@poe-platform/safe-fs 0.1.805 → 0.1.807

package/README.md

@@ -35,7 +35,7 @@ rename nor inode/version identity from placeholder native metadata. Retained
 reads remain available, with native seek reporting `ENOTSUP`. Ordinary browser
 bundles cannot import this backend. Node keeps its POSIX host profile.
 
-For host storage, use `await createRealFileSystem({ root: "/absolute/existing/directory" })` instead. The root must already exist; virtual `/` maps to that directory. ZIP creation and updates can use this adapter's private owned staging in an isolated host tree. Unzip extraction requires atomic ancestry verification, currently supported by MemoryFileSystem; the real adapter and mount views refuse it. Its `trustedOwnedStaging` capability checks original entries before publication and cleanup, and preserves foreign staging children. It does not advertise atomic conditional mutations: keep external writers and other in-flight writes away from the tree during these operations. Read the safety boundary below before exposing it to untrusted code.
+For host storage, use `await createRealFileSystem({ root: "/absolute/existing/directory" })` instead. The root must already exist; virtual `/` maps to that directory. ZIP creation and updates can use this adapter's private owned staging in an isolated host tree. Archive extraction requires atomic ancestry verification. MemoryFileSystem supports it, including a writable root composed with read-only mounts such as `/skills/.system`; the real adapter refuses it. Mount extraction delegates confinement to the root backend and keeps other mounts read-only in the extraction view. Extraction roots inside a separate mount are rejected because directory and metadata mutations cannot atomically guard ancestors on another backend. Staged file publication supports nested writable mounts when every ancestor provides authoritative validation. Its `trustedOwnedStaging` capability checks original entries before publication and cleanup, and preserves foreign staging children. It does not advertise atomic conditional mutations: keep external writers and other in-flight writes away from the tree during these operations. Read the safety boundary below before exposing it to untrusted code.
 
 To create new outputs with Safe Bash's `dos2unix`, `unix2dos`, or compression commands, host adapters need atomic no-replace publication. Supply `createRealFileSystem({ root, renameNoReplace })` only when that callback binds a qualified native primitive such as Linux `renameat2` with `RENAME_NOREPLACE`. It receives resolved absolute host paths and an optional signal in its third argument. Existing destinations must reject `EEXIST` atomically; existence checks followed by rename and copy/delete are insufficient. Without this binding the adapter explicitly refuses those operations. See the [no-replace contract](src/contracts/filesystem.md#atomic-no-replace-rename).
 
@@ -148,7 +148,7 @@ Omit `maxOperations` or pass `Infinity` for unlimited cleanup operations.
 | `createOverlayFileSystem({ upper, lower })` | Reading through to a lower layer and writing changes to an upper layer |
 | `withFileSystemQuota(filesystem, { maxBytes })` | Enforcing a cumulative logical-byte ceiling across every write path |
 
-`createNodeFsBridge` offers a promises-shaped subset, including recursive `cp` and `mkdtemp`. A trusted `reserveReadFile` callback can reserve host resources and return a release function; cancellation retains the reservation until the backend read settles. The portable `createFsBridge` from `@poe-platform/safe-fs/core` instead requires a caller-supplied text codec and returns `Uint8Array` values.
+`createNodeFsBridge` offers a promises-shaped subset, including recursive `cp` and `mkdtemp`. A trusted `reserveReadFile` callback can reserve host resources and return a release function; cancellation retains the reservation until the backend read settles. The portable `createFsBridge` from `@poe-platform/safe-fs/bridge` instead requires a caller-supplied text codec and returns `Uint8Array` values.
 
 ## Write an adapter
 
@@ -253,7 +253,7 @@ console.log(new TextDecoder().decode(await catalog.readFile("/welcome.txt")));
 
 Output: `Hello from the catalog`. `readFile` returns a copy so callers cannot mutate the stored snapshot. Reads check cancellation and `maxBytes`; required mutations always reject with `EROFS`. `stat` and `lstat` share an implementation because this adapter has no symlinks.
 
-`createFileSystem` validates options before calling the factory. The Node registry includes `memory` and `real`, accepts new names, and rejects attempts to replace those defaults. For an explicit allowlist without either default, pass `new Map([["catalog", catalogAdapter]])` directly as `registry`. Names select registered factories; they do not load modules from config.
+`createFileSystem` validates options before calling the factory. For Workers, import `createPortableFileSystemAdapterRegistry` and `createFileSystem` from `@poe-code/safe-fs/core`; the portable registry includes `memory` and caller-supplied adapters, without ambient filesystem access. The Node registry includes `memory` and `real`, accepts new names, and rejects attempts to replace those defaults. For an explicit allowlist without either default, pass `new Map([["catalog", catalogAdapter]])` directly as `registry`. Names select registered factories; they do not load modules from config.
 
 For a mutable backend, preserve exclusive-create behavior, return independent byte buffers, handle cancellation and size limits, and declare only capabilities you actually provide. Use `FsError` for filesystem failures. Do not invent entry identity from matching paths or metadata; omit `compareEntry` when identity is unknown.
 
@@ -357,8 +357,8 @@ Each batch lists from the beginning because previous keys have been deleted; it
 | `addressingStyle` | `path`; alternative `virtual-hosted` requires a DNS endpoint |
 | `listUrlEncoding` | `percent`; alternative `form` |
 | `allowInsecureHttp` | `false`; HTTPS required unless explicitly enabled |
-| `maxPutBytes`, `maxGetBytes` | Unlimited unless configured |
-| `maxXmlBytes` | Unlimited unless configured |
+| `maxPutBytes`, `maxGetBytes` | Unlimited when omitted or `Infinity`; positive safe integers set byte caps |
+| `maxXmlBytes` | Unlimited when omitted or `Infinity`; positive safe integers set a byte cap |
 | `requestTimeoutMs` | Unlimited unless configured |
 | `enableCopy` | `true`; disabling uses a buffered GET/PUT fallback |
 | `verifiedConditionalOperations` | Optional `put`, `copy`, `delete` booleans, each defaulting to false; enable only after verifying the server's semantics |

package/dist/safe-fs/bridge/filesystem.d.ts

@@ -12,6 +12,7 @@ type DirectoryOptions = {
 };
 export declare class FileSystemBridge<Binary extends Uint8Array> {
     #private;
+    static getProvider(bridge: object): FileSystem | undefined;
     constructor(fs: FileSystem, options: {
         readonly cwd?: string;
         readonly root?: string;

package/dist/safe-fs/bridge/filesystem.js

@@ -40,6 +40,9 @@ function timeValue(value) {
     return number;
 }
 export class FileSystemBridge {
+    static getProvider(bridge) {
+        return #fs in bridge ? bridge.#fs : undefined;
+    }
     #fs;
     #cwd;
     #root;

package/dist/safe-fs/bridge/index.d.ts

@@ -4,3 +4,4 @@ import type { FsBridgeOptions } from "./types.js";
 export type { FsBridgeCodec, FsBridgeDirent, FsBridgeEncoding, FsBridgeFileSystem, FsBridgeOptions, FsBridgeStats } from "./types.js";
 export type FsBridge = FileSystemBridge<Uint8Array<ArrayBuffer>>;
 export declare function createFsBridge(fs: FileSystem, options: FsBridgeOptions): FsBridge;
+export declare const getFsBridgeProvider: typeof FileSystemBridge.getProvider;

package/dist/safe-fs/bridge/index.js

@@ -16,3 +16,4 @@ export function createFsBridge(fs, options) {
         }
     });
 }
+export const getFsBridgeProvider = FileSystemBridge.getProvider;

package/dist/safe-fs/config/registry.d.ts

@@ -0,0 +1,2 @@
+import type { FileSystemAdapterRegistry } from "../config.js";
+export declare function extendAdapterRegistry(defaults: FileSystemAdapterRegistry, extensions?: FileSystemAdapterRegistry): FileSystemAdapterRegistry;

package/dist/safe-fs/config/registry.js

@@ -0,0 +1,15 @@
+export function extendAdapterRegistry(defaults, extensions) {
+    if (extensions !== undefined &&
+        (extensions === null ||
+            typeof extensions.get !== "function" ||
+            typeof extensions[Symbol.iterator] !== "function")) {
+        throw new TypeError("registry must be a filesystem adapter map.");
+    }
+    const registry = new Map(defaults);
+    for (const [name, descriptor] of extensions ?? []) {
+        if (registry.has(name))
+            throw new TypeError(`Filesystem adapter already registered: ${name}`);
+        registry.set(name, descriptor);
+    }
+    return registry;
+}

package/dist/safe-fs/config.node.js

@@ -1,22 +1,11 @@
+import { extendAdapterRegistry } from "./config/registry.js";
 import { createMemoryFileSystemAdapter } from "./config/memory.js";
 import { createRealFileSystemAdapter } from "./config/real.js";
 import { createMemoryFileSystem } from "./fs/memory/index.js";
 import { createRealFileSystem } from "./fs/real/index.js";
 export function createNodeFileSystemAdapterRegistry(extensions) {
-    if (extensions !== undefined &&
-        (extensions === null ||
-            typeof extensions.get !== "function" ||
-            typeof extensions[Symbol.iterator] !== "function")) {
-        throw new TypeError("registry must be a filesystem adapter map.");
-    }
-    const registry = new Map([
+    return extendAdapterRegistry(new Map([
         ["memory", createMemoryFileSystemAdapter(createMemoryFileSystem)],
         ["real", createRealFileSystemAdapter(createRealFileSystem)]
-    ]);
-    for (const [name, descriptor] of extensions ?? []) {
-        if (registry.has(name))
-            throw new TypeError(`Filesystem adapter already registered: ${name}`);
-        registry.set(name, descriptor);
-    }
-    return registry;
+    ]), extensions);
 }

package/dist/safe-fs/config.portable.d.ts

@@ -0,0 +1,3 @@
+import type { FileSystemAdapterRegistry } from "./config.js";
+/** Portable defaults never grant access to the host filesystem. */
+export declare function createPortableFileSystemAdapterRegistry(extensions?: FileSystemAdapterRegistry): FileSystemAdapterRegistry;

package/dist/safe-fs/config.portable.js

@@ -0,0 +1,9 @@
+import { createMemoryFileSystemAdapter } from "./config/memory.js";
+import { extendAdapterRegistry } from "./config/registry.js";
+import { createMemoryFileSystem } from "./fs/memory/index.js";
+/** Portable defaults never grant access to the host filesystem. */
+export function createPortableFileSystemAdapterRegistry(extensions) {
+    return extendAdapterRegistry(new Map([
+        ["memory", createMemoryFileSystemAdapter(createMemoryFileSystem)]
+    ]), extensions);
+}

package/dist/safe-fs/contracts/filesystem.d.ts

@@ -284,6 +284,17 @@ export interface PublishStagedFileOptions extends FsOptions {
     readonly parent: FileStat;
     readonly destination: FileStat | null;
 }
+/** Publish one staged regular file and validate/retire sibling source entries in
+ * the same indivisible commit. Every expected version (including absence) must
+ * match before any mutation. Hosts must not emulate this with sequential calls.
+ * Unavailable hosts omit publishStagedFileSet. Sources remain caller-owned. */
+export interface PublishStagedFileSetOptions extends PublishStagedFileOptions {
+    readonly companions: readonly {
+        readonly path: string;
+        readonly expected: FileStat | null;
+        readonly remove: boolean;
+    }[];
+}
 export interface PrepareDirectoryOptions extends FsOptions {
     readonly expected: FileStat | null;
     readonly parent: FileStat;
@@ -321,6 +332,7 @@ export interface FileSystem {
     prepareDirectory?(path: string, options: PrepareDirectoryOptions): Promise<FileStat>;
     createStagedFile?(directoryPath: string, name: string, content: StagedFileContent, options: CreateStagedFileOptions): Promise<FileStaging>;
     publishStagedFile?(staging: FileStaging, destination: string, options: PublishStagedFileOptions): Promise<void>;
+    publishStagedFileSet?(staging: FileStaging, destination: string, options: PublishStagedFileSetOptions): Promise<FileStat>;
     /** Admit a complete canonical root-to-directory prefix and prepare a guard.
      * The returned guard checks current identities/search access synchronously;
      * preparation is not validation, and the guard's result is not an async lease. */

package/dist/safe-fs/contracts/index.d.ts

@@ -3,3 +3,4 @@ export * from "./filesystem.js";
 export * from "./io.js";
 export * from "./path.js";
 export * from "./object.js";
+export { compareIdentity, compareFileVersion } from "../fs/mount/identity.js";

package/dist/safe-fs/contracts/index.js

@@ -3,3 +3,4 @@ export * from "./filesystem.js";
 export * from "./io.js";
 export * from "./path.js";
 export * from "./object.js";
+export { compareIdentity, compareFileVersion } from "../fs/mount/identity.js";

package/dist/safe-fs/contracts/io.js

@@ -211,7 +211,7 @@ class ReadBytesGenerator {
         if (!this.finished && this.iterator?.return) {
             this.finished = true;
             const it = this.iterator;
-            const cleanup = Promise.resolve().then(() => it.return());
+            const cleanup = new Promise(resolve => { resolve(it.return()); });
             if (signal?.aborted)
                 void cleanup.catch(noop);
             else

package/dist/safe-fs/core.d.ts

@@ -14,3 +14,6 @@ export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export * from "./fs/s3/index.js";
 export * from "./fs/s3/http/index.js";
+export { createFileSystem, readConfigRecord, validateFileSystemConfig } from "./config.js";
+export type { FileSystemConfig, FileSystemAdapterDescriptor, FileSystemAdapterRegistry } from "./config.js";
+export { createPortableFileSystemAdapterRegistry } from "./config.portable.js";

package/dist/safe-fs/core.js

@@ -13,3 +13,5 @@ export * from "./contracts/object.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export * from "./fs/s3/index.js";
 export * from "./fs/s3/http/index.js";
+export { createFileSystem, readConfigRecord, validateFileSystemConfig } from "./config.js";
+export { createPortableFileSystemAdapterRegistry } from "./config.portable.js";

package/dist/safe-fs/fs/devices/index.d.ts

@@ -1,5 +1,5 @@
 import type { FileDescriptor, OpenFileOptions } from "../../contracts/descriptor.js";
-import type { AppendFileOptions, CapabilityQueryOptions, CopyFileOptions, DirectoryEntry, FileReadHandle, FileResizeHandle, FileResizeOperation, FileResizeOptions, FileStat, FileSystem, OpenReadFileOptions, OpenResizeFileOptions, FileSystemCapabilities, FsOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, WriteFileOptions, ConditionalFilePublicationOptions, ConditionalWriteFileOptions, ConditionalRemoveFileOptions, ConditionalRemoveEntryOptions, ConditionalRemoveEntryReceiptOptions, CreateStagedFileOptions, FileStaging, FileStagingEntry, FileStagingResolution, PublishStagedFileOptions, PrepareDirectoryOptions, StagedFileContent } from "../../contracts/filesystem.js";
+import type { AppendFileOptions, CapabilityQueryOptions, CopyFileOptions, DirectoryEntry, FileReadHandle, FileResizeHandle, FileResizeOperation, FileResizeOptions, FileStat, FileSystem, OpenReadFileOptions, OpenResizeFileOptions, FileSystemCapabilities, FsOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, WriteFileOptions, ConditionalFilePublicationOptions, ConditionalWriteFileOptions, ConditionalRemoveFileOptions, ConditionalRemoveEntryOptions, ConditionalRemoveEntryReceiptOptions, CreateStagedFileOptions, FileStaging, FileStagingEntry, FileStagingResolution, PublishStagedFileOptions, PublishStagedFileSetOptions, PrepareDirectoryOptions, StagedFileContent } from "../../contracts/filesystem.js";
 import type { ByteSource } from "../../contracts/io.js";
 import { type EntryLocation } from "../mount/comparison.js";
 import { pathNamespace } from "../path-namespace.js";
@@ -40,6 +40,7 @@ export declare class DeviceFileSystem implements FileSystem {
     removeTreeConditional(path: string, options: ConditionalRemoveEntryOptions): Promise<void>;
     createStagedFile(path: string, name: string, content: StagedFileContent, options: CreateStagedFileOptions): Promise<FileStaging>;
     publishStagedFile(staging: FileStaging, destination: string, options: PublishStagedFileOptions): Promise<void>;
+    publishStagedFileSet(receipt: FileStaging, destination: string, supplied: PublishStagedFileSetOptions): Promise<FileStat>;
     prepareDirectoryAncestry(ancestors: readonly FileStagingEntry[], options?: FsOptions): Promise<() => true>;
     prepareStagingResolution(path: string, options?: FsOptions): Promise<FileStagingResolution>;
     removeStagedFile(staging: FileStaging, options?: FsOptions): Promise<void>;

package/dist/safe-fs/fs/devices/index.js

@@ -639,6 +639,47 @@ export class DeviceFileSystem {
             await requireOwnedMutation(this.#filesystem, destination, "guardedStagingPublication", options, options.destination === null);
         await this.#filesystem.publishStagedFile(staging, destination, options);
     }
+    async publishStagedFileSet(receipt, destination, supplied) {
+        const publish = this.#filesystem.publishStagedFileSet;
+        if (!publish)
+            throw new FsError("ENOTSUP", { path: destination });
+        const entry = (value) => ({ path: value.path, stat: { ...value.stat } });
+        const staging = { ...receipt, parent: entry(receipt.parent), directory: entry(receipt.directory), file: entry(receipt.file) };
+        const options = {
+            ...supplied,
+            parent: { ...supplied.parent },
+            destination: supplied.destination === null ? null : { ...supplied.destination },
+            companions: supplied.companions.map(value => ({ ...value, expected: value.expected === null ? null : { ...value.expected } })),
+            ...(supplied.ancestors === undefined ? {} : { ancestors: snapshotDirectoryAncestry(supplied.ancestors) }),
+        };
+        options.signal?.throwIfAborted();
+        const capabilities = await this.#filesystem.capabilitiesFor?.(destination, { ...options, create: options.destination === null }) ?? this.#filesystem.capabilities;
+        if (capabilities.readOnly === true)
+            throw new FsError("EROFS", { path: destination });
+        for (const path of [staging.parent.path, staging.directory.path])
+            await this.#mutable(path, options, false);
+        const guards = [];
+        if (options.ancestors)
+            guards.push(await this.prepareDirectoryAncestry(options.ancestors, options));
+        for (const path of [staging.file.path, destination, ...options.companions.map(value => value.path)]) {
+            await this.#mutable(path, options, false);
+            const resolution = await this.prepareStagingResolution(path, options);
+            guards.push(resolution.validate);
+        }
+        const callerGuard = options.commitGuard;
+        options.signal?.throwIfAborted();
+        return publish.call(this.#filesystem, staging, destination, { ...options, commitGuard: () => {
+                options.signal?.throwIfAborted();
+                if (callerGuard !== undefined)
+                    runStagingGuard(callerGuard);
+                // Recheck every route in the backend's atomic commit, so a source cannot
+                // cross into the virtual device namespace after asynchronous admission.
+                for (const guard of guards)
+                    runStagingGuard(guard);
+                options.signal?.throwIfAborted();
+                return true;
+            } });
+    }
     async prepareDirectoryAncestry(ancestors, options = {}) {
         options.signal?.throwIfAborted();
         try {

package/dist/safe-fs/fs/memory/index.d.ts

@@ -1,4 +1,4 @@
-import type { AppendFileOptions, CopyFileOptions, DirectoryEntry, EntryComparison, FileReadHandle, FileResizeHandle, FileStat, FileSystem, FileSystemCapabilities, FsOptions, ChmodOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, FileDescriptor, OpenFileOptions, OpenReadFileOptions, OpenResizeFileOptions, WriteFileOptions, ConditionalWriteFileOptions, ConditionalRemoveFileOptions, ConditionalRemoveEntryOptions, ConditionalRemoveEntryReceiptOptions, CreateStagedFileOptions, FileStaging, FileStagingEntry, FileStagingResolution, PublishStagedFileOptions, PrepareDirectoryOptions, StagedFileContent } from "../../contracts/filesystem.js";
+import type { AppendFileOptions, CopyFileOptions, DirectoryEntry, EntryComparison, FileReadHandle, FileResizeHandle, FileStat, FileSystem, FileSystemCapabilities, FsOptions, ChmodOptions, RenameOptions, MkdirOptions, ReadDirectoryOptions, ReadFileOptions, ReadStreamOptions, RemoveOptions, FileDescriptor, OpenFileOptions, OpenReadFileOptions, OpenResizeFileOptions, WriteFileOptions, ConditionalWriteFileOptions, ConditionalRemoveFileOptions, ConditionalRemoveEntryOptions, ConditionalRemoveEntryReceiptOptions, CreateStagedFileOptions, FileStaging, FileStagingEntry, FileStagingResolution, PublishStagedFileOptions, PublishStagedFileSetOptions, PrepareDirectoryOptions, StagedFileContent } from "../../contracts/filesystem.js";
 import type { ByteSource } from "../../contracts/io.js";
 import { type MemoryAtomicView } from "./atomic-view.js";
 import { MemoryAllocation, MemoryLedger } from "./ledger.js";
@@ -35,7 +35,6 @@ interface SymlinkNode extends Metadata {
 }
 type MemoryNode = FileNode | DirectoryNode | SymlinkNode;
 declare class MemoryCache {
-    readonly allocations: MemoryAllocation[];
     readonly files: FileNode[];
     readonly directories: DirectoryNode[];
     readonly removedScratch: MemoryNode[];
@@ -118,6 +117,7 @@ export declare class MemoryFileSystem implements FileSystem {
     prepareStagingResolution(path: string, options?: FsOptions): Promise<FileStagingResolution>;
     private verifyDirectoryAncestry;
     publishStagedFile(receipt: FileStaging, destination: string, options: PublishStagedFileOptions): Promise<void>;
+    publishStagedFileSet(receipt: FileStaging, destination: string, options: PublishStagedFileSetOptions): Promise<FileStat>;
     removeStagedFile(staging: FileStaging, options?: FsOptions): Promise<void>;
     private removeStagingLocations;
     prepareDirectory(path: string, options: PrepareDirectoryOptions): Promise<FileStat>;

package/dist/safe-fs/fs/memory/index.js

@@ -324,13 +324,6 @@ class FastDirectoryEntriesMap {
 }
 const SHARED_POOL_CAPACITY = 256;
 const SHARED_DIR_POOL_CAPACITY = 64;
-const sharedAllocationPool = new Array(SHARED_POOL_CAPACITY).fill(DUMMY_POOL_ALLOCATION);
-let sharedAllocationPoolLen = 0;
-const SHARED_LARGE_POOL_CAPACITY = 8;
-const sharedLargeAllocationPool = new Array(SHARED_LARGE_POOL_CAPACITY).fill(DUMMY_POOL_ALLOCATION);
-let sharedLargeAllocationPoolLen = 0;
-const sharedMediumAllocationPool = new Array(SHARED_LARGE_POOL_CAPACITY).fill(DUMMY_POOL_ALLOCATION);
-let sharedMediumAllocationPoolLen = 0;
 const sharedFileNodePool = new Array(SHARED_POOL_CAPACITY).fill(DUMMY_POOL_FILE_NODE);
 let sharedFileNodePoolLen = 0;
 const sharedDirectoryNodePool = new Array(SHARED_DIR_POOL_CAPACITY);
@@ -351,27 +344,9 @@ function collectRemovedChild(child, name) {
     sharedRemovedKeyEntries++;
 }
 function replenishSharedMemoryPools() {
-    while (sharedAllocationPoolLen < 112) {
-        DUMMY_POOL_LEDGER.reserve(64, 0, "init", "/");
-        const alloc = new MemoryAllocation(new Uint8Array(64), DUMMY_POOL_LEDGER);
-        alloc.release();
-        sharedAllocationPool[sharedAllocationPoolLen++] = alloc;
-    }
     while (sharedFileNodePoolLen < 112) {
         sharedFileNodePool[sharedFileNodePoolLen++] = new MemoryFileNode(0, 0, 0, 0, DUMMY_POOL_ALLOCATION, undefined);
     }
-    while (sharedLargeAllocationPoolLen < 4) {
-        DUMMY_POOL_LEDGER.reserve(65536, 0, "init", "/");
-        const alloc = new MemoryAllocation(new Uint8Array(65536), DUMMY_POOL_LEDGER);
-        alloc.release();
-        sharedLargeAllocationPool[sharedLargeAllocationPoolLen++] = alloc;
-    }
-    while (sharedMediumAllocationPoolLen < 4) {
-        DUMMY_POOL_LEDGER.reserve(16384, 0, "init", "/");
-        const alloc = new MemoryAllocation(new Uint8Array(16384), DUMMY_POOL_LEDGER);
-        alloc.release();
-        sharedMediumAllocationPool[sharedMediumAllocationPoolLen++] = alloc;
-    }
     while (sharedDirectoryNodePoolLen < 16) {
         sharedDirectoryNodePool[sharedDirectoryNodePoolLen++] = new MemoryDirectoryNode(0, 0, 0);
     }
@@ -403,7 +378,6 @@ Object.assign(MemoryDirectoryNode.prototype, {
 const DUMMY_POOL_DIR_NODE = new MemoryDirectoryNode(0, 0, null);
 DUMMY_POOL_DIR_NODE.atimeMs = DUMMY_POOL_DIR_NODE.mtimeMs = DUMMY_POOL_DIR_NODE.ctimeMs = DUMMY_POOL_DIR_NODE.birthtimeMs = 1700000000000;
 class MemoryCache {
-    allocations = [];
     files = [];
     directories = [];
     removedScratch = [];
@@ -448,7 +422,7 @@ const compareOwnedMemory = async (own, peer, options) => {
     let answer = "unknown";
     const visited = new Set();
     for (const [left, right] of [[own, peer], [peer, own]]) {
-        if ((!registeredAuthorities.has(left.filesystem) && !ownedStores.has(left.filesystem)) || visited.has(left.filesystem))
+        if (!registeredAuthorities.has(left.filesystem) || visited.has(left.filesystem))
             continue;
         visited.add(left.filesystem);
         const comparison = left.filesystem.compareEntry;
@@ -911,21 +885,6 @@ export class MemoryFileSystem {
             node.sourceRef = undefined;
             node.allocation = DUMMY_POOL_ALLOCATION;
             alloc.release();
-            if (alloc.isReleased64()) {
-                alloc.detachLedger(DUMMY_POOL_LEDGER);
-                if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedAllocationPoolLen < SHARED_POOL_CAPACITY) {
-                    sharedAllocationPool[sharedAllocationPoolLen++] = alloc;
-                }
-                else if (cache.allocations.length < 128) {
-                    cache.allocations.push(alloc);
-                }
-            }
-            else if (alloc.isReleased65536()) {
-                alloc.detachLedger(DUMMY_POOL_LEDGER);
-                if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedLargeAllocationPoolLen < SHARED_LARGE_POOL_CAPACITY) {
-                    sharedLargeAllocationPool[sharedLargeAllocationPoolLen++] = alloc;
-                }
-            }
             if (sharedFileNodePoolLen < SHARED_POOL_CAPACITY) {
                 sharedFileNodePool[sharedFileNodePoolLen++] = node;
             }
@@ -965,18 +924,6 @@ export class MemoryFileSystem {
         node.view = length === allocation.data.byteLength ? allocation.data : undefined;
         node.allocation = allocation;
         previous.release();
-        if (previous.isReleased64()) {
-            previous.detachLedger(DUMMY_POOL_LEDGER);
-            if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedAllocationPoolLen < SHARED_POOL_CAPACITY) {
-                sharedAllocationPool[sharedAllocationPoolLen++] = previous;
-            }
-        }
-        else if (previous.isReleased65536()) {
-            previous.detachLedger(DUMMY_POOL_LEDGER);
-            if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedLargeAllocationPoolLen < SHARED_LARGE_POOL_CAPACITY) {
-                sharedLargeAllocationPool[sharedLargeAllocationPoolLen++] = previous;
-            }
-        }
     }
     admitSize(node, length, syscall, path) {
         this.ledger.fileSize(length, syscall, path);
@@ -1354,36 +1301,7 @@ export class MemoryFileSystem {
         if (length === 0) {
             return DUMMY_POOL_ALLOCATION;
         }
-        if (length === 16384) {
-            if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedMediumAllocationPoolLen > 0) {
-                const pooled = sharedMediumAllocationPool[--sharedMediumAllocationPoolLen];
-                sharedMediumAllocationPool[sharedMediumAllocationPoolLen] = DUMMY_POOL_ALLOCATION;
-                pooled.reuse(this.ledger);
-                return pooled;
-            }
-        }
-        if (length === 65536) {
-            if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedLargeAllocationPoolLen > 0) {
-                const pooled = sharedLargeAllocationPool[--sharedLargeAllocationPoolLen];
-                sharedLargeAllocationPool[sharedLargeAllocationPoolLen] = DUMMY_POOL_ALLOCATION;
-                pooled.reuse(this.ledger);
-                return pooled;
-            }
-        }
-        if (length === 64) {
-            let pooled;
-            if (this.ledger.hasInfiniteRetained && this.ledger.hasInfiniteFileBytes && sharedAllocationPoolLen > 0) {
-                pooled = sharedAllocationPool[--sharedAllocationPoolLen];
-                sharedAllocationPool[sharedAllocationPoolLen] = DUMMY_POOL_ALLOCATION;
-            }
-            else {
-                pooled = memoryCaches.get(this.ledger).allocations.pop();
-            }
-            if (pooled) {
-                pooled.reuse(this.ledger);
-                return pooled;
-            }
-        }
+        // Views can outlive files: never recycle their backing buffers across owners.
         try {
             return new MemoryAllocation(new Uint8Array(length), this.ledger);
         }
@@ -2329,6 +2247,93 @@ export class MemoryFileSystem {
             this.fail("EAGAIN", "publishStagedFile", destination);
         return MemoryFileSystem.prototype.rename.call(this, staging.file.path, destination, { ...controls, noReplace: expected === null });
     }
+    async publishStagedFileSet(receipt, destination, options) {
+        const signal = options.signal;
+        const guard = options.commitGuard;
+        const ancestors = options.ancestors === undefined ? undefined : snapshotDirectoryAncestry(options.ancestors);
+        const snapshot = (entry) => ({ path: entry.path, stat: { ...entry.stat } });
+        const staging = { parent: snapshot(receipt.parent), directory: snapshot(receipt.directory), file: snapshot(receipt.file) };
+        const parent = { ...options.parent };
+        const expected = options.destination === null ? null : { ...options.destination };
+        const companions = options.companions.map(entry => ({ path: entry.path, expected: entry.expected === null ? null : { ...entry.expected }, remove: entry.remove }));
+        const syscall = "publishStagedFileSet";
+        const parentPath = destination.slice(0, destination.lastIndexOf("/")) || "/";
+        const paths = new Set([destination]);
+        const canonical = (path) => path.startsWith("/") && path.slice(1).split("/").every(part => part !== "" && part !== "." && part !== "..");
+        if (!canonical(destination) || ancestors && ancestors.at(-1)?.path !== parentPath)
+            this.fail("EINVAL", syscall, destination);
+        for (const entry of companions) {
+            if (!canonical(entry.path) || paths.has(entry.path) || (entry.path.slice(0, entry.path.lastIndexOf("/")) || "/") !== parentPath)
+                this.fail("EINVAL", syscall, entry.path);
+            paths.add(entry.path);
+        }
+        signal?.throwIfAborted();
+        if (guard !== undefined)
+            runStagingGuard(guard);
+        signal?.throwIfAborted();
+        if (ancestors)
+            this.verifyDirectoryAncestry(ancestors, signal === undefined ? {} : { signal });
+        const { directory, file } = this.stagingLocations(staging);
+        this.expectEntry(file.node, staging.file.stat, staging.file.path);
+        const target = this.entry(destination, syscall, true);
+        this.expectEntry(target.parent, parent, destination, false);
+        this.expectEntry(target.node, expected, destination);
+        const node = file.node;
+        if (node.type !== "file" || target.parent === directory.node || target.node === node)
+            this.fail("EINVAL", syscall, destination);
+        if (target.node && target.node.type !== "file")
+            this.fail("EAGAIN", syscall, destination);
+        this.permission(file.parent, 3, syscall, staging.file.path);
+        this.permission(target.parent, 3, syscall, destination);
+        const retired = [];
+        for (const companion of companions) {
+            const location = this.entry(companion.path, syscall, true);
+            if (location.parent !== target.parent || location.node === node)
+                this.fail("EINVAL", syscall, companion.path);
+            this.expectEntry(location.node, companion.expected, companion.path);
+            if (location.node && location.node.type !== "file")
+                this.fail("EAGAIN", syscall, companion.path);
+            if (companion.remove && location.node)
+                retired.push(location);
+        }
+        const now = Date.now();
+        const published = { ...this.snapshot(node), ctimeMs: now, revision: Math.min(Number.MAX_SAFE_INTEGER + 1, node.revision + 1) };
+        // Admission and all source-set checks precede the single synchronous commit.
+        // No calls to overridable async mutations can interleave a partial result.
+        const nameGrowth = target.node ? 0 : (target.name.length - file.name.length) * 2;
+        this.ledger.reserve(Math.max(0, nameGrowth), 0, syscall, destination);
+        try {
+            target.parent.entries.set(target.name, node);
+        }
+        catch (error) {
+            this.ledger.release(Math.max(0, nameGrowth), 0);
+            throw error;
+        }
+        memoryCaches.get(this.ledger).clearWrites();
+        file.parent.entries.delete(file.name);
+        const unlink = (entry) => {
+            entry.node.nlink--;
+            entry.node.ctimeMs = now;
+            entry.node.revision = Math.min(Number.MAX_SAFE_INTEGER + 1, entry.node.revision + 1);
+            this.releaseNode(entry.node);
+        };
+        if (target.node) {
+            this.ledger.release(file.name.length * 2, 1);
+            unlink(target);
+        }
+        else if (nameGrowth < 0)
+            this.ledger.release(-nameGrowth, 0);
+        for (const entry of retired) {
+            entry.parent.entries.delete(entry.name);
+            this.ledger.release(entry.name.length * 2, 1);
+            unlink(entry);
+        }
+        this.changed(file.parent, now);
+        this.changed(target.parent, now);
+        node.ctimeMs = now;
+        node.revision = published.revision;
+        return published;
+    }
     async removeStagedFile(staging, options = {}) {
         options.signal?.throwIfAborted();
         const { directory, file } = this.stagingLocations(staging);

package/dist/safe-fs/fs/memory/ledger.d.ts

@@ -23,8 +23,4 @@ export declare class MemoryAllocation {
     constructor(data: Uint8Array, ledger: MemoryLedger);
     retain(): void;
     release(): void;
-    isReleased64(): boolean;
-    isReleased65536(): boolean;
-    detachLedger(dummyLedger: MemoryLedger): void;
-    reuse(ledger?: MemoryLedger): void;
 }

package/dist/safe-fs/fs/memory/ledger.js

@@ -89,21 +89,6 @@ export class MemoryAllocation {
             this.ledger.release(this.data.byteLength, 0);
         }
     }
-    isReleased64() {
-        return this.references === 0 && this.data.byteLength === 64;
-    }
-    isReleased65536() {
-        return this.references === 0 && this.data.byteLength === 65536;
-    }
-    detachLedger(dummyLedger) {
-        this.ledger = dummyLedger;
-    }
-    reuse(ledger) {
-        this.references = 1;
-        if (ledger !== undefined)
-            this.ledger = ledger;
-        this.data.fill(0);
-    }
 }
 Object.assign(MemoryAllocation.prototype, {
     references: 1,

package/dist/safe-fs/fs/mount/identity.d.ts

@@ -1,2 +1,6 @@
 import type { FileStat } from "../../contracts/filesystem.js";
 export declare function compareIdentity(left: FileStat | undefined, right: FileStat | undefined): "same" | "distinct" | "unknown";
+/** Compare content snapshots, including adapter generations when supplied.
+ * Identity is checked separately so identityless streaming adapters remain usable.
+ */
+export declare function compareFileVersion(left: FileStat, right: FileStat): boolean;

package/dist/safe-fs/fs/mount/identity.js

@@ -19,3 +19,11 @@ export function compareIdentity(left, right) {
         return "distinct";
     return "unknown";
 }
+/** Compare content snapshots, including adapter generations when supplied.
+ * Identity is checked separately so identityless streaming adapters remain usable.
+ */
+export function compareFileVersion(left, right) {
+    return left.type === right.type && left.size === right.size
+        && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs
+        && left.revision === right.revision && left.opaqueVersion === right.opaqueVersion;
+}

package/dist/safe-fs/fs/mount/index.d.ts

@@ -12,6 +12,7 @@ export declare class MountFileSystem implements FileSystem {
     private namespaceMutation;
     private readonly namespaceWaiters;
     constructor(options: MountFileSystemOptions);
+    confineExtraction(roots: readonly string[], options?: FsOptions): Promise<FileSystem>;
     private select;
     capabilitiesFor(path: string, options?: CapabilityQueryOptions): Promise<FileSystemCapabilities>;
     private supportsStagingAncestry;

package/dist/safe-fs/fs/mount/index.js

@@ -9,6 +9,7 @@ import { pathNamespace } from "../path-namespace.js";
 import { createStagingCleanup, snapshotStagingCreation } from "../staging-cleanup.js";
 import { directoryAncestryPaths, inspectStagingBindings, runStagingGuard, snapshotDirectoryAncestry, snapshotStagingResolution } from "../staging-ancestry.js";
 import { compareIdentity } from "./identity.js";
+import { createReadOnlyFileSystem } from "../readonly/index.js";
 import { snapshotConditionalChmod } from "../conditional-chmod.js";
 import { compareEntries, registerEntryAuthority, registerEntryView } from "./comparison.js";
 const syntheticStat = Object.freeze({
@@ -150,6 +151,36 @@ export class MountFileSystem {
             ...(retainedRead === undefined ? {} : { retainedRead }),
         });
     }
+    async confineExtraction(roots, options = {}) {
+        options.signal?.throwIfAborted();
+        const root = this.select("/").backend;
+        const captured = [...roots];
+        for (const path of captured) {
+            validatePath(path);
+            if (normalizePath(globalPath(path)) !== path)
+                fail("EINVAL");
+            // A backing confinement retains its own root-to-destination ancestry.
+            // It cannot retain directories belonging to another mounted backend.
+            if (this.select(path).path !== "/")
+                fail("ENOTSUP");
+        }
+        if (!root.confineExtraction)
+            fail("ENOTSUP");
+        const confined = await root.confineExtraction(captured, options);
+        options.signal?.throwIfAborted();
+        const observations = new Set(["prepareDirectoryAncestry", "prepareStagingResolution"]);
+        const backing = new Proxy(confined, {
+            get(target, key) {
+                // These only capture/validate bindings. Mutations must always use the
+                // backend's confined view, including creation, metadata and hardlinks.
+                const owner = observations.has(key) ? root : target;
+                const value = Reflect.get(owner, key);
+                return typeof value === "function" ? value.bind(owner) : value;
+            },
+        });
+        return new MountFileSystem({ root: backing, mounts: Object.fromEntries(this.mounts.filter(mount => mount.path !== "/").map(mount => [mount.path,
+                mount.backend.capabilities.readOnly === true ? mount.backend : createReadOnlyFileSystem(mount.backend)])) });
+    }
     select(path) {
         return this.mounts.find((mount) => within(mount.path, path));
     }

package/dist/safe-fs/fs/object-publication/index.d.ts

@@ -15,6 +15,7 @@ export interface ObjectFilePublicationOptions extends FsOptions {
     readonly mode: number;
 }
 export interface ObjectFileAcquireOptions extends FsOptions {
+    readonly noFollow?: boolean;
     readonly access: OpenFileOptions["access"];
 }
 export interface ObjectFileStaging {
@@ -28,6 +29,8 @@ export interface ObjectFileStagingOptions extends FsOptions {
     readonly maxFileBytes: number;
 }
 export interface ObjectFilePublicationStore {
+    /** Certifies acquire can reject symbolic links when noFollow is requested. */
+    readonly noFollow?: boolean;
     acquire(path: string, options: ObjectFileAcquireOptions): Promise<ObjectFileVersion | undefined>;
     publish?(path: string, expectedRevision: string | null, source: ByteSource, options: ObjectFilePublicationOptions): Promise<ObjectFileVersion>;
     createStaging?(path: string, options: ObjectFileStagingOptions): Promise<ObjectFileStaging>;

package/dist/safe-fs/fs/object-publication/index.js

@@ -11,6 +11,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
     const maxOpenFiles = options.maxOpenFiles ?? Infinity;
     if (!Number.isSafeInteger(chunkBytes) || chunkBytes < 1
         || ![maxStagedBytes, maxStagedPages, maxFileBytes, maxOpenFiles].every(value => value === Infinity || Number.isSafeInteger(value) && value > 0)
+        || store.noFollow !== undefined && typeof store.noFollow !== "boolean"
         || typeof store.acquire !== "function"
         || store.publish !== undefined && typeof store.publish !== "function"
         || store.createStaging !== undefined && typeof store.createStaging !== "function")
@@ -68,7 +69,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
         state.pages.clear();
     };
     const open = (path, openOptions) => openFileDescriptor(path, openOptions, {
-        publication: "conditional", position: true, positionedRead: true, positionedWrite: true,
+        publication: "conditional", position: true, positionedRead: true, positionedWrite: true, noFollow: store.noFollow === true,
         truncate: true, synchronization: "storage",
     }, async (admitted) => {
         validatePath(path);
@@ -233,7 +234,7 @@ export function withObjectFileDescriptors(filesystem, store, options = {}) {
                 throw new FsError("ENOTSUP", { path, message: "Object writes require authoritative conditional publication" });
             if (admitted.access !== "write" && capabilities.read === false)
                 throw new FsError("EACCES", { path });
-            const acquired = await store.acquire(path, { access: admitted.access, ...(admitted.signal ? { signal: admitted.signal } : {}) });
+            const acquired = await store.acquire(path, { access: admitted.access, ...(admitted.noFollow ? { noFollow: true } : {}), ...(admitted.signal ? { signal: admitted.signal } : {}) });
             if (acquired) {
                 try {
                     state.head = version(acquired);

package/dist/safe-fs/fs/quota/index.js

@@ -499,7 +499,7 @@ export function withFileSystemQuota(fs, options) {
     // capabilities and methods without violating invariants on own properties.
     return new Proxy(Object.create(fs), {
         get(_target, property) {
-            if (property === "prepareStagingResolution" || property === "prepareDirectoryAncestry" || property === "publishFileConditional" || property === "removeEntryConditional" || property === "writeFileConditional" || property === "removeFileConditional" || property === "resizeFile" || property === "canonicalizeMissingTarget" || property === "createStagedFile" || property === "publishStagedFile" || property === "removeStagedFile" || property === "prepareDirectory")
+            if (property === "publishStagedFileSet" || property === "prepareStagingResolution" || property === "prepareDirectoryAncestry" || property === "publishFileConditional" || property === "removeEntryConditional" || property === "writeFileConditional" || property === "removeFileConditional" || property === "resizeFile" || property === "canonicalizeMissingTarget" || property === "createStagedFile" || property === "publishStagedFile" || property === "removeStagedFile" || property === "prepareDirectory")
                 return undefined;
             if (property === "capabilities")
                 return quotaCapabilities({ ...retainedResizeCapabilities(fs, retainedReadCapabilities(fs)), ...(typeof fs.open === "function" ? {} : { open: false }) });

package/dist/safe-fs/fs/s3/http/transport.js

@@ -22,7 +22,7 @@ function utf8ByteLength(value) {
     return bytes;
 }
 function limit(value, fallback, name, maximum = Number.MAX_SAFE_INTEGER) {
-    if (value === undefined)
+    if (value === undefined || value === Infinity && fallback === Infinity)
         return fallback;
     const result = value;
     if (!Number.isSafeInteger(result) || result < 1 || result > maximum)

package/dist/safe-fs/fs/s3/http/xml.js

@@ -37,8 +37,8 @@ function decodeEntities(text) {
 }
 export function parseXml(bytes, limits = {}) {
     for (const limit of [limits.maxNodes, limits.maxDepth]) {
-        if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1))
-            throw new RangeError("XML limits must be positive safe integers");
+        if (limit !== undefined && limit !== Infinity && (!Number.isSafeInteger(limit) || limit < 1))
+            throw new RangeError("XML limits must be positive safe integers or Infinity");
     }
     let xml;
     try {

package/dist/safe-fs/fs/scoped.js

@@ -18,7 +18,7 @@ export function retargetScopedFileSystem(scoped, charge, signal, cleanupCharge =
     return true;
 }
 const operations = new Set([
-    "prepareDirectoryAncestry", "prepareStagingResolution",
+    "prepareDirectoryAncestry", "prepareStagingResolution", "publishStagedFileSet",
     "publishFileConditional", "removeEntryConditional", "removeTreeConditional", "writeFileConditional", "removeFileConditional", "createStagedFile", "publishStagedFile", "removeStagedFile", "prepareDirectory",
     "confineExtraction", "access", "appendFile", "canonicalizeMissingTarget", "capabilitiesFor", "chmod", "compareEntry",
     "copyFile", "link", "lstat", "mkdir", "openReadFile", "openResizeFile", "readFile", "readStream", "readdir",
@@ -262,7 +262,7 @@ export function scopeFileSystem(filesystem, charge, signal, cleanupCharge = char
                 if (property === "removeEntryConditional")
                     args[1] = resizeOptions({ ...args[1] });
                 let stagingSignal;
-                if (property === "createStagedFile" || property === "publishStagedFile") {
+                if (property === "createStagedFile" || property === "publishStagedFile" || property === "publishStagedFileSet") {
                     signal.throwIfAborted();
                     if (property === "createStagedFile")
                         args[3] = snapshotStagingCreation(args[3], args[0]);
@@ -281,6 +281,36 @@ export function scopeFileSystem(filesystem, charge, signal, cleanupCharge = char
                     if (property === "symlink" && typeof args[1] === "string")
                         validatePath(args[1], maxPathComponents);
                 }
+                if (property === "publishStagedFileSet") {
+                    if (original.capabilities.readOnly === true)
+                        throw new FsError("EROFS", { path: args[1] });
+                    const supplied = args[2];
+                    const callerGuard = supplied.commitGuard;
+                    const entry = (value) => ({ path: value.path, stat: { ...value.stat } });
+                    const input = args[0];
+                    const staging = { ...input, parent: entry(input.parent), directory: entry(input.directory), file: entry(input.file) };
+                    const controls = {
+                        ...supplied,
+                        signal: stagingSignal,
+                        parent: { ...supplied.parent },
+                        destination: supplied.destination === null ? null : { ...supplied.destination },
+                        companions: supplied.companions.map(value => ({ ...value, expected: value.expected === null ? null : { ...value.expected } })),
+                        ...(supplied.ancestors === undefined ? {} : { ancestors: snapshotDirectoryAncestry(supplied.ancestors) }),
+                        commitGuard: () => {
+                            assertOpen({ signal: stagingSignal });
+                            if (callerGuard !== undefined)
+                                runStagingGuard(callerGuard);
+                            assertOpen({ signal: stagingSignal });
+                            return true;
+                        },
+                    };
+                    for (const path of [staging.parent.path, staging.directory.path, staging.file.path, args[1],
+                        ...controls.companions.map(value => value.path), ...(controls.ancestors ?? []).map(value => value.path)]) {
+                        validatePath(path, maxPathComponents);
+                    }
+                    assertOpen(controls);
+                    return Reflect.apply(method, original, [staging, args[1], controls]);
+                }
                 if (["writeFile", "appendFile", "writeStream", "mkdir"].includes(String(property))) {
                     const index = property === "mkdir" ? 1 : 2;
                     args[index] = creationOptions((args[index] ?? {}), property === "mkdir");

package/dist/safe-fs/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./contracts/index.js";
+export * from "./bridge/index.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export * from "./python/index.js";
 export { openFileDescriptor } from "./fs/descriptor.js";
@@ -21,3 +22,4 @@ export * from "./node/index.js";
 export { createFileSystem, readConfigRecord, validateFileSystemConfig } from "./config.js";
 export type { FileSystemConfig, FileSystemAdapterDescriptor, FileSystemAdapterRegistry } from "./config.js";
 export { createNodeFileSystemAdapterRegistry } from "./config.node.js";
+export { createPortableFileSystemAdapterRegistry } from "./config.portable.js";

package/dist/safe-fs/index.js

@@ -1,4 +1,5 @@
 export * from "./contracts/index.js";
+export * from "./bridge/index.js";
 export { ObjectAuthority } from "./fs/object-authority.js";
 export * from "./python/index.js";
 export { openFileDescriptor } from "./fs/descriptor.js";
@@ -17,3 +18,4 @@ export { scopeFileSystem, retainFileSystemCleanup } from "./fs/scoped.js";
 export * from "./node/index.js";
 export { createFileSystem, readConfigRecord, validateFileSystemConfig } from "./config.js";
 export { createNodeFileSystemAdapterRegistry } from "./config.node.js";
+export { createPortableFileSystemAdapterRegistry } from "./config.portable.js";

package/dist/safe-fs/node/filesystem.d.ts

@@ -1,5 +1,6 @@
 import type * as FsPromises from "node:fs/promises";
 import type { FileSystem, FsOptions } from "../contracts/filesystem.js";
+import { FileSystemBridge } from "../bridge/filesystem.js";
 export type NodeFsImplementation = Pick<typeof FsPromises, "access" | "appendFile" | "chmod" | "copyFile" | "cp" | "link" | "lstat" | "mkdir" | "mkdtemp" | "readFile" | "readdir" | "readlink" | "realpath" | "unlink" | "rename" | "rm" | "rmdir" | "stat" | "symlink" | "truncate" | "utimes" | "writeFile">;
 export interface NodeFsBridgeOptions {
     readonly cwd?: string;
@@ -14,5 +15,5 @@ export interface NodeFsBridgeOptions {
 export interface NodeFsBridgeFileSystem extends FileSystem {
     rmdir?(path: string, options?: FsOptions): Promise<void>;
 }
-export declare function getNodeFsBridgeProvider(bridge: object): FileSystem | undefined;
+export declare const getNodeFsBridgeProvider: typeof FileSystemBridge.getProvider;
 export declare function createNodeFsBridge(fs: FileSystem, options?: NodeFsBridgeOptions): NodeFsImplementation;

package/dist/safe-fs/node/filesystem.js

@@ -3,10 +3,7 @@ import { randomBytes } from "node:crypto";
 import { posix } from "node:path";
 import { fileURLToPath } from "node:url";
 import { FileSystemBridge } from "../bridge/filesystem.js";
-const providers = new WeakMap();
-export function getNodeFsBridgeProvider(bridge) {
-    return providers.get(bridge);
-}
+export const getNodeFsBridgeProvider = FileSystemBridge.getProvider;
 export function createNodeFsBridge(fs, options = {}) {
     const bridge = new FileSystemBridge(fs, options, {
         codec: {
@@ -29,6 +26,5 @@ export function createNodeFsBridge(fs, options = {}) {
         randomSuffix() { return randomBytes(6).toString("hex").slice(0, 6); },
         paths: posix
     });
-    providers.set(bridge, fs);
     return bridge;
 }

package/dist/safe-fs/runtime-core.d.ts

@@ -1,6 +1,7 @@
 export * from "./contracts/errors.js";
 export * from "./contracts/filesystem.js";
 export * from "./contracts/io.js";
+export { compareIdentity, compareFileVersion } from "./fs/mount/identity.js";
 export { openFileDescriptor } from "./fs/descriptor.js";
 export type { DescriptorBackend, DescriptorOpenOptions } from "./fs/descriptor.js";
 export { assertPathWithin, isPathWithin, normalizePath, relativePath, resolvePath, validatePath } from "./contracts/virtual-path.js";

package/dist/safe-fs/runtime-core.js

@@ -1,6 +1,7 @@
 export * from "./contracts/errors.js";
 export * from "./contracts/filesystem.js";
 export * from "./contracts/io.js";
+export { compareIdentity, compareFileVersion } from "./fs/mount/identity.js";
 export { openFileDescriptor } from "./fs/descriptor.js";
 export { assertPathWithin, isPathWithin, normalizePath, relativePath, resolvePath, validatePath } from "./contracts/virtual-path.js";
 export { basename, dirname, extname, isAbsolutePath, joinPath, posixPath } from "./contracts/portable-path.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-fs",
-  "version": "0.1.805",
+  "version": "0.1.807",
   "description": "Composable filesystem with a portable core and explicit Node adapters",
   "type": "module",
   "license": "MIT",
@@ -130,6 +130,10 @@
     "./runtime-core": {
       "types": "./dist/safe-fs/runtime-core.d.ts",
       "import": "./dist/safe-fs/runtime-core.js"
+    },
+    "./bridge": {
+      "types": "./dist/safe-fs/bridge/index.d.ts",
+      "import": "./dist/safe-fs/bridge/index.js"
     }
   },
   "repository": {