@poe-platform/safe-js 0.1.0

package/dist/safe-js/chunks/chunk-7M2SJPSZ.js

@@ -0,0 +1,2613 @@
+import {
+  FileSystemBridge,
+  FsError,
+  collectBytes,
+  compareEntries,
+  compareOwnedS3Entries,
+  composeAbortSignals,
+  createMemoryFileSystem,
+  finishCleanup,
+  isErrnoCode,
+  isFsError,
+  readBytes,
+  recordS3Observation,
+  registerEntryAuthority,
+  registerS3EntryOwner,
+  toByteSource,
+  toFsError,
+  validatePath
+} from "./chunk-2QRYPKQQ.js";
+
+// packages/safe-fs/src/contracts/path.ts
+import { posix } from "node:path";
+var posixPath = posix;
+var basename = posix.basename;
+var dirname = posix.dirname;
+var extname = posix.extname;
+var joinPath = posix.join;
+var isAbsolutePath = posix.isAbsolute;
+
+// packages/safe-fs/src/fs/real/index.ts
+import { constants } from "node:fs";
+import * as native from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+// packages/safe-fs/src/fs/real/allocation.ts
+function nativeAllocatedBytes(blocks, platform) {
+  if (platform !== "darwin" && platform !== "linux") return void 0;
+  if (typeof blocks !== "number" || !Number.isSafeInteger(blocks) || blocks < 0) return void 0;
+  const bytes = blocks * 512;
+  return Number.isSafeInteger(bytes) ? bytes : void 0;
+}
+
+// packages/safe-fs/src/fs/real/index.ts
+function fileType(stats) {
+  if (stats.isFile()) return "file";
+  if (stats.isDirectory()) return "directory";
+  if (stats.isSymbolicLink()) return "symlink";
+  throw new FsError("ENOTSUP", { message: "special filesystem nodes are not supported" });
+}
+function fileStat(stats) {
+  const allocatedBytes = nativeAllocatedBytes(stats.blocks, process.platform);
+  return {
+    type: fileType(stats),
+    size: stats.size,
+    mode: stats.mode,
+    ...allocatedBytes === void 0 ? {} : { allocatedBytes },
+    atimeMs: stats.atimeMs,
+    mtimeMs: stats.mtimeMs,
+    ctimeMs: stats.ctimeMs,
+    birthtimeMs: stats.birthtimeMs,
+    ino: stats.ino,
+    dev: stats.dev,
+    ...Number.isSafeInteger(stats.dev) && stats.dev >= 0 && Number.isSafeInteger(stats.ino) && stats.ino >= 0 ? { identityScope: /* @__PURE__ */ Symbol.for("virtual-bash.fs.native") } : {},
+    nlink: stats.nlink,
+    uid: stats.uid,
+    gid: stats.gid
+  };
+}
+function integer(value, minimum = 0) {
+  if (!Number.isSafeInteger(value) || value < minimum) {
+    throw new FsError("EINVAL", { message: "expected a nonnegative safe integer" });
+  }
+}
+function nativeError(error) {
+  if (typeof error === "object" && error !== null && "code" in error && (error.code === "ERR_INVALID_ARG_TYPE" || error.code === "ERR_INVALID_ARG_VALUE" || error.code === "ERR_OUT_OF_RANGE")) {
+    return new FsError("EINVAL", { cause: error });
+  }
+  if (typeof error === "object" && error !== null && "info" in error) {
+    const info = error.info;
+    if (typeof info === "object" && info !== null && "code" in info && isErrnoCode(info.code)) {
+      return new FsError(info.code, { cause: error });
+    }
+  }
+  return toFsError(error);
+}
+var RealFileSystem = class {
+  capabilities = Object.freeze({
+    readOnly: false,
+    symlinks: true,
+    hardlinks: true,
+    permissions: true,
+    timestamps: true,
+    atomicRename: true,
+    streamingRead: true,
+    streamingWrite: true
+  });
+  configuredRoot;
+  rootPromise;
+  constructor(options) {
+    const root = typeof options === "string" ? options : options.root;
+    validatePath(root);
+    if (!isAbsolute(root)) {
+      throw new FsError("EINVAL", { syscall: "root", path: root, message: "root must be an absolute host path" });
+    }
+    if (sep !== "/") {
+      throw new FsError("ENOTSUP", { syscall: "root", message: "this backend requires a POSIX host" });
+    }
+    this.configuredRoot = root;
+  }
+  async root(options = {}) {
+    options.signal?.throwIfAborted();
+    this.rootPromise ??= (async () => {
+      const root2 = await native.realpath(this.configuredRoot);
+      if (!(await native.stat(root2)).isDirectory()) throw new FsError("ENOTDIR");
+      return root2;
+    })();
+    const root = await this.rootPromise;
+    options.signal?.throwIfAborted();
+    if (await native.realpath(root) !== root) throw new FsError("EACCES");
+    options.signal?.throwIfAborted();
+    if (!(await native.stat(root)).isDirectory()) throw new FsError("ENOTDIR");
+    options.signal?.throwIfAborted();
+    return root;
+  }
+  absoluteTarget(root, target) {
+    if (target === root) return [];
+    const prefix = root === "/" ? "/" : `${root}/`;
+    if (!target.startsWith(prefix)) {
+      throw new FsError("EACCES", { message: "symlink target escapes the configured root" });
+    }
+    return target.slice(prefix.length).split("/");
+  }
+  async walk(root, components, options) {
+    let current = root;
+    let links = 0;
+    const pending = [...components];
+    while (pending.length > 0) {
+      options.signal?.throwIfAborted();
+      const { name: component, fromLink } = pending.shift();
+      if (component === "" || component === ".") continue;
+      if (component === "..") {
+        if (current === root) {
+          if (fromLink) throw new FsError("EACCES", { message: "symlink target escapes the configured root" });
+        } else {
+          current = resolve(current, "..");
+        }
+        continue;
+      }
+      const candidate = join(current, component);
+      let stats;
+      try {
+        stats = await native.lstat(candidate);
+      } catch (error) {
+        options.signal?.throwIfAborted();
+        const code = error.code;
+        if (options.checkTarget && (code === "ENOENT" || code === "ENOTDIR")) {
+          current = candidate;
+          continue;
+        }
+        if (code !== "ENOENT") throw error;
+        if (options.createDirectories && !fromLink) {
+          try {
+            options.signal?.throwIfAborted();
+            await native.mkdir(candidate, { mode: options.createDirectories.mode });
+          } catch (creationError) {
+            if (nativeError(creationError).code !== "EEXIST") throw creationError;
+          }
+          options.signal?.throwIfAborted();
+          stats = await native.lstat(candidate);
+        } else if (!options.createDirectories && options.missing === "final" && pending.every((part) => part.name === "")) {
+          return pending.length > 0 ? `${candidate}/` : candidate;
+        } else {
+          throw error;
+        }
+      }
+      options.signal?.throwIfAborted();
+      if (stats.isSymbolicLink() && (pending.length > 0 || options.followFinal !== false)) {
+        if (++links > 40) throw new FsError("ELOOP");
+        const target = await native.readlink(candidate);
+        if (isAbsolute(target)) {
+          pending.unshift(...this.absoluteTarget(root, target).map((name) => ({ name, fromLink: true })));
+          current = root;
+        } else {
+          pending.unshift(...target.split("/").map((name) => ({ name, fromLink: true })));
+        }
+        continue;
+      }
+      if (pending.length > 0 && !stats.isDirectory() && !options.checkTarget) {
+        if (options.deferTrailingSeparator && stats.isFile() && pending.every((part) => part.name === "")) {
+          return `${candidate}/`;
+        }
+        throw new FsError("ENOTDIR");
+      }
+      if (!options.checkTarget) fileType(stats);
+      current = candidate;
+    }
+    options.signal?.throwIfAborted();
+    return components.at(-1)?.name === "" && current !== root ? `${current}/` : current;
+  }
+  async path(path, options = {}) {
+    options.signal?.throwIfAborted();
+    validatePath(path);
+    if (path === "") throw new FsError("ENOENT");
+    return this.walk(await this.root(options), path.split("/").map((name) => ({ name, fromLink: false })), options);
+  }
+  async operation(syscall, path, options, action, dest) {
+    options.signal?.throwIfAborted();
+    try {
+      validatePath(path);
+      if (dest !== void 0) validatePath(dest);
+      const result = await action();
+      options.signal?.throwIfAborted();
+      return result;
+    } catch (error) {
+      options.signal?.throwIfAborted();
+      const converted = nativeError(error);
+      throw new FsError(converted.code, {
+        syscall,
+        path,
+        ...dest === void 0 ? {} : { dest }
+      });
+    }
+  }
+  protectRoot(path, root) {
+    if (resolve(path) === root) throw new FsError("EBUSY", { message: "the filesystem root cannot be removed or replaced" });
+  }
+  protectTerminal(path) {
+    const terminal = path.split("/").filter(Boolean).at(-1);
+    if (terminal === "." || terminal === "..") throw new FsError("EINVAL");
+  }
+  async readFile(path, options = {}) {
+    return this.operation("readFile", path, options, async () => {
+      const maxBytes = options.maxBytes ?? Number.MAX_SAFE_INTEGER;
+      integer(maxBytes);
+      return collectBytes(this.readStream(path, options), { maxBytes, ...options });
+    });
+  }
+  async writeFile(path, data, options = {}) {
+    return this.operation("writeFile", path, options, async () => {
+      if (!(data instanceof Uint8Array)) throw new FsError("EINVAL");
+      await this.writeStream(path, toByteSource(data), options);
+    });
+  }
+  async appendFile(path, data, options = {}) {
+    return this.operation("appendFile", path, options, () => this.writeFile(path, data, { ...options, flag: "a" }));
+  }
+  async stat(path, options = {}) {
+    return this.operation("stat", path, options, async () => {
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      return fileStat(await native.stat(target));
+    });
+  }
+  async lstat(path, options = {}) {
+    return this.operation("lstat", path, options, async () => {
+      const target = await this.path(path, { ...options, followFinal: false });
+      options.signal?.throwIfAborted();
+      return fileStat(await native.lstat(target));
+    });
+  }
+  async readdir(path, options = {}) {
+    return this.operation("readdir", path, options, async () => {
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      const entries = await native.readdir(target, { withFileTypes: true });
+      return entries.map((entry) => ({ name: entry.name, type: fileType(entry) }));
+    });
+  }
+  async mkdir(path, options = {}) {
+    return this.operation("mkdir", path, options, async () => {
+      if (options.mode !== void 0) integer(options.mode);
+      const target = await this.path(path, {
+        ...options,
+        missing: "final",
+        followFinal: !!options.recursive,
+        deferTrailingSeparator: true,
+        ...options.recursive ? { createDirectories: { mode: options.mode ?? 511 } } : {}
+      });
+      options.signal?.throwIfAborted();
+      await native.mkdir(target, { recursive: options.recursive ?? false, ...options.mode === void 0 ? {} : { mode: options.mode } });
+    });
+  }
+  async rmdir(path, options = {}) {
+    return this.operation("rmdir", path, options, async () => {
+      const target = await this.path(path.replace(/\/+$/, "") || (path ? "/" : ""), { ...options, followFinal: false });
+      this.protectTerminal(path);
+      this.protectRoot(target, await this.root(options));
+      options.signal?.throwIfAborted();
+      await native.rmdir(target);
+    });
+  }
+  async rm(path, options = {}) {
+    return this.operation("rm", path, options, async () => {
+      let target;
+      try {
+        target = await this.path(path, { ...options, followFinal: false });
+      } catch (error) {
+        if (options.force && toFsError(error).code === "ENOENT") return;
+        throw error;
+      }
+      this.protectTerminal(path);
+      this.protectRoot(target, await this.root(options));
+      options.signal?.throwIfAborted();
+      await native.rm(target, { recursive: options.recursive ?? false, force: options.force ?? false });
+    });
+  }
+  async rename(source, destination, options = {}) {
+    return this.operation("rename", source, options, async () => {
+      const from = await this.path(source, { ...options, followFinal: false });
+      const to = await this.path(destination, { ...options, followFinal: false, missing: "final" });
+      this.protectTerminal(source);
+      this.protectTerminal(destination);
+      const root = await this.root(options);
+      this.protectRoot(from, root);
+      this.protectRoot(to, root);
+      options.signal?.throwIfAborted();
+      await native.rename(from, to);
+    }, destination);
+  }
+  async copyFile(source, destination, options = {}) {
+    return this.operation("copyFile", source, options, async () => {
+      const from = await this.path(source, options);
+      const to = await this.path(destination, { ...options, missing: "final", followFinal: !options.exclusive, deferTrailingSeparator: true });
+      let flags = options.exclusive ? constants.COPYFILE_EXCL : 0;
+      if (!to.endsWith("/")) {
+        const origin = await native.stat(from, { bigint: true });
+        let target;
+        try {
+          target = await native.lstat(to, { bigint: true });
+        } catch (error) {
+          if (nativeError(error).code !== "ENOENT") throw error;
+        }
+        if (target && options.exclusive) throw new FsError("EEXIST");
+        if (target && origin.isFile() && origin.dev === target.dev && origin.ino === target.ino) throw new FsError("EINVAL");
+        if (!target) flags |= constants.COPYFILE_EXCL;
+      }
+      options.signal?.throwIfAborted();
+      await native.copyFile(from, to, flags);
+    }, destination);
+  }
+  async realpath(path, options = {}) {
+    return this.operation("realpath", path, options, async () => {
+      const target = await this.path(path, options);
+      return `/${relative(await this.root(options), target)}`;
+    });
+  }
+  async access(path, mode = constants.F_OK, options = {}) {
+    return this.operation("access", path, options, async () => {
+      integer(mode);
+      if (mode > 7) throw new FsError("EINVAL");
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      await native.access(target, mode);
+    });
+  }
+  async readlink(path, options = {}) {
+    return this.operation("readlink", path, options, async () => {
+      const resolved = await this.path(path, { ...options, followFinal: false });
+      options.signal?.throwIfAborted();
+      const target = await native.readlink(resolved);
+      if (!isAbsolute(target)) return target;
+      return `/${this.absoluteTarget(await this.root(options), target).join("/")}`;
+    });
+  }
+  async symlink(target, path, options = {}) {
+    return this.operation("symlink", path, options, async () => {
+      validatePath(target);
+      if (!target) throw new FsError("ENOENT");
+      const destination = await this.path(path, { ...options, followFinal: false, missing: "final" });
+      const root = await this.root(options);
+      const stored = target.startsWith("/") ? `${root === "/" ? "" : root}${target}` : target;
+      const components = target.startsWith("/") ? target.split("/") : [...relative(root, resolve(destination, "..")).split("/"), ...target.split("/")];
+      try {
+        await this.walk(root, components.map((name) => ({ name, fromLink: true })), { ...options, checkTarget: true });
+      } catch (error) {
+        if (nativeError(error).code !== "ELOOP") throw error;
+      }
+      options.signal?.throwIfAborted();
+      await native.symlink(stored, destination);
+    });
+  }
+  async link(existingPath, newPath, options = {}) {
+    return this.operation("link", existingPath, options, async () => {
+      const source = await this.path(existingPath, { ...options, followFinal: false });
+      const destination = await this.path(newPath, { ...options, followFinal: false, missing: "final" });
+      options.signal?.throwIfAborted();
+      await native.link(source, destination);
+    }, newPath);
+  }
+  async chmod(path, mode, options = {}) {
+    return this.operation("chmod", path, options, async () => {
+      integer(mode);
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      await native.chmod(target, mode);
+    });
+  }
+  async utimes(path, atimeMs, mtimeMs, options = {}) {
+    return this.operation("utimes", path, options, async () => {
+      if (!Number.isFinite(atimeMs) || !Number.isFinite(mtimeMs)) throw new FsError("EINVAL");
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      await native.utimes(target, new Date(atimeMs), new Date(mtimeMs));
+    });
+  }
+  async truncate(path, length = 0, options = {}) {
+    return this.operation("truncate", path, options, async () => {
+      integer(length);
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      const handle = await native.open(target, constants.O_WRONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        options.signal?.throwIfAborted();
+        if (!(await handle.stat()).isFile()) throw new FsError("ENOTSUP");
+        options.signal?.throwIfAborted();
+        await handle.truncate(length);
+      } finally {
+        await handle.close();
+      }
+    });
+  }
+  async *readStream(path, options = {}) {
+    const syscall = "readStream";
+    let handle;
+    let failed = false;
+    try {
+      options.signal?.throwIfAborted();
+      const start = options.start ?? 0;
+      const end = options.endExclusive ?? Number.MAX_SAFE_INTEGER;
+      const chunkSize = options.chunkSize ?? 64 * 1024;
+      integer(start);
+      integer(end);
+      integer(chunkSize, 1);
+      if (end < start) throw new FsError("EINVAL");
+      const target = await this.path(path, options);
+      options.signal?.throwIfAborted();
+      handle = await native.open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      options.signal?.throwIfAborted();
+      const stats = await handle.stat();
+      if (stats.isDirectory()) throw new FsError("EISDIR");
+      if (!stats.isFile()) throw new FsError("ENOTSUP");
+      let position = start;
+      while (position < end) {
+        options.signal?.throwIfAborted();
+        const bytes = new Uint8Array(Math.min(chunkSize, end - position));
+        const { bytesRead } = await handle.read(bytes, 0, bytes.byteLength, position);
+        options.signal?.throwIfAborted();
+        if (bytesRead === 0) break;
+        position += bytesRead;
+        yield bytes.subarray(0, bytesRead);
+      }
+      options.signal?.throwIfAborted();
+    } catch (error) {
+      failed = true;
+      options.signal?.throwIfAborted();
+      throw new FsError(nativeError(error).code, { syscall, path });
+    } finally {
+      await finishCleanup(async () => {
+        try {
+          await handle?.close();
+        } catch (error) {
+          throw new FsError(nativeError(error).code, { syscall, path });
+        }
+      }, failed);
+    }
+  }
+  async writeStream(path, source, options = {}) {
+    return this.operation("writeStream", path, options, async () => {
+      const flag = options.flag ?? "w";
+      if (!["w", "wx", "a", "ax"].includes(flag)) throw new FsError("EINVAL");
+      if (options.mode !== void 0) integer(options.mode);
+      const exclusive = flag.endsWith("x");
+      const destination = await this.path(path, { ...options, missing: "final", followFinal: !exclusive, deferTrailingSeparator: true });
+      const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK | (flag.startsWith("a") ? constants.O_APPEND : constants.O_TRUNC) | (exclusive ? constants.O_EXCL : 0);
+      options.signal?.throwIfAborted();
+      const handle = await native.open(destination, flags, options.mode ?? 438);
+      try {
+        options.signal?.throwIfAborted();
+        if (!(await handle.stat()).isFile()) throw new FsError("ENOTSUP");
+        options.signal?.throwIfAborted();
+        for await (const chunk of source) {
+          options.signal?.throwIfAborted();
+          if (!(chunk instanceof Uint8Array)) throw new FsError("EINVAL");
+          let offset = 0;
+          while (offset < chunk.byteLength) {
+            options.signal?.throwIfAborted();
+            const { bytesWritten } = await handle.write(chunk, offset, chunk.byteLength - offset, null);
+            if (bytesWritten === 0) throw new FsError("EIO");
+            offset += bytesWritten;
+          }
+        }
+      } finally {
+        await handle.close();
+      }
+    });
+  }
+};
+async function createRealFileSystem(options) {
+  const filesystem = new RealFileSystem(options);
+  await filesystem.stat("/");
+  return filesystem;
+}
+
+// packages/safe-fs/src/fs/s3/filesystem.ts
+import { posix as posix2 } from "node:path";
+
+// packages/safe-fs/src/fs/s3/authority.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var queries = new AsyncLocalStorage();
+var providerHeads = /* @__PURE__ */ new WeakMap();
+var acceptedHeads = /* @__PURE__ */ new WeakMap();
+function recordMockS3Head(output, input, storage) {
+  const query = queries.getStore();
+  if (query && query.Bucket === input.Bucket && query.Key === input.Key) {
+    providerHeads.set(output, { query, entry: { storage, key: input.Key } });
+  }
+}
+async function queryS3Head(input, action) {
+  const query = { ...input };
+  return queries.run(query, async () => {
+    const output = await action();
+    acceptedHeads.delete(output);
+    const proof = providerHeads.get(output);
+    if (proof?.query === query) acceptedHeads.set(output, proof.entry);
+    return output;
+  });
+}
+function recordS3Stat(filesystem, path, stat2, metadata) {
+  if (!metadata) return;
+  const entry = acceptedHeads.get(metadata);
+  acceptedHeads.delete(metadata);
+  if (entry) recordS3Observation(filesystem, path, stat2, entry);
+}
+
+// packages/safe-fs/src/fs/s3/transport.ts
+function createS3Transport(client, capabilities = {}) {
+  const transport = {
+    capabilities: Object.freeze({ ...capabilities }),
+    ...client.getObjectStream ? { getObjectStream: (input, options) => client.getObjectStream(input, options) } : {},
+    ...client.putObjectStream ? { putObjectStream: (input, options) => client.putObjectStream(input, options) } : {},
+    headObject: (input, options) => client.headObject(input, options),
+    getObject: (input, options) => client.getObject(input, options),
+    putObject: (input, options) => client.putObject(input, options),
+    deleteObject: (input, options) => client.deleteObject(input, options),
+    copyObject: (input, options) => client.copyObject(input, options),
+    listObjectsV2: (input, options) => client.listObjectsV2(input, options)
+  };
+  return transport;
+}
+var S3ServiceError = class extends Error {
+  code;
+  $metadata;
+  constructor(code, status, message = code) {
+    super(message);
+    this.name = code;
+    this.code = code;
+    this.$metadata = { httpStatusCode: status };
+  }
+};
+function encodeCopySource(bucket, key) {
+  return [bucket, ...key.split("/")].map((part) => encodeURIComponent(part).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
+}
+
+// packages/safe-fs/src/fs/s3/filesystem.ts
+var S3RenameError = class extends FsError {
+  phase;
+  copiedKeys;
+  deletedKeys;
+  constructor(source, destination, phase, copied, deleted, cause) {
+    super(cause.code, {
+      syscall: "rename",
+      path: source,
+      dest: destination,
+      cause,
+      message: `non-atomic S3 rename failed during ${phase}; destination copies or partial source deletions may remain`
+    });
+    this.name = "S3RenameError";
+    this.phase = phase;
+    this.copiedKeys = Object.freeze([...copied]);
+    this.deletedKeys = Object.freeze([...deleted]);
+  }
+};
+function serviceCode(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const record = error;
+  const value = record.Code ?? record.code ?? record.name;
+  return typeof value === "string" ? value : void 0;
+}
+function translate(error, syscall, path, precondition = "EAGAIN") {
+  if (error instanceof FsError) return error;
+  const status = error?.$metadata?.httpStatusCode;
+  const name = serviceCode(error);
+  let code = "EIO";
+  if (name === "AbortError" || status === 499) code = "ECANCELED";
+  else if (name === "NoSuchKey" || name === "NotFound" || name === "NoSuchBucket" || status === 404) code = "ENOENT";
+  else if (["AccessDenied", "InvalidAccessKeyId", "SignatureDoesNotMatch", "ExpiredToken"].includes(name ?? "") || status === 401 || status === 403) code = "EACCES";
+  else if (name === "PreconditionFailed" || status === 412) code = precondition;
+  else if (name === "ConditionalRequestConflict" || name === "SlowDown" || status === 409 || status === 429 || status === 503) code = "EAGAIN";
+  else if (name === "NotImplemented" || status === 501) code = "ENOTSUP";
+  else if (name === "EntityTooLarge") code = "EFBIG";
+  else if (name === "InvalidArgument" || name === "InvalidRequest" || status === 400) code = "EINVAL";
+  else if (name === "TimeoutError" || name === "RequestTimeout" || status === 408) code = "ETIMEDOUT";
+  return new FsError(code, { syscall, path, cause: error });
+}
+function fail(code, syscall, path, message) {
+  throw new FsError(code, { syscall, path, ...message === void 0 ? {} : { message } });
+}
+function validateLimit(value, name, minimum, maximum = Number.MAX_SAFE_INTEGER) {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new FsError("EINVAL", { message: `${name} must be an integer from ${minimum} to ${maximum}` });
+  }
+  return value;
+}
+function isWellFormed(value) {
+  return !/[\uD800-\uDFFF]/u.test(value);
+}
+var S3FileSystem = class {
+  capabilities;
+  readStream;
+  writeStream;
+  transport;
+  bucket;
+  prefix;
+  allowRename;
+  pageSize;
+  maxReadBytes;
+  maxStreamBytes;
+  maxListEntries;
+  constructor(options) {
+    if (!options?.transport || ["headObject", "getObject", "putObject", "deleteObject", "copyObject", "listObjectsV2"].some((method) => typeof options.transport[method] !== "function")) {
+      throw new FsError("EINVAL", { message: "an explicit six-operation S3 transport is required; no default credentials or network client are created" });
+    }
+    if (options.compareEntry !== void 0 && typeof options.compareEntry !== "function") {
+      throw new FsError("EINVAL", { message: "compareEntry must be a filesystem comparison callback" });
+    }
+    if (typeof options.bucket !== "string" || !options.bucket || /[/:\0]/.test(options.bucket)) {
+      throw new FsError("EINVAL", { message: "bucket must be a nonempty bucket name, not a URL or ARN" });
+    }
+    const prefix = options.prefix ?? "";
+    if (typeof prefix !== "string" || prefix.includes("\0") || !isWellFormed(prefix) || prefix !== "" && prefix.replace(/\/$/, "").split("/").some((part) => !part || part === "." || part === "..")) {
+      throw new FsError("EINVAL", { message: "prefix must be a canonical relative object-key prefix" });
+    }
+    this.prefix = prefix === "" || prefix.endsWith("/") ? prefix : `${prefix}/`;
+    if (Buffer.byteLength(this.prefix) > 1024) throw new FsError("ENAMETOOLONG", { message: "S3 prefix exceeds 1024 UTF-8 bytes" });
+    this.transport = options.transport;
+    this.bucket = options.bucket;
+    this.allowRename = options.allowNonAtomicRename ?? true;
+    this.pageSize = validateLimit(options.pageSize ?? 1e3, "pageSize", 1, 1e3);
+    this.maxReadBytes = validateLimit(options.maxReadBytes ?? 64 * 1024 * 1024, "maxReadBytes", 0);
+    this.maxStreamBytes = validateLimit(options.maxStreamBytes ?? 5e9, "maxStreamBytes", 0, 5e9);
+    this.maxListEntries = validateLimit(options.maxListEntries ?? 1e5, "maxListEntries", 1);
+    this.capabilities = Object.freeze({
+      readOnly: options.readOnly ?? false,
+      symlinks: false,
+      hardlinks: false,
+      permissions: false,
+      timestamps: options.transport.capabilities?.conditionalCopy === true || options.transport.capabilities?.conditionalPut === true,
+      atomicRename: false,
+      snapshotRmdir: true,
+      streamingRead: options.transport.capabilities?.streamingRead === true && typeof options.transport.getObjectStream === "function",
+      streamingWrite: options.transport.capabilities?.streamingWrite === true && typeof options.transport.putObjectStream === "function"
+    });
+    if (this.capabilities.streamingRead) this.readStream = this.streamRead.bind(this);
+    if (this.capabilities.streamingWrite) this.writeStream = this.streamWrite.bind(this);
+    const transport = this.transport;
+    const bucket = this.bucket;
+    const registeredPrefix = this.prefix;
+    registerS3EntryOwner(this, (path) => this.path(path), () => this.transport === transport && this.bucket === bucket && this.prefix === registeredPrefix, s3Comparison, options.compareEntry);
+    registerEntryAuthority(this, compareOwnedS3Entries);
+  }
+  async compareEntry(path, peer, peerPath, options = {}) {
+    return compareEntries(this, path, peer, peerPath, options);
+  }
+  path(input) {
+    if (typeof input !== "string" || input.includes("\0") || !isWellFormed(input)) fail("EINVAL", "resolve", input, "invalid path string");
+    const components = [];
+    for (const part of input.split("/")) {
+      if (!part || part === ".") continue;
+      if (part === "..") {
+        if (components.length === 0) fail("EACCES", "resolve", input, "path attempts to escape the configured prefix");
+        components.pop();
+      } else components.push(part);
+    }
+    const path = `/${components.join("/")}`;
+    if (Buffer.byteLength(this.key(path)) > 1024) fail("ENAMETOOLONG", "resolve", input);
+    return path;
+  }
+  key(path) {
+    return this.prefix + path.slice(1);
+  }
+  directoryKey(path) {
+    const key = path === "/" ? this.prefix : `${this.key(path)}/`;
+    if (Buffer.byteLength(key) > 1024) fail("ENAMETOOLONG", "resolve", path);
+    return key;
+  }
+  checkAbort(options, syscall, path) {
+    if (options.signal?.aborted) fail("ECANCELED", syscall, path);
+  }
+  requestOptions(options) {
+    return options.signal === void 0 ? {} : { abortSignal: options.signal };
+  }
+  async call(syscall, path, options, action, precondition) {
+    this.checkAbort(options, syscall, path);
+    let onAbort;
+    try {
+      const pending = action();
+      const result = options.signal ? await new Promise((resolve2, reject) => {
+        const signal = options.signal;
+        onAbort = () => reject(new FsError("ECANCELED", { syscall, path, cause: signal.reason }));
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted) onAbort();
+        pending.then((value) => {
+          if (signal.aborted && typeof value === "object" && value !== null && "Body" in value) this.dispose(value.Body);
+          resolve2(value);
+        }, reject);
+      }) : await pending;
+      this.checkAbort(options, syscall, path);
+      return result;
+    } catch (error) {
+      if (options.signal?.aborted) fail("ECANCELED", syscall, path);
+      throw translate(error, syscall, path, precondition);
+    } finally {
+      if (onAbort) options.signal?.removeEventListener("abort", onAbort);
+    }
+  }
+  writable(path, mode) {
+    if (this.capabilities.readOnly) fail("EROFS", "write", path);
+    if (mode !== void 0) validateLimit(mode, "mode", 0, 4095);
+  }
+  unsupported(operation, path) {
+    return fail("ENOTSUP", operation, path, `S3 does not support ${operation} with the configured transport`);
+  }
+  async head(key, path, options) {
+    try {
+      const input = { Bucket: this.bucket, Key: key };
+      return await this.call("headObject", path, options, () => queryS3Head(input, () => this.transport.headObject(input, this.requestOptions(options))));
+    } catch (error) {
+      if (isFsError(error, "ENOENT") && serviceCode(error.cause) !== "NoSuchBucket") return void 0;
+      throw error;
+    }
+  }
+  makeStat(type, metadata) {
+    const size = type === "directory" ? 0 : metadata?.ContentLength;
+    if (size === void 0 || !Number.isSafeInteger(size) || size < 0) fail("EIO", "stat", "", "transport omitted a valid object ContentLength");
+    const modified = metadata?.LastModified?.getTime() ?? 0;
+    if (!Number.isFinite(modified)) fail("EIO", "stat", "", "transport returned an invalid LastModified");
+    const timestamp2 = (key, fallback) => {
+      const value = metadata?.Metadata?.[key];
+      if (value === void 0) return fallback;
+      const parsed = Number(value);
+      if (!value || !Number.isFinite(parsed)) fail("EIO", "stat", "", "invalid virtual timestamp metadata");
+      return parsed;
+    };
+    const storedMode = metadata?.Metadata?.["virtual-bash-mode"];
+    const mode = storedMode === void 0 ? type === "directory" ? 493 : 420 : Number(storedMode);
+    if (!Number.isSafeInteger(mode) || mode < 0 || mode > 4095 || storedMode === "") fail("EIO", "stat", "", "invalid virtual mode metadata");
+    return {
+      type,
+      size,
+      mode: (type === "directory" ? 16384 : 32768) | mode,
+      mtimeMs: timestamp2("virtual-bash-mtime", modified),
+      atimeMs: timestamp2("virtual-bash-atime", 0),
+      ctimeMs: modified
+    };
+  }
+  async page(prefix, path, options, delimiter, token, maxKeys = this.pageSize) {
+    const result = await this.call("listObjectsV2", path, options, () => this.transport.listObjectsV2({
+      Bucket: this.bucket,
+      Prefix: prefix,
+      MaxKeys: maxKeys,
+      ...delimiter === void 0 ? {} : { Delimiter: delimiter },
+      ...token === void 0 ? {} : { ContinuationToken: token }
+    }, this.requestOptions(options)));
+    for (const item of result.Contents ?? []) {
+      if (typeof item.Key !== "string" || !item.Key.startsWith(prefix)) fail("EIO", "listObjectsV2", path, "transport returned an object outside the requested prefix");
+      this.validateObject(item, path);
+    }
+    for (const item of result.CommonPrefixes ?? []) {
+      if (delimiter === void 0 || typeof item.Prefix !== "string" || !item.Prefix.startsWith(prefix) || !item.Prefix.endsWith("/") || item.Prefix === prefix) fail("EIO", "listObjectsV2", path, "invalid common prefix");
+      this.validateKey(item.Prefix, path);
+    }
+    if (result.IsTruncated !== void 0 && typeof result.IsTruncated !== "boolean") fail("EIO", "listObjectsV2", path, "invalid IsTruncated flag");
+    return result;
+  }
+  validateKey(key, path) {
+    if (!key.startsWith(this.prefix)) fail("EIO", "listObjectsV2", path, "key escapes the configured prefix");
+    const relative2 = key.slice(this.prefix.length).replace(/\/$/, "");
+    if (!isWellFormed(key) || key.includes("\0") || Buffer.byteLength(key) > 1024 || relative2 !== "" && relative2.split("/").some((part) => !part || part === "." || part === "..")) {
+      fail("ENOTSUP", "listObjectsV2", path, "object key cannot be represented as a canonical filesystem path");
+    }
+  }
+  validateObject(object, path) {
+    const key = object.Key;
+    this.validateKey(key, path);
+    if (object.Size === void 0 || !Number.isSafeInteger(object.Size) || object.Size < 0) fail("EIO", "listObjectsV2", path, "invalid object size");
+    if (key.endsWith("/") && object.Size !== 0) fail("ENOTSUP", "listObjectsV2", path, "nonempty slash-suffixed objects cannot be treated as directories");
+  }
+  async *pages(prefix, path, options, delimiter, maxKeys = this.pageSize) {
+    const tokens = /* @__PURE__ */ new Set();
+    let token;
+    let entries = 0;
+    do {
+      const page = await this.page(prefix, path, options, delimiter, token, maxKeys);
+      entries += (page.Contents?.length ?? 0) + (page.CommonPrefixes?.length ?? 0);
+      if (entries > this.maxListEntries || tokens.size >= this.maxListEntries) fail("EFBIG", "listObjectsV2", path, "listing exceeds maxListEntries");
+      yield page;
+      if (!page.IsTruncated) return;
+      token = page.NextContinuationToken;
+      if (typeof token !== "string" || !token || tokens.has(token)) fail("EIO", "listObjectsV2", path, "missing or repeated continuation token");
+      tokens.add(token);
+    } while (true);
+  }
+  async inspect(path, options) {
+    if (path === "/") {
+      const listing = await this.page(this.prefix, path, options, void 0, void 0, 1);
+      const marker2 = this.prefix && listing.Contents?.some((object) => object.Key === this.prefix) ? await this.head(this.prefix, path, options) : void 0;
+      if (marker2 && marker2.ContentLength !== 0) this.unsupported("nonempty directory markers", path);
+      return { stat: this.makeStat("directory", marker2), ...marker2 ? { metadata: marker2 } : {} };
+    }
+    const file = await this.head(this.key(path), path, options);
+    if (Buffer.byteLength(this.key(path)) === 1024) {
+      return file ? { stat: this.makeStat("file", file), metadata: file } : void 0;
+    }
+    const directoryKey = this.directoryKey(path);
+    const marker = await this.head(directoryKey, path, options);
+    if (marker && marker.ContentLength !== 0) this.unsupported("nonempty directory markers", path);
+    let directory = marker !== void 0;
+    if (!directory) {
+      for await (const children2 of this.pages(directoryKey, path, options, void 0, 1)) {
+        if ((children2.Contents?.length ?? 0) > 0) {
+          directory = true;
+          break;
+        }
+      }
+    }
+    if (file && directory) this.unsupported("file/prefix collisions", path);
+    if (file) return { stat: this.makeStat("file", file), metadata: file };
+    if (directory) return { stat: this.makeStat("directory", marker), ...marker ? { metadata: marker } : {} };
+    return void 0;
+  }
+  async lookup(path, options) {
+    const ancestors = [];
+    for (let parent = posix2.dirname(path); path !== "/"; parent = posix2.dirname(parent)) {
+      ancestors.unshift(parent);
+      if (parent === "/") break;
+    }
+    for (const parent of ancestors) {
+      const ancestor = await this.inspect(parent, options);
+      if (!ancestor) fail("ENOENT", "stat", parent);
+      if (ancestor.stat.type !== "directory") fail("ENOTDIR", "stat", parent);
+    }
+    return this.inspect(path, options);
+  }
+  requireDirectorySuffix(input, info) {
+    if (input.endsWith("/") && info?.stat.type === "file") fail("ENOTDIR", "stat", input);
+  }
+  async stat(input, options = {}) {
+    const path = this.path(input);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (!info) fail("ENOENT", "stat", input);
+    recordS3Stat(this, path, info.stat, info.metadata);
+    return info.stat;
+  }
+  async lstat(path, options = {}) {
+    return this.stat(path, options);
+  }
+  async body(output, path, options) {
+    const limit2 = Math.min(this.maxReadBytes, validateLimit(options.maxBytes ?? this.maxReadBytes, "maxBytes", 0));
+    return this.call("readFile", path, options, async () => {
+      if (output.ContentLength !== void 0 && output.ContentLength > limit2) fail("EFBIG", "readFile", path);
+      const body = output.Body;
+      if (!body) fail("EIO", "readFile", path, "transport omitted the response body");
+      let bytes;
+      if (body instanceof Uint8Array) {
+        if (body.byteLength > limit2) fail("EFBIG", "readFile", path);
+        bytes = new Uint8Array(body);
+      } else if (Symbol.asyncIterator in body) {
+        bytes = await collectBytes(body, { maxBytes: limit2, ...options.signal ? { signal: options.signal } : {} });
+      } else if ("transformToByteArray" in body) {
+        const converted = await body.transformToByteArray();
+        if (!(converted instanceof Uint8Array)) fail("EIO", "readFile", path, "transport body is not binary");
+        if (converted.byteLength > limit2) fail("EFBIG", "readFile", path);
+        bytes = new Uint8Array(converted);
+      } else fail("EIO", "readFile", path, "unsupported response body");
+      this.checkAbort(options, "readFile", path);
+      if (output.ContentLength !== void 0 && output.ContentLength !== bytes.byteLength) fail("EIO", "readFile", path, "response body length does not match ContentLength");
+      return bytes;
+    }).catch((error) => {
+      this.dispose(output.Body);
+      throw error;
+    });
+  }
+  async get(path, options) {
+    return this.call("getObject", path, options, () => this.transport.getObject({ Bucket: this.bucket, Key: this.key(path) }, this.requestOptions(options)));
+  }
+  async readFile(input, options = {}) {
+    const path = this.path(input);
+    validateLimit(options.maxBytes ?? this.maxReadBytes, "maxBytes", 0);
+    const info = await this.stat(input, options);
+    if (info.type === "directory") fail("EISDIR", "readFile", path);
+    if (info.size > Math.min(this.maxReadBytes, options.maxBytes ?? this.maxReadBytes)) fail("EFBIG", "readFile", path);
+    return this.body(await this.get(path, options), path, options);
+  }
+  etag(metadata, path) {
+    if (!metadata?.ETag) this.unsupported("conditional mutation without an ETag", path);
+    return metadata.ETag;
+  }
+  async writeFile(input, data, options = {}) {
+    const path = this.path(input);
+    this.writable(path, options.mode);
+    if (!(data instanceof Uint8Array)) fail("EINVAL", "writeFile", path, "data must be Uint8Array");
+    const bytes = new Uint8Array(data);
+    if (bytes.byteLength > 5e9) fail("EFBIG", "writeFile", path, "multipart upload is not supported");
+    const flag = options.flag ?? "w";
+    if (!["w", "wx", "a", "ax"].includes(flag)) fail("EINVAL", "writeFile", path, "invalid write flag");
+    if (flag !== "w" && !this.transport.capabilities?.conditionalPut) this.unsupported("conditional writes", path);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (info?.stat.type === "directory") fail("EISDIR", "writeFile", path);
+    if (input.endsWith("/")) fail("EISDIR", "writeFile", input);
+    const exclusive = flag === "wx" || flag === "ax";
+    if (exclusive && info) fail("EEXIST", "writeFile", path);
+    let body = bytes;
+    let match;
+    let metadata = this.writeMetadata(info?.metadata, options.mode);
+    if (flag === "a" && info) {
+      const current = await this.get(path, options);
+      const previous = await this.body(current, path, options);
+      match = this.etag(current, path);
+      metadata = { ...current.Metadata };
+      delete metadata["virtual-bash-mtime"];
+      if (previous.length + bytes.length > this.maxReadBytes) fail("EFBIG", "appendFile", path);
+      body = new Uint8Array(previous.length + bytes.length);
+      body.set(previous);
+      body.set(bytes, previous.length);
+    }
+    await this.call("putObject", path, options, () => this.transport.putObject({
+      Bucket: this.bucket,
+      Key: this.key(path),
+      Body: body,
+      ...match === void 0 ? {} : { IfMatch: match },
+      ...exclusive || flag === "a" && !info ? { IfNoneMatch: "*" } : {},
+      ...metadata === void 0 ? {} : { Metadata: metadata }
+    }, this.requestOptions(options)), exclusive ? "EEXIST" : "EAGAIN");
+  }
+  writeMetadata(previous, mode) {
+    const metadata = { ...previous?.Metadata };
+    delete metadata["virtual-bash-mtime"];
+    if (previous === void 0 && mode !== void 0) metadata["virtual-bash-mode"] = String(mode);
+    return Object.keys(metadata).length === 0 ? void 0 : metadata;
+  }
+  async appendFile(path, data, options = {}) {
+    return this.writeFile(path, data, { ...options, flag: "a" });
+  }
+  async mkdir(input, options = {}) {
+    const path = this.path(input);
+    this.writable(path, options.mode);
+    if (options.recursive && path !== "/") {
+      await this.mkdir(posix2.dirname(path), { ...options, recursive: true });
+    }
+    const info = await this.lookup(path, options);
+    if (info) {
+      if (options.recursive && info.stat.type === "directory") return;
+      fail("EEXIST", "mkdir", path);
+    }
+    await this.call("putObject", path, options, () => this.transport.putObject({
+      Bucket: this.bucket,
+      Key: this.directoryKey(path),
+      Body: new Uint8Array(),
+      ...options.mode === void 0 ? {} : { Metadata: { "virtual-bash-mode": String(options.mode) } },
+      ...this.transport.capabilities?.conditionalPut ? { IfNoneMatch: "*" } : {}
+    }, this.requestOptions(options)), "EEXIST");
+  }
+  async readdir(input, options = {}) {
+    const path = this.path(input);
+    if ((await this.stat(input, options)).type !== "directory") fail("ENOTDIR", "readdir", path);
+    const prefix = this.directoryKey(path);
+    const entries = /* @__PURE__ */ new Map();
+    const add = (name, type) => {
+      if (!name || name.includes("/")) fail("EIO", "readdir", path, "invalid direct child in delimited listing");
+      const existing = entries.get(name);
+      if (existing && existing.type !== type) this.unsupported("file/prefix collisions", path);
+      entries.set(name, { name, type });
+    };
+    for await (const page of this.pages(prefix, path, options, "/")) {
+      for (const item of page.Contents ?? []) {
+        if (item.Key === prefix) continue;
+        add(item.Key.slice(prefix.length), "file");
+      }
+      for (const item of page.CommonPrefixes ?? []) add(item.Prefix.slice(prefix.length, -1), "directory");
+    }
+    return [...entries.values()].sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
+  }
+  async tree(path, options) {
+    const objects = /* @__PURE__ */ new Map();
+    for await (const page of this.pages(this.directoryKey(path), path, options)) {
+      for (const item of page.Contents ?? []) objects.set(item.Key, item);
+    }
+    for (const key of objects.keys()) {
+      const withoutSlash = key.replace(/\/$/, "");
+      if (key.endsWith("/") && objects.has(withoutSlash)) this.unsupported("file/prefix collisions", path);
+      let parent = posix2.dirname(withoutSlash);
+      while (parent !== "." && parent !== "/") {
+        if (objects.has(parent)) this.unsupported("file/prefix collisions", path);
+        parent = posix2.dirname(parent);
+      }
+    }
+    return [...objects.values()];
+  }
+  async rmdir(input, options = {}) {
+    try {
+      const path = this.path(input);
+      this.checkAbort(options, "rmdir", input);
+      this.writable(path);
+      if (path === "/") fail("EBUSY", "rmdir", input, "cannot remove the mounted root");
+      const info = await this.lookup(path, options);
+      this.checkAbort(options, "rmdir", input);
+      if (!info) fail("ENOENT", "rmdir", input);
+      if (info.stat.type !== "directory") fail("ENOTDIR", "rmdir", input);
+      const prefix = this.directoryKey(path);
+      let markerObserved = false;
+      for await (const page of this.pages(prefix, path, options, "/", Math.max(2, this.pageSize))) {
+        this.checkAbort(options, "rmdir", input);
+        if (page.Contents?.some((item) => item.Key !== prefix) || page.CommonPrefixes?.length) {
+          fail("ENOTEMPTY", "rmdir", input);
+        }
+        if (page.IsTruncated === void 0) fail("EIO", "rmdir", input, "listing did not confirm completeness");
+        if (page.Contents?.some((item) => item.Key === prefix)) markerObserved = true;
+      }
+      this.checkAbort(options, "rmdir", input);
+      if (!info.metadata) fail("ENOTSUP", "rmdir", input, "snapshot removal requires an explicit directory marker");
+      if (!markerObserved) fail("ENOENT", "rmdir", input, "directory marker disappeared during inspection");
+      await this.call("deleteObject", path, options, () => this.transport.deleteObject({ Bucket: this.bucket, Key: prefix }, this.requestOptions(options)));
+    } catch (error) {
+      if (isFsError(error) && (error.syscall !== "rmdir" || error.path !== input)) {
+        throw new FsError(error.code, { syscall: "rmdir", path: input, cause: error });
+      }
+      throw error;
+    }
+  }
+  async rm(input, options = {}) {
+    const path = this.path(input);
+    this.writable(path);
+    if (path === "/") fail("EBUSY", "rm", path, "cannot remove the mounted root");
+    let info;
+    try {
+      info = await this.lookup(path, options);
+    } catch (error) {
+      if (options.force && isFsError(error, "ENOENT") && serviceCode(error.cause) !== "NoSuchBucket") return;
+      throw error;
+    }
+    this.requireDirectorySuffix(input, info);
+    if (!info) {
+      if (options.force) return;
+      fail("ENOENT", "rm", path);
+    }
+    const objects = info.stat.type === "directory" ? await this.tree(path, options) : [{ Key: this.key(path) }];
+    if (info.stat.type === "directory" && !options.recursive && objects.some((item) => item.Key !== this.directoryKey(path))) fail("ENOTEMPTY", "rm", path);
+    for (const item of objects) {
+      await this.call("deleteObject", path, options, () => this.transport.deleteObject({ Bucket: this.bucket, Key: item.Key }, this.requestOptions(options)));
+    }
+  }
+  async copy(sourceKey, destinationKey, source, metadata, options, destination) {
+    if (metadata.ContentLength === void 0 || metadata.ContentLength > 5e9) this.unsupported("multipart copy", source);
+    const etag = this.etag(metadata, source);
+    const result = await this.call("copyObject", source, options, () => this.transport.copyObject({
+      Bucket: this.bucket,
+      Key: destinationKey,
+      CopySource: encodeCopySource(this.bucket, sourceKey),
+      CopySourceIfMatch: etag,
+      MetadataDirective: "COPY",
+      ...options.exclusive ? { IfNoneMatch: "*" } : {},
+      ...destination === void 0 ? {} : destination === null ? { IfNoneMatch: "*" } : { IfMatch: this.etag(destination, source) }
+    }, this.requestOptions(options)));
+    if (!result.CopyObjectResult?.ETag) fail("EIO", "copyObject", source, "transport did not confirm a completed CopyObject result");
+  }
+  async copyFile(sourceInput, destinationInput, options = {}) {
+    const source = this.path(sourceInput);
+    const destination = this.path(destinationInput);
+    this.writable(destination);
+    if (options.exclusive && !this.transport.capabilities?.conditionalCopy) this.unsupported("exclusive server-side copy", destination);
+    const origin = await this.lookup(source, options);
+    this.requireDirectorySuffix(sourceInput, origin);
+    if (!origin) fail("ENOENT", "copyFile", source);
+    if (origin.stat.type === "directory") fail("EISDIR", "copyFile", source);
+    const target = await this.lookup(destination, options);
+    this.requireDirectorySuffix(destinationInput, target);
+    if (target?.stat.type === "directory" || destinationInput.endsWith("/")) fail("EISDIR", "copyFile", destination);
+    if (target && options.exclusive) fail("EEXIST", "copyFile", destination);
+    if (source === destination) return;
+    try {
+      await this.copy(this.key(source), this.key(destination), source, origin.metadata, options);
+    } catch (error) {
+      if (!options.exclusive || !isFsError(error, "EAGAIN")) throw error;
+      const status = error.cause?.$metadata?.httpStatusCode;
+      if (serviceCode(error.cause) !== "PreconditionFailed" && status !== 412) throw error;
+      let destinationExists = false;
+      try {
+        const currentSource = await this.head(this.key(source), source, options);
+        if (currentSource?.ETag === origin.metadata?.ETag) {
+          destinationExists = await this.head(this.key(destination), destination, options) !== void 0;
+        }
+      } catch (diagnosticError) {
+        if (isFsError(diagnosticError, "ECANCELED")) throw diagnosticError;
+      }
+      if (destinationExists) {
+        throw new FsError("EEXIST", { syscall: "copyFile", path: source, dest: destination, cause: error });
+      }
+      throw error;
+    }
+  }
+  async rename(sourceInput, destinationInput, options = {}) {
+    const source = this.path(sourceInput);
+    const destination = this.path(destinationInput);
+    this.writable(destination);
+    if (!this.allowRename) this.unsupported("atomic rename; explicitly enable allowNonAtomicRename for copy/delete semantics", source);
+    if (!this.transport.capabilities?.conditionalDelete) this.unsupported("rename without conditional delete", source);
+    const conditionalCopy = this.transport.capabilities?.conditionalCopy === true;
+    if (!conditionalCopy && this.transport.capabilities?.conditionalPut !== true) {
+      this.unsupported("rename requires conditional destination copy or conditional PUT, plus conditional delete", source);
+    }
+    const streamFallback = this.capabilities.streamingRead && this.capabilities.streamingWrite;
+    if (source === "/" || destination === "/") fail("EBUSY", "rename", source);
+    const origin = await this.lookup(source, options);
+    this.requireDirectorySuffix(sourceInput, origin);
+    if (!origin) fail("ENOENT", "rename", source);
+    if (source === destination) {
+      this.requireDirectorySuffix(destinationInput, origin);
+      return;
+    }
+    if (destination.startsWith(`${source}/`)) fail("EINVAL", "rename", destination, "cannot move a path into itself");
+    const target = await this.lookup(destination, options);
+    this.requireDirectorySuffix(destinationInput, target);
+    if (destinationInput.endsWith("/") && origin.stat.type !== "directory") fail("ENOTDIR", "rename", destination);
+    if (target && target.stat.type !== origin.stat.type) fail(target.stat.type === "directory" ? "EISDIR" : "ENOTDIR", "rename", destination);
+    if (target?.stat.type === "directory" && (await this.readdir(destination, options)).length > 0) fail("ENOTEMPTY", "rename", destination);
+    if (target?.metadata) this.etag(target.metadata, destination);
+    const objects = origin.stat.type === "directory" ? await this.tree(source, options) : [{
+      Key: this.key(source),
+      Size: origin.stat.size,
+      ETag: origin.metadata?.ETag
+    }];
+    for (const object of objects) {
+      this.etag({ ETag: object.ETag }, source);
+      if (object.Size === void 0 || object.Size > 5e9) this.unsupported("multipart copy", source);
+      if (!conditionalCopy && object.Size > (streamFallback ? this.maxStreamBytes : this.maxReadBytes)) {
+        fail("EFBIG", "rename", source, "conditional PUT fallback exceeds its configured transfer or buffered read limit");
+      }
+      if (Buffer.byteLength(this.key(destination) + object.Key.slice(this.key(source).length)) > 1024) fail("ENAMETOOLONG", "rename", destination);
+    }
+    const copied = [];
+    const deleted = [];
+    let phase = "copy";
+    try {
+      for (const object of objects) {
+        const destinationKey = this.key(destination) + object.Key.slice(this.key(source).length);
+        const destinationMetadata = origin.stat.type === "file" || object.Key === this.directoryKey(source) ? target?.metadata ?? null : null;
+        const metadata = { ContentLength: object.Size, ETag: object.ETag };
+        if (conditionalCopy) await this.copy(object.Key, destinationKey, source, metadata, options, destinationMetadata);
+        else await this.copyWithPut(object.Key, destinationKey, source, metadata, destinationMetadata, options, streamFallback);
+        copied.push(destinationKey);
+      }
+      phase = "delete";
+      for (const object of objects) {
+        await this.call("deleteObject", source, options, () => this.transport.deleteObject({
+          Bucket: this.bucket,
+          Key: object.Key,
+          IfMatch: object.ETag
+        }, this.requestOptions(options)));
+        deleted.push(object.Key);
+      }
+    } catch (error) {
+      throw new S3RenameError(source, destination, phase, copied, deleted, translate(error, "rename", source));
+    }
+  }
+  async copyWithPut(sourceKey, destinationKey, source, expected, destination, options, streaming) {
+    const etag = this.etag(expected, source);
+    const condition = destination === null ? { IfNoneMatch: "*" } : { IfMatch: this.etag(destination, destinationKey) };
+    const controller = new AbortController();
+    const signalScope = options.signal ? composeAbortSignals([options.signal, controller.signal]) : void 0;
+    const signal = signalScope?.signal ?? controller.signal;
+    const operationOptions = { signal };
+    let output;
+    let upload;
+    let reading = false;
+    try {
+      output = await this.call("getObject", source, operationOptions, () => streaming ? this.transport.getObjectStream({ Bucket: this.bucket, Key: sourceKey, IfMatch: etag }, { abortSignal: signal }) : this.transport.getObject({ Bucket: this.bucket, Key: sourceKey }, { abortSignal: signal }));
+      if (this.etag(output, source) !== etag) fail("EAGAIN", "rename", source, "source changed before conditional PUT copy");
+      if (output.ContentLength !== void 0 && output.ContentLength !== expected.ContentLength) {
+        fail("EIO", "rename", source, "source response length differs from the enumerated object");
+      }
+      const input = {
+        Bucket: this.bucket,
+        Key: destinationKey,
+        ...condition,
+        ...output.Metadata === void 0 ? {} : { Metadata: { ...output.Metadata } }
+      };
+      if (!streaming) {
+        const body2 = await this.body(output, source, operationOptions);
+        if (body2.length !== expected.ContentLength) fail("EIO", "rename", source, "source body length differs from the enumerated object");
+        await this.call("putObject", source, operationOptions, () => this.transport.putObject({ ...input, Body: body2 }, { abortSignal: signal }));
+        return;
+      }
+      const body = output.Body;
+      if (!body || !(Symbol.asyncIterator in body)) fail("EIO", "rename", source, "streaming transport did not return an async binary body");
+      let finished = false;
+      upload = (async function* () {
+        let count = 0;
+        reading = true;
+        for await (const chunk of readBytes(body, signal)) {
+          if (chunk.length > expected.ContentLength - count) fail("EIO", "rename", source, "source body exceeds its enumerated length");
+          count += chunk.length;
+          for (let offset = 0; offset < chunk.length; offset += 64 * 1024) {
+            signal.throwIfAborted();
+            yield new Uint8Array(chunk.subarray(offset, offset + 64 * 1024));
+          }
+        }
+        if (count !== expected.ContentLength) fail("EIO", "rename", source, "incomplete source body");
+        finished = true;
+      })();
+      await this.call("putObject", source, operationOptions, () => this.transport.putObjectStream({ ...input, Body: upload }, { abortSignal: signal }));
+      if (!finished) fail("EIO", "rename", source, "transport completed without consuming the conditional copy body");
+    } finally {
+      controller.abort();
+      signalScope?.dispose();
+      this.dispose(upload);
+      this.dispose(output?.Body, !reading);
+    }
+  }
+  async realpath(input, options = {}) {
+    await this.stat(input, options);
+    return this.path(input);
+  }
+  async access(path, mode = 0, options = {}) {
+    if (!Number.isInteger(mode) || mode < 0 || mode > 7) fail("EINVAL", "access", path);
+    const info = await this.stat(path, options);
+    if ((mode & 2) !== 0 && this.capabilities.readOnly) fail("EROFS", "access", path);
+    if ((mode & 1) !== 0 && info.type !== "directory") fail("EACCES", "access", path);
+  }
+  async readlink(path) {
+    return this.unsupported("readlink", path);
+  }
+  async symlink(_target, path) {
+    this.unsupported("symlink", path);
+  }
+  async link(_existingPath, path) {
+    this.unsupported("link", path);
+  }
+  async chmod(path, _mode) {
+    this.unsupported("chmod", path);
+  }
+  async utimes(input, atimeMs, mtimeMs, options = {}) {
+    const path = this.path(input);
+    this.writable(path);
+    if (!Number.isFinite(atimeMs) || !Number.isFinite(mtimeMs)) fail("EINVAL", "utimes", path);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (!info) fail("ENOENT", "utimes", path);
+    if (!this.capabilities.timestamps) this.unsupported("conditional metadata mutation", path);
+    const key = info.stat.type === "directory" ? this.directoryKey(path) : this.key(path);
+    if (!key) this.unsupported("timestamps on an unprefixed bucket root", path);
+    const metadata = {
+      ...info.metadata?.Metadata,
+      "virtual-bash-atime": String(atimeMs),
+      "virtual-bash-mtime": String(mtimeMs)
+    };
+    if (!info.metadata) {
+      if (!this.transport.capabilities?.conditionalPut) this.unsupported("conditional directory marker creation", path);
+      await this.call("utimes", path, options, () => this.transport.putObject({
+        Bucket: this.bucket,
+        Key: key,
+        Body: new Uint8Array(),
+        Metadata: metadata,
+        IfNoneMatch: "*"
+      }, this.requestOptions(options)));
+      return;
+    }
+    if (!this.transport.capabilities?.conditionalCopy) {
+      const current = await this.call("getObject", path, options, () => this.transport.getObject({
+        Bucket: this.bucket,
+        Key: key
+      }, this.requestOptions(options)));
+      const body = await this.body(current, path, options);
+      await this.call("utimes", path, options, () => this.transport.putObject({
+        Bucket: this.bucket,
+        Key: key,
+        Body: body,
+        IfMatch: this.etag(current, path),
+        Metadata: { ...current.Metadata, "virtual-bash-atime": String(atimeMs), "virtual-bash-mtime": String(mtimeMs) }
+      }, this.requestOptions(options)));
+      return;
+    }
+    if (info.stat.size > 5e9) this.unsupported("multipart metadata copy", path);
+    const etag = this.etag(info.metadata, path);
+    const result = await this.call("utimes", path, options, () => this.transport.copyObject({
+      Bucket: this.bucket,
+      Key: key,
+      CopySource: encodeCopySource(this.bucket, key),
+      CopySourceIfMatch: etag,
+      IfMatch: etag,
+      MetadataDirective: "REPLACE",
+      Metadata: metadata
+    }, this.requestOptions(options)));
+    if (!result.CopyObjectResult?.ETag) fail("EIO", "utimes", path, "transport did not confirm a completed metadata copy");
+  }
+  async truncate(input, length = 0, options = {}) {
+    const path = this.path(input);
+    this.writable(path);
+    validateLimit(length, "length", 0);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (!info) fail("ENOENT", "truncate", path);
+    if (info.stat.type === "directory") fail("EISDIR", "truncate", path);
+    if (!this.transport.capabilities?.conditionalPut) this.unsupported("conditional truncate", path);
+    if (length > this.maxReadBytes) fail("EFBIG", "truncate", path);
+    let current = info.metadata;
+    const body = new Uint8Array(length);
+    if (length !== 0 && info.stat.size !== 0) {
+      if (this.readStream) {
+        const previous = await this.call("truncate", path, options, () => collectBytes(this.readStream(input, { ...options, endExclusive: Math.min(length, info.stat.size) }), { ...options, maxBytes: length }));
+        body.set(previous);
+      } else {
+        const output = await this.get(path, options);
+        const previous = await this.body(output, path, options);
+        current = output;
+        body.set(previous.subarray(0, length));
+      }
+    }
+    const metadata = { ...current.Metadata };
+    delete metadata["virtual-bash-mtime"];
+    await this.call("truncate", path, options, () => this.transport.putObject({
+      Bucket: this.bucket,
+      Key: this.key(path),
+      Body: body,
+      IfMatch: this.etag(current, path),
+      Metadata: metadata
+    }, this.requestOptions(options)));
+  }
+  async *streamRead(input, options = {}) {
+    const path = this.path(input);
+    const start = validateLimit(options.start ?? 0, "start", 0);
+    const end = options.endExclusive === void 0 ? void 0 : validateLimit(options.endExclusive, "endExclusive", start);
+    const chunkSize = validateLimit(options.chunkSize ?? 64 * 1024, "chunkSize", 1);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (!info) fail("ENOENT", "readStream", path);
+    if (info.stat.type === "directory") fail("EISDIR", "readStream", path);
+    const stop = Math.min(end ?? info.stat.size, info.stat.size);
+    const expected = Math.max(0, stop - start);
+    if (expected > this.maxStreamBytes) fail("EFBIG", "readStream", path);
+    if (expected === 0 && info.stat.size !== 0) return;
+    let count = 0;
+    let finished = false;
+    const controller = new AbortController();
+    const signalScope = options.signal ? composeAbortSignals([options.signal, controller.signal]) : void 0;
+    const signal = signalScope?.signal ?? controller.signal;
+    let output;
+    let iterator;
+    try {
+      output = await this.call("getObject", path, options, () => this.transport.getObjectStream({
+        Bucket: this.bucket,
+        Key: this.key(path),
+        IfMatch: this.etag(info.metadata, path),
+        ...expected === 0 || start === 0 && stop === info.stat.size ? {} : { Range: `bytes=${start}-${stop - 1}` }
+      }, { abortSignal: signal }));
+      if (output.ETag !== void 0 && output.ETag !== info.metadata?.ETag) fail("EIO", "readStream", path, "response ETag differs from requested snapshot");
+      if (output.ContentLength !== void 0 && output.ContentLength !== expected) fail("EIO", "readStream", path, "response length differs from requested snapshot");
+      iterator = readBytes(output.Body, signal)[Symbol.asyncIterator]();
+      while (true) {
+        const result = await iterator.next();
+        if (result.done) break;
+        const chunk = result.value;
+        if (chunk.length > expected - count) fail("EIO", "readStream", path, "response exceeds requested length");
+        count += chunk.length;
+        for (let offset = 0; offset < chunk.length; offset += chunkSize) {
+          this.checkAbort(options, "readStream", path);
+          yield new Uint8Array(chunk.subarray(offset, offset + chunkSize));
+        }
+      }
+      if (count !== expected) fail("EIO", "readStream", path, "incomplete response body");
+      finished = true;
+    } catch (error) {
+      this.checkAbort(options, "readStream", path);
+      throw translate(error, "readStream", path);
+    } finally {
+      controller.abort();
+      signalScope?.dispose();
+      if (!finished && output) {
+        this.dispose(iterator);
+        this.dispose(output.Body, iterator === void 0);
+      }
+    }
+  }
+  dispose(body, returnIterator = true) {
+    const disposable = body;
+    try {
+      const result = typeof disposable?.destroy === "function" ? disposable.destroy() : typeof disposable?.cancel === "function" ? disposable.cancel() : returnIterator ? disposable?.return?.() : void 0;
+      void Promise.resolve(result).catch(() => {
+      });
+    } catch (ignoredError) {
+      void ignoredError;
+    }
+  }
+  async streamWrite(input, source, options = {}) {
+    const path = this.path(input);
+    this.writable(path, options.mode);
+    const flag = options.flag ?? "w";
+    if (!["w", "wx", "a", "ax"].includes(flag)) fail("EINVAL", "writeStream", path);
+    if (flag !== "w" && !this.transport.capabilities?.conditionalPut) this.unsupported("conditional writes", path);
+    const info = await this.lookup(path, options);
+    this.requireDirectorySuffix(input, info);
+    if (info?.stat.type === "directory" || input.endsWith("/")) fail("EISDIR", "writeStream", path);
+    const exclusive = flag === "wx" || flag === "ax";
+    if (exclusive && info) fail("EEXIST", "writeStream", path);
+    if (flag === "a") {
+      const current = info ? await this.get(path, options) : void 0;
+      const previous = current ? await this.body(current, path, options) : new Uint8Array();
+      const limit2 = Math.min(this.maxReadBytes, this.maxStreamBytes);
+      if (previous.length > limit2) fail("EFBIG", "writeStream", path);
+      const bytes = await this.call("writeStream", path, options, () => collectBytes(source, { maxBytes: limit2 - previous.length, ...options }));
+      const body2 = new Uint8Array(previous.length + bytes.length);
+      body2.set(previous);
+      body2.set(bytes, previous.length);
+      const metadata = this.writeMetadata(current, options.mode);
+      await this.call("putObject", path, options, () => this.transport.putObject({
+        Bucket: this.bucket,
+        Key: this.key(path),
+        Body: body2,
+        ...current ? { IfMatch: this.etag(current, path) } : { IfNoneMatch: "*" },
+        ...metadata ? { Metadata: metadata } : {}
+      }, this.requestOptions(options)));
+      return;
+    }
+    const controller = new AbortController();
+    const signalScope = options.signal ? composeAbortSignals([options.signal, controller.signal]) : void 0;
+    const signal = signalScope?.signal ?? controller.signal;
+    let finished = false;
+    const body = (async function* () {
+      let total = 0;
+      for await (const chunk of readBytes(source, signal)) {
+        if (chunk.length > this.maxStreamBytes - total) fail("EFBIG", "writeStream", path);
+        total += chunk.length;
+        for (let offset = 0; offset < chunk.length; offset += 64 * 1024) {
+          this.checkAbort({ signal }, "writeStream", path);
+          yield new Uint8Array(chunk.subarray(offset, offset + 64 * 1024));
+        }
+      }
+      finished = true;
+    }).call(this);
+    try {
+      const metadata = this.writeMetadata(info?.metadata, options.mode);
+      await this.call("putObject", path, options, () => this.transport.putObjectStream({
+        Bucket: this.bucket,
+        Key: this.key(path),
+        Body: body,
+        ...exclusive ? { IfNoneMatch: "*" } : {},
+        ...metadata === void 0 ? {} : { Metadata: metadata }
+      }, { abortSignal: signal }), exclusive ? "EEXIST" : "EAGAIN");
+      if (!finished) fail("EIO", "writeStream", path, "transport completed without consuming the request body");
+    } finally {
+      controller.abort();
+      signalScope?.dispose();
+      this.dispose(body);
+    }
+  }
+};
+var s3Comparison = S3FileSystem.prototype.compareEntry;
+
+// packages/safe-fs/src/fs/s3/mock.ts
+import { createHash } from "node:crypto";
+function compareKeys(left, right) {
+  return Buffer.compare(Buffer.from(left), Buffer.from(right));
+}
+var MockS3Client = class {
+  capabilities = Object.freeze({ conditionalPut: true, conditionalCopy: true, conditionalDelete: true, streamingRead: true, streamingWrite: true });
+  buckets = /* @__PURE__ */ new Map();
+  cursors = /* @__PURE__ */ new Map();
+  history = [];
+  pageSize;
+  now;
+  authorize;
+  nextToken = 0;
+  constructor(options) {
+    this.pageSize = options.pageSize ?? 1e3;
+    if (!Number.isInteger(this.pageSize) || this.pageSize < 1 || this.pageSize > 1e3) {
+      throw new RangeError("pageSize must be an integer from 1 to 1000");
+    }
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.authorize = options.authorize;
+    for (const bucket of options.buckets) this.buckets.set(bucket, /* @__PURE__ */ new Map());
+  }
+  get requests() {
+    return structuredClone(this.history);
+  }
+  async begin(operation, input, options) {
+    if (options?.abortSignal?.aborted) throw new S3ServiceError("AbortError", 499);
+    const request = { operation, input: structuredClone(input) };
+    this.history.push(structuredClone(request));
+    await this.authorize?.(request);
+    if (options?.abortSignal?.aborted) throw new S3ServiceError("AbortError", 499);
+    if (!this.buckets.has(input.Bucket)) throw new S3ServiceError("NoSuchBucket", 404);
+    if ("Key" in input && (input.Key.length === 0 || Buffer.byteLength(input.Key) > 1024)) {
+      throw new S3ServiceError("InvalidArgument", 400);
+    }
+  }
+  bucket(name) {
+    const bucket = this.buckets.get(name);
+    if (!bucket) throw new S3ServiceError("NoSuchBucket", 404);
+    return bucket;
+  }
+  object(input) {
+    const object = this.bucket(input.Bucket).get(input.Key);
+    if (!object) throw new S3ServiceError("NoSuchKey", 404);
+    return object;
+  }
+  head(object) {
+    return {
+      ContentLength: object.body.byteLength,
+      ETag: object.etag,
+      LastModified: new Date(object.modified),
+      Metadata: { ...object.metadata }
+    };
+  }
+  store(body, metadata = {}) {
+    const metadataBytes = Object.entries(metadata).reduce((total, [key, value]) => total + Buffer.byteLength(key) + Buffer.byteLength(value), 0);
+    if (metadataBytes > 2048) throw new S3ServiceError("MetadataTooLarge", 400);
+    return {
+      body: new Uint8Array(body),
+      etag: `"${createHash("md5").update(body).digest("hex")}"`,
+      modified: new Date(this.now()),
+      metadata: { ...metadata }
+    };
+  }
+  async headObject(input, options) {
+    await this.begin("headObject", input, options);
+    const output = this.head(this.object(input));
+    recordMockS3Head(output, input, this.bucket(input.Bucket));
+    return output;
+  }
+  async getObject(input, options) {
+    await this.begin("getObject", input, options);
+    const object = this.object(input);
+    return { ...this.head(object), Body: new Uint8Array(object.body) };
+  }
+  async putObject(input, options) {
+    if (!(input.Body instanceof Uint8Array)) throw new S3ServiceError("InvalidArgument", 400);
+    input = { ...input, Body: new Uint8Array(input.Body), ...input.Metadata ? { Metadata: { ...input.Metadata } } : {} };
+    await this.begin("putObject", input, options);
+    const bucket = this.bucket(input.Bucket);
+    const previous = bucket.get(input.Key);
+    if (input.IfMatch !== void 0 && !previous) throw new S3ServiceError("NoSuchKey", 404);
+    if (input.IfNoneMatch === "*" && previous || input.IfMatch !== void 0 && previous?.etag !== input.IfMatch) {
+      throw new S3ServiceError("PreconditionFailed", 412);
+    }
+    const object = this.store(input.Body, input.Metadata);
+    bucket.set(input.Key, object);
+    return { ETag: object.etag };
+  }
+  async getObjectStream(input, options) {
+    await this.begin("getObject", input, options);
+    const object = this.object(input);
+    if (input.IfMatch !== void 0 && input.IfMatch !== object.etag) throw new S3ServiceError("PreconditionFailed", 412);
+    let start = 0;
+    let end = object.body.length;
+    if (input.Range !== void 0) {
+      const range = /^bytes=(\d+)-(\d+)$/.exec(input.Range);
+      if (!range) throw new S3ServiceError("InvalidArgument", 400);
+      start = Number(range[1]);
+      end = Math.min(Number(range[2]) + 1, end);
+      if (start >= end) throw new S3ServiceError("InvalidRange", 416);
+    }
+    return {
+      ...this.head(object),
+      ContentLength: end - start,
+      Body: (async function* () {
+        for (let offset = start; offset < end; offset += 64 * 1024) {
+          if (options?.abortSignal?.aborted) throw new S3ServiceError("AbortError", 499);
+          yield object.body.slice(offset, Math.min(offset + 64 * 1024, end));
+        }
+      })()
+    };
+  }
+  async putObjectStream(input, options) {
+    const snapshot = { ...input, Body: new Uint8Array(), ...input.Metadata ? { Metadata: { ...input.Metadata } } : {} };
+    await this.begin("putObject", snapshot, options);
+    const body = await collectBytes(input.Body, { maxBytes: 5e9, ...options?.abortSignal ? { signal: options.abortSignal } : {} });
+    const bucket = this.bucket(input.Bucket);
+    const previous = bucket.get(input.Key);
+    if (input.IfMatch !== void 0 && !previous) throw new S3ServiceError("NoSuchKey", 404);
+    if (input.IfNoneMatch === "*" && previous || input.IfMatch !== void 0 && previous?.etag !== input.IfMatch) {
+      throw new S3ServiceError("PreconditionFailed", 412);
+    }
+    const object = this.store(body, snapshot.Metadata);
+    bucket.set(input.Key, object);
+    return { ETag: object.etag };
+  }
+  async deleteObject(input, options) {
+    await this.begin("deleteObject", input, options);
+    const bucket = this.bucket(input.Bucket);
+    const previous = bucket.get(input.Key);
+    if (input.IfMatch !== void 0 && !previous) throw new S3ServiceError("NoSuchKey", 404);
+    if (previous && input.IfMatch !== void 0 && input.IfMatch !== "*" && previous.etag !== input.IfMatch) {
+      throw new S3ServiceError("PreconditionFailed", 412);
+    }
+    bucket.delete(input.Key);
+    return {};
+  }
+  async copyObject(input, options) {
+    await this.begin("copyObject", input, options);
+    let decoded;
+    try {
+      decoded = decodeURIComponent(input.CopySource.replace(/^\//, ""));
+    } catch {
+      throw new S3ServiceError("InvalidArgument", 400);
+    }
+    const separator = decoded.indexOf("/");
+    if (separator < 1) throw new S3ServiceError("InvalidArgument", 400);
+    const source = this.object({ Bucket: decoded.slice(0, separator), Key: decoded.slice(separator + 1) });
+    if (input.CopySourceIfMatch !== void 0 && input.CopySourceIfMatch !== source.etag) {
+      throw new S3ServiceError("PreconditionFailed", 412);
+    }
+    const bucket = this.bucket(input.Bucket);
+    if (input.IfNoneMatch === "*" && bucket.has(input.Key)) throw new S3ServiceError("PreconditionFailed", 412);
+    if (input.IfMatch !== void 0 && bucket.get(input.Key)?.etag !== input.IfMatch) throw new S3ServiceError("PreconditionFailed", 412);
+    const copy = this.store(source.body, input.MetadataDirective === "REPLACE" ? input.Metadata : source.metadata);
+    bucket.set(input.Key, copy);
+    return { CopyObjectResult: { ETag: copy.etag, LastModified: new Date(copy.modified) } };
+  }
+  async listObjectsV2(input, options) {
+    await this.begin("listObjectsV2", input, options);
+    const maxKeys = input.MaxKeys ?? 1e3;
+    if (!Number.isInteger(maxKeys) || maxKeys < 0 || maxKeys > 1e3) throw new S3ServiceError("InvalidArgument", 400);
+    const prefix = input.Prefix ?? "";
+    const delimiter = input.Delimiter ?? "";
+    const scope = JSON.stringify([input.Bucket, prefix, delimiter]);
+    const cursor = input.ContinuationToken === void 0 ? void 0 : this.cursors.get(input.ContinuationToken);
+    if (input.ContinuationToken !== void 0 && (!cursor || cursor.scope !== scope)) {
+      throw new S3ServiceError("InvalidArgument", 400, "invalid continuation token");
+    }
+    const entries = /* @__PURE__ */ new Map();
+    for (const [key, object] of this.bucket(input.Bucket)) {
+      if (!key.startsWith(prefix)) continue;
+      const separator = delimiter === "" ? -1 : key.indexOf(delimiter, prefix.length);
+      if (separator >= 0) {
+        const commonPrefix = key.slice(0, separator + delimiter.length);
+        entries.set(commonPrefix, commonPrefix);
+      } else {
+        entries.set(key, { Key: key, Size: object.body.byteLength, ETag: object.etag, LastModified: new Date(object.modified) });
+      }
+    }
+    const ordered = [...entries.keys()].sort(compareKeys).filter((key) => cursor === void 0 || compareKeys(key, cursor.after) > 0);
+    const selected = ordered.slice(0, Math.min(maxKeys, this.pageSize));
+    const contents = [];
+    const prefixes = [];
+    for (const key of selected) {
+      const entry = entries.get(key);
+      if (typeof entry === "string") prefixes.push({ Prefix: entry });
+      else if (entry) contents.push(entry);
+    }
+    const truncated = maxKeys > 0 && selected.length < ordered.length;
+    let token;
+    if (truncated) {
+      token = `mock-s3-cursor-${++this.nextToken}`;
+      this.cursors.set(token, { scope, after: selected[selected.length - 1] });
+    }
+    return {
+      Contents: contents,
+      CommonPrefixes: prefixes,
+      KeyCount: selected.length,
+      IsTruncated: truncated,
+      ...token === void 0 ? {} : { NextContinuationToken: token }
+    };
+  }
+};
+
+// packages/safe-fs/src/fs/s3/http/transport.ts
+import { isIP } from "node:net";
+
+// packages/safe-fs/src/fs/s3/http/request.ts
+import { once } from "node:events";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+function scopeFor(signal, timeout) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(signal?.reason);
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted) abort();
+  const timer = setTimeout(() => controller.abort(new S3ServiceError("RequestTimeout", 408)), timeout);
+  return {
+    signal: controller.signal,
+    finish: () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  };
+}
+async function abortable(pending, signal) {
+  let abort;
+  try {
+    return await new Promise((resolve2, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      pending.then(resolve2, reject);
+      if (signal.aborted) abort();
+    });
+  } finally {
+    if (abort) signal.removeEventListener("abort", abort);
+  }
+}
+async function sendRequest(options, body, scope, factory) {
+  const signal = scope.signal;
+  signal.throwIfAborted();
+  return new Promise((resolve2, reject) => {
+    let request;
+    let response;
+    let headersReceived = false;
+    let finished = false;
+    const cleanup = () => {
+      signal.removeEventListener("abort", abort);
+      scope.finish();
+    };
+    const close = () => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+      response?.destroy();
+      request?.destroy();
+    };
+    const fail2 = (error) => {
+      reject(signal.aborted ? signal.reason : error);
+      close();
+    };
+    const abort = () => fail2(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    try {
+      const create = factory ?? (options.protocol === "https:" ? httpsRequest : httpRequest);
+      request = create(options, (message) => {
+        response = message;
+        message.on("error", () => {
+        });
+        if (finished || signal.aborted) {
+          close();
+          message.destroy();
+          return;
+        }
+        headersReceived = true;
+        message.once("close", cleanup);
+        let claimed = false;
+        const source = {
+          [Symbol.asyncIterator]() {
+            if (claimed) throw new S3ServiceError("InvalidResponse", 502, "response body is single-use");
+            claimed = true;
+            const iterator = message[Symbol.asyncIterator]();
+            let ended = false;
+            return {
+              async next() {
+                try {
+                  signal.throwIfAborted();
+                  if (ended) return { done: true, value: void 0 };
+                  const result = await abortable(iterator.next(), signal);
+                  signal.throwIfAborted();
+                  if (result.done) {
+                    ended = true;
+                    if (!message.complete) throw new S3ServiceError("InvalidResponse", 502, "incomplete HTTP response");
+                    close();
+                    return { done: true, value: void 0 };
+                  }
+                  if (!(result.value instanceof Uint8Array)) throw new S3ServiceError("InvalidResponse", 502, "nonbinary HTTP body");
+                  return { done: false, value: new Uint8Array(result.value) };
+                } catch (error) {
+                  ended = true;
+                  close();
+                  throw signal.aborted ? signal.reason : error;
+                }
+              },
+              async return() {
+                ended = true;
+                close();
+                return { done: true, value: void 0 };
+              }
+            };
+          }
+        };
+        resolve2({ message, body: source, close });
+      });
+      request.on("error", fail2);
+      request.once("close", () => {
+        if (!headersReceived) fail2(new S3ServiceError("InvalidResponse", 502, "connection closed before response headers"));
+      });
+      if (signal.aborted || finished) {
+        abort();
+        request.destroy();
+        return;
+      }
+      void (async () => {
+        for (let offset = 0; offset < body.length; offset += 64 * 1024) {
+          signal.throwIfAborted();
+          if (!request.write(body.subarray(offset, offset + 64 * 1024))) await once(request, "drain", { signal });
+        }
+        signal.throwIfAborted();
+        request.end();
+      })().catch(fail2);
+    } catch (error) {
+      fail2(error);
+    }
+  });
+}
+function limitedBody(response, maximum, expected) {
+  if (expected !== void 0 && expected > maximum) {
+    response.close();
+    throw new S3ServiceError("EntityTooLarge", 413, "response exceeds byte limit");
+  }
+  let claimed = false;
+  return {
+    [Symbol.asyncIterator]() {
+      if (claimed) throw new S3ServiceError("InvalidResponse", 502, "response body is single-use");
+      claimed = true;
+      const iterator = response.body[Symbol.asyncIterator]();
+      let count = 0;
+      return {
+        async next() {
+          try {
+            const result = await iterator.next();
+            if (result.done) {
+              if (expected !== void 0 && count !== expected) throw new S3ServiceError("InvalidResponse", 502, "response content length mismatch");
+            } else {
+              count += result.value.length;
+              if (count > maximum) throw new S3ServiceError("EntityTooLarge", 413, "response exceeds byte limit");
+              if (expected !== void 0 && count > expected) throw new S3ServiceError("InvalidResponse", 502, "response content length mismatch");
+            }
+            return result;
+          } catch (error) {
+            response.close();
+            throw error;
+          }
+        },
+        async return() {
+          response.close();
+          await iterator.return?.();
+          return { done: true, value: void 0 };
+        }
+      };
+    }
+  };
+}
+async function collect(response, maximum, expected) {
+  const chunks = [];
+  let count = 0;
+  try {
+    for await (const chunk of limitedBody(response, maximum, expected)) {
+      chunks.push(chunk);
+      count += chunk.length;
+    }
+    return Buffer.concat(chunks, count);
+  } finally {
+    response.close();
+  }
+}
+
+// packages/safe-fs/src/fs/s3/http/signature.ts
+import { createHash as createHash2, createHmac } from "node:crypto";
+function invalid(message) {
+  throw new S3ServiceError("InvalidArgument", 400, message);
+}
+function uriEncode(value, preserveSlash = false) {
+  if (typeof value !== "string") invalid("expected a UTF-8 string");
+  try {
+    const encoded = encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+    return preserveSlash ? encoded.replace(/%2F/g, "/") : encoded;
+  } catch {
+    return invalid("invalid Unicode string");
+  }
+}
+function canonicalQuery(entries) {
+  return entries.map(([name, value]) => [uriEncode(name), uriEncode(value)]).sort(([leftName, leftValue], [rightName, rightValue]) => leftName < rightName ? -1 : leftName > rightName ? 1 : leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0).map(([name, value]) => `${name}=${value}`).join("&");
+}
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function headerValue(value) {
+  if (typeof value !== "string" || /[^\x20-\x7e\t]/.test(value)) invalid("header values must be printable ASCII without line breaks");
+  return value.trim().replace(/[ \t]+/g, " ");
+}
+function signRequest(input) {
+  const credentials = input.credentials;
+  if (!credentials || typeof credentials.accessKeyId !== "string" || !/^[A-Za-z0-9_-]+$/.test(credentials.accessKeyId) || typeof credentials.secretAccessKey !== "string" || credentials.secretAccessKey.length === 0 || credentials.secretAccessKey.length > 4096) invalid("explicit signing credentials are required");
+  if (!/^[a-z0-9-]{1,64}$/.test(input.region)) invalid("invalid signing region");
+  if (!(input.date instanceof Date) || !Number.isFinite(input.date.getTime()) || input.date.getUTCFullYear() < 1970 || input.date.getUTCFullYear() > 9999) invalid("invalid signing clock");
+  const timestamp2 = input.date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const date = timestamp2.slice(0, 8);
+  const headers = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(input.headers)) {
+    const lower = name.toLowerCase();
+    if (!/^[a-z0-9-]+$/.test(lower) || lower in headers) invalid("invalid or duplicate signing header");
+    headers[lower] = headerValue(value);
+  }
+  if (!headers.host) invalid("host is required for signing");
+  const payloadHash = sha256(input.body);
+  headers["x-amz-date"] = timestamp2;
+  headers["x-amz-content-sha256"] = payloadHash;
+  if (credentials.sessionToken !== void 0) {
+    headers["x-amz-security-token"] = headerValue(credentials.sessionToken);
+    if (!headers["x-amz-security-token"]) invalid("session token must not be empty");
+  }
+  const names = Object.keys(headers).sort();
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    input.method,
+    input.path,
+    input.query,
+    names.map((name) => `${name}:${headers[name]}
+`).join(""),
+    signedHeaders,
+    payloadHash
+  ].join("\n");
+  const scope = `${date}/${input.region}/s3/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", timestamp2, scope, sha256(canonicalRequest)].join("\n");
+  let key = createHmac("sha256", `AWS4${credentials.secretAccessKey}`).update(date).digest();
+  for (const part of [input.region, "s3", "aws4_request"]) key = createHmac("sha256", key).update(part).digest();
+  const signature = createHmac("sha256", key).update(stringToSign).digest("hex");
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  if (Object.entries(headers).reduce((size, [name, value]) => size + name.length + value.length + 4, 0) > 16 * 1024) invalid("request headers exceed 16 KiB");
+  return { headers, canonicalRequest, signature };
+}
+
+// packages/safe-fs/src/fs/s3/http/xml.ts
+function malformed(message = "invalid S3 XML response") {
+  throw new S3ServiceError("InvalidResponse", 502, message);
+}
+function validCharacter(code) {
+  return code === 9 || code === 10 || code === 13 || code >= 32 && code <= 55295 || code >= 57344 && code <= 65533 || code >= 65536 && code <= 1114111;
+}
+function decodeEntities(text2) {
+  let result = "";
+  let position = 0;
+  while (position < text2.length) {
+    const start = text2.indexOf("&", position);
+    if (start < 0) return result + text2.slice(position);
+    result += text2.slice(position, start);
+    const end = text2.indexOf(";", start + 1);
+    if (end < 0 || end - start > 12) malformed("invalid XML entity");
+    const entity = text2.slice(start + 1, end);
+    const named = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+    if (Object.hasOwn(named, entity)) result += named[entity];
+    else {
+      const hexadecimal = entity.startsWith("#x");
+      const digits = entity.slice(hexadecimal ? 2 : 1);
+      if (!entity.startsWith("#") || !(hexadecimal ? /^[0-9a-fA-F]+$/ : /^[0-9]+$/).test(digits)) malformed("unknown XML entity");
+      const code = Number.parseInt(digits, hexadecimal ? 16 : 10);
+      if (!validCharacter(code)) malformed("invalid XML code point");
+      result += String.fromCodePoint(code);
+    }
+    position = end + 1;
+  }
+  return result;
+}
+function parseXml(bytes) {
+  let xml;
+  try {
+    xml = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return malformed("XML is not UTF-8");
+  }
+  for (const character of xml) if (!validCharacter(character.codePointAt(0))) malformed("invalid XML character");
+  xml = xml.replace(/\r\n?/g, "\n");
+  let position = 0;
+  let nodes = 0;
+  let root;
+  const stack = [];
+  const whitespace = () => {
+    while (position < xml.length && /[ \t\r\n]/.test(xml[position])) position++;
+  };
+  const name = () => {
+    const start = position;
+    if (!/[A-Za-z_]/.test(xml[position] ?? "")) malformed("invalid XML name");
+    while (position < xml.length && /[A-Za-z0-9_.:-]/.test(xml[position])) position++;
+    const result = xml.slice(start, position);
+    if (result.length > 256) malformed("XML name too long");
+    return result;
+  };
+  while (position < xml.length) {
+    if (xml[position] !== "<") {
+      const end = xml.indexOf("<", position);
+      const text2 = xml.slice(position, end < 0 ? xml.length : end);
+      if (text2.includes("]]>")) malformed();
+      const current = stack.at(-1);
+      if (current) current.text += decodeEntities(text2);
+      else if (text2.trim()) malformed("text outside XML root");
+      position = end < 0 ? xml.length : end;
+      continue;
+    }
+    if (xml.startsWith("<?xml ", position) && !root && position === 0) {
+      const end = xml.indexOf("?>", position);
+      if (end < 0 || end > 256) malformed();
+      const declaration = xml.slice(position, end);
+      if (!/^<\?xml\s+version\s*=\s*(?:"1\.0"|'1\.0')(?:\s+encoding\s*=\s*(?:"[Uu][Tt][Ff]-8"|'[Uu][Tt][Ff]-8'))?(?:\s+standalone\s*=\s*(?:"(?:yes|no)"|'(?:yes|no)'))?\s*$/.test(declaration)) malformed("unsupported XML declaration");
+      position = end + 2;
+      continue;
+    }
+    if (xml.startsWith("<!--", position)) {
+      const end = xml.indexOf("-->", position + 4);
+      const comment = xml.slice(position + 4, end);
+      if (end < 0 || comment.includes("--") || comment.endsWith("-")) malformed();
+      position = end + 3;
+      continue;
+    }
+    if (xml.startsWith("<![CDATA[", position)) {
+      const end = xml.indexOf("]]>", position + 9);
+      const current = stack.at(-1);
+      if (end < 0 || !current) malformed();
+      current.text += xml.slice(position + 9, end);
+      position = end + 3;
+      continue;
+    }
+    position++;
+    const closing = xml[position] === "/";
+    if (closing) position++;
+    const tag = name();
+    if (closing) {
+      whitespace();
+      if (xml[position++] !== ">" || stack.pop()?.name !== tag) malformed("mismatched XML close tag");
+      continue;
+    }
+    const attributes = /* @__PURE__ */ new Set();
+    while (true) {
+      const previous = position;
+      whitespace();
+      if (xml[position] === ">" || xml[position] === "/") break;
+      if (previous === position || attributes.size >= 32) malformed("invalid XML attributes");
+      const attribute = name();
+      if (attributes.has(attribute)) malformed("duplicate XML attribute");
+      attributes.add(attribute);
+      whitespace();
+      if (xml[position++] !== "=") malformed();
+      whitespace();
+      const quote = xml[position++];
+      if (quote !== '"' && quote !== "'") malformed();
+      const end = xml.indexOf(quote, position);
+      if (end < 0 || xml.slice(position, end).includes("<")) malformed();
+      decodeEntities(xml.slice(position, end));
+      position = end + 1;
+    }
+    const selfClosing = xml[position] === "/";
+    if (selfClosing) position++;
+    if (xml[position++] !== ">") malformed();
+    if (++nodes > 32768 || stack.length >= 32) malformed("XML structure limit exceeded");
+    const node = { name: tag, text: "", children: [] };
+    const parent = stack.at(-1);
+    if (parent) parent.children.push(node);
+    else if (root) malformed("multiple XML roots");
+    else root = node;
+    if (!selfClosing) stack.push(node);
+  }
+  if (!root || stack.length) malformed("incomplete XML");
+  return root;
+}
+function children(node, name) {
+  return node.children.filter((child) => child.name === name);
+}
+function text(node, name, required = false) {
+  const matches = children(node, name);
+  if (matches.length > 1 || required && matches.length !== 1) malformed(`invalid ${name} count`);
+  const child = matches[0];
+  if (child?.children.length) malformed(`invalid ${name} value`);
+  return child?.text;
+}
+function integer2(value) {
+  if (!/^[0-9]+$/.test(value) || !Number.isSafeInteger(Number(value))) malformed("invalid integer");
+  return Number(value);
+}
+function timestamp(value) {
+  const date = new Date(value);
+  if (!Number.isFinite(date.getTime())) malformed("invalid timestamp");
+  return date;
+}
+
+// packages/safe-fs/src/fs/s3/http/transport.ts
+var empty = new Uint8Array();
+function limit(value, fallback, name, maximum = 1024 * 1024 * 1024) {
+  const result = value ?? fallback;
+  if (!Number.isSafeInteger(result) || result < 1 || result > maximum) invalid(`invalid ${name}`);
+  return result;
+}
+function boolean(value, fallback, name) {
+  if (value !== void 0 && typeof value !== "boolean") invalid(`invalid ${name}`);
+  return value ?? fallback;
+}
+function bucketName(bucket) {
+  if (typeof bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) || bucket.includes("..") || bucket.includes(".-") || bucket.includes("-.") || isIP(bucket)) invalid("expected a standard S3 bucket name");
+}
+function objectKey(key) {
+  if (typeof key !== "string" || !key || Buffer.byteLength(key) > 1024) invalid("object keys must contain 1..1024 UTF-8 bytes");
+  uriEncode(key);
+}
+function header(message, name) {
+  const values = message.headersDistinct[name];
+  if (values && values.length !== 1) malformed(`duplicate ${name} header`);
+  return values?.[0];
+}
+function head(message) {
+  const length = header(message, "content-length");
+  const modified = header(message, "last-modified");
+  const etag = header(message, "etag");
+  const metadata = /* @__PURE__ */ Object.create(null);
+  for (const name of Object.keys(message.headersDistinct)) {
+    if (name.startsWith("x-amz-meta-")) metadata[name.slice(11)] = header(message, name);
+  }
+  return {
+    ...length === void 0 ? {} : { ContentLength: integer2(length) },
+    ...modified === void 0 ? {} : { LastModified: timestamp(modified) },
+    ...etag === void 0 ? {} : { ETag: etag },
+    Metadata: metadata
+  };
+}
+function metadataHeaders(metadata) {
+  const headers = /* @__PURE__ */ Object.create(null);
+  let size = 0;
+  for (const [name, value] of Object.entries(metadata ?? {})) {
+    const lower = name.toLowerCase();
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(lower) || `x-amz-meta-${lower}` in headers) invalid("invalid or duplicate metadata key");
+    const normalized = headerValue(value);
+    size += Buffer.byteLength(lower) + Buffer.byteLength(normalized);
+    if (size > 2048) invalid("metadata exceeds 2 KiB");
+    headers[`x-amz-meta-${lower}`] = normalized;
+  }
+  return headers;
+}
+function conditions(input) {
+  const headers = {};
+  if (input.IfMatch !== void 0) {
+    const value = headerValue(input.IfMatch);
+    if (!value) invalid("empty IfMatch");
+    headers["if-match"] = value;
+  }
+  if (input.IfNoneMatch !== void 0) {
+    if (input.IfNoneMatch !== "*") invalid("IfNoneMatch must be '*'");
+    headers["if-none-match"] = "*";
+  }
+  return headers;
+}
+function requireCondition(enabled, present) {
+  if (present && !enabled) throw new S3ServiceError("NotImplemented", 501, "conditional operation requires independently verified provider enforcement");
+}
+function copySource(value) {
+  if (typeof value !== "string" || value.length > 4096 || !/^\/?[A-Za-z0-9_.~!$&'()*+,;=:@%/-]+$/.test(value)) invalid("CopySource must already be URI encoded without a query");
+  const source = value.startsWith("/") ? value.slice(1) : value;
+  const slash = source.indexOf("/");
+  if (slash < 1) invalid("CopySource requires bucket/key");
+  let bucket;
+  let key;
+  try {
+    bucket = decodeURIComponent(source.slice(0, slash));
+    key = decodeURIComponent(source.slice(slash + 1));
+  } catch {
+    return invalid("invalid CopySource encoding");
+  }
+  bucketName(bucket);
+  objectKey(key);
+  return value;
+}
+function rangeHeader(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !/^bytes=(?:[0-9]+-[0-9]*|-[0-9]+)$/.test(value)) invalid("unsupported byte range");
+  const [start, end] = value.slice(6).split("-");
+  if (start && !Number.isSafeInteger(Number(start)) || end && !Number.isSafeInteger(Number(end)) || !start && Number(end) === 0 || start && end && Number(start) > Number(end)) invalid("invalid byte range");
+  return value;
+}
+function checkRange(message, range, metadata) {
+  if (!range) {
+    if (message.statusCode !== 200) malformed("unexpected GET status");
+    return metadata.ContentLength;
+  }
+  if (message.statusCode !== 206) malformed("provider ignored byte range");
+  const match = /^bytes ([0-9]+)-([0-9]+)\/([0-9]+)$/.exec(header(message, "content-range") ?? "");
+  if (!match) malformed("invalid Content-Range");
+  const start = integer2(match[1]);
+  const end = integer2(match[2]);
+  const total = integer2(match[3]);
+  const [requestedStart, requestedEnd] = range.slice(6).split("-");
+  const expectedStart = requestedStart ? Number(requestedStart) : Math.max(0, total - Number(requestedEnd));
+  const expectedEnd = requestedStart && requestedEnd ? Math.min(total - 1, Number(requestedEnd)) : total - 1;
+  if (start !== expectedStart || end !== expectedEnd || start > end || end >= total || metadata.ContentLength !== void 0 && metadata.ContentLength !== end - start + 1) malformed("response range differs from request");
+  return end - start + 1;
+}
+function createS3HttpTransport(options) {
+  if (!options || typeof options.endpoint !== "string" || !/^https?:\/\/[^\\/?#]+\/?$/.test(options.endpoint)) invalid("endpoint must be an explicit HTTP(S) origin without path, credentials, query or fragment");
+  let endpoint;
+  try {
+    endpoint = new URL(options.endpoint);
+  } catch {
+    return invalid("invalid endpoint");
+  }
+  if (endpoint.username || endpoint.password) invalid("endpoint credentials are not allowed");
+  if (endpoint.protocol === "http:" && !boolean(options.allowInsecureHttp, false, "allowInsecureHttp")) invalid("HTTP requires explicit allowInsecureHttp");
+  if (typeof options.region !== "string" || !/^[a-z0-9-]{1,64}$/.test(options.region)) invalid("explicit signing region required");
+  if (!options.credentials || typeof options.credentials !== "function" && typeof options.credentials !== "object") invalid("explicit credentials required");
+  const credentials = typeof options.credentials === "function" ? options.credentials : Object.freeze({ ...options.credentials });
+  const addressing = options.addressingStyle ?? "path";
+  if (addressing !== "path" && addressing !== "virtual-hosted") invalid("unsupported addressing style");
+  const listEncoding = options.listUrlEncoding ?? "percent";
+  if (listEncoding !== "percent" && listEncoding !== "form") invalid("unsupported LIST URL encoding");
+  if (addressing === "virtual-hosted" && (isIP(endpoint.hostname.replace(/^\[|\]$/g, "")) || endpoint.hostname === "localhost")) invalid("virtual-hosted addressing requires a DNS endpoint");
+  const maxPut = limit(options.maxPutBytes, 64 * 1024 * 1024, "maxPutBytes");
+  const maxGet = limit(options.maxGetBytes, 64 * 1024 * 1024, "maxGetBytes");
+  const maxXml = limit(options.maxXmlBytes, 4 * 1024 * 1024, "maxXmlBytes", 16 * 1024 * 1024);
+  const timeout = limit(options.requestTimeoutMs, 3e4, "requestTimeoutMs", 2147483647);
+  const enabledCopy = boolean(options.enableCopy, true, "enableCopy");
+  const verified = options.verifiedConditionalOperations;
+  const conditionalPut = boolean(verified?.put, false, "verifiedConditionalOperations.put");
+  const nativeConditionalCopy = boolean(verified?.copy, false, "verifiedConditionalOperations.copy");
+  const conditionalCopy = enabledCopy ? nativeConditionalCopy : conditionalPut;
+  const conditionalDelete = boolean(verified?.delete, false, "verifiedConditionalOperations.delete");
+  const clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+  const factory = options.request;
+  const region = options.region;
+  if (typeof clock !== "function" || factory !== void 0 && typeof factory !== "function") invalid("invalid clock or request factory");
+  const exchange = async (method, bucket, key, headers, query, body, requestOptions) => {
+    requestOptions?.abortSignal?.throwIfAborted();
+    bucketName(bucket);
+    if (key !== void 0) objectKey(key);
+    const hostname = addressing === "virtual-hosted" ? `${bucket}.${endpoint.hostname}` : endpoint.hostname;
+    const host = `${hostname}${endpoint.port ? `:${endpoint.port}` : ""}`;
+    const path = addressing === "virtual-hosted" ? `/${key === void 0 ? "" : uriEncode(key, true)}` : `/${bucket}${key === void 0 ? "" : `/${uriEncode(key, true)}`}`;
+    const encodedQuery = canonicalQuery(query);
+    const target = `${path}${encodedQuery ? `?${encodedQuery}` : ""}`;
+    if (target.length > 16 * 1024) invalid("request target exceeds 16 KiB");
+    const scope = scopeFor(requestOptions?.abortSignal, timeout);
+    try {
+      scope.signal.throwIfAborted();
+      const resolved = typeof credentials === "function" ? await abortable(Promise.resolve(credentials({ signal: scope.signal })), scope.signal) : credentials;
+      scope.signal.throwIfAborted();
+      const signed = signRequest({
+        method,
+        path,
+        query: encodedQuery,
+        headers: { ...headers, host, ...method === "PUT" ? { "content-length": String(body.length) } : {} },
+        body,
+        region,
+        credentials: resolved,
+        date: clock()
+      });
+      const response = await sendRequest({
+        protocol: endpoint.protocol,
+        hostname: hostname.replace(/^\[|\]$/g, ""),
+        ...endpoint.port ? { port: endpoint.port } : {},
+        method,
+        path: target,
+        headers: signed.headers,
+        agent: false,
+        maxHeaderSize: 16 * 1024,
+        ...{ rejectUnauthorized: true }
+      }, body, scope, factory);
+      const status = response.message.statusCode ?? 502;
+      if (status < 200 || status >= 300) {
+        const bytes = await collect(response, maxXml);
+        const fallback = status === 404 ? "NotFound" : status === 403 || status === 401 ? "AccessDenied" : status === 412 ? "PreconditionFailed" : status === 409 ? "ConditionalRequestConflict" : status === 501 ? "NotImplemented" : status === 408 ? "RequestTimeout" : status >= 300 && status < 400 ? "RedirectRejected" : "HttpError";
+        let code = fallback;
+        let message = `S3 HTTP request failed with status ${status}`;
+        if (bytes.length) {
+          try {
+            const parsed = parseXml(bytes);
+            if (parsed.name === "Error") {
+              code = text(parsed, "Code") || fallback;
+              message = text(parsed, "Message") || message;
+            }
+          } catch (ignoredError) {
+            void ignoredError;
+          }
+        }
+        throw new S3ServiceError(code, status, message);
+      }
+      return response;
+    } catch (error) {
+      scope.finish();
+      throw scope.signal.aborted ? scope.signal.reason : error;
+    }
+  };
+  const get = async (input, requestOptions) => {
+    requestOptions?.abortSignal?.throwIfAborted();
+    const range = rangeHeader(input.Range);
+    const headers = { ...conditions(input), ...range ? { range } : {} };
+    const response = await exchange("GET", input.Bucket, input.Key, headers, [], empty, requestOptions);
+    try {
+      const metadata = head(response.message);
+      const expected = checkRange(response.message, range, metadata);
+      if (input.IfMatch !== void 0 && input.IfMatch !== "*" && metadata.ETag !== void 0 && metadata.ETag !== input.IfMatch) malformed("GET ETag differs from IfMatch");
+      return { ...metadata, Body: limitedBody(response, maxGet, expected) };
+    } catch (error) {
+      response.close();
+      throw error;
+    }
+  };
+  const boundedCopy = async (input, requestOptions) => {
+    if (!conditionalPut) throw new S3ServiceError("NotImplemented", 501, "disabled native COPY requires verified conditional PUT for bounded fallback");
+    const scope = scopeFor(requestOptions?.abortSignal, timeout);
+    const operationOptions = { abortSignal: scope.signal };
+    const destination = { Bucket: input.Bucket, Key: input.Key };
+    const source = copySource(input.CopySource).replace(/^\//, "");
+    const slash = source.indexOf("/");
+    const origin = { Bucket: decodeURIComponent(source.slice(0, slash)), Key: decodeURIComponent(source.slice(slash + 1)) };
+    const sourceCondition = input.CopySourceIfMatch;
+    let destinationCondition = { ...conditions(input) };
+    const directive = input.MetadataDirective ?? "COPY";
+    const replacementMetadata = input.Metadata === void 0 ? {} : { ...input.Metadata };
+    let body;
+    try {
+      scope.signal.throwIfAborted();
+      if (Object.keys(destinationCondition).length === 0) {
+        let current;
+        try {
+          current = await transport.headObject(destination, operationOptions);
+        } catch (error) {
+          if (scope.signal.aborted) throw scope.signal.reason;
+          if (!(error instanceof S3ServiceError) || !["NotFound", "NoSuchKey"].includes(error.code)) throw error;
+        }
+        if (current) {
+          if (!current.ETag) malformed("destination lacks ETag for conditional COPY fallback");
+          destinationCondition = { "if-match": current.ETag };
+        } else destinationCondition = { "if-none-match": "*" };
+      }
+      const output = await get({ ...origin, ...sourceCondition === void 0 ? {} : { IfMatch: sourceCondition } }, operationOptions);
+      body = output.Body[Symbol.asyncIterator]();
+      if (!output.ETag || output.ContentLength === void 0) malformed("source lacks ETag/length for bounded COPY fallback");
+      if (sourceCondition !== void 0 && sourceCondition !== "*" && output.ETag !== sourceCondition) throw new S3ServiceError("PreconditionFailed", 412, "source changed before COPY fallback");
+      if (output.ContentLength > maxPut) throw new S3ServiceError("EntityTooLarge", 413, "COPY fallback exceeds PUT byte limit");
+      const chunks = [];
+      let count = 0;
+      while (true) {
+        const result = await body.next();
+        if (result.done) break;
+        count += result.value.length;
+        if (count > maxPut) throw new S3ServiceError("EntityTooLarge", 413, "COPY fallback exceeds PUT byte limit");
+        chunks.push(result.value);
+      }
+      scope.signal.throwIfAborted();
+      const metadata = directive === "REPLACE" ? replacementMetadata : output.Metadata;
+      const headers = { ...metadataHeaders(metadata), ...destinationCondition };
+      const response = await exchange("PUT", destination.Bucket, destination.Key, headers, [], Buffer.concat(chunks, count), operationOptions);
+      try {
+        if (response.message.statusCode !== 200) malformed("unexpected COPY fallback PUT status");
+        await collect(response, maxXml);
+        const etag = header(response.message, "etag");
+        if (!etag) malformed("COPY fallback PUT lacks confirmation ETag");
+        return { CopyObjectResult: { ETag: etag } };
+      } finally {
+        response.close();
+      }
+    } finally {
+      await body?.return?.();
+      scope.finish();
+    }
+  };
+  const transport = {
+    capabilities: Object.freeze({ streamingRead: true, streamingWrite: false, conditionalPut, conditionalCopy, conditionalDelete }),
+    async headObject(input, requestOptions) {
+      const response = await exchange("HEAD", input.Bucket, input.Key, {}, [], empty, requestOptions);
+      try {
+        if (response.message.statusCode !== 200) malformed("unexpected HEAD status");
+        const metadata = head(response.message);
+        await collect(response, maxXml);
+        return metadata;
+      } finally {
+        response.close();
+      }
+    },
+    async getObject(input, requestOptions) {
+      const response = await get(input, requestOptions);
+      const chunks = [];
+      let count = 0;
+      for await (const chunk of response.Body) {
+        chunks.push(chunk);
+        count += chunk.length;
+      }
+      return { ...response, Body: Buffer.concat(chunks, count) };
+    },
+    getObjectStream: get,
+    async putObject(input, requestOptions) {
+      requestOptions?.abortSignal?.throwIfAborted();
+      if (!(input.Body instanceof Uint8Array)) invalid("PUT requires a bounded Uint8Array");
+      if (input.Body.length > maxPut) throw new S3ServiceError("EntityTooLarge", 413, "PUT exceeds byte limit");
+      requireCondition(conditionalPut, input.IfMatch !== void 0 || input.IfNoneMatch !== void 0);
+      const body = new Uint8Array(input.Body);
+      const headers = { ...metadataHeaders(input.Metadata), ...conditions(input) };
+      const response = await exchange("PUT", input.Bucket, input.Key, headers, [], body, requestOptions);
+      try {
+        if (response.message.statusCode !== 200) malformed("unexpected PUT status");
+        await collect(response, maxXml);
+        return { ETag: header(response.message, "etag") };
+      } finally {
+        response.close();
+      }
+    },
+    async deleteObject(input, requestOptions) {
+      requestOptions?.abortSignal?.throwIfAborted();
+      requireCondition(conditionalDelete, input.IfMatch !== void 0);
+      const response = await exchange("DELETE", input.Bucket, input.Key, conditions(input), [], empty, requestOptions);
+      try {
+        if (response.message.statusCode !== 204) malformed("unexpected DELETE status");
+        await collect(response, maxXml);
+        return {};
+      } finally {
+        response.close();
+      }
+    },
+    async copyObject(input, requestOptions) {
+      requestOptions?.abortSignal?.throwIfAborted();
+      if (input.MetadataDirective !== void 0 && input.MetadataDirective !== "COPY" && input.MetadataDirective !== "REPLACE") invalid("invalid MetadataDirective");
+      const headers = {
+        ...metadataHeaders(input.Metadata),
+        ...conditions(input),
+        "x-amz-copy-source": copySource(input.CopySource),
+        ...input.CopySourceIfMatch === void 0 ? {} : { "x-amz-copy-source-if-match": headerValue(input.CopySourceIfMatch) },
+        ...input.MetadataDirective === void 0 ? {} : { "x-amz-metadata-directive": input.MetadataDirective }
+      };
+      if (input.CopySourceIfMatch !== void 0 && !headers["x-amz-copy-source-if-match"]) invalid("empty CopySourceIfMatch");
+      bucketName(input.Bucket);
+      objectKey(input.Key);
+      if (!enabledCopy) return boundedCopy(input, requestOptions);
+      requireCondition(conditionalCopy, input.IfMatch !== void 0 || input.IfNoneMatch !== void 0 || input.CopySourceIfMatch !== void 0);
+      const response = await exchange("PUT", input.Bucket, input.Key, headers, [], empty, requestOptions);
+      const root = parseXml(await collect(response, maxXml));
+      if (root.name === "Error") throw new S3ServiceError(text(root, "Code", true), response.message.statusCode, text(root, "Message") ?? "embedded COPY failure");
+      if (response.message.statusCode !== 200 || root.name !== "CopyObjectResult") malformed("invalid COPY response");
+      return { CopyObjectResult: { ETag: text(root, "ETag", true), LastModified: timestamp(text(root, "LastModified", true)) } };
+    },
+    async listObjectsV2(input, requestOptions) {
+      requestOptions?.abortSignal?.throwIfAborted();
+      if (input.MaxKeys !== void 0 && (!Number.isSafeInteger(input.MaxKeys) || input.MaxKeys < 0 || input.MaxKeys > 1e3)) invalid("MaxKeys must be 0..1000");
+      const query = [["list-type", "2"], ["encoding-type", "url"]];
+      for (const [name, value] of [["prefix", input.Prefix], ["delimiter", input.Delimiter], ["continuation-token", input.ContinuationToken]]) {
+        if (value !== void 0) {
+          if (typeof value !== "string" || Buffer.byteLength(value) > 8192) invalid(`invalid ${name}`);
+          query.push([name, value]);
+        }
+      }
+      if (input.MaxKeys !== void 0) query.push(["max-keys", String(input.MaxKeys)]);
+      const response = await exchange("GET", input.Bucket, void 0, {}, query, empty, requestOptions);
+      const root = parseXml(await collect(response, maxXml));
+      if (response.message.statusCode !== 200 || root.name !== "ListBucketResult") malformed("invalid LIST response");
+      const encoding = text(root, "EncodingType");
+      if (encoding !== void 0 && encoding !== "url") malformed("unsupported LIST encoding");
+      const decode = (value) => {
+        if (encoding !== "url") return value;
+        try {
+          return decodeURIComponent(listEncoding === "form" ? value.replace(/\+/g, " ") : value);
+        } catch {
+          return malformed("invalid URL-encoded LIST key");
+        }
+      };
+      const truncated = text(root, "IsTruncated", true);
+      if (truncated !== "true" && truncated !== "false") malformed("invalid IsTruncated");
+      const token = text(root, "NextContinuationToken");
+      if (truncated === "true" && !token) malformed("truncated LIST lacks continuation token");
+      const keyCount = text(root, "KeyCount");
+      const contents = children(root, "Contents").map((item) => ({
+        Key: decode(text(item, "Key", true)),
+        Size: integer2(text(item, "Size", true)),
+        ETag: text(item, "ETag", true),
+        LastModified: timestamp(text(item, "LastModified", true))
+      }));
+      const prefixes = children(root, "CommonPrefixes").map((item) => ({ Prefix: decode(text(item, "Prefix", true)) }));
+      if (contents.length + prefixes.length > (input.MaxKeys ?? 1e3)) malformed("LIST exceeds requested page size");
+      return {
+        Contents: contents,
+        CommonPrefixes: prefixes,
+        IsTruncated: truncated === "true",
+        ...keyCount === void 0 ? {} : { KeyCount: integer2(keyCount) },
+        ...token === void 0 ? {} : { NextContinuationToken: token }
+      };
+    }
+  };
+  return Object.freeze(transport);
+}
+
+// packages/safe-fs/src/node/filesystem.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { randomBytes } from "node:crypto";
+import { posix as posix3 } from "node:path";
+import { fileURLToPath } from "node:url";
+function createNodeFsBridge(fs, options = {}) {
+  return new FileSystemBridge(fs, options, {
+    codec: {
+      isEncoding: Buffer2.isEncoding,
+      encode(text2, encoding) {
+        if (!Buffer2.isEncoding(encoding)) throw new TypeError("Invalid encoding");
+        return Buffer2.from(text2, encoding);
+      },
+      decode(bytes, encoding) {
+        if (!Buffer2.isEncoding(encoding)) throw new TypeError("Invalid encoding");
+        return Buffer2.from(bytes).toString(encoding);
+      }
+    },
+    copyBytes: Buffer2.from,
+    pathValue(value) {
+      return value instanceof URL ? fileURLToPath(value) : Buffer2.isBuffer(value) ? value.toString("utf8") : value;
+    },
+    randomSuffix() {
+      return randomBytes(6).toString("hex").slice(0, 6);
+    },
+    paths: posix3
+  });
+}
+
+// packages/safe-fs/src/config.ts
+function readConfigRecord(value, label, keys) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a record.`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError(`${label} must be a plain record.`);
+  }
+  const record = /* @__PURE__ */ Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || keys !== void 0 && !keys.includes(key)) {
+      throw new TypeError(`Unknown ${label}: ${String(key)}`);
+    }
+    const property = Object.getOwnPropertyDescriptor(value, key);
+    if (!("value" in property)) throw new TypeError(`${label}.${key} must be a data property.`);
+    record[key] = property.value;
+  }
+  return Object.freeze(record);
+}
+function validateFileSystemConfig(value) {
+  const config = readConfigRecord(value, "filesystem config", ["type", "options"]);
+  if (typeof config.type !== "string" || config.type.trim().length === 0) {
+    throw new TypeError("Filesystem adapter type must be a nonempty string.");
+  }
+  return {
+    type: config.type,
+    ...config.options === void 0 ? {} : { options: readConfigRecord(config.options, "filesystem options") }
+  };
+}
+async function createFileSystem(config, options) {
+  const validated = validateFileSystemConfig(config);
+  const creation = readConfigRecord(options, "filesystem creation option", ["registry"]);
+  const registry = creation.registry;
+  if (registry === void 0 || registry === null || typeof registry.get !== "function") {
+    throw new TypeError("registry must be a filesystem adapter map.");
+  }
+  const descriptor = registry.get(validated.type);
+  if (descriptor === void 0)
+    throw new TypeError(`Unknown filesystem adapter: ${validated.type}`);
+  const adapterOptions = validated.options ?? Object.freeze(/* @__PURE__ */ Object.create(null));
+  descriptor.validateOptions(adapterOptions);
+  return await descriptor.create(adapterOptions);
+}
+
+// packages/safe-fs/src/config/memory.ts
+function createMemoryFileSystemAdapter(create) {
+  return {
+    validateOptions(options) {
+      readConfigRecord(options, "memory option", []);
+    },
+    create
+  };
+}
+
+// packages/safe-fs/src/config/real.ts
+function createRealFileSystemAdapter(create) {
+  return {
+    validateOptions(options) {
+      const record = readConfigRecord(options, "real option", ["root"]);
+      if (typeof record.root !== "string" || !record.root.startsWith("/") || record.root.includes("\0")) {
+        throw new TypeError("adapter.options.root must be an absolute host directory");
+      }
+    },
+    create(options) {
+      return create({ root: options.root });
+    }
+  };
+}
+
+// packages/safe-fs/src/config.node.ts
+function createNodeFileSystemAdapterRegistry(extensions) {
+  if (extensions !== void 0 && (extensions === null || typeof extensions.get !== "function" || typeof extensions[Symbol.iterator] !== "function")) {
+    throw new TypeError("registry must be a filesystem adapter map.");
+  }
+  const registry = /* @__PURE__ */ new Map([
+    ["memory", createMemoryFileSystemAdapter(createMemoryFileSystem)],
+    ["real", createRealFileSystemAdapter(createRealFileSystem)]
+  ]);
+  for (const [name, descriptor] of extensions ?? []) {
+    if (registry.has(name)) throw new TypeError(`Filesystem adapter already registered: ${name}`);
+    registry.set(name, descriptor);
+  }
+  return registry;
+}
+
+export {
+  posixPath,
+  basename,
+  dirname,
+  extname,
+  joinPath,
+  isAbsolutePath,
+  RealFileSystem,
+  createRealFileSystem,
+  createS3Transport,
+  S3ServiceError,
+  encodeCopySource,
+  S3RenameError,
+  S3FileSystem,
+  MockS3Client,
+  createS3HttpTransport,
+  createNodeFsBridge,
+  readConfigRecord,
+  validateFileSystemConfig,
+  createFileSystem,
+  createNodeFileSystemAdapterRegistry
+};
+//# sourceMappingURL=chunk-7M2SJPSZ.js.map