FrontierCode 式可合并代码任务

diff --git a/src/router/reg-exp-router/prepared-router.ts b/src/router/reg-exp-router/prepared-router.ts
new file mode 100644
--- /dev/null
+++ b/src/router/reg-exp-router/prepared-router.ts
@@ -0,0 +1,167 @@
+import type { ParamIndexMap, Result, Router } from '../../router'
+import {
+  MESSAGE_MATCHER_IS_ALREADY_BUILT,
+  METHOD_NAME_ALL,
+  UnsupportedPathError,
+} from '../../router'
+import type { HandlerData, Matcher, StaticMap } from './matcher'
+import { buildMatch, emptyParam } from './matcher'
+import { MatcherBuilder } from './router'
+
+/**
+ * path => [indexes of the lists that the handlers of the path go into, paramIndexMap of the handlers][]
+ *
+ * The lists matched by the RegExp of the matcher are indexed by number, the static ones by path.
+ */
+type RelocateMap = Record<string, [(number | string)[], ParamIndexMap][]>
+
+/**
+ * RegExpRouter whose routes are compiled at build time by `buildInitParams()`.
+ *
+ * @example
+ * ```ts
+ * // at build time
+ * const params = buildInitParams({ paths: app.routes.map(({ path }) => path) })
+ * const code = `const router = new PreparedRegExpRouter(...${serializeInitParams(params)})`
+ *
+ * // at runtime, with the generated `router`
+ * const app = new Hono({ router })
+ * ```
+ */
+export class PreparedRegExpRouter<T> implements Router<T> {
+  name: string = 'PreparedRegExpRouter'
+  #matchers: Record<string, Matcher<T>> = Object.create(null)
+  #relocateMap?: RelocateMap
+
+  constructor(matcher: Matcher<never>, relocateMap: RelocateMap) {
+    this.#matchers[METHOD_NAME_ALL] = matcher
+    this.#relocateMap = relocateMap
+  }
+
+  add(method: string, path: string, handler: T) {
+    if (!this.#relocateMap) {
+      throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT)
+    }
+
+    const relocations = this.#relocateMap[path]
+    if (!relocations) {
+      throw new Error(
+        `Can not add a route since the path "${path}" was not given to buildInitParams.`
+      )
+    }
+
+    if (!this.#matchers[method]) {
+      // as in RegExpRouter, the lists of a method start with the routes of ALL
+      const [regexp, handlerData, staticMap] = this.#matchers[METHOD_NAME_ALL]
+      const methodStaticMap: StaticMap<T> = Object.create(null)
+      for (const staticPath in staticMap) {
+        methodStaticMap[staticPath] = [staticMap[staticPath][0].slice(), emptyParam]
+      }
+      this.#matchers[method] = [regexp, handlerData.map((list) => list.slice()), methodStaticMap]
+    }
+
+    const matchers =
+      method === METHOD_NAME_ALL ? Object.values(this.#matchers) : [this.#matchers[method]]
+    for (const [indexes, paramIndexMap] of relocations) {
+      const data: [T, ParamIndexMap] = [handler, paramIndexMap]
+      for (const matcher of matchers) {
+        for (const index of indexes) {
+          ;(typeof index === 'number' ? matcher[1][index] : matcher[2][index][0]).push(data)
+        }
+      }
+    }
+  }
+
+  match(method: string, path: string): Result<T> {
+    // Release the relocate map, which is used only by add()
+    this.#relocateMap = undefined
+
+    this.match = buildMatch(this.#matchers)
+    return this.match(method, path)
+  }
+}
+
+/**
+ * Compiles the paths of all the routes of an app into the arguments of `new PreparedRegExpRouter()`.
+ *
+ * @param params.paths - The paths, in any order and with repeats allowed.
+ * @returns The arguments, which serve one router.
+ * @throws {UnsupportedPathError} If the paths cannot share one matcher of RegExpRouter.
+ */
+export const buildInitParams = ({
+  paths,
+}: {
+  paths: string[]
+}): ConstructorParameters<typeof PreparedRegExpRouter> => {
+  const uniquePaths = [...new Set(paths)]
+
+  // compile the paths as the routes of one method, with their indexes as the handlers
+  const builder = new MatcherBuilder<number>()
+  const relocateMap: RelocateMap = Object.create(null)
+  uniquePaths.forEach((path, i) => {
+    builder.add(METHOD_NAME_ALL, path, i)
+    relocateMap[path] = []
+  })
+  const [regexp, handlerData, staticMap] = builder.buildAllMatchers()[
+    METHOD_NAME_ALL
+  ] as Matcher<number>
+
+  // record the lists that the handlers of each path go into, and leave them empty for the router
+  const relocate = (list: HandlerData<number>, index: number | string): HandlerData<never> => {
+    list.forEach(([i, paramIndexMap]) => {
+      if (Object.values(paramIndexMap).some((paramIndex) => paramIndex === undefined)) {
+        // e.g. `:id` of `/posts/:id/edit` is not captured when `/posts/*/new` comes first
+        throw new UnsupportedPathError(uniquePaths[i])
+      }
+
+      const relocations = relocateMap[uniquePaths[i]]
+      const key = JSON.stringify(paramIndexMap)
+      const relocation = relocations.find(([, map]) => JSON.stringify(map) === key)
+      if (relocation) {
+        relocation[0].push(index)
+      } else {
+        relocations.push([[index], paramIndexMap])
+      }
+    })
…… 其余 610 行从略（共改动 5 个文件）

diff --git a/src/router/reg-exp-router/prepared-router.ts b/src/router/reg-exp-router/prepared-router.ts
new file mode 100644
--- /dev/null
+++ b/src/router/reg-exp-router/prepared-router.ts
@@ -0,0 +1,182 @@
+import type { ParamIndexMap, Result, Router } from '../../router'
+import { METHOD_NAME_ALL } from '../../router'
+import { checkOptionalParameter } from '../../utils/url'
+import type { HandlerData, HandlerWithMetadata, Matcher, MatcherMap, StaticMap } from './matcher'
+import {
+  buildMatch,
+  buildMatcherFromPreprocessedRoutes,
+  buildWildcardRegExp,
+  clearWildcardRegExpCache,
+  emptyParam,
+} from './matcher'
+
+type Target = number | string // index of a handler list in Matcher[1], or a key of Matcher[2]
+// path -> the handler lists that handlers for the path are added to, with their ParamIndexMap
+type RelocateMap = Record<string, [Target[], ParamIndexMap][]>
+
+function cloneMatcher<T>([regexp, handlerMap, staticMap]: Matcher<T>): Matcher<T> {
+  const clonedStaticMap: StaticMap<T> = Object.create(null)
+  for (const path in staticMap) {
+    clonedStaticMap[path] = [[...staticMap[path][0]], emptyParam]
+  }
+  return [regexp, handlerMap.map((handlerData) => [...handlerData]), clonedStaticMap]
+}
+
+/**
+ * A router that matches like `RegExpRouter`, with its matcher compiled ahead of time by
+ * `buildInitParams()`, so that creating it, adding routes and matching compile nothing.
+ *
+ * All methods share the prepared matcher: a request whose best-matching path was added only for
+ * other methods gets just the wildcard routes of its method and `ALL` covering that path.
+ *
+ * @example
+ * ```ts
+ * const createApp = (router: Hono['router']) => new Hono({ router }).get('/posts/:id', handler)
+ *
+ * // At build time, compile the paths of the application
+ * const paths = createApp(new RegExpRouter()).routes.map(({ path }) => path)
+ * const serialized = serializeInitParams(buildInitParams({ paths }))
+ *
+ * // At runtime, in the code generated with `serialized`
+ * const app = createApp(new PreparedRegExpRouter(...<serialized>))
+ * ```
+ */
+export class PreparedRegExpRouter<T> implements Router<T> {
+  name: string = 'PreparedRegExpRouter'
+  #matchers: MatcherMap<T> = Object.create(null)
+  #relocateMap: RelocateMap
+
+  constructor(matcher: Matcher<never>, relocateMap: RelocateMap) {
+    this.#matchers[METHOD_NAME_ALL] = matcher
+    this.#relocateMap = relocateMap
+  }
+
+  add(method: string, path: string, handler: T) {
+    const relocation = this.#relocateMap[path]
+    if (!relocation) {
+      throw new Error(`Can not add a route since the path is not prepared: ${path}`)
+    }
+
+    const matchers = this.#matchers
+    // like RegExpRouter, a method starts with the handlers added for ALL so far
+    matchers[method] ||= cloneMatcher(matchers[METHOD_NAME_ALL] as Matcher<T>)
+
+    for (const m of method === METHOD_NAME_ALL ? Object.keys(matchers) : [method]) {
+      const [, handlerMap, staticMap] = matchers[m] as Matcher<T>
+      for (const [targets, paramIndexMap] of relocation) {
+        for (const target of targets) {
+          const handlerData = typeof target === 'number' ? handlerMap[target] : staticMap[target][0]
+          handlerData.push([handler, paramIndexMap])
+        }
+      }
+    }
+  }
+
+  match(method: string, path: string): Result<T> {
+    this.match = buildMatch(this.#matchers)
+
+    return this.match(method, path)
+  }
+}
+
+/**
+ * Compiles the paths of the routes of an application into the parameters of `PreparedRegExpRouter`.
+ *
+ * @param {object} options - The options.
+ * @param {string[]} options.paths - The paths the routes will be added with, in any order. Repeats are allowed.
+ * @returns {ConstructorParameters<typeof PreparedRegExpRouter>} The parameters for `new PreparedRegExpRouter(...params)`, serving one router.
+ * @throws {UnsupportedPathError} If the paths can not share one matcher of `RegExpRouter`.
+ */
+export function buildInitParams({
+  paths,
+}: {
+  paths: string[]
+}): ConstructorParameters<typeof PreparedRegExpRouter> {
+  // Build the handler lists as RegExpRouter does for routes added for ALL, with paths as handlers
+  const routes: Record<string, HandlerWithMetadata<string>[]> = Object.create(null)
+  const wildcards: [string, RegExp, number][] = []
+  for (const path of new Set(paths)) {
+    const routePath = path === '/*' ? '*' : path
+    const paramCount = (routePath.match(/\/:/g) || []).length
+    if (/\*$/.test(routePath)) {
+      routes[routePath] ||= []
+      wildcards.push([path, buildWildcardRegExp(routePath), paramCount])
+    } else {
+      const routePaths = checkOptionalParameter(routePath) || [routePath]
+      routePaths.forEach((p, i) => {
+        ;(routes[p] ||= []).push([path, paramCount - routePaths.length + i + 1])
+      })
+    }
+  }
+  for (const [path, re, paramCount] of wildcards) {
+    for (const p in routes) {
+      if (re.test(p)) {
+        routes[p].push([path, paramCount])
+      }
+    }
+  }
+  clearWildcardRegExpCache()
+
+  const [regexp, handlerMap, staticMap] = buildMatcherFromPreprocessedRoutes(Object.entries(routes))
+
+  // Record the handler lists each path is added to, and leave the lists empty for the router.
+  // Lists sharing the same ParamIndexMap are grouped to keep the serialized params small.
+  const relocateMap: RelocateMap = Object.create(null)
+  for (const path of paths) {
…… 其余 720 行从略（共改动 5 个文件）

diff --git a/lib/css/CssServerStylesRuntimeModule.js b/lib/css/CssServerStylesRuntimeModule.js
new file mode 100644
--- /dev/null
+++ b/lib/css/CssServerStylesRuntimeModule.js
@@ -0,0 +1,38 @@
+/*
+	MIT License http://www.opensource.org/licenses/mit-license.php
+*/
+
+"use strict";
+
+const RuntimeGlobals = require("../RuntimeGlobals");
+const RuntimeModule = require("../RuntimeModule");
+
+/** @typedef {import("../Compilation")} Compilation */
+
+class CssServerStylesRuntimeModule extends RuntimeModule {
+	constructor() {
+		super("css server styles");
+	}
+
+	/**
+	 * Generates runtime code for this runtime module.
+	 * @returns {string | null} runtime code
+	 */
+	generate() {
+		const { runtimeTemplate } = /** @type {Compilation} */ (this.compilation);
+
+		return `${RuntimeGlobals.cssServerStyles} = ${runtimeTemplate.basicFunction(
+			"",
+			[
+				`${runtimeTemplate.renderConst()} registry = ${runtimeTemplate.cssServerStyleRegistry(false)};`,
+				// keys are never array indices, so they list in insertion order; a chunk still loading holds ""
+				`return registry ? Object.keys(registry).map(${runtimeTemplate.returningFunction(
+					"registry[key]",
+					"key"
+				)}).filter(Boolean).join("\\n") : "";`
+			]
+		)};`;
+	}
+}
+
+module.exports = CssServerStylesRuntimeModule;
diff --git a/lib/APIPlugin.js b/lib/APIPlugin.js
--- a/lib/APIPlugin.js
+++ b/lib/APIPlugin.js
@@ -14,6 +14,7 @@ const {
 	JAVASCRIPT_MODULE_TYPE_ESM
 } = require("./ModuleTypeConstants");
 const RuntimeGlobals = require("./RuntimeGlobals");
+const CssServerStylesRuntimeModule = require("./css/CssServerStylesRuntimeModule");
 const ConstDependency = require("./dependencies/ConstDependency");
 const ModuleInitFragmentDependency = require("./dependencies/ModuleInitFragmentDependency");
 const RuntimeRequirementsDependency = require("./dependencies/RuntimeRequirementsDependency");
@@ -113,6 +114,12 @@ function getReplacements() {
 			type: "string",
 			assign: false
 		},
+		__webpack_css_server_styles__: {
+			expr: `${RuntimeGlobals.cssServerStyles}()`,
+			req: [RuntimeGlobals.cssServerStyles],
+			type: "string",
+			assign: false
+		},
 		__webpack_get_script_filename__: {
 			expr: RuntimeGlobals.getChunkScriptFilename,
 			req: [RuntimeGlobals.getChunkScriptFilename],
@@ -172,6 +179,11 @@ class APIPlugin {
 					REPLACEMENTS.__non_webpack_require__.expr =
 						"__WEBPACK_EXTERNAL_createRequire_require";
 				}
+				// only universal targets collect styles outside of a document
+				if (!compilation.runtimeTemplate.isNeutralPlatform()) {
+					REPLACEMENTS.__webpack_css_server_styles__.expr = '""';
+					REPLACEMENTS.__webpack_css_server_styles__.req = null;
+				}
 
 				compilation.dependencyTemplates.set(
 					ConstDependency,
@@ -199,6 +211,19 @@ class APIPlugin {
 						return true;
 					});
 
+				compilation.hooks.runtimeRequirementInTree
+					.for(RuntimeGlobals.cssServerStyles)
+					.tap(PLUGIN_NAME, (chunk, set) => {
+						if (!compilation.outputOptions.environment.globalThis) {
+							set.add(RuntimeGlobals.global);
+						}
+						compilation.addRuntimeModule(
+							chunk,
+							new CssServerStylesRuntimeModule()
+						);
+						return true;
+					});
+
 				const hooks = JavascriptModulesPlugin.getCompilationHooks(compilation);
 
 				hooks.renderModuleContent.tap(
diff --git a/lib/RuntimeTemplate.js b/lib/RuntimeTemplate.js
--- a/lib/RuntimeTemplate.js
+++ b/lib/RuntimeTemplate.js
@@ -191,16 +191,23 @@ class RuntimeTemplate {
 
 	/**
 	 * Expression for the global registry that collects CSS server-side when there
-	 * is no DOM (SSR). An SSR host reads it from `globalThis`; it is keyed by the
-	 * style/chunk identifier and namespaced by `output.uniqueName`.
+	 * is no DOM (SSR). It is keyed by the style/chunk identifier and namespaced by
+	 * `output.uniqueName`. It lives on `globalThis`, or on `RuntimeGlobals.global`
+	 * (which the caller then has to require) when the environment has no `globalThis`.
+	 * @param {boolean=} create false to only read it (`undefined` while nothing was collected)
 	 * @returns {string} runtime expression evaluating to the registry object
 	 */
-	cssServerStyleRegistry() {
+	cssServerStyleRegistry(create = true) {
 		const name = this.outputOptions.uniqueName;
 		const key = JSON.stringify(
 			name ? `__webpack_css__${name}` : "__webpack_css__"
 		);
-		return `(${this.assignOr(`globalThis[${key}]`, "{}")})`;
+		const registry = `${
+			this.outputOptions.environment.globalThis
+				? "globalThis"
+				: RuntimeGlobals.global
+		}[${key}]`;
+		return create ? `(${this.assignOr(registry, "{}")})` : registry;
 	}
 
 	supportsConst() {
…… 其余 1,045 行从略（共改动 61 个文件）

diff --git a/lib/css/CssServerStylesRuntimeModule.js b/lib/css/CssServerStylesRuntimeModule.js
new file mode 100644
--- /dev/null
+++ b/lib/css/CssServerStylesRuntimeModule.js
@@ -0,0 +1,41 @@
+/*
+	MIT License http://www.opensource.org/licenses/mit-license.php
+*/
+
+"use strict";
+
+const RuntimeGlobals = require("../RuntimeGlobals");
+const RuntimeModule = require("../RuntimeModule");
+
+/** @typedef {import("../Compilation")} Compilation */
+
+class CssServerStylesRuntimeModule extends RuntimeModule {
+	constructor() {
+		super("css server styles");
+	}
+
+	/**
+	 * Generates runtime code for this runtime module.
+	 * @returns {string | null} runtime code
+	 */
+	generate() {
+		const { runtimeTemplate } = /** @type {Compilation} */ (this.compilation);
+		// only universal targets collect styles
+		if (!runtimeTemplate.isNeutralPlatform()) {
+			return `${RuntimeGlobals.cssServerStyles} = ${runtimeTemplate.returningFunction('""')};`;
+		}
+		return `${RuntimeGlobals.cssServerStyles} = ${runtimeTemplate.basicFunction(
+			"",
+			[
+				`${runtimeTemplate.renderConst()} registry = ${runtimeTemplate.cssServerStyleRegistry(false)};`,
+				// keys are never array indices, so they enumerate in the order the styles were applied
+				`return Object.keys(registry).map(${runtimeTemplate.returningFunction(
+					"registry[key]",
+					"key"
+				)}).filter(Boolean).join("\\n");`
+			]
+		)};`;
+	}
+}
+
+module.exports = CssServerStylesRuntimeModule;
diff --git a/lib/APIPlugin.js b/lib/APIPlugin.js
--- a/lib/APIPlugin.js
+++ b/lib/APIPlugin.js
@@ -14,6 +14,7 @@ const {
 	JAVASCRIPT_MODULE_TYPE_ESM
 } = require("./ModuleTypeConstants");
 const RuntimeGlobals = require("./RuntimeGlobals");
+const CssServerStylesRuntimeModule = require("./css/CssServerStylesRuntimeModule");
 const ConstDependency = require("./dependencies/ConstDependency");
 const ModuleInitFragmentDependency = require("./dependencies/ModuleInitFragmentDependency");
 const RuntimeRequirementsDependency = require("./dependencies/RuntimeRequirementsDependency");
@@ -107,6 +108,12 @@ function getReplacements() {
 			type: "string",
 			assign: false
 		},
+		__webpack_css_server_styles__: {
+			expr: `${RuntimeGlobals.cssServerStyles}()`,
+			req: [RuntimeGlobals.cssServerStyles],
+			type: "string",
+			assign: false
+		},
 		__webpack_chunkname__: {
 			expr: RuntimeGlobals.chunkName,
 			req: [RuntimeGlobals.chunkName],
@@ -199,6 +206,21 @@ class APIPlugin {
 						return true;
 					});
 
+				compilation.hooks.runtimeRequirementInTree
+					.for(RuntimeGlobals.cssServerStyles)
+					.tap(PLUGIN_NAME, (chunk, set) => {
+						if (
+							compilation.runtimeTemplate.cssServerStyleRegistryNeedsGlobal()
+						) {
+							set.add(RuntimeGlobals.global);
+						}
+						compilation.addRuntimeModule(
+							chunk,
+							new CssServerStylesRuntimeModule()
+						);
+						return true;
+					});
+
 				const hooks = JavascriptModulesPlugin.getCompilationHooks(compilation);
 
 				hooks.renderModuleContent.tap(
diff --git a/lib/RuntimeTemplate.js b/lib/RuntimeTemplate.js
--- a/lib/RuntimeTemplate.js
+++ b/lib/RuntimeTemplate.js
@@ -191,16 +191,33 @@ class RuntimeTemplate {
 
 	/**
 	 * Expression for the global registry that collects CSS server-side when there
-	 * is no DOM (SSR). An SSR host reads it from `globalThis`; it is keyed by the
-	 * style/chunk identifier and namespaced by `output.uniqueName`.
+	 * is no DOM (SSR), read back through `__webpack_css_server_styles__`. It is
+	 * keyed by the style/chunk identifier and namespaced by `output.uniqueName`.
+	 * @param {boolean=} create false to read the registry without creating it
 	 * @returns {string} runtime expression evaluating to the registry object
 	 */
-	cssServerStyleRegistry() {
+	cssServerStyleRegistry(create = true) {
 		const name = this.outputOptions.uniqueName;
 		const key = JSON.stringify(
 			name ? `__webpack_css__${name}` : "__webpack_css__"
 		);
-		return `(${this.assignOr(`globalThis[${key}]`, "{}")})`;
+		const slot = `${
+			this.outputOptions.environment.globalThis
+				? "globalThis"
+				: RuntimeGlobals.global
+		}[${key}]`;
+		return `(${create ? this.assignOr(slot, "{}") : `${slot} || {}`})`;
+	}
+
+	/**
+	 * Whether `cssServerStyleRegistry()` reaches the global object through
+	 * `RuntimeGlobals.global`, which its runtime module then has to require.
+	 * @returns {boolean} true when `RuntimeGlobals.global` is needed
+	 */
+	cssServerStyleRegistryNeedsGlobal() {
+		return (
+			this.isNeutralPlatform() && !this.outputOptions.environment.globalThis
+		);
…… 其余 1,050 行从略（共改动 67 个文件）

diff --git a/pydantic/_internal/_decorators.py b/pydantic/_internal/_decorators.py
--- a/pydantic/_internal/_decorators.py
+++ b/pydantic/_internal/_decorators.py
@@ -6,10 +6,11 @@ import sys
 import types
 from collections import deque
 from collections.abc import Iterable
+from copy import copy
 from dataclasses import dataclass, field
 from functools import cached_property, partial, partialmethod
 from inspect import Parameter, Signature, isdatadescriptor, ismethoddescriptor, signature
-from itertools import islice
+from itertools import chain, islice
 from typing import TYPE_CHECKING, Any, Callable, ClassVar, Generic, Literal, TypeVar, Union
 
 from pydantic_core import PydanticUndefined, PydanticUndefinedType, core_schema
@@ -428,9 +429,9 @@ class DecoratorInfos:
     computed_fields: dict[str, Decorator[ComputedFieldInfo]] = field(default_factory=dict)
 
     @staticmethod
-    def build(model_dc: type[Any]) -> DecoratorInfos:  # noqa: C901 (ignore complexity)
+    def build(model_dc: type[Any], *, replace_wrapped: bool = False) -> DecoratorInfos:
         """We want to collect all DecFunc instances that exist as
-        attributes in the namespace of the class (a BaseModel or dataclass)
+        attributes in the namespace of the class (a BaseModel, dataclass or TypedDict)
         that called us
         But we want to collect these in the order of the bases
         So instead of getting them all from the leaf class (the class that called us),
@@ -440,13 +441,36 @@ class DecoratorInfos:
         works with inheritance.
         If we do replace any functions we put the replacement into the position
         the replaced function was in; that is, we maintain the order.
+
+        Each base is only processed once: Pydantic models and Pydantic dataclasses already
+        store their decorators (including the inherited ones) in `__pydantic_decorators__`,
+        and for the other bases (which we don't own, and as such don't modify), we collect
+        the decorators defined in their own namespace. The collected decorators are bound to
+        the class.
+
+        Args:
+            model_dc: The class to collect the decorators of.
+            replace_wrapped: Whether to replace the decorated attributes of the class by the objects they wrap,
+                which allows validator class methods to also function as regular class methods, and computed
+                field setters to be used. Decorated attributes inherited from bases that aren't Pydantic models
+                or Pydantic dataclasses are set on the class instead, leaving these bases untouched. As the
+                decorators can't be collected again from the class afterwards, this should only be enabled for
+                classes owned by Pydantic, which store the result in `__pydantic_decorators__`.
+
+        Returns:
+            The collected decorators.
         """
         # reminder: dicts are ordered and replacement does not alter the order
         res = DecoratorInfos()
-        for base in reversed(mro(model_dc)[1:]):
+        model_mro = mro(model_dc)
+        # bases might not be hashable, so we key them by id:
+        bases_decorators: dict[int, DecoratorInfos] = {}
+        for base in reversed(model_mro[1:]):
             existing: DecoratorInfos | None = base.__dict__.get('__pydantic_decorators__')
             if existing is None:
-                existing = DecoratorInfos.build(base)
+                existing = DecoratorInfos()
+                existing._add_namespace_decorators(base, bases_decorators)
+            bases_decorators[id(base)] = existing
             res.validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.validators.items()})
             res.field_validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.field_validators.items()})
             res.root_validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.root_validators.items()})
diff --git a/pydantic/dataclasses.py b/pydantic/dataclasses.py
--- a/pydantic/dataclasses.py
+++ b/pydantic/dataclasses.py
@@ -183,8 +183,6 @@ def dataclass(
         # if config is not explicitly provided, try to read it from the type
         config_dict = config if config is not None else getattr(cls, '__pydantic_config__', None)
         config_wrapper = _config.ConfigWrapper(config_dict)
-        decorators = _decorators.DecoratorInfos.build(cls)
-        decorators.update_from_config(config_wrapper)
 
         # Keep track of the original __doc__ so that we can restore it after applying the dataclasses decorator
         # Otherwise, classes with no __doc__ will have their signature added into the JSON schema description,
@@ -205,6 +203,11 @@ def dataclass(
                 bases = bases + (generic_base,)
             cls = types.new_class(cls.__name__, bases)
 
+        # The decorators are collected after subclassing stdlib dataclasses, so that the decorated
+        # attributes are replaced on the subclass (and not on the original class):
+        decorators = _decorators.DecoratorInfos.build(cls, replace_wrapped=True)
+        decorators.update_from_config(config_wrapper)
+
         # Respect frozen setting from dataclass constructor and fallback to config setting if not provided
         if frozen is not None:
             frozen_ = frozen
diff --git a/pydantic/_internal/_model_construction.py b/pydantic/_internal/_model_construction.py
--- a/pydantic/_internal/_model_construction.py
+++ b/pydantic/_internal/_model_construction.py
@@ -172,7 +172,7 @@ class ModelMetaclass(ABCMeta):
 
             cls.__pydantic_setattr_handlers__ = {}
 
-            cls.__pydantic_decorators__ = DecoratorInfos.build(cls)
+            cls.__pydantic_decorators__ = DecoratorInfos.build(cls, replace_wrapped=True)
             cls.__pydantic_decorators__.update_from_config(config_wrapper)
 
             # Use the getattr below to grab the __parameters__ from the `typing.Generic` parent class
diff --git a/tests/test_computed_fields.py b/tests/test_computed_fields.py
--- a/tests/test_computed_fields.py
+++ b/tests/test_computed_fields.py
@@ -853,3 +853,24 @@ def test_computed_fields_exclude() -> None:
     assert m.model_dump(mode='json', exclude_computed_fields=True) == {}
     assert m.model_dump_json() == '{"prop":1}'
     assert m.model_dump_json(exclude_computed_fields=True) == '{}'
+
+
+def test_computed_field_config_not_shared_with_parent() -> None:
+    class Parent(BaseModel):
+        model_config = {'defer_build': True}
+
+        @computed_field
+        @property
+        def my_field(self) -> int:
+            return 1
+
+    class Child(Parent):
+        model_config = {'alias_generator': to_camel, 'field_title_generator': lambda name, _: name.upper()}
+
+    assert Parent.model_computed_fields['my_field'].alias is None
+    assert Parent.model_computed_fields['my_field'].title is None
+    assert Parent().model_dump(by_alias=True) == {'my_field': 1}
+
+    assert Child.model_computed_fields['my_field'].alias == 'myField'
+    assert Child.model_computed_fields['my_field'].title == 'MY_FIELD'
…… 其余 340 行从略（共改动 7 个文件）

diff --git a/pydantic/_internal/_decorators.py b/pydantic/_internal/_decorators.py
--- a/pydantic/_internal/_decorators.py
+++ b/pydantic/_internal/_decorators.py
@@ -428,25 +428,44 @@ class DecoratorInfos:
     computed_fields: dict[str, Decorator[ComputedFieldInfo]] = field(default_factory=dict)
 
     @staticmethod
-    def build(model_dc: type[Any]) -> DecoratorInfos:  # noqa: C901 (ignore complexity)
-        """We want to collect all DecFunc instances that exist as
-        attributes in the namespace of the class (a BaseModel or dataclass)
-        that called us
-        But we want to collect these in the order of the bases
-        So instead of getting them all from the leaf class (the class that called us),
-        we traverse the bases from root (the oldest ancestor class) to leaf
-        and collect all of the instances as we go, taking care to replace
-        any duplicate ones with the last one we see to mimic how function overriding
-        works with inheritance.
-        If we do replace any functions we put the replacement into the position
-        the replaced function was in; that is, we maintain the order.
+    def build(model_dc: type[Any], *, unwrap_attributes: bool = False) -> DecoratorInfos:
+        """Collect the decorators of a class (a model, dataclass or typed dictionary), including the inherited ones.
+
+        We want to collect the decorators in the order of the bases. So instead of getting them all from the
+        class itself, we traverse the bases from root (the oldest ancestor class) to leaf, processing each base once,
+        and collect the decorators as we go, taking care to replace any duplicate ones with the last one we see to
+        mimic how function overriding works with inheritance. If we do replace any decorators we put the replacement
+        into the position the replaced decorator was in; that is, we maintain the order.
+
+        Pydantic models and dataclasses provide their collected decorators (which include the inherited ones) as
+        `__pydantic_decorators__`, while the decorators of other classes are collected from their namespace. Classes
+        not owned by Pydantic (e.g. typed dictionaries, stdlib dataclasses or plain classes used as bases) are left
+        untouched.
+
+        Args:
+            model_dc: The class to collect the decorators of.
+            unwrap_attributes: Whether to replace the decorated attributes of the class by the objects they wrap,
+                which allows validator class methods to also function as regular class methods and computed field
+                setters to be used. Decorated attributes inherited from classes not owned by Pydantic are replaced
+                on the class as well. As the class is modified, this must only be used for Pydantic models and
+                dataclasses.
+
+        Returns:
+            The decorators of the class, bound to it.
         """
         # reminder: dicts are ordered and replacement does not alter the order
         res = DecoratorInfos()
-        for base in reversed(mro(model_dc)[1:]):
+        model_dc_mro = mro(model_dc)
+        # the decorators provided by each base:
+        bases_decorators: dict[Any, DecoratorInfos] = {}
+        # the names of the decorated attributes defined in the namespace of the class and of the bases we don't own:
+        decorated_names: list[str] = []
+        for base in reversed(model_dc_mro[1:]):
             existing: DecoratorInfos | None = base.__dict__.get('__pydantic_decorators__')
             if existing is None:
-                existing = DecoratorInfos.build(base)
+                existing = DecoratorInfos()
+                decorated_names += existing._add_from_namespace(base, bases_decorators)
+            bases_decorators[base] = existing
             res.validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.validators.items()})
             res.field_validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.field_validators.items()})
             res.root_validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.root_validators.items()})
@@ -455,26 +474,55 @@ class DecoratorInfos:
             res.model_validators.update({k: v.bind_to_cls(model_dc) for k, v in existing.model_validators.items()})
             res.computed_fields.update({k: v.bind_to_cls(model_dc) for k, v in existing.computed_fields.items()})
 
-        to_replace: list[tuple[str, Any]] = []
+        decorated_names += res._add_from_namespace(model_dc, bases_decorators)
+
+        if unwrap_attributes:
+            for var_name in decorated_names:
+                # the decorated attribute is either defined on the class or inherited from a class we don't own:
+                attribute = next(base.__dict__[var_name] for base in model_dc_mro if var_name in base.__dict__)
+                if isinstance(attribute, PydanticDescriptorProxy):
+                    setattr(model_dc, var_name, attribute.wrapped)
+        return res
+
+    def _add_from_namespace(self, tp: type[Any], bases_decorators: dict[Any, DecoratorInfos]) -> list[str]:
+        """Add the decorators defined in the namespace of a class (i.e. not the inherited ones), bound to the class.
+
+        Args:
+            tp: The class to collect the decorators of.
+            bases_decorators: The decorators provided by each base of the class, used to check that each field
+                has at most one serializer function.
+
+        Returns:
+            The names of the decorated attributes defined in the namespace of the class.
 
-        for var_name, var_value in vars(model_dc).items():
+        Raises:
+            PydanticUserError: If the class defines a serializer function for a field that already has one.
+        """
+        decorated_names: list[str] = []
+        # the field serializers of the class, including the inherited ones (only computed if needed):
+        field_serializers: dict[str, Decorator[FieldSerializerDecoratorInfo]] | None = None
+        for var_name, var_value in vars(tp).items():
             if isinstance(var_value, PydanticDescriptorProxy):
                 info = var_value.decorator_info
                 if isinstance(info, ValidatorDecoratorInfo):
-                    res.validators[var_name] = Decorator.build(
-                        model_dc, cls_var_name=var_name, shim=var_value.shim, info=info
+                    self.validators[var_name] = Decorator.build(
+                        tp, cls_var_name=var_name, shim=var_value.shim, info=info
                     )
                 elif isinstance(info, FieldValidatorDecoratorInfo):
-                    res.field_validators[var_name] = Decorator.build(
-                        model_dc, cls_var_name=var_name, shim=var_value.shim, info=info
+                    self.field_validators[var_name] = Decorator.build(
+                        tp, cls_var_name=var_name, shim=var_value.shim, info=info
                     )
                 elif isinstance(info, RootValidatorDecoratorInfo):
-                    res.root_validators[var_name] = Decorator.build(
-                        model_dc, cls_var_name=var_name, shim=var_value.shim, info=info
+                    self.root_validators[var_name] = Decorator.build(
+                        tp, cls_var_name=var_name, shim=var_value.shim, info=info
                     )
                 elif isinstance(info, FieldSerializerDecoratorInfo):
+                    if field_serializers is None:
+                        field_serializers = {}
+                        for base in reversed(mro(tp)[1:]):
+                            field_serializers.update(bases_decorators[base].field_serializers)
                     # check whether a serializer function is already registered for fields
-                    for field_serializer_decorator in res.field_serializers.values():
+                    for field_serializer_decorator in field_serializers.values():
                         # check that each field has at most one serializer function.
                         # serializer functions for the same field in subclasses are allowed,
                         # and are treated as overrides
…… 其余 411 行从略（共改动 8 个文件）

diff --git a/include/spdlog/details/file_helper-inl.h b/include/spdlog/details/file_helper-inl.h
--- a/include/spdlog/details/file_helper-inl.h
+++ b/include/spdlog/details/file_helper-inl.h
@@ -12,20 +12,29 @@
 
 #include <cerrno>
 #include <cstdio>
+#include <limits>
 #include <string>
 #include <tuple>
 
 SPDLOG_NAMESPACE_BEGIN
 namespace details {
 
-SPDLOG_INLINE file_helper::file_helper(const file_event_handlers &event_handlers)
-    : event_handlers_(event_handlers) {}
+SPDLOG_INLINE file_helper::file_helper(const file_event_handlers &event_handlers,
+                                       size_t buffer_size)
+    : event_handlers_(event_handlers) {
+    set_buffer_size(buffer_size);
+}
 
 SPDLOG_INLINE file_helper::~file_helper() { close(); }
 
 SPDLOG_INLINE void file_helper::open(const filename_t &fname, bool truncate) {
     close();
     filename_ = fname;
+    // no file uses the buffer now: size it for the new file.
+    const auto alloc_size = buffer_alloc_size_(buffer_size_);
+    if (buffer_.size() != alloc_size) {
+        buffer_ = std::vector<char>(alloc_size);
+    }
 
     auto *mode = SPDLOG_FILENAME_T("ab");
     auto *trunc_mode = SPDLOG_FILENAME_T("wb");
@@ -48,6 +57,13 @@ SPDLOG_INLINE void file_helper::open(const filename_t &fname, bool truncate) {
             std::fclose(tmp);
         }
         if (!os::fopen_s(&fd_, fname, mode)) {
+            // setvbuf() must come before any other operation on the file, after_open's included.
+            if (!buffer_.empty() &&
+                std::setvbuf(fd_, buffer_.data(), _IOFBF, buffer_.size()) != 0) {
+                std::fclose(fd_);
+                fd_ = nullptr;
+                throw_spdlog_ex("Failed setting buffer of file " + os::filename_to_str(filename_));
+            }
             if (event_handlers_.after_open) {
                 event_handlers_.after_open(filename_, fd_);
             }
@@ -114,6 +130,36 @@ SPDLOG_INLINE size_t file_helper::size() const {
 
 SPDLOG_INLINE const filename_t &file_helper::filename() const { return filename_; }
 
+SPDLOG_INLINE void file_helper::set_buffer_size(size_t buffer_size) {
+    // MSVC and the BSD libcs (e.g. macOS) limit setvbuf() to INT_MAX bytes
+    if (buffer_size > static_cast<size_t>((std::numeric_limits<int>::max)())) {
+        throw_spdlog_ex("Invalid file buffer size " + std::to_string(buffer_size) +
+                        ": cannot exceed INT_MAX");
+    }
+    const auto alloc_size = buffer_alloc_size_(buffer_size);
+    if (fd_ != nullptr && alloc_size != 0 && alloc_size != buffer_.size()) {
+        std::vector<char> buffer(alloc_size);
+        flush();
+        // On a stream that was written to, glibc stays in write mode across setvbuf() with an
+        // empty put area, so the second write after it flushes the first one. A no-op seek leaves
+        // write mode (even where seeking fails, e.g. on pipes) and avoids that.
+        (void)std::fseek(fd_, 0, SEEK_CUR);
+        if (std::setvbuf(fd_, buffer.data(), _IOFBF, buffer.size()) != 0) {
+            throw_spdlog_ex("Failed setting buffer of file " + os::filename_to_str(filename_));
+        }
+        // the old buffer is released only now that the file no longer uses it.
+        buffer_.swap(buffer);
+    }
+    buffer_size_ = buffer_size;
+}
+
+SPDLOG_INLINE size_t file_helper::buffer_size() const { return buffer_size_; }
+
+// setvbuf() rejects buffers smaller than 2 bytes on MSVC and ignores those smaller than 8 on musl
+SPDLOG_INLINE size_t file_helper::buffer_alloc_size_(size_t buffer_size) {
+    return buffer_size == 0 || buffer_size >= 8 ? buffer_size : 8;
+}
+
 //
 // return file path and its extension:
 //
diff --git a/include/spdlog/sinks/daily_file_sink.h b/include/spdlog/sinks/daily_file_sink.h
--- a/include/spdlog/sinks/daily_file_sink.h
+++ b/include/spdlog/sinks/daily_file_sink.h
@@ -62,6 +62,8 @@ struct daily_filename_format_calculator {
  * Rotating file sink based on date.
  * If truncate != false , the created file will be truncated.
  * If max_files > 0, retain only the last max_files and delete previous.
+ * If buffer_size > 0, the files are fully buffered with a buffer of buffer_size bytes: output
+ * reaches a file when the buffer fills up, on flush or when the file is closed.
  * Note that old log files from previous executions will not be deleted by this class,
  * rotation and deletion is only applied while the program is running.
  */
@@ -74,11 +76,12 @@ public:
                     int rotation_minute,
                     bool truncate = false,
                     uint16_t max_files = 0,
-                    const file_event_handlers &event_handlers = {})
+                    const file_event_handlers &event_handlers = {},
+                    size_t buffer_size = 0)
         : base_filename_(std::move(base_filename)),
           rotation_h_(rotation_hour),
           rotation_m_(rotation_minute),
-          file_helper_{event_handlers},
+          file_helper_{event_handlers, buffer_size},
           truncate_(truncate),
           max_files_(max_files),
           filenames_q_() {
diff --git a/include/spdlog/sinks/basic_file_sink-inl.h b/include/spdlog/sinks/basic_file_sink-inl.h
--- a/include/spdlog/sinks/basic_file_sink-inl.h
+++ b/include/spdlog/sinks/basic_file_sink-inl.h
@@ -16,8 +16,9 @@ namespace sinks {
 template <typename Mutex>
 SPDLOG_INLINE basic_file_sink<Mutex>::basic_file_sink(const filename_t &filename,
                                                       bool truncate,
-                                                      const file_event_handlers &event_handlers)
-    : file_helper_{event_handlers} {
+                                                      const file_event_handlers &event_handlers,
+                                                      size_t buffer_size)
+    : file_helper_{event_handlers, buffer_size} {
     file_helper_.open(filename, truncate);
 }
 
…… 其余 678 行从略（共改动 11 个文件）

diff --git a/include/spdlog/details/file_helper-inl.h b/include/spdlog/details/file_helper-inl.h
--- a/include/spdlog/details/file_helper-inl.h
+++ b/include/spdlog/details/file_helper-inl.h
@@ -12,14 +12,18 @@
 
 #include <cerrno>
 #include <cstdio>
+#include <limits>
 #include <string>
 #include <tuple>
 
 SPDLOG_NAMESPACE_BEGIN
 namespace details {
 
-SPDLOG_INLINE file_helper::file_helper(const file_event_handlers &event_handlers)
-    : event_handlers_(event_handlers) {}
+SPDLOG_INLINE file_helper::file_helper(const file_event_handlers &event_handlers,
+                                       size_t buffer_size)
+    : event_handlers_(event_handlers) {
+    set_buffer_size(buffer_size);
+}
 
 SPDLOG_INLINE file_helper::~file_helper() { close(); }
 
@@ -48,6 +52,9 @@ SPDLOG_INLINE void file_helper::open(const filename_t &fname, bool truncate) {
             std::fclose(tmp);
         }
         if (!os::fopen_s(&fd_, fname, mode)) {
+            if (buffer_size_ > 0) {
+                install_buffer_(buffer_size_);
+            }
             if (event_handlers_.after_open) {
                 event_handlers_.after_open(filename_, fd_);
             }
@@ -88,6 +95,7 @@ SPDLOG_INLINE void file_helper::close() {
 
         std::fclose(fd_);
         fd_ = nullptr;
+        buffer_.reset();
 
         if (event_handlers_.after_close) {
             event_handlers_.after_close(filename_);
@@ -114,6 +122,39 @@ SPDLOG_INLINE size_t file_helper::size() const {
 
 SPDLOG_INLINE const filename_t &file_helper::filename() const { return filename_; }
 
+SPDLOG_INLINE void file_helper::set_buffer_size(size_t buffer_size) {
+    // accept the sizes setvbuf() supports everywhere: the Windows C runtime rejects sizes out of
+    // [2, INT_MAX] through its invalid parameter handler, which terminates the program by default.
+    if (buffer_size == 1 || buffer_size > static_cast<size_t>((std::numeric_limits<int>::max)())) {
+        throw_spdlog_ex("Invalid file buffer size " + std::to_string(buffer_size) +
+                        ": must be 0 or between 2 and INT_MAX");
+    }
+    if (fd_ != nullptr && buffer_size > 0) {
+        // write out what the current buffer holds before replacing it, then take the stream out
+        // of writing mode with a seek: otherwise glibc doesn't set up the new buffer for writing,
+        // and writes out early the first output that goes into it. the seek fails on files that
+        // are not seekable (e.g. pipes), which doesn't matter here.
+        flush();
+        (void)std::fseek(fd_, 0, SEEK_CUR);
+        install_buffer_(buffer_size);
+    }
+    buffer_size_ = buffer_size;
+}
+
+SPDLOG_INLINE size_t file_helper::buffer_size() const { return buffer_size_; }
+
+// Make the open file fully buffered, with a new buffer of the given size.
+// The file must not hold buffered output: it was just opened, or flushed by set_buffer_size().
+SPDLOG_INLINE void file_helper::install_buffer_(size_t buffer_size) {
+    std::unique_ptr<char[]> buffer(new char[buffer_size]);
+    if (std::setvbuf(fd_, buffer.get(), _IOFBF, buffer_size) != 0) {
+        throw_spdlog_ex("Failed setting the buffer of file " + os::filename_to_str(filename_),
+                        errno);
+    }
+    // the previous buffer, if any, is not used by the file anymore
+    buffer_ = std::move(buffer);
+}
+
 //
 // return file path and its extension:
 //
diff --git a/include/spdlog/sinks/daily_file_sink.h b/include/spdlog/sinks/daily_file_sink.h
--- a/include/spdlog/sinks/daily_file_sink.h
+++ b/include/spdlog/sinks/daily_file_sink.h
@@ -74,11 +74,12 @@ public:
                     int rotation_minute,
                     bool truncate = false,
                     uint16_t max_files = 0,
-                    const file_event_handlers &event_handlers = {})
+                    const file_event_handlers &event_handlers = {},
+                    size_t buffer_size = 0)
         : base_filename_(std::move(base_filename)),
           rotation_h_(rotation_hour),
           rotation_m_(rotation_minute),
-          file_helper_{event_handlers},
+          file_helper_{event_handlers, buffer_size},
           truncate_(truncate),
           max_files_(max_files),
           filenames_q_() {
@@ -102,6 +103,17 @@ public:
         return file_helper_.filename();
     }
 
+    // see details::file_helper::set_buffer_size()
+    void set_buffer_size(size_t buffer_size) {
+        std::lock_guard<Mutex> lock(base_sink<Mutex>::mutex_);
+        file_helper_.set_buffer_size(buffer_size);
+    }
+
+    size_t buffer_size() {
+        std::lock_guard<Mutex> lock(base_sink<Mutex>::mutex_);
+        return file_helper_.buffer_size();
+    }
+
 protected:
     void sink_it_(const details::log_msg &msg) override {
         auto time = msg.time;
diff --git a/include/spdlog/sinks/basic_file_sink-inl.h b/include/spdlog/sinks/basic_file_sink-inl.h
--- a/include/spdlog/sinks/basic_file_sink-inl.h
+++ b/include/spdlog/sinks/basic_file_sink-inl.h
@@ -16,8 +16,9 @@ namespace sinks {
 template <typename Mutex>
 SPDLOG_INLINE basic_file_sink<Mutex>::basic_file_sink(const filename_t &filename,
                                                       bool truncate,
-                                                      const file_event_handlers &event_handlers)
-    : file_helper_{event_handlers} {
+                                                      const file_event_handlers &event_handlers,
+                                                      size_t buffer_size)
+    : file_helper_{event_handlers, buffer_size} {
…… 其余 664 行从略（共改动 11 个文件）

diff --git a/router.go b/router.go
--- a/router.go
+++ b/router.go
@@ -737,6 +737,60 @@ func (app *App) nextCustom(c CustomCtx) (bool, error) {
 	return false, ErrNotFound
 }
 
+// nextEndpoint returns the endpoint next would run for c if the chain went on
+// from its current position, or nil when it would run none. It scans the bucket
+// next scans, with the same filters and the same use of the SkipUnmatchedRoutes
+// lookahead, but runs nothing: the middleware it passes is taken to call Next,
+// and parameters are captured into a scratch array instead of c.values, so the
+// only thing it leaves on c is the slash count pathSlashCount caches. path is
+// the path next matches against; nextCustom reads it through the custom
+// context's Path.
+func (app *App) nextEndpoint(c *DefaultCtx, path string) *Route {
+	methodInt := c.methodInt
+	// Middleware-only traversal reaches no endpoint, and a method outside
+	// RequestMethods (as the server error handler can see) has no tree
+	if c.shouldSkipNonUseRoutes || methodInt < 0 || methodInt >= len(app.treeIndex) {
+		return nil
+	}
+
+	detectionPath := utils.UnsafeString(c.detectionPath)
+	tree := app.treeIndex[methodInt].lookup(c.treePathHash)
+	head := pathHeadWord(detectionPath)
+	pathSlashes := c.pathSlashCount(app)
+	firstMatchIndex := c.firstMatchIndex
+	var values [maxParams]string
+
+	for indexRoute := max(c.indexRoute+1, 0); indexRoute < len(tree); indexRoute++ {
+		route := tree[indexRoute]
+		if route.prefixRejects(head) || route.mount {
+			continue
+		}
+
+		// next takes the endpoint the lookahead pre-resolved without matching it again
+		if firstMatchIndex >= 0 && !route.use {
+			if indexRoute < firstMatchIndex {
+				continue
+			}
+			if indexRoute == firstMatchIndex && !app.skip.hasParamUse {
+				return route
+			}
+		}
+
+		if !route.match(detectionPath, path, &values, pathSlashes) {
+			continue
+		}
+		if !route.use {
+			return route
+		}
+		// next stops at a matching route that has no handler to run
+		if len(route.Handlers) == 0 {
+			return nil
+		}
+	}
+
+	return nil
+}
+
 func (app *App) defaultRequestHandler(rctx *fasthttp.RequestCtx) {
 	ctx, ok := app.acquireDefaultCtx(rctx)
 	if !ok {
diff --git a/ctx.go b/ctx.go
--- a/ctx.go
+++ b/ctx.go
@@ -387,6 +387,25 @@ func (c *DefaultCtx) routeFallback() *Route {
 	}
 }
 
+// Endpoint returns the endpoint that Next will reach from the current position
+// in the handler chain: a route registered with Get, Post, Add and the like,
+// never one registered with Use. It returns nil when the router will run no
+// endpoint for the request (404, 405, ...), and once the chain is on an
+// endpoint, in any of its handlers, it returns that endpoint. It only looks
+// ahead: it runs no handler and leaves the handler position, Route, Matched and
+// the route params as they are. Routes registered through Domain check the
+// hostname inside their handlers, so they are reported as the router reaches them.
+func (c *DefaultCtx) Endpoint() *Route {
+	if c.route != nil && !c.route.use {
+		return c.route
+	}
+	if c.handlerCtx != nil {
+		// nextCustom matches against the custom context's Path
+		return c.app.nextEndpoint(c, c.handlerCtx.Path())
+	}
+	return c.app.nextEndpoint(c, utils.UnsafeString(c.path))
+}
+
 // FullPath returns the matched route path, including any group prefixes.
 func (c *DefaultCtx) FullPath() string {
 	return c.Route().Path
diff --git a/req.go b/req.go
--- a/req.go
+++ b/req.go
@@ -1333,6 +1333,18 @@ func (r *DefaultReq) Route() *Route {
 	return r.c.Route()
 }
 
+// Endpoint returns the endpoint that Next will reach from the current position
+// in the handler chain: a route registered with Get, Post, Add and the like,
+// never one registered with Use. It returns nil when the router will run no
+// endpoint for the request (404, 405, ...), and once the chain is on an
+// endpoint, in any of its handlers, it returns that endpoint. It only looks
+// ahead: it runs no handler and leaves the handler position, Route, Matched and
+// the route params as they are. Routes registered through Domain check the
+// hostname inside their handlers, so they are reported as the router reaches them.
+func (r *DefaultReq) Endpoint() *Route {
+	return r.c.Endpoint()
+}
+
 // Subdomains returns a slice of subdomains from the host, excluding the last `offset` components.
 // If the offset is negative or exceeds the number of subdomains, an empty slice is returned.
 // If the offset is zero every label (no trimming) is returned.
diff --git a/ctx_interface_gen.go b/ctx_interface_gen.go
--- a/ctx_interface_gen.go
+++ b/ctx_interface_gen.go
@@ -114,6 +114,15 @@ type Ctx interface {
 	// fallback for unregistered methods) so Route and Method always agree.
 	// Never inlined: inlining it would push Route over the inlining budget.
 	routeFallback() *Route
+	// Endpoint returns the endpoint that Next will reach from the current position
+	// in the handler chain: a route registered with Get, Post, Add and the like,
+	// never one registered with Use. It returns nil when the router will run no
+	// endpoint for the request (404, 405, ...), and once the chain is on an
+	// endpoint, in any of its handlers, it returns that endpoint. It only looks
+	// ahead: it runs no handler and leaves the handler position, Route, Matched and
+	// the route params as they are. Routes registered through Domain check the
+	// hostname inside their handlers, so they are reported as the router reaches them.
…… 其余 920 行从略（共改动 9 个文件）

diff --git a/router.go b/router.go
--- a/router.go
+++ b/router.go
@@ -737,6 +737,66 @@ func (app *App) nextCustom(c CustomCtx) (bool, error) {
 	return false, ErrNotFound
 }
 
+// peekEndpoint is the read-only twin of next: it replays next's scan of the
+// route bucket from c's position and returns the endpoint next selects once
+// each middleware matched on the way has called Next. It returns nil wherever
+// next selects none: a 404 or 405, a middleware-only pass
+// (shouldSkipNonUseRoutes), or a matched middleware route without handlers,
+// which ends the chain. path is what next or nextCustom slices parameters from.
+//
+// Nothing on c changes: parameters are matched into a scratch array, and
+// pathSlashCount only caches the count next would compute itself. Keep this in
+// step with next and nextCustom; Test_Endpoint_AgreesWithRouter and
+// Test_Endpoint_MirrorsNext compare them.
+func (app *App) peekEndpoint(c *DefaultCtx, path string) *Route {
+	methodInt := c.methodInt
+	// A middleware-only pass runs no endpoint, and an unregistered method is
+	// answered with 501 before routing starts.
+	if c.shouldSkipNonUseRoutes || methodInt < 0 || methodInt >= len(app.treeIndex) {
+		return nil
+	}
+
+	detectionPath := utils.UnsafeString(c.detectionPath)
+	tree := app.treeIndex[methodInt].lookup(c.treePathHash)
+	head := pathHeadWord(detectionPath)
+	pathSlashes := c.pathSlashCount(app)
+	firstMatchIndex := c.firstMatchIndex
+	var values [maxParams]string
+
+	for indexRoute := max(c.indexRoute+1, 0); indexRoute < len(tree); indexRoute++ {
+		route := tree[indexRoute]
+		if route.prefixRejects(head) || route.mount {
+			continue
+		}
+
+		// next skips the endpoints the SkipUnmatchedRoutes lookahead ruled out
+		// and takes its pick without matching again, as long as it may reuse
+		// the lookahead's params.
+		if firstMatchIndex >= 0 && !route.use {
+			if indexRoute < firstMatchIndex {
+				continue
+			}
+			if indexRoute == firstMatchIndex && !app.skip.hasParamUse {
+				return route
+			}
+		}
+
+		if !route.match(detectionPath, path, &values, pathSlashes) {
+			continue
+		}
+		if !route.use {
+			return route
+		}
+		// Matched middleware passes the request on, but next stops the chain
+		// at a middleware route without handlers.
+		if len(route.Handlers) == 0 {
+			return nil
+		}
+	}
+
+	return nil
+}
+
 func (app *App) defaultRequestHandler(rctx *fasthttp.RequestCtx) {
 	ctx, ok := app.acquireDefaultCtx(rctx)
 	if !ok {
diff --git a/ctx.go b/ctx.go
--- a/ctx.go
+++ b/ctx.go
@@ -387,6 +387,25 @@ func (c *DefaultCtx) routeFallback() *Route {
 	}
 }
 
+// Endpoint returns the endpoint, a route registered with Get, Post, Add and
+// the like but never with Use, that Next will reach from the current position
+// in the handler chain. Once the chain is on an endpoint, it returns that
+// endpoint. It returns nil when the router will run no endpoint for the
+// request, such as for a 404 or 405. Endpoint only looks ahead: it runs no
+// handler and leaves the handler position, Route, Matched and the route
+// params untouched.
+func (c *DefaultCtx) Endpoint() *Route {
+	if route := c.route; route != nil && !route.use && c.indexHandler < len(route.Handlers) {
+		return route
+	}
+	path := utils.UnsafeString(c.path)
+	if c.handlerCtx != nil {
+		// nextCustom matches against the custom context's Path
+		path = c.handlerCtx.Path()
+	}
+	return c.app.peekEndpoint(c, path)
+}
+
 // FullPath returns the matched route path, including any group prefixes.
 func (c *DefaultCtx) FullPath() string {
 	return c.Route().Path
diff --git a/req.go b/req.go
--- a/req.go
+++ b/req.go
@@ -1333,6 +1333,17 @@ func (r *DefaultReq) Route() *Route {
 	return r.c.Route()
 }
 
+// Endpoint returns the endpoint, a route registered with Get, Post, Add and
+// the like but never with Use, that Next will reach from the current position
+// in the handler chain. Once the chain is on an endpoint, it returns that
+// endpoint. It returns nil when the router will run no endpoint for the
+// request, such as for a 404 or 405. Endpoint only looks ahead: it runs no
+// handler and leaves the handler position, Route, Matched and the route
+// params untouched.
+func (r *DefaultReq) Endpoint() *Route {
+	return r.c.Endpoint()
+}
+
 // Subdomains returns a slice of subdomains from the host, excluding the last `offset` components.
 // If the offset is negative or exceeds the number of subdomains, an empty slice is returned.
 // If the offset is zero every label (no trimming) is returned.
…… 其余 1,010 行从略（共改动 9 个文件）

diff --git a/src/line.rs b/src/line.rs
--- a/src/line.rs
+++ b/src/line.rs
@@ -33,19 +33,37 @@ impl Line<'_> {
     self.fragments.is_empty()
   }
 
-  pub(crate) fn is_infallible(&self) -> bool {
-    self
-      .first()
-      .is_some_and(|text| text.starts_with('-') || text.starts_with("@-"))
+  pub(crate) fn is_guard(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('?')
   }
 
-  pub(crate) fn is_quiet(&self) -> bool {
-    self
-      .first()
-      .is_some_and(|text| text.starts_with('@') || text.starts_with("-@"))
+  pub(crate) fn is_infallible(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('-')
+  }
+
+  pub(crate) fn is_quiet(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('@')
   }
 
   pub(crate) fn is_shebang(&self) -> bool {
     self.first().is_some_and(|text| text.starts_with("#!"))
   }
+
+  fn sigils(&self, guards: bool) -> &str {
+    let text = self.first().unwrap_or_default();
+
+    let mut sigils = 0;
+
+    for c in text.chars() {
+      let sigil = c == '-' || c == '@' || (guards && c == '?');
+
+      if !sigil || text[..sigils].contains(c) {
+        break;
+      }
+
+      sigils += 1;
+    }
+
+    &text[..sigils]
+  }
 }
diff --git a/src/recipe.rs b/src/recipe.rs
--- a/src/recipe.rs
+++ b/src/recipe.rs
@@ -245,6 +245,7 @@ impl<'src, D> Recipe<'src, D> {
     mut evaluator: Evaluator<'src, 'run>,
   ) -> RunResult<'src, ()> {
     let config = &context.config;
+    let guards = context.module.settings.guards;
 
     let mut lines = self.body.iter().peekable();
     let mut line_number = self.line_number() + 1;
@@ -254,8 +255,9 @@ impl<'src, D> Recipe<'src, D> {
       }
       let mut evaluated = String::new();
       let mut continued = false;
-      let quiet_line = lines.peek().is_some_and(|line| line.is_quiet());
-      let infallible_line = lines.peek().is_some_and(|line| line.is_infallible());
+      let guard_line = lines.peek().is_some_and(|line| line.is_guard(guards));
+      let quiet_line = lines.peek().is_some_and(|line| line.is_quiet(guards));
+      let infallible_line = lines.peek().is_some_and(|line| line.is_infallible(guards));
 
       let comment_line = context.module.settings.ignore_comments
         && lines.peek().is_some_and(|line| line.is_comment());
@@ -283,7 +285,7 @@ impl<'src, D> Recipe<'src, D> {
 
       let mut command = evaluated.as_str();
 
-      let sigils = usize::from(infallible_line) + usize::from(quiet_line);
+      let sigils = usize::from(guard_line) + usize::from(infallible_line) + usize::from(quiet_line);
 
       command = &command[sigils..];
 
@@ -349,10 +351,24 @@ impl<'src, D> Recipe<'src, D> {
 
       let (result, caught) = cmd.status_guard();
 
+      let mut guard_failed = false;
+
       match result {
         Ok(exit_status) => {
           if let Some(code) = exit_status.code() {
-            if code != 0 && !infallible_line {
+            if guard_line {
+              match code {
+                0 => {}
+                1 => guard_failed = true,
+                _ => {
+                  return Err(Error::GuardCode {
+                    code,
+                    line_number,
+                    recipe: self.name(),
+                  });
+                }
+              }
+            } else if code != 0 && !infallible_line {
               return Err(Error::Code {
                 recipe: self.name(),
                 line_number: Some(line_number),
@@ -381,6 +397,10 @@ impl<'src, D> Recipe<'src, D> {
           return Err(Error::Interrupted { signal });
         }
       }
+
+      if guard_failed {
+        return Ok(());
+      }
     }
   }
 
diff --git a/src/error.rs b/src/error.rs
--- a/src/error.rs
+++ b/src/error.rs
@@ -120,6 +120,11 @@ pub(crate) enum Error<'src> {
   GetConfirmation {
     io_error: io::Error,
   },
+  GuardCode {
+    code: i32,
+    line_number: usize,
+    recipe: &'src str,
+  },
…… 其余 731 行从略（共改动 17 个文件）

diff --git a/src/line.rs b/src/line.rs
--- a/src/line.rs
+++ b/src/line.rs
@@ -33,19 +33,39 @@ impl Line<'_> {
     self.fragments.is_empty()
   }
 
-  pub(crate) fn is_infallible(&self) -> bool {
-    self
-      .first()
-      .is_some_and(|text| text.starts_with('-') || text.starts_with("@-"))
+  pub(crate) fn is_guard(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('?')
   }
 
-  pub(crate) fn is_quiet(&self) -> bool {
-    self
-      .first()
-      .is_some_and(|text| text.starts_with('@') || text.starts_with("-@"))
+  pub(crate) fn is_infallible(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('-')
+  }
+
+  pub(crate) fn is_quiet(&self, guards: bool) -> bool {
+    self.sigils(guards).contains('@')
   }
 
   pub(crate) fn is_shebang(&self) -> bool {
     self.first().is_some_and(|text| text.starts_with("#!"))
   }
+
+  /// Leading `@`, `-`, and, if `guards` is set, `?` sigils, each of which may
+  /// appear at most once
+  fn sigils(&self, guards: bool) -> &str {
+    let text = self.first().unwrap_or_default();
+
+    let mut end = 0;
+
+    for c in text.chars() {
+      let sigil = c == '@' || c == '-' || (guards && c == '?');
+
+      if !sigil || text[..end].contains(c) {
+        break;
+      }
+
+      end += c.len_utf8();
+    }
+
+    &text[..end]
+  }
 }
diff --git a/src/recipe.rs b/src/recipe.rs
--- a/src/recipe.rs
+++ b/src/recipe.rs
@@ -245,6 +245,7 @@ impl<'src, D> Recipe<'src, D> {
     mut evaluator: Evaluator<'src, 'run>,
   ) -> RunResult<'src, ()> {
     let config = &context.config;
+    let guards = context.module.settings.guards;
 
     let mut lines = self.body.iter().peekable();
     let mut line_number = self.line_number() + 1;
@@ -254,8 +255,9 @@ impl<'src, D> Recipe<'src, D> {
       }
       let mut evaluated = String::new();
       let mut continued = false;
-      let quiet_line = lines.peek().is_some_and(|line| line.is_quiet());
-      let infallible_line = lines.peek().is_some_and(|line| line.is_infallible());
+      let quiet_line = lines.peek().is_some_and(|line| line.is_quiet(guards));
+      let infallible_line = lines.peek().is_some_and(|line| line.is_infallible(guards));
+      let guard_line = lines.peek().is_some_and(|line| line.is_guard(guards));
 
       let comment_line = context.module.settings.ignore_comments
         && lines.peek().is_some_and(|line| line.is_comment());
@@ -283,7 +285,7 @@ impl<'src, D> Recipe<'src, D> {
 
       let mut command = evaluated.as_str();
 
-      let sigils = usize::from(infallible_line) + usize::from(quiet_line);
+      let sigils = usize::from(guard_line) + usize::from(infallible_line) + usize::from(quiet_line);
 
       command = &command[sigils..];
 
@@ -349,10 +351,24 @@ impl<'src, D> Recipe<'src, D> {
 
       let (result, caught) = cmd.status_guard();
 
+      let mut guard_failed = false;
+
       match result {
         Ok(exit_status) => {
           if let Some(code) = exit_status.code() {
-            if code != 0 && !infallible_line {
+            if guard_line {
+              match code {
+                0 => {}
+                1 => guard_failed = true,
+                _ => {
+                  return Err(Error::GuardCode {
+                    code,
+                    line_number,
+                    recipe: self.name(),
+                  });
+                }
+              }
+            } else if code != 0 && !infallible_line {
               return Err(Error::Code {
                 recipe: self.name(),
                 line_number: Some(line_number),
@@ -381,6 +397,10 @@ impl<'src, D> Recipe<'src, D> {
           return Err(Error::Interrupted { signal });
         }
       }
+
+      if guard_failed {
+        return Ok(());
+      }
     }
   }
 
…… 其余 679 行从略（共改动 17 个文件）

diff --git a/src/Composer/Util/Filesystem.php b/src/Composer/Util/Filesystem.php
--- a/src/Composer/Util/Filesystem.php
+++ b/src/Composer/Util/Filesystem.php
@@ -918,26 +918,94 @@ public function filePutContentsIfModified(string $path, string $content)
     {
         $currentContent = Silencer::call('file_get_contents', $path);
         if (false === $currentContent || $currentContent !== $content) {
-            return file_put_contents($path, $content);
+            return self::safeFilePutContents($path, $content);
         }
 
         return 0;
     }
 
     /**
-     * Copy file using stream_copy_to_stream to work around https://bugs.php.net/bug.php?id=6463
+     * Writes a file by replacing it instead of rewriting it in place
+     *
+     * Other hardlinks to the file thus keep their content and readers never see a partially written file. The file is
+     * written in place if it cannot be replaced, e.g. if its directory is not writable or its owner cannot be kept.
+     *
+     * @return int|false the number of bytes written, or false on failure
+     * @phpstan-return int<0, max>|false
+     */
+    public static function safeFilePutContents(string $path, string $content)
+    {
+        // symlinks are written through by replacing the file they point to
+        $target = is_link($path) ? realpath($path) : $path;
+        if (false !== $target && self::replaceFile($target, $content)) {
+            return \strlen($content);
+        }
+
+        return file_put_contents($path, $content);
+    }
+
+    /**
+     * @return bool whether the file was replaced, it is left untouched otherwise
+     */
+    private static function replaceFile(string $path, string $content): bool
+    {
+        $stat = null;
+        if (file_exists($path)) {
+            // only regular files can be replaced, and read-only ones must keep failing to be written
+            if (!is_file($path) || !is_writable($path)) {
+                return false;
+            }
+            $stat = Silencer::call('stat', $path);
+            if (!is_array($stat)) {
+                return false;
+            }
+        }
+
+        $tempPath = $path.'.'.bin2hex(random_bytes(5)).'.tmp';
+
+        // the content may be credentials (auth.json), so a replacement is only accessible to its owner until it has the
+        // owner, group and permissions of the file it replaces, while new files get the permissions a plain write gives
+        $umask = umask();
+        if (null !== $stat) {
+            umask(0077);
+        }
+        $handle = Silencer::call('fopen', $tempPath, 'xb');
+        umask($umask);
+        if (!is_resource($handle)) {
+            return false;
+        }
+
+        $written = Silencer::call('fwrite', $handle, $content);
+        $tempStat = fstat($handle);
+        fclose($handle);
+
+        // only change what differs, as not all of it can be changed everywhere, e.g. only root may change the owner
+        $replaced = $written === \strlen($content)
+            && (null === $stat || (
+                false !== $tempStat
+                && ($tempStat['gid'] === $stat['gid'] || true === Silencer::call('chgrp', $tempPath, $stat['gid']))
+                && ($tempStat['uid'] === $stat['uid'] || true === Silencer::call('chown', $tempPath, $stat['uid']))
+                && (($tempStat['mode'] & 07777) === ($stat['mode'] & 07777) || true === Silencer::call('chmod', $tempPath, $stat['mode'] & 07777))
+            ))
+            && true === Silencer::call('rename', $tempPath, $path);
+
+        if (!$replaced) {
+            Silencer::call('unlink', $tempPath);
+        }
+
+        return $replaced;
+    }
+
+    /**
+     * Copy file without using copy() to work around https://bugs.php.net/bug.php?id=6463
      */
     public function safeCopy(string $source, string $target): void
     {
         if (!file_exists($target) || !file_exists($source) || !$this->filesAreEqual($source, $target)) {
-            $sourceHandle = fopen($source, 'r');
-            assert($sourceHandle !== false, 'Could not open "'.$source.'" for reading.');
-            $targetHandle = fopen($target, 'w+');
-            assert($targetHandle !== false, 'Could not open "'.$target.'" for writing.');
-
-            stream_copy_to_stream($sourceHandle, $targetHandle);
-            fclose($sourceHandle);
-            fclose($targetHandle);
+            $content = file_get_contents($source);
+            assert($content !== false, 'Could not read "'.$source.'".');
+
+            self::safeFilePutContents($target, $content);
 
             touch($target, (int) filemtime($source), (int) fileatime($source));
         }
diff --git a/src/Composer/Command/RequireCommand.php b/src/Composer/Command/RequireCommand.php
--- a/src/Composer/Command/RequireCommand.php
+++ b/src/Composer/Command/RequireCommand.php
@@ -137,7 +137,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         }
 
         $this->newlyCreated = !file_exists($this->file);
-        if ($this->newlyCreated && !file_put_contents($this->file, "{\n}\n")) {
+        if ($this->newlyCreated && !Filesystem::safeFilePutContents($this->file, "{\n}\n")) {
             $io->writeError('<error>'.$this->file.' could not be created.</error>');
 
             return 1;
@@ -149,7 +149,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         }
 
         if (filesize($this->file) === 0) {
-            file_put_contents($this->file, "{\n}\n");
+            Filesystem::safeFilePutContents($this->file, "{\n}\n");
         }
 
         $this->json = new JsonFile($this->file);
…… 其余 790 行从略（共改动 18 个文件）

diff --git a/src/Composer/Util/Filesystem.php b/src/Composer/Util/Filesystem.php
--- a/src/Composer/Util/Filesystem.php
+++ b/src/Composer/Util/Filesystem.php
@@ -918,26 +918,107 @@ public function filePutContentsIfModified(string $path, string $content)
     {
         $currentContent = Silencer::call('file_get_contents', $path);
         if (false === $currentContent || $currentContent !== $content) {
-            return file_put_contents($path, $content);
+            return self::safeFilePutContents($path, $content);
         }
 
         return 0;
     }
 
     /**
-     * Copy file using stream_copy_to_stream to work around https://bugs.php.net/bug.php?id=6463
+     * Writes a file by replacing it with a new one instead of truncating and rewriting it like file_put_contents() does
+     *
+     * Other hardlinks to the file thus keep their content, and concurrent readers never see a partially written file.
+     * Symlinks are written through. If the file can not be replaced while keeping its owner, group and permissions,
+     * e.g. because its directory is not writable, it is written in place so that failures are reported as usual.
+     *
+     * @return int|false the number of bytes written, or false on failure
+     */
+    public static function safeFilePutContents(string $path, string $content)
+    {
+        // write through symlinks by replacing the file they point to, dangling ones are written in place
+        $target = is_link($path) ? realpath($path) : $path;
+        $stat = false !== $target ? Silencer::call('stat', $target) : false;
+        $tmpFile = false !== $target ? self::createReplacementFile($target, $stat) : false;
+
+        if (false !== $tmpFile) {
+            $written = Silencer::call('file_put_contents', $tmpFile, $content);
+            if (
+                false !== $written
+                && (false === $stat || self::applyOwnerAndMode($tmpFile, $stat))
+                && true === Silencer::call('rename', $tmpFile, $target)
+            ) {
+                return $written;
+            }
+
+            Silencer::call('unlink', $tmpFile);
+        }
+
+        return file_put_contents($path, $content);
+    }
+
+    /**
+     * Creates an empty file next to $target to write its replacement to
+     *
+     * @param array<int|string, int>|false $stat stat() of $target, or false if it does not exist
+     * @return string|false the path of the created file, or false if $target can not be replaced
+     */
+    private static function createReplacementFile(string $target, $stat)
+    {
+        if (false === $stat) {
+            // created the way file_put_contents() would create $target, so it gets the same permissions
+            $tmpFile = $target.bin2hex(random_bytes(5)).'.tmp';
+            $handle = Silencer::call('fopen', $tmpFile, 'x');
+            if (false === $handle) {
+                return false;
+            }
+            fclose($handle);
+
+            return $tmpFile;
+        }
+
+        // devices like /dev/null can not be replaced, and read-only files must still fail to be written
+        if (!is_file($target) || !is_writable($target)) {
+            return false;
+        }
+
+        // tempnam() creates the file readable by its owner only, so the content (e.g. credentials) is never readable
+        // by more users than the target is
+        $tmpFile = Silencer::call('tempnam', dirname($target), basename($target));
+
+        // tempnam() falls back to the system temp dir if it can not create the file in the given one
+        if (false !== $tmpFile && realpath(dirname($tmpFile)) !== realpath(dirname($target))) {
+            Silencer::call('unlink', $tmpFile);
+
+            return false;
+        }
+
+        return $tmpFile;
+    }
+
+    /**
+     * @param array<int|string, int> $stat stat() of the file replaced by $file
+     */
+    private static function applyOwnerAndMode(string $file, array $stat): bool
+    {
+        $current = Silencer::call('stat', $file);
+
+        // the mode is set last: the content must not become readable by the group $file was created with, and
+        // changing the owner or group can clear the setuid/setgid bits
+        return false !== $current
+            && ($current['uid'] === $stat['uid'] || true === Silencer::call('chown', $file, $stat['uid']))
+            && ($current['gid'] === $stat['gid'] || true === Silencer::call('chgrp', $file, $stat['gid']))
+            && true === Silencer::call('chmod', $file, $stat['mode'] & 07777);
+    }
+
+    /**
+     * Copy file without using copy() to work around https://bugs.php.net/bug.php?id=64634
      */
     public function safeCopy(string $source, string $target): void
     {
         if (!file_exists($target) || !file_exists($source) || !$this->filesAreEqual($source, $target)) {
-            $sourceHandle = fopen($source, 'r');
-            assert($sourceHandle !== false, 'Could not open "'.$source.'" for reading.');
-            $targetHandle = fopen($target, 'w+');
-            assert($targetHandle !== false, 'Could not open "'.$target.'" for writing.');
-
-            stream_copy_to_stream($sourceHandle, $targetHandle);
-            fclose($sourceHandle);
-            fclose($targetHandle);
+            $content = file_get_contents($source);
+            assert($content !== false, 'Could not read "'.$source.'".');
+            self::safeFilePutContents($target, $content);
 
             touch($target, (int) filemtime($source), (int) fileatime($source));
         }
…… 其余 693 行从略（共改动 16 个文件）