@poe-platform/safe-fs 0.1.721 → 0.1.723

package/dist/safe-fs/fs/real/index.js

@@ -1,6 +1,7 @@
 import { constants } from "node:fs";
+import * as immediate from "node:fs";
 import * as native from "node:fs/promises";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { nativeAllocatedBytes } from "./allocation.js";
 import { openFileDescriptor } from "../descriptor.js";
 import { finishCleanup } from "../../contracts/cleanup.js";
@@ -17,19 +18,24 @@ function fileType(stats) {
     throw new FsError("ENOTSUP", { message: "special filesystem nodes are not supported" });
 }
 function fileStat(stats) {
-    const allocatedBytes = nativeAllocatedBytes(stats.blocks, process.platform);
-    const preferredIoBlockSize = stats.blksize;
-    return {
-        type: fileType(stats), size: stats.size, mode: stats.mode,
+    const allocatedBytes = nativeAllocatedBytes(typeof stats.size === "bigint" && typeof stats.blocks === "bigint" ? Number(stats.blocks) : stats.blocks, process.platform);
+    const blockSize = typeof stats.size === "bigint" && typeof stats.blksize === "bigint" ? Number(stats.blksize) : stats.blksize;
+    const dev = Number(stats.dev), ino = Number(stats.ino);
+    const snapshot = {
+        type: fileType(stats), size: Number(stats.size), mode: Number(stats.mode),
         ...(allocatedBytes === undefined ? {} : { allocatedBytes }),
-        ...(Number.isSafeInteger(stats.blksize) && stats.blksize > 0 ? { ioBlockSize: stats.blksize } : {}),
-        ...(Number.isSafeInteger(preferredIoBlockSize) && preferredIoBlockSize > 0 ? { preferredIoBlockSize } : {}),
-        atimeMs: stats.atimeMs, mtimeMs: stats.mtimeMs, ctimeMs: stats.ctimeMs,
-        birthtimeMs: stats.birthtimeMs, ino: stats.ino, dev: stats.dev,
-        ...(Number.isSafeInteger(stats.dev) && stats.dev >= 0 && Number.isSafeInteger(stats.ino) && stats.ino >= 0
+        ...(typeof blockSize === "number" && Number.isSafeInteger(blockSize) && blockSize > 0 ? { ioBlockSize: blockSize, preferredIoBlockSize: blockSize } : {}),
+        atimeMs: "atimeNs" in stats ? Number(stats.atimeNs / 1000000n) + Number(stats.atimeNs % 1000000n) / 1e6 : stats.atimeMs,
+        mtimeMs: "mtimeNs" in stats ? Number(stats.mtimeNs / 1000000n) + Number(stats.mtimeNs % 1000000n) / 1e6 : stats.mtimeMs,
+        ctimeMs: "ctimeNs" in stats ? Number(stats.ctimeNs / 1000000n) + Number(stats.ctimeNs % 1000000n) / 1e6 : stats.ctimeMs,
+        birthtimeMs: "birthtimeNs" in stats ? Number(stats.birthtimeNs / 1000000n) + Number(stats.birthtimeNs % 1000000n) / 1e6 : stats.birthtimeMs, ino, dev,
+        ...(Number.isSafeInteger(dev) && dev >= 0 && Number.isSafeInteger(ino) && ino >= 0
             ? { identityScope: Symbol.for("virtual-bash.fs.native") } : {}),
-        nlink: stats.nlink, uid: stats.uid, gid: stats.gid,
+        nlink: Number(stats.nlink), uid: Number(stats.uid), gid: Number(stats.gid),
     };
+    if ("ctimeNs" in stats && !stats.isDirectory())
+        Object.defineProperty(snapshot, "opaqueVersion", { value: `${stats.ctimeNs}:${stats.mtimeNs}`, enumerable: true });
+    return snapshot;
 }
 function integer(value, minimum = 0) {
     if (!Number.isSafeInteger(value) || value < minimum) {
@@ -92,9 +98,10 @@ export class RealFileSystem {
         rename: true, atomicRenameNoReplace: false, copy: true, exclusiveCopy: true, readlink: true, truncate: true,
         streamingAppend: true, randomAccessWrite: true,
         readOnly: false, symlinks: true, hardlinks: true, permissions: true,
-        timestamps: true, atomicRename: true, streamingRead: true, streamingWrite: true, retainedRead: true, retainedResize: true,
+        timestamps: true, atomicRename: true, streamingRead: true, streamingWrite: true, retainedRead: true, retainedResize: true, trustedOwnedStaging: true,
     });
     configuredRoot;
+    renameNoReplace;
     rootPromise;
     constructor(options) {
         const root = typeof options === "string" ? options : options.root;
@@ -106,6 +113,12 @@ export class RealFileSystem {
             throw new FsError("ENOTSUP", { syscall: "root", message: "this backend requires a POSIX host" });
         }
         this.configuredRoot = root;
+        this.renameNoReplace = typeof options === "string" ? undefined : options.renameNoReplace;
+        if (this.renameNoReplace !== undefined) {
+            if (typeof this.renameNoReplace !== "function")
+                throw new FsError("EINVAL", { syscall: "root", message: "renameNoReplace must be a function" });
+            this.capabilities = Object.freeze({ ...this.capabilities, atomicRenameNoReplace: true });
+        }
     }
     async root(options = {}) {
         options.signal?.throwIfAborted();
@@ -253,14 +266,223 @@ export class RealFileSystem {
         if (resolve(path) === root)
             throw new FsError("EBUSY", { message: "the filesystem root cannot be removed or replaced" });
     }
+    // These critical sections contain no await. They serialize with all JavaScript
+    // callers, under this adapter's existing trusted-host (externally isolated tree)
+    // boundary. They deliberately do not advertise the stronger atomic capabilities.
+    stagingSnapshot(path) {
+        try {
+            return fileStat(immediate.lstatSync(path, { bigint: true }));
+        }
+        catch (error) {
+            if (nativeError(error).code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    expectStaging(path, expected, identityOnly = false) {
+        if (expected && (expected.identityScope !== Symbol.for("virtual-bash.fs.native")
+            || expected.dev === undefined || expected.ino === undefined || !identityOnly && expected.opaqueVersion === undefined))
+            throw new FsError("ENOTSUP");
+        const current = this.stagingSnapshot(path);
+        if (expected === null ? current !== null : !current || current.dev !== expected.dev || current.ino !== expected.ino || current.type !== expected.type
+            || !identityOnly && (current.opaqueVersion !== expected.opaqueVersion || current.size !== expected.size || current.mode !== expected.mode || current.nlink !== expected.nlink))
+            throw new FsError("EAGAIN");
+        if (immediate.realpathSync(dirname(path)) !== dirname(path))
+            throw new FsError("EAGAIN");
+        return current;
+    }
+    stagingMetadata(options) {
+        if (options.mode !== undefined)
+            integer(options.mode);
+        for (const time of [options.atimeMs, options.mtimeMs])
+            if (time !== undefined && (!Number.isFinite(time) || Math.abs(time) > 8.64e15))
+                throw new FsError("EINVAL");
+    }
+    async createStagedFile(directoryPath, name, content, options) {
+        // Unlike operation(), this must return its receipt after commit even if the
+        // signal is aborted before the promise settles.
+        options.signal?.throwIfAborted();
+        try {
+            if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\0"))
+                throw new FsError("EINVAL");
+            this.stagingMetadata(options);
+            if (content.type === "file" && !(content.data instanceof Uint8Array))
+                throw new FsError("EINVAL");
+            const directory = await this.path(directoryPath, { ...options, followFinal: false, missing: "final" });
+            const root = await this.root(options);
+            const target = content.type === "symlink" ? (validatePath(content.target), isAbsolute(content.target) ? `${root}/${content.target.slice(1)}` : content.target) : undefined;
+            if (content.type === "symlink")
+                await this.walk(root, (isAbsolute(content.target) ? content.target.slice(1).split("/") : relative(root, directory).split("/").concat(content.target.split("/"))).map(name => ({ name, fromLink: true })), { ...options, checkTarget: true });
+            options.signal?.throwIfAborted();
+            this.protectTerminal(directoryPath);
+            this.expectStaging(dirname(directory), options.parent, true);
+            immediate.mkdirSync(directory, { mode: 0o700 });
+            const file = join(directory, name);
+            try {
+                if (content.type === "file") {
+                    const fd = immediate.openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, options.mode ?? 0o666);
+                    try {
+                        immediate.writeFileSync(fd, content.data);
+                        if (options.mode !== undefined)
+                            immediate.fchmodSync(fd, options.mode);
+                        if (options.atimeMs !== undefined || options.mtimeMs !== undefined) {
+                            const stat = immediate.fstatSync(fd);
+                            immediate.futimesSync(fd, (options.atimeMs ?? stat.atimeMs) / 1000, (options.mtimeMs ?? stat.mtimeMs) / 1000);
+                        }
+                    }
+                    finally {
+                        immediate.closeSync(fd);
+                    }
+                }
+                else
+                    immediate.symlinkSync(target, file);
+                const virtualDirectory = `/${relative(root, directory)}`;
+                const receipt = (path, host) => Object.freeze({ path, stat: Object.freeze(this.stagingSnapshot(host)) });
+                return Object.freeze({ parent: receipt(dirname(virtualDirectory), dirname(directory)), directory: receipt(virtualDirectory, directory), file: receipt(`${virtualDirectory}/${name}`, file) });
+            }
+            catch (error) {
+                // Only entries just acquired by this synchronous section can be removed.
+                if (immediate.existsSync(file))
+                    immediate.unlinkSync(file);
+                immediate.rmdirSync(directory);
+                throw error;
+            }
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            throw new FsError(nativeError(error).code, { syscall: "createStagedFile", path: directoryPath });
+        }
+    }
+    async stagingPaths(staging, options) {
+        const directory = await this.path(staging.directory.path, { ...options, followFinal: false });
+        const file = await this.path(staging.file.path, { ...options, followFinal: false, missing: "final" });
+        const parent = await this.path(staging.parent.path, { ...options, followFinal: false });
+        if (dirname(directory) !== parent || dirname(file) !== directory)
+            throw new FsError("EAGAIN");
+        return { directory, file, parent };
+    }
+    checkStaging(staging, paths) {
+        this.expectStaging(paths.parent, staging.parent.stat, true);
+        const directory = this.expectStaging(paths.directory, staging.directory.stat, true);
+        if (directory?.type !== "directory" || (directory.mode & 0o777) !== 0o700)
+            throw new FsError("EAGAIN");
+    }
+    async publishStagedFile(staging, destination, options) {
+        return this.operation("publishStagedFile", staging.file.path, options, async () => {
+            const paths = await this.stagingPaths(staging, options);
+            const target = await this.path(destination, { ...options, followFinal: false, missing: "final" });
+            options.signal?.throwIfAborted();
+            this.protectTerminal(destination);
+            this.checkStaging(staging, paths);
+            this.expectStaging(paths.file, staging.file.stat);
+            this.expectStaging(dirname(target), options.parent, true);
+            const existing = this.expectStaging(target, options.destination);
+            if (existing && (existing.type !== "file" || existing.nlink !== 1))
+                throw new FsError("EAGAIN");
+            if (target === paths.file || target === paths.directory || dirname(target) === paths.directory)
+                throw new FsError("EINVAL");
+            immediate.renameSync(paths.file, target);
+        }, destination);
+    }
+    async removeStagedFile(staging, options = {}) {
+        return this.operation("removeStagedFile", staging.directory.path, options, async () => {
+            const paths = await this.stagingPaths(staging, options);
+            options.signal?.throwIfAborted();
+            this.checkStaging(staging, paths);
+            const file = this.stagingSnapshot(paths.file);
+            if (file)
+                this.expectStaging(paths.file, staging.file.stat);
+            const children = immediate.readdirSync(paths.directory);
+            if (children.length !== (file ? 1 : 0) || file && children[0] !== basename(paths.file))
+                throw new FsError("ENOTEMPTY");
+            if (file)
+                immediate.unlinkSync(paths.file);
+            immediate.rmdirSync(paths.directory);
+        });
+    }
+    async writeFileConditional(path, data, options) {
+        options.signal?.throwIfAborted();
+        try {
+            if (!(data instanceof Uint8Array))
+                throw new FsError("EINVAL");
+            this.stagingMetadata(options);
+            const target = await this.path(path, { ...options, followFinal: false, missing: "final" });
+            options.signal?.throwIfAborted();
+            this.expectStaging(dirname(target), options.parent, true);
+            const existing = this.expectStaging(target, options.expected);
+            if (existing && (existing.type !== "file" || existing.nlink !== 1))
+                throw new FsError("EAGAIN");
+            const fd = immediate.openSync(target, constants.O_WRONLY | constants.O_NOFOLLOW | (existing ? 0 : constants.O_CREAT | constants.O_EXCL), options.mode ?? 0o666);
+            try {
+                if (!options.append)
+                    immediate.ftruncateSync(fd, 0);
+                let offset = options.append ? Number(immediate.fstatSync(fd).size) : 0;
+                let written = 0;
+                while (written < data.length) {
+                    const count = immediate.writeSync(fd, data, written, data.length - written, offset);
+                    if (count === 0)
+                        throw new FsError("EIO");
+                    written += count;
+                    offset += count;
+                }
+                if (options.mode !== undefined)
+                    immediate.fchmodSync(fd, options.mode);
+                return fileStat(immediate.fstatSync(fd, { bigint: true }));
+            }
+            finally {
+                immediate.closeSync(fd);
+            }
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            throw new FsError(nativeError(error).code, { syscall: "writeFileConditional", path });
+        }
+    }
+    async removeFileConditional(path, options) {
+        return this.operation("removeFileConditional", path, options, async () => {
+            const target = await this.path(path, { ...options, followFinal: false });
+            options.signal?.throwIfAborted();
+            this.expectStaging(dirname(target), options.parent, true);
+            const file = this.expectStaging(target, options.expected);
+            if (file?.type !== "file" || file.nlink !== 1)
+                throw new FsError("EAGAIN");
+            immediate.unlinkSync(target);
+        });
+    }
+    async prepareDirectory(path, options) {
+        options.signal?.throwIfAborted();
+        try {
+            this.stagingMetadata(options);
+            const target = await this.path(path, { ...options, followFinal: false, missing: "final" });
+            options.signal?.throwIfAborted();
+            this.protectTerminal(path);
+            this.expectStaging(dirname(target), options.parent, true);
+            const existing = this.expectStaging(target, options.expected, true);
+            if (existing && existing.type !== "directory")
+                throw new FsError("EAGAIN");
+            if (!existing)
+                immediate.mkdirSync(target, { mode: options.mode ?? 0o777 });
+            if (options.mode !== undefined)
+                immediate.chmodSync(target, options.mode);
+            if (options.atimeMs !== undefined || options.mtimeMs !== undefined) {
+                const stat = immediate.statSync(target);
+                immediate.utimesSync(target, (options.atimeMs ?? stat.atimeMs) / 1000, (options.mtimeMs ?? stat.mtimeMs) / 1000);
+            }
+            return this.stagingSnapshot(target);
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            throw new FsError(nativeError(error).code, { syscall: "prepareDirectory", path });
+        }
+    }
     open(path, options) {
         return openFileDescriptor(path, options, {
-            positionedRead: true, positionedWrite: true, truncate: true, synchronization: "storage",
+            noFollow: true, positionedRead: true, positionedWrite: true, truncate: true, synchronization: "storage",
         }, async (admitted) => {
             let handle;
             try {
                 const target = await this.path(path, {
-                    ...admitted, followFinal: admitted.creation !== "exclusive",
+                    ...admitted, followFinal: !admitted.noFollow && admitted.creation !== "exclusive",
                     ...(admitted.creation === "never" ? {} : { missing: "final" }),
                 });
                 let flags = (admitted.access === "read" ? constants.O_RDONLY : admitted.access === "write" ? constants.O_WRONLY : constants.O_RDWR)
@@ -271,7 +493,22 @@ export class RealFileSystem {
                     flags |= constants.O_EXCL;
                 if (admitted.append)
                     flags |= constants.O_APPEND;
-                handle = await native.open(target, flags, admitted.mode);
+                let created = false;
+                if (admitted.exactMode && admitted.creation !== "never") {
+                    try {
+                        handle = await native.open(target, flags | constants.O_EXCL, admitted.mode);
+                        created = true;
+                    }
+                    catch (error) {
+                        if (admitted.creation === "exclusive" || nativeError(error).code !== "EEXIST")
+                            throw error;
+                        handle = await native.open(target, flags & ~constants.O_CREAT, admitted.mode);
+                    }
+                }
+                else
+                    handle = await native.open(target, flags, admitted.mode);
+                if (created)
+                    await handle.chmod(admitted.mode);
                 admitted.signal?.throwIfAborted();
                 const stat = await handle.stat();
                 if (stat.isDirectory())
@@ -285,7 +522,7 @@ export class RealFileSystem {
                 handle = undefined;
                 return {
                     resource,
-                    stat: (retained, forwarded) => this.operation("fstat", path, forwarded, async () => fileStat(await retained.handle.stat())),
+                    stat: (retained, forwarded) => this.operation("fstat", path, forwarded, async () => fileStat(await retained.handle.stat({ bigint: true }))),
                     read: (retained, buffer, position, forwarded) => this.operation("read", path, forwarded, async () => (await retained.handle.read(buffer, 0, buffer.byteLength, position)).bytesRead),
                     write: (retained, buffer, position, forwarded) => this.operation("write", path, forwarded, async () => (await retained.handle.write(buffer, 0, buffer.byteLength, position)).bytesWritten),
                     truncate: (retained, length, forwarded) => this.operation("ftruncate", path, forwarded, () => retained.handle.truncate(length)),
@@ -335,14 +572,14 @@ export class RealFileSystem {
         return this.operation("stat", path, options, async () => {
             const target = await this.path(path, options);
             options.signal?.throwIfAborted();
-            return fileStat(await native.stat(target));
+            return fileStat(await native.stat(target, { bigint: true }));
         });
     }
     async lstat(path, options = {}) {
         return this.operation("lstat", path, options, async () => {
             const target = await this.path(path, { ...options, followFinal: false });
             options.signal?.throwIfAborted();
-            return fileStat(await native.lstat(target));
+            return fileStat(await native.lstat(target, { bigint: true }));
         });
     }
     async readdir(path, options = {}) {
@@ -381,6 +618,8 @@ export class RealFileSystem {
         return this.operation("mkdir", path, options, async () => {
             if (options.mode !== undefined)
                 integer(options.mode);
+            if (options.exactMode && options.recursive)
+                throw new FsError("ENOTSUP");
             const target = await this.path(path, {
                 ...options,
                 missing: "final", followFinal: !!options.recursive, deferTrailingSeparator: true,
@@ -388,6 +627,8 @@ export class RealFileSystem {
             });
             options.signal?.throwIfAborted();
             await native.mkdir(target, { recursive: options.recursive ?? false, ...(options.mode === undefined ? {} : { mode: options.mode }) });
+            if (options.exactMode)
+                await native.chmod(target, options.mode ?? 0o777);
         });
     }
     async rmdir(path, options = {}) {
@@ -427,7 +668,7 @@ export class RealFileSystem {
     }
     async rename(source, destination, options = {}) {
         return this.operation("rename", source, options, async () => {
-            if (options.noReplace)
+            if (options.noReplace && !this.renameNoReplace)
                 throw new FsError("ENOTSUP", { syscall: "rename", path: source, dest: destination });
             const from = await this.path(source, { ...options, followFinal: false });
             const to = await this.path(destination, { ...options, followFinal: false, missing: "final" });
@@ -437,7 +678,10 @@ export class RealFileSystem {
             this.protectRoot(from, root);
             this.protectRoot(to, root);
             options.signal?.throwIfAborted();
-            await native.rename(from, to);
+            if (options.noReplace)
+                await this.renameNoReplace(from, to, options.signal ? { signal: options.signal } : {});
+            else
+                await native.rename(from, to);
         }, destination);
     }
     async copyFile(source, destination, options = {}) {
@@ -641,7 +885,7 @@ export class RealFileSystem {
         };
         return {
             stat(options = {}) {
-                return perform(options, "fstat", async () => fileStat(await handle.stat()));
+                return perform(options, "fstat", async () => fileStat(await handle.stat({ bigint: true })));
             },
             async truncate(length, options = {}) {
                 assertOpen(options, "ftruncate");
@@ -762,7 +1006,7 @@ export class RealFileSystem {
         };
         return {
             stat(options = {}) {
-                return perform(options, "fstat", async () => fileStat(await handle.stat()));
+                return perform(options, "fstat", async () => fileStat(await handle.stat({ bigint: true })));
             },
             async read(position, maxBytes, options = {}) {
                 assertOpen(options, "read");

package/dist/safe-fs/fs/s3/filesystem.d.ts

@@ -14,6 +14,12 @@ export interface S3FileSystemOptions {
     readonly maxReadBytes?: number;
     readonly maxStreamBytes?: number;
     readonly maxListEntries?: number;
+    /** Aggregate budgets for each rm operation, including ancestor inspection. */
+    readonly removalLimits?: {
+        readonly maxRequests?: number;
+        readonly maxListEntries?: number;
+        readonly maxDeleteObjects?: number;
+    };
 }
 export declare class S3RenameError extends FsError {
     readonly phase: "copy" | "delete";
@@ -68,6 +74,8 @@ export declare class S3FileSystem implements FileSystem {
     private readonly maxReadBytes;
     private readonly maxStreamBytes;
     private readonly maxListEntries;
+    private readonly removalLimits;
+    private readonly removalBudgets;
     constructor(options: S3FileSystemOptions);
     compareEntry(path: string, peer: FileSystem, peerPath: string, options?: FsOptions): Promise<EntryComparison>;
     private path;

package/dist/safe-fs/fs/s3/filesystem.js

@@ -82,6 +82,8 @@ export class S3FileSystem {
     maxReadBytes;
     maxStreamBytes;
     maxListEntries;
+    removalLimits;
+    removalBudgets = new WeakMap();
     constructor(options) {
         if (!options?.transport || ["headObject", "getObject", "putObject", "deleteObject", "copyObject", "listObjectsV2"]
             .some((method) => typeof options.transport[method] !== "function")) {
@@ -105,9 +107,14 @@ export class S3FileSystem {
         this.bucket = options.bucket;
         this.allowRename = options.allowNonAtomicRename ?? true;
         this.pageSize = validateLimit(options.pageSize ?? 1000, "pageSize", 1, 1000);
-        this.maxReadBytes = validateLimit(options.maxReadBytes ?? 64 * 1024 * 1024, "maxReadBytes", 0);
-        this.maxStreamBytes = validateLimit(options.maxStreamBytes ?? 5_000_000_000, "maxStreamBytes", 0, 5_000_000_000);
-        this.maxListEntries = validateLimit(options.maxListEntries ?? 100_000, "maxListEntries", 1);
+        this.maxReadBytes = options.maxReadBytes === undefined ? Infinity : validateLimit(options.maxReadBytes, "maxReadBytes", 0);
+        this.maxStreamBytes = options.maxStreamBytes === undefined ? Infinity : validateLimit(options.maxStreamBytes, "maxStreamBytes", 0);
+        this.maxListEntries = options.maxListEntries === undefined ? Infinity : validateLimit(options.maxListEntries, "maxListEntries", 1);
+        this.removalLimits = {
+            maxRequests: validateLimit(options.removalLimits?.maxRequests ?? 32, "removalLimits.maxRequests", 1),
+            maxListEntries: validateLimit(options.removalLimits?.maxListEntries ?? 32, "removalLimits.maxListEntries", 1),
+            maxDeleteObjects: validateLimit(options.removalLimits?.maxDeleteObjects ?? 16, "removalLimits.maxDeleteObjects", 1),
+        };
         this.capabilities = Object.freeze({
             open: false,
             read: true, stat: true, readdir: true, realpath: true, access: true,
@@ -182,6 +189,10 @@ export class S3FileSystem {
     }
     async call(syscall, path, options, action, precondition) {
         this.checkAbort(options, syscall, path);
+        const budget = this.removalBudgets.get(options);
+        if (budget && ++budget.requests > this.removalLimits.maxRequests) {
+            fail("EFBIG", "rm", path, "S3 removal request budget exceeded");
+        }
         let onAbort;
         try {
             const pending = action();
@@ -254,11 +265,19 @@ export class S3FileSystem {
             mtimeMs: timestamp("virtual-bash-mtime", modified), atimeMs: timestamp("virtual-bash-atime", 0), ctimeMs: modified };
     }
     async page(prefix, path, options, delimiter, token, maxKeys = this.pageSize) {
+        const budget = this.removalBudgets.get(options);
+        if (budget)
+            maxKeys = Math.min(maxKeys, this.removalLimits.maxListEntries - budget.entries + 1);
         const result = await this.call("listObjectsV2", path, options, () => this.transport.listObjectsV2({
             Bucket: this.bucket, Prefix: prefix, MaxKeys: maxKeys,
             ...(delimiter === undefined ? {} : { Delimiter: delimiter }),
             ...(token === undefined ? {} : { ContinuationToken: token }),
         }, this.requestOptions(options)));
+        if (budget) {
+            budget.entries += (result.Contents?.length ?? 0) + (result.CommonPrefixes?.length ?? 0);
+            if (budget.entries > this.removalLimits.maxListEntries)
+                fail("EFBIG", "rm", path, "S3 removal listing budget exceeded");
+        }
         for (const item of result.Contents ?? []) {
             if (typeof item.Key !== "string" || !item.Key.startsWith(prefix))
                 fail("EIO", "listObjectsV2", path, "transport returned an object outside the requested prefix");
@@ -376,8 +395,11 @@ export class S3FileSystem {
         return this.stat(path, options);
     }
     async body(output, path, options) {
-        const limit = Math.min(this.maxReadBytes, validateLimit(options.maxBytes ?? this.maxReadBytes, "maxBytes", 0));
+        const limit = Math.min(this.maxReadBytes, options.maxBytes === undefined ? this.maxReadBytes : validateLimit(options.maxBytes, "maxBytes", 0));
+        let iterator;
         return this.call("readFile", path, options, async () => {
+            if (output.Body && Symbol.asyncIterator in output.Body)
+                iterator = output.Body[Symbol.asyncIterator]();
             if (output.ContentLength !== undefined && output.ContentLength > limit)
                 fail("EFBIG", "readFile", path);
             const body = output.Body;
@@ -390,7 +412,7 @@ export class S3FileSystem {
                 bytes = new Uint8Array(body);
             }
             else if (Symbol.asyncIterator in body) {
-                bytes = await collectBytes(body, { maxBytes: limit, ...(options.signal ? { signal: options.signal } : {}) });
+                bytes = await collectBytes({ [Symbol.asyncIterator]: () => iterator }, { ...(limit === Infinity ? {} : { maxBytes: limit }), ...(options.signal ? { signal: options.signal } : {}) });
             }
             else if ("transformToByteArray" in body) {
                 const converted = await body.transformToByteArray();
@@ -407,7 +429,8 @@ export class S3FileSystem {
                 fail("EIO", "readFile", path, "response body length does not match ContentLength");
             return bytes;
         }).catch((error) => {
-            this.dispose(output.Body);
+            this.dispose(iterator);
+            this.dispose(output.Body, iterator === undefined);
             throw error;
         });
     }
@@ -416,13 +439,17 @@ export class S3FileSystem {
     }
     async readFile(input, options = {}) {
         const path = this.path(input);
-        validateLimit(options.maxBytes ?? this.maxReadBytes, "maxBytes", 0);
+        if (options.maxBytes !== undefined)
+            validateLimit(options.maxBytes, "maxBytes", 0);
         const info = await this.stat(input, options);
         if (info.type === "directory")
             fail("EISDIR", "readFile", path);
         if (info.size > Math.min(this.maxReadBytes, options.maxBytes ?? this.maxReadBytes))
             fail("EFBIG", "readFile", path);
-        return this.body(await this.get(path, options), path, options);
+        const output = this.capabilities.streamingRead
+            ? await this.call("getObject", path, options, () => this.transport.getObjectStream({ Bucket: this.bucket, Key: this.key(path) }, this.requestOptions(options)))
+            : await this.get(path, options);
+        return this.body(output, path, options);
     }
     etag(metadata, path) {
         if (!metadata?.ETag)
@@ -594,6 +621,10 @@ export class S3FileSystem {
         }
     }
     async rm(input, options = {}) {
+        // A distinct options object keeps concurrent and nested operations isolated.
+        options = { ...options };
+        const budget = { requests: 0, entries: 0 };
+        this.removalBudgets.set(options, budget);
         const path = this.path(input);
         this.writable(path);
         if (path === "/")
@@ -613,9 +644,25 @@ export class S3FileSystem {
                 return;
             fail("ENOENT", "rm", path);
         }
-        const objects = info.stat.type === "directory" ? await this.tree(path, options) : [{ Key: this.key(path) }];
-        if (info.stat.type === "directory" && !options.recursive && objects.some((item) => item.Key !== this.directoryKey(path)))
-            fail("ENOTEMPTY", "rm", path);
+        let objects;
+        if (info.stat.type === "directory" && !options.recursive) {
+            const prefix = this.directoryKey(path);
+            objects = [];
+            for await (const page of this.pages(prefix, path, options, undefined, 2)) {
+                if (page.Contents?.some(item => item.Key !== prefix))
+                    fail("ENOTEMPTY", "rm", path);
+                if (page.Contents?.length)
+                    objects = [{ Key: prefix }];
+            }
+        }
+        else {
+            objects = info.stat.type === "directory" ? await this.tree(path, options) : [{ Key: this.key(path) }];
+        }
+        // Reserve the complete mutation phase before issuing any deletes.
+        if (objects.length > this.removalLimits.maxDeleteObjects
+            || budget.requests + objects.length > this.removalLimits.maxRequests) {
+            fail("EFBIG", "rm", path, "S3 removal delete or request budget exceeded; use bounded batches");
+        }
         for (const item of objects) {
             await this.call("deleteObject", path, options, () => this.transport.deleteObject({ Bucket: this.bucket, Key: item.Key }, this.requestOptions(options)));
         }
@@ -1008,7 +1055,7 @@ export class S3FileSystem {
             const limit = Math.min(this.maxReadBytes, this.maxStreamBytes);
             if (previous.length > limit)
                 fail("EFBIG", "writeStream", path);
-            const bytes = await this.call("writeStream", path, options, () => collectBytes(source, { maxBytes: limit - previous.length, ...options }));
+            const bytes = await this.call("writeStream", path, options, () => collectBytes(source, { ...(limit === Infinity ? {} : { maxBytes: limit - previous.length }), ...options }));
             const body = new Uint8Array(previous.length + bytes.length);
             body.set(previous);
             body.set(bytes, previous.length);

package/dist/safe-fs/fs/s3/http/request.d.ts

@@ -4,7 +4,7 @@ export interface RequestScope {
     readonly signal: AbortSignal;
     readonly finish: () => void;
 }
-export declare function scopeFor(signal: AbortSignal | undefined, timeout: number): RequestScope;
+export declare function scopeFor(signal: AbortSignal | undefined, timeout: number | undefined): RequestScope;
 export declare function abortable<Value>(pending: Promise<Value>, signal: AbortSignal): Promise<Value>;
 export interface WireResponse {
     readonly message: IncomingMessage;

package/dist/safe-fs/fs/s3/http/request.js

@@ -8,7 +8,7 @@ export function scopeFor(signal, timeout) {
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted)
         abort();
-    const timer = setTimeout(() => controller.abort(new S3ServiceError("RequestTimeout", 408)), timeout);
+    const timer = timeout === undefined ? undefined : setTimeout(() => controller.abort(new S3ServiceError("RequestTimeout", 408)), timeout);
     return {
         signal: controller.signal,
         finish: () => { clearTimeout(timer); signal?.removeEventListener("abort", abort); },

package/dist/safe-fs/fs/s3/http/transport.js

@@ -4,8 +4,10 @@ import { abortable, collect, limitedBody, scopeFor, sendRequest } from "./reques
 import { canonicalQuery, headerValue, invalid, signRequest, uriEncode } from "./signature.js";
 import { children, integer, malformed, parseXml, text, timestamp } from "./xml.js";
 const empty = new Uint8Array();
-function limit(value, fallback, name, maximum = 1024 * 1024 * 1024) {
-    const result = value ?? fallback;
+function limit(value, fallback, name, maximum = Number.MAX_SAFE_INTEGER) {
+    if (value === undefined)
+        return fallback;
+    const result = value;
     if (!Number.isSafeInteger(result) || result < 1 || result > maximum)
         invalid(`invalid ${name}`);
     return result;
@@ -161,10 +163,10 @@ export function createS3HttpTransport(options) {
         invalid("unsupported LIST URL encoding");
     if (addressing === "virtual-hosted" && (isIP(endpoint.hostname.replace(/^\[|\]$/g, "")) || endpoint.hostname === "localhost"))
         invalid("virtual-hosted addressing requires a DNS endpoint");
-    const maxPut = limit(options.maxPutBytes, 64 * 1024 * 1024, "maxPutBytes");
-    const maxGet = limit(options.maxGetBytes, 64 * 1024 * 1024, "maxGetBytes");
-    const maxXml = limit(options.maxXmlBytes, 4 * 1024 * 1024, "maxXmlBytes", 16 * 1024 * 1024);
-    const timeout = limit(options.requestTimeoutMs, 30_000, "requestTimeoutMs", 2_147_483_647);
+    const maxPut = limit(options.maxPutBytes, Infinity, "maxPutBytes");
+    const maxGet = limit(options.maxGetBytes, Infinity, "maxGetBytes");
+    const maxXml = limit(options.maxXmlBytes, Infinity, "maxXmlBytes");
+    const timeout = options.requestTimeoutMs === undefined ? undefined : limit(options.requestTimeoutMs, 0, "requestTimeoutMs", 2_147_483_647);
     const enabledCopy = boolean(options.enableCopy, true, "enableCopy");
     const verified = options.verifiedConditionalOperations;
     const conditionalPut = boolean(verified?.put, false, "verifiedConditionalOperations.put");

package/dist/safe-fs/fs/s3/http/xml.d.ts

@@ -4,7 +4,10 @@ export interface XmlNode {
     text: string;
 }
 export declare function malformed(message?: string): never;
-export declare function parseXml(bytes: Uint8Array): XmlNode;
+export declare function parseXml(bytes: Uint8Array, limits?: {
+    maxNodes?: number;
+    maxDepth?: number;
+}): XmlNode;
 export declare function children(node: XmlNode, name: string): XmlNode[];
 export declare function text(node: XmlNode, name: string, required?: boolean): string | undefined;
 export declare function integer(value: string): number;