@napi-rs/cli 3.10.2 → 3.10.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@napi-rs/cli",
-  "version": "3.10.2",
+  "version": "3.10.4",
   "description": "Cli tools for napi-rs",
   "author": "LongYinan <lynweklm@gmail.com>",
   "homepage": "https://napi.rs/",

package/src/api/__tests__/build.spec.ts

@@ -831,6 +831,263 @@ test('a fresh WASI declaration narrows the inherited root union', async (t) => {
 const ROOT_BINDING_TARGET_DECLARATION =
   "export declare const __napiBindingTarget: 'native' | 'wasm32-wasi' | 'wasm32-wasip1'"
 
+test('an ESM root declaration derives the WASI declaration unless it cannot cross', async (t) => {
+  const { tmpDir, projectDir, typeDefDir } = t.context
+  await writeFile(
+    join(typeDefDir, 'sum.type'),
+    '{"kind":"fn","name":"sum","def":"function sum(a: number, b: number): number"}\n',
+  )
+  const { dts } = await generateTypeDef({
+    typeDefDir,
+    cwd: projectDir,
+    declareBindingTarget: true,
+  })
+
+  // A `"type": "module"` package's `index.d.ts` is an ESM declaration, and so
+  // is an explicit `.d.mts` — but the generated typedef carries nothing a
+  // `.d.cts` cannot re-declare, so the WASI declaration derives verbatim.
+  // (napi-rs#3531: an unconditional refusal failed every WASI build in a
+  // module package, including `--esm` ones.)
+  const sourcePath = join(projectDir, 'index.d.ts')
+  const destinationPath = join(projectDir, 'pkg.wasi.d.cts')
+  for (const esmSourcePath of [sourcePath, join(projectDir, 'index.d.mts')]) {
+    t.is(
+      prepareWasiBindingTypeDef(
+        dts,
+        esmSourcePath,
+        destinationPath,
+        true,
+        'module',
+      ),
+      dts,
+    )
+  }
+
+  // The threadless flavor still gets its node-global rewrites on the way, and
+  // what it emits is valid TypeScript beside the ESM source it came from.
+  const threadless = prepareWasiBindingTypeDef(
+    dts,
+    sourcePath,
+    destinationPath,
+    false,
+    'module',
+  )
+  const codes = await semanticDiagnosticCodes(join(tmpDir, 'esm-derived'), {
+    'index.d.ts': dts,
+    'pkg.wasi.d.cts': threadless,
+  })
+  t.deepEqual(codes['pkg.wasi.d.cts'], [])
+
+  // Only the constructs a CommonJS declaration cannot carry still refuse —
+  // each one named in the error, from `.d.ts` and `.d.mts` sources alike.
+  const hazards: Array<[what: string, source: string, barrier: string]> = [
+    [
+      'an `export default` declaration',
+      'export declare function sum(a: number): number\nexport default sum\n',
+      'an `export default` declaration',
+    ],
+    [
+      'a default class declaration',
+      'export default class Sum {}\n',
+      'an `export default` declaration',
+    ],
+    [
+      'a default function declaration',
+      'export default function sum(a: number): number\n',
+      'an `export default` declaration',
+    ],
+    [
+      'a default interface declaration',
+      'export default interface Sum { a: number }\n',
+      'an `export default` declaration',
+    ],
+    [
+      'a default namespace declaration',
+      'export default namespace Sum { const a: number }\n',
+      'an `export default` declaration',
+    ],
+    [
+      'a `default` re-export',
+      'declare const sum: number\nexport { sum as default }\n',
+      'a `default` re-export',
+    ],
+    [
+      'a `default` re-export from a package',
+      "export { sum as default } from 'sums'\n",
+      'a `default` re-export',
+    ],
+    [
+      'a type-only `default` re-export',
+      'type Sum = number\nexport type { Sum as default }\n',
+      'a `default` re-export',
+    ],
+    [
+      'a `default` namespace re-export',
+      "export * as default from 'sums'\n",
+      'a `default` re-export',
+    ],
+    [
+      'a relative import specifier',
+      "import { sum } from './sum.js'\nexport declare function f(): typeof sum\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'an extensionless relative specifier',
+      "import { sum } from './sum'\nexport declare function f(): typeof sum\n",
+      "a relative './sum' specifier",
+    ],
+    [
+      'a relative export specifier',
+      "export { sum } from './sum.js'\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'a relative export-star specifier',
+      "export * from './sums.js'\n",
+      "a relative './sums.js' specifier",
+    ],
+    [
+      'a relative import type specifier',
+      "import type { Sum } from './sum.js'\nexport declare function f(s: Sum): void\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'a relative import() type',
+      "export declare function f(): import('./sum.js').Sum\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'a relative import-equals specifier',
+      "import sum = require('./sum.js')\nexport declare function f(): typeof sum\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'a relative ambient module specifier',
+      "declare module './sum.js' { export const sum: number }\n",
+      "a relative './sum.js' specifier",
+    ],
+    [
+      'a relative types reference',
+      "/// <reference types='./sum' />\nexport declare const sum: number\n",
+      'a relative \'/// <reference types="./sum" />\' directive',
+    ],
+    [
+      'attributes on a runtime statement',
+      "import sum from './sum.json' with { type: 'json' }\nexport declare const s: typeof sum\n",
+      '`with` attributes on a runtime module statement',
+    ],
+  ]
+  const esmSources: Array<
+    [path: string, packageType: 'module' | 'commonjs' | undefined]
+  > = [
+    [sourcePath, 'module'],
+    [join(projectDir, 'index.d.mts'), undefined],
+  ]
+  for (const [what, source, barrier] of hazards) {
+    for (const [esmSourcePath, packageType] of esmSources) {
+      const error = t.throws(
+        () =>
+          prepareWasiBindingTypeDef(
+            source,
+            esmSourcePath,
+            destinationPath,
+            true,
+            packageType,
+          ),
+        { instanceOf: Error },
+      )
+      t.true(
+        error?.message.includes(barrier),
+        `${what} names the offending construct, got: ${error?.message}`,
+      )
+    }
+  }
+
+  // Everything else a module package can write crosses honestly.
+  const honest: Record<string, string> = {
+    'bare and node: imports':
+      "import { Buffer } from 'buffer'\nimport type { ReadableStream } from 'node:stream/web'\nexport declare function f(b: Buffer, s: ReadableStream): void\n",
+    '.mjs specifiers':
+      "import { sum } from './sum.mjs'\nexport declare function f(): typeof sum\n",
+    '.cjs specifiers':
+      "import { sum } from './sum.cjs'\nexport declare function f(): typeof sum\n",
+    'an export assignment':
+      'declare const binding: { sum(a: number): number }\nexport = binding\n',
+    'a declare global block':
+      'declare global { namespace Legacy { const v: number } }\nexport {}\n',
+    'a bare ambient module':
+      "declare module 'legacy' { export const sum: number }\n",
+    'a .mjs ambient module':
+      "declare module './sum.mjs' { export const sum: number }\n",
+    'a default inside an ambient module':
+      "declare module 'legacy' { const sum: number\nexport default sum }\n",
+    'a type-only import with resolution-mode':
+      "import type { Sum } from './sum.js' with { 'resolution-mode': 'import' }\nexport declare function f(s: Sum): void\n",
+    'a type-only import pinned to require mode':
+      "import type { Sum } from './sum.js' with { 'resolution-mode': 'require' }\nexport declare function f(s: Sum): void\n",
+    'a type-only export with resolution-mode':
+      "export type { Sum } from './sum.js' with { 'resolution-mode': 'import' }\n",
+    'a json specifier':
+      "import sum from './sum.json'\nexport declare const s: typeof sum\n",
+    'a path reference':
+      "/// <reference path='./sum.d.ts' />\nexport declare const sum: number\n",
+    'a bare import() type':
+      "export declare function f(): import('buffer').Buffer\n",
+    'an import() type pinned to import mode':
+      "export declare function f(): import('./sum.js', { with: { 'resolution-mode': 'import' } }).Sum\n",
+    'a namespace export':
+      'export declare namespace Legacy { const sum: number }\n',
+  }
+  for (const [what, source] of Object.entries(honest)) {
+    t.notThrows(
+      () =>
+        prepareWasiBindingTypeDef(
+          source,
+          sourcePath,
+          destinationPath,
+          true,
+          'module',
+        ),
+      what,
+    )
+  }
+
+  // Nothing is scanned when the source is already CommonJS — a `.d.cts` (or a
+  // `.d.ts` in a `commonjs` package) reads the same beside its destination, so
+  // every hazard above carries over verbatim.
+  for (const [, source] of hazards) {
+    for (const [cjsSourcePath, packageType] of [
+      [join(projectDir, 'index.d.cts'), 'module'],
+      [sourcePath, 'commonjs'],
+      [sourcePath, undefined],
+    ] as const) {
+      t.notThrows(() =>
+        prepareWasiBindingTypeDef(
+          source,
+          cjsSourcePath,
+          destinationPath,
+          true,
+          packageType,
+        ),
+      )
+    }
+  }
+
+  // A specifier that can cross still rebases onto the destination directory
+  // — including a `declare module` augmentation name, which targets the file
+  // it spells out.
+  const relocated = prepareWasiBindingTypeDef(
+    "/// <reference path='./sum.d.ts' />\ndeclare module './sum.mjs' { export const sum: number }\nexport declare function f(): import('./sum.mjs').Sum\nexport { sum } from './sum.mjs'\n",
+    join(projectDir, 'types', 'index.d.mts'),
+    destinationPath,
+    true,
+  )
+  t.true(relocated.includes("declare module './types/sum.mjs'"))
+  t.true(relocated.includes("import('./types/sum.mjs')"))
+  t.true(relocated.includes("from './types/sum.mjs'"))
+  t.true(relocated.includes("reference path='./types/sum.d.ts'"))
+})
+
 test('a crate without type defs still declares the binding target', async (t) => {
   const { projectDir, typeDefDir } = t.context
 

package/src/api/build.ts

@@ -21,6 +21,7 @@ import type { BuildOptions as RawBuildOptions } from '../def/build.js'
 import {
   CLI_VERSION,
   commitFileSystemTransaction,
+  commonJsDeclarationBarrier,
   copyFileAtomic,
   type Crate,
   debugFactory,
@@ -795,6 +796,16 @@ export function bindingTargetDeclarationPredicate(input: {
     (input.rootLoaderCandidate && (input.hasWasiFallback || exports.length > 0))
 }
 
+/**
+ * The `.d.cts` content for a WASI flavor loader, derived from the root
+ * declaration this build wrote.
+ *
+ * An ESM source (`*.d.mts`, or `*.d.ts` in a `"type": "module"` package) is
+ * re-declared verbatim when nothing in it changes meaning under CommonJS
+ * interpretation — which is everything a generated typedef and most
+ * `--dts-header`s contain. {@link commonJsDeclarationBarrier} names the
+ * constructs that still refuse, and why.
+ */
 export function prepareWasiBindingTypeDef(
   source: string,
   sourcePath: string,
@@ -803,12 +814,15 @@ export function prepareWasiBindingTypeDef(
   packageType?: 'module' | 'commonjs',
 ) {
   if (
-    sourcePath.endsWith('.d.mts') ||
-    (sourcePath.endsWith('.d.ts') && packageType === 'module')
+    sourcePath.endsWith('.mts') ||
+    (sourcePath.endsWith('.ts') && packageType === 'module')
   ) {
-    throw new Error(
-      `Cannot emit the CommonJS WASI declaration ${destinationPath} from the ESM declaration ${sourcePath}. Use a .d.cts --dts path for WASI builds in module packages.`,
-    )
+    const barrier = commonJsDeclarationBarrier(source)
+    if (barrier !== undefined) {
+      throw new Error(
+        `Cannot emit the CommonJS WASI declaration ${destinationPath} from the ESM declaration ${sourcePath}: ${barrier} cannot be re-declared in a CommonJS declaration. Use a .d.cts --dts path for WASI builds from ESM sources.`,
+      )
+    }
   }
   const targetSource = hasThreads
     ? source

package/src/utils/__tests__/misc.spec.ts

@@ -1,11 +1,16 @@
+import { createHash } from 'node:crypto'
 import { existsSync, type BigIntStats } from 'node:fs'
 import {
+  appendFile,
+  chmod,
   lstat,
   mkdtemp,
   readdir,
   readFile,
   rename,
   rm,
+  stat,
+  utimes,
   writeFile,
 } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -15,6 +20,7 @@ import ava, { type TestFn } from 'ava'
 
 import {
   retireFailedSnapshotLeftover,
+  snapshotFileSystemTransactionInput,
   snapshotLeftoverIsTransactionOwned,
   statIdentitiesMatch,
   updatePackageJson,
@@ -179,3 +185,336 @@ test('retireFailedSnapshotLeftover restores a successor swapped in during the ra
   t.is(await readFile(destination, 'utf8'), 'successor content')
   t.deepEqual(await readdir(t.context.tmpDir), ['leftover.tmp'])
 })
+
+// A snapshot re-verifies its source after the copy so the recorded image is
+// provably consistent. The check used to fail the whole transaction on any
+// difference, including a metadata-only re-stamp of an inode the cli had just
+// written itself — the FreeBSD release-build failure in rolldown/rolldown#10268
+// — and its message named none of the eight conditions it stood for.
+//
+// `onAfterCopy` is the seam these tests drive: it runs after each copy pass and
+// before the post-copy stats, so drift is injected deterministically rather than
+// by racing a timer against a large copy.
+//
+// Every mutation below has to be deterministic on the Windows lanes too
+// (`.github/workflows/test-release.yaml` runs `yarn test:cli` on both
+// `windows-latest` and `windows-11-arm`), which rules out two tempting ones:
+//
+//   * an identical-mode `chmod` to move `ctime` alone. On Windows that is an
+//     attribute no-op and nothing documents it advancing the NTFS ChangeTime
+//     that libuv reports as `ctimeNs`.
+//   * asserting a full POSIX mode. Node documents that on Windows "only the
+//     write permission can be changed, and the distinction among the
+//     permissions of group, owner, or others is not implemented", so a mode
+//     round-trips as read-only or writable and nothing else.
+//
+// So timestamp drift is forced with `utimes`, whose `mtime` write is defined on
+// every supported platform, and mode drift toggles only the owner write bit and
+// asserts against the mode actually observed afterwards.
+const snapshotSourceBytes = Buffer.from('snapshot source contents')
+const snapshotSourceHash = createHash('sha256')
+  .update(snapshotSourceBytes)
+  .digest('hex')
+
+/**
+ * An in-place rewrite of exactly the same length as {@link snapshotSourceBytes}.
+ * Every field the snapshot compares — `dev`, `ino`, `size`, `bytesRead`, `mode`
+ * and, once the timestamps are restamped, `mtimeNs` — survives it untouched, so
+ * only the content moves. That is the shape a coarse or coalesced filesystem
+ * clock hides, and the only thing that can catch it is the hash.
+ */
+function rewrittenSourceBytes(revision: number) {
+  const bytes = Buffer.from(snapshotSourceBytes)
+  bytes.writeUInt8(0x30 + (revision % 10), bytes.length - 1)
+  return bytes
+}
+
+function sourceHashOf(bytes: Buffer) {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+// Two of the mutations below have no Windows equivalent — see the comment on
+// each test for which Windows behavior rules it out.
+const posixTest = process.platform === 'win32' ? test.skip : test
+
+async function writeSnapshotSource(tmpDir: string) {
+  const source = join(tmpDir, 'source.node')
+  await writeFile(source, snapshotSourceBytes)
+  return { destination: join(tmpDir, 'snapshot.input'), source }
+}
+
+async function sourceMode(source: string) {
+  return Number((await stat(source, { bigint: true })).mode & 0o7777n)
+}
+
+/**
+ * Move `mtime` to a fixed whole second, so the drift is the same on a
+ * filesystem with nanosecond stamps and on one with a coarser clock.
+ */
+async function restampSource(source: string, second: number) {
+  const when = new Date(1_700_000_000_000 + second * 1_000)
+  await utimes(source, when, when)
+}
+
+function snapshotInput(
+  source: string,
+  destination: string,
+  onAfterCopy: (attempt: number) => Promise<void>,
+) {
+  return snapshotFileSystemTransactionInput(
+    source,
+    destination,
+    undefined,
+    undefined,
+    0o600,
+    true,
+    undefined,
+    undefined,
+    onAfterCopy,
+  )
+}
+
+// The legitimate FreeBSD case, and the other side of the content-hash rule
+// below: a re-stamp that leaves the bytes alone is accepted on the very next
+// attempt, because that attempt reproduces the hash of the one before it.
+test('snapshot retries a source whose timestamps were re-stamped mid-copy', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const mode = await sourceMode(source)
+  const attempts: number[] = []
+
+  const state = await snapshotInput(source, destination, async (attempt) => {
+    attempts.push(attempt)
+    if (attempt === 1) {
+      // Not one byte of content changes: only the inode's timestamps move.
+      await restampSource(source, 1)
+    }
+  })
+
+  t.deepEqual(attempts, [1, 2])
+  t.is(state.hash, snapshotSourceHash)
+  t.is(state.mode, mode)
+  t.deepEqual(await readFile(destination), snapshotSourceBytes)
+})
+
+posixTest(
+  'snapshot retries a source whose ctime alone was re-stamped mid-copy',
+  async (t) => {
+    const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+    const mode = await sourceMode(source)
+    const attempts: number[] = []
+
+    const state = await snapshotInput(source, destination, async (attempt) => {
+      attempts.push(attempt)
+      if (attempt === 1) {
+        // Re-applying the same mode is the narrowest possible re-stamp: size,
+        // mtime and mode all hold still and only ctime moves. This is the
+        // FreeBSD symptom in its purest form.
+        await chmod(source, mode)
+      }
+    })
+
+    t.deepEqual(attempts, [1, 2])
+    t.is(state.hash, snapshotSourceHash)
+    t.is(state.mode, mode)
+    t.deepEqual(await readFile(destination), snapshotSourceBytes)
+  },
+)
+
+test('snapshot retries mtime drift until the source settles', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const attempts: number[] = []
+
+  const state = await snapshotInput(source, destination, async (attempt) => {
+    attempts.push(attempt)
+    if (attempt < 3) {
+      await restampSource(source, attempt)
+    }
+  })
+
+  // The third attempt is the last the bound allows, and it is clean.
+  t.deepEqual(attempts, [1, 2, 3])
+  t.is(state.hash, snapshotSourceHash)
+  t.deepEqual(await readFile(destination), snapshotSourceBytes)
+})
+
+test('snapshot records the settled mode after a mode re-stamp', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  // Start read-only and hand back the write bit mid-copy. That is the only
+  // mode transition Windows can represent, and it leaves the file writable so
+  // the fixture teardown never meets a read-only inode.
+  await chmod(source, 0o444)
+  const readOnlyMode = await sourceMode(source)
+  const attempts: number[] = []
+
+  const state = await snapshotInput(source, destination, async (attempt) => {
+    attempts.push(attempt)
+    if (attempt === 1) {
+      await chmod(source, 0o644)
+    }
+  })
+
+  // Assert against the mode the platform actually reports, never a literal:
+  // POSIX settles on 0o644 and Windows on 0o666.
+  const writableMode = await sourceMode(source)
+  t.not(readOnlyMode, writableMode, 'the chmod must produce real mode drift')
+  t.deepEqual(attempts, [1, 2])
+  t.is(state.mode, writableMode)
+  t.is(state.hash, snapshotSourceHash)
+})
+
+test('snapshot still fails on a size change and names the field', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const attempts: number[] = []
+
+  const error = await t.throwsAsync(
+    snapshotInput(source, destination, async (attempt) => {
+      attempts.push(attempt)
+      if (attempt === 1) {
+        await appendFile(source, 'appended')
+      }
+    }),
+  )
+
+  // A hard field is fatal on the first observation: no retry is attempted.
+  t.deepEqual(attempts, [1])
+  t.true(
+    error?.message.startsWith(
+      `Filesystem transaction source changed while it was snapshotted: ${source} (`,
+    ),
+  )
+  t.true(
+    error?.message.includes(
+      `size ${snapshotSourceBytes.length} -> ${snapshotSourceBytes.length + 8}`,
+    ),
+    error?.message,
+  )
+  t.true(
+    error?.message.includes(
+      `bytesRead ${snapshotSourceBytes.length} != size ${snapshotSourceBytes.length + 8}`,
+    ),
+    error?.message,
+  )
+  t.false(existsSync(destination))
+})
+
+// Swapping a successor onto a path the snapshot still holds open is POSIX-only:
+// Windows refuses to replace a file with a live handle, and the rename itself
+// fails before the assertion is reached with
+//   EPERM: operation not permitted, rename '...\\successor.node' -> '...\\source.node'
+// The size-change test above already covers a hard field on the Windows lanes.
+posixTest(
+  'snapshot still fails when the path is replaced and names the identity',
+  async (t) => {
+    const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+    const successor = join(t.context.tmpDir, 'successor.node')
+    await writeFile(successor, snapshotSourceBytes)
+    const before = await lstat(source, { bigint: true })
+    const after = await lstat(successor, { bigint: true })
+
+    const error = await t.throwsAsync(
+      snapshotInput(source, destination, async (attempt) => {
+        if (attempt === 1) {
+          await rename(successor, source)
+        }
+      }),
+    )
+
+    t.true(
+      error?.message.includes(
+        `path identity ${before.dev}/${before.ino} -> ${after.dev}/${after.ino}`,
+      ),
+      error?.message,
+    )
+    t.false(existsSync(destination))
+  },
+)
+
+test('snapshot gives up after the attempt bound and names the drifted fields', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const attempts: number[] = []
+
+  const error = await t.throwsAsync(
+    snapshotInput(source, destination, async (attempt) => {
+      attempts.push(attempt)
+      // Never settles: every attempt observes a different mtime.
+      await restampSource(source, attempt)
+    }),
+  )
+
+  t.deepEqual(attempts, [1, 2, 3])
+  t.true(
+    error?.message.startsWith(
+      `Filesystem transaction source changed while it was snapshotted: ${source} (`,
+    ),
+  )
+  t.regex(error?.message ?? '', /mtimeNs \d+ -> \d+/)
+  t.true(
+    error?.message.endsWith('still drifting after 3 snapshot attempts)'),
+    error?.message,
+  )
+  t.false(existsSync(destination))
+})
+
+// Codex review of napi-rs/napi-rs#3530: the retry rebases its baseline purely on
+// metadata, so a writer rewriting the file in place at the same length inside
+// one timestamp tick could hand back a mixed copy that every stat field calls
+// settled. Two attempts now have to agree on the hash before one is accepted.
+test('snapshot re-copies until two attempts agree on the source content', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const mode = await sourceMode(source)
+  const settled = rewrittenSourceBytes(1)
+  const attempts: number[] = []
+
+  const state = await snapshotInput(source, destination, async (attempt) => {
+    attempts.push(attempt)
+    if (attempt === 1) {
+      // Same length, different bytes, and the timestamps pinned to a fixed
+      // second so the second attempt sees metadata that looks perfectly
+      // settled. Only the content betrays the writer.
+      await writeFile(source, settled)
+      await restampSource(source, 1)
+    }
+  })
+
+  // The second attempt copies the settled bytes but cannot know they are
+  // settled — its hash is the first one that differs. Only the third attempt,
+  // which reproduces it, is accepted.
+  t.deepEqual(attempts, [1, 2, 3])
+  t.is(state.hash, sourceHashOf(settled))
+  t.is(state.mode, mode)
+  t.deepEqual(await readFile(destination), settled)
+})
+
+test('snapshot gives up when the source content never settles and names the hash', async (t) => {
+  const { destination, source } = await writeSnapshotSource(t.context.tmpDir)
+  const attempts: number[] = []
+  const copied: Buffer[] = [snapshotSourceBytes]
+
+  const error = await t.throwsAsync(
+    snapshotInput(source, destination, async (attempt) => {
+      attempts.push(attempt)
+      const next = rewrittenSourceBytes(attempt)
+      copied.push(next)
+      await writeFile(source, next)
+      await restampSource(source, attempt)
+    }),
+  )
+
+  t.deepEqual(attempts, [1, 2, 3])
+  t.true(
+    error?.message.startsWith(
+      `Filesystem transaction source changed while it was snapshotted: ${source} (`,
+    ),
+  )
+  t.true(
+    error?.message.includes(
+      `contentHash ${sourceHashOf(copied[1])} -> ${sourceHashOf(copied[2])}`,
+    ),
+    error?.message,
+  )
+  t.true(
+    error?.message.endsWith('still drifting after 3 snapshot attempts)'),
+    error?.message,
+  )
+  t.false(existsSync(destination))
+})