@openclaw/fs-safe 0.10.0 → 0.12.0

package/dist/root-remove.js

@@ -0,0 +1,286 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { assertAsyncDirectoryGuard, assertSyncDirectoryGuard, createAsyncDirectoryGuard, } from "./directory-guard.js";
+import { assertMutationNotDenied } from "./deny-mutations.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { MutationAuthorityError } from "./mutation-authority.js";
+import { isNotFoundPathError, isPathInside } from "./path.js";
+import { assertRootIdentityCurrent } from "./root-context.js";
+import { normalizeRemoveGuardError, normalizeRemovePathError, rootPathChangedError } from "./root-errors.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { createSuppressedError } from "./suppressed-error.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+const DEFAULT_MAX_ENTRIES = 100_000;
+const DEFAULT_MAX_DEPTH = 64;
+export function validateRemoveOptions(options) {
+    if (options.order !== undefined && options.order !== "filesystem" && options.order !== "sorted") {
+        throw new TypeError("remove order must be filesystem or sorted");
+    }
+    for (const key of ["maxEntries", "maxDepth"]) {
+        const value = options[key];
+        if (value !== undefined && value !== Number.POSITIVE_INFINITY && (!Number.isSafeInteger(value) || value < 0)) {
+            throw new RangeError(`${key} must be a non-negative safe integer`);
+        }
+    }
+    if (!options.recursive && (options.maxEntries !== undefined || options.maxDepth !== undefined)) {
+        throw new TypeError("remove budgets require recursive: true");
+    }
+    if (!options.recursive && options.order !== undefined) {
+        throw new TypeError("remove order requires recursive: true");
+    }
+}
+function assertNotAborted(signal) {
+    try {
+        signal?.throwIfAborted();
+    }
+    catch (error) {
+        // Preserve arbitrary abort reasons through Root's filesystem error mapping.
+        throw new MutationAuthorityError(error);
+    }
+}
+async function removeOne(root, targetPath, options) {
+    let guard;
+    try {
+        guard = await createAsyncDirectoryGuard(path.dirname(targetPath));
+    }
+    catch (error) {
+        if (options.force && isNotFoundPathError(error)) {
+            await assertRootIdentityCurrent(root);
+            assertNotAborted(options.signal);
+            return;
+        }
+        throw normalizeRemoveGuardError(error);
+    }
+    try {
+        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", targetPath);
+        await assertAsyncDirectoryGuard(guard);
+    }
+    catch (error) {
+        throw normalizeRemoveGuardError(error);
+    }
+    try {
+        const isDirectory = fsSync.lstatSync(targetPath).isDirectory();
+        assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
+        assertNotAborted(options.signal);
+        options.assertBeforeMutation?.();
+        await (isDirectory ? fs.rmdir(targetPath) : fs.unlink(targetPath));
+    }
+    catch (error) {
+        if (!(options.force && isNotFoundPathError(error)))
+            throw normalizeRemovePathError(error);
+    }
+    await assertAsyncDirectoryGuard(guard).catch(error => { throw normalizeRemoveGuardError(error); });
+    assertNotAborted(options.signal);
+}
+export async function removePathInRootFallback(root, targetPath, options) {
+    assertNotAborted(options.signal);
+    if (!options.recursive) {
+        await removeOne(root, targetPath, options);
+        return;
+    }
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const details = (target, phase) => ({
+        operation: "remove",
+        phase,
+        relativePath: path.relative(targetPath, target),
+    });
+    let examined = 0;
+    const rootGuard = await createAsyncDirectoryGuard(root.rootReal, { bigint: true });
+    if (!sameFileIdentityForCleanup(rootGuard.stat, root.rootIdentity))
+        throw rootPathChangedError();
+    const guards = [rootGuard];
+    let ancestor = root.rootReal;
+    const parentRelative = path.relative(root.rootReal, path.dirname(targetPath));
+    for (const segment of parentRelative.split(path.sep).filter(Boolean)) {
+        ancestor = path.join(ancestor, segment);
+        let guard;
+        try {
+            guard = await createAsyncDirectoryGuard(ancestor, { bigint: true });
+        }
+        catch (error) {
+            if (isNotFoundPathError(error)) {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                if (options.force)
+                    return;
+            }
+            throw normalizeRemoveGuardError(error);
+        }
+        if (!isPathInside(guard.realPath, ancestor) || !isPathInside(ancestor, guard.realPath)) {
+            throw new FsSafeError("path-mismatch", "removal ancestor changed during operation");
+        }
+        guards.push(guard);
+    }
+    function assertCurrent() {
+        for (const guard of guards) {
+            try {
+                assertSyncDirectoryGuard(guard);
+            }
+            catch (error) {
+                // force tolerates a vanished leaf, never a lost traversal boundary.
+                throw new FsSafeError("path-mismatch", "removal ancestor changed during operation", { cause: error });
+            }
+        }
+    }
+    const inspect = (target, expected) => {
+        assertCurrent();
+        try {
+            return inspectFileIdentitySync(() => fsSync.lstatSync(target, { bigint: true }), expected);
+        }
+        catch (error) {
+            if (options.force && isNotFoundPathError(error))
+                return;
+            throw normalizeRemovePathError(error, details(target, expected ? "remove" : "inspect"));
+        }
+    };
+    async function visit(target, depth, entryCounted = false) {
+        assertNotAborted(options.signal);
+        if ((!entryCounted && examined >= maxEntries) || depth > maxDepth) {
+            throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+                details: details(target, "inspect"),
+            });
+        }
+        if (!entryCounted)
+            examined += 1;
+        await assertMutationNotDenied(target, options.denyMutations, { protectAncestors: true });
+        assertNotAborted(options.signal);
+        const initial = inspect(target);
+        if (!initial)
+            return;
+        assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "inspect"));
+        if (initial.isDirectory()) {
+            let directoryGuard;
+            try {
+                directoryGuard = await createAsyncDirectoryGuard(target, { bigint: true });
+            }
+            catch (error) {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                if (options.force && isNotFoundPathError(error))
+                    return;
+                throw normalizeRemovePathError(error, details(target, "inspect"));
+            }
+            if (!isPathInside(directoryGuard.realPath, target) || !isPathInside(target, directoryGuard.realPath) ||
+                !sameFileIdentityForCleanup(directoryGuard.stat, initial)) {
+                throw new FsSafeError("path-mismatch", "removal directory changed during operation");
+            }
+            guards.push(directoryGuard);
+            try {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                const handle = await fs.opendir(target, { bufferSize: 1 }).catch(error => {
+                    if (options.force && isNotFoundPathError(error)) {
+                        assertNotAborted(options.signal);
+                        return undefined;
+                    }
+                    throw normalizeRemovePathError(error, details(target, "enumerate"));
+                });
+                if (handle) {
+                    let failed = false;
+                    let operationError;
+                    try {
+                        let names = options.order === "sorted" ? [] : undefined;
+                        if (names && maxEntries === Infinity) {
+                            assertCurrent();
+                            assertNotAborted(options.signal);
+                            const snapshot = await fs.readdir(target).catch(error => {
+                                if (options.force && isNotFoundPathError(error))
+                                    return undefined;
+                                throw normalizeRemovePathError(error, details(target, "enumerate"));
+                            });
+                            assertNotAborted(options.signal);
+                            if (snapshot) {
+                                assertCurrent();
+                                names = snapshot;
+                                examined += names.length;
+                            }
+                        }
+                        else {
+                            while (true) {
+                                assertCurrent();
+                                assertNotAborted(options.signal);
+                                const entry = await handle.read().catch(error => {
+                                    if (options.force && isNotFoundPathError(error))
+                                        return undefined;
+                                    throw normalizeRemovePathError(error, details(target, "enumerate"));
+                                });
+                                if (entry === undefined) {
+                                    assertNotAborted(options.signal);
+                                    if (names)
+                                        names.length = 0;
+                                    break;
+                                }
+                                assertCurrent();
+                                assertNotAborted(options.signal);
+                                if (!entry)
+                                    break;
+                                if (names) {
+                                    if (examined >= maxEntries) {
+                                        throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+                                            details: details(path.join(target, entry.name), "enumerate"),
+                                        });
+                                    }
+                                    examined += 1;
+                                    names.push(entry.name);
+                                }
+                                else {
+                                    await visit(path.join(target, entry.name), depth + 1);
+                                }
+                            }
+                        }
+                        if (names) {
+                            for (const name of names.sort()) {
+                                await visit(path.join(target, name), depth + 1, true);
+                            }
+                        }
+                    }
+                    catch (error) {
+                        failed = true;
+                        operationError = error instanceof MutationAuthorityError ? error.rejection : error;
+                        throw error;
+                    }
+                    finally {
+                        try {
+                            // Close before rmdir, including on Windows and after revocation.
+                            await handle.close();
+                        }
+                        catch (error) {
+                            const closeError = normalizeRemovePathError(error, details(target, "enumerate"));
+                            if (failed)
+                                throw createSuppressedError(closeError, operationError, "recursive removal and close both failed");
+                            throw closeError;
+                        }
+                    }
+                }
+            }
+            finally {
+                guards.pop();
+            }
+        }
+        // A tolerated missing-directory observation still rechecks its target and ancestors.
+        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", target);
+        await assertMutationNotDenied(target, options.denyMutations, { protectAncestors: true });
+        assertNotAborted(options.signal);
+        if (!inspect(target, initial))
+            return;
+        assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
+        assertNotAborted(options.signal);
+        options.assertBeforeMutation?.();
+        try {
+            await (initial.isDirectory() ? fs.rmdir(target) : fs.unlink(target));
+        }
+        catch (error) {
+            if (!(options.force && isNotFoundPathError(error))) {
+                throw normalizeRemovePathError(error, details(target, "remove"));
+            }
+        }
+        assertCurrent();
+        assertNotAborted(options.signal);
+    }
+    await assertRootIdentityCurrent(root);
+    await visit(targetPath, 0);
+}

package/dist/root-symlink-policy.d.ts

@@ -1,3 +1,4 @@
+import { type FsSafeErrorDetails } from "./errors.js";
 export type SymlinkPolicy = "reject" | "follow-within-root" | "follow-parents-within-root";
 export type MutationSymlinkPolicy = "reject" | "follow-parents-within-root";
 export declare function readSymlinkResolution(symlinks: SymlinkPolicy | undefined): {
@@ -9,5 +10,5 @@ export declare function mutationSymlinkResolution(symlinks: MutationSymlinkPolic
     rejectFinalSymlink: boolean;
     resolveCanonical: boolean;
 };
-export declare function assertFinalSymlinkRejected(targetPath: string, reject: boolean | undefined): void;
+export declare function assertFinalSymlinkRejected(targetPath: string, reject: boolean | undefined, details?: FsSafeErrorDetails): void;
 //# sourceMappingURL=root-symlink-policy.d.ts.map

package/dist/root-symlink-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root-symlink-policy.d.ts","sourceRoot":"","sources":["../src/root-symlink-policy.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAC3F,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,4BAA4B,CAAC;AAE5E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS;IAErE,cAAc;IACd,kBAAkB;EAErB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS;IAKjF,cAAc;IACd,kBAAkB;IAClB,gBAAgB;EAEnB;AAID,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAShG"}
+{"version":3,"file":"root-symlink-policy.d.ts","sourceRoot":"","sources":["../src/root-symlink-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGnE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAC3F,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,4BAA4B,CAAC;AAE5E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS;IAErE,cAAc;IACd,kBAAkB;EAErB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS;IAKjF,cAAc;IACd,kBAAkB;IAClB,gBAAgB;EAEnB;AAID,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CASN"}

package/dist/root-symlink-policy.js

@@ -19,12 +19,12 @@ export function mutationSymlinkResolution(symlinks) {
 }
 // Call after parent fences and immediately before the mutation. This is a
 // final-component check, not an atomic conditional rename against another process.
-export function assertFinalSymlinkRejected(targetPath, reject) {
+export function assertFinalSymlinkRejected(targetPath, reject, details) {
     if (!reject)
         return;
     try {
         if (fs.lstatSync(targetPath).isSymbolicLink()) {
-            throw new FsSafeError("symlink", "final symlink not allowed");
+            throw new FsSafeError("symlink", "final symlink not allowed", { details });
         }
     }
     catch (error) {

package/dist/root-walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root-walk.d.ts","sourceRoot":"","sources":["../src/root-walk.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGrD,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,oBAAoB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,OAAO,CAAC;AACzD,MAAM,MAAM,8BAA8B,GAAG,OAAO,GAAG,iBAAiB,CAAC;AACzE,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,MAAM,GAAG,cAAc,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAExF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACpD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/E,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,yBAAyB,CAAC;AAE1F,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAChC,aAAa,EAAE,qBAAqB,CAAC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACnD,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CACF,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC,CAAC;AAqBF,wBAAuB,QAAQ,CAC7B,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,cAAc,CAAC,aAAa,CAAC,CAqK/B"}
+{"version":3,"file":"root-walk.d.ts","sourceRoot":"","sources":["../src/root-walk.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGrD,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,oBAAoB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,OAAO,CAAC;AACzD,MAAM,MAAM,8BAA8B,GAAG,OAAO,GAAG,iBAAiB,CAAC;AACzE,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,MAAM,GAAG,cAAc,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAExF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACpD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/E,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,yBAAyB,CAAC;AAE1F,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAChC,aAAa,EAAE,qBAAqB,CAAC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACnD,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CACF,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC,CAAC;AAqBF,wBAAuB,QAAQ,CAC7B,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,cAAc,CAAC,aAAa,CAAC,CAsK/B"}

package/dist/root-walk.js

@@ -98,6 +98,7 @@ export async function* walkRoot(root, relativePath, options) {
         let failed = false;
         let operationError;
         try {
+            const relativeDirectory = directory.split(path.sep).join(path.posix.sep);
             while (true) {
                 let next;
                 try {
@@ -112,7 +113,7 @@ export async function* walkRoot(root, relativePath, options) {
                     return;
                 const name = next.kind === "entry" ? next.entry.name : next.name;
                 const child = directory
-                    ? path.posix.join(directory.split(path.sep).join(path.posix.sep), name)
+                    ? path.posix.join(relativeDirectory, name)
                     : name;
                 if (next.kind === "limit") {
                     yield onLimit(child);

package/dist/root-write-mode.d.ts

@@ -1,6 +1,8 @@
+import { type RootBoundaryIdentity } from "./root-boundary.js";
 export declare function inheritWriteTargetMode(params: {
     targetPath: string;
     rootWithSep: string;
+    rootIdentity?: RootBoundaryIdentity;
     requestedMode?: number;
 }): Promise<number>;
 //# sourceMappingURL=root-write-mode.d.ts.map

package/dist/root-write-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root-write-mode.d.ts","sourceRoot":"","sources":["../src/root-write-mode.ts"],"names":[],"mappings":"AASA,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsClB"}
+{"version":3,"file":"root-write-mode.d.ts","sourceRoot":"","sources":["../src/root-write-mode.ts"],"names":[],"mappings":"AAQA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGpF,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDlB"}

package/dist/root-write-mode.js

@@ -1,25 +1,33 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
-import { isNotFoundPathError, isPathInside } from "./path.js";
+import { isNotFoundPathError } from "./path.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { realpathSync } from "./realpath.js";
 import { hardlinkedPathNotAllowedError, outsideWorkspaceError } from "./root-errors.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
 // The caller has already resolved and guarded this write target.
 export async function inheritWriteTargetMode(params) {
     try {
-        const existing = await inspectFileIdentity(() => fsSync.lstatSync(params.targetPath, { bigint: true }));
+        const admittedTarget = admitPathInsideRoot({
+            rootPath: params.rootWithSep,
+            candidatePath: params.targetPath,
+            rootIdentity: params.rootIdentity,
+        });
+        if (!admittedTarget)
+            throw outsideWorkspaceError();
+        const targetPath = admittedTarget.path;
+        const existing = await inspectFileIdentity(() => fsSync.lstatSync(targetPath, { bigint: true }));
         if (existing.isSymbolicLink())
             throw new FsSafeError("path-alias", "path alias escape blocked");
         if (!existing.isFile())
             throw new FsSafeError("not-file", "not a file");
         if (existing.nlink > 1n)
             throw hardlinkedPathNotAllowedError();
-        if (!isPathInside(params.rootWithSep, params.targetPath))
-            throw outsideWorkspaceError();
         // Preserve read-open admission of the pre-existing destination. access(2)
         // is not equivalent: it ignores ACLs on Windows and capabilities on Linux.
-        const handle = await fs.open(params.targetPath, resolveReadOpenFlags());
+        const handle = await fs.open(targetPath, resolveReadOpenFlags());
         try {
             // Bind admission to the inode whose metadata is inherited.
             await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }), existing);
@@ -30,9 +38,15 @@ export async function inheritWriteTargetMode(params) {
         try {
             // A parent can change after guarded resolution. Do not inherit metadata
             // from an outside inode, even if the parent is restored before publication.
-            const realPath = fsSync.realpathSync.native(params.targetPath);
-            if (!isPathInside(params.rootWithSep, realPath))
+            const observedRealPath = realpathSync.native(targetPath);
+            const admittedRealPath = admitPathInsideRoot({
+                rootPath: params.rootWithSep,
+                candidatePath: observedRealPath,
+                rootIdentity: params.rootIdentity,
+            });
+            if (!admittedRealPath)
                 throw outsideWorkspaceError();
+            const realPath = admittedRealPath.path;
             await inspectFileIdentity(async () => {
                 const current = fsSync.statSync(realPath, { bigint: true });
                 if (!current.isFile())

package/dist/root-write-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root-write-verification.d.ts","sourceRoot":"","sources":["../src/root-write-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAK9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFhB"}
+{"version":3,"file":"root-write-verification.d.ts","sourceRoot":"","sources":["../src/root-write-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAK9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CA6FhB"}

package/dist/root-write-verification.js

@@ -4,10 +4,11 @@ import { assertAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { resolveOpenedFileRealPathForFd } from "./opened-realpath.js";
-import { assertNoUnsafeDeviceReadPath, hasNodeErrorCode, isNotFoundPathError, isPathInside, isSymlinkOpenError } from "./path.js";
+import { assertNoUnsafeDeviceReadPath, hasNodeErrorCode, isNotFoundPathError, isSymlinkOpenError } from "./path.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { assertRootIdentityCurrent } from "./root-context.js";
 import { fileNotFoundError, hardlinkedPathNotAllowedError, outsideWorkspaceError } from "./root-errors.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
 export async function verifyAtomicWriteResult(params) {
     let needsPathOpen = false;
     const assertFile = (stat) => {
@@ -49,7 +50,11 @@ export async function verifyAtomicWriteResult(params) {
         assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
         const { realPath } = await resolveOpenedFileRealPathForFd(params.fd, stat, params.targetPath);
         assertPath(fsSync.statSync(realPath, { bigint: true }));
-        if (!isPathInside(params.root.rootWithSep, realPath)) {
+        if (!admitPathInsideRoot({
+            rootPath: params.root.rootReal,
+            candidatePath: realPath,
+            rootIdentity: params.root.rootIdentity,
+        })) {
             throw outsideWorkspaceError();
         }
         await assertAsyncDirectoryGuard(params.parentGuard);
@@ -76,7 +81,11 @@ export async function verifyAtomicWriteResult(params) {
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
                 const { realPath: reopenedPath } = await resolveOpenedFileRealPathForFd(opened.fd, reopenedStat, params.targetPath);
                 assertPath(fsSync.statSync(reopenedPath, { bigint: true }));
-                if (!isPathInside(params.root.rootWithSep, reopenedPath)) {
+                if (!admitPathInsideRoot({
+                    rootPath: params.root.rootReal,
+                    candidatePath: reopenedPath,
+                    rootIdentity: params.root.rootIdentity,
+                })) {
                     throw outsideWorkspaceError();
                 }
                 await assertAsyncDirectoryGuard(params.parentGuard);

package/dist/root.d.ts

@@ -1,6 +1,7 @@
-export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type DenyMutationPolicy, type HardlinkPolicy, type MutationSymlinkPolicy, type RenameIdentityPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCopySource, type RootCreateJsonOptions, type RootCreateOptions, type RootDefaults, type RootMkdirOptions, type RootMoveOptions, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootRemoveOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root-impl.js";
+export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type DenyMutationPolicy, type HardlinkPolicy, type MutationSymlinkPolicy, type RenameIdentityPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCopySource, type RootCreateJsonOptions, type RootCreateOptions, type RootCreateStreamOptions, type RootDefaults, type RootMkdirOptions, type RootMoveOptions, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootRemoveOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root-impl.js";
 export type { RootCopyPublicationReceipt } from "./copy-publication.js";
 export type { CopyCloneMode } from "./copy-policy.js";
+export type { RootEntriesOptions } from "./root-entries.js";
 export type { ContainmentGuarantee } from "./containment.js";
 export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";
 //# sourceMappingURL=root.d.ts.map

package/dist/root.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root.d.ts","sourceRoot":"","sources":["../src/root.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,kCAAkC,EAClC,IAAI,EACJ,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,8BAA8B,EAC9B,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"root.d.ts","sourceRoot":"","sources":["../src/root.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,kCAAkC,EAClC,IAAI,EACJ,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,8BAA8B,EAC9B,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC"}

package/dist/safe-path-segment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-path-segment.d.ts","sourceRoot":"","sources":["../src/safe-path-segment.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAaT;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAUR;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAWR;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAeR"}
+{"version":3,"file":"safe-path-segment.d.ts","sourceRoot":"","sources":["../src/safe-path-segment.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAaT;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAUR;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAWR;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAeR"}

package/dist/safe-path-segment.js

@@ -4,12 +4,14 @@ const SAFE_DOT_PREFIX_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9._-]+$/;
 // Windows treats "C:name" as relative to the drive's current directory even
 // though path.win32.isAbsolute() reports false.
 const DRIVE_RELATIVE_PREFIX = /^[A-Za-z]:(?![\\/])/;
+// A forward slash ends the segment, so "C:/file" still contains the "C:" segment.
+const DRIVE_RELATIVE_SEGMENT = /(?:^|\/)[A-Za-z]:(?!\\)/;
 const HYPHEN_CHAR_CODE = 0x2d;
 export function isDriveRelativePath(value) {
     return DRIVE_RELATIVE_PREFIX.test(value);
 }
 export function assertNoDriveRelativePathSegments(value, label) {
-    if (value.split("/").some(isDriveRelativePath)) {
+    if (DRIVE_RELATIVE_SEGMENT.test(value)) {
         throw new FsSafeError("invalid-path", `${label} must not contain a drive letter`);
     }
     return value;

package/dist/secret-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-file.d.ts","sourceRoot":"","sources":["../src/secret-file.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAK/C,OAAO,EAAkF,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAUhJ,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,eAAO,MAAM,uBAAuB,MAAQ,CAAC;AAC7C,eAAO,MAAM,wBAAwB,MAAQ,CAAC;AAE9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAkER;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,GAAG,SAAS,CAUpB;AA8JD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAYF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAuBD;AAwDD,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxF;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAezF"}
+{"version":3,"file":"secret-file.d.ts","sourceRoot":"","sources":["../src/secret-file.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,OAAO,EAAkF,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAUhJ,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,eAAO,MAAM,uBAAuB,MAAQ,CAAC;AAC7C,eAAO,MAAM,wBAAwB,MAAQ,CAAC;AAE9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAkER;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,GAAG,SAAS,CAUpB;AA8JD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAYF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAuBD;AAwDD,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxF;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAezF"}

package/dist/secret-file.js

@@ -1,6 +1,7 @@
 import fs, {} from "node:fs";
 import fsp from "node:fs/promises";
 import path from "node:path";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
 import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
@@ -166,7 +167,7 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
         catch (error) {
             if (error.code !== "ENOENT")
                 throw error;
-            await fsp.mkdir(path.dirname(resolvedRoot), { recursive: true, mode });
+            await fsp.mkdir(recursiveMkdirPath(path.dirname(resolvedRoot)), { recursive: true, mode });
             createdRoot = await createPrivateDirectory(resolvedRoot, mode);
         }
         rootStat = await inspectPrivateDirectory(resolvedRoot, "root");

package/dist/secret-read-async.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}
+{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAQA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}

package/dist/secret-read-async.js

@@ -4,6 +4,7 @@ import { readFileHandleBounded } from "./bounded-read.js";
 import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { realpathSync } from "./realpath.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
 import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 export async function readSecretFile(filePath, label, options = {}) {
@@ -29,7 +30,7 @@ export async function readSecretFile(filePath, label, options = {}) {
     let handle;
     let raw;
     try {
-        const realPath = fsSync.realpathSync.native(resolvedPath);
+        const realPath = realpathSync.native(resolvedPath);
         assertNoUnsafeDeviceReadPath(realPath);
         handle = await fs.open(realPath, resolveReadOpenFlags());
         const openedHandle = handle;

package/dist/secure-file-windows.d.ts

@@ -0,0 +1,10 @@
+import type { BigIntStats, Stats } from "node:fs";
+import type { PermissionCheck } from "./permissions.js";
+type ExactIdentity = Pick<BigIntStats, "dev" | "ino">;
+export declare function inspectSecureWindowsDescriptor(params: {
+    fd: number;
+    identity: ExactIdentity;
+    stat: Stats;
+}): PermissionCheck;
+export {};
+//# sourceMappingURL=secure-file-windows.d.ts.map

package/dist/secure-file-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-file-windows.d.ts","sourceRoot":"","sources":["../src/secure-file-windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AASlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA4BxD,KAAK,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AAuHtD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;CACb,GAAG,eAAe,CA0ClB"}