blockpatch 1.0.0 → 1.1.0

package/dist/cli.js

@@ -20,6 +20,12 @@ class BlockPatchError extends Error {
 function fail(code, message, details) {
   throw new BlockPatchError(code, message, details);
 }
+function matchedLocations(count, truncated) {
+  return `matched ${truncated ? "at least " : ""}${count} locations`;
+}
+function matchCountDetails(count, truncated) {
+  return truncated ? { matches: count, matches_truncated: true } : { matches: count };
+}
 function boundedMatchRanges(matches, byteLength) {
   const ranges = [];
   for (const start of matches) {
@@ -79,10 +85,11 @@ function clamp(value, min, max) {
 // src/engine.ts
 import { Buffer as Buffer3 } from "node:buffer";
 import { randomBytes } from "node:crypto";
-import { chmod, mkdir, rename, stat as stat2, unlink, writeFile } from "node:fs/promises";
-import { basename, dirname, join as join2, resolve as resolve2 } from "node:path";
+import { chmod, lstat, mkdir, rename, rmdir, stat as stat2, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
 
 // src/files.ts
+import { createHash } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 async function readFileChecked(path, label) {
@@ -92,6 +99,22 @@ async function readFileChecked(path, label) {
     failFileSystem(error, path, `Could not read ${label}`);
   }
 }
+async function readFileSnapshot(path, label) {
+  const bytes = await readFileChecked(path, label);
+  const info = await statChecked(path, label);
+  assertRegularFile(info, path, label);
+  return fileSnapshot(bytes, info);
+}
+function fileSnapshot(bytes, info) {
+  return {
+    bytes,
+    sha256: hashBytes(bytes),
+    stat: statSnapshot(info)
+  };
+}
+function hashBytes(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
 async function statChecked(path, label) {
   try {
     return await stat(path);
@@ -125,6 +148,16 @@ function failFileSystem(error, path, action, phase = "io") {
   const message = error instanceof Error ? `${action}: ${error.message}` : `${action}: ${path}`;
   fail(fileSystemErrorCode(error), message, { path, phase });
 }
+function statSnapshot(info) {
+  return {
+    dev: info.dev,
+    ino: info.ino,
+    mode: info.mode,
+    size: info.size,
+    mtimeMs: info.mtimeMs,
+    ctimeMs: info.ctimeMs
+  };
+}
 function fileSystemErrorCode(error) {
   switch (error.code) {
     case "ENOENT":
@@ -142,8 +175,151 @@ function fileSystemErrorCode(error) {
 
 // src/parser.ts
 import { Buffer as Buffer2 } from "node:buffer";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { posix } from "node:path";
+
+// src/paths.ts
+import { lstatSync as lstatSync2 } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
+function validateOperationPath(path, label) {
+  if (path === "") {
+    fail("invalid_path", `Invalid ${label}: ${path}`, { path, phase: "path" });
+  }
+  rejectUnsafeDisplayPath(path, label);
+  rejectAbsolutePath(path, label);
+  rejectBackslashPath(path, label);
+}
+function rejectUnsafeDisplayPath(path, label) {
+  if (/[\x00-\x1f\x7f-\x9f]/u.test(path)) {
+    fail("invalid_path", `${label} contains unsupported control characters`, {
+      path,
+      phase: "path"
+    });
+  }
+}
+function rejectBackslashPath(path, label) {
+  if (path.includes("\\")) {
+    fail("invalid_path", `${label} must use POSIX-style / separators: ${path}`, {
+      path,
+      phase: "path"
+    });
+  }
+}
+function rejectAbsolutePath(path, label) {
+  if (isAbsolute(path) || win32.isAbsolute(path)) {
+    fail("path_outside_cwd", `${label} must be relative to the working directory: ${path}`, {
+      path,
+      phase: "path"
+    });
+  }
+}
+function rejectDotPathSegments(path, label) {
+  if (path.split("/").some((part) => part === "." || part === "..")) {
+    fail("invalid_path", `${label} must not contain . or .. path segments: ${path}`, {
+      path,
+      phase: "path"
+    });
+  }
+}
+function resolvePath(cwd, path, label) {
+  validateOperationPath(path, label);
+  const root = resolve(cwd);
+  const resolved = resolve(root, path);
+  const realRoot = realpathSyncChecked(root, "working directory", root);
+  if (!isInside(root, resolved)) {
+    fail("path_outside_cwd", `${label} escapes the working directory: ${path}`, { path, phase: "path" });
+  }
+  rejectDotPathSegments(path, label);
+  rejectSymlinkComponents(root, resolved, path, label);
+  const info = lstatSyncChecked(resolved, label, path);
+  assertRegularFile(info, path, label, "path");
+  const realResolved = realpathSyncChecked(resolved, label, path);
+  if (!isInside(realRoot, realResolved)) {
+    fail("path_outside_cwd", `${label} resolves outside the working directory: ${path}`, { path, phase: "path" });
+  }
+  return resolved;
+}
+function resolvePathAllowMissing(cwd, path, label) {
+  validateOperationPath(path, label);
+  const root = resolve(cwd);
+  const resolved = resolve(root, path);
+  const realRoot = realpathSyncChecked(root, "working directory", root);
+  if (!isInside(root, resolved)) {
+    fail("path_outside_cwd", `${label} escapes the working directory: ${path}`, { path, phase: "path" });
+  }
+  rejectDotPathSegments(path, label);
+  const deepestExisting = rejectExistingSymlinkComponents(root, resolved, path, label);
+  if (deepestExisting !== resolved) {
+    return { path: resolved, exists: false };
+  }
+  const info = lstatSyncChecked(resolved, label, path);
+  assertRegularFile(info, path, label, "path");
+  const realResolved = realpathSyncChecked(resolved, label, path);
+  if (!isInside(realRoot, realResolved)) {
+    fail("path_outside_cwd", `${label} resolves outside the working directory: ${path}`, { path, phase: "path" });
+  }
+  return { path: resolved, exists: true };
+}
+async function sameFileIdentity(left, right) {
+  if (left === right) {
+    return true;
+  }
+  const [leftInfo, rightInfo] = await Promise.all([
+    statChecked(left, "source path"),
+    statChecked(right, "destination path")
+  ]);
+  return leftInfo.dev === rightInfo.dev && leftInfo.ino === rightInfo.ino;
+}
+function rejectSymlinkComponents(root, resolved, originalPath, label) {
+  const relativePath = relative(root, resolved);
+  if (relativePath === "") {
+    return;
+  }
+  let current = root;
+  for (const part of relativePath.split(sep)) {
+    current = join(current, part);
+    if (lstatSyncChecked(current, label, originalPath).isSymbolicLink()) {
+      fail("symlink_path", `${label} must not contain symbolic links: ${originalPath}`, {
+        path: originalPath,
+        phase: "path"
+      });
+    }
+  }
+}
+function rejectExistingSymlinkComponents(root, resolved, originalPath, label) {
+  const relativePath = relative(root, resolved);
+  if (relativePath === "") {
+    return resolved;
+  }
+  let current = root;
+  for (const part of relativePath.split(sep)) {
+    const next = join(current, part);
+    let info;
+    try {
+      info = lstatSync2(next);
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT" || code === "ENOTDIR") {
+        return current;
+      }
+      failFileSystem(error, originalPath, `Could not stat ${label}`, "path");
+    }
+    if (info.isSymbolicLink()) {
+      fail("symlink_path", `${label} must not contain symbolic links: ${originalPath}`, {
+        path: originalPath,
+        phase: "path"
+      });
+    }
+    current = next;
+  }
+  return current;
+}
+function isInside(root, path) {
+  const fromRoot = relative(root, path);
+  return fromRoot === "" || !fromRoot.startsWith("..") && !isAbsolute(fromRoot);
+}
+
+// src/parser.ts
 var devNull = "/dev/null";
 var noNewlineMarker = "\";
 var movePrefix = "blockpatch move ";
@@ -321,7 +497,7 @@ function buildTargetOnlyBlockPatch(section, targetHunk, options) {
   };
 }
 function verifyPayloadHash(payload, payloadSha256) {
-  const actualHash = createHash("sha256").update(payload).digest("hex");
+  const actualHash = createHash2("sha256").update(payload).digest("hex");
   if (actualHash !== payloadSha256) {
     fail("hash_mismatch", "payload-sha256 does not match moved payload", {
       phase: "payload",
@@ -546,13 +722,17 @@ function parseMetadata(input) {
 }
 function parseFileHeader(line, prefix, requiredPathPrefix) {
   const marker = `${prefix} `;
-  if (line !== undefined && line.slice(marker.length).trim() === devNull && line.startsWith(marker)) {
+  const rawPath = line?.startsWith(marker) === true ? line.slice(marker.length) : undefined;
+  if (rawPath !== undefined) {
+    rejectUnsafeDisplayPath(rawPath, `${prefix} file header path`);
+  }
+  if (rawPath?.trim() === devNull && line?.startsWith(marker)) {
     return devNull;
   }
   if (line?.startsWith(`${marker}${requiredPathPrefix}`) !== true) {
     fail("parse_error", `Patch must include a ${marker}${requiredPathPrefix}<path> or ${marker}${devNull} header`);
   }
-  const path = line.slice(marker.length).trim();
+  const path = rawPath?.trim() ?? "";
   if (!path || path === requiredPathPrefix) {
     fail("parse_error", `${prefix} file header must include a path`);
   }
@@ -589,121 +769,6 @@ function text(line) {
   return line?.body.toString("utf8");
 }
 
-// src/paths.ts
-import { lstatSync as lstatSync2 } from "node:fs";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
-function resolvePath(cwd, path, label) {
-  if (path === "" || path.includes("\x00")) {
-    fail("invalid_path", `Invalid ${label}: ${path}`, { path, phase: "path" });
-  }
-  if (isAbsolute(path)) {
-    fail("path_outside_cwd", `${label} must be relative to the working directory: ${path}`, {
-      path,
-      phase: "path"
-    });
-  }
-  const root = resolve(cwd);
-  const resolved = resolve(root, path);
-  const realRoot = realpathSyncChecked(root, "working directory", root);
-  if (!isInside(root, resolved)) {
-    fail("path_outside_cwd", `${label} escapes the working directory: ${path}`, { path, phase: "path" });
-  }
-  rejectSymlinkComponents(root, resolved, path, label);
-  const info = lstatSyncChecked(resolved, label, path);
-  assertRegularFile(info, path, label, "path");
-  const realResolved = realpathSyncChecked(resolved, label, path);
-  if (!isInside(realRoot, realResolved)) {
-    fail("path_outside_cwd", `${label} resolves outside the working directory: ${path}`, { path, phase: "path" });
-  }
-  return resolved;
-}
-function resolvePathAllowMissing(cwd, path, label) {
-  if (path === "" || path.includes("\x00")) {
-    fail("invalid_path", `Invalid ${label}: ${path}`, { path, phase: "path" });
-  }
-  if (isAbsolute(path)) {
-    fail("path_outside_cwd", `${label} must be relative to the working directory: ${path}`, {
-      path,
-      phase: "path"
-    });
-  }
-  const root = resolve(cwd);
-  const resolved = resolve(root, path);
-  const realRoot = realpathSyncChecked(root, "working directory", root);
-  if (!isInside(root, resolved)) {
-    fail("path_outside_cwd", `${label} escapes the working directory: ${path}`, { path, phase: "path" });
-  }
-  const deepestExisting = rejectExistingSymlinkComponents(root, resolved, path, label);
-  if (deepestExisting !== resolved) {
-    return { path: resolved, exists: false };
-  }
-  const info = lstatSyncChecked(resolved, label, path);
-  assertRegularFile(info, path, label, "path");
-  const realResolved = realpathSyncChecked(resolved, label, path);
-  if (!isInside(realRoot, realResolved)) {
-    fail("path_outside_cwd", `${label} resolves outside the working directory: ${path}`, { path, phase: "path" });
-  }
-  return { path: resolved, exists: true };
-}
-async function sameFileIdentity(left, right) {
-  if (left === right) {
-    return true;
-  }
-  const [leftInfo, rightInfo] = await Promise.all([
-    statChecked(left, "source path"),
-    statChecked(right, "destination path")
-  ]);
-  return leftInfo.dev === rightInfo.dev && leftInfo.ino === rightInfo.ino;
-}
-function rejectSymlinkComponents(root, resolved, originalPath, label) {
-  const relativePath = relative(root, resolved);
-  if (relativePath === "") {
-    return;
-  }
-  let current = root;
-  for (const part of relativePath.split(sep)) {
-    current = join(current, part);
-    if (lstatSyncChecked(current, label, originalPath).isSymbolicLink()) {
-      fail("symlink_path", `${label} must not contain symbolic links: ${originalPath}`, {
-        path: originalPath,
-        phase: "path"
-      });
-    }
-  }
-}
-function rejectExistingSymlinkComponents(root, resolved, originalPath, label) {
-  const relativePath = relative(root, resolved);
-  if (relativePath === "") {
-    return resolved;
-  }
-  let current = root;
-  for (const part of relativePath.split(sep)) {
-    const next = join(current, part);
-    let info;
-    try {
-      info = lstatSync2(next);
-    } catch (error) {
-      const code = error.code;
-      if (code === "ENOENT" || code === "ENOTDIR") {
-        return current;
-      }
-      failFileSystem(error, originalPath, `Could not stat ${label}`, "path");
-    }
-    if (info.isSymbolicLink()) {
-      fail("symlink_path", `${label} must not contain symbolic links: ${originalPath}`, {
-        path: originalPath,
-        phase: "path"
-      });
-    }
-    current = next;
-  }
-  return current;
-}
-function isInside(root, path) {
-  const fromRoot = relative(root, path);
-  return fromRoot === "" || !fromRoot.startsWith("..") && !isAbsolute(fromRoot);
-}
-
 // src/engine.ts
 async function checkPatchFile(patchPath, options = {}) {
   return runPatchFile(patchPath, { ...options, dryRun: true });
@@ -713,7 +778,8 @@ async function checkPatchBytes(patchBytes, options = {}) {
 }
 function checkPatchBytesInMemory(patchBytes, files, options = {}) {
   const patch = parseBlockPatch(patchBytes, { stripComponents: options.stripComponents });
-  return checkMovePatchInMemory(patch, memoryFileMap(files), options.reverse ?? false);
+  const effectivePatch = options.reverse === true ? reverseMovePatch(patch) : patch;
+  return planMovePatch(effectivePatch, memoryFileMap(files)).result;
 }
 async function applyPatchFile(patchPath, options = {}) {
   return runPatchFile(patchPath, options);
@@ -733,119 +799,179 @@ async function runPatchBytes(patchBytes, options) {
 }
 async function applyMovePatch(patch, cwd, dryRun, reverse) {
   const effectivePatch = reverse ? reverseMovePatch(patch) : patch;
-  if (effectivePatch.src === null || effectivePatch.dst === null) {
-    if (effectivePatch.src === null && effectivePatch.dst !== null && !effectivePatch.hasSourceHunk) {
-      return applyPathCreationMove(effectivePatch, effectivePatch.dst, cwd, dryRun);
-    }
-    if (effectivePatch.dst === null && effectivePatch.src !== null && effectivePatch.hasSourceHunk) {
-      return applyPathDeletionMove(effectivePatch, effectivePatch.src, cwd, dryRun);
+  const workspace = await readPatchWorkspace(effectivePatch, cwd);
+  const plan = planMovePatch(effectivePatch, workspace.files);
+  if (!dryRun) {
+    await commitPatchMutations(plan.mutations, workspace.paths);
+  }
+  return resultWithWriteFlag(plan.result, dryRun);
+}
+async function readPatchWorkspace(patch, cwd) {
+  const workspace = {
+    files: new Map,
+    paths: new Map
+  };
+  if (patch.src === null || patch.dst === null) {
+    if (patch.src === null && patch.dst !== null && !patch.hasSourceHunk) {
+      const resolved = resolvePathAllowMissing(cwd, patch.dst, "destination path");
+      if (resolved.exists) {
+        rememberFile(workspace, patch.dst, resolved.path, await readFileSnapshot(resolved.path, "destination file"));
+      } else {
+        rememberMissingPath(workspace, patch.dst, resolved.path);
+      }
+      return workspace;
+    }
+    if (patch.dst === null && patch.src !== null && patch.hasSourceHunk) {
+      const resolved = resolvePathAllowMissing(cwd, patch.src, "source path");
+      if (resolved.exists) {
+        rememberFile(workspace, patch.src, resolved.path, await readFileSnapshot(resolved.path, "source file"));
+      } else {
+        rememberMissingPath(workspace, patch.src, resolved.path);
+      }
+      return workspace;
     }
     fail("parse_error", "Invalid /dev/null endpoint move shape");
   }
-  if (!effectivePatch.hasSourceHunk) {
-    return applyInFileInsertionMove(effectivePatch, effectivePatch.src, effectivePatch.dst, cwd, dryRun);
+  if (!patch.hasSourceHunk) {
+    const dstPath2 = resolvePath(cwd, patch.dst, "destination path");
+    rememberFile(workspace, patch.dst, dstPath2, await readFileSnapshot(dstPath2, "destination file"));
+    return workspace;
   }
-  if (effectivePatch.target === null) {
-    return applyInFileDeletionMove(effectivePatch, effectivePatch.src, effectivePatch.dst, cwd, dryRun);
+  if (patch.target === null) {
+    const srcPath2 = resolvePath(cwd, patch.src, "source path");
+    rememberFile(workspace, patch.src, srcPath2, await readFileSnapshot(srcPath2, "source file"));
+    return workspace;
   }
-  const srcLabel = effectivePatch.src;
-  const dstLabel = effectivePatch.dst;
-  const srcPath = resolvePath(cwd, srcLabel, "source path");
-  const dstPath = resolvePath(cwd, dstLabel, "destination path");
+  const srcPath = resolvePath(cwd, patch.src, "source path");
+  const dstPath = resolvePath(cwd, patch.dst, "destination path");
   const sameFile = await sameFileIdentity(srcPath, dstPath);
-  const srcOriginal = await readFileChecked(srcPath, "source file");
-  const dstOriginal = sameFile ? srcOriginal : await readFileChecked(dstPath, "destination file");
-  const plan = selectMovePlan(srcOriginal, dstOriginal, effectivePatch, sameFile);
-  if (plan.status === "already_applied") {
-    return {
-      changed: [],
-      affected: unique([srcLabel, dstLabel]),
-      written: false,
-      noop: true,
-      status: "already_applied",
-      moves: [plan.details]
-    };
+  const srcSnapshot = await readFileSnapshot(srcPath, "source file");
+  const dstSnapshot = sameFile ? srcSnapshot : await readFileSnapshot(dstPath, "destination file");
+  const identity = sameFile ? "paired-file" : undefined;
+  rememberFile(workspace, patch.src, srcPath, srcSnapshot, identity);
+  rememberFile(workspace, patch.dst, dstPath, dstSnapshot, identity);
+  return workspace;
+}
+function rememberMissingPath(workspace, label, path) {
+  workspace.paths.set(label, { path, missing: true });
+}
+function rememberFile(workspace, label, path, snapshot, identity = path) {
+  workspace.paths.set(label, { path, snapshot });
+  workspace.files.set(label, { bytes: snapshot.bytes, identity });
+}
+async function commitPatchMutations(mutations, paths) {
+  const writes = [];
+  const deletes = [];
+  for (const mutation of mutations) {
+    const pathState = mutationPath(paths, mutation.label);
+    if (mutation.kind === "write") {
+      writes.push({
+        path: pathState.path,
+        bytes: mutation.bytes,
+        create: mutation.create,
+        label: mutation.label,
+        expected: writeExpectation(mutation, pathState)
+      });
+    } else {
+      deletes.push({
+        path: pathState.path,
+        label: mutation.label,
+        expected: fileExpectation(mutation.label, pathState)
+      });
+    }
   }
-  const selection = plan.selection;
-  const changed = await commitMove({
-    srcPath,
-    dstPath,
-    sameFile,
-    dryRun,
-    srcOriginal,
-    dstOriginal,
-    selection,
-    srcLabel,
-    dstLabel
-  });
+  await writeAtomically(writes, deletes);
+}
+function writeExpectation(mutation, state) {
+  if (state.snapshot !== undefined) {
+    return { kind: "file", label: mutation.label, snapshot: state.snapshot };
+  }
+  if (state.missing === true && mutation.create === true) {
+    return { kind: "missing", label: mutation.label, bytesIfExists: mutation.bytes };
+  }
+  fail("parse_error", `No original state for planned write: ${mutation.label}`, { path: mutation.label, phase: "path" });
+}
+function fileExpectation(label, state) {
+  if (state.snapshot !== undefined) {
+    return { kind: "file", label, snapshot: state.snapshot };
+  }
+  fail("parse_error", `No original file state for planned mutation: ${label}`, { path: label, phase: "path" });
+}
+function mutationPath(paths, label) {
+  const state = paths.get(label);
+  if (state === undefined) {
+    fail("parse_error", `No resolved path for planned mutation: ${label}`, { path: label, phase: "path" });
+  }
+  return state;
+}
+function resultWithWriteFlag(result, dryRun) {
   return {
-    changed,
-    affected: unique([srcLabel, dstLabel]),
-    written: !dryRun && changed.length > 0,
-    noop: changed.length === 0,
-    status: changed.length === 0 ? "noop" : "applied",
-    moves: [
-      moveResultDetails({
-        id: effectivePatch.id,
-        src: srcLabel,
-        dst: dstLabel,
-        payloadSha256: effectivePatch.payloadSha256,
-        selection
-      })
-    ]
+    ...result,
+    written: result.status === "applied" && !dryRun && result.changed.length > 0
   };
 }
-function checkMovePatchInMemory(patch, files, reverse) {
-  const effectivePatch = reverse ? reverseMovePatch(patch) : patch;
+function planMovePatch(effectivePatch, files) {
   if (effectivePatch.src === null || effectivePatch.dst === null) {
     if (effectivePatch.src === null && effectivePatch.dst !== null && !effectivePatch.hasSourceHunk) {
-      return checkPathCreationMoveInMemory(effectivePatch, effectivePatch.dst, files);
+      return planPathCreationMove(effectivePatch, effectivePatch.dst, files);
     }
     if (effectivePatch.dst === null && effectivePatch.src !== null && effectivePatch.hasSourceHunk) {
-      return checkPathDeletionMoveInMemory(effectivePatch, effectivePatch.src, files);
+      return planPathDeletionMove(effectivePatch, effectivePatch.src, files);
     }
     fail("parse_error", "Invalid /dev/null endpoint move shape");
   }
   if (!effectivePatch.hasSourceHunk) {
-    return checkInFileInsertionMoveInMemory(effectivePatch, effectivePatch.src, effectivePatch.dst, files);
+    return planInFileInsertionMove(effectivePatch, effectivePatch.src, effectivePatch.dst, files);
   }
   if (effectivePatch.target === null) {
-    return checkInFileDeletionMoveInMemory(effectivePatch, effectivePatch.src, effectivePatch.dst, files);
+    return planInFileDeletionMove(effectivePatch, effectivePatch.src, effectivePatch.dst, files);
+  }
+  return planPairedMove(effectivePatch, files);
+}
+function planPairedMove(patch, files) {
+  if (patch.src === null || patch.dst === null) {
+    fail("parse_error", "Paired move requires source and destination paths");
   }
-  const srcLabel = effectivePatch.src;
-  const dstLabel = effectivePatch.dst;
+  const srcLabel = patch.src;
+  const dstLabel = patch.dst;
   const srcFile = readMemoryFile(files, srcLabel, "source file");
   const sameFile = sameMemoryFile(files, srcLabel, dstLabel);
   const dstFile = sameFile ? srcFile : readMemoryFile(files, dstLabel, "destination file");
-  const plan = selectMovePlan(srcFile, dstFile, effectivePatch, sameFile);
+  const plan = selectMovePlan(srcFile, dstFile, patch, sameFile);
   if (plan.status === "already_applied") {
     return {
-      changed: [],
-      affected: unique([srcLabel, dstLabel]),
-      written: false,
-      noop: true,
-      status: "already_applied",
-      moves: [plan.details]
+      result: {
+        changed: [],
+        affected: unique([srcLabel, dstLabel]),
+        written: false,
+        noop: true,
+        status: "already_applied",
+        moves: [plan.details]
+      },
+      mutations: []
     };
   }
   const selection = plan.selection;
   const next = sameFile ? applyMove(srcFile, selection) : applyCrossFileMove(srcFile, dstFile, selection);
   const changed = changedMoveLabels(srcLabel, dstLabel, sameFile, srcFile, dstFile, next);
   return {
-    changed,
-    affected: unique([srcLabel, dstLabel]),
-    written: false,
-    noop: changed.length === 0,
-    status: changed.length === 0 ? "noop" : "applied",
-    moves: [
-      moveResultDetails({
-        id: effectivePatch.id,
-        src: srcLabel,
-        dst: dstLabel,
-        payloadSha256: effectivePatch.payloadSha256,
-        selection
-      })
-    ]
+    result: {
+      changed,
+      affected: unique([srcLabel, dstLabel]),
+      written: false,
+      noop: changed.length === 0,
+      status: changed.length === 0 ? "noop" : "applied",
+      moves: [
+        moveResultDetails({
+          id: patch.id,
+          src: srcLabel,
+          dst: dstLabel,
+          payloadSha256: patch.payloadSha256,
+          selection
+        })
+      ]
+    },
+    mutations: moveMutations(srcLabel, dstLabel, sameFile, srcFile, dstFile, next)
   };
 }
 function reverseMovePatch(patch) {
@@ -864,64 +990,24 @@ function reverseMovePatch(patch) {
     target: reversedTarget
   };
 }
-async function applyInFileInsertionMove(patch, srcLabel, dstLabel, cwd, dryRun) {
-  const target = requireTarget(patch);
-  const dstPath = resolvePath(cwd, dstLabel, "destination path");
-  const original = await readFileChecked(dstPath, "destination file");
-  const alreadyApplied = findAlreadyAppliedTargetSelection(original, patch, dstLabel);
-  if (alreadyApplied !== undefined) {
-    return oneSidedResult({
-      patch,
-      src: srcLabel,
-      dst: dstLabel,
-      changed: [],
-      dryRun,
-      status: "already_applied",
-      sourceRange: null,
-      targetRange: alreadyApplied.range,
-      insertIndex: alreadyApplied.insertIndex
-    });
-  }
-  const selection = findTargetSelection(original, target.before, target.after, dstLabel, {
-    phase: "target",
-    anchor: "blockpatch-target"
-  });
-  const next = Buffer3.concat([
-    original.subarray(0, selection.insertIndex),
-    patch.sourcePayload,
-    original.subarray(selection.insertIndex)
-  ]);
-  if (!dryRun) {
-    await writeAtomically([{ path: dstPath, bytes: next }]);
-  }
-  return oneSidedResult({
-    patch,
-    src: srcLabel,
-    dst: dstLabel,
-    changed: next.equals(original) ? [] : unique([srcLabel, dstLabel]),
-    dryRun,
-    status: next.equals(original) ? "noop" : "applied",
-    sourceRange: null,
-    targetRange: selection.range,
-    insertIndex: selection.insertIndex
-  });
-}
-function checkInFileInsertionMoveInMemory(patch, srcLabel, dstLabel, files) {
+function planInFileInsertionMove(patch, srcLabel, dstLabel, files) {
   const target = requireTarget(patch);
   const original = readMemoryFile(files, dstLabel, "destination file");
   const alreadyApplied = findAlreadyAppliedTargetSelection(original, patch, dstLabel);
   if (alreadyApplied !== undefined) {
-    return oneSidedResult({
-      patch,
-      src: srcLabel,
-      dst: dstLabel,
-      changed: [],
-      dryRun: true,
-      status: "already_applied",
-      sourceRange: null,
-      targetRange: alreadyApplied.range,
-      insertIndex: alreadyApplied.insertIndex
-    });
+    return {
+      result: oneSidedResult({
+        patch,
+        src: srcLabel,
+        dst: dstLabel,
+        changed: [],
+        status: "already_applied",
+        sourceRange: null,
+        targetRange: alreadyApplied.range,
+        insertIndex: alreadyApplied.insertIndex
+      }),
+      mutations: []
+    };
   }
   const selection = findTargetSelection(original, target.before, target.after, dstLabel, {
     phase: "target",
@@ -932,85 +1018,60 @@ function checkInFileInsertionMoveInMemory(patch, srcLabel, dstLabel, files) {
     patch.sourcePayload,
     original.subarray(selection.insertIndex)
   ]);
-  return oneSidedResult({
-    patch,
-    src: srcLabel,
-    dst: dstLabel,
-    changed: next.equals(original) ? [] : unique([srcLabel, dstLabel]),
-    dryRun: true,
-    status: next.equals(original) ? "noop" : "applied",
-    sourceRange: null,
-    targetRange: selection.range,
-    insertIndex: selection.insertIndex
-  });
-}
-async function applyInFileDeletionMove(patch, srcLabel, dstLabel, cwd, dryRun) {
-  const srcPath = resolvePath(cwd, srcLabel, "source path");
-  const original = await readFileChecked(srcPath, "source file");
-  const source = findDeletionSourceRange(original, patch, srcLabel);
-  if (source === undefined) {
-    return oneSidedResult({
+  const changed = next.equals(original) ? [] : unique([srcLabel, dstLabel]);
+  return {
+    result: oneSidedResult({
       patch,
       src: srcLabel,
       dst: dstLabel,
-      changed: [],
-      dryRun,
-      status: "already_applied",
+      changed,
+      status: changed.length === 0 ? "noop" : "applied",
       sourceRange: null,
-      targetRange: null,
-      insertIndex: null
-    });
-  }
-  const next = Buffer3.concat([original.subarray(0, source.start), original.subarray(source.end)]);
-  if (!dryRun) {
-    await writeAtomically([{ path: srcPath, bytes: next }]);
-  }
-  return oneSidedResult({
-    patch,
-    src: srcLabel,
-    dst: dstLabel,
-    changed: next.equals(original) ? [] : unique([srcLabel, dstLabel]),
-    dryRun,
-    status: next.equals(original) ? "noop" : "applied",
-    sourceRange: source,
-    targetRange: null,
-    insertIndex: null
-  });
+      targetRange: selection.range,
+      insertIndex: selection.insertIndex
+    }),
+    mutations: changed.length === 0 ? [] : [{ kind: "write", label: dstLabel, bytes: next }]
+  };
 }
-function checkInFileDeletionMoveInMemory(patch, srcLabel, dstLabel, files) {
+function planInFileDeletionMove(patch, srcLabel, dstLabel, files) {
   const original = readMemoryFile(files, srcLabel, "source file");
   const source = findDeletionSourceRange(original, patch, srcLabel);
   if (source === undefined) {
-    return oneSidedResult({
+    return {
+      result: oneSidedResult({
+        patch,
+        src: srcLabel,
+        dst: dstLabel,
+        changed: [],
+        status: "already_applied",
+        sourceRange: null,
+        targetRange: null,
+        insertIndex: null
+      }),
+      mutations: []
+    };
+  }
+  const next = Buffer3.concat([original.subarray(0, source.start), original.subarray(source.end)]);
+  const changed = next.equals(original) ? [] : unique([srcLabel, dstLabel]);
+  return {
+    result: oneSidedResult({
       patch,
       src: srcLabel,
       dst: dstLabel,
-      changed: [],
-      dryRun: true,
-      status: "already_applied",
-      sourceRange: null,
+      changed,
+      status: changed.length === 0 ? "noop" : "applied",
+      sourceRange: source,
       targetRange: null,
       insertIndex: null
-    });
-  }
-  const next = Buffer3.concat([original.subarray(0, source.start), original.subarray(source.end)]);
-  return oneSidedResult({
-    patch,
-    src: srcLabel,
-    dst: dstLabel,
-    changed: next.equals(original) ? [] : unique([srcLabel, dstLabel]),
-    dryRun: true,
-    status: next.equals(original) ? "noop" : "applied",
-    sourceRange: source,
-    targetRange: null,
-    insertIndex: null
-  });
+    }),
+    mutations: changed.length === 0 ? [] : [{ kind: "write", label: srcLabel, bytes: next }]
+  };
 }
 function oneSidedResult(args) {
   return {
     changed: args.changed,
     affected: unique([args.src, args.dst]),
-    written: args.status === "applied" && !args.dryRun && args.changed.length > 0,
+    written: false,
     noop: args.status !== "applied" || args.changed.length === 0,
     status: args.status,
     moves: [
@@ -1027,28 +1088,15 @@ function oneSidedResult(args) {
     ]
   };
 }
-function checkPathCreationMoveInMemory(patch, dstLabel, files) {
+function planPathCreationMove(patch, dstLabel, files) {
   const fullTarget = fullTargetBytes(patch);
   const original = files.get(dstLabel)?.bytes;
   if (original !== undefined) {
     if (original.equals(fullTarget)) {
-      return nullSourceResult(patch, dstLabel, true, "already_applied", { start: 0, end: original.length }, 0);
-    }
-    fail("destination_exists", `Destination path for file creation already exists with different bytes: ${dstLabel}`, {
-      path: dstLabel,
-      phase: "target",
-      anchor: "blockpatch-target"
-    });
-  }
-  return nullSourceResult(patch, dstLabel, true, "applied", { start: 0, end: 0 }, 0);
-}
-async function applyPathCreationMove(patch, dstLabel, cwd, dryRun) {
-  const resolved = resolvePathAllowMissing(cwd, dstLabel, "destination path");
-  const fullTarget = fullTargetBytes(patch);
-  if (resolved.exists) {
-    const original = await readFileChecked(resolved.path, "destination file");
-    if (original.equals(fullTarget)) {
-      return nullSourceResult(patch, dstLabel, dryRun, "already_applied", { start: 0, end: original.length }, 0);
+      return {
+        result: nullSourceResult(patch, dstLabel, "already_applied", { start: 0, end: original.length }, 0),
+        mutations: []
+      };
     }
     fail("destination_exists", `Destination path for file creation already exists with different bytes: ${dstLabel}`, {
       path: dstLabel,
@@ -1056,36 +1104,19 @@ async function applyPathCreationMove(patch, dstLabel, cwd, dryRun) {
       anchor: "blockpatch-target"
     });
   }
-  if (!dryRun) {
-    await writeAtomically([{ path: resolved.path, bytes: fullTarget, create: true }]);
-  }
-  return nullSourceResult(patch, dstLabel, dryRun, "applied", { start: 0, end: 0 }, 0);
+  return {
+    result: nullSourceResult(patch, dstLabel, "applied", { start: 0, end: 0 }, 0),
+    mutations: [{ kind: "write", label: dstLabel, bytes: fullTarget, create: true }]
+  };
 }
-function checkPathDeletionMoveInMemory(patch, srcLabel, files) {
+function planPathDeletionMove(patch, srcLabel, files) {
   const original = files.get(srcLabel)?.bytes;
   if (original === undefined) {
-    return nullTargetResult(patch, srcLabel, true, "already_applied", null);
-  }
-  const fullSource = Buffer3.concat([patch.sourceBefore, patch.sourcePayload, patch.sourceAfter]);
-  if (!original.equals(fullSource)) {
-    fail("source_not_found", `Whole-file source payload was not found in ${srcLabel}`, {
-      path: srcLabel,
-      phase: "source",
-      anchor: "blockpatch-source",
-      matches: 0
-    });
-  }
-  return nullTargetResult(patch, srcLabel, true, "applied", {
-    start: patch.sourceBefore.length,
-    end: patch.sourceBefore.length + patch.sourcePayload.length
-  });
-}
-async function applyPathDeletionMove(patch, srcLabel, cwd, dryRun) {
-  const resolved = resolvePathAllowMissing(cwd, srcLabel, "source path");
-  if (!resolved.exists) {
-    return nullTargetResult(patch, srcLabel, dryRun, "already_applied", null);
+    return {
+      result: nullTargetResult(patch, srcLabel, "already_applied", null),
+      mutations: []
+    };
   }
-  const original = await readFileChecked(resolved.path, "source file");
   const fullSource = Buffer3.concat([patch.sourceBefore, patch.sourcePayload, patch.sourceAfter]);
   if (!original.equals(fullSource)) {
     fail("source_not_found", `Whole-file source payload was not found in ${srcLabel}`, {
@@ -1095,17 +1126,13 @@ async function applyPathDeletionMove(patch, srcLabel, cwd, dryRun) {
       matches: 0
     });
   }
-  if (!dryRun) {
-    try {
-      await unlink(resolved.path);
-    } catch (error) {
-      failFileSystem(error, srcLabel, "Could not remove file");
-    }
-  }
-  return nullTargetResult(patch, srcLabel, dryRun, "applied", {
-    start: patch.sourceBefore.length,
-    end: patch.sourceBefore.length + patch.sourcePayload.length
-  });
+  return {
+    result: nullTargetResult(patch, srcLabel, "applied", {
+      start: patch.sourceBefore.length,
+      end: patch.sourceBefore.length + patch.sourcePayload.length
+    }),
+    mutations: [{ kind: "delete", label: srcLabel }]
+  };
 }
 function fullTargetBytes(patch) {
   const target = requireTarget(patch);
@@ -1119,17 +1146,18 @@ function requireTarget(patch) {
 }
 function findDeletionSourceRange(file, patch, srcLabel) {
   const fullSource = Buffer3.concat([patch.sourceBefore, patch.sourcePayload, patch.sourceAfter]);
-  const fullMatches = indexesOf(file, fullSource);
-  if (fullMatches.length === 1) {
+  const fullMatchResult = indexesOfLimited(file, fullSource);
+  const fullMatches = fullMatchResult.matches;
+  if (fullMatches.length === 1 && !fullMatchResult.truncated) {
     const start = fullMatches[0] + patch.sourceBefore.length;
     return { start, end: start + patch.sourcePayload.length };
   }
-  if (fullMatches.length > 1) {
-    fail("source_ambiguous", `Source block is ambiguous in ${srcLabel}; matched ${fullMatches.length} locations`, {
+  if (fullMatches.length > 1 || fullMatchResult.truncated) {
+    fail("source_ambiguous", `Source block is ambiguous in ${srcLabel}; ${matchedLocations(fullMatches.length, fullMatchResult.truncated)}`, {
       path: srcLabel,
       phase: "source",
       anchor: "blockpatch-source",
-      matches: fullMatches.length,
+      ...matchCountDetails(fullMatches.length, fullMatchResult.truncated),
       ranges: boundedMatchRanges(fullMatches, fullSource.length),
       line_ranges: boundedMatchLineRanges(file, fullMatches, fullSource.length)
     });
@@ -1142,36 +1170,37 @@ function deletionAlreadyAppliedOrFail(file, patch, srcLabel) {
     return;
   }
   const adjacent = Buffer3.concat([patch.sourceBefore, patch.sourceAfter]);
-  const adjacentMatches = indexesOf(file, adjacent);
-  if (adjacentMatches.length === 1) {
+  const adjacentMatchResult = indexesOfLimitedWhere(file, adjacent, (start) => isDeletionAlreadyAppliedMatch(file, patch, start));
+  const adjacentMatches = adjacentMatchResult.matches;
+  if (adjacentMatches.length === 1 && !adjacentMatchResult.truncated) {
     return;
   }
-  if (adjacentMatches.length > 1) {
+  if (adjacentMatches.length > 1 || adjacentMatchResult.truncated) {
     fail("source_ambiguous", `Already-deleted source anchors are ambiguous in ${srcLabel}`, {
       path: srcLabel,
       phase: "source",
       anchor: "blockpatch-source",
-      matches: adjacentMatches.length,
+      ...matchCountDetails(adjacentMatches.length, adjacentMatchResult.truncated),
       ranges: boundedMatchRanges(adjacentMatches, adjacent.length),
       line_ranges: boundedMatchLineRanges(file, adjacentMatches, adjacent.length)
     });
   }
   const envelopes = findSourceEnvelopes(file, patch);
-  if (envelopes.length === 1) {
+  if (envelopes.ranges.length === 1 && !envelopes.truncated) {
     fail("payload_mismatch", `Source payload does not match located source anchors in ${srcLabel}`, {
       path: srcLabel,
       phase: "payload",
       anchor: "blockpatch-source"
     });
   }
-  if (envelopes.length > 1) {
-    fail("source_ambiguous", `Source anchors are ambiguous in ${srcLabel}; matched ${envelopes.length} locations`, {
+  if (envelopes.ranges.length > 1 || envelopes.truncated) {
+    fail("source_ambiguous", `Source anchors are ambiguous in ${srcLabel}; ${matchedLocations(envelopes.ranges.length, envelopes.truncated)}`, {
       path: srcLabel,
       phase: "source",
       anchor: "blockpatch-source",
-      matches: envelopes.length,
-      ranges: boundedRanges(envelopes),
-      line_ranges: boundedLineRanges(file, envelopes)
+      ...matchCountDetails(envelopes.ranges.length, envelopes.truncated),
+      ranges: boundedRanges(envelopes.ranges),
+      line_ranges: boundedLineRanges(file, envelopes.ranges)
     });
   }
   fail("source_not_found", `Source anchors were not found in ${srcLabel}`, {
@@ -1181,12 +1210,21 @@ function deletionAlreadyAppliedOrFail(file, patch, srcLabel) {
     matches: 0
   });
 }
-function nullSourceResult(patch, dstLabel, dryRun, status, targetRange, insertIndex) {
+function isDeletionAlreadyAppliedMatch(file, patch, start) {
+  if (patch.sourceBefore.length === 0) {
+    return start === 0;
+  }
+  if (patch.sourceAfter.length === 0) {
+    return start + patch.sourceBefore.length === file.length;
+  }
+  return true;
+}
+function nullSourceResult(patch, dstLabel, status, targetRange, insertIndex) {
   const applied = status === "applied";
   return {
     changed: applied ? [dstLabel] : [],
     affected: [dstLabel],
-    written: applied && !dryRun,
+    written: false,
     noop: !applied,
     status,
     moves: [
@@ -1203,12 +1241,12 @@ function nullSourceResult(patch, dstLabel, dryRun, status, targetRange, insertIn
     ]
   };
 }
-function nullTargetResult(patch, srcLabel, dryRun, status, sourceRange) {
+function nullTargetResult(patch, srcLabel, status, sourceRange) {
   const applied = status === "applied";
   return {
     changed: applied ? [srcLabel] : [],
     affected: [srcLabel],
-    written: applied && !dryRun,
+    written: false,
     noop: !applied,
     status,
     moves: [
@@ -1252,6 +1290,12 @@ function selectMovePlan(srcFile, dstFile, patch, sameFile) {
       })
     };
   }
+  if (!sameFile) {
+    const alreadyAppliedTarget = findAlreadyAppliedTargetSelection(dstFile, patch, dstLabel);
+    if (alreadyAppliedTarget !== undefined) {
+      failPartialAppliedDuplicate(srcLabel, dstLabel, patch, source, alreadyAppliedTarget);
+    }
+  }
   const target = findTargetSelection(dstFile, targetAnchor.before, targetAnchor.after, dstLabel, {
     phase: "target",
     anchor: "blockpatch-target"
@@ -1261,6 +1305,17 @@ function selectMovePlan(srcFile, dstFile, patch, sameFile) {
     selection: buildMoveSelection(srcFile, source, target, sameFile, dstLabel)
   };
 }
+function failPartialAppliedDuplicate(srcLabel, dstLabel, patch, source, target) {
+  fail("partial_applied_duplicate", `Cross-file move appears partially applied: ${dstLabel} already contains the moved payload while ${srcLabel} still contains it`, {
+    path: dstLabel,
+    phase: "target",
+    anchor: "blockpatch-target",
+    source_range: source,
+    target_range: target.range,
+    payload_sha256: patch.payloadSha256,
+    suggested_action: "review_then_remove_source"
+  });
+}
 function buildMoveSelection(srcFile, source, target, sameFile, dstLabel) {
   if (sameFile && rangesOverlap(source, target.range)) {
     fail("target_overlaps_source", `Target anchor for ${dstLabel} overlaps the source block`, {
@@ -1283,10 +1338,20 @@ async function commitMove(args) {
   if (!args.dryRun) {
     const writes = [];
     if (dstChanged || sameFileAlias && srcChanged) {
-      writes.push({ path: args.dstPath, bytes: next.dst });
+      writes.push({
+        path: args.dstPath,
+        bytes: next.dst,
+        label: args.dstLabel,
+        expected: args.dstSnapshot === undefined ? undefined : { kind: "file", label: args.dstLabel, snapshot: args.dstSnapshot }
+      });
     }
     if (srcChanged) {
-      writes.push({ path: args.srcPath, bytes: next.src });
+      writes.push({
+        path: args.srcPath,
+        bytes: next.src,
+        label: args.srcLabel,
+        expected: args.srcSnapshot === undefined ? undefined : { kind: "file", label: args.srcLabel, snapshot: args.srcSnapshot }
+      });
     }
     await writeAtomically(writes);
   }
@@ -1328,17 +1393,18 @@ function applyCrossFileMove(srcFile, dstFile, selection) {
 function findSourceRange(srcFile, dstFile, patch) {
   const srcLabel = patch.src ?? devNull;
   const fullSource = Buffer3.concat([patch.sourceBefore, patch.sourcePayload, patch.sourceAfter]);
-  const fullMatches = indexesOf(srcFile, fullSource);
-  if (fullMatches.length === 1) {
+  const fullMatchResult = indexesOfLimited(srcFile, fullSource);
+  const fullMatches = fullMatchResult.matches;
+  if (fullMatches.length === 1 && !fullMatchResult.truncated) {
     const start = fullMatches[0] + patch.sourceBefore.length;
     return { start, end: start + patch.sourcePayload.length };
   }
-  if (fullMatches.length > 1) {
-    fail("source_ambiguous", `Source block is ambiguous in ${srcLabel}; matched ${fullMatches.length} locations`, {
+  if (fullMatches.length > 1 || fullMatchResult.truncated) {
+    fail("source_ambiguous", `Source block is ambiguous in ${srcLabel}; ${matchedLocations(fullMatches.length, fullMatchResult.truncated)}`, {
       path: srcLabel,
       phase: "source",
       anchor: "blockpatch-source",
-      matches: fullMatches.length,
+      ...matchCountDetails(fullMatches.length, fullMatchResult.truncated),
       ranges: boundedMatchRanges(fullMatches, fullSource.length),
       line_ranges: boundedMatchLineRanges(srcFile, fullMatches, fullSource.length)
     });
@@ -1348,21 +1414,21 @@ function findSourceRange(srcFile, dstFile, patch) {
     return;
   }
   const envelopes = findSourceEnvelopes(srcFile, patch);
-  if (envelopes.length === 1) {
+  if (envelopes.ranges.length === 1 && !envelopes.truncated) {
     fail("payload_mismatch", `Source payload does not match located source anchors in ${srcLabel}`, {
       path: srcLabel,
       phase: "payload",
       anchor: "blockpatch-source"
     });
   }
-  if (envelopes.length > 1) {
-    fail("source_ambiguous", `Source anchors are ambiguous in ${srcLabel}; matched ${envelopes.length} locations`, {
+  if (envelopes.ranges.length > 1 || envelopes.truncated) {
+    fail("source_ambiguous", `Source anchors are ambiguous in ${srcLabel}; ${matchedLocations(envelopes.ranges.length, envelopes.truncated)}`, {
       path: srcLabel,
       phase: "source",
       anchor: "blockpatch-source",
-      matches: envelopes.length,
-      ranges: boundedRanges(envelopes),
-      line_ranges: boundedLineRanges(srcFile, envelopes)
+      ...matchCountDetails(envelopes.ranges.length, envelopes.truncated),
+      ranges: boundedRanges(envelopes.ranges),
+      line_ranges: boundedLineRanges(srcFile, envelopes.ranges)
     });
   }
   fail("source_not_found", `Source anchors were not found in ${srcLabel}`, {
@@ -1375,16 +1441,17 @@ function findSourceRange(srcFile, dstFile, patch) {
 function findAlreadyAppliedTargetSelection(file, patch, dstLabel = patch.dst ?? devNull) {
   const target = requireTarget(patch);
   const alreadyApplied = Buffer3.concat([target.before, patch.sourcePayload, target.after]);
-  const matches = indexesOf(file, alreadyApplied);
+  const matchResult = indexesOfLimited(file, alreadyApplied);
+  const matches = matchResult.matches;
   if (matches.length === 0) {
     return;
   }
-  if (matches.length > 1) {
-    fail("target_ambiguous", `Already-applied target is ambiguous in ${dstLabel}; matched ${matches.length} locations`, {
+  if (matches.length > 1 || matchResult.truncated) {
+    fail("target_ambiguous", `Already-applied target is ambiguous in ${dstLabel}; ${matchedLocations(matches.length, matchResult.truncated)}`, {
       path: dstLabel,
       phase: "target",
       anchor: "blockpatch-target",
-      matches: matches.length,
+      ...matchCountDetails(matches.length, matchResult.truncated),
       ranges: boundedMatchRanges(matches, alreadyApplied.length),
       line_ranges: boundedMatchLineRanges(file, matches, alreadyApplied.length)
     });
@@ -1395,22 +1462,30 @@ function findAlreadyAppliedTargetSelection(file, patch, dstLabel = patch.dst ??
     insertIndex: start + target.before.length
   };
 }
-function findSourceEnvelopes(file, patch) {
-  const beforeMatches = indexesOf(file, patch.sourceBefore);
-  const afterMatches = indexesOf(file, patch.sourceAfter);
+function findSourceEnvelopes(file, patch, limit = 11) {
+  if (patch.sourceBefore.length === 0 || patch.sourceAfter.length === 0) {
+    return { ranges: [], truncated: false };
+  }
+  const maxMatches = normalizedLimit(limit);
   const ranges = [];
-  for (const beforeStart of beforeMatches) {
+  let beforeStart = file.indexOf(patch.sourceBefore);
+  while (beforeStart !== -1) {
     const payloadStart = beforeStart + patch.sourceBefore.length;
-    const afterStart = afterMatches.find((candidate) => candidate >= payloadStart);
-    if (afterStart !== undefined) {
+    const afterStart = file.indexOf(patch.sourceAfter, payloadStart);
+    if (afterStart !== -1) {
+      if (ranges.length >= maxMatches) {
+        return { ranges, truncated: true };
+      }
       ranges.push({ start: payloadStart, end: afterStart });
     }
+    beforeStart = file.indexOf(patch.sourceBefore, beforeStart + 1);
   }
-  return ranges;
+  return { ranges, truncated: false };
 }
 function findTargetSelection(file, before, after, dstLabel, details = {}) {
   const anchor = Buffer3.concat([before, after]);
-  const matches = indexesOf(file, anchor);
+  const matchResult = indexesOfLimited(file, anchor);
+  const matches = matchResult.matches;
   if (matches.length === 0) {
     fail("target_not_found", `Target anchor was not found in ${dstLabel}`, {
       path: dstLabel,
@@ -1418,11 +1493,11 @@ function findTargetSelection(file, before, after, dstLabel, details = {}) {
       matches: 0
     });
   }
-  if (matches.length > 1) {
-    fail("target_ambiguous", `Target anchor is ambiguous in ${dstLabel}; matched ${matches.length} locations`, {
+  if (matches.length > 1 || matchResult.truncated) {
+    fail("target_ambiguous", `Target anchor is ambiguous in ${dstLabel}; ${matchedLocations(matches.length, matchResult.truncated)}`, {
       path: dstLabel,
       ...details,
-      matches: matches.length,
+      ...matchCountDetails(matches.length, matchResult.truncated),
       ranges: boundedMatchRanges(matches, anchor.length),
       line_ranges: boundedMatchLineRanges(file, matches, anchor.length)
     });
@@ -1433,17 +1508,45 @@ function findTargetSelection(file, before, after, dstLabel, details = {}) {
     insertIndex: start + before.length
   };
 }
-function indexesOf(haystack, needle) {
+function indexesOfLimited(haystack, needle, limit = 11) {
+  if (needle.length === 0) {
+    return { matches: [], truncated: false };
+  }
+  const maxMatches = normalizedLimit(limit);
+  const matches = [];
+  let index = haystack.indexOf(needle);
+  while (index !== -1) {
+    if (matches.length >= maxMatches) {
+      return { matches, truncated: true };
+    }
+    matches.push(index);
+    index = haystack.indexOf(needle, index + 1);
+  }
+  return { matches, truncated: false };
+}
+function indexesOfLimitedWhere(haystack, needle, predicate, limit = 11) {
   if (needle.length === 0) {
-    return [];
+    return { matches: [], truncated: false };
   }
-  const indexes = [];
+  const maxMatches = normalizedLimit(limit);
+  const matches = [];
   let index = haystack.indexOf(needle);
   while (index !== -1) {
-    indexes.push(index);
+    if (predicate(index)) {
+      if (matches.length >= maxMatches) {
+        return { matches, truncated: true };
+      }
+      matches.push(index);
+    }
     index = haystack.indexOf(needle, index + 1);
   }
-  return indexes;
+  return { matches, truncated: false };
+}
+function normalizedLimit(limit) {
+  if (!Number.isFinite(limit)) {
+    return Number.POSITIVE_INFINITY;
+  }
+  return Math.max(0, Math.trunc(limit));
 }
 function rangesOverlap(left, right) {
   return left.start < right.end && right.start < left.end;
@@ -1491,6 +1594,19 @@ function changedMoveLabels(srcLabel, dstLabel, sameFile, srcOriginal, dstOrigina
   }
   return unique(changed);
 }
+function moveMutations(srcLabel, dstLabel, sameFile, srcOriginal, dstOriginal, next) {
+  const srcChanged = !next.src.equals(srcOriginal);
+  const dstChanged = !sameFile && !next.dst.equals(dstOriginal);
+  const sameFileAlias = sameFile && srcLabel !== dstLabel;
+  const mutations = [];
+  if (dstChanged || sameFileAlias && srcChanged) {
+    mutations.push({ kind: "write", label: dstLabel, bytes: next.dst });
+  }
+  if (srcChanged) {
+    mutations.push({ kind: "write", label: srcLabel, bytes: next.src });
+  }
+  return mutations;
+}
 function memoryFileMap(files) {
   const mapped = new Map;
   for (const file of files) {
@@ -1519,36 +1635,123 @@ function sameMemoryFile(files, left, right) {
   const rightFile = files.get(right);
   return leftFile !== undefined && rightFile !== undefined && leftFile.identity === rightFile.identity;
 }
-async function writeAtomic(path, bytes) {
-  await writeAtomically([{ path, bytes }]);
+async function writeAtomic(path, bytes, options = {}) {
+  await writeAtomically([
+    {
+      path,
+      bytes,
+      create: options.create,
+      expected: options.expected,
+      label: options.label
+    }
+  ]);
 }
-async function writeAtomically(writes) {
+async function writeAtomically(writes, deletes = []) {
   const staged = [];
   try {
     for (const write of writes) {
-      staged.push(await stageAtomicWrite(write.path, write.bytes, write.create === true));
+      staged.push(await stageAtomicWrite(write));
     }
+    const decisions = [];
     for (const write of staged) {
+      decisions.push(await verifyStagedWrite(write));
+    }
+    for (const deletion of deletes) {
+      await verifyAtomicDelete(deletion);
+    }
+    for (const [index, write] of staged.entries()) {
+      if (decisions[index] === "skip") {
+        await cleanupStagedWrite(write);
+        continue;
+      }
       try {
         await rename(write.temp, write.path);
       } catch (error) {
         failFileSystem(error, write.path, "Could not replace file");
       }
     }
+    for (const deletion of deletes) {
+      try {
+        await unlink(deletion.path);
+      } catch (error) {
+        failFileSystem(error, deletion.path, "Could not remove file");
+      }
+    }
+  } catch (error) {
+    await cleanupStagedWrites(staged);
+    throw error;
+  }
+}
+async function verifyStagedWrite(write) {
+  const expected = write.request.expected;
+  if (expected === undefined) {
+    return "rename";
+  }
+  if (expected.kind === "missing") {
+    const current2 = await readFileSnapshotOptional(write.path, expected.label);
+    if (current2 === undefined) {
+      return "rename";
+    }
+    if (expected.bytesIfExists !== undefined && current2.bytes.equals(expected.bytesIfExists)) {
+      return "skip";
+    }
+    failConcurrentModification(expected.label);
+  }
+  const current = await readFileSnapshotOptional(write.path, expected.label);
+  if (current === undefined || !sameFileSnapshot(expected.snapshot, current)) {
+    failConcurrentModification(expected.label);
+  }
+  return "rename";
+}
+async function verifyAtomicDelete(deletion) {
+  const expected = deletion.expected;
+  if (expected === undefined) {
+    return;
+  }
+  if (expected.kind === "missing") {
+    const current2 = await readFileSnapshotOptional(deletion.path, expected.label);
+    if (current2 === undefined) {
+      return;
+    }
+    failConcurrentModification(expected.label);
+  }
+  const current = await readFileSnapshotOptional(deletion.path, expected.label);
+  if (current === undefined || !sameFileSnapshot(expected.snapshot, current)) {
+    failConcurrentModification(expected.label);
+  }
+}
+async function readFileSnapshotOptional(path, label) {
+  try {
+    return await readFileSnapshot(path, "current file");
   } catch (error) {
-    await Promise.all(staged.map((write) => unlink(write.temp).catch(() => {
+    if (error instanceof BlockPatchError && error.code === "file_not_found") {
       return;
-    })));
+    }
+    if (error instanceof BlockPatchError && error.code === "not_regular_file") {
+      failConcurrentModification(label);
+    }
     throw error;
   }
 }
-async function stageAtomicWrite(path, bytes, create = false) {
+function sameFileSnapshot(left, right) {
+  return left.sha256 === right.sha256 && sameStatSnapshot(left.stat, right.stat);
+}
+function sameStatSnapshot(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function failConcurrentModification(label) {
+  fail("concurrent_modification", `File changed after blockpatch verified its input: ${label}`, {
+    path: label,
+    phase: "write"
+  });
+}
+async function stageAtomicWrite(write) {
   let mode;
   let createMissing = false;
-  if (create) {
-    const info = await statOptional(path);
+  if (write.create === true) {
+    const info = await statOptional(write.path);
     if (info !== undefined) {
-      assertRegularFile(info, path, "output file");
+      assertExpectedRegularFile(info, write.path, "output file", write.expected);
       mode = info.mode;
     }
     if (mode === undefined) {
@@ -1556,28 +1759,105 @@ async function stageAtomicWrite(path, bytes, create = false) {
       mode = 420;
     }
   } else {
-    const info = await statChecked(path, "output file");
-    assertRegularFile(info, path, "output file");
+    const info = await statOptional(write.path);
+    if (info === undefined) {
+      if (write.expected !== undefined) {
+        failConcurrentModification(write.expected.label);
+      }
+      fail("file_not_found", `Could not stat output file: ${write.path}`, { path: write.path, phase: "io" });
+    }
+    assertExpectedRegularFile(info, write.path, "output file", write.expected);
     mode = info.mode;
   }
-  const dir = dirname(path);
-  const base = basename(path);
+  const dir = dirname(write.path);
+  const base = basename(write.path);
   const temp = join2(dir, `.${base}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+  let createdDirectory;
   try {
     if (createMissing) {
-      await mkdir(dir, { recursive: true });
+      const firstCreated = await mkdir(dir, { recursive: true });
+      if (firstCreated !== undefined) {
+        createdDirectory = { first: firstCreated, target: dir };
+      }
     }
-    await writeFile(temp, bytes, { flag: "wx" });
+    await assertSafeOutputParentDirectory(dir, write.path);
+    await writeFile(temp, write.bytes, { flag: "wx" });
     if (mode !== undefined) {
       await chmod(temp, mode);
     }
   } catch (error) {
-    await unlink(temp).catch(() => {
-      return;
+    await cleanupStagedWrite({ temp, createdDirectory });
+    failFileSystem(error, write.path, "Could not stage file replacement");
+  }
+  return { path: write.path, temp, request: write, createdDirectory };
+}
+async function assertSafeOutputParentDirectory(dir, outputPath) {
+  let info;
+  try {
+    info = await lstat(dir);
+  } catch (error) {
+    failFileSystem(error, outputPath, "Could not stat output directory", "path");
+  }
+  if (info.isSymbolicLink()) {
+    fail("symlink_path", `output directory must not be a symbolic link: ${outputPath}`, {
+      path: outputPath,
+      phase: "path"
+    });
+  }
+  if (!info.isDirectory()) {
+    fail("not_regular_file", `output directory must be a directory: ${outputPath}`, {
+      path: outputPath,
+      phase: "path"
     });
-    failFileSystem(error, path, "Could not stage file replacement");
   }
-  return { path, temp };
+}
+async function cleanupStagedWrites(staged) {
+  await Promise.all(staged.map((write) => unlink(write.temp).catch(() => {
+    return;
+  })));
+  for (const write of [...staged].reverse()) {
+    await cleanupCreatedDirectoryChain(write.createdDirectory);
+  }
+}
+async function cleanupStagedWrite(write) {
+  await unlink(write.temp).catch(() => {
+    return;
+  });
+  await cleanupCreatedDirectoryChain(write.createdDirectory);
+}
+async function cleanupCreatedDirectoryChain(chain) {
+  if (chain === undefined || !isSameOrChildPath(chain.target, chain.first)) {
+    return;
+  }
+  let current = chain.target;
+  while (true) {
+    try {
+      await rmdir(current);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT") {
+        return;
+      }
+    }
+    if (resolve2(current) === resolve2(chain.first)) {
+      return;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return;
+    }
+    current = parent;
+  }
+}
+function isSameOrChildPath(child, parent) {
+  const childFromParent = relative2(resolve2(parent), resolve2(child));
+  return childFromParent === "" || childFromParent !== ".." && !childFromParent.startsWith(`..${sep2}`) && !isAbsolute2(childFromParent);
+}
+function assertExpectedRegularFile(info, path, label, expected) {
+  if (!info.isFile() && expected !== undefined) {
+    failConcurrentModification(expected.label);
+  }
+  assertRegularFile(info, path, label);
 }
 async function statOptional(path) {
   try {
@@ -1592,7 +1872,7 @@ async function statOptional(path) {
 }
 
 // src/move.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { posix as posix2 } from "node:path";
 import { TextDecoder } from "node:util";
 var moveArgTypes = {
@@ -1604,14 +1884,22 @@ var moveArgTypes = {
   target_before: "string",
   target_after: "string",
   expected_payload_sha256: "string",
+  mode: "string",
   dry_run: "boolean"
 };
+var moveModes = new Set(["create_file", "remove_file"]);
 var utf8Decoder = new TextDecoder("utf-8", { fatal: true });
 async function moveBlock(args, options = {}) {
   const validated = validateMoveArgs(args);
   const normalized = normalizeArgs(validated);
   const cwd = options.cwd ?? process.cwd();
   const dryRun = options.dryRun ?? validated.dry_run ?? false;
+  if (normalized.kind === "create_file") {
+    return createFile(normalized, validated, cwd, dryRun, options);
+  }
+  if (normalized.kind === "remove_file") {
+    return removeFile(normalized, validated, cwd, dryRun, options);
+  }
   if (normalized.kind === "insertion") {
     return insertPayload(normalized, validated, cwd, dryRun, options);
   }
@@ -1621,15 +1909,17 @@ async function moveBlock(args, options = {}) {
   const srcPath = resolvePath(cwd, normalized.src, "source path");
   const dstPath = resolvePath(cwd, normalized.dst, "destination path");
   const sameFile = await sameFileIdentity(srcPath, dstPath);
-  const srcOriginal = await readFileChecked(srcPath, "source file");
-  const dstOriginal = sameFile ? srcOriginal : await readFileChecked(dstPath, "destination file");
+  const srcSnapshot = await readFileSnapshot(srcPath, "source file");
+  const dstSnapshot = sameFile ? srcSnapshot : await readFileSnapshot(dstPath, "destination file");
+  const srcOriginal = srcSnapshot.bytes;
+  const dstOriginal = dstSnapshot.bytes;
   const source = findSource(srcOriginal, normalized);
   const target = findTargetSelection(dstOriginal, normalized.targetBefore, normalized.targetAfter, normalized.dst, {
     phase: "target",
     anchor: targetAnchorName(normalized)
   });
   const selection = buildMoveSelection(srcOriginal, source, target, sameFile, normalized.dst);
-  const payloadSha256 = createHash2("sha256").update(selection.payload).digest("hex");
+  const payloadSha256 = createHash3("sha256").update(selection.payload).digest("hex");
   verifyExpectedPayloadHash(validated, payloadSha256);
   const samePatchLabel = samePatchPath2(normalized.src, normalized.dst);
   const patch = options.diff ? renderMovePatch(normalized, srcOriginal, dstOriginal, selection, sameFile && samePatchLabel, payloadSha256) : undefined;
@@ -1642,6 +1932,8 @@ async function moveBlock(args, options = {}) {
     dryRun: writeSuppressed,
     srcOriginal,
     dstOriginal,
+    srcSnapshot,
+    dstSnapshot,
     selection,
     srcLabel: normalized.src,
     dstLabel: normalized.dst
@@ -1683,12 +1975,27 @@ function validateMoveArgs(value) {
       field: "expected_payload_sha256"
     });
   }
+  if (args.mode !== undefined && !moveModes.has(args.mode)) {
+    fail("invalid_move_args", "mode must be create_file or remove_file", { field: "mode" });
+  }
   return args;
 }
 function normalizeArgs(args) {
   if (!args.src) {
     fail("invalid_move_args", "move requires src", { field: "src" });
   }
+  if (args.src !== devNull) {
+    validateOperationPath(args.src, "source path");
+  }
+  if (args.dst !== undefined && args.dst !== devNull) {
+    validateOperationPath(args.dst, "destination path");
+  }
+  if (args.mode === "create_file") {
+    return normalizeFileCreationArgs(args);
+  }
+  if (args.mode === "remove_file") {
+    return normalizeFileRemovalArgs(args);
+  }
   const dst = args.dst ?? args.src;
   if (args.src === devNull && dst === devNull) {
     fail("invalid_move_args", "move cannot use /dev/null for both src and dst", { field: "dst" });
@@ -1749,6 +2056,60 @@ function normalizeArgs(args) {
     targetAfter: target.after
   };
 }
+function normalizeFileCreationArgs(args) {
+  if (args.src !== devNull) {
+    fail("invalid_move_args", "create_file mode requires src to be /dev/null", { field: "src" });
+  }
+  if (args.dst === undefined) {
+    fail("invalid_move_args", "create_file mode requires dst", { field: "dst" });
+  }
+  if (args.dst === devNull) {
+    fail("invalid_move_args", "create_file mode cannot target /dev/null", { field: "dst" });
+  }
+  if (args.payload === undefined) {
+    fail("invalid_move_args", "create_file mode requires payload", { field: "payload" });
+  }
+  rejectSourceSelectionArgs(args, "create_file mode uses payload as the whole-file content");
+  rejectTargetAnchorArgs(args, "create_file mode must not include target anchors");
+  return {
+    kind: "create_file",
+    src: devNull,
+    dst: args.dst,
+    payload: Buffer.from(args.payload, "utf8")
+  };
+}
+function normalizeFileRemovalArgs(args) {
+  if (args.src === devNull) {
+    fail("invalid_move_args", "remove_file mode requires a real src path", { field: "src" });
+  }
+  if (args.dst !== devNull) {
+    fail("invalid_move_args", "remove_file mode requires dst to be /dev/null", { field: "dst" });
+  }
+  if (args.payload !== undefined) {
+    fail("invalid_move_args", "remove_file mode reads the whole-file payload from src", { field: "payload" });
+  }
+  rejectSourceSelectionArgs(args, "remove_file mode removes the whole src file");
+  rejectTargetAnchorArgs(args, "remove_file mode must not include target anchors");
+  return {
+    kind: "remove_file",
+    src: args.src,
+    dst: devNull
+  };
+}
+function rejectSourceSelectionArgs(args, message) {
+  if (args.src_start !== undefined || args.src_end !== undefined) {
+    fail("invalid_move_args", message, {
+      field: args.src_start !== undefined ? "src_start" : "src_end"
+    });
+  }
+}
+function rejectTargetAnchorArgs(args, message) {
+  if (args.target_before !== undefined || args.target_after !== undefined) {
+    fail("invalid_move_args", message, {
+      field: args.target_before !== undefined ? "target_before" : "target_after"
+    });
+  }
+}
 function normalizeTargetArgs(args) {
   const hasTargetBefore = args.target_before !== undefined;
   const hasTargetAfter = args.target_after !== undefined;
@@ -1768,10 +2129,33 @@ function requiredBuffer(value, field) {
   }
   return Buffer.from(value, "utf8");
 }
+async function createFile(args, validated, cwd, dryRun, options) {
+  const payloadSha256 = createHash3("sha256").update(args.payload).digest("hex");
+  verifyExpectedPayloadHash(validated, payloadSha256);
+  const patch = renderFileCreationPatch(args, payloadSha256);
+  return runRenderedPatch(patch, cwd, dryRun, options);
+}
+async function removeFile(args, validated, cwd, dryRun, options) {
+  const srcPath = resolvePath(cwd, args.src, "source path");
+  const payload = await readFileChecked(srcPath, "source file");
+  const payloadSha256 = createHash3("sha256").update(payload).digest("hex");
+  verifyExpectedPayloadHash(validated, payloadSha256);
+  const patch = renderFileRemovalPatch(args, payload, payloadSha256);
+  return runRenderedPatch(patch, cwd, dryRun, options);
+}
+async function runRenderedPatch(patch, cwd, dryRun, options) {
+  const writeSuppressed = dryRun || options.diff === true;
+  const result = await applyPatchBytes(Buffer.from(patch, "utf8"), { cwd, dryRun: writeSuppressed });
+  return {
+    ...result,
+    patch: options.diff === true ? patch : undefined
+  };
+}
 async function insertPayload(args, validated, cwd, dryRun, options) {
   const dstPath = resolvePath(cwd, args.dst, "destination path");
-  const original = await readFileChecked(dstPath, "destination file");
-  const payloadSha256 = createHash2("sha256").update(args.payload).digest("hex");
+  const snapshot = await readFileSnapshot(dstPath, "destination file");
+  const original = snapshot.bytes;
+  const payloadSha256 = createHash3("sha256").update(args.payload).digest("hex");
   verifyExpectedPayloadHash(validated, payloadSha256);
   const alreadyApplied = findAlreadyAppliedTarget(original, args, args.dst);
   if (alreadyApplied !== undefined) {
@@ -1812,7 +2196,9 @@ async function insertPayload(args, validated, cwd, dryRun, options) {
   ]);
   const changed = next.equals(original) ? [] : [args.dst];
   if (!writeSuppressed && changed.length > 0) {
-    await writeAtomic(dstPath, next);
+    await writeAtomic(dstPath, next, {
+      expected: { kind: "file", label: args.dst, snapshot }
+    });
   }
   return {
     changed,
@@ -1846,17 +2232,18 @@ function verifyExpectedPayloadHash(args, payloadSha256) {
 }
 function findAlreadyAppliedTarget(file, args, dstLabel) {
   const alreadyApplied = Buffer.concat([args.targetBefore, args.payload, args.targetAfter]);
-  const matches = indexesOf(file, alreadyApplied);
+  const matchResult = indexesOfLimited(file, alreadyApplied);
+  const matches = matchResult.matches;
   if (matches.length === 0) {
     return;
   }
-  if (matches.length > 1) {
+  if (matches.length > 1 || matchResult.truncated) {
     const ranges = boundedRanges(matches.map((start2) => ({ start: start2, end: start2 + alreadyApplied.length })));
-    fail("target_ambiguous", `Already-applied target is ambiguous in ${dstLabel}; matched ${matches.length} locations`, {
+    fail("target_ambiguous", `Already-applied target is ambiguous in ${dstLabel}; ${matchedLocations(matches.length, matchResult.truncated)}`, {
       path: dstLabel,
       phase: "target",
       anchor: "target_before+payload+target_after",
-      matches: matches.length,
+      ...matchCountDetails(matches.length, matchResult.truncated),
       ranges,
       line_ranges: boundedLineRanges(file, ranges)
     });
@@ -1869,10 +2256,11 @@ function findAlreadyAppliedTarget(file, args, dstLabel) {
 }
 async function deletePayload(args, validated, cwd, dryRun, options) {
   const srcPath = resolvePath(cwd, args.src, "source path");
-  const original = await readFileChecked(srcPath, "source file");
+  const snapshot = await readFileSnapshot(srcPath, "source file");
+  const original = snapshot.bytes;
   const source = findSource(original, args);
   const payload = Buffer.from(original.subarray(source.start, source.end));
-  const payloadSha256 = createHash2("sha256").update(payload).digest("hex");
+  const payloadSha256 = createHash3("sha256").update(payload).digest("hex");
   verifyExpectedPayloadHash(validated, payloadSha256);
   const renderedPatch = options.diff ? renderDeletionPatch(args, original, source, payload, payloadSha256) : undefined;
   await selfCheckRenderedPatch(renderedPatch, [{ path: args.src, bytes: original }]);
@@ -1880,7 +2268,9 @@ async function deletePayload(args, validated, cwd, dryRun, options) {
   const next = Buffer.concat([original.subarray(0, source.start), original.subarray(source.end)]);
   const changed = next.equals(original) ? [] : [args.src];
   if (!writeSuppressed && changed.length > 0) {
-    await writeAtomic(srcPath, next);
+    await writeAtomic(srcPath, next, {
+      expected: { kind: "file", label: args.src, snapshot }
+    });
   }
   return {
     changed,
@@ -1904,15 +2294,8 @@ async function deletePayload(args, validated, cwd, dryRun, options) {
   };
 }
 function findSource(file, args) {
-  const startMatches = indexesOf(file, args.srcStart);
-  const ranges = [];
-  for (const start of startMatches) {
-    const searchFrom = start + args.srcStart.length;
-    const endStart = file.indexOf(args.srcEnd, searchFrom);
-    if (endStart !== -1) {
-      ranges.push({ start, end: endStart + args.srcEnd.length });
-    }
-  }
+  const result = findDelimitedRanges(file, args.srcStart, args.srcEnd);
+  const ranges = result.ranges;
   if (ranges.length === 0) {
     fail("source_not_found", `Source delimiters were not found in ${args.src}`, {
       path: args.src,
@@ -1921,18 +2304,44 @@ function findSource(file, args) {
       matches: 0
     });
   }
-  if (ranges.length > 1) {
-    fail("source_ambiguous", `Source delimiters are ambiguous in ${args.src}; matched ${ranges.length} locations`, {
+  if (ranges.length > 1 || result.truncated) {
+    fail("source_ambiguous", `Source delimiters are ambiguous in ${args.src}; ${matchedLocations(ranges.length, result.truncated)}`, {
       path: args.src,
       phase: "source",
       anchor: "src_start/src_end",
-      matches: ranges.length,
+      ...matchCountDetails(ranges.length, result.truncated),
       ranges: boundedRanges(ranges),
       line_ranges: boundedLineRanges(file, ranges)
     });
   }
   return ranges[0];
 }
+function findDelimitedRanges(file, startNeedle, endNeedle, limit = 11) {
+  if (startNeedle.length === 0) {
+    return { ranges: [], truncated: false };
+  }
+  const maxMatches = normalizedLimit2(limit);
+  const ranges = [];
+  let start = file.indexOf(startNeedle);
+  while (start !== -1) {
+    const searchFrom = start + startNeedle.length;
+    const endStart = file.indexOf(endNeedle, searchFrom);
+    if (endStart !== -1) {
+      if (ranges.length >= maxMatches) {
+        return { ranges, truncated: true };
+      }
+      ranges.push({ start, end: endStart + endNeedle.length });
+    }
+    start = file.indexOf(startNeedle, start + 1);
+  }
+  return { ranges, truncated: false };
+}
+function normalizedLimit2(limit) {
+  if (!Number.isFinite(limit)) {
+    return Number.POSITIVE_INFINITY;
+  }
+  return Math.max(0, Math.trunc(limit));
+}
 function targetAnchorName(args) {
   if (args.targetBefore.length > 0 && args.targetAfter.length > 0) {
     return "target_before+target_after";
@@ -2078,6 +2487,40 @@ function renderDeletionPatch(args, srcOriginal, source, payload, payloadSha256)
 `) + `
 `;
 }
+function renderFileCreationPatch(args, payloadSha256) {
+  const id = "move-1";
+  const payloadLines = countLines(args.payload);
+  const targetBody = renderHunkBytes(args.payload, "+");
+  return [
+    `diff --blockpatch ${devNull} b/${args.dst}`,
+    "blockpatch version 1",
+    `blockpatch move id=${id} payload-sha256=${payloadSha256}`,
+    `--- ${devNull}`,
+    `+++ b/${args.dst}`,
+    "",
+    `@@ -0,0 +${payloadLines === 0 ? "0,0" : `1,${payloadLines}`} @@ blockpatch-target id=${id}`,
+    targetBody
+  ].join(`
+`) + `
+`;
+}
+function renderFileRemovalPatch(args, payload, payloadSha256) {
+  const id = "move-1";
+  const payloadLines = countLines(payload);
+  const sourceBody = renderHunkBytes(payload, "-");
+  return [
+    `diff --blockpatch a/${args.src} ${devNull}`,
+    "blockpatch version 1",
+    `blockpatch move id=${id} payload-sha256=${payloadSha256}`,
+    `--- a/${args.src}`,
+    `+++ ${devNull}`,
+    "",
+    `@@ -${payloadLines === 0 ? "0,0" : `1,${payloadLines}`} +0,0 @@ blockpatch-source id=${id}`,
+    sourceBody
+  ].join(`
+`) + `
+`;
+}
 function lineNumberAt2(file, byteIndex) {
   let line = 1;
   for (let index = 0;index < byteIndex; index += 1) {
@@ -2146,6 +2589,24 @@ function decodeUtf8(bytes) {
 
 // src/cli.ts
 var packageJson = createRequire(import.meta.url)("../package.json");
+var OUTPUT_FLAGS = new Set(["--json-output", "--explain"]);
+var CWD_VALUE_FLAGS = new Set(["--cwd", "--directory", "-d"]);
+var PATCH_INPUT_VALUE_FLAGS = new Set(["-i", "--input"]);
+var STRIP_VALUE_FLAGS = new Set(["-p", "--strip"]);
+var PATCH_VALUE_FLAGS = new Set([...CWD_VALUE_FLAGS, ...PATCH_INPUT_VALUE_FLAGS, ...STRIP_VALUE_FLAGS]);
+var MOVE_JSON_VALUE_FLAGS = new Set(["--json"]);
+var MOVE_KEY_BY_FLAG = {
+  "--src": "src",
+  "--src-start": "src_start",
+  "--src-end": "src_end",
+  "--dst": "dst",
+  "--payload": "payload",
+  "--target-before": "target_before",
+  "--target-after": "target_after",
+  "--expected-payload-sha256": "expected_payload_sha256"
+};
+var MOVE_ARG_VALUE_FLAGS = new Set(Object.keys(MOVE_KEY_BY_FLAG));
+var MOVE_VALUE_FLAGS = new Set([...CWD_VALUE_FLAGS, ...MOVE_JSON_VALUE_FLAGS, ...MOVE_ARG_VALUE_FLAGS]);
 async function main(argv) {
   const options = parseArgs(argv);
   if (options.command === "help") {
@@ -2177,12 +2638,13 @@ async function main(argv) {
 }
 async function runPatchCommand(options) {
   const patchPath = options.patchPath ?? "-";
+  const inputPatchPath = patchPath === "-" ? patchPath : resolve3(patchPath);
   if (options.command === "check") {
     return patchPath === "-" ? checkPatchBytes(await readStdin(), {
       cwd: options.cwd,
       reverse: options.reverse,
       stripComponents: options.stripComponents
-    }) : checkPatchFile(patchPath, {
+    }) : checkPatchFile(inputPatchPath, {
       cwd: options.cwd,
       reverse: options.reverse,
       stripComponents: options.stripComponents
@@ -2193,7 +2655,7 @@ async function runPatchCommand(options) {
     dryRun: options.dryRun,
     reverse: options.reverse,
     stripComponents: options.stripComponents
-  }) : applyPatchFile(patchPath, {
+  }) : applyPatchFile(inputPatchPath, {
     cwd: options.cwd,
     dryRun: options.dryRun,
     reverse: options.reverse,
@@ -2207,7 +2669,7 @@ async function loadMoveArgs(options) {
   if (options.moveJsonPath === undefined) {
     throw new BlockPatchError("missing_move_args", `${options.command} requires --json or --src flags`);
   }
-  const jsonBytes = options.moveJsonPath === "-" ? await readStdin() : await readFileChecked(resolve3(options.cwd, options.moveJsonPath), "move JSON file");
+  const jsonBytes = options.moveJsonPath === "-" ? await readStdin() : await readFileChecked(resolve3(options.moveJsonPath), "move JSON file");
   try {
     return JSON.parse(jsonBytes.toString("utf8"));
   } catch (error) {
@@ -2225,9 +2687,14 @@ function parseArgs(argv) {
   if (first === "version" || first === "--version" || first === "-v") {
     const options = base("version", outputFlags.jsonOutput);
     for (const arg of args) {
-      if (arg === "--json-output" || arg === "--explain") {
+      if (isOutputFlag(arg)) {
         options.jsonOutput = true;
+        continue;
       }
+      if (arg.startsWith("-")) {
+        throw new BlockPatchError("unknown_option", `Unknown option: ${arg}`);
+      }
+      throw new BlockPatchError("too_many_args", `Unexpected argument: ${arg}`);
     }
     return options;
   }
@@ -2257,7 +2724,7 @@ function parsePatchArgs(command, args, jsonOutput, explain) {
       options.reverse = true;
       continue;
     }
-    if (arg === "--cwd" || arg === "--directory" || arg === "-d") {
+    if (isValueFlag(arg, CWD_VALUE_FLAGS)) {
       options.cwd = requireValue(args, arg, true);
       continue;
     }
@@ -2269,7 +2736,7 @@ function parsePatchArgs(command, args, jsonOutput, explain) {
       options.cwd = resolve3(arg.slice("--directory=".length));
       continue;
     }
-    if (arg === "-i" || arg === "--input") {
+    if (isValueFlag(arg, PATCH_INPUT_VALUE_FLAGS)) {
       setPatchPath(options, requireValue(args, arg, false));
       continue;
     }
@@ -2317,7 +2784,7 @@ function parseMoveArgs(command, args, jsonOutput, explain) {
       options.diff = true;
       continue;
     }
-    if (arg === "--cwd" || arg === "--directory" || arg === "-d") {
+    if (isValueFlag(arg, CWD_VALUE_FLAGS)) {
       options.cwd = requireValue(args, arg, true);
       continue;
     }
@@ -2329,8 +2796,8 @@ function parseMoveArgs(command, args, jsonOutput, explain) {
       options.cwd = resolve3(arg.slice("--directory=".length));
       continue;
     }
-    if (arg === "--json") {
-      options.moveJsonPath = requireValue(args, "--json", false);
+    if (isValueFlag(arg, MOVE_JSON_VALUE_FLAGS)) {
+      options.moveJsonPath = requireValue(args, arg, false);
       continue;
     }
     if (arg?.startsWith("--json=")) {
@@ -2354,26 +2821,7 @@ function parseMoveArgs(command, args, jsonOutput, explain) {
   return options;
 }
 function argToMoveKey(arg) {
-  switch (arg) {
-    case "--src":
-      return "src";
-    case "--src-start":
-      return "src_start";
-    case "--src-end":
-      return "src_end";
-    case "--dst":
-      return "dst";
-    case "--payload":
-      return "payload";
-    case "--target-before":
-      return "target_before";
-    case "--target-after":
-      return "target_after";
-    case "--expected-payload-sha256":
-      return "expected_payload_sha256";
-    default:
-      return;
-  }
+  return MOVE_KEY_BY_FLAG[arg];
 }
 function base(command, jsonOutput) {
   return {
@@ -2393,7 +2841,7 @@ function setPatchPath(options, path) {
   options.patchPath = path;
 }
 function parseStripOption(arg, args) {
-  if (arg === "-p" || arg === "--strip") {
+  if (isValueFlag(arg, STRIP_VALUE_FLAGS)) {
     return parseStripComponents(requireValue(args, arg, false), arg);
   }
   if (arg?.startsWith("-p") === true && arg.length > 2) {
@@ -2417,7 +2865,7 @@ function parseStripComponents(value, option) {
 function takeLeadingOutputFlags(args) {
   let jsonOutput = false;
   let explain = false;
-  while (args[0] === "--json-output" || args[0] === "--explain") {
+  while (isOutputFlag(args[0])) {
     const arg = args.shift();
     jsonOutput = true;
     explain = explain || arg === "--explain";
@@ -2425,10 +2873,6 @@ function takeLeadingOutputFlags(args) {
   return { jsonOutput, explain };
 }
 function takeOutputFlag(options, arg) {
-  if (arg === "--json-output") {
-    options.jsonOutput = true;
-    return true;
-  }
   if (arg === "--explain") {
     options.jsonOutput = true;
     if (options.command === "apply" || options.command === "move" || options.command === "plan") {
@@ -2436,8 +2880,18 @@ function takeOutputFlag(options, arg) {
     }
     return true;
   }
+  if (arg === "--json-output") {
+    options.jsonOutput = true;
+    return true;
+  }
   return false;
 }
+function isOutputFlag(arg) {
+  return arg !== undefined && OUTPUT_FLAGS.has(arg);
+}
+function isValueFlag(arg, flags) {
+  return arg !== undefined && flags.has(arg);
+}
 function requireValue(args, option, pathValue) {
   const value = args.shift();
   if (value === undefined) {
@@ -2531,31 +2985,21 @@ function hasJsonOutputFlag(argv) {
   if (command === "plan") {
     return true;
   }
-  return args.includes("--json-output") || args.includes("--explain");
+  return args.some(isOutputFlag);
 }
 function hasPatchJsonOutputFlag(args) {
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--json-output" || arg === "--explain") {
-      return true;
-    }
-    if (arg === "--cwd" || arg === "--directory" || arg === "-d" || arg === "-i" || arg === "--input") {
-      index += 1;
-      continue;
-    }
-    if (arg === "-p" || arg === "--strip") {
-      index += 1;
-    }
-  }
-  return false;
+  return hasJsonOutputAfterValueFlags(args, PATCH_VALUE_FLAGS);
 }
 function hasMoveJsonOutputFlag(args) {
+  return hasJsonOutputAfterValueFlags(args, MOVE_VALUE_FLAGS);
+}
+function hasJsonOutputAfterValueFlags(args, valueFlags) {
   for (let index = 0;index < args.length; index += 1) {
     const arg = args[index];
-    if (arg === "--json-output" || arg === "--explain") {
+    if (isOutputFlag(arg)) {
       return true;
     }
-    if (arg === "--cwd" || arg === "--directory" || arg === "-d" || arg === "--json" || argToMoveKey(arg) !== undefined) {
+    if (isValueFlag(arg, valueFlags)) {
       index += 1;
     }
   }