@openclaw/fs-safe 0.13.1 → 0.15.0

package/dist/root-write-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"root-write-verification.d.ts","sourceRoot":"","sources":["../src/root-write-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAK9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgGhB"}
+{"version":3,"file":"root-write-verification.d.ts","sourceRoot":"","sources":["../src/root-write-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAK9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EhB"}

package/dist/root-write-verification.js

@@ -1,5 +1,5 @@
 import fsSync, {} from "node:fs";
-import fs from "node:fs/promises";
+import fs, {} from "node:fs/promises";
 import { assertAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
@@ -45,59 +45,46 @@ export async function verifyAtomicWriteResult(params) {
         return stat;
     };
     try {
-        // This descriptor remains owned by the writer, even when final mode forbids opens.
-        const stat = assertDescriptor();
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(params.fd, stat, params.targetPath);
-        // Consume the resolver's observation only in this pass; the checks after
-        // the directory guards must still sample the current path and descriptor.
-        assertPath(resolvedStat);
-        if (!admitPathInsideRoot({
-            rootPath: params.root.rootReal,
-            candidatePath: realPath,
-            rootIdentity: params.root.rootIdentity,
-        })) {
-            throw outsideWorkspaceError();
-        }
-        await assertAsyncDirectoryGuard(params.parentGuard);
-        await assertRootIdentityCurrent(params.root);
-        // Recheck after canonical resolution and directory checks, including late links.
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        assertDescriptor();
-        if (needsPathOpen) {
-            // A retained fd cannot prove that an opaque Windows pathname still names it.
-            // Reopen only for publication verification: the writer's exact identity is
-            // independent proof unavailable to ordinary readers. Never read any bytes.
-            assertNoUnsafeDeviceReadPath(params.targetPath);
-            const opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
-                if (isSymlinkOpenError(error)) {
-                    throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
-                }
-                if (hasNodeErrorCode(error, "EISDIR")) {
-                    throw new FsSafeError("not-file", "not a file");
-                }
-                throw error;
-            });
-            try {
-                const reopenedStat = assertDescriptor(opened.fd);
+        let opened;
+        try {
+            while (true) {
+                // The original descriptor remains borrowed; only a verification reopen is owned here.
+                const fd = opened?.fd ?? params.fd;
+                const stat = assertDescriptor(fd);
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                const { realPath: reopenedPath, stat: reopenedPathStat } = await resolveOpenedFileRealPathForFd(opened.fd, reopenedStat, params.targetPath);
-                assertPath(reopenedPathStat);
+                const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(fd, stat, params.targetPath);
+                // Consume the resolver's observation only in this pass; the checks after
+                // the directory guards must still sample the current path and descriptor.
+                assertPath(resolvedStat);
                 if (!admitPathInsideRoot({
                     rootPath: params.root.rootReal,
-                    candidatePath: reopenedPath,
+                    candidatePath: realPath,
                     rootIdentity: params.root.rootIdentity,
                 })) {
                     throw outsideWorkspaceError();
                 }
                 await assertAsyncDirectoryGuard(params.parentGuard);
                 await assertRootIdentityCurrent(params.root);
+                // Recheck after canonical resolution and directory checks, including late links.
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                assertDescriptor(opened.fd);
+                assertDescriptor(fd);
+                if (opened || !needsPathOpen)
+                    break;
+                // Opaque Windows pathname identity needs one independent, read-free reopen.
+                assertNoUnsafeDeviceReadPath(params.targetPath);
+                opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
+                    if (isSymlinkOpenError(error)) {
+                        throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
+                    }
+                    if (hasNodeErrorCode(error, "EISDIR"))
+                        throw new FsSafeError("not-file", "not a file");
+                    throw error;
+                });
             }
-            finally {
+        }
+        finally {
+            if (opened)
                 await opened.close().catch(() => undefined);
-            }
         }
     }
     catch (error) {

package/dist/secret-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-file.d.ts","sourceRoot":"","sources":["../src/secret-file.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,OAAO,EAAkF,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAUhJ,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAQjC,eAAO,MAAM,uBAAuB,MAAQ,CAAC;AAC7C,eAAO,MAAM,wBAAwB,MAAQ,CAAC;AAE9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAmER;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,GAAG,SAAS,CAUpB;AA8JD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AA+BF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAgCD;AAwDD,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxF;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzF"}
+{"version":3,"file":"secret-file.d.ts","sourceRoot":"","sources":["../src/secret-file.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,OAAO,EAAkF,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAShJ,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAQjC,eAAO,MAAM,uBAAuB,MAAQ,CAAC;AAC7C,eAAO,MAAM,wBAAwB,MAAQ,CAAC;AAE9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,CA2CR;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,MAAM,GAAG,SAAS,CAUpB;AA8JD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AA+BF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAgCD;AAwDD,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxF;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzF"}

package/dist/secret-file.js

@@ -7,42 +7,20 @@ import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
 import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
 import { assertOwnedDirectory } from "./directory-mode-owner.js";
-import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
 import { openPinnedFileSync } from "./pinned-open.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { ensureTrailingSep } from "./root-context.js";
 import { verifyAtomicWriteResult } from "./root-write-verification.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { prepareSecretRead, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export const PRIVATE_SECRET_DIR_MODE = 0o700;
 export const PRIVATE_SECRET_FILE_MODE = 0o600;
 export function readSecretFileSync(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fs.lstatSync(resolvedPath, { bigint: true })
-            : fs.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     const opened = openPinnedFileSync({
         filePath: resolvedPath,
         rejectPathSymlink: rejectSymlink,

package/dist/secret-read-async.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAQA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAGjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA6DjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}
+{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAGjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}

package/dist/secret-read-async.js

@@ -5,32 +5,11 @@ import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
-import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { prepareSecretRead, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function readSecretFile(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fsSync.lstatSync(resolvedPath, { bigint: true })
-            : fsSync.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     let handle;
     let raw;
     try {

package/dist/secret-read-policy.d.ts

@@ -1,4 +1,4 @@
-import type { BigIntStats } from "node:fs";
+import { type BigIntStats } from "node:fs";
 import { FsSafeError, type FsSafeErrorCode } from "./errors.js";
 export declare const DEFAULT_SECRET_FILE_MAX_BYTES: number;
 export type SecretFileReadOptions = {
@@ -10,8 +10,12 @@ export declare function secretPathErrorCode(error: unknown): FsSafeErrorCode;
 export declare function secretReadError(code: FsSafeErrorCode, action: "inspect" | "read", label: string, resolvedPath: string, error: unknown): FsSafeError;
 export declare function assertSecretFilePreview(stat: BigIntStats, label: string, resolvedPath: string, maxBytes: number, rejectHardlinks: boolean): void;
 export declare function trimSecretFileContent(raw: string, label: string, resolvedPath: string): string;
-export declare function resolveSecretReadPolicy(filePath: string, label: string, options: SecretFileReadOptions): {
+export declare function prepareSecretRead(filePath: string, label: string, options: SecretFileReadOptions): {
     resolvedPath: string;
     maxBytes: number;
+    rejectSymlink: boolean;
+    rejectHardlinks: boolean;
+    previewStat: BigIntStats;
+    inspectInput: (symlinkMessage: string) => BigIntStats;
 };
 //# sourceMappingURL=secret-read-policy.d.ts.map

package/dist/secret-read-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-read-policy.d.ts","sourceRoot":"","sources":["../src/secret-read-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAGnE;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,GACb,WAAW,CAGb;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,OAAO,GACvB,IAAI,CAUN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG;IACxG,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAYA"}
+{"version":3,"file":"secret-read-policy.d.ts","sourceRoot":"","sources":["../src/secret-read-policy.ts"],"names":[],"mappings":"AAEA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAIhE,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAGnE;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,GACb,WAAW,CAGb;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,OAAO,GACvB,IAAI,CAUN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9F;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB;;;;;;mCAyBzD,MAAM,KAAG,WAAW;EAY3D"}

package/dist/secret-read-policy.js

@@ -1,6 +1,9 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
+import fs, {} from "node:fs";
+import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
@@ -29,7 +32,7 @@ export function trimSecretFileContent(raw, label, resolvedPath) {
     }
     return secret;
 }
-export function resolveSecretReadPolicy(filePath, label, options) {
+export function prepareSecretRead(filePath, label, options) {
     const trimmedPath = filePath.trim();
     assertNoWindowsPathAlias(trimmedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
     const resolvedPath = resolveHomeRelativePath(trimmedPath);
@@ -40,5 +43,26 @@ export function resolveSecretReadPolicy(filePath, label, options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes, {
         defaultValue: DEFAULT_SECRET_FILE_MAX_BYTES,
     });
-    return { resolvedPath, maxBytes };
+    let rejectSymlink;
+    let previewStat;
+    try {
+        assertNoUnsafeDeviceReadPath(resolvedPath);
+        rejectSymlink = Boolean(options.rejectSymlink);
+        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
+    }
+    catch (error) {
+        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
+    }
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fs.lstatSync(resolvedPath, { bigint: true })
+            : fs.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    return { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput };
 }

package/dist/sibling-temp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sibling-temp.d.ts","sourceRoot":"","sources":["../src/sibling-temp.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AASF,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CA0BxC;AAwBD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDhB"}
+{"version":3,"file":"sibling-temp.d.ts","sourceRoot":"","sources":["../src/sibling-temp.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AASF,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAkCxC;AAwBD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhB"}

package/dist/sibling-temp.js

@@ -25,25 +25,33 @@ export async function writeSiblingTempFile(options) {
     const dir = resolvePathPreservingWindowsRoot(dirInput);
     assertNoWindowsPathAlias(dir, "filesystem", "sibling temp directory uses a Windows filesystem namespace alias");
     const producerIsolation = options.producerIsolation;
-    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: options.dirMode ?? 0o700 });
-    if (options.chmodDir !== false) {
+    const dirMode = options.dirMode ?? 0o700;
+    const chmodDir = options.chmodDir !== false;
+    const tempPrefix = options.tempPrefix;
+    const writeTemp = options.writeTemp;
+    const resolveFinalPath = options.resolveFinalPath;
+    const mode = options.mode;
+    const syncTempFile = options.syncTempFile === true;
+    const syncParentDir = options.syncParentDir === true;
+    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: dirMode });
+    if (chmodDir) {
         await applyDirectoryMode({
             fsModule: fs,
             dirPath: dir,
-            mode: options.dirMode ?? 0o700,
+            mode: dirMode,
             ignoreChmodError: true,
         });
     }
     return await writeCallbackSibling({
         tempDir: dir,
-        tempName: buildTempName(options.tempPrefix),
-        write: options.writeTemp,
+        tempName: buildTempName(tempPrefix),
+        write: writeTemp,
         producerIsolation,
-        resolveFinalPath: options.resolveFinalPath,
-        mode: options.mode,
+        resolveFinalPath,
+        mode,
         ignoreModeError: true,
-        syncTempFile: options.syncTempFile === true,
-        syncParentDir: options.syncParentDir === true,
+        syncTempFile,
+        syncParentDir,
     });
 }
 function buildSiblingTempName(params) {
@@ -91,6 +99,9 @@ export async function writeViaSiblingTempPath(params) {
         path.isAbsolute(relativeTargetPath)) {
         throw new Error("Target path is outside the allowed root");
     }
+    const writeTemp = params.writeTemp;
+    const fallbackFileName = params.fallbackFileName;
+    const tempPrefix = params.tempPrefix;
     const rootGuard = await createAsyncDirectoryGuard(rootDir);
     const workspace = await tempFile({
         rootDir: resolveSecureTempRoot({
@@ -104,12 +115,12 @@ export async function writeViaSiblingTempPath(params) {
     try {
         const tempName = buildSiblingTempName({
             targetPath: path.join(workspace.dir, path.basename(targetPath)),
-            fallbackFileName: params.fallbackFileName ?? "output.bin",
-            tempPrefix: params.tempPrefix ?? ".fs-safe-output-",
+            fallbackFileName: fallbackFileName ?? "output.bin",
+            tempPrefix: tempPrefix ?? ".fs-safe-output-",
         });
         const tempPath = resolveCallbackTempPath(workspace.dir, tempName);
         await getFsSafeTestHooks()?.beforeSiblingTempWrite?.(tempPath);
-        await params.writeTemp(tempPath);
+        await Function.prototype.call.call(writeTemp, params, tempPath);
         await assertAsyncDirectoryGuard(rootGuard);
         const targetRoot = await root(rootDir);
         await targetRoot.copyIn(relativeTargetPath, tempPath, { mkdir: false });

package/dist/sidecar-lock-acquire.d.ts

@@ -1,31 +1,5 @@
-import { type NativeFileHandle } from "./native-operations.js";
-import type { Root } from "./root-impl.js";
-import { type SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
 import type { SidecarLockAcquireOptions, SidecarLockHandle } from "./sidecar-lock-types.js";
-type SidecarFileHandle = Pick<NativeFileHandle, "fd" | "close" | "stat" | "writeFile">;
-export type HeldSidecarLock = {
-    refCount: number;
-    reentrantOwner?: string;
-    handle: SidecarFileHandle;
-    lockPath: string;
-    snapshot: SidecarLockSnapshot;
-    acquiredAt: number;
-    metadata: Record<string, unknown>;
-    releasePromise?: Promise<void>;
-    lockRoot?: Root;
-    retainOnExit?: boolean;
-    parsePayload?: (raw: string) => unknown;
-    compromiseTimer?: NodeJS.Timeout;
-};
-type SidecarLockAcquisitionContext = {
-    held: Map<string, HeldSidecarLock>;
-    reclaimGuards: Set<string>;
-    ensureExitCleanupRegistered(): void;
-    handleForHeldLock(normalizedTargetPath: string, held: HeldSidecarLock): SidecarLockHandle;
-    releaseHeldLock(normalizedTargetPath: string, held: HeldSidecarLock, options?: {
-        force?: boolean;
-    }): Promise<boolean>;
-};
+import { type SidecarLockAcquisitionContext } from "./sidecar-lock-admission.js";
+export type { HeldSidecarLock } from "./sidecar-lock-admission.js";
 export declare function acquireSidecarLock<TPayload extends Record<string, unknown>>(options: SidecarLockAcquireOptions<TPayload>, context: SidecarLockAcquisitionContext): Promise<SidecarLockHandle>;
-export {};
 //# sourceMappingURL=sidecar-lock-acquire.d.ts.map

package/dist/sidecar-lock-acquire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar-lock-acquire.d.ts","sourceRoot":"","sources":["../src/sidecar-lock-acquire.ts"],"names":[],"mappings":"AAUA,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAW3C,OAAO,EAWL,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK5F,KAAK,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,KAAK,6BAA6B,GAAG;IACnC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,2BAA2B,IAAI,IAAI,CAAC;IACpC,iBAAiB,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAC1F,eAAe,CACb,oBAAoB,EAAE,MAAM,EAC5B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB,CAAC;AAoCF,wBAAsB,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAC5C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA2U5B"}
+{"version":3,"file":"sidecar-lock-acquire.d.ts","sourceRoot":"","sources":["../src/sidecar-lock-acquire.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,OAAO,EAA4C,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAM3H,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,wBAAsB,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAC5C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA0b5B"}