@openclaw/fs-safe 0.13.1 → 0.15.0

package/dist/archive-zip-loader.js

@@ -1,57 +1,133 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
 import { validateArchiveEntryPath } from "./archive-entry.js";
-import { isZipSymlinkEntry } from "./archive-zip-entry.js";
+import { registerAdmittedZipEntry } from "./archive-zip-entry.js";
 import { zipPathKey } from "./archive-zip-names.js";
+function disagreement() {
+    throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+}
+function collision() {
+    throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
+}
+function matchesData(value, physical) {
+    if (!value || typeof value !== "object")
+        return false;
+    const data = value;
+    return Number.isInteger(data.crc32) && data.crc32 >= -0x80000000 && data.crc32 <= 0xffffffff &&
+        (data.crc32 >>> 0) === physical.crc32 && data.uncompressedSize === physical.size &&
+        data.compressedSize === physical.compressedSize && typeof data.getContentWorker === "function" &&
+        data.compression?.magic === String.fromCharCode(physical.compressionMethod & 255, physical.compressionMethod >>> 8);
+}
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
 export async function loadAdmittedZipArchive(buffer, admitted) {
+    const physicalByPath = new Map();
+    for (const entry of admitted) {
+        if (physicalByPath.has(entry.portableKey))
+            collision();
+        physicalByPath.set(entry.portableKey, entry);
+    }
     const JSZip = await importOptionalJsZip();
-    let archive;
+    const archive = new JSZip();
+    const originalFile = archive.file;
+    const originalDescriptor = Object.getOwnPropertyDescriptor(archive, "file");
+    const inserted = new Map();
+    const remaining = new Map(physicalByPath);
+    // JSZip's fileAdd can misclassify UNIX type bits as directories, rename an
+    // entry, and erase its payload. Intercept only this private instance's load.
+    Object.defineProperty(archive, "file", { configurable: true, writable: true,
+        value: function (...args) {
+            if (args.length === 1)
+                return originalFile.apply(this, args);
+            const [name, data, options] = args;
+            if (this !== archive || args.length !== 3 || typeof name !== "string" || !options || typeof options !== "object")
+                disagreement();
+            validateArchiveEntryPath(name);
+            const key = zipPathKey(name);
+            const physical = remaining.get(key);
+            if (!physical) {
+                if (physicalByPath.has(key))
+                    collision();
+                disagreement();
+            }
+            const fields = options;
+            const unixMode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : null;
+            const dosMode = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
+            const decoderDirectory = Boolean(physical.externalAttributes & 0x10) || physical.portableDirectory;
+            if (physical.index !== inserted.size || fields.unixPermissions !== unixMode || fields.dosPermissions !== dosMode ||
+                fields.dir !== decoderDirectory || !matchesData(data, physical))
+                disagreement();
+            const result = originalFile.call(this, name, data, {
+                ...fields, dir: false, unixPermissions: null, dosPermissions: null, createFolders: false,
+            });
+            const entry = archive.files[name];
+            if (!entry || typeof entry !== "object" || inserted.has(entry))
+                disagreement();
+            // fileAdd also substitutes an empty promise for declared-zero contents.
+            // Retain the original decoder object so size/CRC checks still read bytes.
+            entry._data = data;
+            inserted.set(entry, { physical, data });
+            remaining.delete(key);
+            return result;
+        },
+    });
     try {
-        archive = await JSZip.loadAsync(buffer);
+        const loaded = await archive.loadAsync(buffer, { createFolders: false });
+        if (loaded !== archive)
+            disagreement();
     }
     catch (error) {
+        if (error instanceof ArchiveFormatError || error instanceof ArchiveSecurityError)
+            throw error;
         throw new ArchiveFormatError(`invalid ZIP archive: ${error instanceof Error ? error.message : String(error)}`, { cause: error instanceof Error ? error : undefined });
     }
-    const names = Object.keys(archive.files);
-    if (names.length !== admitted.length) {
-        throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
-    }
-    // Object key order is not central-directory order (numeric names reorder).
-    // Use the admitted portable interpretation, including legacy UTF-8 decoding.
-    const physicalByPath = new Map();
-    for (const entry of admitted) {
-        physicalByPath.set(entry.portableKey, entry);
+    finally {
+        if (originalDescriptor)
+            Object.defineProperty(archive, "file", originalDescriptor);
+        else
+            Reflect.deleteProperty(archive, "file");
     }
+    const names = Object.keys(archive.files);
+    if (names.length !== admitted.length)
+        collision();
+    const normalized = [];
     for (const name of names) {
         validateArchiveEntryPath(name);
-        const key = zipPathKey(name);
-        const physical = physicalByPath.get(key);
         const entry = archive.files[name];
-        const entryName = entry.name;
-        let entryKey = key;
-        if (entryName !== name) {
-            validateArchiveEntryPath(entryName);
-            entryKey = zipPathKey(entryName);
-        }
-        const kind = isZipSymlinkEntry(entry) ? "symlink" : entry.dir ? "directory" : "file";
-        if (!physical || entryKey !== key || kind !== physical.kind) {
-            throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
-        }
-        physicalByPath.delete(key);
+        if (!entry || typeof entry.name !== "string")
+            disagreement();
+        validateArchiveEntryPath(entry.name);
+        const insertion = inserted.get(entry);
+        if (!insertion || zipPathKey(name) !== insertion.physical.portableKey || zipPathKey(entry.name) !== insertion.physical.portableKey ||
+            entry.dir !== false || entry.unixPermissions !== null || entry.dosPermissions !== null ||
+            entry._data !== insertion.data || !matchesData(entry._data, insertion.physical))
+            disagreement();
+        normalized[insertion.physical.index] = [name, entry, insertion.physical];
+        inserted.delete(entry);
     }
-    if (physicalByPath.size) {
-        throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+    if (remaining.size || inserted.size)
+        disagreement();
+    const files = Object.create(null);
+    for (const [name, entry, physical] of normalized) {
+        const appendSlash = physical.kind === "directory" && !name.endsWith("/");
+        const normalizedName = appendSlash ? `${name}/` : name;
+        if (Object.hasOwn(files, normalizedName))
+            collision();
+        if (appendSlash) {
+            entry.name = `${entry.name}/`;
+        }
+        files[normalizedName] = entry;
+        registerAdmittedZipEntry(entry, physical);
     }
+    archive.files = files;
     return archive;
 }
 async function importOptionalJsZip() {
     try {
         const module = await import("jszip");
         const candidate = typeof module === "function" ? module : module.default;
-        if ((typeof candidate !== "object" && typeof candidate !== "function") ||
-            candidate === null ||
-            typeof candidate.loadAsync !== "function") {
-            throw new Error('Optional archive dependency "jszip" does not expose loadAsync().');
+        if (typeof candidate !== "function" ||
+            typeof candidate.prototype?.file !== "function" ||
+            typeof candidate.prototype?.loadAsync !== "function") {
+            throw new Error('Optional archive dependency "jszip" does not expose its constructor, file(), and loadAsync().');
         }
         return candidate;
     }

package/dist/archive-zip-names.d.ts

@@ -12,6 +12,7 @@ export declare function admitZipNames(params: {
 }): {
     path?: string;
     portableKey: string;
+    portableDirectory: boolean;
     directory: boolean;
 };
 //# sourceMappingURL=archive-zip-names.d.ts.map

package/dist/archive-zip-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-zip-names.d.ts","sourceRoot":"","sources":["../src/archive-zip-names.ts"],"names":[],"mappings":"AAKA,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAEhD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcjE;AAUD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAoBD,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAC9C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAiE7D"}
+{"version":3,"file":"archive-zip-names.d.ts","sourceRoot":"","sources":["../src/archive-zip-names.ts"],"names":[],"mappings":"AAKA,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAEhD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcjE;AAUD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAoBD,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAC9C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAuEzF"}

package/dist/archive-zip-names.js

@@ -130,9 +130,15 @@ export function admitZipNames(params) {
     // Unflagged legacy names can decode differently and need their own key.
     const portableKey = portablePath === centralRaw ? centralKey
         : interpretations.includes(portablePath) ? interpretationKey : zipPathKey(portablePath);
+    // JSZip prioritizes flagged local UTF-8 and checks a central Unicode field
+    // against local bytes. Canonically equal names can end in different separators.
+    const decoderPath = flags & 0x800 ? localUtf8
+        : centralUnicode !== undefined && (sameName || centralField.readUInt32LE(1) === updateCrc32(0, local))
+            ? centralUnicode : local.toString("utf8");
     return {
         path,
         portableKey,
+        portableDirectory: decoderPath.endsWith("/"),
         directory,
     };
 }

package/dist/archive.js

@@ -13,7 +13,7 @@ import { assertPortableArchiveKind, resolveArchiveKind } from "./archive-kind.js
 import { prepareArchiveDestinationGuard, preparePrivateArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
 import { mergePlannedArchiveIntoDestination } from "./archive-merge.js";
 import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
-import { isZipSymlinkEntry, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
+import { zipEntryKind, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { FsSafeError } from "./errors.js";
 import { ArchiveSecurityError } from "./archive-errors.js";
@@ -95,7 +95,7 @@ async function writeZipFileEntry(params) {
                 }
                 params.deadline.check();
                 if (!handleClosedByStream) {
-                    await tempHandle.close().catch(() => undefined);
+                    await tempHandle.close();
                     handleClosedByStream = true;
                 }
                 tempHandle = null;
@@ -153,8 +153,7 @@ async function extractZip(params) {
                     }
                     assertArchiveEntryPathComponentsWithinLimit(output.relPath, limits);
                     trackOutputPath(output.relPath, entry.name);
-                    const isSymlink = isZipSymlinkEntry(entry);
-                    const entryKind = isSymlink ? "symlink" : entry.dir ? "directory" : "file";
+                    const entryKind = zipEntryKind(entry);
                     const entrySize = zipEntryDeclaredSize(entry);
                     if (!shouldExtractArchiveEntry({
                         filter: params.entryFilter,
@@ -163,9 +162,11 @@ async function extractZip(params) {
                     })) {
                         continue;
                     }
-                    if (isSymlink) {
+                    if (entryKind === "symlink") {
                         throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${entry.name}`);
                     }
+                    if (entryKind === "other")
+                        continue;
                     const mode = zipEntryMode(entry, params.entryModes);
                     acceptedEntries.push({ path: output.relPath, kind: entry.dir ? "directory" : "file", mode });
                     await preparePrivateArchiveOutputPath({

package/dist/bounded-read-stream.d.ts

@@ -1,4 +1,3 @@
 import { Transform } from "node:stream";
-export declare function createMaxBytesTransform(maxBytes: number): Transform;
 export declare function createByteLimitTransform(maxBytes: number, overflowError: (bytes: number) => Error): Transform;
 //# sourceMappingURL=bounded-read-stream.d.ts.map

package/dist/bounded-read-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAMnE;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,GACtC,SAAS,CAaX"}
+{"version":3,"file":"bounded-read-stream.d.ts","sourceRoot":"","sources":["../src/bounded-read-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,GACtC,SAAS,CAaX"}

package/dist/bounded-read-stream.js

@@ -1,10 +1,4 @@
 import { Transform } from "node:stream";
-import { normalizeMaxBytes } from "./byte-budget.js";
-import { FsSafeError } from "./errors.js";
-export function createMaxBytesTransform(maxBytes) {
-    normalizeMaxBytes(maxBytes);
-    return createByteLimitTransform(maxBytes, (bytes) => new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`));
-}
 export function createByteLimitTransform(maxBytes, overflowError) {
     let bytes = 0;
     return new Transform({

package/dist/copy-publication.d.ts

@@ -1,3 +1,4 @@
+import type { BigIntStats } from "node:fs";
 import type { PinnedWriteParams, PublishedWriteIdentity } from "./pinned-write.js";
 export type RootCopyPublicationReceipt = Readonly<{
     path: string;
@@ -9,7 +10,12 @@ export declare function createCopyPublicationObserver(path: string, notify?: (re
     rethrowObserverFailure(error: unknown): void;
 };
 export declare const onCopyPublication: unique symbol;
+export declare const onCopySourceAdmission: unique symbol;
 export type CopyPublicationOptions = {
     [onCopyPublication]?: PinnedWriteParams["verifyPublished"];
+    [onCopySourceAdmission]?: (identity: BigIntStats, realPath: string) => {
+        mode: number;
+        verify(): void;
+    };
 };
 //# sourceMappingURL=copy-publication.d.ts.map

package/dist/copy-publication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-publication.d.ts","sourceRoot":"","sources":["../src/copy-publication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGnF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI;IAIpD,WAAW,WAAW,sBAAsB,GAAG,IAAI;IAcnD,sBAAsB,QAAQ,OAAO,GAAG,IAAI;EAO/C;AAID,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAC7D,MAAM,MAAM,sBAAsB,GAAG;IACnC,CAAC,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;CAC5D,CAAC"}
+{"version":3,"file":"copy-publication.d.ts","sourceRoot":"","sources":["../src/copy-publication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGnF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI;IAIpD,WAAW,WAAW,sBAAsB,GAAG,IAAI;IAcnD,sBAAsB,QAAQ,OAAO,GAAG,IAAI;EAO/C;AAID,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAG7D,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,MAAM,MAAM,sBAAsB,GAAG;IACnC,CAAC,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAC3D,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,KAAK;QACrE,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,IAAI,IAAI,CAAC;KAChB,CAAC;CACH,CAAC"}

package/dist/copy-publication.js

@@ -28,3 +28,6 @@ export function createCopyPublicationObserver(path, notify) {
 // Internal composition hook; the descriptor is borrowed until the callback returns.
 // Kept off RootCopyOptions and all public package exports.
 export const onCopyPublication = Symbol("onCopyPublication");
+// Reuse the copy's admitted descriptor identity before any bytes are staged.
+// Internal callers can bind prior observations and select its publication mode.
+export const onCopySourceAdmission = Symbol("onCopySourceAdmission");

package/dist/copy-tree-portable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-tree-portable.d.ts","sourceRoot":"","sources":["../src/copy-tree-portable.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAQ/B,0FAA0F;AAC1F,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,EAC9C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IACP,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACtD,GACA,OAAO,CAAC,IAAI,CAAC,CAiNf"}
+{"version":3,"file":"copy-tree-portable.d.ts","sourceRoot":"","sources":["../src/copy-tree-portable.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAU/B,0FAA0F;AAC1F,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,EAC9C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IACP,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACtD,GACA,OAAO,CAAC,IAAI,CAAC,CAoOf"}

package/dist/copy-tree-portable.js

@@ -15,16 +15,21 @@ export async function copyOwnedTree(source, destination, options) {
     const cancellation = new AbortController();
     const signal = cancellation.signal;
     setMaxListeners(options.concurrency, signal);
-    const abort = () => cancellation.abort(options.signal?.reason);
-    options.signal?.addEventListener("abort", abort, { once: true });
     const pending = new Set();
     const finishing = new Set();
     const buffers = [];
+    let failure = undefined;
+    function recordFailure(value) {
+        failure ??= { value };
+        cancellation.abort(failure);
+    }
+    const abort = () => recordFailure(options.signal?.reason);
+    options.signal?.addEventListener("abort", abort, { once: true });
     async function schedule(operation, children) {
         signal.throwIfAborted();
         const task = operation()
             .catch((error) => {
-            cancellation.abort(error);
+            recordFailure(error);
         })
             .finally(() => {
             pending.delete(task);
@@ -65,13 +70,13 @@ export async function copyOwnedTree(source, destination, options) {
                 try {
                     let position = 0;
                     while (true) {
-                        signal?.throwIfAborted();
+                        signal.throwIfAborted();
                         const { bytesRead } = await input.read(buffer, 0, buffer.length, position);
                         if (bytesRead === 0)
                             break;
                         let written = 0;
                         while (written < bytesRead) {
-                            signal?.throwIfAborted();
+                            signal.throwIfAborted();
                             const { bytesWritten } = await output.write(buffer, written, bytesRead - written, position + written);
                             if (bytesWritten === 0)
                                 throw new Error("copy write made no progress");
@@ -90,20 +95,25 @@ export async function copyOwnedTree(source, destination, options) {
             await output.utimes(timestampSeconds(stat.atimeNs), timestampSeconds(stat.mtimeNs));
         }
         catch (error) {
-            cancellation.abort(error);
-            throw error;
+            recordFailure(error);
         }
-        finally {
+        if (output) {
             try {
-                await output?.close();
+                await output.close();
             }
-            finally {
-                await input.close();
+            catch (error) {
+                recordFailure(error);
             }
         }
+        try {
+            await input.close();
+        }
+        catch (error) {
+            recordFailure(error);
+        }
     }
     async function copyDirectory(from, to, parentChildren) {
-        signal?.throwIfAborted();
+        signal.throwIfAborted();
         const stat = await fsp.lstat(from, { bigint: true });
         // Exclusive admission prevents merging a pre-existing directory, including
         // any destination left by an unsuccessful native clone.
@@ -117,7 +127,7 @@ export async function copyOwnedTree(source, destination, options) {
                 throw new FsSafeError("path-mismatch", "copy source directory changed while opening");
             }
             for (const entry of await fsp.readdir(from, { withFileTypes: true })) {
-                signal?.throwIfAborted();
+                signal.throwIfAborted();
                 assertStagedDirectoryCurrent(target.receipt);
                 assertStagedDirectoryCurrent(original.receipt);
                 const childSource = path.join(from, entry.name);
@@ -151,7 +161,7 @@ export async function copyOwnedTree(source, destination, options) {
                             throw error;
                         }
                     }
-                    signal?.throwIfAborted();
+                    signal.throwIfAborted();
                     await fsp.symlink(link, childTarget, type);
                 }
                 else {
@@ -160,7 +170,7 @@ export async function copyOwnedTree(source, destination, options) {
             }
         }
         catch (error) {
-            cancellation.abort(error);
+            recordFailure(error);
             throw error;
         }
         finally {
@@ -179,18 +189,26 @@ export async function copyOwnedTree(source, destination, options) {
                         assertStagedDirectoryCurrent(target.receipt);
                     }
                 }
-                finally {
+                catch (error) {
+                    recordFailure(error);
+                }
+                if (original) {
                     try {
-                        if (original)
-                            fs.closeSync(original.fd);
+                        fs.closeSync(original.fd);
                     }
-                    finally {
-                        fs.closeSync(target.fd);
+                    catch (error) {
+                        recordFailure(error);
                     }
                 }
+                try {
+                    fs.closeSync(target.fd);
+                }
+                catch (error) {
+                    recordFailure(error);
+                }
             })()
                 .catch((error) => {
-                cancellation.abort(error);
+                recordFailure(error);
             })
                 .finally(() => {
                 finishing.delete(completion);
@@ -211,12 +229,14 @@ export async function copyOwnedTree(source, destination, options) {
         signal.throwIfAborted();
     }
     catch (error) {
-        await Promise.all(finishing);
-        options.signal?.throwIfAborted();
-        throw error;
+        recordFailure(error);
     }
     finally {
         await Promise.all(finishing);
         options.signal?.removeEventListener("abort", abort);
     }
+    if (failure)
+        throw failure.value;
+    options.signal?.throwIfAborted();
+    signal.throwIfAborted();
 }

package/dist/copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy.d.ts","sourceRoot":"","sources":["../src/copy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAK5E,OAAO,EAAE,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAS/E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAM,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"copy.d.ts","sourceRoot":"","sources":["../src/copy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAK5E,OAAO,EAAE,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAiBF,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAc/E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAM,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/copy.js

@@ -7,18 +7,36 @@ import { FsSafeError } from "./errors.js";
 import { getNativeBinding, requireNativeBinding } from "./native.js";
 import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
 export { readCloneFileMetadata } from "./clone-metadata.js";
+function firstFailure(current, value) {
+    return current ?? { value };
+}
+function closeDescriptor(fd, failure) {
+    try {
+        fs.closeSync(fd);
+        return failure;
+    }
+    catch (error) {
+        return firstFailure(failure, error);
+    }
+}
 /** Inspect an existing real directory without creating probe files. */
 export function probeTreeClone(parentPath) {
     const native = getNativeBinding();
     if (!native)
         return undefined;
     const parent = openStagedDirectory(assertAbsolutePathInput(parentPath));
+    let backend;
+    let failure;
     try {
-        return native.probeTreeClone(parent.fd) ?? undefined;
+        backend = native.probeTreeClone(parent.fd) ?? undefined;
     }
-    finally {
-        fs.closeSync(parent.fd);
+    catch (error) {
+        failure = firstFailure(failure, error);
     }
+    failure = closeDescriptor(parent.fd, failure);
+    if (failure)
+        throw failure.value;
+    return backend;
 }
 /** Create an empty clone source: a Btrfs subvolume or an ordinary supported directory. */
 export async function createCloneSource(destination, options = {}) {
@@ -56,6 +74,7 @@ async function materializeTree(source, destination, options, policy) {
         throw new FsSafeError("invalid-path", "clone destination must name a child directory");
     const parent = openStagedDirectory(path.dirname(target));
     let original;
+    let failure;
     try {
         const supported = native?.probeTreeClone(parent.fd);
         if (!supported && policy === "always") {
@@ -113,13 +132,12 @@ async function materializeTree(source, destination, options, policy) {
             assertStagedDirectoryCurrent(original.receipt);
         }
     }
-    finally {
-        try {
-            if (original)
-                fs.closeSync(original.fd);
-        }
-        finally {
-            fs.closeSync(parent.fd);
-        }
+    catch (error) {
+        failure = firstFailure(failure, error);
     }
+    if (original)
+        failure = closeDescriptor(original.fd, failure);
+    failure = closeDescriptor(parent.fd, failure);
+    if (failure)
+        throw failure.value;
 }

package/dist/directory-mode-owner.js

@@ -43,10 +43,10 @@ export function ownDirectoryMode(params) {
             // Hooks/ancestor checks can yield; recheck the original named association.
             await params.inspect();
             checks.check?.();
-            let dispatchDeadlineError;
+            let dispatchDeadlineFailure;
             if (currentMode !== mode) {
+                checks.check?.();
                 try {
-                    checks.check?.();
                     await params.chmod(mode);
                 }
                 catch (error) {
@@ -58,13 +58,13 @@ export function ownDirectoryMode(params) {
                     checks.check?.();
                 }
                 catch (error) {
-                    dispatchDeadlineError = error;
+                    dispatchDeadlineFailure = { error };
                 }
                 await params.verifyChmod?.();
             }
             const finalMode = await params.inspect();
-            if (dispatchDeadlineError)
-                throw dispatchDeadlineError;
+            if (dispatchDeadlineFailure)
+                throw dispatchDeadlineFailure.error;
             checks.check?.();
             if (!params.ignoreChmodError && finalMode !== mode) {
                 throw new FsSafeError("path-mismatch", "directory final mode could not be verified");

package/dist/file-handle-transfer.d.ts

@@ -5,6 +5,8 @@ export type CopyFileHandleOptions = {
     onChunk?: (chunk: Uint8Array) => void;
     assertBeforeMutation?: () => void;
 };
+/** Copies caller-owned regular-file descriptors without moving either cursor. */
+export declare function copyFileDescriptorSync(sourceFd: number, targetFd: number, options?: CopyFileHandleOptions): number;
 /** Copies caller-owned regular files from offset zero without moving either cursor. */
 export declare function copyFileHandle(source: FileHandle, target: FileHandle, options?: CopyFileHandleOptions): Promise<number>;
 export declare function transferFileHandle(source: FileHandle, target: FileHandle | number, options: CopyFileHandleOptions & {

package/dist/file-handle-transfer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-handle-transfer.d.ts","sourceRoot":"","sources":["../src/file-handle-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAkDF,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CAwBjB"}
+{"version":3,"file":"file-handle-transfer.d.ts","sourceRoot":"","sources":["../src/file-handle-transfer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAQF,iFAAiF;AACjF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,MAAM,CA6CR;AAgDD,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CAwBjB"}