK;IAyCJ,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAc3H;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAM9D;CACF;AAaD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB"}