@poe-platform/safe-fs 0.1.721 → 0.1.723

package/dist/safe-fs/fs/devices/index.d.ts

@@ -39,6 +39,7 @@ export declare class DeviceFileSystem implements FileSystem {
     access(path: string, mode?: number, options?: FsOptions): Promise<void>;
     readlink(path: string, options?: FsOptions): Promise<string>;
     symlink(target: string, path: string, options?: FsOptions): Promise<void>;
+    confineExtraction(roots: readonly string[], options?: FsOptions): Promise<FileSystem>;
     link(existingPath: string, newPath: string, options?: FsOptions): Promise<void>;
     chmod(path: string, mode: number, options?: FsOptions): Promise<void>;
     utimes(path: string, atimeMs: number, mtimeMs: number, options?: FsOptions): Promise<void>;

package/dist/safe-fs/fs/devices/index.js

@@ -15,13 +15,14 @@ const deviceCapabilities = Object.freeze({
     remove: false, removeDirectory: false, recursiveRemove: false, rename: false,
     mkdir: false, recursiveMkdir: false, symlinks: false, hardlinks: false, readlink: false,
     permissions: false, timestamps: false, truncate: false, randomAccessWrite: false,
-    open: true, atomicFilePublication: false, atomicFileMutation: false, atomicEntryRemoval: false, atomicTreeRemoval: false, atomicFileStaging: false, atomicDirectoryMetadata: false,
+    open: true, atomicFilePublication: false, atomicFileMutation: false, atomicEntryRemoval: false, atomicTreeRemoval: false, atomicFileStaging: false, atomicDirectoryMetadata: false, trustedOwnedStaging: false,
     atomicRename: false, atomicRenameNoReplace: false, descriptorWriteStream: true, retainedResize: true, atomicResize: false,
 });
 function globalCapabilities(filesystem) {
     const capabilities = { readOnly: false };
     const optional = {
         open: ["open"],
+        trustedOwnedStaging: ["createStagedFile", "publishStagedFile", "removeStagedFile", "writeFileConditional", "removeFileConditional", "prepareDirectory"],
         atomicFilePublication: ["publishFileConditional"], atomicEntryRemoval: ["removeEntryConditional"], atomicTreeRemoval: ["removeTreeConditional"], atomicFileMutation: ["writeFileConditional", "removeFileConditional"], atomicFileStaging: ["createStagedFile", "publishStagedFile", "removeStagedFile"], atomicDirectoryMetadata: ["prepareDirectory"],
         streamingRead: ["readStream"], streamingWrite: ["writeStream"], retainedRead: ["openReadFile"],
         streamingAppend: ["writeStream"], descriptorWriteStream: ["writeStream"], retainedResize: ["openResizeFile"], atomicResize: ["resizeFile"],
@@ -101,7 +102,16 @@ export class DeviceFileSystem {
             throw new FsError("EBUSY", { path });
     }
     async #writeTarget(path, options) {
-        const resolved = await this.#resolve(path, options);
+        let resolved;
+        try {
+            resolved = await this.#resolve(path, options);
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            if ((options.flag === "wx" || options.flag === "ax") && isFsError(error, "ELOOP"))
+                return false;
+            throw error;
+        }
         if (resolved === nullPath) {
             if (options.flag === "wx" || options.flag === "ax")
                 throw new FsError("EEXIST", { path });
@@ -122,7 +132,7 @@ export class DeviceFileSystem {
         let resolved;
         let selected;
         try {
-            resolved = await this.#resolve(path, options, true, options.create);
+            resolved = await this.#resolve(path, options, options.create !== undefined || options.creation !== "exclusive", options.create);
         }
         catch (error) {
             options.signal?.throwIfAborted();
@@ -261,11 +271,11 @@ export class DeviceFileSystem {
         options?.signal?.throwIfAborted();
         if (!options || typeof options !== "object")
             throw new FsError("EINVAL", { syscall: "open", path });
-        const resolved = await this.#resolve(path, options, options.creation !== "exclusive");
+        const resolved = await this.#resolve(path, options, !options.noFollow && options.creation !== "exclusive");
         options.signal?.throwIfAborted();
         if (resolved === nullPath)
             return openFileDescriptor(path, options, {
-                position: true, positionedRead: true, positionedWrite: true, positionedAppendWrite: true,
+                noFollow: true, position: true, positionedRead: true, positionedWrite: true, positionedAppendWrite: true,
                 openTruncate: true, delegateZeroLengthWrite: true, truncate: false, synchronization: "none",
             }, async (admitted) => {
                 if (admitted.creation === "exclusive")
@@ -289,7 +299,7 @@ export class DeviceFileSystem {
             throw new FsError("ENOTSUP", { syscall: "open", path });
         const query = this.#filesystem.capabilitiesFor;
         options.signal?.throwIfAborted();
-        const capabilities = query && options.creation !== "exclusive" ? await Reflect.apply(query, this.#filesystem, [path, options]) : this.#filesystem.capabilities;
+        const capabilities = query && !options.noFollow && options.creation !== "exclusive" ? await Reflect.apply(query, this.#filesystem, [path, options]) : this.#filesystem.capabilities;
         options.signal?.throwIfAborted();
         const open = this.#filesystem.open;
         options.signal?.throwIfAborted();
@@ -572,6 +582,14 @@ export class DeviceFileSystem {
             throw new FsError("ENOTSUP", { path });
         await this.#filesystem.symlink(target, path, options);
     }
+    async confineExtraction(roots, options = {}) {
+        options.signal?.throwIfAborted();
+        if (!this.#filesystem.confineExtraction)
+            throw new FsError("ENOTSUP", { syscall: "confineExtraction" });
+        // Extraction uses only the backing namespace; synthetic devices must never
+        // become archive publication destinations.
+        return this.#filesystem.confineExtraction(roots, options);
+    }
     async link(existingPath, newPath, options = {}) {
         await this.#mutable(existingPath, options, false);
         await this.#mutable(newPath, options, false);

package/dist/safe-fs/fs/memory/index.d.ts

@@ -35,6 +35,7 @@ export declare class MemoryFileSystem implements FileSystem {
         timestamps: true;
         atomicRename: true;
         atomicFileStaging: true;
+        atomicStagingAncestry: true;
         atomicFileMutation: true;
         atomicEntryRemoval: true;
         atomicTreeRemoval: true;
@@ -53,6 +54,7 @@ export declare class MemoryFileSystem implements FileSystem {
     constructor(options?: MemoryFileSystemOptions);
     compareEntry(path: string, peer: FileSystem, peerPath: string, options?: FsOptions): Promise<EntryComparison>;
     canonicalizeMissingTarget(path: string, options?: FsOptions): string | undefined;
+    confineExtraction(roots: readonly string[], options?: FsOptions): Promise<FileSystem>;
     private metadata;
     private directory;
     private addNode;

package/dist/safe-fs/fs/memory/index.js

@@ -68,7 +68,7 @@ export class MemoryFileSystem {
             permissions: true,
             timestamps: true,
             atomicRename: true,
-            atomicFileStaging: true, atomicFileMutation: true, atomicEntryRemoval: true, atomicTreeRemoval: true,
+            atomicFileStaging: true, atomicStagingAncestry: true, atomicFileMutation: true, atomicEntryRemoval: true, atomicTreeRemoval: true,
             atomicDirectoryMetadata: true,
             streamingRead: true,
             retainedRead: true,
@@ -117,6 +117,68 @@ export class MemoryFileSystem {
             this.validatePath(path, "realpath");
         return resolveMissingTarget(owner.root, path || ".", options.signal);
     }
+    async confineExtraction(roots, options = {}) {
+        options.signal?.throwIfAborted();
+        const retained = new Map();
+        for (const root of roots) {
+            this.validatePath(root, "confineExtraction");
+            let path = "";
+            for (const component of root.split("/").filter(Boolean)) {
+                if (component === "." || component === "..")
+                    this.fail("EINVAL", "confineExtraction", root);
+                path += `/${component}`;
+                const node = this.entry(path, "confineExtraction").node;
+                if (node.type !== "directory")
+                    this.fail("ENOTDIR", "confineExtraction", path);
+                retained.set(path, node);
+            }
+            retained.set("/", this.root);
+        }
+        const allowed = new Set(["mkdir", "rm", "rmdir", "rename", "symlink", "link", "chmod", "utimes", "writeFile", "appendFile", "writeStream", "writeFileConditional", "removeFileConditional"]);
+        const reads = new Set(["access", "capabilitiesFor", "compareEntry", "lstat", "stat", "readFile", "readStream", "readdir", "readlink", "realpath"]);
+        const check = (path, followFinal) => {
+            if (!roots.some(root => root === "/" || path === root || path.startsWith(`${root}/`)))
+                this.fail("EPERM", "confineExtraction", path);
+            const components = path.split("/").filter(Boolean);
+            if (components.some(component => component === "." || component === ".."))
+                this.fail("EINVAL", "confineExtraction", path);
+            let current = "";
+            for (const [index, component] of components.entries()) {
+                current += `/${component}`;
+                const node = this.entry(current, "confineExtraction", true).node;
+                if (retained.has(current) && node !== retained.get(current))
+                    this.fail("EAGAIN", "confineExtraction", current);
+                if (index < components.length - 1 && node?.type !== "directory")
+                    this.fail("ENOTDIR", "confineExtraction", current);
+                if (followFinal && index === components.length - 1 && node?.type === "symlink")
+                    this.fail("ELOOP", "confineExtraction", current);
+            }
+        };
+        return new Proxy(this, {
+            get: (target, property) => {
+                if (property === "objects" || property === "confineExtraction")
+                    return undefined;
+                const value = Reflect.get(target, property);
+                if (typeof value !== "function")
+                    return value;
+                if (reads.has(String(property)))
+                    return value.bind(target);
+                return (...args) => {
+                    if (!allowed.has(String(property)))
+                        throw new FsError("ENOTSUP", { syscall: String(property) });
+                    // Stock mutations resolve and commit synchronously; writeStream retains
+                    // its file node before its first await, so later chunks cannot redirect.
+                    const paths = property === "symlink" ? [args[1]] : property === "link" || property === "rename" ? args.slice(0, 2) : [args[0]];
+                    for (const path of paths) {
+                        if (typeof path !== "string")
+                            throw new FsError("EINVAL");
+                        check(path, ["chmod", "utimes", "appendFile", "writeFile", "writeStream", "writeFileConditional", "link"].includes(String(property)));
+                    }
+                    return Reflect.apply(value, target, args);
+                };
+            },
+        });
+    }
     metadata(mode) {
         const now = Date.now();
         return {
@@ -201,6 +263,10 @@ export class MemoryFileSystem {
     }
     resolve(path, syscall, options = {}) {
         this.validatePath(path, syscall);
+        // Bound all component arrays allocated by this resolution, including cycles.
+        let remainingPathUnits = 65_536 - path.length;
+        if (remainingPathUnits < 0)
+            this.fail("ENAMETOOLONG", syscall, path);
         const pending = path.split("/").filter(Boolean);
         if (path.endsWith("/"))
             pending.push("");
@@ -239,6 +305,9 @@ export class MemoryFileSystem {
             if (node.type === "symlink" && (options.followFinal !== false || pending.length > 0)) {
                 if (++links > 40)
                     this.fail("ELOOP", syscall, path);
+                if (node.target.length > remainingPathUnits)
+                    this.fail("ENAMETOOLONG", syscall, path);
+                remainingPathUnits -= node.target.length;
                 const target = node.target.split("/").filter(Boolean);
                 if (node.target.endsWith("/"))
                     target.push("");
@@ -278,6 +347,7 @@ export class MemoryFileSystem {
     snapshot(node) {
         return {
             type: node.type,
+            filesystemType: "memory",
             ioBlockSize: preferredIoBlockSize,
             ...(Number.isSafeInteger(node.revision) ? { revision: node.revision } : {}),
             preferredIoBlockSize: 4096,
@@ -314,15 +384,17 @@ export class MemoryFileSystem {
     }
     open(path, options) {
         return openFileDescriptor(path, options, {
-            positionedRead: true, positionedWrite: true, truncate: true, synchronization: "volatile", position: true,
+            noFollow: true, positionedRead: true, positionedWrite: true, truncate: true, synchronization: "volatile", position: true,
         }, async (admitted) => {
             const location = this.resolve(path, "open", {
-                followFinal: admitted.creation !== "exclusive", allowMissing: admitted.creation !== "never",
+                followFinal: !admitted.noFollow && admitted.creation !== "exclusive", allowMissing: admitted.creation !== "never",
             });
             let node = location.node;
             if (node) {
                 if (admitted.creation === "exclusive")
                     this.fail("EEXIST", "open", path);
+                if (node.type === "symlink" && admitted.noFollow)
+                    this.fail("ELOOP", "open", path);
                 if (node.type !== "file")
                     this.fail("EISDIR", "open", path);
                 this.permission(node, admitted.access === "read" ? 4 : admitted.access === "write" ? 2 : 6, "open", path);
@@ -583,6 +655,25 @@ export class MemoryFileSystem {
     }
     async publishStagedFile(staging, destination, options) {
         options.signal?.throwIfAborted();
+        if (options.ancestors) {
+            let path = "/";
+            const parentPath = destination.slice(0, destination.lastIndexOf("/")) || "/";
+            const paths = ["/", ...parentPath.split("/").filter(Boolean).map(component => {
+                    path = path === "/" ? `/${component}` : `${path}/${component}`;
+                    return path;
+                })];
+            if (paths.length !== options.ancestors.length)
+                this.fail("EINVAL", "publishStagedFile", destination);
+            for (let index = 0; index < paths.length; index++) {
+                const expected = options.ancestors[index];
+                if (expected.path !== paths[index])
+                    this.fail("EINVAL", "publishStagedFile", destination);
+                const entry = this.entry(expected.path, "publishStagedFile");
+                if (entry.node?.type !== "directory")
+                    this.fail("EAGAIN", "publishStagedFile", destination);
+                this.expectEntry(entry.node, expected.stat, expected.path, false);
+            }
+        }
         const { directory, file } = this.stagingLocations(staging);
         this.expectEntry(file.node, staging.file.stat, staging.file.path);
         const target = this.entry(destination, "publishStagedFile", true);
@@ -1212,5 +1303,5 @@ function stockRetainedResize(filesystem) {
     return true;
 }
 export function createMemoryFileSystem(options = {}) {
-    return new MemoryFileSystem(normalizeMemoryFileSystemLimits(options));
+    return new MemoryFileSystem(options);
 }

package/dist/safe-fs/fs/memory/limits.js

@@ -1,8 +1,8 @@
 import { readConfigRecord } from "../../config.js";
 export const defaultMemoryFileSystemLimits = Object.freeze({
-    maxFileBytes: 16 * 1024 * 1024,
-    maxRetainedBytes: 64 * 1024 * 1024,
-    maxMetadataUnits: 10_000,
+    maxFileBytes: Infinity,
+    maxRetainedBytes: Infinity,
+    maxMetadataUnits: Infinity,
 });
 export function normalizeMemoryFileSystemLimits(options) {
     const keys = ["maxFileBytes", "maxRetainedBytes", "maxMetadataUnits"];
@@ -15,7 +15,9 @@ export function normalizeMemoryFileSystemLimits(options) {
         limits.maxBytes = record.maxBytes;
     }
     for (const key of keys) {
-        const value = Object.hasOwn(record, key) ? record[key] : limits[key];
+        if (!Object.hasOwn(record, key))
+            continue;
+        const value = record[key];
         if (typeof value !== "number" || !Number.isSafeInteger(value) || value < (key === "maxMetadataUnits" ? 1 : 0)) {
             throw new RangeError(`${key} must be a ${key === "maxMetadataUnits" ? "positive" : "nonnegative"} safe integer`);
         }

package/dist/safe-fs/fs/mount/index.d.ts

@@ -8,6 +8,9 @@ export interface MountFileSystemOptions {
 export declare class MountFileSystem implements FileSystem {
     readonly capabilities: FileSystemCapabilities;
     private readonly mounts;
+    private activeNamespaceOperations;
+    private namespaceMutation;
+    private readonly namespaceWaiters;
     constructor(options: MountFileSystemOptions);
     private select;
     capabilitiesFor(path: string, options?: CapabilityQueryOptions): Promise<FileSystemCapabilities>;
@@ -16,6 +19,7 @@ export declare class MountFileSystem implements FileSystem {
     resizeFile(path: string, operation: FileResizeOperation, options?: FileResizeOptions): Promise<void>;
     openResizeFile(path: string, options?: OpenResizeFileOptions): Promise<FileResizeHandle>;
     private error;
+    private acquireNamespace;
     private operation;
     private components;
     private lookup;

package/dist/safe-fs/fs/mount/index.js

@@ -22,9 +22,10 @@ function fail(code) {
     throw new FsError(code);
 }
 function snapshotStat(stat) {
-    const { type, size, allocatedBytes, ioBlockSize, preferredIoBlockSize, mode, mtimeMs, atimeMs, ctimeMs, birthtimeMs, revision, identityScope, opaqueIdentity, opaqueVersion, ino, dev, rdevMajor, rdevMinor, nlink, uid, gid } = stat;
+    const { type, filesystemType, size, allocatedBytes, ioBlockSize, preferredIoBlockSize, mode, mtimeMs, atimeMs, ctimeMs, birthtimeMs, revision, identityScope, opaqueIdentity, opaqueVersion, ino, dev, rdevMajor, rdevMinor, nlink, uid, gid } = stat;
     return {
         type, size, mode, mtimeMs, atimeMs, ctimeMs,
+        ...(filesystemType === undefined ? {} : { filesystemType }),
         ...(revision === undefined ? {} : { revision }),
         ...(allocatedBytes === undefined ? {} : { allocatedBytes }),
         ...(ioBlockSize === undefined ? {} : { ioBlockSize }),
@@ -45,6 +46,9 @@ function snapshotStat(stat) {
 export class MountFileSystem {
     capabilities;
     mounts;
+    activeNamespaceOperations = 0;
+    namespaceMutation = false;
+    namespaceWaiters = new Set();
     constructor(options) {
         const mounts = [];
         const paths = new Set();
@@ -98,6 +102,7 @@ export class MountFileSystem {
         const common = (capability) => {
             const optional = {
                 open: ["open"],
+                trustedOwnedStaging: ["createStagedFile", "publishStagedFile", "removeStagedFile", "writeFileConditional", "removeFileConditional", "prepareDirectory"],
                 atomicFilePublication: ["publishFileConditional"], atomicEntryRemoval: ["removeEntryConditional"], atomicTreeRemoval: ["removeTreeConditional"], atomicFileMutation: ["writeFileConditional", "removeFileConditional"], atomicFileStaging: ["createStagedFile", "publishStagedFile", "removeStagedFile"], atomicDirectoryMetadata: ["prepareDirectory"],
                 symlinks: ["symlink", "readlink"], hardlinks: ["link"], permissions: ["chmod"], timestamps: ["utimes"], readlink: ["readlink"],
                 descriptorWriteStream: ["writeStream"], retainedResize: ["openResizeFile"], atomicResize: ["resizeFile"],
@@ -116,7 +121,7 @@ export class MountFileSystem {
             return values.every(value => value === true) ? true : values.every(value => value === false) ? false : undefined;
         };
         const semantics = Object.fromEntries([
-            "atomicFilePublication", "atomicEntryRemoval", "atomicTreeRemoval", "atomicFileMutation", "atomicFileStaging", "atomicDirectoryMetadata", "read", "stat", "readdir", "realpath", "access", "open", "versionedDescriptors",
+            "trustedOwnedStaging", "atomicFilePublication", "atomicEntryRemoval", "atomicTreeRemoval", "atomicFileMutation", "atomicFileStaging", "atomicDirectoryMetadata", "read", "stat", "readdir", "realpath", "access", "open", "versionedDescriptors",
             "write", "append", "exclusiveCreate", "explicitDirectories", "implicitDirectories", "mkdir", "recursiveMkdir",
             "remove", "removeDirectory", "recursiveRemove", "rename", "atomicRenameNoReplace", "copy", "exclusiveCopy", "readlink", "truncate",
             "streamingAppend", "randomAccessWrite", "descriptorWriteStream", "retainedResize", "atomicResize", "symlinks", "hardlinks", "permissions", "timestamps",
@@ -126,6 +131,7 @@ export class MountFileSystem {
             readOnly: all("readOnly"),
             ...(append === undefined ? {} : { append }),
             ...semantics,
+            atomicStagingAncestry: false,
             atomicRename: mounts.length === 1 && all("atomicRename"),
             ...(streamingRead === undefined ? {} : { streamingRead }),
             ...(streamingWrite === undefined ? {} : { streamingWrite }),
@@ -139,6 +145,7 @@ export class MountFileSystem {
         return this.operation("capabilitiesFor", path, options, async () => {
             const location = await this.resolve(path, options, {
                 allowMissing: options.create ?? true,
+                followFinal: options.create !== undefined || options.creation !== "exclusive",
                 ...(options.create === undefined ? {} : { resizeCreate: options.create }),
             });
             const observed = ownedMutationCapabilities(location.mount.backend, await location.mount.backend.capabilitiesFor?.(location.local, options)
@@ -148,7 +155,7 @@ export class MountFileSystem {
                 ? { ...observed, descriptorWriteStream: false } : observed;
             const resize = declared.atomicResize === true && (typeof location.mount.backend.resizeFile !== "function" || declared.readOnly === true)
                 ? { ...declared, atomicResize: false } : declared;
-            const withOpen = { ...resize, ...(typeof location.mount.backend.open === "function" ? {} : { open: false }) };
+            const withOpen = { ...resize, atomicStagingAncestry: false, ...(typeof location.mount.backend.open === "function" ? {} : { open: false }) };
             const capabilities = location.synthetic ? { ...withOpen, open: false, retainedRead: false }
                 : retainedResizeCapabilities(location.mount.backend, retainedReadCapabilities(location.mount.backend, withOpen));
             if (location.synthetic)
@@ -168,7 +175,9 @@ export class MountFileSystem {
         return path === "/" || this.mounts.some((mount) => within(path, mount.path));
     }
     async openReadFile(path, options = {}) {
+        let release;
         try {
+            release = await this.acquireNamespace(options);
             options.signal?.throwIfAborted();
             const location = await this.resolve(path, options);
             if (location.synthetic)
@@ -178,6 +187,9 @@ export class MountFileSystem {
         catch (error) {
             throw error ? this.error(error, "openReadFile", path, options) : error;
         }
+        finally {
+            release?.();
+        }
     }
     async resizeFile(path, operation, options = {}) {
         return this.operation("resizeFile", path, options, async () => {
@@ -197,7 +209,9 @@ export class MountFileSystem {
         });
     }
     async openResizeFile(path, options = {}) {
+        let release;
         try {
+            release = await this.acquireNamespace(options);
             options.signal?.throwIfAborted();
             const resolution = this.resolve(path, options, { allowMissing: options.create === true, resizeCreate: options.create ?? false });
             const signal = options.signal;
@@ -216,17 +230,56 @@ export class MountFileSystem {
         catch (error) {
             throw error ? this.error(error, "openResizeFile", path, options) : error;
         }
+        finally {
+            release?.();
+        }
     }
     error(error, syscall, path, options, dest) {
-        if (options.signal?.aborted && error === options.signal.reason)
+        if (options.signal?.aborted && Object.is(error, options.signal.reason))
             return error;
         return new FsError(toFsError(error).code, {
             cause: error, syscall, path: globalPath(path), ...(dest === undefined ? {} : { dest: globalPath(dest) }),
         });
     }
+    // Keep guest namespace changes outside every path admission/action interval.
+    // Backend references held outside this view still require backend confinement.
+    async acquireNamespace(options, mutation = false) {
+        const signal = options.signal;
+        signal?.throwIfAborted();
+        while (this.namespaceMutation || mutation && this.activeNamespaceOperations > 0) {
+            await new Promise((resolve, reject) => {
+                const wake = () => { cleanup(); resolve(); };
+                const abort = () => { cleanup(); reject(signal.reason); };
+                const cleanup = () => {
+                    this.namespaceWaiters.delete(wake);
+                    signal?.removeEventListener("abort", abort);
+                };
+                this.namespaceWaiters.add(wake);
+                signal?.addEventListener("abort", abort, { once: true });
+                if (signal?.aborted)
+                    abort();
+            });
+            signal?.throwIfAborted();
+        }
+        this.activeNamespaceOperations++;
+        if (mutation)
+            this.namespaceMutation = true;
+        return () => {
+            this.activeNamespaceOperations--;
+            if (mutation)
+                this.namespaceMutation = false;
+            for (const wake of this.namespaceWaiters)
+                wake();
+        };
+    }
     async operation(syscall, path, options, action, dest, preserveReceipt = false) {
+        let release;
         try {
-            options.signal?.throwIfAborted();
+            release = await this.acquireNamespace(options, [
+                "rename", "symlink", "link", "unlink", "rm", "rmdir",
+                "removeEntryConditional", "removeFileConditional", "removeTreeConditional",
+                "publishStagedFile", "removeStagedFile",
+            ].includes(syscall));
             const result = await action();
             if (!preserveReceipt)
                 options.signal?.throwIfAborted();
@@ -235,6 +288,9 @@ export class MountFileSystem {
         catch (error) {
             throw this.error(error, syscall, path, options, dest);
         }
+        finally {
+            release?.();
+        }
     }
     components(path) {
         validatePath(path);
@@ -423,18 +479,21 @@ export class MountFileSystem {
     }
     open(path, options) {
         return openFileDescriptor(globalPath(path), options, {
-            positionedRead: true, positionedWrite: true, truncate: true, synchronization: "storage",
+            noFollow: true, positionedRead: true, positionedWrite: true, truncate: true, synchronization: "storage",
         }, async (admitted) => {
+            let release;
             try {
+                release = await this.acquireNamespace(admitted);
                 const location = await this.resolve(path, admitted, {
-                    allowMissing: admitted.creation !== "never", followFinal: admitted.creation !== "exclusive",
+                    allowMissing: admitted.creation !== "never", followFinal: !admitted.noFollow && admitted.creation !== "exclusive",
                 });
                 if (location.synthetic)
                     fail("EISDIR");
                 if (admitted.access !== "read" || admitted.creation !== "never" || admitted.truncate || admitted.append)
                     this.mutable(location);
                 const backend = location.mount.backend;
-                const capabilities = await backend.capabilitiesFor?.(location.local, admitted) ?? backend.capabilities;
+                const capabilities = admitted.noFollow ? backend.capabilities
+                    : await backend.capabilitiesFor?.(location.local, admitted) ?? backend.capabilities;
                 if (!backend.open || capabilities.open === false)
                     fail("ENOTSUP");
                 admitted.signal?.throwIfAborted();
@@ -451,6 +510,9 @@ export class MountFileSystem {
                 admitted.signal?.throwIfAborted();
                 throw this.error(error, "open", path, admitted);
             }
+            finally {
+                release?.();
+            }
         });
     }
     writeFile(path, data, options = {}) {
@@ -776,10 +838,7 @@ export class MountFileSystem {
                 }
             }
             else {
-                const maxBytes = 64 * 1024 * 1024;
-                const data = await reader.readFile(origin.local, { ...options, maxBytes });
-                if (data.byteLength > maxBytes)
-                    fail("EFBIG");
+                const data = await reader.readFile(origin.local, options);
                 options.signal?.throwIfAborted();
                 await writer.writeFile(target.local, data, writeOptions);
             }
@@ -856,7 +915,9 @@ export class MountFileSystem {
         });
     }
     async *readStream(path, options = {}) {
+        let release;
         try {
+            release = await this.acquireNamespace(options);
             options.signal?.throwIfAborted();
             const location = await this.resolve(path, options);
             if (location.synthetic)
@@ -871,6 +932,9 @@ export class MountFileSystem {
         catch (error) {
             throw this.error(error, "readStream", path, options);
         }
+        finally {
+            release?.();
+        }
     }
     writeStream(path, source, options = {}) {
         return this.operation("writeStream", path, options, async () => {

package/dist/safe-fs/fs/object-publication/index.d.ts

@@ -2,11 +2,15 @@ import type { FileStat, FileSystem, FsOptions, OpenFileOptions } from "../../con
 import type { ByteSource } from "../../contracts/io.js";
 export interface ObjectFileVersion {
     readonly revision: string;
+    /** Opaque lease/reservation token; independent of namespace revision. */
+    readonly publicationToken?: string;
     readonly stat: FileStat;
     read(position: number, maxBytes: number, options?: FsOptions): Promise<Uint8Array>;
     close(): Promise<void>;
 }
 export interface ObjectFilePublicationOptions extends FsOptions {
+    /** Token from this descriptor's current retained version, if supplied by its store. */
+    readonly previousToken?: string;
     readonly size: number;
     readonly mode: number;
 }

package/dist/safe-fs/fs/object-publication/index.js

@@ -5,12 +5,12 @@ import { validatePath } from "../../contracts/virtual-path.js";
 import { openFileDescriptor } from "../descriptor.js";
 export function withObjectFileDescriptors(filesystem, store, options = {}) {
     const chunkBytes = options.chunkBytes ?? 65536;
-    const maxStagedBytes = options.maxStagedBytes ?? 8 * 1024 * 1024;
-    const maxStagedPages = options.maxStagedPages ?? 4096;
-    const maxFileBytes = options.maxFileBytes ?? 256 * 1024 * 1024;
-    const maxOpenFiles = options.maxOpenFiles ?? 64;
-    if (![chunkBytes, maxStagedBytes, maxStagedPages, maxFileBytes, maxOpenFiles].every(value => Number.isSafeInteger(value) && value > 0)
-        || chunkBytes > 1048576 || typeof store.acquire !== "function"
+    const maxStagedBytes = options.maxStagedBytes ?? Infinity;
+    const maxStagedPages = options.maxStagedPages ?? Infinity;
+    const maxFileBytes = options.maxFileBytes ?? Infinity;
+    const maxOpenFiles = options.maxOpenFiles ?? Infinity;
+    if (![chunkBytes, options.maxStagedBytes, options.maxStagedPages, options.maxFileBytes, options.maxOpenFiles].every(value => value === undefined || Number.isSafeInteger(value) && value > 0)
+        || typeof store.acquire !== "function"
         || store.publish !== undefined && typeof store.publish !== "function"
         || store.createStaging !== undefined && typeof store.createStaging !== "function")
         throw new TypeError("Invalid object descriptor configuration");
@@ -50,6 +50,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
     };
     const version = (value) => {
         if (!value || typeof value.revision !== "string" || value.revision.length === 0 || value.revision.length > 4096
+            || value.publicationToken !== undefined && (typeof value.publicationToken !== "string" || value.publicationToken.length === 0 || value.publicationToken.length > 4096)
             || !value.stat || value.stat.type !== "file" || !Number.isSafeInteger(value.stat.size) || value.stat.size < 0
             || !Number.isSafeInteger(value.stat.mode) || value.stat.mode < 0 || value.stat.mode > 0o177777
             || ![value.stat.mtimeMs, value.stat.atimeMs, value.stat.ctimeMs].every(Number.isFinite)
@@ -57,7 +58,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
             throw new FsError("EIO", { message: "Invalid immutable object version" });
         if (value.stat.size > maxFileBytes)
             throw new FsError("EFBIG", { message: "Object descriptor file limit exceeded" });
-        return Object.freeze({ revision: value.revision, stat: Object.freeze({ ...value.stat }), read: value.read.bind(value), close: value.close.bind(value) });
+        return Object.freeze({ revision: value.revision, ...(value.publicationToken === undefined ? {} : { publicationToken: value.publicationToken }), stat: Object.freeze({ ...value.stat }), read: value.read.bind(value), close: value.close.bind(value) });
     };
     const clearPages = (state) => {
         stagedBytes -= state.pages.size * chunkBytes;
@@ -181,7 +182,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
                             yield bytes;
                         }
                     })();
-                    received = await store.publish(path, expected, source, { ...selected, size: state.size, mode: (state.head?.stat.mode ?? admitted.mode) & 0o7777 });
+                    received = await store.publish(path, expected, source, { ...selected, ...(state.head?.publicationToken === undefined ? {} : { previousToken: state.head.publicationToken }), size: state.size, mode: (state.head?.stat.mode ?? admitted.mode) & 0o7777 });
                 });
                 const published = version(received);
                 if (emitted !== state.size || published.stat.size !== state.size || published.revision === expected)

package/dist/safe-fs/fs/overlay/index.d.ts

@@ -1,6 +1,6 @@
 import type { ByteSource } from "../../contracts/io.js";
 import type { FileDescriptor, OpenFileOptions } from "../../contracts/descriptor.js";
-import type { AppendFileOptions, CapabilityQueryOptions, CopyFileOptions, DirectoryEntry, OpenReadFileOptions, FileStat, FileSystem, FileSystemCapabilities, FsOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, WriteFileOptions } from "../../contracts/filesystem.js";
+import type { AppendFileOptions, CapabilityQueryOptions, CopyFileOptions, DirectoryEntry, OpenReadFileOptions, FileReadHandle, FileStat, FileSystem, FileSystemCapabilities, FsOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, WriteFileOptions } from "../../contracts/filesystem.js";
 export interface OverlayFileSystemOptions {
     readonly upper: FileSystem;
     readonly lower: FileSystem;
@@ -21,7 +21,9 @@ export declare class OverlayFileSystem implements FileSystem {
     open(path: string, options: OpenFileOptions): Promise<FileDescriptor>;
     private run;
     capabilitiesFor(path: string, options?: CapabilityQueryOptions): Promise<FileSystemCapabilities>;
-    openReadFile(path: string, options?: OpenReadFileOptions): Promise<import("../../contracts/filesystem.js").FileReadHandle>;
+    openReadFile(path: string, options?: OpenReadFileOptions): Promise<FileReadHandle>;
+    private pinRead;
+    private handleBytes;
     private writable;
     private permission;
     private maybeStat;