@openclaw/fs-safe 0.15.0 → 0.17.0

package/dist/native-staged-file.js

@@ -50,19 +50,22 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+import { assertDarwinCreationAcl } from "./creation-darwin.js";
+import { assertPrivateCreationFile } from "./creation-file-state.js";
 import { requireNativeBinding } from "./native.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, {} from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
-import { MutationAuthorityError } from "./mutation-authority.js";
+import { assertSynchronousCallbackResult, MutationAuthorityError } from "./mutation-authority.js";
 import { captureNativeFdClose } from "./native-binding.js";
-import { writeNativeInput } from "./native-operations.js";
+import { writePinnedInput } from "./pinned-write-input.js";
 import { assertNativeCopyCompleted, createNativeCopyFile } from "./copy-file-input.js";
 import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
+import { createStagedFileReceipt, stagedFileFailure as failure } from "./staged-file-settlement.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.closeOwnedFd,
@@ -82,12 +85,6 @@ function assertBasename(name, portable) {
     }
 }
 const NOT_PUBLISHED = Object.freeze({ status: "not-published" });
-function failure(error, details) {
-    const code = error instanceof FsSafeError
-        ? error.code
-        : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
-    return new FsSafeError(code, `staged file ${details.phase} failed`, { cause: error, details });
-}
 class NativeStagedFile {
     #binding;
     #closeFd;
@@ -97,12 +94,15 @@ class NativeStagedFile {
     #portableNames;
     #publishedMode;
     #sync;
+    #strictFileSync;
+    #private;
+    #verifyMode;
     #assertBeforeMutation;
     #name;
     #state = { status: "open", publication: NOT_PUBLISHED };
     #receipt;
     #rejectFinalSymlink = false;
-    constructor(binding, parentFd, closeParentFd, directory, portableNames, publishedMode, sync, assertBeforeMutation, name = `.fs-safe-${randomUUID()}.tmp`) {
+    constructor(binding, parentFd, closeParentFd, directory, portableNames, publishedMode, sync, assertBeforeMutation, name = `.fs-safe-${randomUUID()}.tmp`, strictFileSync = false, permissionPolicy) {
         assertBasename(name, portableNames);
         this.#name = name;
         this.#closeFd = captureNativeFdClose(binding);
@@ -113,16 +113,19 @@ class NativeStagedFile {
         this.#portableNames = portableNames;
         this.#publishedMode = publishedMode;
         this.#sync = sync;
+        this.#strictFileSync = strictFileSync;
+        this.#private = permissionPolicy === "private-creation";
+        this.#verifyMode = permissionPolicy !== undefined;
         this.#assertBeforeMutation = assertBeforeMutation;
     }
     // Public staging supplies a Node parent; pinned writes supply a native parent.
     // The supplied closer owns parentFd even on construction or preparation failure.
     static async create(binding, parentFd, closeParentFd, directory, input, mode, maxBytes, 
     // Public staging uses portable names; existing POSIX writes accept literal names.
-    portableNames = true, sync = true, assertBeforeMutation, exclusiveBasename) {
+    portableNames = true, sync = true, assertBeforeMutation, exclusiveBasename, strictFileSync = false, permissionPolicy) {
         let staged;
         try {
-            staged = new NativeStagedFile(binding, parentFd, closeParentFd, directory, portableNames, mode, sync, assertBeforeMutation, exclusiveBasename);
+            staged = new NativeStagedFile(binding, parentFd, closeParentFd, directory, portableNames, mode, sync, assertBeforeMutation, exclusiveBasename, strictFileSync, permissionPolicy);
         }
         catch (error) {
             try {
@@ -142,19 +145,29 @@ class NativeStagedFile {
             const exclusive = params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false;
             // This owner never escapes. Only the internal verifier borrows its fd;
             // public descriptor methods remain await-free and cannot race disposal.
-            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, closeParentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync, params.assertBeforeMutation, exclusive ? params.basename : undefined), true);
+            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, closeParentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync, params.assertBeforeMutation, exclusive ? params.basename : undefined, params.strictFileSync, params.private ? "private-creation" : params.verifyPosixMode === true ? "mode-only" : undefined), true);
             staged.#rejectFinalSymlink = params.rejectFinalSymlink === true;
             if (params.input.kind === "file")
                 await params.input.verifySource();
             if (exclusive) {
                 staged.#assertCurrent();
                 params.assertBeforeMutation?.();
+                if (staged.#verifyMode)
+                    staged.#assertCurrent();
             }
             const published = exclusive
                 ? staged.#completePublication(params.basename, false, params.onPublished)
                 : await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
             const identity = published.staged.identity;
-            await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+            try {
+                await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+            }
+            catch (error) {
+                if (params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true) {
+                    throw failure(error, { phase: "publish", publication: published });
+                }
+                throw error;
+            }
             return { dev: identity.dev, ino: identity.ino };
         }
         catch (e_1) {
@@ -186,13 +199,14 @@ class NativeStagedFile {
         }
         return state.fileFd;
     }
-    #assertNamed(name) {
+    #assertNamed(name, expectedMode) {
         const fd = this.#file();
         const stat = this.#binding.stagedFileMatches(this.#parentFd, name, fd)
             ? fs.fstatSync(fd, { bigint: true }) : undefined;
         if (!stat || stat.nlink !== 1n) {
             throw new FsSafeError("path-mismatch", "staged entry no longer names the exclusive created file");
         }
+        this.#assertPermissions(fd, stat, expectedMode);
         return Number(stat.mode & 4095n);
     }
     #assertCurrent() {
@@ -200,7 +214,17 @@ class NativeStagedFile {
             throw new FsSafeError("helper-failed", "staged file publication has already been attempted");
         }
         assertStagedDirectoryCurrent(this.#directory);
-        this.#assertNamed(this.#name);
+        this.#assertNamed(this.#name, 0o600);
+    }
+    #assertPermissions(fd, stat, expectedMode) {
+        if (this.#private)
+            assertPrivateCreationFile(stat, fd);
+        if (this.#verifyMode && Number(stat.mode & 4095n) !== expectedMode) {
+            throw new FsSafeError("insecure-permissions", "filesystem did not enforce the staged file mode");
+        }
+    }
+    #assertStagePermissions(fd) {
+        this.#assertPermissions(fd, fs.fstatSync(fd, { bigint: true }), 0o600);
     }
     async #prepare(input, maxBytes) {
         try {
@@ -208,44 +232,63 @@ class NativeStagedFile {
             if (!Number.isInteger(mode) || mode < 0 || mode > 0o7777) {
                 throw new FsSafeError("invalid-path", "invalid staged file mode");
             }
+            const fileSignal = input.kind === "file" && this.#verifyMode ? input.signal : undefined;
+            if (input.kind === "file" && this.#verifyMode) {
+                fileSignal?.throwIfAborted();
+                if (input.clone === "always") {
+                    throw new FsSafeError("helper-unavailable", "required cloning cannot verify staged permissions before copying");
+                }
+            }
             assertStagedDirectoryCurrent(this.#directory);
             // The exclusive open performs no fallible post-open checks. Store its fd
             // before every subsequent operation, including the first metadata read.
             const state = this.#open();
+            if (this.#private)
+                assertDarwinCreationAcl(this.#parentFd, "file");
             this.#assertBeforeMutation?.();
-            const copied = input.kind === "file"
+            if (this.#private)
+                assertDarwinCreationAcl(this.#parentFd, "file");
+            // Native copying populates its new file before returning its descriptor.
+            const copied = input.kind === "file" && !this.#verifyMode
                 ? await createNativeCopyFile(this.#binding, input, this.#parentFd, this.#name, maxBytes, false)
                 : undefined;
             state.fileFd = copied?.fd;
             if (state.fileFd === undefined) {
                 this.#assertBeforeMutation?.();
+                if (this.#private)
+                    assertDarwinCreationAcl(this.#parentFd, "file");
                 state.fileFd = this.#binding.createStagedFile(this.#parentFd, this.#name);
             }
             const fd = state.fileFd;
             if (input.kind === "file")
                 assertNativeCopyCompleted(input, copied);
-            this.#assertBeforeMutation?.();
+            const assertBeforeChmod = this.#assertBeforeMutation;
+            const beforeChmodResult = assertBeforeChmod?.();
+            if (this.#private) {
+                assertSynchronousCallbackResult(beforeChmodResult, "assertBeforeMutation");
+                assertPrivateCreationFile(fs.fstatSync(fd, { bigint: true }), fd);
+            }
             fs.fchmodSync(fd, 0o600);
+            // Some filesystems report successful chmod without enforcing its mode.
+            if (this.#verifyMode)
+                this.#assertStagePermissions(fd);
+            const assertBeforeMutation = this.#verifyMode ? () => {
+                assertSynchronousCallbackResult(this.#assertBeforeMutation?.(), "assertBeforeMutation");
+                fileSignal?.throwIfAborted();
+                this.#assertStagePermissions(fd);
+            } : this.#assertBeforeMutation;
             if (!copied)
-                await writeNativeInput(fd, input, maxBytes, this.#assertBeforeMutation);
-            if (this.#sync)
-                syncFileBestEffortSync(fd);
+                await writePinnedInput(fd, input, maxBytes, assertBeforeMutation);
+            if (this.#verifyMode)
+                this.#assertStagePermissions(fd);
+            if (this.#sync) {
+                if (this.#strictFileSync)
+                    fs.fsyncSync(fd);
+                else
+                    syncFileBestEffortSync(fd);
+            }
             const stat = fs.fstatSync(fd, { bigint: true });
-            this.#receipt = Object.freeze({
-                directory: this.#directory,
-                temporaryBasename: this.#name,
-                identity: Object.freeze({
-                    dev: stat.dev,
-                    ino: stat.ino,
-                    mode: Number(stat.mode & 4095n),
-                    nlink: stat.nlink,
-                    size: stat.size,
-                    uid: Number(stat.uid),
-                    gid: Number(stat.gid),
-                    mtimeNs: stat.mtimeNs,
-                    ctimeNs: stat.ctimeNs,
-                }),
-            });
+            this.#receipt = createStagedFileReceipt(this.#directory, this.#name, stat);
             this.#assertCurrent();
         }
         catch (error) {
@@ -275,6 +318,10 @@ class NativeStagedFile {
             this.#assertCurrent();
             assertFinalSymlinkRejected(path.join(this.#directory.realPath, basename), this.#rejectFinalSymlink);
             this.#assertBeforeMutation?.();
+            if (this.#assertBeforeMutation) {
+                this.#assertCurrent();
+                assertFinalSymlinkRejected(path.join(this.#directory.realPath, basename), this.#rejectFinalSymlink);
+            }
             try {
                 if (overwrite) {
                     this.#binding.renameReplace(this.#parentFd, this.#name, this.#parentFd, basename);
@@ -307,7 +354,7 @@ class NativeStagedFile {
         const receipt = Object.freeze({ status: "published", staged: this.receipt, basename, overwrite });
         this.#open().publication = receipt;
         onPublished?.(receipt.staged.identity);
-        const stagedMode = this.#assertNamed(basename);
+        const stagedMode = this.#assertNamed(basename, 0o600);
         assertStagedDirectoryCurrent(this.#directory);
         // Keep contents private until the name passes its identity fence. Mode
         // changes use the owned fd, including for final mode 000.
@@ -317,11 +364,14 @@ class NativeStagedFile {
         // Content was synced during preparation. A lost chmod leaves 0600, no wider
         // than modes retaining owner rw; restrictive modes still need a durable correction.
         if (this.#sync && ((this.#publishedMode & 0o600) !== 0o600 || (stagedMode & ~this.#publishedMode) !== 0)) {
-            syncFileBestEffortSync(fd);
+            if (this.#strictFileSync)
+                fs.fsyncSync(fd);
+            else
+                syncFileBestEffortSync(fd);
         }
         if (this.#sync)
             syncFileBestEffortSync(this.#parentFd);
-        this.#assertNamed(basename);
+        this.#assertNamed(basename, this.#publishedMode);
         assertStagedDirectoryCurrent(this.#directory);
         return receipt;
     }
@@ -397,5 +447,5 @@ export async function stageFileInDirectory(options) {
     const input = { kind: "buffer", data: Buffer.from(options.content) };
     const mode = options.mode ?? 0o600;
     const parent = openStagedDirectory(options.directory);
-    return await createNativeStage(binding, parent.fd, fs.closeSync, parent.receipt, input, mode);
+    return await createNativeStage(binding, parent.fd, fs.closeSync, parent.receipt, input, mode, undefined, true, true, undefined, undefined, false, "mode-only");
 }

package/dist/native.js

@@ -22,7 +22,7 @@ function isMuslFromReport() {
             return true;
     }
     catch {
-        // Continue with filesystem and ELF inspection.
+        // Continue with ELF and filesystem inspection.
     }
     return undefined;
 }
@@ -114,7 +114,7 @@ function isMuslFromElfInterpreter() {
 function isMusl() {
     if (process.platform !== "linux")
         return false;
-    for (const detector of [isMuslFromReport, isMuslFromFilesystem, isMuslFromElfInterpreter]) {
+    for (const detector of [isMuslFromReport, isMuslFromElfInterpreter, isMuslFromFilesystem]) {
         const result = detector();
         if (result !== undefined)
             return result;

package/dist/opened-realpath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}
+{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}

package/dist/opened-realpath.js

@@ -5,9 +5,18 @@ import { openedPathResolutionError } from "./opened-file-failure.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 export async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
-    const handleStat = fsSync.fstatSync(handle.fd);
-    return (await resolveOpenedFileRealPathForFd(handle.fd, handleStat, ioPath)).realPath;
+    const fd = handle.fd;
+    const identity = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }));
+    const resolved = await resolveOpenedFileRealPathForFd(fd, identity, ioPath);
+    let first = resolved.stat;
+    inspectFileIdentitySync(() => {
+        const current = first ?? fsSync.statSync(resolved.realPath, { bigint: true });
+        first = undefined;
+        return current;
+    }, identity);
+    return resolved.realPath;
 }
 export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
     const statOptions = typeof handleStat.dev === "bigint" || typeof handleStat.ino === "bigint"

package/dist/owner-dacl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAmCvE"}
+{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAmCvE"}

package/dist/owner-dacl.js

@@ -1,17 +1,23 @@
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
+import { warnNativeFallback } from "./native-fallback-warning.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { readWindowsSecurityFactsCommand } from "./windows-security-command.js";
 export function readOwnerAndDacl(targetPath) {
     if (process.platform !== "win32") {
         return { status: "unsupported-platform", platform: process.platform };
     }
     assertNoWindowsPathAlias(targetPath, "filesystem", "owner and DACL path uses a Windows filesystem namespace alias");
     const native = getNativeBinding();
-    if (!native) {
-        throw new FsSafeError("helper-unavailable", "Windows owner and DACL facts require the matching optional native platform package; " +
-            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
+    const inspect = native?.readOwnerAndDacl;
+    if (typeof inspect !== "function") {
+        if (getFsSafeNativeConfig().mode === "require") {
+            throw new FsSafeError("helper-unavailable", "Windows owner and DACL facts require an up-to-date native helper");
+        }
+        warnNativeFallback("windows-owner-dacl", "Windows owner and DACL inspection uses a slower built-in system command.");
     }
-    const facts = native.readOwnerAndDacl(targetPath);
+    const facts = typeof inspect === "function" ? inspect.call(native, targetPath) : readWindowsSecurityFactsCommand(targetPath);
     return {
         status: "supported",
         ownerSid: facts.ownerSid,

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAsBT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAsBT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CASrF"}

package/dist/path.js

@@ -160,7 +160,8 @@ export function splitSafeRelativePath(relativePath) {
 export function resolveSafeRelativePath(rootDir, relativePath) {
     assertNoWindowsPathAlias(rootDir, "filesystem", "root dir uses a Windows filesystem namespace alias");
     const root = resolvePathPreservingWindowsRoot(rootDir);
-    const target = resolvePathFromBasePreservingWindowsRoot(root, ...splitSafeRelativePath(relativePath));
+    splitSafeRelativePath(relativePath);
+    const target = resolvePathFromBasePreservingWindowsRoot(root, relativePath);
     if (!isPathInside(root, target)) {
         throw new FsSafeError("outside-workspace", "relative path escapes root");
     }

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA8BF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA0E1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA8BF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA4D1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/permissions.js

@@ -39,23 +39,9 @@ export async function inspectPathPermissions(targetPath, opts) {
     const admissionPlatform = process.platform === "win32"
         ? process.platform
         : (opts?.platform ?? process.platform);
-    if (hasWindowsPathAlias(targetPath, "filesystem", admissionPlatform)) {
-        const st = failedSafeStat("Path uses a Windows filesystem namespace alias");
-        return {
-            ok: false,
-            isSymlink: false,
-            isDir: false,
-            mode: null,
-            bits: null,
-            source: "unknown",
-            worldWritable: false,
-            groupWritable: false,
-            worldReadable: false,
-            groupReadable: false,
-            error: st.error,
-        };
-    }
-    const st = await safeStatAdmitted(targetPath);
+    const st = hasWindowsPathAlias(targetPath, "filesystem", admissionPlatform)
+        ? failedSafeStat("Path uses a Windows filesystem namespace alias")
+        : await safeStatAdmitted(targetPath);
     if (!st.ok) {
         return {
             ok: false,

package/dist/pinned-write-input.d.ts

@@ -0,0 +1,4 @@
+import type { FileHandle } from "node:fs/promises";
+import type { PinnedWriteInput } from "./pinned-write-types.js";
+export declare function writePinnedInput(target: FileHandle | number, input: PinnedWriteInput, maxBytes?: number, assertBeforeMutation?: () => void): Promise<void>;
+//# sourceMappingURL=pinned-write-input.d.ts.map

package/dist/pinned-write-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-write-input.d.ts","sourceRoot":"","sources":["../src/pinned-write-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAWhE,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,KAAK,EAAE,gBAAgB,EACvB,QAAQ,CAAC,EAAE,MAAM,EACjB,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/pinned-write-input.js

@@ -0,0 +1,35 @@
+import { types } from "node:util";
+import { snapshotByteView } from "./byte-view.js";
+import { writeCopyFileToFd } from "./copy-file-input.js";
+import { FsSafeError } from "./errors.js";
+import { writeAllToFile } from "./write-file-handle.js";
+const isUint8Array = types.isUint8Array;
+function streamChunkBytes(chunk) {
+    if (Buffer.isBuffer(chunk))
+        return chunk;
+    if (!isUint8Array(chunk))
+        return Buffer.from(chunk);
+    return snapshotByteView(chunk);
+}
+export async function writePinnedInput(target, input, maxBytes, assertBeforeMutation) {
+    if (input.kind === "file") {
+        await writeCopyFileToFd(typeof target === "number" ? target : target.fd, input, maxBytes, assertBeforeMutation);
+        return;
+    }
+    let bytes = 0;
+    const write = async (data) => {
+        bytes += data.byteLength;
+        if (maxBytes !== undefined && bytes > maxBytes) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
+        }
+        await writeAllToFile(target, data, { assertBeforeMutation });
+    };
+    if (input.kind === "buffer") {
+        await write(typeof input.data === "string" ? Buffer.from(input.data, input.encoding ?? "utf8") : input.data);
+    }
+    else {
+        for await (const chunk of input.stream) {
+            await write(streamChunkBytes(chunk));
+        }
+    }
+}

package/dist/pinned-write-mode.d.ts

@@ -0,0 +1,5 @@
+import type { FileHandle } from "node:fs/promises";
+export declare function assertPinnedWriteMode(fd: number, mode: number, privateCreation?: boolean): void;
+export declare function preparePinnedWriteMode(handle: FileHandle, createdMode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): Promise<(() => void) | undefined>;
+export declare function pinnedWriteModeAssertion(fd: number, mode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): () => void;
+//# sourceMappingURL=pinned-write-mode.d.ts.map

package/dist/pinned-write-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-write-mode.d.ts","sourceRoot":"","sources":["../src/pinned-write-mode.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI,CAO7F;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,eAAe,UAAQ,GACtB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,CAQnC;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,eAAe,UAAQ,GACtB,MAAM,IAAI,CAKZ"}

package/dist/pinned-write-mode.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
+import { assertPrivateCreationFile } from "./creation-file-state.js";
+export function assertPinnedWriteMode(fd, mode, privateCreation = false) {
+    if (process.platform === "win32")
+        return;
+    const stat = fs.fstatSync(fd, { bigint: true });
+    if (privateCreation)
+        assertPrivateCreationFile(stat, fd);
+    if (Number(stat.mode & 4095n) !== mode) {
+        throw new FsSafeError("insecure-permissions", "filesystem did not enforce the requested file mode");
+    }
+}
+export async function preparePinnedWriteMode(handle, createdMode, assertBeforeMutation, privateCreation = false) {
+    if (process.platform === "win32")
+        return assertBeforeMutation;
+    assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
+    if (createdMode !== 0o600) {
+        if (privateCreation)
+            assertPrivateCreationFile(fs.fstatSync(handle.fd, { bigint: true }), handle.fd);
+        await handle.chmod(0o600);
+    }
+    return pinnedWriteModeAssertion(handle.fd, 0o600, assertBeforeMutation, privateCreation);
+}
+export function pinnedWriteModeAssertion(fd, mode, assertBeforeMutation, privateCreation = false) {
+    return () => {
+        assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
+        assertPinnedWriteMode(fd, mode, privateCreation);
+    };
+}

package/dist/pinned-write-staged.d.ts

@@ -0,0 +1,6 @@
+import { type BigIntStats } from "node:fs";
+import type { AsyncDirectoryGuard } from "./directory-guard.js";
+import { type FileIdentityStat } from "./file-identity.js";
+import type { PinnedWriteParams } from "./pinned-write-types.js";
+export declare function runPinnedStagedWrite(params: PinnedWriteParams, parentPath: string, parentGuard: AsyncDirectoryGuard<BigIntStats>): Promise<FileIdentityStat>;
+//# sourceMappingURL=pinned-write-staged.d.ts.map

package/dist/pinned-write-staged.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-write-staged.d.ts","sourceRoot":"","sources":["../src/pinned-write-staged.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAMnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EAA+B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AASjE,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAC5C,OAAO,CAAC,gBAAgB,CAAC,CAqJ3B"}