@neottia/repository-store 0.2.0

package/dist/internal/filesystem.js

@@ -0,0 +1,199 @@
+import { closeSync, constants as fsConstants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { DurabilityError, PathSafetyError, ResourceLimitError } from '../errors.js';
+import { emitFilesystemFault } from './fault-injection.js';
+export function noFollowFlag() {
+    return typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+}
+export function hasCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+export function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+export function ensurePrivateDirectory(target) {
+    const missing = [];
+    let current = resolve(target);
+    while (true) {
+        try {
+            const stat = lstatSync(current);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw unsafe(`Unsafe directory: ${current}`);
+            break;
+        }
+        catch (error) {
+            if (!hasCode(error, 'ENOENT'))
+                throw error;
+            const parent = dirname(current);
+            if (parent === current)
+                throw unsafe(`Cannot resolve directory ancestor: ${target}`);
+            missing.unshift(basename(current));
+            current = parent;
+        }
+    }
+    for (const component of missing) {
+        current = join(current, component);
+        try {
+            mkdirSync(current, { mode: 0o700 });
+        }
+        catch (error) {
+            if (!hasCode(error, 'EEXIST'))
+                throw error;
+        }
+        const stat = lstatSync(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw unsafe(`Unsafe directory: ${current}`);
+    }
+}
+export function captureDirectories(directory) {
+    const paths = ancestorPaths(resolve(directory));
+    const identities = [];
+    for (const path of paths) {
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw unsafe(`Unsafe directory ancestor: ${path}`);
+        identities.push({ path, stat });
+    }
+    return identities;
+}
+function ancestorPaths(path) {
+    const parent = dirname(path);
+    return parent === path ? [path] : [...ancestorPaths(parent), path];
+}
+export function revalidateDirectories(identities) {
+    for (const identity of identities) {
+        let current;
+        try {
+            current = lstatSync(identity.path);
+        }
+        catch (error) {
+            throw unsafe(`Directory changed during access: ${identity.path}`, 'IDENTITY_CHANGED', error);
+        }
+        if (current.isSymbolicLink() || !current.isDirectory() || !sameIdentity(identity.stat, current))
+            throw unsafe(`Directory changed during access: ${identity.path}`, 'IDENTITY_CHANGED');
+    }
+}
+export function readRegularFile(path, maxBytes, options = {}) {
+    return readRegularFileWithIdentity(path, maxBytes, options).bytes;
+}
+export function readRegularFileWithIdentity(path, maxBytes, options = {}) {
+    const parents = captureDirectories(dirname(path));
+    const allowedLinkCounts = options.allowedLinkCounts ?? [1];
+    let descriptor;
+    try {
+        descriptor = openSync(path, fsConstants.O_RDONLY | noFollowFlag());
+        const before = fstatSync(descriptor);
+        assertRegularWithLinks(before, path, allowedLinkCounts);
+        if (before.size > maxBytes)
+            throw new ResourceLimitError(`Managed file exceeds configured byte limit: ${path}`);
+        const pathBefore = lstatSync(path);
+        if (pathBefore.isSymbolicLink() || !sameIdentity(before, pathBefore))
+            throw unsafe(`Managed file identity changed before read: ${path}`, 'IDENTITY_CHANGED');
+        emitFilesystemFault('bounded-read-opened', path);
+        const capacity = Math.min(maxBytes + 1, before.size + 1);
+        const buffer = Buffer.allocUnsafe(capacity);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const count = readSync(descriptor, buffer, offset, buffer.byteLength - offset, offset);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        if (offset > maxBytes)
+            throw new ResourceLimitError(`Managed file exceeds configured byte limit: ${path}`);
+        const after = fstatSync(descriptor);
+        assertRegularWithLinks(after, path, allowedLinkCounts);
+        if (!sameIdentity(before, after) ||
+            before.size !== after.size ||
+            before.mtimeMs !== after.mtimeMs ||
+            before.ctimeMs !== after.ctimeMs ||
+            before.nlink !== after.nlink ||
+            offset !== before.size)
+            throw unsafe(`Managed file changed during read: ${path}`, 'IDENTITY_CHANGED');
+        const pathAfter = lstatSync(path);
+        if (pathAfter.isSymbolicLink() || !sameIdentity(after, pathAfter))
+            throw unsafe(`Managed file identity changed after read: ${path}`, 'IDENTITY_CHANGED');
+        revalidateDirectories(parents);
+        return { bytes: buffer.subarray(0, offset), identity: after };
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError || error instanceof ResourceLimitError)
+            throw error;
+        if (hasCode(error, 'ELOOP'))
+            throw unsafe(`Symbolic link is not allowed: ${path}`, 'UNSAFE_LINK', error);
+        throw error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function assertSafeRegular(stat, path) {
+    assertRegularWithLinks(stat, path, [1]);
+}
+function assertRegularWithLinks(stat, path, allowedLinkCounts) {
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw unsafe(`Managed path is not a regular file: ${path}`, 'UNSAFE_LINK');
+    if (!allowedLinkCounts.includes(stat.nlink))
+        throw unsafe(`Managed file has an unsafe hard-link count: ${path}`, 'UNSAFE_HARD_LINK');
+}
+export function syncFileDescriptor(descriptor, path) {
+    try {
+        emitFilesystemFault('file-fsync', path);
+        fsyncSync(descriptor);
+    }
+    catch (error) {
+        throw new DurabilityError(`Failed to synchronize file: ${path}`, {
+            cause: error,
+            evidence: { operation: 'file-fsync', path },
+        });
+    }
+}
+export function syncRegularFile(path) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, fsConstants.O_RDONLY | noFollowFlag());
+        const opened = fstatSync(descriptor);
+        assertSafeRegular(opened, path);
+        syncFileDescriptor(descriptor, path);
+        const current = lstatSync(path);
+        if (!sameIdentity(opened, current))
+            throw unsafe(`File changed during synchronization: ${path}`, 'IDENTITY_CHANGED');
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function syncDirectory(path) {
+    if (process.platform === 'win32')
+        return;
+    let descriptor;
+    try {
+        descriptor = openSync(path, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | noFollowFlag());
+        const stat = fstatSync(descriptor);
+        if (!stat.isDirectory())
+            throw unsafe(`Unsafe directory: ${path}`);
+        try {
+            emitFilesystemFault('directory-fsync', path);
+            fsyncSync(descriptor);
+        }
+        catch (error) {
+            throw new DurabilityError(`Failed to synchronize directory: ${path}`, {
+                cause: error,
+                evidence: { operation: 'directory-fsync', path },
+            });
+        }
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+function unsafe(message, code = 'UNSAFE_LINK', cause) {
+    const error = new PathSafetyError(message, code);
+    if (cause !== undefined)
+        Object.defineProperty(error, 'cause', { value: cause, enumerable: false });
+    return error;
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/internal/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/internal/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,GAET,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAS3D,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,KAAc,EAAE,IAAY;IAClD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,IAAI,CAAC;AACrG,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,IAAW,EAAE,KAAY;IACpD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAC1D,CAAC;AAGD,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,MAAM,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;YAC/F,MAAM;QACR,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,MAAM,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;YACrF,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,MAAM,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,MAAM,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACrG,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAGD,MAAM,UAAU,qBAAqB,CAAC,UAAwC;IAC5E,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,OAAc,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAC7F,MAAM,MAAM,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB,EAChB,UAA8D,EAAE;IAEhE,OAAO,2BAA2B,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC;AAGD,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAAgB,EAChB,UAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC;YAClE,MAAM,MAAM,CAAC,8CAA8C,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACzF,mBAAmB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACvD,IACE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;YAC5B,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAChC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC5B,MAAM,KAAK,MAAM,CAAC,IAAI;YAEtB,MAAM,MAAM,CAAC,qCAAqC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;YAC/D,MAAM,MAAM,CAAC,6CAA6C,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACxF,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAC;QACzF,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,MAAM,MAAM,CAAC,iCAAiC,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACzG,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,iBAAiB,CAAC,IAAW,EAAE,IAAY;IACzD,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAW,EAAE,IAAY,EAAE,iBAAoC;IAC7F,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QACzC,MAAM,MAAM,CAAC,uCAAuC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAC7E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACzC,MAAM,MAAM,CAAC,+CAA+C,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5F,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,IAAY;IACjE,IAAI,CAAC;QACH,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACxC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,+BAA+B,IAAI,EAAE,EAAE;YAC/D,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;YAChC,MAAM,MAAM,CAAC,wCAAwC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAC7C,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CAAC,oCAAoC,IAAI,EAAE,EAAE;gBACpE,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,OAAe,EACf,OAAgE,aAAa,EAC7E,KAAe;IAEf,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/internal/model.d.ts

@@ -0,0 +1,43 @@
+import type { Stats } from 'node:fs';
+import type { StoreLimits } from '../limits.js';
+export interface RootState {
+    readonly authorityRoot: string;
+    readonly managedRoot: string;
+    readonly authorityId: string;
+    readonly managedRootId: string;
+    readonly limits: StoreLimits;
+}
+export interface PathState {
+    readonly authorityId: string;
+    readonly managedRootId: string;
+    readonly absolutePath: string;
+}
+export interface LeaseState {
+    readonly authorityId: string;
+    readonly token: string;
+    readonly lockPath: string;
+    readonly lockIdentity: Stats;
+    readonly ownerIdentity: Stats;
+    readonly pendingOperations: Set<Promise<unknown>>;
+    active: boolean;
+}
+export interface ManagedRoot {
+    readonly authorityRoot: string;
+    readonly managedRoot: string;
+}
+export interface ManagedPath {
+    readonly relativePath: string;
+}
+export interface RepositoryLease {
+    readonly authorityRoot: string;
+}
+export declare function createManagedRoot(state: RootState): ManagedRoot;
+export declare function createManagedPath(relativePath: string, state: PathState): ManagedPath;
+export declare function createRepositoryLease(authorityRoot: string, state: LeaseState): RepositoryLease;
+export declare function getRootState(root: ManagedRoot): RootState | undefined;
+export declare function getPathState(path: ManagedPath): PathState | undefined;
+export declare function requireRootState(root: ManagedRoot): RootState;
+export declare function requirePathState(path: ManagedPath): PathState;
+export declare function getLeaseState(lease: RepositoryLease): LeaseState | undefined;
+export declare function managedPathBelongsToRoot(root: ManagedRoot, path: ManagedPath): boolean;
+//# sourceMappingURL=model.d.ts.map

package/dist/internal/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/internal/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAGD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC;CACjB;AAGD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAI/D;AAGD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW,CAIrF;AAGD,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,eAAe,CAI/F;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAErE;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAErE;AAGD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAI7D;AAGD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAI7D;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAE5E;AAGD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAStF"}

package/dist/internal/model.js

@@ -0,0 +1,49 @@
+import { PathSafetyError } from '../errors.js';
+const rootStates = new WeakMap();
+const pathStates = new WeakMap();
+const leaseStates = new WeakMap();
+export function createManagedRoot(state) {
+    const root = Object.freeze({ authorityRoot: state.authorityRoot, managedRoot: state.managedRoot });
+    rootStates.set(root, state);
+    return root;
+}
+export function createManagedPath(relativePath, state) {
+    const path = Object.freeze({ relativePath });
+    pathStates.set(path, state);
+    return path;
+}
+export function createRepositoryLease(authorityRoot, state) {
+    const lease = Object.freeze({ authorityRoot });
+    leaseStates.set(lease, state);
+    return lease;
+}
+export function getRootState(root) {
+    return rootStates.get(root);
+}
+export function getPathState(path) {
+    return pathStates.get(path);
+}
+export function requireRootState(root) {
+    const state = getRootState(root);
+    if (state === undefined)
+        throw new PathSafetyError('Managed root is not a repository-store handle.');
+    return state;
+}
+export function requirePathState(path) {
+    const state = getPathState(path);
+    if (state === undefined)
+        throw new PathSafetyError('Managed path is not a repository-store handle.');
+    return state;
+}
+export function getLeaseState(lease) {
+    return leaseStates.get(lease);
+}
+export function managedPathBelongsToRoot(root, path) {
+    const rootState = getRootState(root);
+    const pathState = getPathState(path);
+    return (pathState !== undefined &&
+        rootState !== undefined &&
+        pathState.authorityId === rootState.authorityId &&
+        pathState.managedRootId === rootState.managedRootId);
+}
+//# sourceMappingURL=model.js.map

package/dist/internal/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/internal/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAiD/C,MAAM,UAAU,GAAG,IAAI,OAAO,EAA0B,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,OAAO,EAA0B,CAAC;AACzD,MAAM,WAAW,GAAG,IAAI,OAAO,EAA+B,CAAC;AAG/D,MAAM,UAAU,iBAAiB,CAAC,KAAgB;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACnG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,KAAgB;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7C,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,KAAiB;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/C,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAGD,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,gDAAgD,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,gDAAgD,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAGD,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,IAAiB;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,CACL,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC/C,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa,CACpD,CAAC;AACJ,CAAC"}

package/dist/internal/native-publication.d.ts

@@ -0,0 +1,9 @@
+export interface NativePublicationBackend {
+    renameNoReplace(source: string, destination: string): void;
+    supportsLocalPath(path: string): boolean;
+}
+export declare function requireNativePublicationBackend(): NativePublicationBackend;
+export declare function nativeRenameNoReplace(backend: NativePublicationBackend, source: string, destination: string): void;
+export declare function assertNativePublicationPath(backend: NativePublicationBackend, path: string): void;
+export declare function setNativePublicationBackendForTests(backend: NativePublicationBackend | null | undefined): void;
+//# sourceMappingURL=native-publication.d.ts.map

package/dist/internal/native-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-publication.d.ts","sourceRoot":"","sources":["../../src/internal/native-publication.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,wBAAwB;IACvC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAOD,wBAAgB,+BAA+B,IAAI,wBAAwB,CAuB1E;AAGD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAQlH;AAGD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAOjG;AAGD,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE9G"}

package/dist/internal/native-publication.js

@@ -0,0 +1,65 @@
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { UnsupportedRuntimeError } from '../errors.js';
+let injectedBackend;
+let loadedBackend;
+let loadFailure;
+export function requireNativePublicationBackend() {
+    if (injectedBackend !== undefined) {
+        if (injectedBackend !== null)
+            return injectedBackend;
+        throw unsupported('Native publication backend is disabled for this operation.');
+    }
+    if (process.platform !== 'linux')
+        throw unsupported(`Exact destructive publication is unsupported on ${process.platform}.`);
+    if (loadedBackend !== undefined)
+        return loadedBackend;
+    if (loadFailure !== undefined)
+        throw unsupported('Native publication backend could not be loaded.', loadFailure);
+    try {
+        const require = createRequire(import.meta.url);
+        const packageRoot = fileURLToPath(new URL('../../', import.meta.url));
+        const candidate = require(`${packageRoot}build/Release/repository_store_native.node`);
+        if (typeof candidate.renameNoReplace !== 'function' || typeof candidate.supportsLocalPath !== 'function')
+            throw new Error('Native addon does not expose the complete publication contract.');
+        loadedBackend = candidate;
+        return loadedBackend;
+    }
+    catch (error) {
+        loadFailure = error;
+        throw unsupported('Native publication backend could not be loaded.', error);
+    }
+}
+export function nativeRenameNoReplace(backend, source, destination) {
+    try {
+        backend.renameNoReplace(source, destination);
+    }
+    catch (error) {
+        if (['EINVAL', 'EXDEV', 'ENOSYS', 'ENOTSUP', 'EOPNOTSUPP'].some((code) => hasCode(error, code)))
+            throw unsupported(`Native no-replace move is unsupported for ${source}.`, error);
+        throw error;
+    }
+}
+export function assertNativePublicationPath(backend, path) {
+    try {
+        if (backend.supportsLocalPath(path))
+            return;
+    }
+    catch (error) {
+        throw unsupported(`Native filesystem capability check failed for ${path}.`, error);
+    }
+    throw unsupported(`Exact destructive publication requires a supported Linux local filesystem: ${path}.`);
+}
+export function setNativePublicationBackendForTests(backend) {
+    injectedBackend = backend;
+}
+function hasCode(error, code) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
+}
+function unsupported(message, cause) {
+    const error = new UnsupportedRuntimeError(message);
+    if (cause !== undefined)
+        Object.defineProperty(error, 'cause', { value: cause });
+    return error;
+}
+//# sourceMappingURL=native-publication.js.map

package/dist/internal/native-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-publication.js","sourceRoot":"","sources":["../../src/internal/native-publication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAQvD,IAAI,eAA4D,CAAC;AACjE,IAAI,aAAmD,CAAC;AACxD,IAAI,WAAoB,CAAC;AAGzB,MAAM,UAAU,+BAA+B;IAC7C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,eAAe,KAAK,IAAI;YAAE,OAAO,eAAe,CAAC;QACrD,MAAM,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC9B,MAAM,WAAW,CAAC,mDAAmD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC5F,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,WAAW,CAAC,iDAAiD,EAAE,WAAW,CAAC,CAAC;IACjH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,CACvB,GAAG,WAAW,4CAA4C,CACtB,CAAC;QACvC,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,SAAS,CAAC,iBAAiB,KAAK,UAAU;YACtG,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,aAAa,GAAG,SAAqC,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,WAAW,GAAG,KAAK,CAAC;QACpB,MAAM,WAAW,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,qBAAqB,CAAC,OAAiC,EAAE,MAAc,EAAE,WAAmB;IAC1G,IAAI,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7F,MAAM,WAAW,CAAC,6CAA6C,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,2BAA2B,CAAC,OAAiC,EAAE,IAAY;IACzF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO;IAC9C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,iDAAiD,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,CAAC,8EAA8E,IAAI,GAAG,CAAC,CAAC;AAC3G,CAAC;AAGD,MAAM,UAAU,mCAAmC,CAAC,OAAoD;IACtG,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAe;IACnD,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/internal/publication.d.ts

@@ -0,0 +1,10 @@
+import { type Stats } from 'node:fs';
+import { type ByteRevision } from '../revision.js';
+export interface ExpectedRegularFile {
+    readonly identity: Stats;
+    readonly revision: ByteRevision;
+    readonly maxBytes: number;
+}
+export declare function publishExactRegularFile(path: string, bytes: Uint8Array | null, expected: ExpectedRegularFile | undefined, token: string): void;
+export declare function recoverExactPublication(path: string, token: string, allowedRevisions: readonly (ByteRevision | null)[], maxBytes: number): void;
+//# sourceMappingURL=publication.d.ts.map

package/dist/internal/publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.d.ts","sourceRoot":"","sources":["../../src/internal/publication.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,KAAK,EACX,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAsBxE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAOD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,EACzC,KAAK,EAAE,MAAM,GACZ,IAAI,CAwGN;AAID,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,EAClD,QAAQ,EAAE,MAAM,GACf,IAAI,CA2CN"}

package/dist/internal/publication.js

@@ -0,0 +1,223 @@
+import { closeSync, constants as fsConstants, fstatSync, linkSync, lstatSync, openSync, rmSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { PathSafetyError, RecoveryError, UnsupportedRuntimeError } from '../errors.js';
+import { computeByteRevision } from '../revision.js';
+import { emitFilesystemFault } from './fault-injection.js';
+import { assertSafeRegular, captureDirectories, ensurePrivateDirectory, hasCode, noFollowFlag, readRegularFile, revalidateDirectories, sameIdentity, syncDirectory, syncFileDescriptor, } from './filesystem.js';
+import { assertNativePublicationPath, nativeRenameNoReplace, requireNativePublicationBackend, } from './native-publication.js';
+export function publishExactRegularFile(path, bytes, expected, token) {
+    const parent = dirname(path);
+    ensurePrivateDirectory(parent);
+    const parents = captureDirectories(parent);
+    const temporary = join(parent, `.${basename(path)}.${token}.repository-store.tmp`);
+    const evacuated = join(parent, `.${basename(path)}.${token}.repository-store.evacuated`);
+    const nativeBackend = expected === undefined ? undefined : requireNativePublicationBackend();
+    if (nativeBackend !== undefined)
+        assertNativePublicationPath(nativeBackend, parent);
+    let descriptor;
+    let temporaryIdentity;
+    let evacuatedIdentity;
+    try {
+        if (artifactExists(evacuated))
+            throw new RecoveryError('A prior exact-publication evacuation requires recovery.', 'RECOVERY_AMBIGUOUS', {
+                path,
+                evacuated,
+            });
+        if (bytes !== null) {
+            descriptor = openSync(temporary, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), 0o600);
+            writeFileSync(descriptor, bytes);
+            syncFileDescriptor(descriptor, temporary);
+            temporaryIdentity = fstatSync(descriptor);
+            assertSafeRegular(temporaryIdentity, temporary);
+            closeSync(descriptor);
+            descriptor = undefined;
+        }
+        if (expected !== undefined) {
+            emitFilesystemFault(bytes === null ? 'before-exact-removal' : 'before-exact-publication', path);
+            emitFilesystemFault('before-exact-evacuation', evacuated);
+            moveNoReplace(nativeBackend, path, evacuated, 'evacuate destination');
+            emitFilesystemFault('destination-evacuated', path);
+            evacuatedIdentity = lstatSync(evacuated);
+            assertSafeRegular(evacuatedIdentity, evacuated);
+            const evacuatedBytes = readRegularFile(evacuated, expected.maxBytes);
+            if (!sameIdentity(expected.identity, evacuatedIdentity) ||
+                computeByteRevision(evacuatedBytes) !== expected.revision) {
+                restoreEvacuated(nativeBackend, evacuated, path, parent);
+                evacuatedIdentity = undefined;
+                throw new PathSafetyError(`Destination changed during publication: ${path}`, 'IDENTITY_CHANGED', {
+                    path,
+                });
+            }
+            revalidateDirectories(parents);
+            syncDirectory(parent);
+        }
+        else if (bytes !== null) {
+            emitFilesystemFault('before-exact-publication', path);
+        }
+        if (bytes !== null) {
+            try {
+                linkSync(temporary, path);
+            }
+            catch (error) {
+                if (hasCode(error, 'EEXIST')) {
+                    if (evacuatedIdentity !== undefined)
+                        restoreEvacuated(nativeBackend, evacuated, path, parent);
+                    evacuatedIdentity = undefined;
+                    throw new PathSafetyError(`Destination appeared during publication: ${path}`, 'IDENTITY_CHANGED');
+                }
+                throw unsupportedLink(error, path);
+            }
+            emitFilesystemFault('exclusive-destination-published', path);
+            const destination = lstatSync(path);
+            if (temporaryIdentity === undefined || !sameIdentity(temporaryIdentity, destination))
+                throw new PathSafetyError(`Destination changed during publication: ${path}`, 'IDENTITY_CHANGED');
+            rmSync(temporary);
+            temporaryIdentity = undefined;
+            revalidateDirectories(parents);
+            syncDirectory(parent);
+        }
+        if (evacuatedIdentity !== undefined) {
+            const current = lstatSync(evacuated);
+            if (!sameIdentity(evacuatedIdentity, current))
+                throw new RecoveryError('Evacuated publication evidence changed before cleanup.', 'RECOVERY_AMBIGUOUS', {
+                    path,
+                    evacuated,
+                });
+            rmSync(evacuated);
+            evacuatedIdentity = undefined;
+            syncDirectory(parent);
+        }
+        else if (bytes === null) {
+            revalidateDirectories(parents);
+        }
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        try {
+            revalidateDirectories(parents);
+            if (temporaryIdentity !== undefined && artifactExists(temporary)) {
+                const current = lstatSync(temporary);
+                if (sameIdentity(temporaryIdentity, current))
+                    rmSync(temporary);
+            }
+        }
+        catch {
+        }
+    }
+}
+export function recoverExactPublication(path, token, allowedRevisions, maxBytes) {
+    const parent = dirname(path);
+    const evacuated = join(parent, `.${basename(path)}.${token}.repository-store.evacuated`);
+    const temporary = join(parent, `.${basename(path)}.${token}.repository-store.tmp`);
+    recoverTemporaryPublication(path, temporary, token, allowedRevisions, maxBytes);
+    if (!artifactExists(evacuated))
+        return;
+    const evidence = lstatSync(evacuated);
+    if (evidence.isSymbolicLink() || !evidence.isFile())
+        throw new RecoveryError('Evacuated publication evidence is unsafe.', 'RECOVERY_AMBIGUOUS', { path, evacuated });
+    let current;
+    try {
+        current = lstatSync(path);
+    }
+    catch (error) {
+        if (!hasCode(error, 'ENOENT'))
+            throw error;
+    }
+    if (current === undefined) {
+        restoreEvacuated(requireNativePublicationBackend(), evacuated, path, parent);
+        return;
+    }
+    if (sameIdentity(evidence, current)) {
+        rmSync(evacuated);
+        syncDirectory(parent);
+        return;
+    }
+    assertSafeRegular(evidence, evacuated);
+    assertSafeRegular(current, path);
+    const evidenceRevision = computeByteRevision(readRegularFile(evacuated, maxBytes));
+    const currentRevision = computeByteRevision(readRegularFile(path, maxBytes));
+    if (!allowedRevisions.includes(evidenceRevision) || !allowedRevisions.includes(currentRevision))
+        throw new RecoveryError('Canonical and evacuated states contain unauthenticated revisions.', 'RECOVERY_AMBIGUOUS', {
+            path,
+            evacuated,
+            evidenceRevision,
+            currentRevision,
+        });
+    publishExactRegularFile(evacuated, null, { identity: evidence, revision: evidenceRevision, maxBytes }, `${token}-evidence`);
+}
+function recoverTemporaryPublication(path, temporary, token, allowedRevisions, maxBytes) {
+    if (!artifactExists(temporary))
+        return;
+    const temporaryIdentity = lstatSync(temporary);
+    let destination;
+    try {
+        destination = lstatSync(path);
+    }
+    catch (error) {
+        if (!hasCode(error, 'ENOENT'))
+            throw error;
+    }
+    if (destination !== undefined && sameIdentity(temporaryIdentity, destination)) {
+        rmSync(temporary);
+        syncDirectory(dirname(path));
+        return;
+    }
+    assertSafeRegular(temporaryIdentity, temporary);
+    const revision = computeByteRevision(readRegularFile(temporary, maxBytes));
+    if (!allowedRevisions.includes(revision))
+        throw new RecoveryError('Temporary publication artifact has an unauthenticated revision.', 'RECOVERY_AMBIGUOUS', {
+            path,
+            temporary,
+            revision,
+        });
+    publishExactRegularFile(temporary, null, { identity: temporaryIdentity, revision, maxBytes }, `${token}-temporary`);
+}
+function restoreEvacuated(backend, evacuated, path, parent) {
+    try {
+        nativeRenameNoReplace(backend, evacuated, path);
+    }
+    catch (error) {
+        if (hasCode(error, 'EEXIST'))
+            throw new RecoveryError('Cannot restore raced destination because another entry appeared.', 'RECOVERY_AMBIGUOUS', { path, evacuated });
+        throw nativeMoveError(error, path, 'restore destination');
+    }
+    syncDirectory(parent);
+}
+function moveNoReplace(backend, source, destination, operation) {
+    try {
+        nativeRenameNoReplace(backend, source, destination);
+    }
+    catch (error) {
+        if (hasCode(error, 'EEXIST'))
+            throw new RecoveryError(`Cannot ${operation}; private destination already exists.`, 'RECOVERY_AMBIGUOUS', {
+                source,
+                destination,
+            });
+        if (hasCode(error, 'ENOENT'))
+            throw new PathSafetyError(`Source disappeared while attempting to ${operation}: ${source}`, 'IDENTITY_CHANGED');
+        throw nativeMoveError(error, source, operation);
+    }
+}
+function nativeMoveError(error, path, operation) {
+    if (['EINVAL', 'EXDEV', 'ENOSYS', 'ENOTSUP', 'EOPNOTSUPP'].some((code) => hasCode(error, code)))
+        return new UnsupportedRuntimeError(`Filesystem cannot ${operation} without replacement: ${path}`);
+    return error;
+}
+function unsupportedLink(error, path) {
+    if (['EPERM', 'EXDEV', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS'].some((code) => hasCode(error, code)))
+        return new UnsupportedRuntimeError(`Filesystem does not support exclusive regular-file publication: ${path}`);
+    return error;
+}
+function artifactExists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+}
+//# sourceMappingURL=publication.js.map