@openclaw/fs-safe 0.10.0 → 0.12.0

package/dist/json-durable-queue-directory.js

@@ -1,10 +1,10 @@
-import fsSync from "node:fs";
 import path from "node:path";
 import { syncDirectory } from "./directory-durability.js";
 import { isPathRelativeEscape } from "./path.js";
+import { realpathSync } from "./realpath.js";
 export async function syncQueueDirectoryCreation(dir, validationBase) {
-    const baseReal = fsSync.realpathSync.native(validationBase);
-    const targetReal = fsSync.realpathSync.native(dir);
+    const baseReal = realpathSync.native(validationBase);
+    const targetReal = realpathSync.native(dir);
     const relative = path.relative(baseReal, targetReal);
     if (isPathRelativeEscape(relative)) {
         throw new Error(`durable queue directory escapes validation base: ${dir}`);

package/dist/json-durable-queue-ownership.d.ts

@@ -1,3 +1,4 @@
+import { type BigIntStats } from "node:fs";
 export type DurableQueueEntryPathsLike = {
     jsonPath: string;
     deliveredPath: string;
@@ -7,6 +8,7 @@ export declare function durableQueueProcessingPath(paths: DurableQueueEntryPaths
 export declare function claimDurableQueueEntry(paths: DurableQueueEntryPathsLike, options?: {
     skipUnowned?: boolean;
 }): Promise<string | null>;
+export declare function migrateDurableQueueEntry<T>(paths: DurableQueueEntryPathsLike, expected: BigIntStats, releaseReadPin: () => Promise<void>, run: (filePath: string, beforePublish: () => Promise<void>) => Promise<T>): Promise<T>;
 export declare function completeDeliveredQueueEntry(paths: DurableQueueEntryPathsLike): Promise<boolean>;
 export declare function acknowledgeDurableQueueEntry(paths: DurableQueueEntryPathsLike): Promise<void>;
 export declare function moveDurableQueueEntryToFailed(params: {

package/dist/json-durable-queue-ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-durable-queue-ownership.d.ts","sourceRoot":"","sources":["../src/json-durable-queue-ownership.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAKpF;AA+DD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhB;AAKD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI1D"}
+{"version":3,"file":"json-durable-queue-ownership.d.ts","sourceRoot":"","sources":["../src/json-durable-queue-ownership.ts"],"names":[],"mappings":"AAEA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AASnD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAKpF;AAwED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAGD,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,KAAK,EAAE,0BAA0B,EACjC,QAAQ,EAAE,WAAW,EACrB,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACnC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACxE,OAAO,CAAC,CAAC,CAAC,CAkCZ;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhB;AAKD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI1D"}

package/dist/json-durable-queue-ownership.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { syncDirectory } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
 export function durableQueueProcessingPath(paths) {
     if (paths.processingPath)
@@ -32,10 +33,17 @@ async function claimDurableQueueEntryUnlocked(paths, options = {}) {
     const existingProcessing = await regularQueueFileIdentity(processingPath);
     if (existingProcessing) {
         const pending = await lstatOrNull(paths.jsonPath);
-        if (pending &&
+        const retiresPending = pending !== null &&
             !pending.isSymbolicLink() &&
             pending.isFile() &&
-            sameFileIdentityForCleanup(pending, existingProcessing)) {
+            sameFileIdentityForCleanup(pending, existingProcessing);
+        if (!retiresPending ||
+            path.resolve(path.dirname(processingPath)) !== path.resolve(path.dirname(paths.jsonPath))) {
+            // An existing claim can contain a migration whose publication sync failed.
+            // Retirement already syncs this edge when both names share a parent.
+            await syncDirectory(path.dirname(processingPath));
+        }
+        if (retiresPending) {
             await retireDurableQueueSource({ jsonPath: paths.jsonPath, processingPath });
         }
         return processingPath;
@@ -54,7 +62,10 @@ async function claimDurableQueueEntryUnlocked(paths, options = {}) {
     }
     catch (error) {
         if (getErrorCode(error) === "EEXIST") {
-            return (await regularQueueFileIdentity(processingPath)) ? processingPath : null;
+            if (!(await regularQueueFileIdentity(processingPath)))
+                return null;
+            await syncDirectory(path.dirname(processingPath));
+            return processingPath;
         }
         if (getErrorCode(error) === "ENOENT")
             return null;
@@ -73,6 +84,39 @@ export async function claimDurableQueueEntry(paths, options = {}) {
         return null;
     return await withQueueEntryLock(paths, async () => await claimDurableQueueEntryUnlocked(paths, options));
 }
+// The caller retains its read pin until this owner releases it or migration settles.
+export async function migrateDurableQueueEntry(paths, expected, releaseReadPin, run) {
+    return await withQueueEntryLock(paths, async () => {
+        const processingPath = durableQueueProcessingPath(paths);
+        const assertCurrent = async () => {
+            try {
+                await inspectFileIdentity(() => {
+                    const current = fsSync.lstatSync(processingPath, { bigint: true });
+                    if (current.isSymbolicLink() || !current.isFile() || current.nlink !== 1n) {
+                        throw new FsSafeError("path-mismatch", "queue migration requires its original processing claim");
+                    }
+                    return current;
+                }, expected);
+            }
+            catch (error) {
+                if (getErrorCode(error) === "ENOENT") {
+                    throw new FsSafeError("path-mismatch", "queue processing claim disappeared before migration", { cause: error });
+                }
+                throw error;
+            }
+        };
+        await assertCurrent();
+        return await run(processingPath, async () => {
+            await assertCurrent();
+            if (process.platform === "win32") {
+                // Windows cannot replace our still-open target. Keep the transfer lock
+                // across release and reject changes made while the async close settles.
+                await releaseReadPin();
+                await assertCurrent();
+            }
+        });
+    });
+}
 export async function completeDeliveredQueueEntry(paths) {
     if (!(await lstatOrNull(path.dirname(paths.deliveredPath))))
         return false;

package/dist/json-durable-queue-read.d.ts

@@ -0,0 +1,6 @@
+import { type BigIntStats } from "node:fs";
+export declare const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES: number;
+export declare function withJsonDurableQueueEntry<T, R>(filePath: string, options: {
+    maxBytes?: number;
+}, run: (entry: T, identity: BigIntStats, releaseReadPin: () => Promise<void>) => Promise<R>): Promise<R>;
+//# sourceMappingURL=json-durable-queue-read.d.ts.map

package/dist/json-durable-queue-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-durable-queue-read.d.ts","sourceRoot":"","sources":["../src/json-durable-queue-read.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AA8B3E,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,CAAC,EAClD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9B,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACxF,OAAO,CAAC,CAAC,CAAC,CA8BZ"}

package/dist/json-durable-queue-read.js

@@ -0,0 +1,59 @@
+import fs, {} from "node:fs";
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { readBoundedAsync } from "./bounded-read.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
+async function inspectQueueEntry(inspect, maxBytes, expected) {
+    let inspectionFailed = false;
+    try {
+        return await inspectFileIdentity(async () => {
+            try {
+                const stat = inspect();
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    throw new Error("queue entry is not a regular file");
+                }
+                if (stat.nlink > 1n)
+                    throw new Error("queue entry hardlinks are not allowed");
+                if (stat.size > maxBytes)
+                    throw new Error(`queue entry exceeds ${maxBytes} bytes`);
+                return stat;
+            }
+            catch (error) {
+                inspectionFailed = true;
+                throw error;
+            }
+        }, expected);
+    }
+    catch (error) {
+        // Translate only the identity helper's rejection, never inspection errors.
+        if (inspectionFailed)
+            throw error;
+        throw new Error("queue entry changed during read", { cause: error });
+    }
+}
+export async function withJsonDurableQueueEntry(filePath, options, run) {
+    const maxBytes = normalizeMaxBytes(options.maxBytes, {
+        defaultValue: DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES,
+    });
+    const inspectPath = () => fs.lstatSync(filePath, { bigint: true });
+    const initialStat = await inspectQueueEntry(inspectPath, maxBytes);
+    const handle = await fs.promises.open(filePath, resolveReadOpenFlags());
+    let closePromise;
+    const releaseReadPin = () => closePromise ??= (async () => { await handle.close(); })();
+    try {
+        const openedStat = await inspectQueueEntry(() => fs.fstatSync(handle.fd, { bigint: true }), maxBytes, initialStat);
+        await inspectQueueEntry(inspectPath, maxBytes, openedStat);
+        const bytes = await readBoundedAsync(maxBytes, async (buffer, length) => (await handle.read(buffer, 0, length, null)).bytesRead, {
+            initialSize: openedStat.size >= 0n && Number.isSafeInteger(Number(openedStat.size))
+                ? Number(openedStat.size) : undefined,
+            createLimitError: () => new Error(`queue entry exceeds ${maxBytes} bytes`),
+        });
+        // The migration owner may release this pin only at the verified publication
+        // boundary; until then an unlinked inode cannot be recycled into a new claim.
+        return await run(JSON.parse(bytes.toString("utf8")), openedStat, releaseReadPin);
+    }
+    finally {
+        await releaseReadPin();
+    }
+}

package/dist/json-durable-queue.d.ts

@@ -1,3 +1,4 @@
+export { DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES } from "./json-durable-queue-read.js";
 export type JsonDurableQueueEntryPaths = {
     jsonPath: string;
     deliveredPath: string;
@@ -14,7 +15,6 @@ export type JsonDurableQueueLoadOptions<T> = {
     cleanupTmpMaxAgeMs?: number;
     maxBytes?: number;
 };
-export declare const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES: number;
 export declare function unlinkBestEffort(filePath: string): Promise<void>;
 export declare function jsonDurableQueueEntryExists(filePath: string): Promise<boolean>;
 export declare function resolveJsonDurableQueueEntryPaths(queueDir: string, id: string): JsonDurableQueueEntryPaths;

package/dist/json-durable-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAM3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAO5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAiLD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAyDD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAsBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CA+Dd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,0CAA0C,EAAE,MAAM,8BAA8B,CAAC;AAE1F,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAWF,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAO5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAiLD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAgBD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CAEZ;AAgBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAqBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAqEd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}

package/dist/json-durable-queue.js

@@ -1,16 +1,15 @@
 import fs, {} from "node:fs";
 import path from "node:path";
-import { normalizeMaxBytes } from "./byte-budget.js";
-import { readBoundedAsync } from "./bounded-read.js";
 import { syncDirectory } from "./directory-durability.js";
 import { syncQueueDirectoryCreation } from "./json-durable-queue-directory.js";
-import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, moveDurableQueueEntryToFailed, } from "./json-durable-queue-ownership.js";
+import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, migrateDurableQueueEntry, moveDurableQueueEntryToFailed, } from "./json-durable-queue-ownership.js";
+import { withJsonDurableQueueEntry } from "./json-durable-queue-read.js";
 import { stringifyJsonDocument } from "./json-stringify.js";
-import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { replaceFileAtomicWithDirectorySync } from "./replace-file.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
+export { DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES } from "./json-durable-queue-read.js";
 function assertSafeQueueEntryId(id) {
     assertSafePathSegment(id, { label: "queue entry id" });
 }
@@ -60,7 +59,7 @@ async function ensureJsonDurableQueueDir(dir, validationRoot) {
         ? validationRoot
         : queueValidationRoot(dir);
     await assertNoSymlinkDirectorySegments(root, dir, true);
-    await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.promises.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: 0o700 });
     await assertNoSymlinkDirectorySegments(root, dir, false);
     await chmodQueueDirectory(dir);
     await syncQueueDirectoryCreation(dir, root.path);
@@ -115,7 +114,7 @@ async function isDarwinSystemAlias(dir, stat) {
         return false;
     }
     try {
-        return fs.realpathSync.native(resolved) === `/private${resolved}`;
+        return realpathSync.native(resolved) === `/private${resolved}`;
     }
     catch {
         return false;
@@ -131,7 +130,7 @@ async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissin
         if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
             throw new Error(`durable queue path is not a directory: ${dir}`);
         }
-        base = fs.realpathSync.native(base);
+        base = realpathSync.native(base);
         target = path.join(base, ...relative.split(path.sep).filter(Boolean));
         current = base;
         baseStat = fs.lstatSync(base);
@@ -159,7 +158,7 @@ async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissin
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
             if (stat.isSymbolicLink() && validationRoot.allowSymlinkBase) {
                 if (await isDarwinSystemAlias(current, stat)) {
-                    current = fs.realpathSync.native(current);
+                    current = realpathSync.native(current);
                     continue;
                 }
             }
@@ -211,67 +210,25 @@ async function chmodQueueDirectory(dir) {
     }
 }
 export async function writeJsonDurableQueueEntry(params) {
+    await writeQueueEntry(params);
+}
+async function writeQueueEntry(params, beforeRename) {
     await replaceFileAtomicWithDirectorySync({
         filePath: params.filePath,
         content: stringifyJsonDocument(params.entry, null, 2),
         mode: 0o600,
         tempPrefix: params.tempPrefix,
         syncTempFile: true,
+        beforeRename,
     }, syncDirectory);
 }
-async function inspectQueueEntry(inspect, maxBytes, expected) {
-    let inspectionFailed = false;
-    try {
-        return await inspectFileIdentity(async () => {
-            try {
-                const stat = inspect();
-                if (stat.isSymbolicLink() || !stat.isFile()) {
-                    throw new Error("queue entry is not a regular file");
-                }
-                if (stat.nlink > 1n)
-                    throw new Error("queue entry hardlinks are not allowed");
-                if (stat.size > maxBytes)
-                    throw new Error(`queue entry exceeds ${maxBytes} bytes`);
-                return stat;
-            }
-            catch (error) {
-                inspectionFailed = true;
-                throw error;
-            }
-        }, expected);
-    }
-    catch (error) {
-        // Translate only the identity helper's rejection, never inspection errors.
-        if (inspectionFailed)
-            throw error;
-        throw new Error("queue entry changed during read", { cause: error });
-    }
-}
-async function readBoundedUtf8File(params) {
-    const inspectPath = () => fs.lstatSync(params.filePath, { bigint: true });
-    const initialStat = await inspectQueueEntry(inspectPath, params.maxBytes);
-    const handle = await fs.promises.open(params.filePath, resolveReadOpenFlags());
-    try {
-        const openedStat = await inspectQueueEntry(() => fs.fstatSync(handle.fd, { bigint: true }), params.maxBytes, initialStat);
-        await inspectQueueEntry(inspectPath, params.maxBytes, openedStat);
-        const bytes = await readBoundedAsync(params.maxBytes, async (buffer, length) => (await handle.read(buffer, 0, length, null)).bytesRead, {
-            initialSize: openedStat.size >= 0n && Number.isSafeInteger(Number(openedStat.size))
-                ? Number(openedStat.size) : undefined,
-            createLimitError: () => new Error(`queue entry exceeds ${params.maxBytes} bytes`),
-        });
-        return bytes.toString("utf8");
-    }
-    finally {
-        await handle.close();
-    }
-}
 export async function readJsonDurableQueueEntry(filePath, options = {}) {
-    return JSON.parse(await readBoundedUtf8File({
-        filePath,
-        maxBytes: normalizeMaxBytes(options.maxBytes, {
-            defaultValue: DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES,
-        }),
-    }));
+    return await withJsonDurableQueueEntry(filePath, options, async (entry) => entry);
+}
+async function migrateClaimedQueueEntry(params) {
+    await migrateDurableQueueEntry(params.paths, params.identity, params.releaseReadPin, async (filePath, beforePublish) => {
+        await writeQueueEntry({ filePath, entry: params.entry, tempPrefix: params.tempPrefix }, beforePublish);
+    });
 }
 export async function ackJsonDurableQueueEntry(paths) {
     await acknowledgeDurableQueueEntry(paths);
@@ -281,18 +238,17 @@ export async function loadJsonDurableQueueEntry(params) {
         const claimedPath = await claimDurableQueueEntry(params.paths);
         if (!claimedPath)
             return null;
-        const raw = await readJsonDurableQueueEntry(claimedPath, {
+        return await withJsonDurableQueueEntry(claimedPath, {
             maxBytes: params.maxBytes,
+        }, async (raw, identity, releaseReadPin) => {
+            const result = params.read ? await params.read(raw, params.paths.jsonPath) : { entry: raw };
+            if (result.migrated) {
+                await migrateClaimedQueueEntry({
+                    paths: params.paths, identity, releaseReadPin, entry: result.entry, tempPrefix: params.tempPrefix,
+                });
+            }
+            return result.entry;
         });
-        const result = params.read ? await params.read(raw, params.paths.jsonPath) : { entry: raw };
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: params.tempPrefix,
-            });
-        }
-        return result.entry;
     }
     catch (error) {
         if (getErrorCode(error) === "ENOENT") {
@@ -356,22 +312,25 @@ export async function loadPendingJsonDurableQueueEntries(options) {
         const claimedPath = await claimDurableQueueEntry(paths, { skipUnowned: true });
         if (!claimedPath)
             continue;
-        let result;
+        let migrationStarted = false;
         try {
-            const raw = await readJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes });
-            result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
+            const entry = await withJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes }, async (raw, identity, releaseReadPin) => {
+                const result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
+                if (result.migrated) {
+                    migrationStarted = true;
+                    await migrateClaimedQueueEntry({
+                        paths, identity, releaseReadPin, entry: result.entry, tempPrefix: options.tempPrefix,
+                    });
+                }
+                return result.entry;
+            });
+            entries.push(entry);
         }
-        catch {
+        catch (error) {
+            if (migrationStarted)
+                throw error;
             continue;
         }
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: options.tempPrefix,
-            });
-        }
-        entries.push(result.entry);
     }
     return entries;
 }

package/dist/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA8JhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA8JhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}

package/dist/json.js

@@ -8,6 +8,7 @@ import { stringifyJsonDocument } from "./json-stringify.js";
 import { readRegularFile, readRegularFileSync, statRegularFile } from "./regular-file.js";
 import { openRootFileSync } from "./root-file.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { writeTextAtomic } from "./text-atomic.js";
 import { sleep } from "./timing.js";
 const READ_RETRY_MAX_ATTEMPTS = 5;
@@ -169,7 +170,7 @@ export function writeJsonSync(pathname, data) {
     // Keep literal parent segments so staging follows the same symlinks as the target.
     const tmpPath = path.format({ ...path.parse(pathname), base: `.fs-safe-${randomUUID()}.tmp` });
     const payload = `${stringifyJsonDocument(data, null, 2)}\n`;
-    fsSync.mkdirSync(path.dirname(pathname), { recursive: true, mode: JSON_DIR_MODE });
+    fsSync.mkdirSync(recursiveMkdirPath(path.dirname(pathname)), { recursive: true, mode: JSON_DIR_MODE });
     try {
         const tempIdentity = writeTempJsonFile(tmpPath, payload);
         trySetSecureMode(tmpPath, tempIdentity);

package/dist/local-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAOA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAsDF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CAqC7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiCtC"}
+{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAsDF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CAqC7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiCtC"}

package/dist/local-roots.js

@@ -4,6 +4,7 @@ import { normalizeMaxBytes } from "./byte-budget.js";
 import { FsSafeError } from "./errors.js";
 import { expandHomePrefix, resolveRequiredHomeDir } from "./home-dir.js";
 import { isFileUrl, safeFileURLToPath } from "./local-file-access.js";
+import { realpathSync } from "./realpath.js";
 import { ROOT_PATH_ALIAS_POLICIES, resolveRootPathSync } from "./root-path.js";
 import { root } from "./root.js";
 function resolveLocalPathInput(input, label) {
@@ -52,7 +53,7 @@ function resolveRootRealSync(rootDir) {
         if (!stat.isDirectory()) {
             return null;
         }
-        return fsSync.realpathSync(rootDir);
+        return realpathSync(rootDir);
     }
     catch {
         return null;

package/dist/move-path-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path-stage.d.ts","sourceRoot":"","sources":["../src/move-path-stage.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAQnD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM;oBAkBrC,WAAW,GAAG,IAAI;yBAPV,IAAI;iBAkBf,IAAI;eACA,OAAO,CAAC,IAAI,CAAC;GAajC"}
+{"version":3,"file":"move-path-stage.d.ts","sourceRoot":"","sources":["../src/move-path-stage.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AASnD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM;oBAkBrC,WAAW,GAAG,IAAI;yBAPV,IAAI;iBAkBf,IAAI;eACA,OAAO,CAAC,IAAI,CAAC;GAajC"}

package/dist/move-path-stage.js

@@ -5,6 +5,7 @@ import { FsSafeError } from "./errors.js";
 import { guardedRm, guardedRmSync } from "./guarded-mutation.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
+import { realpathSync } from "./realpath.js";
 export async function createMoveStageOwner(staged) {
     const parent = await createAsyncDirectoryGuard(path.dirname(staged), { bigint: true });
     let identity;
@@ -14,7 +15,7 @@ export async function createMoveStageOwner(staged) {
         const current = fsSync.lstatSync(parent.dir, { bigint: true });
         if (!current.isDirectory() || current.isSymbolicLink() ||
             !sameFileIdentityForCleanup(current, parent.stat) ||
-            fsSync.realpathSync.native(parent.dir) !== parent.realPath)
+            realpathSync.native(parent.dir) !== parent.realPath)
             throw changed();
     };
     const assertCurrent = () => {

package/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAiRD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAwGf"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAiRD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAwGf"}

package/dist/move-path.js

@@ -9,6 +9,7 @@ import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryS
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
 import { createMoveStageOwner } from "./move-path-stage.js";
+import { realpathSync } from "./realpath.js";
 export function moveCopyFallbackReasonForRenameError(error, platform = process.platform) {
     const code = error?.code;
     if (code === "EXDEV") {
@@ -61,12 +62,12 @@ async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expect
     }
     const normalizedSource = path.resolve(sourcePath);
     const normalizedTarget = path.resolve(targetPath);
-    const sourceParentReal = fsSync.realpathSync.native(path.dirname(normalizedSource));
-    const targetParentReal = fsSync.realpathSync.native(path.dirname(normalizedTarget));
+    const sourceParentReal = realpathSync.native(path.dirname(normalizedSource));
+    const targetParentReal = realpathSync.native(path.dirname(normalizedTarget));
     const sourceCandidate = path.join(sourceParentReal, path.basename(normalizedSource));
     const targetCandidate = path.join(targetParentReal, path.basename(normalizedTarget));
     const sourceBoundary = sourceStat.isDirectory()
-        ? fsSync.realpathSync.native(sourcePath)
+        ? realpathSync.native(sourcePath)
         : sourceCandidate;
     const unsafeTarget = sourceStat.isDirectory()
         ? isSameOrDescendant(sourceBoundary, targetCandidate)

package/dist/mutation-authority.d.ts

@@ -3,6 +3,7 @@ export declare class MutationAuthorityError extends FsSafeError {
     readonly rejection: unknown;
     constructor(rejection: unknown);
 }
+export declare function assertSynchronousCallbackResult(returned: unknown, name: string): void;
 export declare function composeMutationAssertions(defaultAssertion?: () => void, callAssertion?: () => void): (() => void) | undefined;
 export declare function rethrowMutationAuthorityError(error: unknown): never;
 //# sourceMappingURL=mutation-authority.d.ts.map

package/dist/mutation-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutation-authority.d.ts","sourceRoot":"","sources":["../src/mutation-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,qBAAa,sBAAuB,SAAQ,WAAW;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO;IAAvC,YAAqB,SAAS,EAAE,OAAO,EAEtC;CACF;AAcD,wBAAgB,yBAAyB,CACvC,gBAAgB,CAAC,EAAE,MAAM,IAAI,EAC7B,aAAa,CAAC,EAAE,MAAM,IAAI,GACzB,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAU1B;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAInE"}
+{"version":3,"file":"mutation-authority.d.ts","sourceRoot":"","sources":["../src/mutation-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,qBAAa,sBAAuB,SAAQ,WAAW;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO;IAAvC,YAAqB,SAAS,EAAE,OAAO,EAEtC;CACF;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAUrF;AAED,wBAAgB,yBAAyB,CACvC,gBAAgB,CAAC,EAAE,MAAM,IAAI,EAC7B,aAAa,CAAC,EAAE,MAAM,IAAI,GACzB,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAU1B;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAInE"}

package/dist/mutation-authority.js

@@ -6,13 +6,13 @@ export class MutationAuthorityError extends FsSafeError {
         this.rejection = rejection;
     }
 }
-function assertSynchronous(returned) {
+export function assertSynchronousCallbackResult(returned, name) {
     if (returned !== null &&
         (typeof returned === "object" || typeof returned === "function") &&
         typeof returned.then === "function") {
         // TypeScript permits async functions for () => void. Do not admit their work.
         void Promise.resolve(returned).catch(() => undefined);
-        throw new TypeError("assertBeforeMutation must be synchronous");
+        throw new TypeError(`${name} must be synchronous`);
     }
 }
 export function composeMutationAssertions(defaultAssertion, callAssertion) {
@@ -20,8 +20,8 @@ export function composeMutationAssertions(defaultAssertion, callAssertion) {
         return undefined;
     return () => {
         try {
-            assertSynchronous(defaultAssertion?.());
-            assertSynchronous(callAssertion?.());
+            assertSynchronousCallbackResult(defaultAssertion?.(), "assertBeforeMutation");
+            assertSynchronousCallbackResult(callAssertion?.(), "assertBeforeMutation");
         }
         catch (error) {
             throw new MutationAuthorityError(error);

package/dist/native-binding.d.ts

@@ -75,8 +75,18 @@ export interface NativeWindowsSecurityFacts {
     unsupportedAceTypes: number[];
     aces: NativeWindowsAccessControlEntry[];
 }
+export interface NativeWindowsDescriptorSecurityFacts {
+    /** Canonical lowercase 32-bit volume serial and 64-bit file-index projection used by Node. */
+    identity: string;
+    security: NativeWindowsSecurityFacts;
+}
 export interface NativeBinding {
-    /** Windows-only byte transfer; callers retain both admitted descriptors until settlement. */
+    /** POSIX system canonicalization; confinement and identity policy stay with callers. */
+    canonicalizePath?(path: string, ordinary: boolean): {
+        path?: string;
+        errno?: number;
+    };
+    /** Linux/Windows byte transfer; callers retain both admitted descriptors until settlement. */
     copyFileContents?(sourceFd: number, targetFd: number, signal?: AbortSignal): Promise<void>;
     /** Internal: same private, immutable input ownership as the ZIP buffer reader. */
     openTarBufferNative(buffer: Buffer, kind: string, limits: TarMeterLimits, signal?: AbortSignal): Promise<{
@@ -89,7 +99,7 @@ export interface NativeBinding {
         readEntry(index: number, maxBytes: number, signal?: AbortSignal): Promise<Buffer>;
     }>;
     readCloneFileMetadata(paths: string[]): Promise<(Buffer | null)[]>;
-    probeTreeClone(parentFd: number): "apfs" | "btrfs" | "refs" | "xfs" | null;
+    probeTreeClone(parentFd: number): "apfs" | "btrfs" | "refs" | "xfs" | "zfs" | null;
     cloneTree(sourceFd: number | null, parentFd: number, basename: string, concurrency: number, signal?: AbortSignal): Promise<void>;
     createStagedFile?(parentFd: number, basename: string): number;
     stagedFileMatches?(parentFd: number, basename: string, fileFd: number): boolean;
@@ -106,6 +116,8 @@ export interface NativeBinding {
     openBeneath(rootFd: number, relPath: string, flags: number): NativeOpenBeneathResult;
     readArchiveEntryNative(path: string, kind: string, requested: string, maxBytes: number, limits: TarMeterLimits, signal: AbortSignal): Promise<Buffer>;
     readOwnerAndDacl(path: string): NativeWindowsSecurityFacts;
+    /** Internal Windows-only inspection of the exact borrowed Node descriptor. */
+    inspectWindowsSecureFileHandle?(fd: number): NativeWindowsDescriptorSecurityFacts;
     ownedTreeRemovalAvailable?(parentFd: number): boolean;
     removeOwnedTree?(parentFd: number, basename: string, directoryFd: number): Promise<NativeOwnedTreeRemovalResult>;
     removeOwnedTreeSync?(parentFd: number, basename: string, directoryFd: number): NativeOwnedTreeRemovalResult;