@openclaw/fs-safe 0.12.0 → 0.13.1

package/dist/private-temp-workspace.js

@@ -1,16 +1,20 @@
-import { randomUUID } from "node:crypto";
-import fsSync from "node:fs";
+import { randomInt, randomUUID } from "node:crypto";
+import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileStore, fileStoreSync, } from "./file-store.js";
 import { FsSafeError } from "./errors.js";
 import { isNotFoundPathError } from "./path.js";
-import { realpathSync } from "./realpath.js";
-import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { throwFsSafeReadError } from "./root-errors.js";
 import { matchRootFileOpenFailure, openRootFileSync, } from "./root-file.js";
 import { registerTempPathForExit, } from "./temp-cleanup.js";
 import { TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner, } from "./temp-workspace-owner.js";
+import { assertNoWindowsPathAlias, hasWindowsPathAlias, } from "./windows-path-alias.js";
+import { TempWorkspaceRetainedChild } from "./temp-workspace-descriptor.js";
+import { admitRetainedTempWorkspaceChild, admitRetainedTempWorkspaceChildSync, validateInitialTempWorkspaceChild, } from "./temp-workspace-child-admission.js";
+import { admitTempWorkspaceRoot, admitTempWorkspaceRootSync, } from "./temp-workspace-admission.js";
+import { validateTempWorkspaceDirMode } from "./temp-workspace-permissions.js";
 function resolveTempWorkspaceCleanupSafety(value) {
     if (value === undefined || value === "compatible")
         return "compatible";
@@ -25,8 +29,43 @@ function sanitizeTempPrefix(prefix) {
     }
     return sanitized.endsWith("-") ? sanitized : `${sanitized}-`;
 }
+const TEMP_WORKSPACE_SUFFIX_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+const TEMP_WORKSPACE_SUFFIX_SPACE = TEMP_WORKSPACE_SUFFIX_ALPHABET.length ** 6;
+const TEMP_WORKSPACE_DIRECT_CREATE_ATTEMPTS = 64;
+function randomTempWorkspaceChildPath(childPrefix) {
+    let encoded = randomInt(TEMP_WORKSPACE_SUFFIX_SPACE);
+    let suffix = "";
+    for (let index = 0; index < 6; index += 1) {
+        suffix = TEMP_WORKSPACE_SUFFIX_ALPHABET[encoded % TEMP_WORKSPACE_SUFFIX_ALPHABET.length] + suffix;
+        encoded = Math.floor(encoded / TEMP_WORKSPACE_SUFFIX_ALPHABET.length);
+    }
+    return `${childPrefix}${suffix}`;
+}
+function canCreateTempWorkspaceWithRequestedMode(dirMode) {
+    return (process.platform === "linux" || process.platform === "darwin") && dirMode !== 0o700 &&
+        (dirMode & 0o700) === 0o700 && (dirMode & 0o7000) === 0 && (dirMode & 0o022) === 0;
+}
+function createTempWorkspaceWithRequestedModeSync(childPrefix, dirMode, prepareChildCreation) {
+    let collision;
+    for (let attempt = 0; attempt < TEMP_WORKSPACE_DIRECT_CREATE_ATTEMPTS; attempt += 1) {
+        const candidate = randomTempWorkspaceChildPath(childPrefix);
+        prepareChildCreation();
+        try {
+            fsSync.mkdirSync(candidate, { mode: dirMode, recursive: false });
+            return candidate;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            collision = error;
+        }
+    }
+    throw collision;
+}
 function resolveWorkspaceLeaf(dir, fileName) {
-    return path.join(dir, assertWorkspaceFileName(fileName));
+    const resolved = path.join(dir, assertWorkspaceFileName(fileName));
+    assertNoWindowsPathAlias(resolved, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
+    return resolved;
 }
 function assertWorkspaceFileName(fileName) {
     const value = fileName.trim();
@@ -36,6 +75,7 @@ function assertWorkspaceFileName(fileName) {
         value.includes("\0") ||
         value.includes("/") ||
         value.includes("\\") ||
+        hasWindowsPathAlias(value, "relative") ||
         path.basename(value) !== value) {
         throw new Error(`Invalid temp workspace file name: ${JSON.stringify(fileName)}`);
     }
@@ -67,55 +107,60 @@ function throwTempWorkspaceOpenFailure(failure) {
         },
     });
 }
-async function ensurePrivateDirectory(dir, mode) {
-    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode });
-    const stat = fsSync.statSync(dir);
-    if (!stat.isDirectory()) {
-        throw new Error(`Temp root must be a directory: ${dir}`);
-    }
-    await fs.chmod(dir, mode).catch(() => undefined);
-}
-function ensurePrivateDirectorySync(dir, mode) {
-    fsSync.mkdirSync(recursiveMkdirPath(dir), { recursive: true, mode });
-    const stat = fsSync.statSync(dir);
-    if (!stat.isDirectory()) {
-        throw new Error(`Temp root must be a directory: ${dir}`);
-    }
-    try {
-        fsSync.chmodSync(dir, mode);
-    }
-    catch {
-        // Best-effort on platforms that do not enforce POSIX modes.
-    }
-}
-async function createTempWorkspace(options) {
+async function createTempWorkspace(options, scopedPrefix = false) {
+    const rootDir = options.rootDir;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "temp workspace root uses a Windows filesystem namespace alias");
     const dirMode = options.dirMode ?? 0o700;
+    validateTempWorkspaceDirMode(dirMode);
     const mode = options.mode ?? 0o600;
     const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
-    const requestedRoot = path.resolve(options.rootDir);
-    let root = requestedRoot;
-    try {
-        root = realpathSync.native(requestedRoot);
-    }
-    catch {
-        root = requestedRoot;
-    }
-    await ensurePrivateDirectory(root, dirMode);
-    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    const admission = await admitTempWorkspaceRoot(rootDir);
+    const root = admission.dir;
+    assertNoWindowsPathAlias(root, "filesystem", "temp workspace root uses a Windows filesystem namespace alias");
+    // Capture and sanitize caller-controlled prefix data before retaining descriptors.
+    const rawPrefix = options.prefix;
+    const workspacePrefix = scopedPrefix
+        ? `${sanitizeTempPrefix(rawPrefix)}${randomUUID()}-`
+        : rawPrefix;
+    const childPrefix = path.join(root, sanitizeTempPrefix(workspacePrefix));
+    assertNoWindowsPathAlias(childPrefix, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety, admission, dirMode);
     let dir;
     let stat;
+    let retainedChild;
+    let retainChildDescriptor = false;
     let cleanupOwner;
     let unregisterTempDir;
     try {
-        dir = await fs.mkdtemp(path.join(root, sanitizeTempPrefix(options.prefix)));
-        await fs.chmod(dir, dirMode).catch(() => undefined);
-        stat = fsSync.lstatSync(dir, { bigint: true });
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            throw new Error(`Temp workspace must be a directory: ${dir}`);
-        }
+        // Native capability discovery is complete before this synchronous
+        // boundary. The existing canonical-root route now captures the complete
+        // ancestry and associates its provisional parent descriptor here, then
+        // dispatches mkdtemp without yielding or invoking another probe.
+        capability.prepareChildCreation();
+        dir = await fs.mkdtemp(childPrefix);
+        assertNoWindowsPathAlias(dir, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
         if (capability.parent)
             capability.assertCurrent();
-        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        else
+            admission.assertCurrent();
+        stat = inspectDirectoryIdentitySync(dir);
+        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        // Retain while the child still has its private creation mode so an
+        // explicit dirMode such as 0 cannot make identity descriptor acquisition fail.
+        retainedChild = TempWorkspaceRetainedChild.retain(dir, stat);
+        const modeInitialization = admitRetainedTempWorkspaceChild(retainedChild, needsModeInitialization, admission, dirMode);
+        if (modeInitialization)
+            await modeInitialization;
+        retainChildDescriptor = capability.admitChildDescriptor(retainedChild.ensureReadable());
+        // Final adoption order is deliberate: complete ancestry, retained cleanup
+        // parent, then descriptor and named checks of the original child identity.
+        if (capability.parent)
+            capability.assertAncestryCurrent();
+        else
+            admission.assertAncestry();
+        stat = retainedChild.finalizeAdmission(admission.ownerUid, dirMode);
+        cleanupOwner = new TempWorkspaceCleanupOwner(retainedChild, capability, retainChildDescriptor);
+        retainedChild = undefined;
         unregisterTempDir = registerTempPathForExit(dir, {
             cleanupSync: () => cleanupOwner.cleanupSync(),
         });
@@ -124,8 +169,26 @@ async function createTempWorkspace(options) {
         try {
             if (cleanupOwner)
                 cleanupOwner.cleanupSync();
-            else
-                capability.close();
+            else {
+                const closeErrors = [];
+                try {
+                    retainedChild?.close();
+                }
+                catch (closeError) {
+                    closeErrors.push(closeError);
+                }
+                try {
+                    capability.close();
+                }
+                catch (closeError) {
+                    closeErrors.push(closeError);
+                }
+                if (closeErrors.length === 1)
+                    throw closeErrors[0];
+                if (closeErrors.length > 1) {
+                    throw new AggregateError(closeErrors, "temp workspace admission descriptor close failed");
+                }
+            }
         }
         catch (cleanupError) {
             throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
@@ -178,10 +241,7 @@ export async function tempWorkspace(options) {
     return await createTempWorkspace(options);
 }
 export async function withTempWorkspace(options, run) {
-    const workspace = await createTempWorkspace({
-        ...options,
-        prefix: `${sanitizeTempPrefix(options.prefix)}${randomUUID()}-`,
-    });
+    const workspace = await createTempWorkspace(options, true);
     try {
         return await run(workspace);
     }
@@ -189,39 +249,67 @@ export async function withTempWorkspace(options, run) {
         await workspace.cleanup();
     }
 }
-export function tempWorkspaceSync(options) {
+function createTempWorkspaceSync(options, scopedPrefix = false) {
+    const rootDir = options.rootDir;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "temp workspace root uses a Windows filesystem namespace alias");
     const dirMode = options.dirMode ?? 0o700;
+    validateTempWorkspaceDirMode(dirMode);
     const mode = options.mode ?? 0o600;
     const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
-    const requestedRoot = path.resolve(options.rootDir);
-    let root = requestedRoot;
-    try {
-        root = realpathSync.native(requestedRoot);
-    }
-    catch {
-        root = requestedRoot;
-    }
-    ensurePrivateDirectorySync(root, dirMode);
-    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    const admission = admitTempWorkspaceRootSync(rootDir);
+    const root = admission.dir;
+    assertNoWindowsPathAlias(root, "filesystem", "temp workspace root uses a Windows filesystem namespace alias");
+    // Capture and sanitize caller-controlled prefix data before retaining descriptors.
+    const rawPrefix = options.prefix;
+    const workspacePrefix = scopedPrefix
+        ? `${sanitizeTempPrefix(rawPrefix)}${randomUUID()}-`
+        : rawPrefix;
+    const childPrefix = path.join(root, sanitizeTempPrefix(workspacePrefix));
+    assertNoWindowsPathAlias(childPrefix, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety, admission, dirMode);
     let dir;
     let stat;
+    let retainedChild;
+    let retainChildDescriptor = false;
+    let needsModeInitialization;
     let cleanupOwner;
     let unregisterTempDir;
     try {
-        dir = fsSync.mkdtempSync(path.join(root, sanitizeTempPrefix(options.prefix)));
-        try {
-            fsSync.chmodSync(dir, dirMode);
+        const directRequestedMode = canCreateTempWorkspaceWithRequestedMode(dirMode);
+        if (directRequestedMode) {
+            dir = createTempWorkspaceWithRequestedModeSync(childPrefix, dirMode, () => capability.prepareChildCreation());
         }
-        catch {
-            // Best-effort on platforms that do not enforce POSIX modes.
-        }
-        stat = fsSync.lstatSync(dir, { bigint: true });
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            throw new Error(`Temp workspace must be a directory: ${dir}`);
+        else {
+            capability.prepareChildCreation();
+            dir = fsSync.mkdtempSync(childPrefix);
         }
+        assertNoWindowsPathAlias(dir, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
         if (capability.parent)
             capability.assertCurrent();
-        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        else
+            admission.assertCurrent();
+        if (directRequestedMode) {
+            const created = TempWorkspaceRetainedChild.retainCreated(dir);
+            retainedChild = created.retained;
+            stat = created.stat;
+            needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        }
+        else {
+            stat = inspectDirectoryIdentitySync(dir);
+            needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+            retainedChild = TempWorkspaceRetainedChild.retain(dir, stat);
+        }
+        admitRetainedTempWorkspaceChildSync(retainedChild, needsModeInitialization, admission, dirMode);
+        retainChildDescriptor = capability.admitChildDescriptor(retainedChild.ensureReadable());
+        // Match async adoption: complete ancestry and retained cleanup authority
+        // precede descriptor and named child security-state checks.
+        if (capability.parent)
+            capability.assertAncestryCurrent();
+        else
+            admission.assertAncestry();
+        stat = retainedChild.finalizeAdmission(admission.ownerUid, dirMode);
+        cleanupOwner = new TempWorkspaceCleanupOwner(retainedChild, capability, retainChildDescriptor);
+        retainedChild = undefined;
         unregisterTempDir = registerTempPathForExit(dir, {
             cleanupSync: () => cleanupOwner.cleanupSync(),
         });
@@ -230,8 +318,26 @@ export function tempWorkspaceSync(options) {
         try {
             if (cleanupOwner)
                 cleanupOwner.cleanupSync();
-            else
-                capability.close();
+            else {
+                const closeErrors = [];
+                try {
+                    retainedChild?.close();
+                }
+                catch (closeError) {
+                    closeErrors.push(closeError);
+                }
+                try {
+                    capability.close();
+                }
+                catch (closeError) {
+                    closeErrors.push(closeError);
+                }
+                if (closeErrors.length === 1)
+                    throw closeErrors[0];
+                if (closeErrors.length > 1) {
+                    throw new AggregateError(closeErrors, "temp workspace admission descriptor close failed");
+                }
+            }
         }
         catch (cleanupError) {
             throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
@@ -293,11 +399,11 @@ export function tempWorkspaceSync(options) {
         },
     };
 }
+export function tempWorkspaceSync(options) {
+    return createTempWorkspaceSync(options);
+}
 export function withTempWorkspaceSync(options, run) {
-    const workspace = tempWorkspaceSync({
-        ...options,
-        prefix: `${sanitizeTempPrefix(options.prefix)}${randomUUID()}-`,
-    });
+    const workspace = createTempWorkspaceSync(options, true);
     try {
         return run(workspace);
     }

package/dist/publish-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA2ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}
+{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAKnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GAAG,cAAc,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEjG,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAIF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA0ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6NtC"}

package/dist/publish-file.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import fsSync, {} from "node:fs";
-import fs from "node:fs/promises";
+import fs, {} from "node:fs/promises";
 import path from "node:path";
 import { pinDirectory, } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
@@ -8,30 +8,18 @@ import { hashFileHandle } from "./file-hash.js";
 import { sameFileIdentity, sameFileIdentityForCleanup, } from "./file-identity.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { getNativeBinding, requireNativeBinding } from "./native.js";
+import { captureNativeFdClose } from "./native-binding.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { directorySyncFailure, publicationFailure, rememberCreatedTarget, } from "./publish-file-failure.js";
+import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
-const HARDLINK_FALLBACK_CODES = new Set([
-    "EPERM",
-    "EXDEV",
-    "ENOTSUP",
-    "EOPNOTSUPP",
-    "ENOSYS",
-]);
-const NATIVE_COPY_FALLBACK_CODES = new Set([
-    "EINVAL",
-    "ENOSYS",
-    "ENOTSUP",
-    "EOPNOTSUPP",
-    "EPERM",
-    "EXDEV",
-]);
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+const HARDLINK_FALLBACK_CODES = new Set(["EPERM", "EXDEV", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]);
+const NATIVE_COPY_FALLBACK_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EPERM", "EXDEV"]);
 export function isHardlinkFallbackError(error) {
     return HARDLINK_FALLBACK_CODES.has(error?.code ?? "");
 }
-function sourceOpenFlags() {
-    return resolveReadOpenFlags();
-}
+function sourceOpenFlags() { return resolveReadOpenFlags(); }
 function directoryOpenFlags() {
     return (fsSync.constants.O_RDONLY |
         (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
@@ -67,6 +55,7 @@ async function assertPinnedSourceCurrent(params) {
 }
 async function copyPinnedSource(params) {
     if (params.native && params.targetNativeParent) {
+        const closeFd = captureNativeFdClose(params.native);
         for (const method of ["clone", "copy-file-range"]) {
             let nativeFd;
             try {
@@ -108,7 +97,7 @@ async function copyPinnedSource(params) {
                 const hashed = await hashFileHandle(target, params.native);
                 const completedFd = nativeFd;
                 nativeFd = undefined;
-                fsSync.closeSync(completedFd);
+                closeFd(completedFd);
                 return {
                     handle: target,
                     exactIdentity: opened,
@@ -122,7 +111,7 @@ async function copyPinnedSource(params) {
             }
             finally {
                 if (nativeFd !== undefined)
-                    fsSync.closeSync(nativeFd);
+                    closeFd(nativeFd);
             }
         }
     }
@@ -190,12 +179,27 @@ async function syncPublishedParent(params) {
     }
 }
 export async function publishFileExclusive(params) {
-    const sourcePath = path.resolve(params.sourcePath);
-    const targetPath = path.resolve(params.targetPath);
+    const sourcePathInput = admitStandalonePublicationPath(params.sourcePath, "publication source uses a Windows filesystem namespace alias");
+    const targetPathInput = admitStandalonePublicationPath(params.targetPath, "publication target uses a Windows filesystem namespace alias");
+    const parentReceiptInput = params.parentReceipt;
+    const parentReceipt = parentReceiptInput
+        ? { path: parentReceiptInput.path, realPath: parentReceiptInput.realPath,
+            identity: parentReceiptInput.identity }
+        : undefined;
+    if (parentReceipt) {
+        assertNoWindowsPathAlias(parentReceipt.path, "filesystem", "publication parent uses a Windows filesystem namespace alias");
+    }
+    const sourcePath = path.resolve(sourcePathInput);
+    const targetPath = path.resolve(targetPathInput);
+    assertNoWindowsPathAlias(sourcePath, "filesystem", "publication source uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(targetPath, "filesystem", "publication target uses a Windows filesystem namespace alias");
     const parentPath = path.dirname(targetPath);
-    if (params.parentReceipt && path.resolve(params.parentReceipt.path) !== parentPath) {
+    if (parentReceipt && path.resolve(parentReceipt.path) !== parentPath) {
         throw new FsSafeError("path-mismatch", "publication parent receipt does not match target parent");
     }
+    if (parentReceipt) {
+        assertNoWindowsPathAlias(parentReceipt.realPath, "filesystem", "publication parent uses a Windows filesystem namespace alias");
+    }
     const sourcePathStat = fsSync.lstatSync(sourcePath);
     if (sourcePathStat.isSymbolicLink() || !sourcePathStat.isFile()) {
         throw new FsSafeError("not-file", "publication source must be a regular file");
@@ -204,38 +208,40 @@ export async function publishFileExclusive(params) {
     let parent;
     let sourceNativeParent;
     let targetNativeParent;
+    const strategy = params.strategy;
     const failure = {
-        phase: params.strategy === "rename-noreplace" ? "rename-create" : "hardlink-create",
+        phase: strategy === "rename-noreplace" ? "rename-create" : "hardlink-create",
         targetCreated: false,
         preserveTarget: false,
     };
     try {
-        parent = await pinDirectory(params.parentReceipt ?? parentPath, {
+        parent = await pinDirectory(parentReceipt ?? parentPath, {
             label: "publication parent",
         });
         const sourceIdentity = fsSync.fstatSync(source.fd);
         const sourceExactIdentity = fsSync.fstatSync(source.fd, { bigint: true });
         const sourcePathExactIdentity = fsSync.lstatSync(sourcePath, { bigint: true });
+        const expectedSourceIdentity = params.expectedSourceIdentity;
         if (sourcePathExactIdentity.isSymbolicLink() ||
             !sourcePathExactIdentity.isFile() ||
             !sameFileIdentity(sourcePathExactIdentity, sourceExactIdentity) ||
-            (params.expectedSourceIdentity &&
-                !sameFileIdentity(params.expectedSourceIdentity, typeof params.expectedSourceIdentity.dev === "bigint" ||
-                    typeof params.expectedSourceIdentity.ino === "bigint"
+            (expectedSourceIdentity &&
+                !sameFileIdentity(expectedSourceIdentity, typeof expectedSourceIdentity.dev === "bigint" ||
+                    typeof expectedSourceIdentity.ino === "bigint"
                     ? sourceExactIdentity
                     : sourceIdentity))) {
             throw new FsSafeError("path-mismatch", "publication source identity did not match");
         }
         await parent.assertCurrent();
         await assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
-        const native = params.strategy === "rename-noreplace"
+        const native = strategy === "rename-noreplace"
             ? requireNativeBinding()
             : getNativeBinding();
         if (native) {
             sourceNativeParent = await openNativeParent(sourcePath);
             targetNativeParent = await openNativeParent(targetPath);
         }
-        if (params.strategy === "rename-noreplace") {
+        if (strategy === "rename-noreplace") {
             const binding = requireNativeBinding();
             binding.renameNoReplace(sourceNativeParent.handle.fd, sourceNativeParent.basename, targetNativeParent.handle.fd, targetNativeParent.basename);
             rememberCreatedTarget(failure, sourceExactIdentity, "rename-verify");
@@ -301,7 +307,7 @@ export async function publishFileExclusive(params) {
         catch (error) {
             if (failure.targetCreated ||
                 !isHardlinkFallbackError(error) ||
-                params.strategy === "link-required") {
+                strategy === "link-required") {
                 throw error;
             }
         }

package/dist/regular-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,MAAM,MAAM,SAAS,CAAC;AAmB7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CASR;AAaD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA6D3C;AA2DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAoCA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAgF7E"}
+{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,MAAM,MAAM,SAAS,CAAC;AAuB7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CASR;AAaD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAetF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAe3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA+D3C;AA2DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAsCA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAkF7E"}