@poe-platform/safe-fs 0.1.799 → 0.1.801

package/dist/safe-fs/fs/s3/http/request.js

@@ -1,8 +1,6 @@
 import { concatBytes } from "./bytes.js";
-import { once } from "node:events";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
 import { S3ServiceError } from "../transport.js";
+export { sendRequest } from "#safe-fs-s3-request";
 export function scopeFor(signal, timeout) {
     const controller = new AbortController();
     const abort = () => controller.abort(signal?.reason);
@@ -31,112 +29,6 @@ export async function abortable(pending, signal) {
             signal.removeEventListener("abort", abort);
     }
 }
-export async function sendRequest(options, body, scope, factory) {
-    const signal = scope.signal;
-    signal.throwIfAborted();
-    return new Promise((resolve, reject) => {
-        let request;
-        let response;
-        let headersReceived = false;
-        let finished = false;
-        const cleanup = () => {
-            signal.removeEventListener("abort", abort);
-            scope.finish();
-        };
-        const close = () => {
-            if (finished)
-                return;
-            finished = true;
-            cleanup();
-            response?.destroy();
-            request?.destroy();
-        };
-        const fail = (error) => {
-            reject(signal.aborted ? signal.reason : error);
-            close();
-        };
-        const abort = () => fail(signal.reason);
-        signal.addEventListener("abort", abort, { once: true });
-        try {
-            const create = factory ?? (options.protocol === "https:" ? httpsRequest : httpRequest);
-            request = create(options, message => {
-                response = message;
-                message.on("error", () => { });
-                if (finished || signal.aborted) {
-                    close();
-                    message.destroy();
-                    return;
-                }
-                headersReceived = true;
-                message.once("close", cleanup);
-                let claimed = false;
-                const source = {
-                    [Symbol.asyncIterator]() {
-                        if (claimed)
-                            throw new S3ServiceError("InvalidResponse", 502, "response body is single-use");
-                        claimed = true;
-                        const iterator = message[Symbol.asyncIterator]();
-                        let ended = false;
-                        return {
-                            async next() {
-                                try {
-                                    signal.throwIfAborted();
-                                    if (ended)
-                                        return { done: true, value: undefined };
-                                    const result = await abortable(iterator.next(), signal);
-                                    signal.throwIfAborted();
-                                    if (result.done) {
-                                        ended = true;
-                                        if (!message.complete)
-                                            throw new S3ServiceError("InvalidResponse", 502, "incomplete HTTP response");
-                                        close();
-                                        return { done: true, value: undefined };
-                                    }
-                                    if (!(result.value instanceof Uint8Array))
-                                        throw new S3ServiceError("InvalidResponse", 502, "nonbinary HTTP body");
-                                    return { done: false, value: new Uint8Array(result.value) };
-                                }
-                                catch (error) {
-                                    ended = true;
-                                    close();
-                                    throw signal.aborted ? signal.reason : error;
-                                }
-                            },
-                            async return() {
-                                ended = true;
-                                close();
-                                return { done: true, value: undefined };
-                            },
-                        };
-                    },
-                };
-                resolve({ message, body: source, close });
-            });
-            request.on("error", fail);
-            request.once("close", () => {
-                if (!headersReceived)
-                    fail(new S3ServiceError("InvalidResponse", 502, "connection closed before response headers"));
-            });
-            if (signal.aborted || finished) {
-                abort();
-                request.destroy();
-                return;
-            }
-            void (async () => {
-                for (let offset = 0; offset < body.length; offset += 64 * 1024) {
-                    signal.throwIfAborted();
-                    if (!request.write(body.subarray(offset, offset + 64 * 1024)))
-                        await once(request, "drain", { signal });
-                }
-                signal.throwIfAborted();
-                request.end();
-            })().catch(fail);
-        }
-        catch (error) {
-            fail(error);
-        }
-    });
-}
 export function limitedBody(response, maximum, expected) {
     if (expected !== undefined && expected > maximum) {
         response.close();

package/dist/safe-fs/fs/s3/http/signature.js

@@ -1,4 +1,6 @@
-import { createHash, createHmac } from "node:crypto";
+import { sha256 as hash } from "@noble/hashes/sha2.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 import { S3ServiceError } from "../transport.js";
 export function invalid(message) {
     throw new S3ServiceError("InvalidArgument", 400, message);
@@ -20,7 +22,7 @@ export function canonicalQuery(entries) {
         .map(([name, value]) => `${name}=${value}`).join("&");
 }
 export function sha256(bytes) {
-    return createHash("sha256").update(bytes).digest("hex");
+    return bytesToHex(hash(typeof bytes === "string" ? utf8ToBytes(bytes) : bytes));
 }
 export function headerValue(value) {
     if (typeof value !== "string" || /[^\x20-\x7e\t]/.test(value))
@@ -63,10 +65,10 @@ export function signRequest(input) {
         names.map(name => `${name}:${headers[name]}\n`).join(""), signedHeaders, payloadHash].join("\n");
     const scope = `${date}/${input.region}/s3/aws4_request`;
     const stringToSign = ["AWS4-HMAC-SHA256", timestamp, scope, sha256(canonicalRequest)].join("\n");
-    let key = createHmac("sha256", `AWS4${credentials.secretAccessKey}`).update(date).digest();
+    let key = hmac(hash, utf8ToBytes(`AWS4${credentials.secretAccessKey}`), utf8ToBytes(date));
     for (const part of [input.region, "s3", "aws4_request"])
-        key = createHmac("sha256", key).update(part).digest();
-    const signature = createHmac("sha256", key).update(stringToSign).digest("hex");
+        key = hmac(hash, key, utf8ToBytes(part));
+    const signature = bytesToHex(hmac(hash, key, utf8ToBytes(stringToSign)));
     headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
     if (Object.entries(headers).reduce((size, [name, value]) => size + name.length + value.length + 4, 0) > 16 * 1024)
         invalid("request headers exceed 16 KiB");

package/dist/safe-fs/fs/s3/http/transport.js

@@ -1,5 +1,4 @@
 import { concatBytes } from "./bytes.js";
-import { isIP } from "node:net";
 import { S3ServiceError } from "../transport.js";
 import { abortable, collect, limitedBody, scopeFor, sendRequest } from "./request.js";
 import { canonicalQuery, headerValue, invalid, signRequest, uriEncode } from "./signature.js";
@@ -35,9 +34,13 @@ function boolean(value, fallback, name) {
         invalid(`invalid ${name}`);
     return value ?? fallback;
 }
+function isIPv4(value) {
+    const parts = value.split(".");
+    return parts.length === 4 && parts.every(part => String(Number(part)) === part && Number(part) >= 0 && Number(part) <= 255);
+}
 function bucketName(bucket) {
     if (typeof bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket)
-        || bucket.includes("..") || bucket.includes(".-") || bucket.includes("-.") || isIP(bucket))
+        || bucket.includes("..") || bucket.includes(".-") || bucket.includes("-.") || isIPv4(bucket))
         invalid("expected a standard S3 bucket name");
 }
 function objectKey(key) {
@@ -179,7 +182,7 @@ export function createS3HttpTransport(options) {
     const listEncoding = options.listUrlEncoding ?? "percent";
     if (listEncoding !== "percent" && listEncoding !== "form")
         invalid("unsupported LIST URL encoding");
-    if (addressing === "virtual-hosted" && (isIP(endpoint.hostname.replace(/^\[|\]$/g, "")) || endpoint.hostname === "localhost"))
+    if (addressing === "virtual-hosted" && (endpoint.hostname.includes(":") || isIPv4(endpoint.hostname) || endpoint.hostname === "localhost"))
         invalid("virtual-hosted addressing requires a DNS endpoint");
     const maxPut = limit(options.maxPutBytes, Infinity, "maxPutBytes");
     const maxGet = limit(options.maxGetBytes, Infinity, "maxGetBytes");

package/dist/safe-fs/fs/s3/namespace.js

@@ -18,7 +18,7 @@ export async function createS3NamespaceFileSystem(options) {
         throw new TypeError('An explicit S3 bucket and manifest key are required');
     const maxBytes = limit(options.maxBytes);
     const maxEntries = limit(options.maxEntries);
-    const maxManifestBytes = limit(options.maxManifestBytes ?? 4 * 1024 * 1024);
+    const maxManifestBytes = options.maxManifestBytes === Infinity ? Infinity : limit(options.maxManifestBytes);
     const maxAttempts = limit(options.maxAttempts);
     const descriptorOptions = options;
     for (const key of ['chunkBytes', 'maxStagedBytes', 'maxStagedPages', 'maxFileBytes', 'maxOpenFiles']) {

package/dist/safe-fs/fs/scoped.js

@@ -537,8 +537,8 @@ export function scopeFileSystem(filesystem, charge, signal, cleanupCharge = char
 }
 export function retainFileSystemCleanup(filesystem, cleanupCallback, options) {
     const maximum = options?.maxOperations ?? Infinity;
-    if (options?.maxOperations !== undefined && (!Number.isSafeInteger(maximum) || maximum < 0))
-        throw new RangeError("cleanup maxOperations must be a nonnegative safe integer");
+    if (maximum !== Infinity && (!Number.isSafeInteger(maximum) || maximum < 0))
+        throw new RangeError("cleanup maxOperations must be a nonnegative safe integer or Infinity");
     if (typeof cleanupCallback !== "function")
         throw new TypeError("cleanup callback must be a function");
     const scope = originals.get(filesystem);

package/dist/safe-fs/fs/webdav/webdav.d.ts

@@ -29,6 +29,8 @@ export interface WebDavFileSystemOptions {
     readonly maxResponseBytes?: number;
     /** Metadata response ceiling before decoding/parsing; unlimited unless configured. */
     readonly maxXmlBytes?: number;
+    /** Timestamp property UTF-8 byte ceiling; unlimited unless configured. */
+    readonly maxTimestampPropertyBytes?: number;
     readonly maxEntries?: number;
     /** XML structure ceilings; unlimited unless configured. */
     readonly xmlLimits?: Pick<XmlLimits, "maxNodes" | "maxContentNodes" | "maxDepth" | "maxAttributes">;
@@ -80,6 +82,7 @@ export declare class WebDavFileSystem implements FileSystem {
     private readonly headers;
     private readonly maxResponseBytes;
     private readonly maxXmlBytes;
+    private readonly maxTimestampPropertyBytes;
     private readonly maxEntries;
     private readonly xmlLimits;
     private readonly timeoutMs;

package/dist/safe-fs/fs/webdav/webdav.js

@@ -6,16 +6,15 @@ import { admitDirectoryEntries, directoryEntryLimit } from "../directory-admissi
 import { assertCallbackAuthorityAllowed, compareEntries, registerEntryAuthority } from "../mount/comparison.js";
 import { compareWebDavResources, ownedResponseIdentifier, recordOwnedResourceStat, registerResourceQuery, resourceIdentifier } from "./resource-id.js";
 const timestampNamespace = "urn:virtual-bash:metadata";
-const maxTimestampPropertyBytes = 4096;
 /** Admit only five scalar members before native JSON parsing can allocate a graph. */
-function preflightTimestamps(property) {
+function preflightTimestamps(property, maxTimestampPropertyBytes) {
     // Check the untrimmed text first; counting UTF-8 bytes does not allocate an encoded copy.
     let bytes = 0;
     for (const point of property.text) {
         const code = point.codePointAt(0);
         bytes += code <= 0x7f ? 1 : code <= 0x7ff ? 2 : code <= 0xffff ? 3 : 4;
         if (bytes > maxTimestampPropertyBytes)
-            throw new Error("timestamp property exceeds 4KiB limit");
+            throw new Error("timestamp property exceeds byte limit");
     }
     const text = scalar(property);
     let offset = 0;
@@ -233,6 +232,7 @@ export class WebDavFileSystem {
     headers;
     maxResponseBytes;
     maxXmlBytes;
+    maxTimestampPropertyBytes;
     maxEntries;
     xmlLimits;
     timeoutMs;
@@ -290,6 +290,7 @@ export class WebDavFileSystem {
             streamingAppend: this.requestStreamSupport !== false,
         });
         this.maxResponseBytes = options.maxResponseBytes === undefined ? Infinity : positive(options.maxResponseBytes, "maxResponseBytes", false, true);
+        this.maxTimestampPropertyBytes = positive(options.maxTimestampPropertyBytes ?? Infinity, "maxTimestampPropertyBytes", true, true);
         this.maxXmlBytes = options.maxXmlBytes === undefined ? Infinity : positive(options.maxXmlBytes, "maxXmlBytes", false, true);
         this.xmlLimits = Object.freeze({ ...options.xmlLimits });
         for (const [name, value] of Object.entries(this.xmlLimits))
@@ -714,7 +715,7 @@ export class WebDavFileSystem {
         let mtimeMs = date("getlastmodified") ?? 0;
         let atimeMs = 0;
         if (timestampProperty) {
-            const timestamps = JSON.parse(preflightTimestamps(timestampProperty));
+            const timestamps = JSON.parse(preflightTimestamps(timestampProperty, this.maxTimestampPropertyBytes));
             if (typeof timestamps !== "object" || timestamps === null
                 || !("version" in timestamps) || timestamps.version !== 1
                 || !("etag" in timestamps) || typeof timestamps.etag !== "string" || !/^"[\x21\x23-\x7e\x80-\xff]*"$/.test(timestamps.etag)

package/dist/xml-ast/index.d.ts

@@ -26,6 +26,8 @@ export interface XmlElement extends XmlName {
     readonly epilog?: readonly XmlContent[];
 }
 export interface XmlLimits {
+    /** Opt-in best-effort parsing; each repaired syntax error is reported. DTDs remain forbidden. */
+    readonly recover?: (message: string) => void;
     readonly expectedEncoding?: "UTF-8" | "UTF-16" | "UTF-16LE" | "UTF-16BE";
     readonly retainContent?: boolean;
     readonly maxDepth?: number;

package/dist/xml-ast/index.js

@@ -74,7 +74,7 @@ function qualifiedNameSync(name, cache) {
     }
     return parts;
 }
-function* entities(text) {
+function* entities(text, recover) {
     let result = "";
     let offset = 0;
     while (offset < text.length) {
@@ -83,8 +83,12 @@ function* entities(text) {
             return result + text.slice(offset);
         result += text.slice(offset, start);
         const end = yield* find(text, ";", start + 1);
-        if (end < 0)
-            invalid("unterminated entity");
+        if (end < 0) {
+            if (!recover)
+                invalid("unterminated entity");
+            recover("unterminated entity");
+            return result + text.slice(start + 1);
+        }
         const entity = text.slice(start + 1, end);
         const predefined = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
         if (Object.hasOwn(predefined, entity))
@@ -92,8 +96,13 @@ function* entities(text) {
         else {
             const hexadecimal = entity.startsWith("#x");
             const digits = entity.slice(hexadecimal ? 2 : 1);
-            if (!entity.startsWith("#") || !digits.length)
-                invalid("undeclared entity");
+            if (!entity.startsWith("#") || !digits.length) {
+                if (!recover)
+                    invalid("undeclared entity");
+                recover("undeclared entity");
+                offset = end + 1;
+                continue;
+            }
             let point = 0;
             for (let index = 0; index < digits.length; index++) {
                 const code = digits.charCodeAt(index);
@@ -255,27 +264,42 @@ export function* parseXmlSteps(input, limits = {}) {
             throw new XmlLimitError("maxContentNodes", "XML content node limit exceeded");
     };
     let pendingWork = 0;
-    const skipWhitespace = () => {
+    const skipWhitespace = function* () {
         const start = offset;
         while (offset < source.length) {
             const c = source.charCodeAt(offset);
             if (c !== 32 && c !== 9 && c !== 10 && c !== 13)
                 break;
             offset++;
+            pendingWork++;
+            if (pendingWork >= 512) {
+                yield 512;
+                pendingWork -= 512;
+            }
         }
         return offset - start;
     };
-    const scanName = () => {
+    const scanName = function* () {
         const start = offset;
         while (offset < source.length) {
             const c = source.charCodeAt(offset);
             if (c === 32 || c === 9 || c === 13 || c === 10 || c === 47 || c === 61 || c === 62 || c === 63)
                 break;
             offset++;
+            pendingWork++;
+            if (pendingWork >= 512) {
+                yield 512;
+                pendingWork -= 512;
+            }
         }
         const name = source.slice(start, offset);
+        pendingWork += offset - start;
+        while (pendingWork >= 512) {
+            yield 512;
+            pendingWork -= 512;
+        }
         const [prefix, localName] = qualifiedNameSync(name, qualifiedNames);
-        return [name, prefix, localName, (offset - start) * 2];
+        return [name, prefix, localName];
     };
     while (offset < source.length) {
         pendingWork += 1;
@@ -296,7 +320,7 @@ export function* parseXmlSteps(input, limits = {}) {
             }
             if (text.indexOf("]]>") >= 0)
                 invalid("CDATA terminator in text");
-            const resolved = stack.length ? (text.indexOf("&") < 0 ? (pendingWork += text.length, text) : yield* entities(text)) : text;
+            const resolved = stack.length ? (text.indexOf("&") < 0 ? (pendingWork += text.length, text) : yield* entities(text, limits.recover)) : text;
             while (pendingWork >= 512) {
                 yield 512;
                 pendingWork -= 512;
@@ -313,11 +337,15 @@ export function* parseXmlSteps(input, limits = {}) {
             }
             else {
                 for (let index = 0; index < resolved.length; index++) {
+                    pendingWork++;
+                    if (pendingWork >= 512) {
+                        yield 512;
+                        pendingWork -= 512;
+                    }
                     const c = resolved.charCodeAt(index);
                     if (c !== 32 && c !== 9 && c !== 13 && c !== 10)
                         invalid("text outside the root");
                 }
-                pendingWork += resolved.length;
                 while (pendingWork >= 512) {
                     yield 512;
                     pendingWork -= 512;
@@ -362,8 +390,7 @@ export function* parseXmlSteps(input, limits = {}) {
         else if (source.startsWith("<?", offset)) {
             const start = offset;
             offset += 2;
-            const [target, , , wName] = scanName();
-            pendingWork += wName;
+            const [target] = yield* scanName();
             while (pendingWork >= 512) {
                 yield 512;
                 pendingWork -= 512;
@@ -406,25 +433,29 @@ export function* parseXmlSteps(input, limits = {}) {
         }
         else if (source.charCodeAt(offset + 1) === 47) {
             offset += 2;
-            const [name, , , wName] = scanName();
-            pendingWork += wName + skipWhitespace();
+            const [name] = yield* scanName();
+            yield* skipWhitespace();
             while (pendingWork >= 512) {
                 yield 512;
                 pendingWork -= 512;
             }
-            if (source[offset++] !== ">" || stack.pop()?.name !== name)
-                invalid("mismatched closing tag");
+            if (source[offset++] !== ">" || stack.pop()?.name !== name) {
+                if (!limits.recover)
+                    invalid("mismatched closing tag");
+                limits.recover("mismatched closing tag");
+            }
         }
         else {
             offset++;
             const repeated = previousEmpty && source.startsWith(previousEmpty.suffix, offset) ? previousEmpty : undefined;
-            const [name, prefix, localName, wName] = repeated
-                ? [repeated.name, repeated.prefix, repeated.localName, repeated.name.length * 2]
-                : scanName();
+            const [name, prefix, localName] = repeated
+                ? [repeated.name, repeated.prefix, repeated.localName]
+                : (yield* scanName());
             if (repeated)
                 offset += name.length;
             // Preserve scan/validation work while reusing the admitted spelling.
-            pendingWork += wName;
+            if (repeated)
+                pendingWork += name.length * 2;
             while (pendingWork >= 512) {
                 yield 512;
                 pendingWork -= 512;
@@ -434,19 +465,17 @@ export function* parseXmlSteps(input, limits = {}) {
             let namespaces = stack.at(-1)?.namespaces ?? new Map([["xml", xmlNamespace]]);
             let ownsNamespaces = stack.length === 0;
             while (!repeated) {
-                const ws = skipWhitespace();
-                pendingWork += ws;
+                const ws = (yield* skipWhitespace());
                 while (pendingWork >= 512) {
                     yield 512;
                     pendingWork -= 512;
                 }
                 const ch = source.charCodeAt(offset);
-                if (ch === 47 || ch === 62)
+                if (ch === 47 || ch === 62 || limits.recover && offset === source.length)
                     break;
                 if (ws === 0)
                     invalid("attributes require whitespace");
-                const [attribute, attrPrefix, attrLocal, wAttr] = scanName();
-                pendingWork += wAttr;
+                const [attribute, attrPrefix, attrLocal] = yield* scanName();
                 while (pendingWork >= 512) {
                     yield 512;
                     pendingWork -= 512;
@@ -457,10 +486,10 @@ export function* parseXmlSteps(input, limits = {}) {
                     throw new XmlLimitError("maxAttributes", "XML attribute limit exceeded");
                 if ((attributes?.size ?? 0) >= maxAttributesPerElement)
                     throw new XmlLimitError("maxAttributesPerElement", "XML attribute limit exceeded");
-                pendingWork += skipWhitespace();
+                yield* skipWhitespace();
                 if (source[offset++] !== "=")
                     invalid("missing attribute equals");
-                pendingWork += skipWhitespace();
+                yield* skipWhitespace();
                 const quote = source[offset++];
                 if (quote !== '"' && quote !== "'")
                     invalid("unquoted attribute");
@@ -482,7 +511,7 @@ export function* parseXmlSteps(input, limits = {}) {
                 if (raw.indexOf("<") >= 0)
                     invalid("less-than in attribute");
                 const normalized = /[\t\n\r]/.test(raw) ? raw.replace(/[\t\n\r]/g, " ") : raw;
-                const value = normalized.indexOf("&") < 0 ? (pendingWork += normalized.length, normalized) : yield* entities(normalized);
+                const value = normalized.indexOf("&") < 0 ? (pendingWork += normalized.length, normalized) : yield* entities(normalized, limits.recover);
                 while (pendingWork >= 512) {
                     yield 512;
                     pendingWork -= 512;
@@ -571,8 +600,11 @@ export function* parseXmlSteps(input, limits = {}) {
             const empty = source[offset] === "/";
             if (empty)
                 offset++;
-            if (source[offset++] !== ">")
-                invalid("unterminated start tag");
+            if (source[offset++] !== ">") {
+                if (!limits.recover)
+                    invalid("unterminated start tag");
+                limits.recover("unterminated start tag");
+            }
             // Only cache compact, attribute-free spellings. Namespace resolution and
             // every admission counter still run for each distinct physical element.
             if (empty && !attributes && name.length <= 512 && source.slice(offset - name.length - 3, offset) === `<${name}/>`)
@@ -585,8 +617,13 @@ export function* parseXmlSteps(input, limits = {}) {
         yield pendingWork;
         pendingWork = 0;
     }
-    if (stack.length || !root)
+    if (!root)
         invalid("incomplete document");
+    if (stack.length) {
+        if (!limits.recover)
+            invalid("incomplete document");
+        limits.recover("incomplete document");
+    }
     return root;
 }
 export function parseXml(input, limits = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-fs",
-  "version": "0.1.799",
+  "version": "0.1.801",
   "description": "Composable filesystem with a portable core and explicit Node adapters",
   "type": "module",
   "license": "MIT",
@@ -133,9 +133,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@types/node": "^25.2.2"
+    "@types/node": "^25.2.2",
+    "@noble/hashes": "2.4.0"
   },
   "imports": {
+    "#safe-fs-s3-request": {
+      "types": "./dist/safe-fs/fs/s3/http/request-node.d.ts",
+      "workerd": "./dist/safe-fs/fs/s3/http/request-fetch.js",
+      "browser": "./dist/safe-fs/fs/s3/http/request-fetch.js",
+      "default": "./dist/safe-fs/fs/s3/http/request-node.js"
+    },
     "#safe-fs-platform": {
       "types": {
         "workerd": "./dist/safe-fs/platform/browser.d.ts",