@openclaw/fs-safe 0.16.0 → 0.17.0

package/dist/move-path.js

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { createAsyncDirectoryGuard, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { assertSyncDirectoryGuard, createAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { guardedRename } from "./guarded-mutation.js";
-import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
+import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, inspectSourceDirectory, inspectSourceEntry, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
@@ -57,7 +57,7 @@ function isSameOrDescendant(parentPath, candidatePath) {
         (!path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== ".."));
 }
 async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expectedIdentity) {
-    const sourceStat = fsSync.lstatSync(sourcePath);
+    const sourceStat = inspectSourceEntry(sourcePath, () => fsSync.lstatSync(sourcePath, { bigint: true }));
     const sourceIdentity = entryIdentity(sourceStat);
     if (expectedIdentity && !sameIdentity(expectedIdentity, sourceIdentity)) {
         throw sourceChangedError(sourcePath);
@@ -80,7 +80,7 @@ async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expect
     return sourceIdentity;
 }
 function modeBits(mode) {
-    return mode & 0o777;
+    return Number(mode & 511n);
 }
 async function chmodDirectoryPinned(directoryPath, mode) {
     if (process.platform === "win32") {
@@ -120,21 +120,25 @@ async function copyRegularFilePinned(params) {
         throw error;
     }
     try {
-        const openedStat = fsSync.fstatSync(sourceHandle.fd);
+        const inspectOpenedSource = () => inspectSourceEntry(params.from, () => {
+            const stat = fsSync.fstatSync(sourceHandle.fd, { bigint: true });
+            if (params.rejectHardlinks && stat.nlink > 1n)
+                throw hardlinkedSourceError(params.from);
+            if (!stat.isFile())
+                throw sourceChangedError(params.from);
+            return stat;
+        });
+        const openedStat = inspectOpenedSource();
         openedIdentity = entryIdentity(openedStat);
-        if (params.rejectHardlinks && openedStat.nlink > 1) {
-            throw hardlinkedSourceError(params.from);
-        }
         const openAdvancedWindowsCtime = process.platform === "win32" &&
             params.identity.dev === openedIdentity.dev &&
             params.identity.ino === openedIdentity.ino &&
             params.identity.mode === openedIdentity.mode &&
             params.identity.nlink === openedIdentity.nlink &&
             params.identity.size === openedIdentity.size &&
-            params.identity.mtimeMs === openedIdentity.mtimeMs &&
-            openedIdentity.ctimeMs >= params.identity.ctimeMs;
-        if (!openedStat.isFile() ||
-            (!sameIdentity(params.identity, openedIdentity) && !openAdvancedWindowsCtime)) {
+            params.identity.mtimeNs === openedIdentity.mtimeNs &&
+            openedIdentity.ctimeNs >= params.identity.ctimeNs;
+        if (!sameIdentity(params.identity, openedIdentity) && !openAdvancedWindowsCtime) {
             throw sourceChangedError(params.from);
         }
         await assertSourceStillMatches(params.from, openedIdentity);
@@ -154,11 +158,7 @@ async function copyRegularFilePinned(params) {
             }
             // Re-check the opened source before the staged tree can be committed. If
             // it changed while we copied, the caller should retry the move.
-            const finalSourceStat = fsSync.fstatSync(sourceHandle.fd);
-            if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
-                throw hardlinkedSourceError(params.from);
-            }
-            if (!sameIdentity(openedIdentity, entryIdentity(finalSourceStat))) {
+            if (!sameIdentity(openedIdentity, inspectOpenedSource())) {
                 throw sourceChangedError(params.from);
             }
             await destinationHandle.chmod(modeBits(params.mode));
@@ -178,21 +178,8 @@ async function copyRegularFilePinned(params) {
     }
     return openedIdentity;
 }
-function inspectSourceDirectory(sourcePath, expected) {
-    try {
-        return inspectDirectoryIdentitySync(sourcePath, expected);
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT" || code === "ENOTDIR" ||
-            (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
-            throw sourceChangedError(sourcePath);
-        }
-        throw error;
-    }
-}
 async function copyEntryWithManifest(from, to, options, expectedIdentity) {
-    const sourceStat = fsSync.lstatSync(from);
+    const sourceStat = inspectSourceEntry(from, () => fsSync.lstatSync(from, { bigint: true }));
     const identity = entryIdentity(sourceStat);
     if (expectedIdentity && !sameIdentity(expectedIdentity, identity)) {
         throw sourceChangedError(from);
@@ -208,8 +195,7 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
         return { ...identity, kind: "leaf" };
     }
     if (sourceStat.isDirectory()) {
-        const directoryStat = inspectSourceDirectory(from);
-        const directoryIdentity = Object.freeze({ dev: directoryStat.dev, ino: directoryStat.ino });
+        const directoryIdentity = Object.freeze({ dev: sourceStat.dev, ino: sourceStat.ino });
         await fs.mkdir(to, { mode: modeBits(sourceStat.mode) || 0o755 });
         options.onCreated?.(fsSync.lstatSync(to, { bigint: true }));
         const children = [];
@@ -226,6 +212,7 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
                 name: child,
                 manifest: await copyEntryWithManifest(path.join(from, child), path.join(to, child), {
                     sourceHardlinks: options.sourceHardlinks, budget: options.budget,
+                    aliases: options.aliases,
                 }),
             });
         }
@@ -241,9 +228,13 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
     if (!sourceStat.isFile()) {
         throw new Error(`Refusing to move non-file path with copy fallback: ${from}`);
     }
-    if (options.sourceHardlinks === "reject" && sourceStat.nlink > 1) {
+    if (options.sourceHardlinks === "reject" && sourceStat.nlink > 1n) {
         throw hardlinkedSourceError(from);
     }
+    const aliasKey = options.aliases && identity.nlink > 1n ? `${identity.dev}:${identity.ino}` : undefined;
+    const alias = aliasKey ? options.aliases.get(aliasKey) : undefined;
+    if (alias && !sameIdentity(alias, identity))
+        throw sourceChangedError(from);
     const copiedIdentity = await copyRegularFilePinned({
         from,
         identity,
@@ -252,7 +243,14 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
         to,
         onCreated: options.onCreated,
     });
-    return { ...copiedIdentity, kind: "leaf" };
+    // A permitted Windows open advances every name's ctime. Share its receipt
+    // only after the preceding fingerprint and this complete copy were verified.
+    if (alias)
+        return Object.assign(alias, copiedIdentity);
+    const manifest = { ...copiedIdentity, kind: "leaf" };
+    if (aliasKey)
+        options.aliases.set(aliasKey, manifest);
+    return manifest;
 }
 function assertSynchronousResult(returned, name) {
     if (returned !== undefined) {
@@ -275,13 +273,13 @@ export async function movePathWithCopyFallback(options) {
     const callerPublished = options.onDestinationPublished;
     let assertionRejected = false;
     let destinationPublished = false;
-    const assertBeforeMutation = () => {
-        assertSynchronousResult(callerMutationAssert?.(), "assertBeforeMutation");
+    const assertBeforeMutation = callerMutationAssert == null ? undefined : () => {
+        assertSynchronousResult(callerMutationAssert(), "assertBeforeMutation");
     };
     const assertBeforeRename = () => {
         try {
             assertSynchronousResult(callerRenameAssert?.(), "assertBeforeRename");
-            assertBeforeMutation();
+            assertBeforeMutation?.();
         }
         catch (error) {
             assertionRejected = true;
@@ -332,6 +330,29 @@ export async function movePathWithCopyFallback(options) {
         // never become the published target; the copy loop fences nlink again.
     }
     const sourceIdentity = await assertCopyDestinationOutsideSource(sourcePath, targetPath);
+    const sourceParentPath = path.dirname(sourcePath);
+    const sourceParent = assertBeforeMutation || callerRenameAssert || callerPublished
+        ? await createAsyncDirectoryGuard(realpathSync.native(sourceParentPath), { bigint: true })
+        : undefined;
+    const assertSourceParent = sourceParent ? () => {
+        try {
+            if (realpathSync.native(sourceParentPath) !== sourceParent.realPath)
+                throw sourceChangedError(sourcePath);
+            assertSyncDirectoryGuard(sourceParent);
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP" ||
+                (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
+                throw sourceChangedError(sourcePath);
+            }
+            throw error;
+        }
+    } : undefined;
+    const assertBeforeCleanup = assertSourceParent ? () => {
+        assertBeforeMutation?.();
+        assertSourceParent();
+    } : undefined;
     const targetDir = path.dirname(targetPath);
     const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
     const stage = await createMoveStageOwner(staged);
@@ -339,6 +360,7 @@ export async function movePathWithCopyFallback(options) {
         const manifest = await copyEntryWithManifest(sourcePath, staged, {
             sourceHardlinks: rejectHardlinks ? "reject" : "allow",
             onCreated: stage.record,
+            ...(!rejectHardlinks && process.platform === "win32" ? { aliases: new Map() } : {}),
             ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
         }, sourceIdentity);
         const cleanupState = createCleanupCopiedEntryState(sourcePath, manifest);
@@ -355,7 +377,8 @@ export async function movePathWithCopyFallback(options) {
                 onRenamed();
             },
         });
-        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState, assertBeforeMutation);
+        assertSourceParent?.();
+        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState, assertBeforeCleanup);
         if (cleanupResult === "stale") {
             throw sourceChangedError(sourcePath);
         }

package/dist/native-staged-file.d.ts

@@ -1,4 +1,5 @@
 import type { DirectoryReceipt } from "./directory-durability.js";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import { type NativeBinding } from "./native-binding.js";
@@ -24,7 +25,7 @@ export declare const createNativeStage: (...args: Parameters<typeof NativeStaged
 export declare const writeNativeStage: typeof NativeStagedFile.write;
 export type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileFailureDetails, StagedFilePublication, StagedFileReceipt, } from "./staged-file-types.js";
 export declare function stageFileInDirectory(options: {
-    directory: string | DirectoryReceipt;
+    directory: string | DirectoryReceipt<Stats | BigIntStats>;
     content: string | Uint8Array;
     /** Published mode; the unpublished stage stays at 0600. Defaults to 0600. */
     mode?: number;

package/dist/native-staged-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQlE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAWnG;AAeD,KAAK,sBAAsB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/D,cAAM,gBAAiB,YAAW,UAAU;;IAkB1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,IAAI,SAAiC,EACrC,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,EAgB1C;IAID,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,EACX,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IAoHK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC7C,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;IAuEK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAatB"}
+{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAW,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAWnG;AAeD,KAAK,sBAAsB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/D,cAAM,gBAAiB,YAAW,UAAU;;IAkB1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,IAAI,SAAiC,EACrC,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,EAgB1C;IAID,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,EACX,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IAuHK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC7C,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;IAuEK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC;IAC1D,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAatB"}

package/dist/native-staged-file.js

@@ -50,12 +50,12 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-import { assertDarwinCreationAcl, privateFileMutationAssertion } from "./creation-darwin.js";
+import { assertDarwinCreationAcl } from "./creation-darwin.js";
 import { assertPrivateCreationFile } from "./creation-file-state.js";
 import { requireNativeBinding } from "./native.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, {} from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult, MutationAuthorityError } from "./mutation-authority.js";
@@ -262,9 +262,12 @@ class NativeStagedFile {
             const fd = state.fileFd;
             if (input.kind === "file")
                 assertNativeCopyCompleted(input, copied);
-            const assertBeforeChmod = this.#private
-                ? privateFileMutationAssertion(fd, this.#assertBeforeMutation) : this.#assertBeforeMutation;
-            assertBeforeChmod?.();
+            const assertBeforeChmod = this.#assertBeforeMutation;
+            const beforeChmodResult = assertBeforeChmod?.();
+            if (this.#private) {
+                assertSynchronousCallbackResult(beforeChmodResult, "assertBeforeMutation");
+                assertPrivateCreationFile(fs.fstatSync(fd, { bigint: true }), fd);
+            }
             fs.fchmodSync(fd, 0o600);
             // Some filesystems report successful chmod without enforcing its mode.
             if (this.#verifyMode)

package/dist/native.js

@@ -22,7 +22,7 @@ function isMuslFromReport() {
             return true;
     }
     catch {
-        // Continue with filesystem and ELF inspection.
+        // Continue with ELF and filesystem inspection.
     }
     return undefined;
 }
@@ -114,7 +114,7 @@ function isMuslFromElfInterpreter() {
 function isMusl() {
     if (process.platform !== "linux")
         return false;
-    for (const detector of [isMuslFromReport, isMuslFromFilesystem, isMuslFromElfInterpreter]) {
+    for (const detector of [isMuslFromReport, isMuslFromElfInterpreter, isMuslFromFilesystem]) {
         const result = detector();
         if (result !== undefined)
             return result;

package/dist/opened-realpath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}
+{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}

package/dist/opened-realpath.js

@@ -5,9 +5,18 @@ import { openedPathResolutionError } from "./opened-file-failure.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 export async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
-    const handleStat = fsSync.fstatSync(handle.fd);
-    return (await resolveOpenedFileRealPathForFd(handle.fd, handleStat, ioPath)).realPath;
+    const fd = handle.fd;
+    const identity = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }));
+    const resolved = await resolveOpenedFileRealPathForFd(fd, identity, ioPath);
+    let first = resolved.stat;
+    inspectFileIdentitySync(() => {
+        const current = first ?? fsSync.statSync(resolved.realPath, { bigint: true });
+        first = undefined;
+        return current;
+    }, identity);
+    return resolved.realPath;
 }
 export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
     const statOptions = typeof handleStat.dev === "bigint" || typeof handleStat.ino === "bigint"

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAsBT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAsBT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CASrF"}

package/dist/path.js

@@ -160,7 +160,8 @@ export function splitSafeRelativePath(relativePath) {
 export function resolveSafeRelativePath(rootDir, relativePath) {
     assertNoWindowsPathAlias(rootDir, "filesystem", "root dir uses a Windows filesystem namespace alias");
     const root = resolvePathPreservingWindowsRoot(rootDir);
-    const target = resolvePathFromBasePreservingWindowsRoot(root, ...splitSafeRelativePath(relativePath));
+    splitSafeRelativePath(relativePath);
+    const target = resolvePathFromBasePreservingWindowsRoot(root, relativePath);
     if (!isPathInside(root, target)) {
         throw new FsSafeError("outside-workspace", "relative path escapes root");
     }

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA8BF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA0E1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA8BF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA4D1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/permissions.js

@@ -39,23 +39,9 @@ export async function inspectPathPermissions(targetPath, opts) {
     const admissionPlatform = process.platform === "win32"
         ? process.platform
         : (opts?.platform ?? process.platform);
-    if (hasWindowsPathAlias(targetPath, "filesystem", admissionPlatform)) {
-        const st = failedSafeStat("Path uses a Windows filesystem namespace alias");
-        return {
-            ok: false,
-            isSymlink: false,
-            isDir: false,
-            mode: null,
-            bits: null,
-            source: "unknown",
-            worldWritable: false,
-            groupWritable: false,
-            worldReadable: false,
-            groupReadable: false,
-            error: st.error,
-        };
-    }
-    const st = await safeStatAdmitted(targetPath);
+    const st = hasWindowsPathAlias(targetPath, "filesystem", admissionPlatform)
+        ? failedSafeStat("Path uses a Windows filesystem namespace alias")
+        : await safeStatAdmitted(targetPath);
     if (!st.ok) {
         return {
             ok: false,

package/dist/pinned-write-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write-input.d.ts","sourceRoot":"","sources":["../src/pinned-write-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,KAAK,EAAE,gBAAgB,EACvB,QAAQ,CAAC,EAAE,MAAM,EACjB,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"pinned-write-input.d.ts","sourceRoot":"","sources":["../src/pinned-write-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAWhE,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,KAAK,EAAE,gBAAgB,EACvB,QAAQ,CAAC,EAAE,MAAM,EACjB,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/pinned-write-input.js

@@ -1,6 +1,16 @@
+import { types } from "node:util";
+import { snapshotByteView } from "./byte-view.js";
 import { writeCopyFileToFd } from "./copy-file-input.js";
 import { FsSafeError } from "./errors.js";
 import { writeAllToFile } from "./write-file-handle.js";
+const isUint8Array = types.isUint8Array;
+function streamChunkBytes(chunk) {
+    if (Buffer.isBuffer(chunk))
+        return chunk;
+    if (!isUint8Array(chunk))
+        return Buffer.from(chunk);
+    return snapshotByteView(chunk);
+}
 export async function writePinnedInput(target, input, maxBytes, assertBeforeMutation) {
     if (input.kind === "file") {
         await writeCopyFileToFd(typeof target === "number" ? target : target.fd, input, maxBytes, assertBeforeMutation);
@@ -19,7 +29,7 @@ export async function writePinnedInput(target, input, maxBytes, assertBeforeMuta
     }
     else {
         for await (const chunk of input.stream) {
-            await write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            await write(streamChunkBytes(chunk));
         }
     }
 }

package/dist/pinned-write-mode.d.ts

@@ -1,5 +1,5 @@
 import type { FileHandle } from "node:fs/promises";
-export declare function assertPinnedWriteMode(fd: number, mode: number): void;
-export declare function preparePinnedWriteMode(handle: FileHandle, createdMode: number, assertBeforeMutation?: () => void): Promise<(() => void) | undefined>;
-export declare function pinnedWriteModeAssertion(fd: number, mode: number, assertBeforeMutation?: () => void): () => void;
+export declare function assertPinnedWriteMode(fd: number, mode: number, privateCreation?: boolean): void;
+export declare function preparePinnedWriteMode(handle: FileHandle, createdMode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): Promise<(() => void) | undefined>;
+export declare function pinnedWriteModeAssertion(fd: number, mode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): () => void;
 //# sourceMappingURL=pinned-write-mode.d.ts.map

package/dist/pinned-write-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write-mode.d.ts","sourceRoot":"","sources":["../src/pinned-write-mode.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAKpE;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,CAKnC;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,MAAM,IAAI,CAKZ"}
+{"version":3,"file":"pinned-write-mode.d.ts","sourceRoot":"","sources":["../src/pinned-write-mode.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI,CAO7F;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,eAAe,UAAQ,GACtB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,CAQnC;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,eAAe,UAAQ,GACtB,MAAM,IAAI,CAKZ"}

package/dist/pinned-write-mode.js

@@ -1,24 +1,31 @@
 import fs from "node:fs";
 import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
-export function assertPinnedWriteMode(fd, mode) {
+import { assertPrivateCreationFile } from "./creation-file-state.js";
+export function assertPinnedWriteMode(fd, mode, privateCreation = false) {
     if (process.platform === "win32")
         return;
-    if (Number(fs.fstatSync(fd, { bigint: true }).mode & 4095n) !== mode) {
-        throw new FsSafeError("insecure-permissions", "filesystem did not enforce the secret file mode");
+    const stat = fs.fstatSync(fd, { bigint: true });
+    if (privateCreation)
+        assertPrivateCreationFile(stat, fd);
+    if (Number(stat.mode & 4095n) !== mode) {
+        throw new FsSafeError("insecure-permissions", "filesystem did not enforce the requested file mode");
     }
 }
-export async function preparePinnedWriteMode(handle, createdMode, assertBeforeMutation) {
+export async function preparePinnedWriteMode(handle, createdMode, assertBeforeMutation, privateCreation = false) {
     if (process.platform === "win32")
         return assertBeforeMutation;
     assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
-    if (createdMode !== 0o600)
+    if (createdMode !== 0o600) {
+        if (privateCreation)
+            assertPrivateCreationFile(fs.fstatSync(handle.fd, { bigint: true }), handle.fd);
         await handle.chmod(0o600);
-    return pinnedWriteModeAssertion(handle.fd, 0o600, assertBeforeMutation);
+    }
+    return pinnedWriteModeAssertion(handle.fd, 0o600, assertBeforeMutation, privateCreation);
 }
-export function pinnedWriteModeAssertion(fd, mode, assertBeforeMutation) {
+export function pinnedWriteModeAssertion(fd, mode, assertBeforeMutation, privateCreation = false) {
     return () => {
         assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
-        assertPinnedWriteMode(fd, mode);
+        assertPinnedWriteMode(fd, mode, privateCreation);
     };
 }

package/dist/pinned-write-staged.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write-staged.d.ts","sourceRoot":"","sources":["../src/pinned-write-staged.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAMnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EAA+B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AASjE,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAC5C,OAAO,CAAC,gBAAgB,CAAC,CAqJ3B"}
+{"version":3,"file":"pinned-write-staged.d.ts","sourceRoot":"","sources":["../src/pinned-write-staged.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAMnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EAA+B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AASjE,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAC5C,OAAO,CAAC,gBAAgB,CAAC,CAqJ3B"}

package/dist/pinned-write-staged.js

@@ -9,7 +9,6 @@ import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity, sha256Hex } from "./file-identity.js";
 import { syncFileBestEffort } from "./file-sync.js";
-import { assertDarwinCreationAcl, privateFileMutationAssertion } from "./creation-darwin.js";
 import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
 import { writePinnedInput } from "./pinned-write-input.js";
 import { assertPinnedWriteMode, pinnedWriteModeAssertion, preparePinnedWriteMode } from "./pinned-write-mode.js";
@@ -20,7 +19,8 @@ import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { createStagedFileReceipt, settleStagedFile } from "./staged-file-settlement.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
-    const verifyPosixMode = params.verifyPosixMode === true && process.platform !== "win32";
+    const verifyPosixMode = process.platform !== "win32" &&
+        (params.verifyPosixMode === true || params.private === true);
     const targetPath = path.join(parentPath, params.basename);
     // Private staging must not consume the destination basename's filename budget.
     const tempPath = path.join(parentPath, `.fs-safe-${randomUUID()}.tmp`);
@@ -49,18 +49,15 @@ export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
             : await fs.open(tempPath, tempFlags, verifyPosixMode ? 0o600 : params.mode);
         let verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
         tempIdentity = verificationIdentity;
-        let assertBeforeMutation = params.private
-            ? privateFileMutationAssertion(handle.fd, params.assertBeforeMutation) : params.assertBeforeMutation;
+        let assertBeforeMutation = params.assertBeforeMutation;
         const assertBeforeWrite = verifyPosixMode
-            ? await preparePinnedWriteMode(handle, Number(tempIdentity.mode & 4095n), assertBeforeMutation)
+            ? await preparePinnedWriteMode(handle, Number(tempIdentity.mode & 4095n), assertBeforeMutation, params.private)
             : assertBeforeMutation;
         if (verifyPosixMode)
-            assertPinnedWriteMode(handle.fd, 0o600);
+            assertPinnedWriteMode(handle.fd, 0o600, params.private);
         await writePinnedInput(handle, params.input, params.maxBytes, assertBeforeWrite);
         if (verifyPosixMode)
-            assertPinnedWriteMode(handle.fd, 0o600);
-        if (params.private)
-            assertDarwinCreationAcl(handle.fd);
+            assertPinnedWriteMode(handle.fd, 0o600, params.private);
         tempStat = fsSync.fstatSync(handle.fd);
         const tempPathStat = fsSync.lstatSync(tempPath);
         if (tempPathStat.isSymbolicLink() || !sameFileIdentity(tempPathStat, tempStat)) {
@@ -69,8 +66,8 @@ export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
         const expectedTempStat = tempStat;
         await handle.chmod(params.mode);
         if (verifyPosixMode) {
-            assertPinnedWriteMode(handle.fd, params.mode);
-            assertBeforeMutation = pinnedWriteModeAssertion(handle.fd, params.mode, assertBeforeMutation);
+            assertPinnedWriteMode(handle.fd, params.mode, params.private);
+            assertBeforeMutation = pinnedWriteModeAssertion(handle.fd, params.mode, params.assertBeforeMutation, params.private);
         }
         if (params.sync !== false) {
             if (params.strictFileSync)
@@ -146,6 +143,8 @@ export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
             }
         });
         await params.verifyPublished?.((readHandle ?? handle).fd, verificationIdentity, parentGuard);
+        if (verifyPosixMode)
+            assertPinnedWriteMode((readHandle ?? handle).fd, params.mode, params.private);
         return { dev: verifiedIdentity.dev, ino: verifiedIdentity.ino };
     }
     catch (error) {

package/dist/pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAgB3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACvF,YAAY,EACV,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAC9D,8BAA8B,EAAE,gCAAgC,EAChE,6BAA6B,EAAE,+BAA+B,EAC9D,4BAA4B,EAAE,iBAAiB,GAChD,MAAM,yBAAyB,CAAC;AAkDjC,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsD/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAED,wBAAsB,iCAAiC,CAAC,CAAC,EACvD,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5E,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAiBZ"}
+{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAgB3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACvF,YAAY,EACV,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAC9D,8BAA8B,EAAE,gCAAgC,EAChE,6BAA6B,EAAE,+BAA+B,EAC9D,4BAA4B,EAAE,iBAAiB,GAChD,MAAM,yBAAyB,CAAC;AAkDjC,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsD/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAED,wBAAsB,iCAAiC,CAAC,CAAC,EACvD,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,EAC5E,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAiBZ"}

package/dist/pinned-write.js

@@ -1,5 +1,4 @@
 import { syncFileBestEffort } from "./file-sync.js";
-import { assertDarwinCreationAcl, privateFileMutationAssertion } from "./creation-darwin.js";
 import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -124,7 +123,8 @@ export async function withPinnedWriteRenameIdentityLock(params, run) {
     }, run);
 }
 async function runPinnedWriteFallback(params) {
-    const verifyPosixMode = params.verifyPosixMode === true && process.platform !== "win32";
+    const verifyPosixMode = process.platform !== "win32" &&
+        (params.verifyPosixMode === true || params.private === true);
     const exactRoot = typeof params.rootIdentity?.dev === "bigint" && typeof params.rootIdentity.ino === "bigint"
         ? { dev: params.rootIdentity.dev, ino: params.rootIdentity.ino } : undefined;
     const mutationAdmission = params.mutationAdmission;
@@ -250,25 +250,23 @@ async function runPinnedWriteFallback(params) {
             },
         });
         let created = true;
+        let completed = false;
         let createdIdentity;
         try {
             const verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
             createdIdentity = verificationIdentity;
-            let assertBeforeWrite = params.private
-                ? privateFileMutationAssertion(handle.fd, assertBeforeMutation) : assertBeforeMutation;
-            if (verifyPosixMode) {
-                assertBeforeWrite = await preparePinnedWriteMode(handle, Number(createdIdentity.mode & 4095n), assertBeforeWrite);
-                assertPinnedWriteMode(handle.fd, 0o600);
-            }
+            const assertBeforeWrite = verifyPosixMode
+                ? await preparePinnedWriteMode(handle, Number(createdIdentity.mode & 4095n), assertBeforeMutation, params.private)
+                : assertBeforeMutation;
+            if (verifyPosixMode)
+                assertPinnedWriteMode(handle.fd, 0o600, params.private);
             await writePinnedInput(handle, params.input, params.maxBytes, assertBeforeWrite);
             if (verifyPosixMode)
-                assertPinnedWriteMode(handle.fd, 0o600);
-            if (params.private)
-                assertDarwinCreationAcl(handle.fd);
+                assertPinnedWriteMode(handle.fd, 0o600, params.private);
             // Content writes may clear set-ID bits; finalize them through the owned fd.
             await handle.chmod(params.mode);
             if (verifyPosixMode)
-                assertPinnedWriteMode(handle.fd, params.mode);
+                assertPinnedWriteMode(handle.fd, params.mode, params.private);
             if (params.sync !== false) {
                 if (params.strictFileSync)
                     await handle.sync();
@@ -281,6 +279,9 @@ async function runPinnedWriteFallback(params) {
             // Publication is complete. A failed outer check must not remove its target.
             created = false;
             await params.verifyPublished?.(handle.fd, verificationIdentity, parentGuard);
+            if (verifyPosixMode)
+                assertPinnedWriteMode(handle.fd, params.mode, params.private);
+            completed = true;
             return { dev: stat.dev, ino: stat.ino };
         }
         finally {
@@ -290,7 +291,10 @@ async function runPinnedWriteFallback(params) {
                 }
             }
             finally {
-                await handle.close().catch(() => undefined);
+                if (completed)
+                    await handle.close();
+                else
+                    await handle.close().catch(() => undefined);
             }
         }
     }