@openclaw/fs-safe 0.15.0 → 0.17.0

package/dist/json.js

@@ -3,12 +3,12 @@ import fsSync from "node:fs";
 import path from "node:path";
 import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { stringifyJsonDocument } from "./json-stringify.js";
 import { readRegularFile, readRegularFileSync, statRegularFile } from "./regular-file.js";
 import { openRootFileSync } from "./root-file.js";
-import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { writeTempFileSync } from "./replace-file-descriptor.js";
+import { SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
 import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
 import { writeTextAtomic } from "./text-atomic.js";
 import { sleep } from "./timing.js";
@@ -56,42 +56,12 @@ const JSON_DIR_MODE = 0o700;
 function getErrorCode(err) {
     return err instanceof Error ? err.code : undefined;
 }
-function trySetSecureMode(pathname, expectedIdentity) {
-    let fd;
+function trySetSecureMode(fd) {
     try {
-        const before = fsSync.lstatSync(pathname, { bigint: true });
-        if (before.isSymbolicLink() ||
-            !before.isFile() ||
-            before.nlink !== 1n ||
-            !sameFileIdentityForCleanup(before, expectedIdentity)) {
-            return;
-        }
-        fd = fsSync.openSync(pathname, resolveReadOpenFlags());
-        const opened = fsSync.fstatSync(fd, { bigint: true });
-        const current = fsSync.lstatSync(pathname, { bigint: true });
-        if (!opened.isFile() ||
-            opened.nlink !== 1n ||
-            current.isSymbolicLink() ||
-            !current.isFile() ||
-            current.nlink !== 1n ||
-            !sameFileIdentityForCleanup(opened, expectedIdentity) ||
-            !sameFileIdentityForCleanup(current, opened)) {
-            return;
-        }
         fsSync.fchmodSync(fd, JSON_FILE_MODE);
     }
     catch {
-        // Best-effort mode application never falls back to a mutable pathname.
-    }
-    finally {
-        if (fd !== undefined) {
-            try {
-                fsSync.closeSync(fd);
-            }
-            catch {
-                // best-effort cleanup
-            }
-        }
+        // Best-effort mode application stays on the retained staging descriptor.
     }
 }
 function trySyncDirectory(pathname) {
@@ -114,48 +84,24 @@ function trySyncDirectory(pathname) {
         }
     }
 }
-function renameJsonFileWithFallback(tmpPath, pathname) {
+function renameJsonFileWithFallback(owner, pathname) {
+    owner.assertCurrent(fsSync);
     try {
-        fsSync.renameSync(tmpPath, pathname);
+        fsSync.renameSync(owner.pathname, pathname);
         return;
     }
     catch (error) {
-        const code = error.code;
+        const code = error?.code;
         if (code === "EPERM" || code === "EEXIST") {
-            const existing = (() => {
-                try {
-                    return fsSync.lstatSync(pathname);
-                }
-                catch (lstatError) {
-                    if (lstatError.code === "ENOENT") {
-                        return null;
-                    }
-                    throw lstatError;
-                }
-            })();
-            if (existing?.isSymbolicLink()) {
-                fsSync.rmSync(pathname, { force: true });
-                fsSync.renameSync(tmpPath, pathname);
-                return;
-            }
+            owner.assertCurrent(fsSync);
             fsSync.rmSync(pathname, { force: true });
-            fsSync.renameSync(tmpPath, pathname);
+            owner.assertCurrent(fsSync);
+            fsSync.renameSync(owner.pathname, pathname);
             return;
         }
         throw error;
     }
 }
-function writeTempJsonFile(pathname, payload) {
-    const fd = fsSync.openSync(pathname, "wx", JSON_FILE_MODE);
-    try {
-        fsSync.writeFileSync(fd, payload, "utf8");
-        fsSync.fsyncSync(fd);
-        return fsSync.fstatSync(fd, { bigint: true });
-    }
-    finally {
-        fsSync.closeSync(fd);
-    }
-}
 export function tryReadJsonSync(pathname, options = {}) {
     try {
         const raw = readRegularFileSync({
@@ -174,20 +120,31 @@ export function writeJsonSync(pathname, data) {
     const tmpPath = path.format({ ...path.parse(filePath), base: `.fs-safe-${randomUUID()}.tmp` });
     const payload = `${stringifyJsonDocument(data, null, 2)}\n`;
     fsSync.mkdirSync(recursiveMkdirPath(path.dirname(filePath)), { recursive: true, mode: JSON_DIR_MODE });
+    const owner = new SyncAtomicTempOwner(tmpPath);
+    let originalFailure;
     try {
-        const tempIdentity = writeTempJsonFile(tmpPath, payload);
-        trySetSecureMode(tmpPath, tempIdentity);
-        renameJsonFileWithFallback(tmpPath, filePath);
-        trySetSecureMode(filePath, tempIdentity);
+        owner.start();
+        const temp = writeTempFileSync({
+            fsModule: fsSync, tempPath: tmpPath, content: payload, mode: JSON_FILE_MODE,
+            sync: false, onIdentity: owner.onIdentity,
+        });
+        owner.adopt(temp);
+        owner.assertCurrent(fsSync);
+        trySetSecureMode(temp.fd);
+        fsSync.fsyncSync(temp.fd);
+        renameJsonFileWithFallback(owner, filePath);
+        owner.markRenamed();
+        owner.assertPublished(fsSync, filePath);
+        trySetSecureMode(temp.fd);
         trySyncDirectory(filePath);
+        owner.assertPublished(fsSync, filePath);
+    }
+    catch (error) {
+        originalFailure = { error };
+        throw error;
     }
     finally {
-        try {
-            fsSync.rmSync(tmpPath, { force: true });
-        }
-        catch {
-            // best-effort cleanup when rename does not happen
-        }
+        owner.finish({ fsModule: fsSync, originalFailure, throwOnCleanupError: false });
     }
 }
 export class JsonFileReadError extends Error {

package/dist/local-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAQ3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAiEF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CA2C7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuCtC"}
+{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAQ3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AA+EF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CAoC7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6BtC"}

package/dist/local-roots.js

@@ -71,7 +71,7 @@ function resolveRootRealSync(rootDir) {
     assertNoWindowsPathAlias(realPath, "filesystem", "local root uses a Windows filesystem namespace alias");
     return realPath;
 }
-export function resolveLocalPathFromRootsSync(options) {
+function prepareLocalRootsInput(options) {
     const label = options.label ?? "local roots";
     const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
     let requestedPath;
@@ -83,6 +83,13 @@ export function resolveLocalPathFromRootsSync(options) {
             return null;
         throw error;
     }
+    return { label, rootDirs, requestedPath };
+}
+export function resolveLocalPathFromRootsSync(options) {
+    const input = prepareLocalRootsInput(options);
+    if (!input)
+        return null;
+    const { label, rootDirs, requestedPath } = input;
     for (const rootDir of rootDirs) {
         const rootReal = resolveRootRealSync(rootDir);
         if (!rootReal) {
@@ -122,17 +129,17 @@ export function resolveLocalPathFromRootsSync(options) {
 }
 export async function readLocalFileFromRoots(options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes);
-    const label = options.label ?? "local roots";
-    const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
-    let requestedPath;
-    try {
-        requestedPath = resolveLocalPathInput(options.filePath, "file path");
-    }
-    catch (error) {
-        if (isWindowsPathAliasError(error))
-            return null;
-        throw error;
-    }
+    const input = prepareLocalRootsInput(options);
+    if (!input || input.rootDirs.length === 0)
+        return null;
+    const { rootDirs, requestedPath } = input;
+    const readOptions = {
+        hardlinks: options.hardlinks,
+        symlinks: options.symlinks,
+    };
+    // Omission keeps Root's default cap; one policy snapshot serves every root.
+    if (maxBytes !== undefined)
+        readOptions.maxBytes = maxBytes;
     for (const rootDir of rootDirs) {
         let scopedRoot;
         try {
@@ -141,15 +148,6 @@ export async function readLocalFileFromRoots(options) {
         catch {
             continue;
         }
-        const readOptions = {
-            hardlinks: options.hardlinks,
-            symlinks: options.symlinks,
-        };
-        // Leave maxBytes absent when the caller omits it so Root's own default
-        // cap remains in force instead of being overwritten by undefined.
-        if (maxBytes !== undefined) {
-            readOptions.maxBytes = maxBytes;
-        }
         try {
             const result = await scopedRoot.readAbsolute(requestedPath, readOptions);
             return { ...result, root: scopedRoot.rootReal };

package/dist/move-path-cleanup.d.ts

@@ -1,13 +1,5 @@
 import fsSync from "node:fs";
-export type EntryIdentity = {
-    ctimeMs: number;
-    dev: number;
-    ino: number;
-    mode: number;
-    mtimeMs: number;
-    nlink: number;
-    size: number;
-};
+export type EntryIdentity = Readonly<Pick<fsSync.BigIntStats, "ctimeNs" | "dev" | "ino" | "mode" | "mtimeNs" | "nlink" | "size">>;
 export type CopiedEntryManifest = (EntryIdentity & {
     children: Array<{
         name: string;
@@ -27,19 +19,13 @@ type CleanupAliasGroup = {
 export type CleanupCopiedEntryState = {
     aliasGroups: Map<string, CleanupAliasGroup>;
 };
-export declare function entryIdentity(stat: {
-    ctimeMs: number;
-    dev: number;
-    ino: number;
-    mode: number;
-    mtimeMs: number;
-    nlink: number;
-    size: number;
-}): EntryIdentity;
+export declare function entryIdentity(stat: EntryIdentity): EntryIdentity;
 export declare function sameIdentity(a: EntryIdentity, b: EntryIdentity): boolean;
 export declare function sourceChangedError(sourcePath: string): Error;
+export declare function inspectSourceEntry(sourcePath: string, observe: () => fsSync.BigIntStats): fsSync.BigIntStats;
+export declare function inspectSourceDirectory(sourcePath: string, expected?: Pick<fsSync.BigIntStats, "dev" | "ino">): fsSync.BigIntStats;
 export declare function assertSourceStillMatches(sourcePath: string, identity: EntryIdentity): Promise<void>;
 export declare function createCleanupCopiedEntryState(sourcePath: string, manifest: CopiedEntryManifest): CleanupCopiedEntryState;
-export declare function cleanupCopiedEntry(sourcePath: string, manifest: CopiedEntryManifest, state: CleanupCopiedEntryState, assertBeforeMutation: () => void): Promise<CleanupCopiedEntryResult>;
+export declare function cleanupCopiedEntry(sourcePath: string, manifest: CopiedEntryManifest, state: CleanupCopiedEntryState, assertBeforeMutation: (() => void) | undefined): Promise<CleanupCopiedEntryResult>;
 export {};
 //# sourceMappingURL=move-path-cleanup.d.ts.map

package/dist/move-path-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path-cleanup.d.ts","sourceRoot":"","sources":["../src/move-path-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAM7B,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,CAAC,aAAa,GAAG;IACf,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,GACF,CAAC,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvC,KAAK,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC7C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,aAAa,CAUhB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAUxE;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,CAI5D;AAED,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,GAC5B,uBAAuB,CAuBzB;AAsDD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,MAAM,IAAI,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAkFnC"}
+{"version":3,"file":"move-path-cleanup.d.ts","sourceRoot":"","sources":["../src/move-path-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAC1D,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAClE,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,aAAa,GAAG;IACf,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,GACF,CAAC,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvC,KAAK,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC7C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAUhE;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAUxE;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,CAI5D;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAE5G;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,GACjD,MAAM,CAAC,WAAW,CAWpB;AAED,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,GAC5B,uBAAuB,CAuBzB;AAgED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CA0FnC"}

package/dist/move-path-cleanup.js

@@ -2,14 +2,15 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 export function entryIdentity(stat) {
     return {
-        ctimeMs: stat.ctimeMs,
+        ctimeNs: stat.ctimeNs,
         dev: stat.dev,
         ino: stat.ino,
         mode: stat.mode,
-        mtimeMs: stat.mtimeMs,
+        mtimeNs: stat.mtimeNs,
         nlink: stat.nlink,
         size: stat.size,
     };
@@ -20,16 +21,32 @@ export function sameIdentity(a, b) {
         a.mode === b.mode &&
         a.nlink === b.nlink &&
         a.size === b.size &&
-        a.mtimeMs === b.mtimeMs &&
-        a.ctimeMs === b.ctimeMs);
+        a.mtimeNs === b.mtimeNs &&
+        a.ctimeNs === b.ctimeNs);
 }
 export function sourceChangedError(sourcePath) {
     return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
         code: "ESTALE",
     });
 }
+export function inspectSourceEntry(sourcePath, observe) {
+    return inspectFileIdentitySync(observe, undefined, process.platform, () => sourceChangedError(sourcePath));
+}
+export function inspectSourceDirectory(sourcePath, expected) {
+    try {
+        return inspectDirectoryIdentitySync(sourcePath, expected);
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ENOENT" || code === "ENOTDIR" ||
+            (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
+            throw sourceChangedError(sourcePath);
+        }
+        throw error;
+    }
+}
 export async function assertSourceStillMatches(sourcePath, identity) {
-    if (!sameIdentity(identity, entryIdentity(fsSync.lstatSync(sourcePath)))) {
+    if (!sameIdentity(identity, inspectSourceEntry(sourcePath, () => fsSync.lstatSync(sourcePath, { bigint: true })))) {
         throw sourceChangedError(sourcePath);
     }
 }
@@ -43,7 +60,7 @@ function collectAliasCandidates(sourcePath, manifest, candidates) {
         }
         return;
     }
-    if (manifest.nlink <= 1) {
+    if (manifest.nlink <= 1n) {
         return;
     }
     const key = identityKey(manifest);
@@ -76,15 +93,26 @@ function sameOwnedUnlinkTransition(before, after) {
         before.ino === after.ino &&
         before.mode === after.mode &&
         before.size === after.size &&
-        before.mtimeMs === after.mtimeMs &&
-        before.nlink > 0 &&
-        after.nlink === before.nlink - 1 &&
-        after.ctimeMs >= before.ctimeMs);
+        before.mtimeNs === after.mtimeNs &&
+        before.nlink > 0n &&
+        after.nlink === before.nlink - 1n &&
+        after.ctimeNs >= before.ctimeNs);
 }
 function poisonAliasGroup(group) {
     group.stale = true;
     return "stale";
 }
+function inspectCleanupLeaf(sourcePath, expected) {
+    let mismatch;
+    try {
+        return inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), expected, process.platform, () => mismatch = sourceChangedError(sourcePath));
+    }
+    catch (error) {
+        if (mismatch !== undefined && error === mismatch)
+            return undefined;
+        throw error;
+    }
+}
 async function observeOwnedAliasUnlink(sourcePath, group) {
     group.remainingPaths.delete(sourcePath);
     const remainingPath = group.remainingPaths.values().next().value;
@@ -93,7 +121,7 @@ async function observeOwnedAliasUnlink(sourcePath, group) {
     }
     let observed;
     try {
-        observed = fsSync.lstatSync(remainingPath);
+        observed = inspectCleanupLeaf(remainingPath, group.expected);
     }
     catch (error) {
         if (error?.code === "ENOENT") {
@@ -101,11 +129,10 @@ async function observeOwnedAliasUnlink(sourcePath, group) {
         }
         throw error;
     }
-    const observedIdentity = entryIdentity(observed);
-    if (!sameOwnedUnlinkTransition(group.expected, observedIdentity)) {
+    if (!observed || !sameOwnedUnlinkTransition(group.expected, observed)) {
         return poisonAliasGroup(group);
     }
-    group.expected = observedIdentity;
+    group.expected = entryIdentity(observed);
     return "removed";
 }
 function mergeCleanupResults(a, b) {
@@ -130,12 +157,16 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
         // A same-inode directory can gain unrelated children after commit. Still
         // clean manifest children so the fallback does not duplicate copied files.
         let result = "removed";
+        const assertBeforeChildMutation = assertBeforeMutation ? () => {
+            assertBeforeMutation();
+            inspectSourceDirectory(sourcePath, manifest.directoryIdentity);
+        } : undefined;
         for (const child of manifest.children) {
-            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeMutation));
+            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeChildMutation));
         }
         // Child cleanup and the caller's authority check can replace the directory.
         // Keep the final exact observation after both, immediately before removal.
-        assertBeforeMutation();
+        assertBeforeMutation?.();
         try {
             currentStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), manifest.directoryIdentity);
         }
@@ -166,9 +197,10 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
     if (aliasGroup?.stale) {
         return "stale";
     }
+    const expected = aliasGroup?.expected ?? manifest;
     let currentStat;
     try {
-        currentStat = fsSync.lstatSync(sourcePath);
+        currentStat = inspectCleanupLeaf(sourcePath, expected);
     }
     catch (error) {
         if (error?.code === "ENOENT") {
@@ -176,11 +208,15 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
         }
         throw error;
     }
-    const expected = aliasGroup?.expected ?? manifest;
-    if (!sameIdentity(expected, entryIdentity(currentStat))) {
-        return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+    for (let observation = 0;; observation++) {
+        if (!currentStat || !sameIdentity(expected, currentStat)) {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+        }
+        if (observation || !assertBeforeMutation)
+            break;
+        assertBeforeMutation();
+        currentStat = inspectCleanupLeaf(sourcePath, expected);
     }
-    assertBeforeMutation();
     await fs.unlink(sourcePath);
     return aliasGroup
         ? await observeOwnedAliasUnlink(sourcePath, aliasGroup)

package/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAoSD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAoHf"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAGvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA4RD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CA2If"}