@poe-platform/safe-fs 0.1.799 → 0.1.801

package/README.md

@@ -1,6 +1,8 @@
 # safe-fs
 
-An asynchronous filesystem interface for memory, rooted host directories, S3, and WebDAV, with mounts, copy-on-write overlays, and Node-style bridges.
+An asynchronous filesystem interface for memory, rooted host directories, S3, and WebDAV, with mounts, copy-on-write overlays, and Node-style bridges. Portable filesystem types and POSIX helpers compile without Node types.
+
+Under `workerd` and `browser` conditions, the root export includes portable filesystems, `S3FileSystem`, and `MockS3Client`. Supply an S3 transport to use object storage without Node globals.
 
 ## Quickstart
 
@@ -44,7 +46,7 @@ To create new outputs with Safe Bash's `dos2unix`, `unix2dos`, or compression co
 | `@poe-platform/safe-fs` | Full Node API; selects the portable core under the `browser` and `workerd` conditions. |
 | `@poe-platform/safe-fs/core` | Memory, mounts, overlays, read-only, WebDAV, portable bridges, types, and errors. Bundle with the `browser` condition for browsers and Workers. |
 | `@poe-platform/safe-fs/node` | Host filesystem, Node bridge, S3, and configuration helpers; unavailable in browsers. |
-| `@poe-platform/safe-fs/fs/*` | Individual adapters: `memory`, `readonly`, `mount`, `overlay`, `webdav`, `real`, `s3`, and `s3/http`. S3 and its mock accept an injected transport in browsers and Workers; `s3/http` is Node-only. |
+| `@poe-platform/safe-fs/fs/*` | Individual adapters: `memory`, `readonly`, `mount`, `overlay`, `webdav`, `real`, `s3`, and `s3/http`. S3, its mock, and the signed `s3/http` transport work in browsers and Workers. |
 
 ```ts
 import { createMemoryFileSystem, FsError, type FileSystem } from "@poe-platform/safe-fs/core";
@@ -111,12 +113,17 @@ advertising `retainedStagingCleanup` accept `createStagedFile(..., { parent,
 retainCleanup: true })`. Use the returned `staging.cleanup.remove()` and always
 call `staging.cleanup.close()` in `finally`. Memory and its supported wrappers
 retain only the owned staging entries; replacement entries remain protected.
+Overlays backed by stock Memory filesystems support conditional file mutations,
+directory preparation, and confined staging. Publication may omit `ancestors`
+when the destination shares the staging parent; the overlay checks the ancestry
+retained before staging began.
 See the [staging contract](src/contracts/filesystem.md#atomic-owned-staging).
 
 Capture `retainFileSystemCleanup(scoped, callback, { maxOperations })` before
 cancellation to clean up through a bounded view after ordinary scoped operations
 close. Cleanup preserves its owning scope and limits across separately bundled
 command runtimes, including restrictions added by filesystem wrappers.
+Omit `maxOperations` or pass `Infinity` for unlimited cleanup operations.
 
 | Backend or wrapper | Use it for |
 | --- | --- |
@@ -246,7 +253,7 @@ There are no package environment variables, implicit credentials, or automatic `
 
 | API | Options and defaults |
 | --- | --- |
-| `createFileSystem(config, { registry })` | Required `config.type`; `config.options` defaults to an empty record. `registry` is required. Built-in `memory` accepts optional file, retained-byte, metadata and total-byte quotas; built-in `real` requires `root`. |
+| `createFileSystem(config, { registry })` | Required `config.type`; `config.options` defaults to an empty record. `registry` is required. Built-in `memory` accepts optional file, retained-byte, metadata, total-byte, `maxPathBytes` and `maxPathComponents` quotas (omitted, `undefined`, or `Infinity` disables each quota); built-in `real` requires `root`. |
 | `createNodeFileSystemAdapterRegistry(extensions?)` | Optional map of additional adapter descriptors; defaults to only `memory` and `real`. |
 | Memory / read-only | Memory accepts independent optional `maxFileBytes`, `maxRetainedBytes`, `maxMetadataUnits` and `maxBytes` quotas, all unlimited by default. Read-only takes the backing filesystem, without an options object. |
 | Real | Required `root`: existing absolute host directory; the constructor/factory also accepts the root string directly. |
@@ -271,9 +278,11 @@ Every raw filesystem operation accepts an optional `signal`. Additional fields a
 | `copyFile` | `exclusive` (default false) |
 | `readStream` | `start` (default 0), `endExclusive` (default end of file), `chunkSize` (built-in default 64 KiB) |
 
+`validatePath(path, { maxPathBytes, maxPathComponents })` accepts optional UTF-8 byte and component quotas; both default to `Infinity`. Memory accepts the same constructor options and counts cumulative symlink expansion. Device operations accept these quotas under `pathLimits`. WebDAV accepts `maxTimestampPropertyBytes` for timestamp metadata, also unlimited by default.
+
 `access` takes a separate mode bitmask from `ACCESS_MODES`. `chmod` takes a mode, `utimes` takes millisecond timestamps, and `truncate` takes a byte length (default 0). For conditional chmod, check `capabilitiesFor(path, { conditionalChmod: true })` (or `capabilities`) and require `conditionalChmod: true`; supply `parent`, `expected`, and complete root-to-parent `ancestors` together. An optional mutation-free `commitGuard` must return literal `true` synchronously. Memory validates at its metadata commit; mount and supported Memory overlays preserve wrapper ancestry. Real uses its existing externally isolated host-tree boundary and does not prevent races with other processes. Backend limits still apply. Node-shaped bridge methods translate their own options rather than accepting these raw option objects; see the [bridge signatures](src/bridge/filesystem.ts).
 
-`collectBytes(source, { maxBytes, maxMemoryBytes, signal })` snapshots streamed chunks into one growing buffer. `maxBytes` and `maxMemoryBytes` accept explicit `Infinity`. `maxMemoryBytes` limits owned capacity, the current input's full backing buffer, and overlapping allocations during growth; exhaustion throws `EFBIG`. Collection limits are disabled by default on Node, browser, and Worker targets. The returned view may retain geometric spare capacity. Configured budgets cover collection, not caller-retained results, transport buffering, archive decoding, strings, or the rest of the runtime; use streaming APIs and limit concurrent workloads for larger inputs.
+`collectBytes(source, { maxBytes, maxMemoryBytes, signal })` snapshots streamed chunks into one growing buffer. `maxBytes` and `maxMemoryBytes` accept explicit `Infinity`. `maxMemoryBytes` limits owned capacity, the current input's full backing buffer, and overlapping allocations during growth; exhaustion throws `EFBIG`. Collection limits are disabled by default on Node, browser, and Worker targets. Each call owns its budget; concurrent collections do not consume one another’s allowance. The returned view may retain geometric spare capacity. Configured budgets cover collection, not caller-retained results, transport buffering, archive decoding, strings, or the rest of the runtime; use streaming APIs and limit concurrent workloads for larger inputs.
 
 <details>
 <summary>S3 filesystem and HTTP transport options</summary>
@@ -336,7 +345,7 @@ Each batch lists from the beginning because previous keys have been deleted; it
 | `enableCopy` | `true`; disabling uses a buffered GET/PUT fallback |
 | `verifiedConditionalOperations` | Optional `put`, `copy`, `delete` booleans, each defaulting to false; enable only after verifying the server's semantics |
 | `clock` | Current date/time function, used for signing |
-| `request` | Optional Node HTTP request factory; defaults to the built-in HTTP(S) client |
+| `request` | Optional Node HTTP request factory; Node defaults to HTTP(S), browsers and Workers use global fetch |
 
 </details>
 
@@ -369,10 +378,10 @@ See the [binding types](src/fs/webdav/webdav.ts) before implementing atomic dire
 ## Safety boundary and limitations
 
 - **Not an OS sandbox.** Rooted storage and bridge confinement check paths and symlinks, but checks and host operations can race concurrent changes. Use a separate OS isolation boundary for hostile workloads. A custom adapter or transport is trusted code with its own host authority.
-- **A read-only view is not an immutable store.** Mount views serialize guest symlink, rename, and removal operations against active path operations. Finish or close read streams before awaiting these namespace changes. Other references can still change the backing filesystem; this coordination applies only to operations through the same mount view. Overlay reads require retained handles and stable object and ancestor identities; unsupported backends or changed read admission fail with `ENOTSUP`. Overlays with two stock MemoryFileSystem layers support race-safe patch publication and confined directory creation/removal. Publication checks both layers, retains logical directory identity across copy-up, and leaves lower bytes intact; wrapped or customized layers remain unsupported. Overlays are not transactions; cancellation and cleanup do not guarantee rollback. Cross-mount rename can fail with `EXDEV`.
+- **A read-only view is not an immutable store.** Mount views serialize guest symlink, rename, and removal operations against active path operations. Finish or close read streams before awaiting these namespace changes. Other references can still change the backing filesystem; this coordination applies only to operations through the same mount view. Overlay reads require retained handles and stable object and ancestor identities; unsupported backends or changed read admission fail with `ENOTSUP`. Overlays with two stock MemoryFileSystem layers support race-safe patch publication, conditional file writes/removal, no-replace rename, and confined directory creation/removal and file writes. Compression file output, `mv -n`, `sed -i`, and ssconvert work with these layers. Upper-file writes retain file identity; lower-file writes copy up without changing lower bytes. Publication checks both layers, retains logical directory identity across copy-up, and leaves lower bytes intact; wrapped or customized layers remain unsupported. Overlays are not transactions; cancellation and cleanup do not guarantee rollback. Cross-mount rename can fail with `EXDEV`.
 - **Remote storage is not a POSIX disk.** S3 and WebDAV do not provide hardlinks or symlinks. S3 rename is non-atomic and may leave partial copies/deletions; `S3RenameError` reports the phase and affected keys. Strong empty-only removal and conditional writes depend on backend support, not a prior listing.
 - **The bridges are partial Node compatibility layers.** No synchronous/callback API, file handles, watchers, bigint stats, flush/retry support, or `cp` dereference/timestamp-preservation options. Missing optional operations fail rather than being approximated with destructive alternatives.
-- **Browser support is filesystem-only.** The `browser` and `workerd` export conditions select the portable surface: memory, mounts, overlays, read-only, WebDAV, and the codec-based bridge. S3 is available through `fs/s3` with an explicit transport, including its portable mock. Real storage, the Node bridge, and the configuration registry are not browser exports. WebDAV still needs server CORS support; no OPFS or directory-handle adapter is included. This does not make the SafeJS runtime browser-compatible.
+- **Browser support is filesystem-only.** The `browser` and `workerd` export conditions select the portable surface: memory, mounts, overlays, read-only, WebDAV, and the codec-based bridge. S3 is available through `fs/s3` with an explicit transport, including its portable mock and `fs/s3/http`. The HTTP transport uses fetch in browsers and Workers and requires server CORS support in browsers. Fetch rejects keys containing dot segments that the URL parser would normalize, and never follows redirects. Node request factories are only supported in Node. Real storage, the Node bridge, and the configuration registry are not browser exports. WebDAV still needs server CORS support; no OPFS or directory-handle adapter is included. This does not make the SafeJS runtime browser-compatible.
 - **Portable temporary names require secure randomness.** Browser overlay staging and portable bridge `mkdtemp` require `crypto.randomUUID` or `crypto.getRandomValues`; without either, they fail with `ENOTSUP` rather than use `Math.random`.
 - **Allocation and identity may be unknown.** Optional `FileStat.allocatedBytes` is provider-reported allocation, not logical length or reclaimable space. Do not infer identity from size, timestamps, or inode numbers across unrelated backends.
 

package/dist/safe-fs/contracts/filesystem.d.ts

@@ -105,6 +105,8 @@ export interface FileSystemCapabilities {
     readonly [capability: string]: boolean | undefined;
 }
 export interface FsOptions {
+    /** Optional virtual device path traversal quotas; disabled by default. */
+    readonly pathLimits?: import("./virtual-path.js").PathLimits;
     readonly signal?: AbortSignal;
 }
 export interface ChmodOptions extends FsOptions {

package/dist/safe-fs/contracts/io.js

@@ -1,6 +1,5 @@
 import { FsError } from "./errors.js";
 import { finishCleanup } from "./cleanup.js";
-import { platform } from "#safe-fs-platform";
 let sharedTextEncoder;
 const EMPTY_BYTES = new Uint8Array(0);
 const DONE_RESULT = Object.freeze({ done: true, value: undefined });
@@ -63,7 +62,6 @@ export function toByteSource(input) {
     const bytes = typeof input === "string" ? (sharedTextEncoder ??= new TextEncoder()).encode(input) : new Uint8Array(input);
     return new SingleChunkByteSource(bytes);
 }
-let activeCollectionBytes = 0;
 export async function collectBytes(source, options) {
     if (options.maxBytes !== undefined && options.maxBytes !== Infinity && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0)) {
         throw new RangeError("maxBytes must be a nonnegative safe integer");
@@ -77,46 +75,38 @@ export async function collectBytes(source, options) {
     let buffer = new Uint8Array(0);
     let size = 0;
     function reserve(bytes) {
-        if (bytes > memoryLimit - reserved || bytes > platform.maxCollectionBytes - activeCollectionBytes) {
+        if (bytes > memoryLimit - reserved) {
             throw new FsError("EFBIG", { syscall: "collectBytes", message: "collection exceeds memory budget" });
         }
         reserved += bytes;
-        activeCollectionBytes += bytes;
     }
-    try {
-        options.signal?.throwIfAborted();
-        for await (const chunk of readBytes(source, options.signal)) {
-            activeCollectionBytes -= inputBytes;
-            reserved -= inputBytes;
-            inputBytes = 0;
-            if (chunk.byteLength > (options.maxBytes ?? Infinity) - size) {
-                throw new FsError("EFBIG", { syscall: "collectBytes", message: "output exceeds maxBytes" });
-            }
-            // A small view can retain a large backing buffer. Keep this reservation
-            // while awaiting the next chunk, including while its source is suspended.
-            reserve(chunk.buffer.byteLength);
-            inputBytes = chunk.buffer.byteLength;
-            const nextSize = size + chunk.byteLength;
-            if (nextSize > buffer.byteLength) {
-                const capacity = Math.min(options.maxBytes ?? Infinity, Math.max(nextSize, buffer.byteLength * 2));
-                // Admit both generations before allocation. Do not fall back to repeated
-                // exact-size growth when geometric growth exceeds the budget.
-                reserve(capacity);
-                const replacement = new Uint8Array(capacity);
-                replacement.set(buffer.subarray(0, size));
-                activeCollectionBytes -= buffer.byteLength;
-                reserved -= buffer.byteLength;
-                buffer = replacement;
-            }
-            buffer.set(chunk, size);
-            size = nextSize;
+    options.signal?.throwIfAborted();
+    for await (const chunk of readBytes(source, options.signal)) {
+        reserved -= inputBytes;
+        inputBytes = 0;
+        if (chunk.byteLength > (options.maxBytes ?? Infinity) - size) {
+            throw new FsError("EFBIG", { syscall: "collectBytes", message: "output exceeds maxBytes" });
         }
-        options.signal?.throwIfAborted();
-        return buffer.subarray(0, size);
-    }
-    finally {
-        activeCollectionBytes -= reserved;
+        // A small view can retain a large backing buffer. Keep this reservation
+        // while awaiting the next chunk, including while its source is suspended.
+        reserve(chunk.buffer.byteLength);
+        inputBytes = chunk.buffer.byteLength;
+        const nextSize = size + chunk.byteLength;
+        if (nextSize > buffer.byteLength) {
+            const capacity = Math.min(options.maxBytes ?? Infinity, Math.max(nextSize, buffer.byteLength * 2));
+            // Admit both generations before allocation. Do not fall back to repeated
+            // exact-size growth when geometric growth exceeds the budget.
+            reserve(capacity);
+            const replacement = new Uint8Array(capacity);
+            replacement.set(buffer.subarray(0, size));
+            reserved -= buffer.byteLength;
+            buffer = replacement;
+        }
+        buffer.set(chunk, size);
+        size = nextSize;
     }
+    options.signal?.throwIfAborted();
+    return buffer.subarray(0, size);
 }
 async function abortable(operation, signal) {
     signal?.throwIfAborted();

package/dist/safe-fs/contracts/path.d.ts

@@ -1,8 +1,3 @@
-import { posix } from "#safe-fs-platform-path";
 export { assertPathWithin, isPathWithin, normalizePath, relativePath, resolvePath, validatePath } from "./virtual-path.js";
-export declare const posixPath: typeof posix;
-export declare const basename: typeof posix.basename;
-export declare const dirname: typeof posix.dirname;
-export declare const extname: typeof posix.extname;
-export declare const joinPath: typeof posix.join;
-export declare const isAbsolutePath: typeof posix.isAbsolute;
+export { posixPath, basename, dirname, extname, joinPath, isAbsolutePath } from "./portable-path.js";
+export type { PathLimits } from "./virtual-path.js";

package/dist/safe-fs/contracts/path.js

@@ -1,8 +1,2 @@
-import { posix } from "#safe-fs-platform-path";
 export { assertPathWithin, isPathWithin, normalizePath, relativePath, resolvePath, validatePath } from "./virtual-path.js";
-export const posixPath = posix;
-export const basename = posix.basename;
-export const dirname = posix.dirname;
-export const extname = posix.extname;
-export const joinPath = posix.join;
-export const isAbsolutePath = posix.isAbsolute;
+export { posixPath, basename, dirname, extname, joinPath, isAbsolutePath } from "./portable-path.js";

package/dist/safe-fs/contracts/virtual-path.d.ts

@@ -1,6 +1,11 @@
-export declare const MAX_PATH_BYTES = 65536;
-export declare const MAX_PATH_COMPONENTS = 2048;
-export declare function validatePath(path: string, maxComponents?: number): void;
+export declare const MAX_PATH_BYTES: number;
+export declare const MAX_PATH_COMPONENTS: number;
+export interface PathLimits {
+    readonly maxPathBytes?: number | undefined;
+    readonly maxPathComponents?: number | undefined;
+}
+export declare function pathByteLength(path: string): number;
+export declare function validatePath(path: string, limits?: PathLimits | number): void;
 export declare function resolvePath2(cwd: string, path0: string): string;
 export declare function resolvePath(cwd: string, ...paths: string[]): string;
 export declare function normalizePath(path: string, cwd?: string): string;

package/dist/safe-fs/contracts/virtual-path.js

@@ -1,14 +1,31 @@
 import { FsError } from "./errors.js";
-export const MAX_PATH_BYTES = 65_536;
-export const MAX_PATH_COMPONENTS = 2048;
-export function validatePath(path, maxComponents = MAX_PATH_COMPONENTS) {
+export const MAX_PATH_BYTES = Infinity;
+export const MAX_PATH_COMPONENTS = Infinity;
+export function pathByteLength(path) {
+    let bytes = 0;
+    for (const point of path) {
+        const code = point.codePointAt(0);
+        bytes += code <= 0x7f ? 1 : code <= 0x7ff ? 2 : code <= 0xffff ? 3 : 4;
+    }
+    return bytes;
+}
+export function validatePath(path, limits = {}) {
+    const maxBytes = typeof limits === "number" ? Infinity : limits.maxPathBytes ?? Infinity;
+    const maxComponents = typeof limits === "number" ? limits : limits.maxPathComponents ?? Infinity;
+    for (const value of [maxBytes, maxComponents]) {
+        if (value !== Infinity && (!Number.isSafeInteger(value) || value < 0)) {
+            throw new RangeError("Path limits must be nonnegative safe integers or Infinity");
+        }
+    }
     if (typeof path !== "string" || path.includes("\0")) {
         throw new FsError("EINVAL", { syscall: "resolve", message: "paths must be strings without NUL bytes" });
     }
-    if (path.length > MAX_PATH_BYTES) {
+    if (maxBytes !== Infinity && pathByteLength(path) > maxBytes) {
         throw new FsError("ENAMETOOLONG", { syscall: "resolve", path });
     }
-    const limit = Math.min(maxComponents, MAX_PATH_COMPONENTS);
+    if (maxComponents === Infinity)
+        return;
+    const limit = maxComponents;
     let components = 0;
     let inComponent = false;
     for (let i = 0; i < path.length; i++) {

package/dist/safe-fs/core.d.ts

@@ -24,3 +24,4 @@ export type { XmlName, XmlAttribute, XmlContent, XmlElement, XmlLimits } from ".
 export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export { bindConditionalMutation, type ConditionalMutationBinding } from "./fs/memory/index.js";
+export * from "./fs/s3/index.js";

package/dist/safe-fs/core.js

@@ -20,3 +20,4 @@ export { parseXml, parseXmlSteps, XmlLimitError } from "./xml.js";
 export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export { bindConditionalMutation } from "./fs/memory/index.js";
+export * from "./fs/s3/index.js";

package/dist/safe-fs/fs/devices/path.js

@@ -1,5 +1,5 @@
 import { FsError, isFsError } from "../../contracts/errors.js";
-import { MAX_PATH_COMPONENTS, validatePath } from "../../contracts/virtual-path.js";
+import { pathByteLength, validatePath } from "../../contracts/virtual-path.js";
 import { capturePathNamespace, pathNamespace } from "../path-namespace.js";
 import { isCleanAbsolutePath, tryResolveMemoryDevicePath } from "../memory/index.js";
 export const nullPath = "/dev/null";
@@ -23,20 +23,20 @@ export function lexicalDevicePath(path) {
     return `/${parts.join("/")}`;
 }
 async function resolveResizeDevicePath(filesystem, path, options, create, namespace, traversal) {
-    validatePath(path);
+    validatePath(path, options.pathLimits);
     const components = (value) => {
         const result = value.split("/").filter(Boolean);
         if (value.endsWith("/"))
             result.push("");
         return result;
     };
-    const pending = components(path);
-    let remainingComponents = MAX_PATH_COMPONENTS - pending.length;
+    let pending = components(path);
+    let remainingComponents = (options.pathLimits?.maxPathComponents ?? Infinity) - pending.length;
     if (remainingComponents < 0)
         throw new FsError("ENAMETOOLONG", { path });
     const parts = [];
     let links = 0;
-    let expanded = path.length;
+    let expanded = pathByteLength(path);
     let boundary;
     while (pending.length) {
         options.signal?.throwIfAborted();
@@ -99,9 +99,9 @@ async function resolveResizeDevicePath(filesystem, path, options, create, namesp
                     throw new FsError("ELOOP", { path });
                 const target = await Reflect.apply(readlink, filesystem, [candidate, options]);
                 options.signal?.throwIfAborted();
-                validatePath(target);
-                expanded += target.length;
-                if (expanded > 65536)
+                validatePath(target, options.pathLimits);
+                expanded += pathByteLength(target);
+                if (expanded > (options.pathLimits?.maxPathBytes ?? Infinity))
                     throw new FsError("ENAMETOOLONG", { path });
                 if (target.startsWith("/"))
                     parts.splice(0, parts.length, ...(boundary ?? "/").split("/").filter(Boolean));
@@ -111,7 +111,7 @@ async function resolveResizeDevicePath(filesystem, path, options, create, namesp
                 if (targetParts.length > remainingComponents)
                     throw new FsError("ENAMETOOLONG", { path });
                 remainingComponents -= targetParts.length;
-                pending.unshift(...targetParts);
+                pending = targetParts.concat(pending);
                 continue;
             }
         }
@@ -141,7 +141,8 @@ function exceedsComponentByteLimit(value) {
 }
 export async function resolveDevicePath(filesystem, path, options, followFinal = true, resizeCreate, traversal) {
     options.signal?.throwIfAborted();
-    if (Reflect.get(filesystem, pathNamespace) === undefined) {
+    validatePath(path, options.pathLimits);
+    if (options.pathLimits === undefined && Reflect.get(filesystem, pathNamespace) === undefined) {
         const fast = tryResolveMemoryDevicePath(filesystem, path, resizeCreate);
         if (fast !== undefined)
             return fast;
@@ -155,13 +156,13 @@ export async function resolveDevicePath(filesystem, path, options, followFinal =
     const aliases = typeof lstat === "function";
     if (!aliases && lexical !== nullPath && lexical !== deviceDirectory && lexical !== "/")
         return lexical;
-    const pending = path.split("/");
-    let remainingComponents = MAX_PATH_COMPONENTS - pending.filter(Boolean).length;
+    let pending = path.split("/");
+    let remainingComponents = (options.pathLimits?.maxPathComponents ?? Infinity) - pending.filter(Boolean).length;
     if (remainingComponents < 0)
         throw new FsError("ENAMETOOLONG", { path });
     const parts = [];
     let links = 0;
-    let expanded = path.length;
+    let expanded = pathByteLength(path);
     let absolute = path.startsWith("/");
     let traversalFailure;
     let failedDepth = Infinity;
@@ -218,9 +219,9 @@ export async function resolveDevicePath(filesystem, path, options, followFinal =
                     throw new FsError("ELOOP", { path });
                 const target = await Reflect.apply(readlink, filesystem, [lookup, options]);
                 options.signal?.throwIfAborted();
-                validatePath(target);
-                expanded += target.length;
-                if (expanded > 65536)
+                validatePath(target, options.pathLimits);
+                expanded += pathByteLength(target);
+                if (expanded > (options.pathLimits?.maxPathBytes ?? Infinity))
                     throw new FsError("ENAMETOOLONG", { path });
                 const targetSplit = target.split("/");
                 const nonEmptyCount = targetSplit.filter(Boolean).length;
@@ -232,7 +233,7 @@ export async function resolveDevicePath(filesystem, path, options, followFinal =
                     absolute = true;
                     failedDepth = Infinity;
                 }
-                pending.unshift(...targetSplit);
+                pending = targetSplit.concat(pending);
                 continue;
             }
             if (stat && pending.length && stat.type !== "directory") {