@jini-ai/platform 0.5.8 → 0.5.10

package/dist/fs/directory-sync.js

@@ -1,70 +1,62 @@
 import fs from "node:fs";
 import path from "node:path";
 import { readOptionalText, readWindowsOneDriveRoots } from "./user-data-directories.js";
-/** Detect provider roots, never infer syncing just because a provider is installed. Canonical
- * containment catches redirected Documents, while marker files cover older client layouts.
- * Dropbox publishes info.json paths; macOS File Provider mounts identify their provider.
- * @complexity O(a + p) small account/mount lists and ancestor probes, no recursive site scan.
- */
-export function detectDirectorySync({ dir, homeDir, documents }, { env = process.env, platform = process.platform, readText = (file) => readOptionalText({ file }), canonicalPath = ({ path: value }) => { try {
+const MOUNT_PROVIDERS = [["OneDrive-", "OneDrive"], ["GoogleDrive-", "Google Drive"], ["Dropbox", "Dropbox"]];
+function canonicalOrResolved({ path: value }) { try {
     return fs.realpathSync(value);
 }
 catch {
     return path.resolve(value);
-} }, listDirectories = (root) => { try {
+} }
+function listDirectoriesOrEmpty(root) { try {
     return fs.readdirSync(root);
 }
 catch (error) {
     if (error.code === "ENOENT")
         return [];
     throw error;
-} }, exists = fs.existsSync, oneDriveRoots = [], windowsOneDriveRoots = () => readWindowsOneDriveRoots({}), } = {}) {
-    const paths = platform === "win32" ? path.win32 : path.posix;
-    const roots = [];
-    const add = (root, provider) => { if (root)
-        roots.push({ root, provider }); };
-    if (platform === "darwin") {
-        const cloud = paths.join(homeDir, "Library", "Mobile Documents", "com~apple~CloudDocs");
-        add(cloud, "iCloud");
-        // Documents need not be a symlink on newer macOS: the cloud Documents entry is evidence
-        // of Desktop & Documents being enabled, rather than merely iCloud Drive being installed.
-        if (exists(paths.join(cloud, "Documents")))
-            add(documents, "iCloud");
-        const mounts = paths.join(homeDir, "Library", "CloudStorage");
-        for (const name of listDirectories(mounts)) {
-            if (name.startsWith("OneDrive-"))
-                add(paths.join(mounts, name), "OneDrive");
-            else if (name.startsWith("GoogleDrive-"))
-                add(paths.join(mounts, name), "Google Drive");
-            else if (name.startsWith("Dropbox"))
-                add(paths.join(mounts, name), "Dropbox");
-        }
+} }
+function macRoots({ homeDir, documents }, { paths, exists, listDirectories }) {
+    const cloud = paths.join(homeDir, "Library", "Mobile Documents", "com~apple~CloudDocs");
+    const roots = [{ root: cloud, provider: "iCloud" }];
+    // Documents need not be a symlink on newer macOS: the cloud Documents entry is evidence
+    // of Desktop & Documents being enabled, rather than merely iCloud Drive being installed.
+    if (exists(paths.join(cloud, "Documents")) && documents)
+        roots.push({ root: documents, provider: "iCloud" });
+    const mounts = paths.join(homeDir, "Library", "CloudStorage");
+    for (const name of listDirectories(mounts)) {
+        const provider = MOUNT_PROVIDERS.find(([prefix]) => name.startsWith(prefix))?.[1];
+        if (provider)
+            roots.push({ root: paths.join(mounts, name), provider });
     }
-    for (const root of [env.OneDrive, env.OneDriveConsumer, env.OneDriveCommercial, ...oneDriveRoots])
-        add(root, "OneDrive");
-    if (platform === "win32" && !env.OneDrive && !env.OneDriveConsumer && !env.OneDriveCommercial) {
-        for (const root of windowsOneDriveRoots())
-            add(root, "OneDrive");
+    return roots;
+}
+function oneDriveRoots({ env, platform, oneDriveRoots: extra, windowsOneDriveRoots }) {
+    const fromEnv = [env.OneDrive, env.OneDriveConsumer, env.OneDriveCommercial];
+    const fromAccounts = platform === "win32" && !fromEnv.some(Boolean) ? windowsOneDriveRoots() : [];
+    return [...fromEnv, ...extra, ...fromAccounts];
+}
+function dropboxInfoFiles({ homeDir }, { env, platform }, paths) {
+    if (platform !== "win32")
+        return [paths.join(homeDir, ".dropbox", "info.json")];
+    return [env.APPDATA, env.LOCALAPPDATA].filter((root) => Boolean(root)).map((root) => paths.join(root, "Dropbox", "info.json"));
+}
+function dropboxAccountPaths(text) {
+    if (!text)
+        return [];
+    // Provider-owned metadata can be torn/corrupt; it is optional evidence, never a boot gate.
+    let accounts;
+    try {
+        accounts = JSON.parse(text);
     }
-    const dropboxFiles = platform === "win32" ? [env.APPDATA, env.LOCALAPPDATA].filter((root) => Boolean(root)).map((root) => paths.join(root, "Dropbox", "info.json")) : [paths.join(homeDir, ".dropbox", "info.json")];
-    for (const file of dropboxFiles) {
-        const text = readText(file);
-        if (!text)
-            continue;
-        // Provider-owned metadata can be torn/corrupt; it is optional evidence, never a boot gate.
-        let accounts;
-        try {
-            accounts = JSON.parse(text);
-        }
-        catch {
-            continue;
-        }
-        if (!accounts || typeof accounts !== "object" || Array.isArray(accounts))
-            continue;
-        for (const account of Object.values(accounts))
-            if (typeof account?.path === "string")
-                add(account.path, "Dropbox");
+    catch {
+        return [];
     }
+    if (!accounts || typeof accounts !== "object" || Array.isArray(accounts))
+        return [];
+    return Object.values(accounts).map((account) => account?.path).filter((root) => typeof root === "string");
+}
+function containingProvider({ dir, roots }, { canonicalPath, platform }, paths) {
     const canonical = (value) => { const resolved = canonicalPath({ path: value }); return platform === "win32" ? resolved.toLowerCase() : resolved; };
     const target = canonical(dir);
     for (const { root, provider } of roots) {
@@ -72,6 +64,9 @@ catch (error) {
         if (target === resolved || target.startsWith(resolved + paths.sep))
             return provider;
     }
+    return null;
+}
+function ancestorMarkerProvider({ dir }, { exists }, paths) {
     let ancestor = paths.resolve(dir);
     while (true) {
         if (exists(paths.join(ancestor, ".dropbox.cache")))
@@ -84,4 +79,22 @@ catch (error) {
         ancestor = parent;
     }
 }
+function providerRoots(provider, roots) {
+    return roots.filter((root) => Boolean(root)).map((root) => ({ root, provider }));
+}
+function detectWithPorts({ dir, homeDir, documents }, ports) {
+    const paths = ports.platform === "win32" ? path.win32 : path.posix;
+    const mac = ports.platform === "darwin" ? macRoots({ homeDir, documents }, { paths, exists: ports.exists, listDirectories: ports.listDirectories }) : [];
+    const oneDrive = providerRoots("OneDrive", oneDriveRoots(ports));
+    const dropbox = providerRoots("Dropbox", dropboxInfoFiles({ homeDir }, ports, paths).flatMap((file) => dropboxAccountPaths(ports.readText(file))));
+    return containingProvider({ dir, roots: [...mac, ...oneDrive, ...dropbox] }, ports, paths) ?? ancestorMarkerProvider({ dir }, ports, paths);
+}
+/** Detect provider roots, never infer syncing just because a provider is installed. Canonical
+ * containment catches redirected Documents, while marker files cover older client layouts.
+ * Dropbox publishes info.json paths; macOS File Provider mounts identify their provider.
+ * @complexity O(a + p) small account/mount lists and ancestor probes, no recursive site scan.
+ */
+export function detectDirectorySync(required, { env = process.env, platform = process.platform, readText = (file) => readOptionalText({ file }), canonicalPath = canonicalOrResolved, listDirectories = listDirectoriesOrEmpty, exists = fs.existsSync, oneDriveRoots = [], windowsOneDriveRoots = () => readWindowsOneDriveRoots({}), } = {}) {
+    return detectWithPorts(required, { env, platform, readText, canonicalPath, listDirectories, exists, oneDriveRoots, windowsOneDriveRoots });
+}
 //# sourceMappingURL=directory-sync.js.map

package/dist/fs/directory-user-config.js

@@ -3,6 +3,23 @@ import { createHash } from "node:crypto";
 import { resolveDirectoryHome } from "./directory-home.js";
 import { resolveUserDataDirectories } from "./user-data-directories.js";
 import { detectDirectorySync } from "./directory-sync.js";
+const SAFE_SITE_ID = /^[a-zA-Z0-9_-]+$/;
+const invalidMarker = (markerPath) => new Error(`Interrupted database move has an invalid recovery marker: ${markerPath}. Restore the pre-move backup before starting.`);
+function assertDatabaseFilename(filename) {
+    if (path.basename(filename) !== filename || !filename.endsWith(".db"))
+        throw new Error("A database filename must be a .db basename.");
+}
+/** iCloud keeps data.nosync out of sync; every other provider syncs live databases. */
+function syncsDatabases(sync) { return sync !== null && sync !== "iCloud"; }
+/** Old markers use the fixed home2 name; new moves identify their unique backup. Admit
+ * only a sibling of this source so malformed metadata cannot supply unrelated evidence. */
+function markerBackup(source, namedBackup) {
+    if (namedBackup === undefined)
+        return source + ".home2-backup";
+    if (typeof namedBackup !== "string" || path.dirname(namedBackup) !== path.dirname(source) || !namedBackup.startsWith(source + ".relocation-") || !namedBackup.endsWith("-backup"))
+        return undefined;
+    return namedBackup;
+}
 /** One atomic settings owner for multiple processes. Existing DB files always win over preferences:
  * changing placement controls new databases, never silently moves or abandons existing ones.
  * @complexity O(n) canonicalizations for n roots; DB lookup probes three fixed locations.
@@ -47,11 +64,37 @@ export function createDirectoryUserConfig({ homeDir, defaultFolder, envName, pol
         const nestedHome = legacyHomes.includes(savedHome) ? paths.join(savedHome, policy.defaultSubfolder) : savedHome;
         const sitesHome = expand(env[envName] ?? nestedHome);
         const sync = syncProvider(sitesHome);
-        return {
-            sitesHome,
-            siteRoots: distinct(env[policy.rootsEnvName] !== undefined ? env[policy.rootsEnvName].split(",").map((root) => root.trim()).filter(Boolean) : saved.siteRoots ?? policy.sourceRoots ?? []),
-            databases: saved.databases ?? (sync && sync !== "iCloud" ? "appData" : "inSite"),
+        return { sitesHome, siteRoots: distinct(configuredRoots(saved)), databases: saved.databases ?? (syncsDatabases(sync) ? "appData" : "inSite") };
+    }
+    function configuredRoots(saved) {
+        const fromEnv = env[policy.rootsEnvName];
+        return fromEnv !== undefined ? fromEnv.split(",").map((root) => root.trim()).filter(Boolean) : saved.siteRoots ?? policy.sourceRoots ?? [];
+    }
+    // Prefer explicit settings, never coerce an existing regular file into a directory.
+    function assertDirectories(checked) {
+        for (const directory of [checked.sitesHome, ...(checked.siteRoots ?? [])]) {
+            if (directory === undefined)
+                continue;
+            const expanded = expand(directory);
+            if (exists(expanded) && !isDirectory(expanded))
+                throw new Error(`Sites folder is not a directory: ${directory}`);
+        }
+    }
+    function assertNotOverridden(checked) {
+        if (checked.sitesHome !== undefined && env[envName] !== undefined)
+            throw new Error(`${envName} overrides this setting. Unset it before changing the directory home.`);
+        if (checked.siteRoots !== undefined && env[policy.rootsEnvName] !== undefined)
+            throw new Error(`${policy.rootsEnvName} overrides this setting. Unset it before changing site roots.`);
+    }
+    function merged(previous, checked, incremental) {
+        const next = { ...previous, ...checked,
+            ...(checked.sitesHome !== undefined ? { sitesHome: expand(checked.sitesHome) } : {}),
+            ...(checked.siteRoots !== undefined ? { siteRoots: distinct(checked.siteRoots) } : {}),
         };
+        // Empty incremental extras restore implicit defaults instead of persisting those defaults.
+        if (incremental && checked.siteRoots?.length === 0)
+            delete next.siteRoots;
+        return next;
     }
     function update({ patch }, { transform } = {}) {
         // Compute incremental root changes inside the same lock as the write: a sibling process's
@@ -59,25 +102,9 @@ export function createDirectoryUserConfig({ homeDir, defaultFolder, envName, pol
         file.withLock({ critical: () => {
                 const previous = stored(true);
                 const checked = validateDirectoryUserConfig({ value: transform ? transform(read({}), previous) : patch });
-                // Prefer explicit settings, never coerce an existing regular file into a directory.
-                for (const directory of [checked.sitesHome, ...(checked.siteRoots ?? [])]) {
-                    if (directory === undefined)
-                        continue;
-                    const expanded = expand(directory);
-                    if (exists(expanded) && !isDirectory(expanded))
-                        throw new Error(`Sites folder is not a directory: ${directory}`);
-                }
-                if (checked.sitesHome !== undefined && env[envName] !== undefined)
-                    throw new Error(`${envName} overrides this setting. Unset it before changing the directory home.`);
-                if (checked.siteRoots !== undefined && env[policy.rootsEnvName] !== undefined)
-                    throw new Error(`${policy.rootsEnvName} overrides this setting. Unset it before changing site roots.`);
-                const next = { ...previous, ...checked,
-                    ...(checked.sitesHome !== undefined ? { sitesHome: expand(checked.sitesHome) } : {}),
-                    ...(checked.siteRoots !== undefined ? { siteRoots: distinct(checked.siteRoots) } : {}),
-                };
-                // Empty incremental extras restore implicit defaults instead of persisting those defaults.
-                if (transform && checked.siteRoots?.length === 0)
-                    delete next.siteRoots;
+                assertDirectories(checked);
+                assertNotOverridden(checked);
+                const next = merged(previous, checked, transform !== undefined);
                 // With no other saved settings, removing the final extra also restores an absent config.
                 // The Node assembly supplies removal; non-Node adapters may retain the equivalent {}.
                 if (transform && Object.keys(next).length === 0 && removeFile)
@@ -94,50 +121,62 @@ export function createDirectoryUserConfig({ homeDir, defaultFolder, envName, pol
                 return { siteRoots: distinct([...(saved.siteRoots ?? []), ...add]).filter((root) => !excluded.has(root) && !protectedRoots.has(root)) };
             } });
     }
-    function databasePath({ dir, id, filename, placement }, _options = {}) {
-        if (path.basename(filename) !== filename || !filename.endsWith(".db"))
-            throw new Error("A database filename must be a .db basename.");
-        const inSite = path.join(dir, "data.nosync", filename), legacy = path.join(dir, filename);
-        if (!/^[a-zA-Z0-9_-]+$/.test(id)) {
-            if (!placement && exists(legacy))
-                return legacy;
-            throw new Error("A database directory requires a safe, stable site identity.");
-        }
-        const appData = path.join(directories.appData, "databases", id, filename);
-        if (placement)
-            return placement === "inSite" ? inSite : appData;
-        const candidates = [legacy, inSite, appData];
-        // A move journal is written before copying; the old name stays authoritative until verification
-        // retires it. Recovery never guesses from two DB sizes/timestamps or asks users to delete data.
+    // A move journal is written before copying; the old name stays authoritative until verification
+    // retires it. Recovery never guesses from two DB sizes/timestamps or asks users to delete data.
+    function moveMarker(source, candidates) {
+        const markerPath = source + ".home2-relocation.json", marker = fileAt(markerPath).read({});
+        if (marker.state === "missing")
+            return undefined;
+        const value = marker.state === "ok" ? marker.value : undefined;
+        const target = value?.to, backup = markerBackup(source, value?.backup);
+        if (typeof target !== "string" || !candidates.includes(target) || backup === undefined)
+            throw invalidMarker(markerPath);
+        return { markerPath, target, backup };
+    }
+    function authoritativeCopy(source, { markerPath, target, backup }) {
+        if (exists(source))
+            return source;
+        if (exists(backup) && exists(target))
+            return target;
+        throw new Error(`Interrupted database move needs recovery: ${markerPath}. Restore the pre-move backup before starting.`);
+    }
+    function recoveredMove(candidates) {
         for (const source of candidates) {
-            const markerPath = source + ".home2-relocation.json", marker = fileAt(markerPath).read({});
-            if (marker.state === "missing")
+            const marker = moveMarker(source, candidates);
+            if (!marker)
                 continue;
-            const target = marker.state === "ok" ? marker.value?.to : undefined;
-            if (typeof target !== "string" || !candidates.includes(target))
-                throw new Error(`Interrupted database move has an invalid recovery marker: ${markerPath}. Restore the pre-move backup before starting.`);
-            const namedBackup = marker.state === "ok" ? marker.value?.backup : undefined;
-            // Old markers use the fixed home2 name; new moves identify their unique backup. Admit
-            // only a sibling of this source so malformed metadata cannot supply unrelated evidence.
-            if (namedBackup !== undefined && (typeof namedBackup !== "string" || path.dirname(namedBackup) !== path.dirname(source) || !namedBackup.startsWith(source + ".relocation-") || !namedBackup.endsWith("-backup")))
-                throw new Error(`Interrupted database move has an invalid recovery marker: ${markerPath}. Restore the pre-move backup before starting.`);
-            const backup = typeof namedBackup === "string" ? namedBackup : source + ".home2-backup";
-            const authoritative = exists(source) ? source : exists(backup) && exists(target) ? target : undefined;
-            if (!authoritative)
-                throw new Error(`Interrupted database move needs recovery: ${markerPath}. Restore the pre-move backup before starting.`);
-            report(`Recovered interrupted database move using ${authoritative}. Keep the backup files (${backup}); finish the move before changing database placement.`);
+            const authoritative = authoritativeCopy(source, marker);
+            report(`Recovered interrupted database move using ${authoritative}. Keep the backup files (${marker.backup}); finish the move before changing database placement.`);
             return authoritative;
         }
+        return undefined;
+    }
+    function existingCopy(candidates, filename) {
         const present = candidates.filter(exists);
         if (present.length > 1)
             throw new Error(`Multiple copies of ${filename} exist for this site. Choose the authoritative database before starting it.`);
-        if (present[0])
-            return present[0];
+        return present[0];
+    }
+    function unsafeIdentityPath(legacy, placement) {
+        if (!placement && exists(legacy))
+            return legacy;
+        throw new Error("A database directory requires a safe, stable site identity.");
+    }
+    function databasePath({ dir, id, filename, placement }, _options = {}) {
+        assertDatabaseFilename(filename);
+        const inSite = path.join(dir, "data.nosync", filename), legacy = path.join(dir, filename);
+        if (!SAFE_SITE_ID.test(id))
+            return unsafeIdentityPath(legacy, placement);
+        const appData = path.join(directories.appData, "databases", id, filename);
+        if (placement)
+            return placement === "inSite" ? inSite : appData;
+        const candidates = [legacy, inSite, appData];
+        const found = recoveredMove(candidates) ?? existingCopy(candidates, filename);
+        if (found)
+            return found;
         // A missing chat DB follows an existing content DB even after the user changes preferences.
-        if (filename !== "content.db") {
-            const content = databasePath({ dir, id, filename: "content.db" });
-            return path.join(path.dirname(content), filename);
-        }
+        if (filename !== "content.db")
+            return path.join(path.dirname(databasePath({ dir, id, filename: "content.db" })), filename);
         return read({}).databases === "inSite" ? inSite : appData;
     }
     return { read, update, updateRoots, databasePath, filePath, ...directories,
@@ -157,12 +196,17 @@ export function createDirectoryUserConfig({ homeDir, defaultFolder, envName, pol
         syncWarning: (_required, _options = {}) => {
             const config = read({});
             const sync = syncProvider(config.sitesHome);
-            if (!sync || sync === "iCloud")
+            if (!syncsDatabases(sync))
                 return null;
             return { provider: sync, message: config.databases === "appData" ? `${sync} syncs the sites folder. New databases use OS app-data for safety. Site folders are not self-contained: include their app-data databases when transferring them.` : `${sync} syncs the sites folder. It does not honor data.nosync; syncing live SQLite databases can corrupt them. Use app-data databases or a local sites folder.`, localHome };
         },
     };
 }
+const SETTING_RULES = [
+    ["sitesHome", (value) => typeof value === "string" && Boolean(value.trim()), "sitesHome must name a directory."],
+    ["siteRoots", (value) => Array.isArray(value) && value.every((root) => typeof root === "string" && root.trim()), "siteRoots must be an array of directory paths."],
+    ["databases", (value) => value === "inSite" || value === "appData", 'databases must be "inSite" or "appData".'],
+];
 /** Validate only the three public settings; reject arrays, unknown fields and invalid enums.
  * @complexity O(n) root strings. No I/O or mutation.
  */
@@ -170,14 +214,11 @@ export function validateDirectoryUserConfig({ value }, _options = {}) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("User config must be an object.");
     const row = value;
-    if (Object.keys(row).some((key) => !["sitesHome", "siteRoots", "databases"].includes(key)))
+    if (Object.keys(row).some((key) => !SETTING_RULES.some(([known]) => known === key)))
         throw new Error("Unknown user config setting.");
-    if (row.sitesHome !== undefined && (typeof row.sitesHome !== "string" || !row.sitesHome.trim()))
-        throw new Error("sitesHome must name a directory.");
-    if (row.siteRoots !== undefined && (!Array.isArray(row.siteRoots) || !row.siteRoots.every((root) => typeof root === "string" && root.trim())))
-        throw new Error("siteRoots must be an array of directory paths.");
-    if (row.databases !== undefined && row.databases !== "inSite" && row.databases !== "appData")
-        throw new Error('databases must be "inSite" or "appData".');
+    for (const [key, valid, message] of SETTING_RULES)
+        if (row[key] !== undefined && !valid(row[key]))
+            throw new Error(message);
     return row;
 }
 //# sourceMappingURL=directory-user-config.js.map

package/dist/fs/directory-workspace.d.ts

@@ -129,4 +129,15 @@ export declare function createNodeDirectoryWorkspace({ homeDir, defaultFolder, e
         record: import("./directory-running-lock.js").DirectoryRunningRecord;
     };
 };
+/** Canonicalize existing ancestors without creating the selected directory.
+ * The default canonicalizer of {@link createNodeDirectoryWorkspace}. `realpath` is the native
+ * resolver by default; it is injectable so a missing filesystem root (an unmounted Windows drive)
+ * can be exercised on any host. A missing root resolves to its absolute form.
+ * @complexity O(d) realpath probes for d path segments.
+ */
+export declare function canonicalNodeDirectory({ path: dir }: {
+    path: string;
+}, { realpath }?: {
+    realpath?: (dir: string) => string;
+}): string;
 //# sourceMappingURL=directory-workspace.d.ts.map

package/dist/fs/directory-workspace.js

@@ -94,6 +94,9 @@ export function createNodeDirectoryWorkspace({ homeDir, defaultFolder, envName,
         const previous = oldCatalogs();
         current.merge({ entries: previous.flatMap((catalog) => catalog.list({})), migrations: previous.flatMap((catalog) => catalog.migrations({})), migration: "app-data-catalog-v1" });
     };
+    // One lease adapter for both the app-data and the site-local (legacy) lease locations.
+    const runningLockAt = (filePath) => createDirectoryRunningLock({ file: fileAt(filePath), isAlive: ports.process.isAlive,
+        remove: () => ports.filesystem.rmSync(filePath, { force: true }) }, { ...(ports.process.bootIdentity ? { bootIdentity: ports.process.bootIdentity } : {}) });
     const mutate = (operation) => settings.withLock({ critical: () => { importOldCatalog(); return operation(); } });
     // Serialize pointer changes with catalog mutations. A caller that obtained a registry before
     // settings changed must still write into the current home, never strand a late registration.
@@ -181,7 +184,6 @@ export function createNodeDirectoryWorkspace({ homeDir, defaultFolder, envName,
                             const staged = createDirectoryRegistry({ canonicalPath, file: {
                                     read: () => state === undefined ? { state: "missing" } : { state: "ok", value: state },
                                     write: ({ value: next }) => { state = next; }, withLock: ({ critical }) => critical(),
-                                    tempPath: () => "", quarantine: () => false,
                                 } });
                             if (!staged.hasMigration({ migration: "app-data-catalog-v1" })) {
                                 const previous = oldCatalogs();
@@ -216,14 +218,12 @@ export function createNodeDirectoryWorkspace({ homeDir, defaultFolder, envName,
         },
         registry: (_required, _options = {}) => registry,
         running: ({ path: dir }, _options = {}) => {
-            const filePath = config?.runningPath({ dir }) ?? path.join(canonicalPath({ path: dir }), runningName);
-            const current = createDirectoryRunningLock({ file: fileAt(filePath), isAlive: ports.process.isAlive,
-                remove: () => ports.filesystem.rmSync(filePath, { force: true }) }, { ...(ports.process.bootIdentity ? { bootIdentity: ports.process.bootIdentity } : {}) });
+            const legacyPath = path.join(canonicalPath({ path: dir }), runningName);
+            const current = runningLockAt(config?.runningPath({ dir }) ?? legacyPath);
             if (!config)
                 return current;
-            const legacyPath = path.join(canonicalPath({ path: dir }), runningName);
-            const legacy = createDirectoryRunningLock({ file: fileAt(legacyPath), isAlive: ports.process.isAlive,
-                remove: () => ports.filesystem.rmSync(legacyPath, { force: true }) }, { ...(ports.process.bootIdentity ? { bootIdentity: ports.process.bootIdentity } : {}) });
+            // The legacy lease is only ever peeked, so its removal callback is never invoked here.
+            const legacy = runningLockAt(legacyPath);
             return { ...current,
                 // Older servers may still own a site-local lease. Observe it without moving/editing it;
                 // claim serializes against new clients and refuses the old live owner.
@@ -249,10 +249,15 @@ export function createNodeDirectoryWorkspace({ homeDir, defaultFolder, envName,
             overrides: { sitesHome: env[envName] !== undefined, siteRoots: env[userConfig.rootsEnvName] !== undefined } };
     }
 }
-/** Canonicalize existing ancestors without creating the selected directory. */
-function canonicalNodeDirectory({ path: dir }, _options = {}) {
+/** Canonicalize existing ancestors without creating the selected directory.
+ * The default canonicalizer of {@link createNodeDirectoryWorkspace}. `realpath` is the native
+ * resolver by default; it is injectable so a missing filesystem root (an unmounted Windows drive)
+ * can be exercised on any host. A missing root resolves to its absolute form.
+ * @complexity O(d) realpath probes for d path segments.
+ */
+export function canonicalNodeDirectory({ path: dir }, { realpath = fs.realpathSync } = {}) {
     try {
-        return fs.realpathSync(dir);
+        return realpath(dir);
     }
     catch (error) {
         if (error.code !== "ENOENT")
@@ -260,7 +265,7 @@ function canonicalNodeDirectory({ path: dir }, _options = {}) {
         // Resolve the nearest existing ancestor too: a not-yet-created home may sit below a
         // symlink (notably /var on macOS) and must compare equal before and after creation.
         const absolute = path.resolve(dir), parent = path.dirname(absolute);
-        return parent === absolute ? absolute : path.join(canonicalNodeDirectory({ path: parent }), path.basename(absolute));
+        return parent === absolute ? absolute : path.join(canonicalNodeDirectory({ path: parent }, { realpath }), path.basename(absolute));
     }
 }
 //# sourceMappingURL=directory-workspace.js.map

package/dist/fs/durable-json.d.ts

@@ -74,7 +74,9 @@ export interface DurableJsonFile {
 }
 /** Atomic replacement, distinct corrupt reads, quarantine, and token-owned synchronous locks.
  * Lock stealing rechecks inode, bytes and mtime; conditional unlink is not available on all hosts.
- * File fsync precedes rename; directory fsync follows it. Persistence remains filesystem-dependent.
+ * File fsync precedes rename; directory flush afterwards is best-effort: skipped on Windows,
+ * unsupported-code failures ignored (EPERM/EISDIR/EINVAL/EACCES/ENOTSUP), other failures reported
+ * after replacement. Persistence remains filesystem-dependent.
  */
 export declare function createDurableJsonFile({ filePath, filesystem: fs, clock, sleep, process, random, report, notices }: DurableJsonPorts & {
     filePath: string;

package/dist/fs/durable-json.js

@@ -36,7 +36,9 @@ export function createNodeDurableJsonPorts(_required) {
 }
 /** Atomic replacement, distinct corrupt reads, quarantine, and token-owned synchronous locks.
  * Lock stealing rechecks inode, bytes and mtime; conditional unlink is not available on all hosts.
- * File fsync precedes rename; directory fsync follows it. Persistence remains filesystem-dependent.
+ * File fsync precedes rename; directory flush afterwards is best-effort: skipped on Windows,
+ * unsupported-code failures ignored (EPERM/EISDIR/EINVAL/EACCES/ENOTSUP), other failures reported
+ * after replacement. Persistence remains filesystem-dependent.
  */
 export function createDurableJsonFile({ filePath, filesystem: fs, clock, sleep, process, random, report, notices }, { pollMs = 10, staleMs = 30000 } = {}) {
     if (!filePath)
@@ -70,8 +72,9 @@ export function createDurableJsonFile({ filePath, filesystem: fs, clock, sleep,
         return `${filePath}.${pid}.tmp`;
     }
     // Same-directory rename gives readers complete old/new versions rather than a torn intermediate.
-    // Flush bytes before rename so metadata cannot precede content. The canonical writer also syncs
-    // the parent directory; platform/filesystem support determines persistence after that sync.
+    // Flush bytes before rename so metadata cannot precede content. The canonical writer's parent
+    // directory flush is best-effort: skipped on Windows, unsupported-code failures ignored
+    // (EPERM/EISDIR/EINVAL/EACCES/ENOTSUP), other failures reported after replacement.
     // Keep the legacy temp path, pretty JSON bytes and new-file create mode for these shared stores.
     function writeJson(filePath, value) {
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -176,46 +179,58 @@ export function updateDurableJsonFiles({ changes, fileAt, remove }, _options = {
         throw new Error("Duplicate JSON transaction path.");
     const ordered = [...changes].sort((a, b) => a.filePath.localeCompare(b.filePath));
     const files = ordered.map((change) => fileAt(change.filePath));
-    const lock = (index) => {
-        if (index < files.length) {
-            files[index].withLock({ critical: () => lock(index + 1) });
-            return;
+    withLocksInOrder({ files, critical: () => applyJsonUpdates({ updates: planJsonUpdates({ ordered, files }), remove }) });
+}
+/** Nests each file's lock in path order, then runs the critical section with all of them held. */
+function withLocksInOrder({ files, critical }, { index = 0 } = {}) {
+    if (index >= files.length) {
+        critical();
+        return;
+    }
+    files[index].withLock({ critical: () => withLocksInOrder({ files, critical }, { index: index + 1 }) });
+}
+/** Every transform runs before any write, so a refusal leaves all participants untouched. */
+function planJsonUpdates({ ordered, files }) {
+    return ordered.map((change, i) => {
+        const before = files[i].read({});
+        if (before.state === "unreadable")
+            throw new Error(`JSON reference is unreadable: ${change.filePath}. Nothing was moved.`);
+        const previous = before.state === "ok" ? before.value : undefined;
+        return { file: files[i], filePath: change.filePath, previous, next: change.transform(previous) };
+    }).filter((item) => JSON.stringify(item.previous) !== JSON.stringify(item.next));
+}
+/** Undefined means the file is absent, so it is removed rather than written. */
+function persistJsonValue({ item, value, remove }) {
+    if (value === undefined)
+        remove({ filePath: item.filePath });
+    else
+        item.file.write({ value });
+}
+function applyJsonUpdates({ updates, remove }) {
+    const attempted = [];
+    try {
+        for (const item of updates) {
+            attempted.push(item); // A write can fail after its rename; include it in rollback.
+            persistJsonValue({ item, value: item.next, remove });
         }
-        const updates = ordered.map((change, i) => {
-            const before = files[i].read({});
-            if (before.state === "unreadable")
-                throw new Error(`JSON reference is unreadable: ${change.filePath}. Nothing was moved.`);
-            const previous = before.state === "ok" ? before.value : undefined;
-            return { file: files[i], filePath: change.filePath, previous, next: change.transform(previous) };
-        }).filter((item) => JSON.stringify(item.previous) !== JSON.stringify(item.next));
-        const attempted = [];
+    }
+    catch (failure) {
+        rollbackJsonUpdates({ attempted, remove, failure });
+    }
+}
+/** Restores prior bytes newest-first; keeps going past individual rollback failures. */
+function rollbackJsonUpdates({ attempted, remove, failure }) {
+    const errors = [failure];
+    for (const item of attempted.reverse()) {
         try {
-            for (const item of updates) {
-                attempted.push(item); // A write can fail after its rename; include it in rollback.
-                if (item.next === undefined)
-                    remove({ filePath: item.filePath });
-                else
-                    item.file.write({ value: item.next });
-            }
+            persistJsonValue({ item, value: item.previous, remove });
         }
-        catch (failure) {
-            const errors = [failure];
-            for (const item of attempted.reverse()) {
-                try {
-                    if (item.previous === undefined)
-                        remove({ filePath: item.filePath });
-                    else
-                        item.file.write({ value: item.previous });
-                }
-                catch (error) {
-                    errors.push(error);
-                }
-            }
-            if (errors.length > 1)
-                throw new AggregateError(errors, "JSON reference rollback failed.");
-            throw failure;
+        catch (error) {
+            errors.push(error);
         }
-    };
-    lock(0);
+    }
+    if (errors.length > 1)
+        throw new AggregateError(errors, "JSON reference rollback failed.");
+    throw failure;
 }
 //# sourceMappingURL=durable-json.js.map