better-dsh 0.2.5 → 0.3.0-c

package/lib/{web-trust-BO66y72w.js → web-trust-D6gJpUMf.js}

@@ -1,5 +1,5 @@
+import { t as Schema } from "./lib-C8_jXvwA.js";
 import { Context } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
 
 //#region src/mobile/zoom-guard.ts
 /**
@@ -245,6 +245,30 @@ function buildZoomGuardSection() {
 	].join("");
 }
 
+//#endregion
+//#region src/connection-trust.ts
+/**
+* Use the native index authenticator as a cookie-only admission delegate.
+* A fixed, query-free index path prevents token exchange or redirects here;
+* original Host and Cookie headers preserve the native authority binding and
+* lifetime. No upstream private fields or cookie-format copies are needed.
+*/
+function installAuthenticationOnlyAdmission(connection) {
+	const original = connection.requestRejection;
+	const response = {
+		writeHead() {},
+		end() {}
+	};
+	connection.requestRejection = (request) => connection.authorizeIndex({
+		headers: request.headers,
+		method: "GET",
+		url: "/index.html"
+	}, response) ? void 0 : 401;
+	return () => {
+		connection.requestRejection = original;
+	};
+}
+
 //#endregion
 //#region src/web-trust.ts
 /**
@@ -284,10 +308,12 @@ function frame(body) {
 * inert-when-empty).
 *
 * @param trustedPageAuthorities - the operator-declared hostnames.
-* @returns the script text, or `undefined` when the list is empty (inject
-*   nothing — the feature is fully inert).
+* @param trustAllHosts - delegate admission to native authentication without an address fence.
+* @returns the script text, or `undefined` when declared-authorities mode
+*   has an empty list (no page injection).
 */
-function buildTrustScript(trustedPageAuthorities) {
+function buildTrustScript(trustedPageAuthorities, trustAllHosts = false) {
+	if (trustAllHosts) return frame(["if(!window.__DSH_TRANSPORT__)window.__DSH_TRANSPORT__={ownsHost:true};"]);
 	const authorities = [...trustedPageAuthorities ?? []];
 	if (authorities.length === 0) return void 0;
 	for (const entry of authorities) assertBareHostname(entry);
@@ -323,7 +349,10 @@ function buildMobileScript(mobile) {
 	return frame(body);
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-const Config = z.object({ trustedPageAuthorities: z.array(String).default(deriveDefaultPageAuthorities(process.env.DSH_TRUSTED_HOSTS)) });
+const Config = Schema.object({
+	trustAllHosts: Schema.boolean().default(false),
+	trustedPageAuthorities: Schema.array(String).default(deriveDefaultPageAuthorities(process.env.DSH_TRUSTED_HOSTS))
+});
 /** Cordis plugin name. */
 const name = "dashr-web-trust";
 /**
@@ -332,17 +361,20 @@ const name = "dashr-web-trust";
 */
 const inject = [];
 /**
-* Mount the authorities-leg injection: one `webserver/index-inject` listener
-* pushing the rendered row.
+* Mount page capabilities and, when enabled, an authentication-only admission
+* delegate. Both registrations are owned by this plugin fiber.
 * @param ctx - host plugin context.
 * @param config - the row config.
 */
 function apply(ctx, config) {
 	const authorities = config?.trustedPageAuthorities;
+	if (config?.trustAllHosts) ctx.inject(["connection"], (owner) => {
+		owner.effect(() => installAuthenticationOnlyAdmission(owner.connection), "dashr-web-trust: authentication-only admission");
+	});
 	ctx.inject(["webServer"], () => {
 		ctx.on("webserver/index-inject", (table) => {
-			const text = buildTrustScript(authorities);
-			if (text !== void 0) table.push({
+			const text = buildTrustScript(authorities, config?.trustAllHosts);
+			if (text !== void 0) table.unshift({
 				kind: "script",
 				placement: "head",
 				text

package/lib/{web-trust-BihHCelF.d.ts → web-trust-Dej_RI2B.d.ts}

@@ -1,5 +1,5 @@
+import { t as Schema } from "./index-DTDXUe6m.js";
 import { Context } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
 
 //#region src/web-trust.d.ts
 
@@ -50,10 +50,11 @@ interface BootScriptRow {
  * inert-when-empty).
  *
  * @param trustedPageAuthorities - the operator-declared hostnames.
- * @returns the script text, or `undefined` when the list is empty (inject
- *   nothing — the feature is fully inert).
+ * @param trustAllHosts - delegate admission to native authentication without an address fence.
+ * @returns the script text, or `undefined` when declared-authorities mode
+ *   has an empty list (no page injection).
  */
-declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined): string | undefined;
+declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined, trustAllHosts?: boolean): string | undefined;
 /**
  * Build the mobile-leg script. Pure: same config in, same script out — the
  * unit tests pin the shape (mobile global, tuned thresholds, zoomGuard
@@ -69,14 +70,18 @@ declare function buildMobileScript(mobile: MobileConfig | undefined): string | u
  * the mobile knobs are the `dashr-mobile` row's own config.
  */
 interface TrustConfig {
+  /** Accept every serving address after native cookie authentication, including in the browser UI. */
+  trustAllHosts?: boolean;
   /** Hostnames this operator declares their own devices' pages run on. */
   trustedPageAuthorities?: readonly string[];
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-declare const Config: z<Schemastery.ObjectS<NoInfer<{
-  trustedPageAuthorities: z<string[], string[], "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  trustedPageAuthorities: z<string[], string[], "defined">;
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, "plain">;
 /** Cordis plugin name. */
 declare const name = "dashr-web-trust";
@@ -86,8 +91,8 @@ declare const name = "dashr-web-trust";
  */
 declare const inject: string[];
 /**
- * Mount the authorities-leg injection: one `webserver/index-inject` listener
- * pushing the rendered row.
+ * Mount page capabilities and, when enabled, an authentication-only admission
+ * delegate. Both registrations are owned by this plugin fiber.
  * @param ctx - host plugin context.
  * @param config - the row config.
  */
@@ -95,10 +100,12 @@ declare function apply(ctx: Context, config: TrustConfig | undefined): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: z<Schemastery.ObjectS<NoInfer<{
-    trustedPageAuthorities: z<string[], string[], "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    trustedPageAuthorities: z<string[], string[], "defined">;
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-trust.d.ts

@@ -1,2 +1,3 @@
-import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-BihHCelF.js";
+import "./index-DTDXUe6m.js";
+import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-Dej_RI2B.js";
 export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust.js

@@ -1,3 +1,4 @@
-import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-BO66y72w.js";
+import "./lib-C8_jXvwA.js";
+import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-D6gJpUMf.js";
 
 export { Config, apply, buildMobileScript, buildTrustScript, web_trust_default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/webserver.d.ts

@@ -0,0 +1,10 @@
+import { Service } from "@deepseek-ai/cordis";
+import { WebServer } from "@deepseek-ai/dsh-host-webserver";
+
+//#region src/webserver.d.ts
+declare class BetterWebServer extends WebServer {
+  static inject: string[];
+  [Service.init](): Promise<void>;
+}
+//#endregion
+export { BetterWebServer as default };

package/lib/webserver.js

@@ -0,0 +1,19 @@
+import { Service } from "@deepseek-ai/cordis";
+import { WebServer } from "@deepseek-ai/dsh-host-webserver";
+
+//#region src/webserver.ts
+var BetterWebServer = class extends WebServer {
+	static inject = ["loader"];
+	async [Service.init]() {
+		const welcome = [...this.ctx.loader.entries()].find((entry) => entry.options.id === "dashr-welcome-notice");
+		if (welcome !== void 0 && !welcome.disabled) {
+			if (welcome.fiber === void 0) await welcome.init();
+			await welcome.fiber?.await();
+		}
+		this.ctx.fiber.assertActive();
+		await super[Service.init]();
+	}
+};
+
+//#endregion
+export { BetterWebServer as default };

package/lib/welcome-notice.d.ts

@@ -0,0 +1,18 @@
+import { Context } from "@deepseek-ai/cordis";
+
+//#region src/welcome-notice.d.ts
+declare const name = "dashr-welcome-notice";
+declare const inject: string[];
+/** The private upstream constant has no Host export; reject changed layouts rather than guess. */
+declare function parseWelcomeVersion(client: string): string;
+/** Resolve from the owning DSH installation, never from this plugin's build dependencies. */
+declare function readHostWelcomeVersion(installAnchor: string): string;
+/** Keep the original settings namespace and native UI; project policy before startup settles. */
+declare function apply(ctx: Context): Promise<(() => Promise<void>) | undefined>;
+declare const _default: {
+  name: string;
+  inject: string[];
+  apply: typeof apply;
+};
+//#endregion
+export { apply, _default as default, inject, name, parseWelcomeVersion, readHostWelcomeVersion };

package/lib/welcome-notice.js

@@ -0,0 +1,59 @@
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+
+//#region src/welcome-notice.ts
+const name = "dashr-welcome-notice";
+const inject = ["loader", "profileContext"];
+const NAMESPACE = "ui-settings-general";
+const FIELD = "welcomeNoticeVersion";
+/** The private upstream constant has no Host export; reject changed layouts rather than guess. */
+function parseWelcomeVersion(client) {
+	const values = [...client.matchAll(/\b(?:const|let|var)\s+WELCOME_NOTICE_VERSION\s*=\s*(['"])([^'"\\\r\n]+)\1\s*[;,]/g)];
+	if (values.length !== 1) throw new Error("dashr-welcome-notice: expected one WELCOME_NOTICE_VERSION in the installed Models client; check the upstream bundle layout or disable this entry");
+	return values[0][2];
+}
+/** Resolve from the owning DSH installation, never from this plugin's build dependencies. */
+function readHostWelcomeVersion(installAnchor) {
+	return parseWelcomeVersion(readFileSync(createRequire(createRequire(installAnchor).resolve("@deepseek-ai/dsh-web-app/package.json")).resolve("@deepseek-ai/dsh-client-ui-settings-models/client"), "utf8"));
+}
+/** Keep the original settings namespace and native UI; project policy before startup settles. */
+async function apply(ctx) {
+	const entry = [...ctx.loader.entries()].find((entry$1) => entry$1.options.id === NAMESPACE);
+	if (entry === void 0 || entry.disabled) return;
+	const version = readHostWelcomeVersion(ctx.profileContext.installAnchor);
+	const original = { ...entry.options.config ?? {} };
+	const unhook = ctx.on("internal/config", function(_raw, next) {
+		const config = next();
+		return this.entry?.options.id === NAMESPACE ? {
+			...config,
+			[FIELD]: version
+		} : config;
+	}, { global: true });
+	try {
+		if (entry.fiber === void 0) await entry.init();
+		await entry.fiber?.await();
+		await entry.update({ config: {
+			...original,
+			[FIELD]: version
+		} });
+	} catch (error) {
+		unhook();
+		throw error;
+	}
+	return async () => {
+		unhook();
+		if (entry.fiber === void 0 || entry.disabled) return;
+		const config = { ...entry.options.config ?? {} };
+		if (Object.hasOwn(original, FIELD)) config[FIELD] = original[FIELD];
+		else delete config[FIELD];
+		await entry.update({ config });
+	};
+}
+var welcome_notice_default = {
+	name,
+	inject,
+	apply
+};
+
+//#endregion
+export { apply, welcome_notice_default as default, inject, name, parseWelcomeVersion, readHostWelcomeVersion };

package/lib/{wrap-Bzdimp4p.js → wrap-T4I0nfPM.js}

@@ -1,6 +1,6 @@
-import { promises, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { promises, statSync } from "node:fs";
 
 //#region src/url-schemes/catalog.ts
 /**
@@ -124,11 +124,11 @@ function parseUrl(raw) {
 	};
 	const isQuery = hasQuestion && (!hasColon || question < colon);
 	const marker = isQuery ? question : colon;
-	const path = rest.slice(0, marker);
+	const path$1 = rest.slice(0, marker);
 	const selPart = rest.slice(marker + 1);
 	return {
 		scheme,
-		path,
+		path: path$1,
 		selector: isQuery ? {
 			kind: "query",
 			q: selPart.startsWith("q=") ? selPart.slice(2) : selPart
@@ -219,9 +219,9 @@ function tryParseJson(text) {
 	}
 }
 /** Walk a dot-path through a parsed JSON value (numeric segments index arrays). */
-function navigate(node, path) {
+function navigate(node, path$1) {
 	let current = node;
-	for (const segment of path.split(".")) {
+	for (const segment of path$1.split(".")) {
 		if (segment === "") return void 0;
 		if (Array.isArray(current)) {
 			const idx = Number(segment);
@@ -385,11 +385,11 @@ function createDshHandler(deps) {
 	* of materializing the listing text. `config` is content-backed (resolved
 	* settings JSON) — never path-backed.
 	*/
-	async function resolvePathDisk(path) {
-		if (path !== "docs" && !path.startsWith("docs/")) return void 0;
+	async function resolvePathDisk(path$1) {
+		if (path$1 !== "docs" && !path$1.startsWith("docs/")) return void 0;
 		const dir = await findDocsDir();
 		if (dir === void 0) return void 0;
-		const abs = path === "docs" ? dir : join(dir, path.slice(5));
+		const abs = path$1 === "docs" ? dir : join(dir, path$1.slice(5));
 		try {
 			await promises.stat(abs);
 			return abs;
@@ -398,11 +398,11 @@ function createDshHandler(deps) {
 		}
 	}
 	return {
-		async resolvePath(_env, path) {
-			return resolvePathDisk(path);
+		async resolvePath(_env, path$1) {
+			return resolvePathDisk(path$1);
 		},
-		async resolve(_env, path) {
-			const [root, ...rest] = path.split("/");
+		async resolve(_env, path$1) {
+			const [root, ...rest] = path$1.split("/");
 			const restPath = rest.join("/");
 			if (root === "docs") {
 				const dir = await findDocsDir();
@@ -445,15 +445,15 @@ function listDvcDevices() {
 * (the write tool's contract) or the full URL.
 */
 /** Subpath after the device name (`status`, `diagnostics?file=…`), or undefined. */
-function subpathOf(path) {
-	const trimmed = (path.startsWith("dvc://") ? path.slice(6) : path).replace(/^\/+/, "");
+function subpathOf(path$1) {
+	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
 	const slash = trimmed.indexOf("/");
 	if (slash === -1) return void 0;
 	const sub = trimmed.slice(slash + 1);
 	return sub === "" ? void 0 : sub;
 }
-function deviceNameFromPath(path) {
-	const trimmed = (path.startsWith("dvc://") ? path.slice(6) : path).replace(/^\/+/, "");
+function deviceNameFromPath(path$1) {
+	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
 	const slash = trimmed.indexOf("/");
 	return slash === -1 ? trimmed : trimmed.slice(0, slash);
 }
@@ -470,15 +470,15 @@ function messageOf(error) {
 function createDvcHandler(_deps = {}) {
 	return {
 		selectorAware: true,
-		async resolve(_env, path, selector) {
-			const name = deviceNameFromPath(path);
+		async resolve(_env, path$1, selector) {
+			const name = deviceNameFromPath(path$1);
 			if (name === "") {
 				if (devices.size === 0) return "no devices mounted";
 				return applySelector([...devices].map(([n, device$1]) => `${n}\t${device$1.summary}`).join("\n"), selector ?? null);
 			}
 			const device = devices.get(name);
 			if (device === void 0) return `unknown device: ${name}`;
-			const subpath = subpathOf(path);
+			const subpath = subpathOf(path$1);
 			if (subpath !== void 0 && device.read !== void 0) {
 				const query = selector?.kind === "query" ? `?${selector.q}` : "";
 				let text;
@@ -504,9 +504,9 @@ function createDvcHandler(_deps = {}) {
 * contract — while a device-reported failure rejects the returned promise as
 * `DVC_DEVICE_ERROR` carrying the device name.
 */
-function dispatchDvcWrite(path, content, session) {
+function dispatchDvcWrite(path$1, content, session, cwd) {
 	if (devices.size === 0) throw new UrlSchemesError("DVC_NO_DEVICE", "dvc:// write dispatch: no devices mounted to route the write to");
-	const name = deviceNameFromPath(path);
+	const name = deviceNameFromPath(path$1);
 	const device = devices.get(name);
 	if (device === void 0) throw new UrlSchemesError("DVC_UNKNOWN_DEVICE", `dvc:// write dispatch: no device named "${name}" (registered: ${[...devices.keys()].sort().join(", ")})`);
 	let args;
@@ -516,7 +516,10 @@ function dispatchDvcWrite(path, content, session) {
 		throw new UrlSchemesError("DVC_BAD_ARGS", `dvc:// write dispatch: device "${name}" requires a JSON args payload (${messageOf(error)})`);
 	}
 	if (session !== void 0 && args !== null && typeof args === "object" && !Array.isArray(args)) args = { ...args };
-	return Promise.resolve().then(() => device.execute(args, { session })).catch((error) => {
+	return Promise.resolve().then(() => device.execute(args, {
+		session,
+		...cwd === void 0 ? {} : { cwd }
+	})).catch((error) => {
 		throw new UrlSchemesError("DVC_DEVICE_ERROR", `dvc:// device "${name}" execute failed: ${messageOf(error)}`);
 	});
 }
@@ -627,8 +630,8 @@ async function getUrl(url) {
 * share.
 */
 function createHttpHandler() {
-	return { async resolve(env, path) {
-		const raw = env.rawUrl ?? `https://${path}`;
+	return { async resolve(env, path$1) {
+		const raw = env.rawUrl ?? `https://${path$1}`;
 		let url;
 		try {
 			url = new URL(raw);
@@ -660,11 +663,11 @@ function resolveDocsDir() {
 //#endregion
 //#region src/fs-aware/wrap.ts
 const WRAPPED = Symbol("dsh-url-schemes.fs-wrap");
-function isSchemePath(path) {
-	return typeof path === "string" && /^[a-z][a-z0-9]*:\/\//.test(path);
+function isSchemePath(path$1) {
+	return typeof path$1 === "string" && /^[a-z][a-z0-9]*:\/\//.test(path$1);
 }
-function isSessionLayerScheme(path) {
-	return path.startsWith("ctx://") || path.startsWith("agent://") || path.startsWith("skill://");
+function isSessionLayerScheme(path$1) {
+	return path$1.startsWith("ctx://") || path$1.startsWith("agent://") || path$1.startsWith("skill://");
 }
 function sessionLayerError(url) {
 	if (url.startsWith("skill://")) return new UrlSchemesError("CTX_SESSION_LAYER", `${url}: session-layer scheme — skill discovery (which roots load, scan depth, layered scope merge) is the host skill provider's business logic and resolves only against a calling agent, which the filesystem layer does not have. Load skills with the native \`skill\` tool; grep/glob with path=skill://… keep working through the tool layer`);
@@ -679,11 +682,11 @@ function buildFsLayerResolver(services, fsSelf) {
 	}));
 	resolver.register("dvc", createDvcHandler());
 	for (const scheme of HTTP_SCHEMES) resolver.register(scheme, createHttpHandler());
-	resolver.register("ctx", { async resolve(_env, path) {
-		throw sessionLayerError(`ctx://${path}`);
+	resolver.register("ctx", { async resolve(_env, path$1) {
+		throw sessionLayerError(`ctx://${path$1}`);
 	} });
-	resolver.register("agent", { async resolve(_env, path) {
-		throw sessionLayerError(`agent://${path}`);
+	resolver.register("agent", { async resolve(_env, path$1) {
+		throw sessionLayerError(`agent://${path$1}`);
 	} });
 	return resolver;
 }
@@ -691,34 +694,34 @@ function buildFsLayerResolver(services, fsSelf) {
 * Wrap the mounted `ctx.fs` instance in place. Idempotent via a symbol flag.
 * Returns the resolver used for scheme dereferencing (for diagnostics).
 */
-function wrapFsWithSchemes(fs, services) {
-	const holder = fs;
+function wrapFsWithSchemes(fs$1, services) {
+	const holder = fs$1;
 	if (holder[WRAPPED] !== void 0) return holder[WRAPPED];
-	const resolver = buildFsLayerResolver(services, fs);
+	const resolver = buildFsLayerResolver(services, fs$1);
 	const envFor = (url) => ({
-		fs,
+		fs: fs$1,
 		rawUrl: url
 	});
-	const bind = (fn) => typeof fn === "function" ? fn.bind(fs) : void 0;
-	const origResolve = bind(fs.resolve);
-	const origStat = bind(fs.stat);
-	const origReadText = bind(fs.readText);
-	const origWriteText = bind(fs.writeText);
-	const origEditText = bind(fs.editText);
+	const bind = (fn) => typeof fn === "function" ? fn.bind(fs$1) : void 0;
+	const origResolve = bind(fs$1.resolve);
+	const origStat = bind(fs$1.stat);
+	const origReadText = bind(fs$1.readText);
+	const origWriteText = bind(fs$1.writeText);
+	const origEditText = bind(fs$1.editText);
 	const requireOrig = (orig, method) => {
 		if (orig === void 0) throw new UrlSchemesError("FS_BASE_UNSUPPORTED", `the mounted filesystem service exposes no "${method}" — scheme wrap is active but the base backend cannot serve real paths`);
 		return orig;
 	};
-	fs.resolve = async (path, opts) => {
-		if (!isSchemePath(path)) return requireOrig(origResolve, "resolve")(path, opts);
-		if (isSessionLayerScheme(path)) throw sessionLayerError(path);
-		await resolver.resolve(envFor(path), path);
+	fs$1.resolve = async (path$1, opts) => {
+		if (!isSchemePath(path$1)) return requireOrig(origResolve, "resolve")(path$1, opts);
+		if (isSessionLayerScheme(path$1)) throw sessionLayerError(path$1);
+		await resolver.resolve(envFor(path$1), path$1);
 		return {
-			targetKey: path,
-			displayPath: path
+			targetKey: path$1,
+			displayPath: path$1
 		};
 	};
-	fs.stat = async (target, signal) => {
+	fs$1.stat = async (target, signal) => {
 		if (!isSchemePath(target.targetKey)) return requireOrig(origStat, "stat")(target, signal);
 		if (isSessionLayerScheme(target.targetKey)) throw sessionLayerError(target.targetKey);
 		return {
@@ -726,16 +729,16 @@ function wrapFsWithSchemes(fs, services) {
 			size: (await resolver.resolve(envFor(target.targetKey), target.targetKey)).length
 		};
 	};
-	fs.readText = async (target, signal) => {
+	fs$1.readText = async (target, signal) => {
 		if (!isSchemePath(target.targetKey)) return requireOrig(origReadText, "readText")(target, signal);
 		if (isSessionLayerScheme(target.targetKey)) throw sessionLayerError(target.targetKey);
 		return resolver.resolve(envFor(target.targetKey), target.targetKey);
 	};
-	fs.writeText = async (target, ...rest) => {
+	fs$1.writeText = async (target, ...rest) => {
 		if (isSchemePath(target.targetKey)) throw new UrlSchemesError("FS_VIRTUAL_READONLY", `cannot write "${target.targetKey}": scheme resources are read-only at the filesystem layer`);
 		return requireOrig(origWriteText, "writeText")(target, ...rest);
 	};
-	fs.editText = async (target, ...rest) => {
+	fs$1.editText = async (target, ...rest) => {
 		if (isSchemePath(target.targetKey)) throw new UrlSchemesError("FS_VIRTUAL_READONLY", `cannot edit "${target.targetKey}": scheme resources are read-only at the filesystem layer`);
 		return requireOrig(origEditText, "editText")(target, ...rest);
 	};