@fuzdev/fuz_app 0.109.0 → 0.110.0

package/dist/dev/setup.d.ts

@@ -57,16 +57,12 @@ export interface SetupEnvOptions {
      * Replaces `^KEY=$` (empty value) patterns in the env file.
      */
     replacements?: Record<string, () => Promise<string>>;
-    /** Optional callback to set file permissions (e.g. `Deno.chmod`). */
-    set_permissions?: (path: string, mode: number) => Promise<void>;
     log?: SetupLogger;
 }
 /** Options for `setup_bootstrap_token`. */
 export interface SetupBootstrapTokenOptions {
     /** State directory override. Defaults to `~/.{app_name}`. */
     state_dir?: string;
-    /** Optional callback to set file/directory permissions. */
-    set_permissions?: (path: string, mode: number) => Promise<void>;
     log?: SetupLogger;
 }
 /** Options for `create_database`. */
@@ -119,9 +115,9 @@ export declare const read_env_var: (deps: Pick<FsReadDeps, "read_text_file">, en
  * @param deps - file read, write, and command capabilities
  * @param env_path - path for the env file (e.g. `.env.development`)
  * @param example_path - path to the example template
- * @param options - extra replacements, permissions, logger
+ * @param options - extra replacements, logger
  * @returns result indicating whether the file was created or updated
- * @mutates filesystem - writes `env_path` (creating from `example_path` if missing) and optionally chmods to `0o600`
+ * @mutates filesystem - writes `env_path` atomically at mode `0o600` (creating from `example_path` if missing)
  */
 export declare const setup_env_file: (deps: FsReadDeps & FsWriteDeps & CommandDeps, env_path: string, example_path: string, options?: SetupEnvOptions) => Promise<SetupEnvResult>;
 /**
@@ -132,9 +128,9 @@ export declare const setup_env_file: (deps: FsReadDeps & FsWriteDeps & CommandDe
  *
  * @param deps - file, command, and env capabilities
  * @param app_name - application name (used for default state directory)
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result indicating whether a token was created
- * @mutates filesystem - creates state directory and writes the token file (optionally chmods to `0o700` / `0o600`)
+ * @mutates filesystem - creates the state directory (`0o700`) and writes the token file atomically at `0o600`
  */
 export declare const setup_bootstrap_token: (deps: FsReadDeps & FsWriteDeps & CommandDeps & EnvDeps, app_name: string, options?: SetupBootstrapTokenOptions) => Promise<SetupTokenResult>;
 /**
@@ -142,7 +138,7 @@ export declare const setup_bootstrap_token: (deps: FsReadDeps & FsWriteDeps & Co
  *
  * @param deps - file, command, env, and remove capabilities
  * @param app_name - application name
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result from creating the new token
  * @mutates filesystem - removes the existing token file (if any) then writes a fresh one
  */

package/dist/dev/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACxC,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAG5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA0B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAoB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAE,GAAG,CAAC,EAAE,WAAW,CAAA;CAAE,KAC7B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAUrD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACxC,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAG5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA2B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAmB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAE,GAAG,CAAC,EAAE,WAAW,CAAA;CAAE,KAC7B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}

package/dist/dev/setup.js

@@ -9,6 +9,7 @@
  * @module
  */
 import { load_env_file } from '../env/dotenv.js';
+import { write_file_atomic } from '../runtime/fs.js';
 import { query_account_by_username, query_actors_by_account, query_create_account_with_actor } from '../auth/account_queries.js';
 import { query_create_role_grant } from '../auth/role_grant_queries.js';
 /** Default logger using bracket format. */
@@ -77,13 +78,12 @@ export const read_env_var = async (deps, env_path, name) => {
  * @param deps - file read, write, and command capabilities
  * @param env_path - path for the env file (e.g. `.env.development`)
  * @param example_path - path to the example template
- * @param options - extra replacements, permissions, logger
+ * @param options - extra replacements, logger
  * @returns result indicating whether the file was created or updated
- * @mutates filesystem - writes `env_path` (creating from `example_path` if missing) and optionally chmods to `0o600`
+ * @mutates filesystem - writes `env_path` atomically at mode `0o600` (creating from `example_path` if missing)
  */
 export const setup_env_file = async (deps, env_path, example_path, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     // build the full replacement map (SECRET_FUZ_COOKIE_KEYS + extras)
     const replacements = {
         SECRET_FUZ_COOKIE_KEYS: () => generate_random_key(deps),
@@ -104,9 +104,10 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
             }
         }
         if (changed) {
-            await deps.write_text_file(env_path, content);
-            if (set_permissions)
-                await set_permissions(env_path, 0o600);
+            // Atomic replace at 0600 — the backfill just wrote secrets into the
+            // file, so publishing a fresh owner-only inode also repairs a
+            // hand-made permissive .env in the same step the old chmod covered.
+            await write_file_atomic(deps, env_path, content, { mode: 0o600 });
         }
         else {
             log.skip(`${env_path} already configured`);
@@ -122,9 +123,7 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
             content = content.replace(pattern, `${key}=${value}`);
         }
     }
-    await deps.write_text_file(env_path, content);
-    if (set_permissions)
-        await set_permissions(env_path, 0o600);
+    await write_file_atomic(deps, env_path, content, { mode: 0o600 });
     log.ok(`Created ${env_path} with generated secrets`);
     return { created: true, updated: true, path: env_path };
 };
@@ -136,13 +135,12 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
  *
  * @param deps - file, command, and env capabilities
  * @param app_name - application name (used for default state directory)
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result indicating whether a token was created
- * @mutates filesystem - creates state directory and writes the token file (optionally chmods to `0o700` / `0o600`)
+ * @mutates filesystem - creates the state directory (`0o700`) and writes the token file atomically at `0o600`
  */
 export const setup_bootstrap_token = async (deps, app_name, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     const home = deps.env_get('HOME');
     if (!home) {
         log.skip('$HOME not set, skipping bootstrap token');
@@ -155,13 +153,13 @@ export const setup_bootstrap_token = async (deps, app_name, options) => {
         log.skip(`~/.${app_name}/secret_bootstrap_token already exists`);
         return { created: false, token_path };
     }
-    await deps.mkdir(state_dir, { recursive: true });
-    if (set_permissions)
-        await set_permissions(state_dir, 0o700);
+    // Modes apply at creation — an already-existing state dir keeps its mode.
+    // The token itself is always freshly created here (the stat above skipped
+    // existing files), so its 0600 holds unconditionally; the server-side
+    // `read_secure_file` refuses anything laxer at read time.
+    await deps.mkdir(state_dir, { recursive: true, mode: 0o700 });
     const key = await generate_random_key(deps);
-    await deps.write_text_file(token_path, key + '\n');
-    if (set_permissions)
-        await set_permissions(token_path, 0o600);
+    await write_file_atomic(deps, token_path, key + '\n', { mode: 0o600 });
     log.ok(`Created ~/.${app_name}/secret_bootstrap_token (one-shot, deleted after first use)`);
     return { created: true, token_path };
 };
@@ -170,13 +168,12 @@ export const setup_bootstrap_token = async (deps, app_name, options) => {
  *
  * @param deps - file, command, env, and remove capabilities
  * @param app_name - application name
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result from creating the new token
  * @mutates filesystem - removes the existing token file (if any) then writes a fresh one
  */
 export const reset_bootstrap_token = async (deps, app_name, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     const home = deps.env_get('HOME');
     if (!home) {
         log.skip('$HOME not set');
@@ -189,7 +186,7 @@ export const reset_bootstrap_token = async (deps, app_name, options) => {
         await deps.remove(token_path);
         log.ok('Removed existing bootstrap token');
     }
-    return setup_bootstrap_token(deps, app_name, { state_dir, set_permissions, log });
+    return setup_bootstrap_token(deps, app_name, { state_dir, log });
 };
 // === Database helpers ===
 /**

package/dist/runtime/deno.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AA6DxE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WAgJhE,CAAC"}
+{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAoExE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WAuKhE,CAAC"}

package/dist/runtime/deno.js

@@ -8,6 +8,7 @@
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
+import { assert_secure_mode, assert_secure_size, read_secure_bounded } from './secure_file.js';
 /**
  * Create a runtime backed by Deno APIs.
  *
@@ -44,6 +45,28 @@ export const create_deno_runtime = (args) => ({
     mkdir: (path, options) => Deno.mkdir(path, options),
     read_text_file: (path) => Deno.readTextFile(path),
     read_file: (path) => Deno.readFile(path),
+    read_secure_file: async (path) => {
+        // Deno exposes no O_NOFOLLOW, so the symlink check is a pre-open lstat
+        // (a TOCTOU window the Node impl doesn't have — the mode check below
+        // still runs on the open descriptor, so a post-open swap can't defeat
+        // it). The checks themselves are the shared `runtime/secure_file.ts`
+        // helpers, same as `load_secure_file_node`.
+        const l = await Deno.lstat(path);
+        if (l.isSymlink)
+            throw new Error(`secure file is a symlink: ${path}`);
+        const file = await Deno.open(path, { read: true });
+        try {
+            const s = await file.stat();
+            // `mode` is null where POSIX modes don't apply (Windows).
+            if (s.mode !== null)
+                assert_secure_mode(path, s.mode);
+            assert_secure_size(path, s.size);
+            return await read_secure_bounded(path, (target) => file.read(target));
+        }
+        finally {
+            file.close();
+        }
+    },
     read_file_stream: async (path) => (await Deno.open(path, { read: true })).readable,
     write_file_stream: async (path, data) => {
         const file = await Deno.open(path, { write: true, create: true, truncate: true });
@@ -78,7 +101,10 @@ export const create_deno_runtime = (args) => ({
             names.push(entry.name);
         return names;
     },
-    write_text_file: (path, content) => Deno.writeTextFile(path, content),
+    write_text_file: (path, content, options) => Deno.writeTextFile(path, content, {
+        mode: options?.mode,
+        createNew: options?.exclusive
+    }),
     write_file: (path, data) => Deno.writeFile(path, data),
     rename: (old_path, new_path) => Deno.rename(old_path, new_path),
     fsync: async (path) => {

package/dist/runtime/deps.d.ts

@@ -79,6 +79,39 @@ export interface ReadTextFromOffsetResult {
     /** Total file size at the time of the read (for truncation detection). */
     file_size: number;
 }
+/**
+ * Options for `FsWriteDeps.write_text_file`.
+ */
+export interface WriteFileOptions {
+    /**
+     * POSIX mode applied at creation (e.g. `0o600`). Creation-time only — an
+     * existing file keeps its mode (pair with `exclusive` when the mode must
+     * hold). No-op where modes don't apply (mock runtime, Windows).
+     */
+    mode?: number;
+    /**
+     * Fail if the path already exists (`O_EXCL`). Load-bearing for secret
+     * files: without it a crash-leftover temp file is reopened `O_TRUNC` and
+     * keeps its old (possibly permissive) mode, since `mode` only applies at
+     * creation.
+     */
+    exclusive?: boolean;
+}
+/**
+ * Hardened read for secret files (bootstrap tokens, keys) — the TS twin of
+ * the Rust spine's `fuz_sys::secure_file::load_secure_file`.
+ */
+export interface FsSecureReadDeps {
+    /**
+     * Read a small secret file with fail-loud checks: rejects symlinks, any
+     * group/other-accessible mode (must be `0600`/`0400`; skipped where POSIX
+     * modes don't apply), and files over a 4 KiB cap. Permission checks run on
+     * the open descriptor where the platform allows, so the file can't be
+     * swapped between check and read. Throws on any refusal — a refused secret
+     * must never degrade to an empty read.
+     */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
+}
 /**
  * File system read operations.
  */
@@ -104,12 +137,13 @@ export interface FsReadDeps {
  * File system write operations.
  */
 export interface FsWriteDeps {
-    /** Create a directory. */
+    /** Create a directory. `mode` applies at creation (no-op where modes don't apply). */
     mkdir: (path: string, options?: {
         recursive?: boolean;
+        mode?: number;
     }) => Promise<void>;
-    /** Write text to a file. */
-    write_text_file: (path: string, content: string) => Promise<void>;
+    /** Write text to a file. See `WriteFileOptions` for `mode` / `exclusive`. */
+    write_text_file: (path: string, content: string, options?: WriteFileOptions) => Promise<void>;
     /** Write bytes to a file. */
     write_file: (path: string, data: Uint8Array) => Promise<void>;
     /** Rename (move) a file. */
@@ -213,7 +247,7 @@ export interface ProcessDeps {
  * Functions should accept narrow `*Deps` interfaces, not this full type —
  * this type is for the wiring layer that creates and passes the runtime.
  */
-export interface RuntimeDeps extends EnvDeps, FsReadDeps, FsWriteDeps, FsStreamDeps, FsRemoveDeps, CommandDeps, FetchDeps, TerminalDeps, ProcessDeps, LogDeps {
+export interface RuntimeDeps extends EnvDeps, FsReadDeps, FsSecureReadDeps, FsWriteDeps, FsStreamDeps, FsRemoveDeps, CommandDeps, FetchDeps, TerminalDeps, ProcessDeps, LogDeps {
     /** Get all environment variables. */
     env_all: () => Record<string, string>;
     /** CLI arguments passed to the program. */

package/dist/runtime/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,0BAA0B;IAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,4BAA4B;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}

package/dist/runtime/fs.d.ts

@@ -3,15 +3,34 @@
  *
  * @module
  */
-import type { FsWriteDeps } from './deps.js';
+import type { FsRemoveDeps, FsWriteDeps } from './deps.js';
+/** Options for `write_file_atomic`. */
+export interface WriteFileAtomicOptions {
+    /**
+     * POSIX mode for the written file (e.g. `0o600` for secrets). Applied at
+     * temp-file creation, so the published file never exists with a laxer
+     * mode. Omitted = the runtime default (umask).
+     */
+    mode?: number;
+}
 /**
  * Write a file atomically via temp file + rename.
  *
- * Writes to `<path>.tmp` then renames over `path` so readers either see the
- * old contents or the full new contents — never a partial write.
+ * Writes to a unique `.{name}.tmp.{pid}.{counter}` sibling with exclusive
+ * create (`O_EXCL`), then renames over `path` so readers either see the old
+ * contents or the full new contents — never a partial write. The unique name
+ * + exclusive create are load-bearing for secret files: a fixed temp name
+ * would let a crash-leftover temp be reopened `O_TRUNC` with its old
+ * (possibly permissive) mode — `mode` only applies at creation — and the
+ * rename would publish that stale inode. Twin of the Rust spine's
+ * `fuz_sys::secure_file::write_secure_file` naming scheme.
  *
- * @mutates filesystem - creates `<path>.tmp` then renames it to `path`
+ * @param deps - write capabilities; pass `remove` too for best-effort temp cleanup on failure
+ * @param path - destination path
+ * @param content - full file content
+ * @param options - optional `mode` applied at creation
+ * @mutates filesystem - creates the unique temp file then renames it to `path`
  * @throws Error if `write_text_file` or `rename` rejects (permissions, disk full, cross-device rename, etc.)
  */
-export declare const write_file_atomic: (deps: Pick<FsWriteDeps, "write_text_file" | "rename">, path: string, content: string) => Promise<void>;
+export declare const write_file_atomic: (deps: Pick<FsWriteDeps, "write_text_file" | "rename"> & Partial<FsRemoveDeps>, path: string, content: string, options?: WriteFileAtomicOptions) => Promise<void>;
 //# sourceMappingURL=fs.d.ts.map

package/dist/runtime/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,CAAC,EACrD,MAAM,MAAM,EACZ,SAAS,MAAM,KACb,OAAO,CAAC,IAAI,CAId,CAAC"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE3D,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,EAC7E,MAAM,MAAM,EACZ,SAAS,MAAM,EACf,UAAU,sBAAsB,KAC9B,OAAO,CAAC,IAAI,CAoBd,CAAC"}

package/dist/runtime/fs.js

@@ -3,17 +3,48 @@
  *
  * @module
  */
+import process from 'node:process';
+/** Per-process counter for unique temp names (concurrent same-path writes). */
+let temp_file_counter = 0;
 /**
  * Write a file atomically via temp file + rename.
  *
- * Writes to `<path>.tmp` then renames over `path` so readers either see the
- * old contents or the full new contents — never a partial write.
+ * Writes to a unique `.{name}.tmp.{pid}.{counter}` sibling with exclusive
+ * create (`O_EXCL`), then renames over `path` so readers either see the old
+ * contents or the full new contents — never a partial write. The unique name
+ * + exclusive create are load-bearing for secret files: a fixed temp name
+ * would let a crash-leftover temp be reopened `O_TRUNC` with its old
+ * (possibly permissive) mode — `mode` only applies at creation — and the
+ * rename would publish that stale inode. Twin of the Rust spine's
+ * `fuz_sys::secure_file::write_secure_file` naming scheme.
  *
- * @mutates filesystem - creates `<path>.tmp` then renames it to `path`
+ * @param deps - write capabilities; pass `remove` too for best-effort temp cleanup on failure
+ * @param path - destination path
+ * @param content - full file content
+ * @param options - optional `mode` applied at creation
+ * @mutates filesystem - creates the unique temp file then renames it to `path`
  * @throws Error if `write_text_file` or `rename` rejects (permissions, disk full, cross-device rename, etc.)
  */
-export const write_file_atomic = async (deps, path, content) => {
-    const temp_path = path + '.tmp';
-    await deps.write_text_file(temp_path, content);
-    await deps.rename(temp_path, path);
+export const write_file_atomic = async (deps, path, content, options) => {
+    const slash = path.lastIndexOf('/');
+    const dir = slash === -1 ? '' : path.slice(0, slash + 1);
+    const name = slash === -1 ? path : path.slice(slash + 1);
+    const temp_path = `${dir}.${name}.tmp.${process.pid}.${temp_file_counter++}`;
+    try {
+        await deps.write_text_file(temp_path, content, {
+            mode: options?.mode,
+            exclusive: true
+        });
+        await deps.rename(temp_path, path);
+    }
+    catch (err) {
+        // best-effort cleanup so a failed write doesn't strand the temp
+        try {
+            await deps.remove?.(temp_path);
+        }
+        catch {
+            // already gone or not removable — the original error wins
+        }
+        throw err;
+    }
 };

package/dist/runtime/mock.d.ts

@@ -18,6 +18,13 @@ export interface MockRuntime extends RuntimeDeps {
     mock_fs: Map<string, string>;
     /** Mock binary file system (path -> bytes). */
     mock_fs_bytes: Map<string, Uint8Array>;
+    /**
+     * Recorded POSIX modes (path -> mode), written by `write_text_file`'s
+     * `mode` option. A file with no recorded mode reads as `0o644` (the
+     * default-umask hazard) — so `read_secure_file` refuses it unless the
+     * writer asked for `0o600` explicitly, mirroring the real runtimes.
+     */
+    mock_fs_modes: Map<string, number>;
     /** Mock directories that exist. */
     mock_dirs: Set<string>;
     /** Exit calls recorded (exit codes). */

package/dist/runtime/mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAc,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAI3F;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,kCAAkC;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACxF,sCAAsC;IACtC,qBAAqB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACnE,8BAA8B;IAC9B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,4CAA4C;IAC5C,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjD,yCAAyC;IACzC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,4BAA4B;IAC5B,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC1E,wDAAwD;IACxD,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAM,KAAK,CAAC,MAAM,CAAM,KAAG,WAwR9D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,WAAW,KAAG,IAazD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,WAAW,EAAE,OAAO,MAAM,KAAG,IAEpE,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAKxB"}
+{"version":3,"file":"mock.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAc,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAK3F;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,kCAAkC;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC;;;;;OAKG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACxF,sCAAsC;IACtC,qBAAqB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACnE,8BAA8B;IAC9B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,4CAA4C;IAC5C,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjD,yCAAyC;IACzC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,4BAA4B;IAC5B,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC1E,wDAAwD;IACxD,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAM,KAAK,CAAC,MAAM,CAAM,KAAG,WA8T9D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,WAAW,KAAG,IAazD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,WAAW,EAAE,OAAO,MAAM,KAAG,IAEpE,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAKxB"}

package/dist/runtime/mock.js

@@ -7,6 +7,7 @@
  *
  * @module
  */
+import { assert_secure_mode, assert_secure_size } from './secure_file.js';
 /**
  * Create a mock `RuntimeDeps` for testing.
  *
@@ -32,6 +33,7 @@ export const create_mock_runtime = (args = []) => {
     const mock_env = new Map();
     const mock_fs = new Map();
     const mock_fs_bytes = new Map();
+    const mock_fs_modes = new Map();
     const mock_dirs = new Set();
     const exit_calls = [];
     const command_calls = [];
@@ -46,6 +48,7 @@ export const create_mock_runtime = (args = []) => {
         mock_env,
         mock_fs,
         mock_fs_bytes,
+        mock_fs_modes,
         mock_dirs,
         exit_calls,
         command_calls,
@@ -122,6 +125,26 @@ export const create_mock_runtime = (args = []) => {
             error.code = 'ENOENT';
             throw error;
         },
+        read_secure_file: async (path) => {
+            let bytes = mock_fs_bytes.get(path);
+            if (bytes === undefined) {
+                const content = mock_fs.get(path);
+                if (content !== undefined)
+                    bytes = new TextEncoder().encode(content);
+            }
+            if (bytes === undefined) {
+                const error = new Error(`ENOENT: no such file or directory: ${path}`);
+                error.code = 'ENOENT';
+                throw error;
+            }
+            // A file written without an explicit mode reads as 0o644 — the
+            // default-umask hazard — so the secure read refuses it unless the
+            // writer asked for 0600, mirroring the real runtimes (simulated
+            // modes, so no platform gate).
+            assert_secure_mode(path, mock_fs_modes.get(path) ?? 0o644);
+            assert_secure_size(path, bytes.length);
+            return bytes;
+        },
         read_file_stream: async (path) => {
             let bytes = mock_fs_bytes.get(path);
             if (bytes === undefined) {
@@ -193,8 +216,15 @@ export const create_mock_runtime = (args = []) => {
             }
             return Array.from(seen).sort();
         },
-        write_text_file: async (path, content) => {
+        write_text_file: async (path, content, options) => {
+            if (options?.exclusive && (mock_fs.has(path) || mock_fs_bytes.has(path))) {
+                const error = new Error(`EEXIST: file already exists: ${path}`);
+                error.code = 'EEXIST';
+                throw error;
+            }
             mock_fs.set(path, content);
+            if (options?.mode !== undefined)
+                mock_fs_modes.set(path, options.mode);
         },
         write_file: async (path, data) => {
             mock_fs_bytes.set(path, data);
@@ -236,10 +266,20 @@ export const create_mock_runtime = (args = []) => {
                 mock_fs_bytes.set(new_path, bytes);
                 mock_fs_bytes.delete(old_path);
             }
+            // the inode's mode travels with the rename (POSIX semantics)
+            const mode = mock_fs_modes.get(old_path);
+            if (mode !== undefined) {
+                mock_fs_modes.set(new_path, mode);
+                mock_fs_modes.delete(old_path);
+            }
+            else {
+                mock_fs_modes.delete(new_path);
+            }
         },
         remove: async (path, options) => {
             mock_fs.delete(path);
             mock_fs_bytes.delete(path);
+            mock_fs_modes.delete(path);
             mock_dirs.delete(path);
             if (options?.recursive) {
                 const prefix = path.endsWith('/') ? path : path + '/';

package/dist/runtime/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAM,aAAa,CAAC,MAAM,CAAyB,KACjD,WAkMD,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAGxE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAM,aAAa,CAAC,MAAM,CAAyB,KACjD,WAwMD,CAAC"}

package/dist/runtime/node.js

@@ -13,6 +13,7 @@ import { stat, mkdir, readFile, readdir, writeFile, rename, rm, open } from 'nod
 import process from 'node:process';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { load_secure_file_node } from './secure_file.js';
 /**
  * Create a `RuntimeDeps` backed by Node.js APIs.
  *
@@ -50,6 +51,7 @@ export const create_node_runtime = (args = process.argv.slice(2)) => ({
     },
     read_text_file: (path) => readFile(path, 'utf-8'),
     read_file: (path) => readFile(path).then((buf) => new Uint8Array(buf)),
+    read_secure_file: load_secure_file_node,
     // `Readable.toWeb` / `fromWeb` bridge Node streams to the web stream shape
     // the interface speaks. The casts cross Node's `stream/web` ReadableStream
     // and the global DOM `ReadableStream` (structurally identical here).
@@ -84,7 +86,11 @@ export const create_node_runtime = (args = process.argv.slice(2)) => ({
         }
     },
     readdir: (path) => readdir(path),
-    write_text_file: (path, content) => writeFile(path, content, 'utf-8'),
+    write_text_file: (path, content, options) => writeFile(path, content, {
+        encoding: 'utf-8',
+        mode: options?.mode,
+        flag: options?.exclusive ? 'wx' : 'w'
+    }),
     write_file: (path, data) => writeFile(path, data),
     rename: (old_path, new_path) => rename(old_path, new_path),
     fsync: async (path) => {

package/dist/runtime/secure_file.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Hardened secret-file read — the TS twin of the Rust spine's
+ * `fuz_sys::secure_file::load_secure_file`.
+ *
+ * The file this guards is typically the highest-value credential on the host
+ * (the bootstrap token mints the keeper account), so the read fails loud
+ * rather than degrading: a symlink, a group/other-accessible mode, or an
+ * oversized file is refused, never returned. The deploy recipe places the
+ * token at `0600`, so the check ratifies the shape zap produces; a
+ * hand-placed `0644` file fails at boot instead of being read.
+ *
+ * The Node implementation lives here (`load_secure_file_node`, wired as
+ * `create_node_runtime().read_secure_file`); the Deno runtime implements the
+ * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
+ * the mode/size checks over its in-memory map. All three refuse through the
+ * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
+ * helpers so the checks — and their operator-facing messages — can't drift
+ * between runtimes.
+ *
+ * @module
+ */
+/**
+ * Maximum size for secure files. Prevents DoS from unexpectedly large files;
+ * 4 KiB is generous for token/key material. Matches the Rust twin's
+ * `MAX_SECURE_FILE_SIZE`.
+ */
+export declare const MAX_SECURE_FILE_SIZE = 4096;
+/**
+ * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
+ *
+ * Callers own the platform gating: the real runtimes skip the check where
+ * modes aren't meaningful (Node on Windows, a `null` Deno mode); the mock
+ * checks its simulated modes unconditionally.
+ *
+ * @throws Error naming the path, the offending mode, and the `chmod` fix
+ */
+export declare const assert_secure_mode: (path: string, mode: number) => void;
+/**
+ * Refuse a byte count over `MAX_SECURE_FILE_SIZE`.
+ *
+ * @throws Error naming the path, the size, and the cap
+ */
+export declare const assert_secure_size: (path: string, size: number) => void;
+/**
+ * Drain `read_chunk` into a cap-bounded buffer.
+ *
+ * Reads up to cap + 1 bytes so a file growing between stat and read is still
+ * caught (the stat-time size check alone races). `read_chunk` fills the given
+ * target from the file's current position and returns the bytes read
+ * (`null`/`0` = EOF) — the seam that lets the Node and Deno handle APIs share
+ * one loop.
+ *
+ * @throws Error when more than `MAX_SECURE_FILE_SIZE` bytes arrive
+ */
+export declare const read_secure_bounded: (path: string, read_chunk: (target: Uint8Array) => Promise<number | null>) => Promise<Uint8Array>;
+/**
+ * Read a secret file with fail-loud checks (Node implementation).
+ *
+ * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - the permission check runs on the open descriptor, not the path, so the
+ *   file can't be swapped between check and read — any group/other access
+ *   (not `0600`/`0400`) is refused
+ * - a size cap bounds the read; the read itself is limited to cap + 1 so a
+ *   file growing between stat and read is still caught
+ *
+ * @param path - path to the secret file
+ * @returns the file's bytes
+ * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ */
+export declare const load_secure_file_node: (path: string) => Promise<Uint8Array>;
+//# sourceMappingURL=secure_file.d.ts.map

package/dist/runtime/secure_file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CAuB5E,CAAC"}