@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive.js

@@ -1,36 +1,37 @@
-import { createTarEntryPlanner } from "./archive-tar.js";
+import { createTarEntryPlanner, createArchiveEntrySelector, resolveArchiveFilteredEntryPolicy, createArchiveEntryPlanner, } from "./archive-plan.js";
 import { inspectTar, replayTar } from "./archive-tar-stream.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { constants as fsConstants } from "node:fs";
-import fs from "node:fs/promises";
+import fs, {} from "node:fs/promises";
 import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { createArchiveOutputPathTracker, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { createPipelineTimeoutError, waitForDeadline, withExtractionDeadline, } from "./archive-deadline.js";
-import { assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, resolveTarMeterLimits, } from "./archive-limits.js";
-import { assertPortableArchiveKind, resolveArchiveKind } from "./archive-kind.js";
-import { prepareArchiveDestinationDir, preparePrivateArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
-import { mergePlannedArchiveIntoDestination } from "./archive-merge.js";
+import { assertArchiveEntryCountWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, resolveTarMeterLimits, } from "./archive-limits.js";
+import { resolveArchiveKind } from "./archive-kind.js";
+import { prepareArchiveDestinationGuard, preparePrivateArchiveOutputPath, } from "./archive-staging.js";
+import { withStagedArchivePublication } from "./archive-merge.js";
 import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
-import { isZipSymlinkEntry, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
+import { admittedZipEntries } from "./archive-zip-loader.js";
+import { zipEntryKind, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
-import { FsSafeError } from "./errors.js";
-import { ArchiveSecurityError } from "./archive-errors.js";
-import { extractNativeArchive } from "./archive-native.js";
+import { ArchiveSecurityError, ArchiveFormatError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
 import { stageArchiveFileForExtraction } from "./archive-input.js";
-import { getNativeBinding } from "./native.js";
-import { resolveArchiveFilteredEntryPolicy, shouldExtractArchiveEntry, } from "./archive-policy.js";
+import { getNativeBinding, } from "./native.js";
 import { writeSiblingTempFile } from "./sibling-temp.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { classifyArchiveParserError } from "./archive-parser-errors.js";
+import { validateArchiveEntryPath } from "./archive-entry.js";
+import { admitZipFile } from "./archive-zip-admission.js";
+import { validateNativeZipManifest } from "./archive-zip-manifest.js";
 export { isWindowsDrivePath, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 export { resolveArchiveKind, resolvePackedRootDir } from "./archive-kind.js";
 export { readArchiveEntry } from "./archive-read.js";
-export { inspectTarArchive } from "./archive-tar-inspect.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ENTRY_PATH_COMPONENTS, } from "./archive-limits.js";
 export { ArchiveFormatError } from "./archive-errors.js";
 export { ArchiveSecurityError } from "./archive-staging.js";
 export { createArchiveSymlinkTraversalError, mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
-export { createTarEntryPreflightChecker } from "./archive-tar.js";
+export { createTarEntryPreflightChecker } from "./archive-plan.js";
 export { loadZipArchiveWithPreflight, readZipCentralDirectoryEntryCount, } from "./archive-zip-preflight.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in fsConstants;
 const OPEN_WRITE_CREATE_FLAGS = fsConstants.O_WRONLY |
@@ -45,26 +46,6 @@ async function readZipEntryStream(entry) {
     const buf = await entry.async("nodebuffer");
     return Readable.from(buf);
 }
-function resolveZipOutputPath(params) {
-    validateArchiveEntryPath(params.entryPath);
-    const canonicalPath = stripArchivePath(params.entryPath, 0);
-    if (!canonicalPath)
-        return null;
-    const relPath = stripArchivePath(canonicalPath, params.strip);
-    if (!relPath) {
-        return null;
-    }
-    validateArchiveEntryPath(relPath);
-    return {
-        canonicalPath,
-        relPath,
-        outPath: resolveArchiveOutputPath({
-            rootDir: params.destinationDir,
-            relPath,
-            originalPath: params.entryPath,
-        }),
-    };
-}
 async function writeZipFileEntry(params) {
     params.deadline.check();
     params.budget.startEntry();
@@ -77,6 +58,8 @@ async function writeZipFileEntry(params) {
             dir: path.dirname(destinationPath),
             chmodDir: false,
             mode: 0o600,
+            syncTempFile: false,
+            syncParentDir: false,
             writeTemp: async (tempPath) => {
                 tempHandle = await fs.open(tempPath, OPEN_WRITE_CREATE_FLAGS, 0o600);
                 const writable = tempHandle.createWriteStream();
@@ -91,7 +74,7 @@ async function writeZipFileEntry(params) {
                 }
                 params.deadline.check();
                 if (!handleClosedByStream) {
-                    await tempHandle.close().catch(() => undefined);
+                    await tempHandle.close();
                     handleClosedByStream = true;
                 }
                 tempHandle = null;
@@ -113,163 +96,234 @@ async function writeZipFileEntry(params) {
     }
 }
 async function extractZip(params) {
-    const limits = resolveExtractLimits(params.limits);
-    const stagedArchive = await stageArchiveFileForExtraction({
-        archivePath: params.archivePath,
-        limits,
-        deadline: params.deadline,
+    const { limits, deadline } = params;
+    const destinationGuard = await prepareArchiveDestinationGuard(params.destDir);
+    deadline.check();
+    const buffer = await fs.readFile(params.archivePath, { signal: deadline.signal });
+    deadline.check();
+    const zip = await waitForDeadline(loadZipArchiveWithPreflight(buffer, limits), deadline);
+    deadline.check();
+    const entries = admittedZipEntries(zip);
+    assertArchiveEntryCountWithinLimit(entries.length, limits);
+    const budget = createByteBudgetTracker(limits);
+    await withStagedArchivePublication({ ...params, destinationGuard }, async (stagingDir) => {
+        const { select } = createArchiveEntrySelector({ ...params, rootDir: stagingDir });
+        const acceptedEntries = [];
+        for (const entry of entries) {
+            deadline.check();
+            const entryKind = zipEntryKind(entry);
+            const relPath = select({ path: entry.name, kind: entryKind, size: zipEntryDeclaredSize(entry) });
+            if (relPath === null)
+                continue;
+            if (entryKind === "symlink") {
+                throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${entry.name}`);
+            }
+            if (entryKind === "other")
+                continue;
+            const mode = zipEntryMode(entry, params.entryModes);
+            acceptedEntries.push({ path: relPath, kind: entry.dir ? "directory" : "file", mode });
+            const outPath = path.join(stagingDir, relPath);
+            await preparePrivateArchiveOutputPath({
+                destinationDir: stagingDir,
+                destinationRealDir: stagingDir,
+                relPath,
+                outPath,
+                originalPath: entry.name,
+                isDirectory: entry.dir,
+                deadline,
+            });
+            if (!entry.dir) {
+                await writeZipFileEntry({ entry, outPath, budget, deadline });
+            }
+        }
+        return acceptedEntries;
     });
-    try {
-        const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
-        params.deadline.check();
-        const buffer = await fs.readFile(stagedArchive.path, { signal: params.deadline.signal });
-        params.deadline.check();
-        const zip = await waitForDeadline(loadZipArchiveWithPreflight(buffer, limits), params.deadline);
-        params.deadline.check();
-        const entries = Object.values(zip.files);
-        const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
-        assertArchiveEntryCountWithinLimit(entries.length, limits);
-        const budget = createByteBudgetTracker(limits);
-        const trackOutputPath = createArchiveOutputPathTracker();
-        await withStagedArchiveDestination({
-            destinationRealDir,
-            run: async (stagingDir) => {
-                const stagingRealDir = await fs.realpath(stagingDir);
-                const acceptedEntries = [];
-                for (const entry of entries) {
-                    params.deadline.check();
-                    const output = resolveZipOutputPath({
-                        entryPath: entry.name,
-                        strip,
-                        destinationDir: stagingRealDir,
-                    });
-                    if (!output) {
-                        continue;
-                    }
-                    assertArchiveEntryPathComponentsWithinLimit(output.relPath, limits);
-                    trackOutputPath(output.relPath, entry.name);
-                    const isSymlink = isZipSymlinkEntry(entry);
-                    const entryKind = isSymlink ? "symlink" : entry.dir ? "directory" : "file";
-                    const entrySize = zipEntryDeclaredSize(entry);
-                    if (!shouldExtractArchiveEntry({
-                        filter: params.entryFilter,
-                        onFiltered: params.onFiltered,
-                        entry: { path: output.canonicalPath, kind: entryKind, size: entrySize },
-                    })) {
-                        continue;
-                    }
-                    if (isSymlink) {
-                        throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${entry.name}`);
-                    }
-                    const mode = zipEntryMode(entry, params.entryModes);
-                    acceptedEntries.push({ path: output.relPath, kind: entry.dir ? "directory" : "file", mode });
-                    await preparePrivateArchiveOutputPath({
-                        destinationDir: stagingRealDir,
-                        destinationRealDir: stagingRealDir,
-                        relPath: output.relPath,
-                        outPath: output.outPath,
-                        originalPath: entry.name,
-                        isDirectory: entry.dir,
-                        deadline: params.deadline,
-                    });
-                    if (entry.dir) {
-                        continue;
-                    }
-                    await writeZipFileEntry({
-                        entry,
-                        outPath: output.outPath,
-                        budget,
-                        deadline: params.deadline,
-                    });
-                }
-                params.deadline.check();
-                await mergePlannedArchiveIntoDestination({
-                    entries: acceptedEntries,
-                    sourceDir: stagingRealDir,
-                    destinationDir: params.destDir,
-                    destinationRealDir,
-                    deadline: params.deadline,
-                });
-                params.deadline.check();
-            },
-        });
-    }
-    finally {
-        await stagedArchive.cleanup();
-    }
 }
 export async function extractArchive(params) {
+    const archivePath = params.archivePath;
+    const destDir = params.destDir;
+    const { entryUmask = 0 } = params;
+    if (!Number.isInteger(entryUmask) || entryUmask < 0 || entryUmask > 0o777) {
+        throw new RangeError("archive entryUmask must be an integer between 0 and 0o777");
+    }
     const onFiltered = resolveArchiveFilteredEntryPolicy(params.onFiltered);
-    const kind = params.kind ?? resolveArchiveKind(params.archivePath);
+    const kind = params.kind ?? resolveArchiveKind(archivePath);
     if (!kind) {
-        throw new Error(`unsupported archive: ${params.archivePath}`);
+        throw new Error(`unsupported archive: ${archivePath}`);
     }
     const label = kind === "zip" ? "extract zip" : "extract tar";
     const limits = resolveExtractLimits(params.limits);
     const tarLimits = resolveTarMeterLimits(limits);
     const native = getNativeBinding();
+    assertNoWindowsPathAlias(archivePath, "filesystem", "archive source uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(destDir, "filesystem", "archive destination uses a Windows filesystem namespace alias");
     // Read the declared public fields before private adapters copy options: class
     // getters and inherited policy must survive identically on every backend.
     const options = {
-        archivePath: params.archivePath, destDir: params.destDir,
+        archivePath, destDir,
+        durable: params.durable,
         stripComponents: params.stripComponents, limits,
-        entryModes: params.entryModes, entryFilter: params.entryFilter, onFiltered,
+        entryModes: params.entryModes, entryUmask, entryFilter: params.entryFilter, onFiltered,
     };
-    if (native) {
-        await withExtractionDeadline(params.timeoutMs, label, async (deadline) => extractNativeArchive({ ...options, binding: native, kind, tarLimits, deadline }));
-        return;
-    }
-    assertPortableArchiveKind(kind);
-    if (kind === "tar") {
-        await withExtractionDeadline(params.timeoutMs, label, async (deadline) => {
-            const stagedArchive = await stageArchiveFileForExtraction({
-                archivePath: options.archivePath,
-                limits,
-                deadline,
-            });
-            try {
-                await extractWasmTar({ archivePath: stagedArchive.path, options, limits, tarLimits, deadline });
-            }
-            finally {
-                await stagedArchive.cleanup();
-            }
-        });
-        return;
-    }
-    await withExtractionDeadline(params.timeoutMs, label, async (deadline) => extractZip({ ...options, deadline }));
+    await withExtractionDeadline(params.timeoutMs, label, async (deadline) => {
+        const stagedArchive = await stageArchiveFileForExtraction({ archivePath, limits, deadline });
+        try {
+            deadline.check();
+            const stagedOptions = { ...options, archivePath: stagedArchive.path, deadline };
+            if (native)
+                await extractNativeArchive({ ...stagedOptions, binding: native, kind, tarLimits });
+            else if (kind === "zip")
+                await extractZip(stagedOptions);
+            else
+                await extractWasmTar({ ...stagedOptions, kind, tarLimits });
+        }
+        finally {
+            await stagedArchive.cleanup();
+        }
+    });
 }
 async function extractWasmTar(params) {
-    const { options, deadline, tarLimits } = params;
+    const { deadline, tarLimits } = params;
     const manifest = [];
-    await inspectTar({ archivePath: params.archivePath, limits: tarLimits, signal: deadline.signal,
+    await inspectTar({ archivePath: params.archivePath, kind: params.kind, limits: tarLimits, signal: deadline.signal,
         onMember: (entry) => { manifest.push(entry); } });
     deadline.check();
-    const destinationRealDir = await prepareArchiveDestinationDir(options.destDir);
-    await withStagedArchiveDestination({ destinationRealDir, run: async (stagingPath) => {
-            const stagingDir = await fs.realpath(stagingPath);
-            const planEntry = createTarEntryPlanner({ ...options, rootDir: destinationRealDir, limits: params.limits });
-            const accepted = manifest.flatMap((entry) => {
+    const destinationGuard = await prepareArchiveDestinationGuard(params.destDir);
+    await withStagedArchivePublication({ ...params, destinationGuard }, async (stagingDir) => {
+        const planEntry = createTarEntryPlanner({ ...params, rootDir: destinationGuard.realPath });
+        const accepted = manifest.flatMap((entry) => {
+            deadline.check();
+            const planned = planEntry(entry);
+            return planned ? [{ ...entry, ...planned }] : [];
+        });
+        await replayTar({ archivePath: params.archivePath, kind: params.kind, limits: tarLimits, signal: deadline.signal, members: accepted,
+            async consume(member, payload) {
                 deadline.check();
-                const planned = planEntry(entry);
-                return planned ? [{ ...entry, ...planned }] : [];
-            });
-            await replayTar({ archivePath: params.archivePath, limits: tarLimits, signal: deadline.signal, members: accepted,
-                async consume(member, payload) {
+                await preparePrivateArchiveOutputPath({ destinationDir: stagingDir, destinationRealDir: stagingDir,
+                    relPath: member.path, outPath: path.join(stagingDir, member.path), originalPath: member.path,
+                    isDirectory: member.kind === "directory", deadline });
+                if (member.kind === "file") {
+                    await runPinnedWriteHelper({ rootPath: stagingDir, relativeParentPath: path.posix.dirname(member.path),
+                        basename: path.posix.basename(member.path), mkdir: false, mode: 0o600, overwrite: false,
+                        sync: false,
+                        maxBytes: member.size, input: { kind: "stream", stream: Readable.from(payload) } });
+                }
+                deadline.check();
+            },
+        });
+        return accepted;
+    });
+}
+function throwMappedNativeArchiveError(error) {
+    if (error instanceof Error) {
+        const mapped = classifyArchiveParserError(error.message, { cause: error });
+        if (mapped)
+            throw mapped;
+        if (isArchiveFormatErrorMessage(error.message)) {
+            throw new ArchiveFormatError(error.message, { cause: error });
+        }
+        if (error.code === "InvalidArg") {
+            throw new ArchiveFormatError(`invalid archive: ${error.message}`, { cause: error });
+        }
+    }
+    throw error;
+}
+async function extractNativeArchive(params) {
+    const { archivePath, limits, tarLimits, deadline } = params;
+    const zipEntries = [];
+    if (params.kind === "zip") {
+        await admitZipFile(archivePath, limits, deadline, (entry) => { zipEntries.push(entry); });
+    }
+    const destinationGuard = await prepareArchiveDestinationGuard(params.destDir);
+    await withStagedArchivePublication({ ...params, destinationGuard }, async (stagingDir) => {
+        deadline.check();
+        // N-API retains completed task state on its signal; each pass needs its own.
+        const manifest = await params.binding
+            .inspectArchiveNative(archivePath, params.kind, tarLimits, AbortSignal.any([deadline.signal]))
+            .catch(throwMappedNativeArchiveError);
+        deadline.check();
+        assertArchiveEntryCountWithinLimit(manifest.length, limits);
+        if (params.kind === "zip") {
+            validateNativeZipManifest(manifest, zipEntries);
+        }
+        // Recheck the native manifest before any caller callback observes an entry.
+        if (params.kind !== "zip") {
+            for (const entry of manifest)
+                validateArchiveEntryPath(entry.path);
+        }
+        const planEntry = createArchiveEntryPlanner({ ...params, rootDir: stagingDir }, params.kind);
+        const plan = [];
+        for (const entry of manifest) {
+            deadline.check();
+            const mode = params.kind === "zip"
+                ? zipEntries[entry.index].creatorSystem === 3
+                    ? zipEntries[entry.index].externalAttributes >>> 16
+                    : undefined
+                : entry.mode;
+            const accepted = planEntry({ ...entry, mode });
+            if (accepted)
+                plan.push({ ...accepted, index: entry.index });
+        }
+        const directory = await fs.open(stagingDir, fsConstants.O_RDONLY |
+            (typeof fsConstants.O_DIRECTORY === "number" ? fsConstants.O_DIRECTORY : 0));
+        try {
+            deadline.check();
+            await params.binding.extractArchiveNative(archivePath, params.kind, directory.fd, plan.map((entry) => ({ ...entry, mode: entry.kind === "directory" ? 0o700 : 0o600 })), tarLimits, AbortSignal.any([deadline.signal])).catch(throwMappedNativeArchiveError);
+        }
+        finally {
+            await directory.close().catch(() => undefined);
+        }
+        return plan;
+    });
+}
+/** Complete TAR/gzip admission and zero-strip extraction policy, without output writes. */
+export async function inspectTarArchive(params) {
+    const archivePath = params.archivePath;
+    const onFiltered = resolveArchiveFilteredEntryPolicy(params.onFiltered);
+    const limits = resolveExtractLimits(params.limits);
+    const tarLimits = resolveTarMeterLimits(limits);
+    const native = getNativeBinding();
+    assertNoWindowsPathAlias(archivePath, "filesystem", "archive source uses a Windows filesystem namespace alias");
+    return await withExtractionDeadline(params.timeoutMs, "inspect tar", async (deadline) => {
+        const staged = await stageArchiveFileForExtraction({ archivePath, limits, deadline });
+        try {
+            // Staging closes descriptors asynchronously; expiry there must not start a decoder.
+            deadline.check();
+            const entries = [];
+            const append = (entry) => {
+                if (entry)
+                    entries.push(Object.freeze({ path: entry.path, kind: entry.kind, size: entry.size }));
+            };
+            const policy = { limits, entryFilter: params.entryFilter, onFiltered };
+            if (native) {
+                const manifest = await native.inspectArchiveNative(staged.path, "tar", tarLimits, deadline.signal)
+                    .catch(throwMappedNativeArchiveError);
+                deadline.check();
+                // Match extraction's whole-manifest validation before caller policy runs.
+                for (const entry of manifest)
+                    validateArchiveEntryPath(entry.path);
+                const planEntry = createArchiveEntryPlanner(policy, "tar");
+                for (const entry of manifest) {
                     deadline.check();
-                    await preparePrivateArchiveOutputPath({ destinationDir: stagingDir, destinationRealDir: stagingDir,
-                        relPath: member.path, outPath: path.join(stagingDir, member.path), originalPath: member.path,
-                        isDirectory: member.kind === "directory", deadline });
-                    if (member.kind === "file") {
-                        await runPinnedWriteHelper({ rootPath: stagingDir, relativeParentPath: path.posix.dirname(member.path),
-                            basename: path.posix.basename(member.path), mkdir: false, mode: 0o600, overwrite: false,
-                            maxBytes: member.size, input: { kind: "stream", stream: Readable.from(payload) } });
-                    }
+                    append(planEntry(entry));
+                }
+            }
+            else {
+                const manifest = [];
+                await inspectTar({ archivePath: staged.path, limits: tarLimits, signal: deadline.signal,
+                    onMember: (entry) => { manifest.push(entry); } });
+                const planEntry = createTarEntryPlanner(policy);
+                for (const entry of manifest) {
                     deadline.check();
-                },
-            });
-            deadline.check();
-            await mergePlannedArchiveIntoDestination({ entries: accepted, sourceDir: stagingDir,
-                destinationDir: options.destDir, destinationRealDir, deadline });
+                    append(planEntry(entry));
+                }
+            }
             deadline.check();
-        } });
+            // This is bounded evidence about the staged bytes, not a reusable write plan.
+            return Object.freeze(entries);
+        }
+        finally {
+            await staged.cleanup();
+        }
+    });
 }

package/node_modules/@openclaw/fs-safe/dist/async-lock.d.ts

@@ -1,2 +1 @@
 export declare function createAsyncLock(): <T>(fn: () => Promise<T>) => Promise<T>;
-//# sourceMappingURL=async-lock.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/atomic.d.ts

@@ -1,5 +1,6 @@
-export { replaceFileAtomic, replaceFileAtomicSync, type RenameIdentityPolicy, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicRestoreCleanup, type ReplaceFileAtomicRestoreFailureDetails, type ReplaceFileAtomicResult, type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
+export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
+export type { RenameIdentityPolicy } from "./pinned-write-types.js";
+export type { ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, } from "./replace-file-copy-fallback.js";
 export { writeTextAtomic, type WriteTextAtomicOptions } from "./text-atomic.js";
 export { replaceDirectoryAtomic, type ReplaceDirectoryAtomicOptions } from "./replace-directory.js";
 export { movePathWithCopyFallback, type MovePathPublicationReceipt, type MovePathWithCopyFallbackOptions, } from "./move-path.js";
-//# sourceMappingURL=atomic.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/bounded-read-stream.d.ts

@@ -1,4 +1,2 @@
 import { Transform } from "node:stream";
-export declare function createMaxBytesTransform(maxBytes: number): Transform;
 export declare function createByteLimitTransform(maxBytes: number, overflowError: (bytes: number) => Error): Transform;
-//# sourceMappingURL=bounded-read-stream.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/bounded-read-stream.js

@@ -1,10 +1,4 @@
 import { Transform } from "node:stream";
-import { normalizeMaxBytes } from "./byte-budget.js";
-import { FsSafeError } from "./errors.js";
-export function createMaxBytesTransform(maxBytes) {
-    normalizeMaxBytes(maxBytes);
-    return createByteLimitTransform(maxBytes, (bytes) => new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`));
-}
 export function createByteLimitTransform(maxBytes, overflowError) {
     let bytes = 0;
     return new Transform({

package/node_modules/@openclaw/fs-safe/dist/bounded-read.d.ts

@@ -1,5 +1,12 @@
 import type { FileHandle } from "node:fs/promises";
 type ReadableFileHandle = Pick<FileHandle, "read">;
+export declare function readBoundedAsync(maxBytes: number, readChunk: (scratch: Buffer, length: number) => Promise<number>, options?: {
+    observeRegularFileSize?: () => number | undefined;
+    initialSize?: number;
+    createLimitError?: () => Error;
+    /** Keep the result outside Node's shared small-buffer allocation pool. */
+    unpooled?: boolean;
+}): Promise<Buffer>;
 /**
  * Reads from the handle's current offset without closing it. A bounded read
  * consumes at most maxBytes + 1 bytes so growth after an earlier stat cannot
@@ -8,7 +15,11 @@ type ReadableFileHandle = Pick<FileHandle, "read">;
 export declare function readFileHandleBounded(handle: ReadableFileHandle, maxBytes: number): Promise<Buffer>;
 /** Async bounded read from a numeric descriptor. The caller owns the descriptor. */
 export declare function readFileDescriptorBounded(fd: number, maxBytes: number): Promise<Buffer>;
+export declare function readBoundedSync(maxBytes: number, readChunk: (scratch: Buffer, length: number) => number, options?: {
+    observeRegularFileSize?: () => number | undefined;
+    initialSize?: number;
+    createLimitError?: () => Error;
+}): Buffer;
 /** Sync bounded read from a numeric descriptor. The caller owns the descriptor. */
 export declare function readFileDescriptorBoundedSync(fd: number, maxBytes: number): Buffer;
 export {};
-//# sourceMappingURL=bounded-read.d.ts.map