@poe-platform/safe-fs 0.1.802 → 0.1.804

package/README.md

@@ -1,6 +1,6 @@
 # safe-fs
 
-An asynchronous filesystem interface for memory, rooted host directories, S3, and WebDAV, with mounts, copy-on-write overlays, and Node-style bridges. Portable filesystem types and POSIX helpers compile without Node types.
+An asynchronous filesystem interface for memory, rooted host directories, S3, and WebDAV, with mounts, copy-on-write overlays, and Node-style bridges. Portable filesystem types and POSIX helpers compile without Node types. The `posixPath` export from `@poe-code/safe-fs/core` provides `basename`, `dirname`, `extname`, `join`, `isAbsolute`, `normalize`, `resolve`, `relative`, `sep`, and `delimiter`; `resolve` and `relative` use `/` as their working directory in every runtime.
 
 Under `workerd` and `browser` conditions, the root export includes portable filesystems, `S3FileSystem`, and `MockS3Client`. Supply an S3 transport to use object storage without Node globals.
 
@@ -86,14 +86,26 @@ cause. Preserve cancellation/control exceptions separately. Cross-family
 
 All required methods must exist, but a backend may reject an operation with `FsError`, such as `EROFS` for a write or `ENOTSUP` for unsupported semantics. Check optional methods and `capabilities` rather than assuming every backend behaves like a local disk. Errors expose `code` and may include `syscall`, `path`, `dest`, and `cause`.
 
+`readBytes` supports frozen host abort signals. The exported
+`listenForAbort(signal, listener)` returns a cleanup function for custom
+operations; if frozen host bookkeeping prevents registration, callers must
+check cancellation at operation boundaries, as `readBytes` does.
+
 `createDeviceFileSystem(fs)` adds portable `/dev/null` whole-file, stream, and descriptor I/O. Descriptor reads return EOF and writes discard bytes; stat remains a zero-size character device and descriptor position remains zero. Truncating opens are accepted, exclusive creation fails with `EEXIST`, and descriptor resizing and synchronization are unsupported. Access modes, cancellation, and closed handles use the normal descriptor checks. With an authoritative object store, use `createDeviceFileSystem(withObjectFileDescriptors(fs, store))` so null-device I/O never acquires or publishes an object version; ordinary files retain conditional publication. The device wrapper must be outermost for this composition.
 
+`PythonStatTranslator` and `createPythonRuntimeStatMapper` allocate stable guest device
+identities without a default device-count budget. Their optional `maxDevices` accepts
+`Infinity` or a positive safe integer. Explicit budgets remain enforced; device numbers
+must still fit the disjoint application/runtime ranges of the uint32 Python stat ABI.
+
 `withObjectFileDescriptors(fs, store)` supports large shell and Python descriptor
 writes when the host supplies `store.createStaging`: private externally backed
 pages keep working memory bounded without publishing the growing file after
 every write. Conditional publication still occurs at sync/close, and retained
 readers keep their old versions. Without that optional backend primitive, the
-optional dirty-page budget limits unflushed output only when configured. See the
+optional dirty-page budget limits unflushed output only when configured. Descriptor
+resource limits accept `Infinity` and are unlimited when omitted; `chunkBytes`
+remains a positive finite integer. See the
 [object descriptor and spill contract](src/contracts/object-publication.md) for
 backend methods, failure semantics and qualification; no provider storage is
 configured automatically.
@@ -270,7 +282,8 @@ Every raw filesystem operation accepts an optional `signal`. Additional fields a
 
 | Operation | Options |
 | --- | --- |
-| `readFile` | `maxBytes`: upper bound on collected bytes |
+| `readFile` | `maxBytes`: nonnegative safe-integer byte cap; `Infinity` adds no per-read cap |
+| `readdir` | `maxEntries`: nonnegative safe-integer entry cap; omission or `Infinity` preserves backend limits and ordering |
 | `writeFile`, `writeStream` | `flag`: `w` (default, replace), `wx` (exclusive create), `a` (append), or `ax` (exclusive append/create); optional `mode` |
 | `appendFile` | Optional `mode` |
 | `mkdir` | `recursive` (default false); optional `mode` |
@@ -278,7 +291,7 @@ Every raw filesystem operation accepts an optional `signal`. Additional fields a
 | `copyFile` | `exclusive` (default false) |
 | `readStream` | `start` (default 0), `endExclusive` (default end of file), `chunkSize` (built-in default 64 KiB) |
 
-`validatePath(path, { maxPathBytes, maxPathComponents })` accepts optional UTF-8 byte and component quotas; both default to `Infinity`. Memory accepts the same constructor options and counts cumulative symlink expansion. Device operations accept these quotas under `pathLimits`. WebDAV accepts `maxTimestampPropertyBytes` for timestamp metadata, also unlimited by default.
+`validatePath(path, { maxPathBytes, maxPathComponents })` accepts optional UTF-8 byte and component quotas; both default to `Infinity`. Memory accepts the same constructor options and counts cumulative symlink expansion. Device operations and WebDAV stat, access, and writes accept these quotas under `pathLimits`. WebDAV accepts `maxTimestampPropertyBytes` for timestamp metadata, also unlimited by default.
 
 `access` takes a separate mode bitmask from `ACCESS_MODES`. `chmod` takes a mode, `utimes` takes millisecond timestamps, and `truncate` takes a byte length (default 0). For conditional chmod, check `capabilitiesFor(path, { conditionalChmod: true })` (or `capabilities`) and require `conditionalChmod: true`; supply `parent`, `expected`, and complete root-to-parent `ancestors` together. An optional mutation-free `commitGuard` must return literal `true` synchronously. Memory validates at its metadata commit; mount and supported Memory overlays preserve wrapper ancestry. Real uses its existing externally isolated host-tree boundary and does not prevent races with other processes. Backend limits still apply. Node-shaped bridge methods translate their own options rather than accepting these raw option objects; see the [bridge signatures](src/bridge/filesystem.ts).
 
@@ -289,6 +302,11 @@ Every raw filesystem operation accepts an optional `signal`. Additional fields a
 
 `S3FileSystem` requires `transport` and `bucket`. A transport supplies `headObject`, `getObject`, `putObject`, `deleteObject`, `copyObject`, and `listObjectsV2`; see the [transport interface](src/fs/s3/transport.ts).
 
+`createS3NamespaceFileSystem` resource limits (`maxBytes`, `maxEntries`,
+`maxManifestBytes`, `maxAttempts`, and inherited descriptor limits) are unlimited
+when omitted or set to `Infinity`; positive safe integers enable finite limits.
+Namespace paths have no implicit length cap; configured manifest budgets still apply.
+
 `createS3Transport(client, capabilities?)` wraps a compatible client with explicit `streamingRead`, `streamingWrite`, `conditionalPut`, `conditionalCopy`, and `conditionalDelete` flags (all absent by default). Direct transport requests accept an optional `abortSignal`.
 
 For in-memory S3 simulations, `new MockS3Client({ buckets, pageSize?, now?, authorize? })` requires bucket names. `pageSize` defaults to 1,000 (range 1–1,000), `now` defaults to the current date/time, and optional `authorize(request)` can reject requests. It does not verify a real provider.

package/dist/safe-fs/bridge/filesystem.js

@@ -70,7 +70,7 @@ export class FileSystemBridge {
         assertBridgePath(this.#root, this.#cwd);
         this.#signal = options.signal;
         const maximum = options.readFileMaxBytes;
-        if (maximum !== undefined && (!Number.isSafeInteger(maximum) || maximum < 0))
+        if (maximum !== undefined && maximum !== Infinity && (!Number.isSafeInteger(maximum) || maximum < 0))
             throw new TypeError("Invalid readFileMaxBytes");
         this.#readFileMaxBytes = maximum;
         if (options.reserveReadFile !== undefined && typeof options.reserveReadFile !== "function")

package/dist/safe-fs/contracts/errors.js

@@ -44,13 +44,14 @@ export class FsError extends Error {
         const operation = options.syscall ? `, ${options.syscall}` : "";
         const path = options.path === undefined ? "" : ` '${options.path}'`;
         const destination = options.dest === undefined ? "" : ` -> '${options.dest}'`;
-        const prevStackLimit = Error.stackTraceLimit;
-        Error.stackTraceLimit = 0;
+        const errorConstructor = Error;
+        const prevStackLimit = errorConstructor.stackTraceLimit;
+        errorConstructor.stackTraceLimit = 0;
         try {
             super(`${code}: ${options.message ?? descriptions[code]}${operation}${path}${destination}`, options);
         }
         finally {
-            Error.stackTraceLimit = prevStackLimit;
+            errorConstructor.stackTraceLimit = prevStackLimit;
         }
         this.name = "FsError";
         this.code = code;

package/dist/safe-fs/contracts/filesystem.d.ts

@@ -170,13 +170,14 @@ export interface RenameOptions extends FsOptions {
     readonly noReplace?: boolean;
 }
 export interface ReadFileOptions extends FsOptions {
+    /** Nonnegative safe-integer byte cap; Infinity adds no per-read cap. */
     readonly maxBytes?: number;
 }
 export interface ReadDirectoryOptions extends FsOptions {
     /**
-     * Optional per-listing entry admission limit, a nonnegative safe integer.
+     * Optional per-listing entry admission limit, a nonnegative safe integer or Infinity.
      * Zero permits an empty listing; overflow rejects with EFBIG, never truncates.
-     * Omission preserves the adapter's existing limits and ordering. Composed
+     * Omission or Infinity preserves the adapter's existing limits and ordering. Composed
      * adapters may conservatively count distinct candidates before visibility
      * filtering. This is not a global traversal, host-allocation or work quota.
      */

package/dist/safe-fs/contracts/io.d.ts

@@ -7,4 +7,6 @@ export interface CollectOptions {
 }
 export declare function toByteSource(input: string | Uint8Array): ByteSource;
 export declare function collectBytes(source: ByteSource, options: CollectOptions): Promise<Uint8Array>;
+/** Subscribe when supported; callers must still check cancellation at operation boundaries. */
+export declare function listenForAbort(signal: AbortSignal, listener: () => void): () => void;
 export declare function readBytes(source: ByteSource, signal?: AbortSignal): AsyncGenerator<Uint8Array>;

package/dist/safe-fs/contracts/io.js

@@ -108,27 +108,52 @@ export async function collectBytes(source, options) {
     options.signal?.throwIfAborted();
     return buffer.subarray(0, size);
 }
+/** Subscribe when supported; callers must still check cancellation at operation boundaries. */
+export function listenForAbort(signal, listener) {
+    let callback = listener;
+    const onAbort = () => callback?.();
+    const dispose = () => {
+        // Release operation state even when a frozen host refuses removal.
+        callback = undefined;
+        try {
+            signal.removeEventListener("abort", onAbort);
+        }
+        catch (error) {
+            if (!(error instanceof TypeError) || Object.isExtensible(signal))
+                throw error;
+        }
+    };
+    try {
+        signal.addEventListener("abort", onAbort, { once: true });
+    }
+    catch (error) {
+        // Frozen hosts may register before failing to update their bookkeeping.
+        dispose();
+        if (!(error instanceof TypeError) || Object.isExtensible(signal))
+            throw error;
+    }
+    return dispose;
+}
 async function abortable(operation, signal) {
     signal?.throwIfAborted();
     if (!signal)
         return operation();
     return new Promise((resolve, reject) => {
-        const onAbort = () => {
-            signal.removeEventListener("abort", onAbort);
+        const dispose = listenForAbort(signal, () => {
+            dispose();
             reject(signal.reason);
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
+        });
         try {
             Promise.resolve(operation()).then((result) => {
-                signal.removeEventListener("abort", onAbort);
+                dispose();
                 resolve(result);
             }, (error) => {
-                signal.removeEventListener("abort", onAbort);
+                dispose();
                 reject(error);
             });
         }
         catch (error) {
-            signal.removeEventListener("abort", onAbort);
+            dispose();
             reject(error);
         }
     });

package/dist/safe-fs/contracts/portable-path.d.ts

@@ -4,10 +4,18 @@ export declare const dirname: typeof virtualDirname;
 export declare function extname(path: string): string;
 export declare function isAbsolutePath(path: string): boolean;
 export declare function joinPath(...paths: string[]): string;
+declare function resolve(...paths: string[]): string;
+declare function relative(from: string, to: string): string;
 export declare const posixPath: Readonly<{
     basename: typeof basename;
     dirname: typeof virtualDirname;
     extname: typeof extname;
     join: typeof joinPath;
     isAbsolute: typeof isAbsolutePath;
+    normalize: typeof joinPath;
+    resolve: typeof resolve;
+    relative: typeof relative;
+    sep: "/";
+    delimiter: ":";
 }>;
+export {};

package/dist/safe-fs/contracts/portable-path.js

@@ -54,4 +54,25 @@ export function joinPath(...paths) {
     const result = `${absolute ? "/" : ""}${components.join("/")}` || ".";
     return joined.endsWith("/") && result !== "/" ? `${result}/` : result;
 }
-export const posixPath = Object.freeze({ basename, dirname, extname, join: joinPath, isAbsolute: isAbsolutePath });
+// Portable paths have a stable root instead of a process working directory.
+function resolve(...paths) {
+    let joined = "/";
+    for (const path of paths) {
+        assertString(path);
+        joined = path.startsWith("/") ? path : `${joined}/${path}`;
+    }
+    const normalized = joinPath(joined);
+    return normalized.length > 1 && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+function relative(from, to) {
+    const source = resolve(from).split("/").filter(Boolean);
+    const target = resolve(to).split("/").filter(Boolean);
+    let common = 0;
+    while (common < source.length && common < target.length && source[common] === target[common])
+        common++;
+    return [...Array(source.length - common).fill(".."), ...target.slice(common)].join("/");
+}
+export const posixPath = Object.freeze({
+    basename, dirname, extname, join: joinPath, isAbsolute: isAbsolutePath,
+    normalize: joinPath, resolve, relative, sep: "/", delimiter: ":"
+});

package/dist/safe-fs/core.d.ts

@@ -25,3 +25,4 @@ export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export { bindConditionalMutation, type ConditionalMutationBinding } from "./fs/memory/index.js";
 export * from "./fs/s3/index.js";
+export * from "./fs/s3/http/index.js";

package/dist/safe-fs/core.js

@@ -21,3 +21,4 @@ export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export { bindConditionalMutation } from "./fs/memory/index.js";
 export * from "./fs/s3/index.js";
+export * from "./fs/s3/http/index.js";

package/dist/safe-fs/fs/devices/index.js

@@ -309,7 +309,8 @@ export class DeviceFileSystem {
     async #readFileSlow(path, options) {
         const resolved = await this.#resolve(path, options);
         if (resolved === nullPath) {
-            nonnegative(options.maxBytes, path);
+            if (options.maxBytes !== Infinity)
+                nonnegative(options.maxBytes, path);
             return new Uint8Array();
         }
         if (resolved === deviceDirectory)

package/dist/safe-fs/fs/directory-admission.js

@@ -1,9 +1,9 @@
 import { FsError } from "../contracts/errors.js";
 export function directoryEntryLimit(options, path) {
     options.signal?.throwIfAborted();
-    const limit = options.maxEntries;
+    const limit = options.maxEntries === Infinity ? undefined : options.maxEntries;
     if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 0)) {
-        throw new FsError("EINVAL", { syscall: "readdir", path, message: "directory entry limit must be a nonnegative safe integer" });
+        throw new FsError("EINVAL", { syscall: "readdir", path, message: "directory entry limit must be a nonnegative safe integer or Infinity" });
     }
     return limit;
 }

package/dist/safe-fs/fs/memory/index.d.ts

@@ -173,7 +173,7 @@ export declare function utf8ByteLength(value: string): number;
 export declare function isCleanAbsolutePath(path: string): boolean;
 export declare function tryResolveMemoryDevicePath(filesystem: FileSystem, path: string, resizeCreate?: boolean): string | undefined;
 export declare function getLastReadMemoryFileSourceRef(view: Uint8Array): Uint8Array | undefined;
-export declare function tryReadMemoryFileViewSync(filesystem: FileSystem, path: string, maxBytes?: number, signal?: AbortSignal, captureSourceRef?: boolean): Uint8Array | undefined;
+export declare function tryReadMemoryFileViewSync(filesystem: FileSystem, path: string, maxBytes?: number, signal?: AbortSignal, captureSourceRef?: boolean, beforeRead?: () => void): Uint8Array | undefined;
 export declare function tryGetMemoryDirectoryEntryNamesSync(filesystem: FileSystem, path: string): ReadonlyMap<string, {
     readonly type: "file" | "directory" | "symlink";
 }> | undefined;

package/dist/safe-fs/fs/memory/index.js

@@ -46,16 +46,10 @@ Object.assign(MemoryFileNode.prototype, {
     sourceRef: undefined,
 });
 const EMPTY_ALLOC_BYTES = new Uint8Array(0);
-const SMALL_ALLOC_SLAB_SIZE = 8192;
-let smallAllocSlab = new Uint8Array(SMALL_ALLOC_SLAB_SIZE);
-let smallAllocOffset = 0;
 const DUMMY_POOL_LEDGER = new MemoryLedger(normalizeMemoryFileSystemLimits({}));
 const DUMMY_POOL_ALLOCATION = new MemoryAllocation(EMPTY_ALLOC_BYTES, DUMMY_POOL_LEDGER);
 const DUMMY_POOL_FILE_NODE = new MemoryFileNode(0, 0, null, 0, DUMMY_POOL_ALLOCATION, DUMMY_POOL_ALLOCATION.data);
 DUMMY_POOL_FILE_NODE.atimeMs = DUMMY_POOL_FILE_NODE.mtimeMs = DUMMY_POOL_FILE_NODE.ctimeMs = DUMMY_POOL_FILE_NODE.birthtimeMs = 1700000000000;
-const defaultDateNow = Date.now;
-let fastWriteCachedNow = Date.now();
-let fastWriteNowTick = 0;
 class FastDirectoryEntriesMap {
     // Keep speculative slots local so a failed write cannot pin a tenant globally.
     _missKey = "";
@@ -159,6 +153,7 @@ class FastDirectoryEntriesMap {
     }
     _rebuild(newCap) {
         this._missKey = "";
+        this._missSlot = -1;
         const newTableLen = newCap * 2;
         const newMask = newTableLen - 1;
         const newTable = newCap <= 16384 ? new Int16Array(newTableLen).fill(-1) : new Int32Array(newTableLen).fill(-1);
@@ -198,16 +193,17 @@ class FastDirectoryEntriesMap {
         this._next = writeIdx;
     }
     set(k, v) {
-        if (k === this._missKey && this._next < this._keys.length) {
+        const missSlot = k === this._missKey ? this._missSlot : -1;
+        this._missKey = "";
+        this._missSlot = -1;
+        if (missSlot >= 0 && (this._table[missSlot] === -1 || this._table[missSlot] === -2) && this._next < this._keys.length) {
             const entryIdx = this._next++;
-            this._table[this._missSlot] = entryIdx;
+            this._table[missSlot] = entryIdx;
             this._keys[entryIdx] = k;
             this._vals[entryIdx] = v;
             this.size++;
-            this._missKey = "";
             return this;
         }
-        this._missKey = "";
         if (this._next >= this._keys.length) {
             this._rebuild(this.size * 2 <= this._keys.length ? this._keys.length : this._keys.length * 2);
         }
@@ -240,6 +236,7 @@ class FastDirectoryEntriesMap {
     }
     delete(k) {
         this._missKey = "";
+        this._missSlot = -1;
         if (this.size === 0)
             return false;
         let slot = this._hash(k);
@@ -268,6 +265,7 @@ class FastDirectoryEntriesMap {
     }
     clear() {
         this._missKey = "";
+        this._missSlot = -1;
         if (this._next > 0) {
             this._table.fill(-1);
             for (let i = 0; i < this._next; i++) {
@@ -346,19 +344,13 @@ function collectRemovedChild(child, name) {
 }
 function replenishSharedMemoryPools() {
     while (sharedAllocationPoolLen < 112) {
-        if (smallAllocOffset + 64 > SMALL_ALLOC_SLAB_SIZE) {
-            smallAllocSlab = new Uint8Array(SMALL_ALLOC_SLAB_SIZE);
-            smallAllocOffset = 0;
-        }
-        const slice = smallAllocSlab.subarray(smallAllocOffset, smallAllocOffset + 64);
-        smallAllocOffset += 64;
         DUMMY_POOL_LEDGER.reserve(64, 0, "init", "/");
-        const alloc = new MemoryAllocation(slice, DUMMY_POOL_LEDGER);
+        const alloc = new MemoryAllocation(new Uint8Array(64), DUMMY_POOL_LEDGER);
         alloc.release();
         sharedAllocationPool[sharedAllocationPoolLen++] = alloc;
     }
     while (sharedFileNodePoolLen < 112) {
-        sharedFileNodePool[sharedFileNodePoolLen++] = new MemoryFileNode(0, 0, fastWriteCachedNow, 0, DUMMY_POOL_ALLOCATION, undefined);
+        sharedFileNodePool[sharedFileNodePoolLen++] = new MemoryFileNode(0, 0, 0, 0, DUMMY_POOL_ALLOCATION, undefined);
     }
     while (sharedLargeAllocationPoolLen < 4) {
         DUMMY_POOL_LEDGER.reserve(65536, 0, "init", "/");
@@ -373,7 +365,7 @@ function replenishSharedMemoryPools() {
         sharedMediumAllocationPool[sharedMediumAllocationPoolLen++] = alloc;
     }
     while (sharedDirectoryNodePoolLen < 16) {
-        sharedDirectoryNodePool[sharedDirectoryNodePoolLen++] = new MemoryDirectoryNode(0, 0, fastWriteCachedNow);
+        sharedDirectoryNodePool[sharedDirectoryNodePoolLen++] = new MemoryDirectoryNode(0, 0, 0);
     }
 }
 class MemoryDirectoryNode {
@@ -921,6 +913,7 @@ export class MemoryFileSystem {
                 cache.lastFastDirNode = undefined;
             }
             if (node.entries.size === 0) {
+                node.entries.clear();
                 if (sharedDirectoryNodePoolLen < SHARED_DIR_POOL_CAPACITY) {
                     sharedDirectoryNodePool[sharedDirectoryNodePoolLen++] = node;
                 }
@@ -1363,17 +1356,6 @@ export class MemoryFileSystem {
             }
         }
         try {
-            // A shared slab's backing buffer exceeds the admitted slice capacity.
-            // Finite file/storage ceilings require independently owned exact buffers.
-            if (length <= 64 && this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes) {
-                if (smallAllocOffset + length > SMALL_ALLOC_SLAB_SIZE) {
-                    smallAllocSlab = new Uint8Array(SMALL_ALLOC_SLAB_SIZE);
-                    smallAllocOffset = 0;
-                }
-                const slice = smallAllocSlab.subarray(smallAllocOffset, smallAllocOffset + length);
-                smallAllocOffset += length;
-                return new MemoryAllocation(slice, this.ledger);
-            }
             return new MemoryAllocation(new Uint8Array(length), this.ledger);
         }
         catch (cause) {
@@ -1559,11 +1541,12 @@ export class MemoryFileSystem {
             }
             if (position > curLen)
                 storage.fill(0, curLen, position);
+            const source = data;
             if (dataLen === data.byteLength) {
                 storage.set(data, position);
             }
-            else if (typeof data.copy === "function") {
-                data.copy(storage, position, 0, dataLen);
+            else if (typeof source.copy === "function") {
+                source.copy(storage, position, 0, dataLen);
             }
             else {
                 for (let i = 0; i < dataLen; i++)
@@ -1762,7 +1745,7 @@ export class MemoryFileSystem {
                 1 + batchCount <= entries._keys.length) {
                 this.ledger.reserve(totalNameBytes, 2 * batchCount, "writeFile", fileNames[batchCount - 1]);
                 this.totalBytes += payloadBytesSum;
-                const now = fastWriteCachedNow;
+                const now = Date.now();
                 const fileMode = typeModes.file | mode;
                 let ino = this.nextInode;
                 this.nextInode = ino + batchCount;
@@ -1835,7 +1818,7 @@ export class MemoryFileSystem {
             const existing = nameHash !== undefined ? entries.getForWriteWithHash(name, nameHash) : entries.getForWrite(name);
             if (existing === undefined && entries._next < entries._keys.length) {
                 this.ledger.reserve(name.length * 2, 2, "writeFile", name);
-                const now = fastWriteCachedNow;
+                const now = Date.now();
                 const length = data.byteLength;
                 const node = sharedFileNodePool[--sharedFileNodePoolLen];
                 sharedFileNodePool[sharedFileNodePoolLen] = DUMMY_POOL_FILE_NODE;
@@ -1957,7 +1940,7 @@ export class MemoryFileSystem {
                         allocation.data.set(data);
                     this.ledger.reserve(nameBytes, 2, syscall, name);
                     try {
-                        const now = fastWriteCachedNow;
+                        const now = Date.now();
                         const fileMode = typeModes.file | mode;
                         const view = zeroCopyConst ? new Uint8Array(data) : (capacity === length ? allocation.data : undefined);
                         let node;
@@ -2038,7 +2021,7 @@ export class MemoryFileSystem {
     }
     async readFile(path, options = {}) {
         options.signal?.throwIfAborted();
-        if (options.maxBytes !== undefined)
+        if (options.maxBytes !== undefined && options.maxBytes !== Infinity)
             this.integer(options.maxBytes, "readFile", path);
         const node = this.file(path, "readFile");
         this.permission(node, 4, "readFile", path);
@@ -3111,7 +3094,7 @@ export class MemoryRedirectHandle {
         if (len === 0)
             return;
         const pos = this.append ? this.node.byteLength : this.position;
-        const now = Date.now === defaultDateNow ? fastWriteCachedNow : Date.now();
+        const now = Date.now();
         this.fs.writeAtRange(this.node, src, len, pos, "write", this.path, now);
         if (!this.append)
             this.position = pos + len;
@@ -3131,7 +3114,7 @@ export class MemoryRedirectHandle {
             mem.ledger.hasInfiniteRetained &&
             mem.ledger.hasInfiniteFileBytes &&
             mem.ledger.limits.maxBytes === undefined) {
-            const now = Date.now === defaultDateNow ? fastWriteCachedNow : Date.now();
+            const now = Date.now();
             this.node.byteLength = len;
             this.node.view = immutableData;
             this.node.sourceRef = immutableData;
@@ -3257,7 +3240,7 @@ export function tryOpenMemoryRedirectHandleSync(filesystem, path, append, mode,
         }
         const cache = mem._cache;
         cache.clearWrites();
-        const now = Date.now === defaultDateNow ? ((++fastWriteNowTick & 63) === 0 ? (fastWriteCachedNow = Date.now()) : fastWriteCachedNow) : Date.now();
+        const now = Date.now();
         const fileMode = typeModes.file | validMode;
         let newNode;
         if (sharedFileNodePoolLen > 0) {
@@ -3458,7 +3441,7 @@ export function getLastReadMemoryFileSourceRef(view) {
     lastReadViewSourceRef = undefined;
     return ref;
 }
-export function tryReadMemoryFileViewSync(filesystem, path, maxBytes, signal, captureSourceRef = false) {
+export function tryReadMemoryFileViewSync(filesystem, path, maxBytes, signal, captureSourceRef = false, beforeRead) {
     // A capture belongs only to the most recent read, including failed/fallback reads.
     lastReadViewData = undefined;
     lastReadViewSourceRef = undefined;
@@ -3466,19 +3449,15 @@ export function tryReadMemoryFileViewSync(filesystem, path, maxBytes, signal, ca
     if (mem._owner === undefined || !isStockMemoryMethods(mem, readFileFastMethodNames, false))
         return undefined;
     signal?.throwIfAborted();
-    if (maxBytes !== undefined)
+    beforeRead?.();
+    if (maxBytes !== undefined && maxBytes !== Infinity)
         mem.integer(maxBytes, "readFile", path);
     const node = mem.file(path, "readFile");
     mem.permission(node, 4, "readFile", path);
     const data = node.data;
     if (maxBytes !== undefined && data.byteLength > maxBytes)
         mem.fail("EFBIG", "readFile", path);
-    if (Date.now !== defaultDateNow)
-        node.atimeMs = Date.now();
-    else if ((++fastWriteNowTick & 63) === 0)
-        node.atimeMs = fastWriteCachedNow = Date.now();
-    else
-        node.atimeMs = fastWriteCachedNow;
+    node.atimeMs = Date.now();
     if (captureSourceRef && node.revision === 0) {
         lastReadViewData = new WeakRef(data);
         lastReadViewSourceRef = node.sourceRef === undefined ? undefined : new WeakRef(node.sourceRef);
@@ -3561,7 +3540,7 @@ export function tryGetMemoryDirectoryEntryNamesSync(filesystem, path) {
     validatePath(path, owner.ledger.limits);
     const root = mem.root;
     if (path === "/") {
-        if (((root.mode >> 6) & 4) !== 4)
+        if (((root.mode >> 6) & 5) !== 5)
             return undefined;
         return root.entries;
     }
@@ -3572,7 +3551,7 @@ export function tryGetMemoryDirectoryEntryNamesSync(filesystem, path) {
     const fastPrefix = cache?.lastFastDirPrefix;
     if (fastDir !== undefined &&
         fastDir.nlink !== 0 &&
-        ((fastDir.mode >> 6) & 4) === 4 &&
+        ((fastDir.mode >> 6) & 5) === 5 &&
         fastPrefix !== undefined &&
         (fastPrefix === path || (fastPrefix.length === path.length + 1 && fastPrefix.charCodeAt(path.length) === 47 && fastPrefix.startsWith(path)))) {
         return fastDir.entries;
@@ -3585,7 +3564,7 @@ export function tryGetMemoryDirectoryEntryNamesSync(filesystem, path) {
         const slash = path.indexOf("/", start);
         if (slash === -1) {
             const next = current.entries.getSubstr(path, start, path.length);
-            if (!next || next.type !== "directory" || ((next.mode >> 6) & 4) !== 4)
+            if (!next || next.type !== "directory" || ((next.mode >> 6) & 5) !== 5)
                 return undefined;
             return next.entries;
         }
@@ -3639,7 +3618,7 @@ export function tryMkdirMemorySync(filesystem, path, recursive, mode, signal, di
             let next = current.entries.get(seg);
             if (!next) {
                 mem.permission(current, 3, "mkdir", path);
-                next = mem.addDirectoryNode(current, seg, validMode, "mkdir", path, fastWriteCachedNow);
+                next = mem.addDirectoryNode(current, seg, validMode, "mkdir", path, Date.now());
             }
             else if (next.type !== "directory") {
                 mem.fail(slash === -1 ? "EEXIST" : "ENOTDIR", "mkdir", path);
@@ -3660,7 +3639,7 @@ export function tryMkdirMemorySync(filesystem, path, recursive, mode, signal, di
     if (location.node)
         mem.fail("EEXIST", "mkdir", path);
     mem.permission(location.parent, 3, "mkdir", path);
-    mem.addDirectoryNode(location.parent, location.name, validMode, "mkdir", path, fastWriteCachedNow);
+    mem.addDirectoryNode(location.parent, location.name, validMode, "mkdir", path, Date.now());
     return true;
 }
 export function tryRmRfMemorySync(filesystem, path, signal) {
@@ -3710,7 +3689,7 @@ export function tryRmRfMemorySync(filesystem, path, signal) {
     sharedFastLocation.name = targetName;
     sharedFastLocation.path = path;
     try {
-        mem.removeLocation(sharedFastLocation, path, "rm", true, fastWriteCachedNow);
+        mem.removeLocation(sharedFastLocation, path, "rm", true, Date.now());
     }
     finally {
         sharedFastLocation.node = undefined;

package/dist/safe-fs/fs/memory/ledger.js

@@ -84,8 +84,10 @@ export class MemoryAllocation {
             return;
         if (this.references <= 0)
             throw new Error("Memory allocation already released");
-        if (--this.references === 0)
+        if (--this.references === 0) {
+            this.data.fill(0);
             this.ledger.release(this.data.byteLength, 0);
+        }
     }
     isReleased64() {
         return this.references === 0 && this.data.byteLength === 64;

package/dist/safe-fs/fs/object-publication/index.js

@@ -9,7 +9,8 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
     const maxStagedPages = options.maxStagedPages ?? Infinity;
     const maxFileBytes = options.maxFileBytes ?? Infinity;
     const maxOpenFiles = options.maxOpenFiles ?? Infinity;
-    if (![chunkBytes, options.maxStagedBytes, options.maxStagedPages, options.maxFileBytes, options.maxOpenFiles].every(value => value === undefined || Number.isSafeInteger(value) && value > 0)
+    if (!Number.isSafeInteger(chunkBytes) || chunkBytes < 1
+        || ![maxStagedBytes, maxStagedPages, maxFileBytes, maxOpenFiles].every(value => value === Infinity || Number.isSafeInteger(value) && value > 0)
         || typeof store.acquire !== "function"
         || store.publish !== undefined && typeof store.publish !== "function"
         || store.createStaging !== undefined && typeof store.createStaging !== "function")

package/dist/safe-fs/fs/real/index.js

@@ -608,8 +608,9 @@ export class RealFileSystem {
     }
     async readFile(path, options = {}) {
         return this.operation("readFile", path, options, async () => {
-            const maxBytes = options.maxBytes ?? Number.MAX_SAFE_INTEGER;
-            integer(maxBytes);
+            const maxBytes = options.maxBytes ?? Infinity;
+            if (maxBytes !== Infinity)
+                integer(maxBytes);
             return collectBytes(this.readStream(path, options), { maxBytes, ...options });
         });
     }

package/dist/safe-fs/fs/s3/http/request-fetch.d.ts

@@ -1,4 +1,15 @@
-import type { RequestOptions } from "node:http";
 import type { RequestScope, WireResponse } from "./request.js";
-import type { S3HttpRequestFactory } from "./types.js";
-export declare function sendRequest(options: RequestOptions, body: Uint8Array, scope: RequestScope, factory?: S3HttpRequestFactory): Promise<WireResponse>;
+export type S3HttpRequestFactory = never;
+interface FetchRequestOptions {
+    readonly protocol?: string | undefined;
+    readonly hostname?: string | undefined;
+    readonly port?: string | number | undefined;
+    readonly path?: string | undefined;
+    readonly method?: string | undefined;
+    readonly headers?: Record<string, string> | undefined;
+    readonly agent?: false;
+    readonly maxHeaderSize?: number;
+    readonly rejectUnauthorized?: true;
+}
+export declare function sendRequest(options: FetchRequestOptions, body: Uint8Array, scope: RequestScope, factory?: S3HttpRequestFactory): Promise<WireResponse>;
+export {};

package/dist/safe-fs/fs/s3/http/request-node.d.ts

@@ -1,4 +1,4 @@
-import type { RequestOptions } from "node:http";
-import type { S3HttpRequestFactory } from "./types.js";
+import type { ClientRequest, IncomingMessage, RequestOptions } from "node:http";
 import type { RequestScope, WireResponse } from "./request.js";
+export type S3HttpRequestFactory = (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
 export declare function sendRequest(options: RequestOptions, body: Uint8Array, scope: RequestScope, factory?: S3HttpRequestFactory): Promise<WireResponse>;

package/dist/safe-fs/fs/s3/http/types.d.ts

@@ -1,4 +1,5 @@
-import type { ClientRequest, IncomingMessage, RequestOptions } from "node:http";
+import type { S3HttpRequestFactory } from "#safe-fs-s3-request";
+export type { S3HttpRequestFactory } from "#safe-fs-s3-request";
 export interface S3HttpCredentials {
     readonly accessKeyId: string;
     readonly secretAccessKey: string;
@@ -7,7 +8,6 @@ export interface S3HttpCredentials {
 export type S3HttpCredentialProvider = (options: {
     readonly signal: AbortSignal;
 }) => Promise<S3HttpCredentials>;
-export type S3HttpRequestFactory = (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
 export interface S3HttpTransportOptions {
     readonly endpoint: string;
     readonly region: string;

package/dist/safe-fs/fs/s3/manifest-admission.js

@@ -41,8 +41,6 @@ export async function* admitManifest(source, options) {
                 invalid();
             const key = value;
             if (frame.shape === 'nodes') {
-                if (key.length > 4096)
-                    invalid();
                 if (++entries > options.maxEntries)
                     throw new FsError('ENOSPC');
             }
@@ -83,8 +81,6 @@ export async function* admitManifest(source, options) {
             if (token) {
                 if (quoted) {
                     token += character;
-                    if (token.length > 4096 * 6 + 2)
-                        invalid();
                     if (escaped)
                         escaped = false;
                     else if (character === '\\')

package/dist/safe-fs/fs/s3/namespace.js

@@ -4,7 +4,7 @@ import { dirname, normalizePath, validatePath } from '../../contracts/virtual-pa
 import { withObjectFileDescriptors } from '../object-publication/index.js';
 import { admitManifest } from './manifest-admission.js';
 function limit(value) {
-    if (value === undefined)
+    if (value === undefined || value === Infinity)
         return Infinity;
     if (!Number.isSafeInteger(value) || value < 1)
         throw new RangeError('Invalid S3 namespace limit');
@@ -18,7 +18,7 @@ export async function createS3NamespaceFileSystem(options) {
         throw new TypeError('An explicit S3 bucket and manifest key are required');
     const maxBytes = limit(options.maxBytes);
     const maxEntries = limit(options.maxEntries);
-    const maxManifestBytes = options.maxManifestBytes === Infinity ? Infinity : limit(options.maxManifestBytes);
+    const maxManifestBytes = limit(options.maxManifestBytes);
     const maxAttempts = limit(options.maxAttempts);
     const descriptorOptions = options;
     for (const key of ['chunkBytes', 'maxStagedBytes', 'maxStagedPages', 'maxFileBytes', 'maxOpenFiles']) {
@@ -32,8 +32,6 @@ export async function createS3NamespaceFileSystem(options) {
         validatePath(value);
         if (!value)
             throw new FsError('ENOENT');
-        if (value.length > 4096)
-            throw new FsError('ENAMETOOLONG');
         return normalizePath(value);
     };
     const entryPath = (value) => {

package/dist/safe-fs/fs/webdav/webdav.js

@@ -1,6 +1,7 @@
 import { FsError, isErrnoCode, isFsError } from "../../contracts/errors.js";
 import { composeAbortSignals } from "../../contracts/abort.js";
 import { readBytes } from "../../contracts/io.js";
+import { validatePath } from "../../contracts/virtual-path.js";
 import { davChild, davChildren, parseXmlSteps, scalar, XmlResponseLimitError, XmlResourceLimitError } from "./xml.js";
 import { admitDirectoryEntries, directoryEntryLimit } from "../directory-admission.js";
 import { assertCallbackAuthorityAllowed, compareEntries, registerEntryAuthority } from "../mount/comparison.js";
@@ -159,28 +160,6 @@ function normalize(path) {
     }
     return `/${segments.join("/")}`;
 }
-function validateDirectoryWalkPath(path, syscall = "access") {
-    if (typeof path !== "string")
-        fail("EINVAL", "resolve", String(path), "invalid WebDAV path");
-    let bytes = 0;
-    let components = 0;
-    let inComponent = false;
-    for (let offset = 0; offset < path.length; offset++) {
-        const point = path.codePointAt(offset);
-        if (point === 47)
-            inComponent = false;
-        else if (!inComponent) {
-            components++;
-            inComponent = true;
-        }
-        bytes += point <= 0x7f ? 1 : point <= 0x7ff ? 2 : point <= 0xffff ? 3 : 4;
-        if (point > 0xffff)
-            offset++;
-        if (bytes > 65_536 || components > 256) {
-            fail("ENAMETOOLONG", syscall, path, "directory access exceeds the 64KiB path or 256 component limit");
-        }
-    }
-}
 function requiresCollection(path) {
     const last = path.split("/").at(-1);
     return last === "" || last === "." || last === "..";
@@ -826,7 +805,7 @@ export class WebDavFileSystem {
         }
     }
     async stat(path, options = {}) {
-        validateDirectoryWalkPath(path, "stat");
+        validatePath(path, options.pathLimits);
         return this.statWithAncestors(path, options);
     }
     async statWithAncestors(path, options) {
@@ -909,7 +888,7 @@ export class WebDavFileSystem {
         }.bind(this));
     }
     async prepareWrite(path, options) {
-        validateDirectoryWalkPath(path, "writeFile");
+        validatePath(path, options.pathLimits);
         const normalized = normalize(path);
         if (options.mode !== undefined)
             this.unsupported("writeFile mode", path);
@@ -1329,10 +1308,7 @@ export class WebDavFileSystem {
             fail("ECANCELED", "access", path);
         if (mode & 2)
             this.unsupported("access write/execute permission checks", path);
-        if (mode & 1)
-            validateDirectoryWalkPath(path);
-        // Non-execute probes do not inherit stat's raw-path limits.
-        const stat = await (mode & 1 ? this.stat(path, options) : this.statWithAncestors(path, options));
+        const stat = await this.stat(path, options);
         if (options.signal?.aborted)
             fail("ECANCELED", "access", path);
         if ((mode & 1) && stat.type !== "directory")

package/dist/safe-fs/fs/webdav/xml.js

@@ -20,8 +20,8 @@ export function parseXml(input, limits = {}) {
 }
 export function* parseXmlSteps(input, limits = {}) {
     const { maxResponses, ...documentLimits } = limits;
-    if (maxResponses !== undefined && (!Number.isSafeInteger(maxResponses) || maxResponses < 1)) {
-        throw new RangeError("XML limits must be positive integers");
+    if (maxResponses !== undefined && maxResponses !== Infinity && (!Number.isSafeInteger(maxResponses) || maxResponses < 1)) {
+        throw new RangeError("XML limits must be positive integers or Infinity");
     }
     let responses = 0;
     try {

package/dist/safe-fs/python/emscripten.js

@@ -332,8 +332,8 @@ export function writePythonStat(heap, pointer, stat) {
     return 0;
 }
 /** Runtime storage and application storage occupy disjoint guest device ranges. */
-export function createPythonRuntimeStatMapper(maxDevices = 1024) {
-    if (!Number.isSafeInteger(maxDevices) || maxDevices < 1 || maxDevices > 1024)
+export function createPythonRuntimeStatMapper(maxDevices = Infinity) {
+    if (maxDevices !== Infinity && (!Number.isSafeInteger(maxDevices) || maxDevices < 1))
         throw new RangeError('Invalid runtime device limit');
     const mapped = Symbol('mapped Python runtime device');
     const devices = new Map();
@@ -346,6 +346,9 @@ export function createPythonRuntimeStatMapper(maxDevices = 1024) {
         if (device === undefined) {
             if (devices.size >= maxDevices)
                 throw new Error('EOVERFLOW');
+            // Preserve the uint32 guest ABI even when the resource budget is unlimited.
+            if (devices.size >= 0x80000000)
+                throw new Error('EOVERFLOW');
             device = 0x80000000 + devices.size;
             devices.set(stat.dev, device);
         }

package/dist/safe-fs/python/filesystem.js

@@ -23,11 +23,11 @@ export class PythonFileSystem {
         if (!options.cwd.startsWith("/"))
             throw new FsError("EINVAL", { syscall: "python filesystem", path: options.cwd, message: "cwd must be absolute" });
         this.#cwd = options.cwd;
-        this.#transfer = options.maxTransferBytes ?? 65536;
+        this.#transfer = options.maxTransferBytes ?? Infinity;
         this.#limit = options.maxOpenFiles ?? Infinity;
         this.#directoryLimit = options.maxDirectoryEntries ?? Infinity;
         for (const limit of [this.#transfer, options.maxOpenFiles, options.maxDirectoryEntries])
-            if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1))
+            if (limit !== undefined && limit !== Infinity && (!Number.isSafeInteger(limit) || limit < 1))
                 throw new FsError("EINVAL", { syscall: "python filesystem" });
         this.#open = options.open;
         this.#scope = composeAbortSignals([...(options.signal === undefined ? [] : [options.signal]), this.#abort.signal]);

package/dist/safe-fs/python/native.js

@@ -10,7 +10,7 @@ const errno = {
 };
 export function createPythonNativeSyscalls(options) {
     const { runtime, signal, maxTransferBytes, runtimeMount } = options;
-    if (!Number.isSafeInteger(maxTransferBytes) || maxTransferBytes < 1)
+    if (maxTransferBytes !== Infinity && (!Number.isSafeInteger(maxTransferBytes) || maxTransferBytes < 1))
         throw new RangeError('Invalid native transfer limit');
     const descriptors = new Map();
     const closedStdio = new Set();

package/dist/safe-fs/python/stat.js

@@ -4,8 +4,8 @@ export class PythonStatTranslator {
     #devices = new Map();
     #maxDevices;
     #next = 1;
-    constructor(maxDevices = 1024) {
-        if (!Number.isSafeInteger(maxDevices) || maxDevices < 1)
+    constructor(maxDevices = Infinity) {
+        if (maxDevices !== Infinity && (!Number.isSafeInteger(maxDevices) || maxDevices < 1))
             throw new FsError("EINVAL");
         this.#maxDevices = maxDevices;
     }
@@ -19,6 +19,9 @@ export class PythonStatTranslator {
         if (guestDevice === undefined) {
             if (this.#next > this.#maxDevices)
                 throw new FsError("EFBIG", { syscall: "stat", message: "Python device identity limit exceeded" });
+            // The upper half of the uint32 guest ABI is reserved for runtime devices.
+            if (this.#next >= 0x80000000)
+                throw new FsError("EFBIG", { syscall: "stat", message: "Python device identity exceeds guest ABI range" });
             if (!devices) {
                 devices = new Map();
                 this.#devices.set(identityScope, devices);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-fs",
-  "version": "0.1.802",
+  "version": "0.1.804",
   "description": "Composable filesystem with a portable core and explicit Node adapters",
   "type": "module",
   "license": "MIT",
@@ -43,12 +43,14 @@
       "types": "./dist/safe-fs/testing/atomic-filesystem.d.ts",
       "workerd": "./dist/safe-fs/testing/atomic-filesystem.js",
       "browser": "./dist/safe-fs/testing/atomic-filesystem.js",
+      "worker": "./dist/safe-fs/testing/atomic-filesystem.js",
       "import": "./dist/safe-fs/testing/atomic-filesystem.js"
     },
     "./testing/object-publication": {
       "types": "./dist/safe-fs/testing/object-publication.d.ts",
       "workerd": "./dist/safe-fs/testing/object-publication.js",
       "browser": "./dist/safe-fs/testing/object-publication.js",
+      "worker": "./dist/safe-fs/testing/object-publication.js",
       "import": "./dist/safe-fs/testing/object-publication.js"
     },
     "./node": {
@@ -63,10 +65,12 @@
       "types": {
         "workerd": "./dist/safe-fs/node-unavailable.d.ts",
         "browser": "./dist/safe-fs/node-unavailable.d.ts",
+        "worker": "./dist/safe-fs/node-unavailable.d.ts",
         "default": "./dist/safe-fs/node/filesystem.d.ts"
       },
       "workerd": null,
       "browser": null,
+      "worker": null,
       "import": "./dist/safe-fs/node/filesystem.js"
     },
     "./fs/memory": {
@@ -138,9 +142,15 @@
   },
   "imports": {
     "#safe-fs-s3-request": {
-      "types": "./dist/safe-fs/fs/s3/http/request-node.d.ts",
+      "types": {
+        "workerd": "./dist/safe-fs/fs/s3/http/request-fetch.d.ts",
+        "browser": "./dist/safe-fs/fs/s3/http/request-fetch.d.ts",
+        "worker": "./dist/safe-fs/fs/s3/http/request-fetch.d.ts",
+        "default": "./dist/safe-fs/fs/s3/http/request-node.d.ts"
+      },
       "workerd": "./dist/safe-fs/fs/s3/http/request-fetch.js",
       "browser": "./dist/safe-fs/fs/s3/http/request-fetch.js",
+      "worker": "./dist/safe-fs/fs/s3/http/request-fetch.js",
       "default": "./dist/safe-fs/fs/s3/http/request-node.js"
     },
     "#safe-fs-platform": {