@openclaw/fs-safe 0.16.0 → 0.18.0

package/dist/root-remove.js

@@ -220,13 +220,21 @@ async function removeOne(root, targetPath, options, receipts) {
         throw normalizeRemoveGuardError(error);
     }
     try {
-        const isDirectory = fsSync.lstatSync(targetPath).isDirectory();
+        const identity = options.assertBeforeMutation
+            ? inspectFileIdentitySync(() => fsSync.lstatSync(targetPath, { bigint: true })) : undefined;
+        const isDirectory = (identity ?? fsSync.lstatSync(targetPath)).isDirectory();
         if (!isDirectory && options[nonrecursiveRemovalKind] === "directory") {
             throw new FsSafeError("path-mismatch", "store entry is no longer a directory");
         }
         assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
         assertNotAborted(options.signal);
         options.assertBeforeMutation?.();
+        if (identity) {
+            assertNotAborted(options.signal);
+            admission.assertCurrent();
+            inspectFileIdentitySync(() => fsSync.lstatSync(targetPath, { bigint: true }), identity);
+            assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
+        }
         await (isDirectory ? fs.rmdir(targetPath) : fs.unlink(targetPath));
     }
     catch (error) {
@@ -436,6 +444,12 @@ export async function removePathInRootFallback(root, targetPath, options, receip
         assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
         assertNotAborted(options.signal);
         options.assertBeforeMutation?.();
+        if (options.assertBeforeMutation) {
+            assertNotAborted(options.signal);
+            if (!inspect(target, initial))
+                return;
+            assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
+        }
         try {
             await (initial.isDirectory() ? fs.rmdir(target) : fs.unlink(target));
         }

package/dist/root-symlink-policy.d.ts

@@ -11,4 +11,3 @@ export declare function mutationSymlinkResolution(symlinks: MutationSymlinkPolic
     resolveCanonical: boolean;
 };
 export declare function assertFinalSymlinkRejected(targetPath: string, reject: boolean | undefined, details?: FsSafeErrorDetails): void;
-//# sourceMappingURL=root-symlink-policy.d.ts.map

package/dist/root-walk.d.ts

@@ -39,4 +39,3 @@ type RootWalkCapability = {
 };
 export declare function walkRoot(root: RootWalkCapability, relativePath: string, options: RootWalkOptions): AsyncGenerator<RootWalkEntry>;
 export {};
-//# sourceMappingURL=root-walk.d.ts.map

package/dist/root-write-admission.d.ts

@@ -63,4 +63,3 @@ export declare function resolveGuardedWritePathInRoot(root: RootContext, params:
 export declare function resolveGuardedWriteTargetInRoot(root: RootContext, params: GuardedWritePathOptions): Promise<GuardedRootWriteTarget>;
 export declare function resolvePinnedWriteTargetInRoot(root: RootContext, relativePath: string, requestedMode?: number, denyMutations?: DenyMutationPolicy, overwrite?: boolean, mutationSymlinks?: MutationSymlinkPolicy): Promise<PinnedWriteTarget>;
 export {};
-//# sourceMappingURL=root-write-admission.d.ts.map

package/dist/root-write-compatibility.d.ts

@@ -9,4 +9,3 @@ export declare function withRootFallbackCompatibilityLock<T>(params: {
     relativePath: string;
     assertBeforeMutation: () => void;
 }) => Promise<T>): Promise<T>;
-//# sourceMappingURL=root-write-compatibility.d.ts.map

package/dist/root-write-complete-parent.d.ts

@@ -39,4 +39,3 @@ export type SharedRootWriteTarget = Readonly<{
 export declare function assertPreparedRootWriteParentCurrent(prepared: PreparedRootWriteParent, verifyTarget?: boolean): void;
 export declare function prepareSharedRootWriteTarget(root: RootContext, params: SharedRootWriteTargetParams): Promise<SharedRootWriteTarget>;
 export {};
-//# sourceMappingURL=root-write-complete-parent.d.ts.map

package/dist/root-write-lock-binding.d.ts

@@ -12,4 +12,3 @@ export declare function createRootWriteLockBinding(params: Readonly<{
     assertCurrent: () => void;
     dispose(): void;
 }>;
-//# sourceMappingURL=root-write-lock-binding.d.ts.map

package/dist/root-write-mode.d.ts

@@ -5,4 +5,3 @@ export declare function inheritWriteTargetMode(params: {
     rootIdentity?: RootBoundaryIdentity;
     requestedMode?: number;
 }): Promise<number>;
-//# sourceMappingURL=root-write-mode.d.ts.map

package/dist/root-write-publication.d.ts

@@ -21,4 +21,3 @@ export declare function finishRootFallbackWrite(params: {
     }>;
     onVerificationFailure: (error: unknown) => void;
 }): Promise<void>;
-//# sourceMappingURL=root-write-publication.d.ts.map

package/dist/root-write-verification.d.ts

@@ -9,4 +9,3 @@ export declare function verifyAtomicWriteResult(params: {
     expectedMode?: number;
     parentGuard: AnyAsyncDirectoryGuard;
 }): Promise<void>;
-//# sourceMappingURL=root-write-verification.d.ts.map

package/dist/root.d.ts

@@ -4,4 +4,3 @@ export type { CopyCloneMode } from "./copy-policy.js";
 export type { RootEntriesOptions } from "./root-entries.js";
 export type { ContainmentGuarantee } from "./containment.js";
 export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";
-//# sourceMappingURL=root.d.ts.map

package/dist/safe-path-segment.d.ts

@@ -7,6 +7,5 @@ export declare function assertNoDriveRelativePathSegments(value: string, label:
 export declare function trimHyphenEdges(value: string): string;
 export declare function isSafePathSegment(segment: string, options?: SafePathSegmentOptions): boolean;
 export declare function assertSafePathSegment(segment: string, options?: SafePathSegmentOptions): string;
-export declare function sanitizeSafePathSegment(value: string, fallback: string, options?: SafePathSegmentOptions): string;
+export declare function sanitizeSafePathSegment(value: string): string | undefined;
 export declare function assertSafePathPrefix(prefix: string, options?: SafePathSegmentOptions): string;
-//# sourceMappingURL=safe-path-segment.d.ts.map

package/dist/safe-path-segment.js

@@ -47,17 +47,14 @@ export function assertSafePathSegment(segment, options = {}) {
     }
     return segment;
 }
-export function sanitizeSafePathSegment(value, fallback, options = {}) {
+export function sanitizeSafePathSegment(value) {
     const sanitized = value
         .trim()
         .replace(/[\\/]+/g, "-")
         .replace(/\0/g, "")
         .replace(/[^A-Za-z0-9._-]+/g, "-");
     const trimmed = trimHyphenEdges(sanitized);
-    if (isSafePathSegment(trimmed, options)) {
-        return trimmed;
-    }
-    return assertSafePathSegment(fallback, { ...options, label: "fallback path segment" });
+    return isSafePathSegment(trimmed, { allowDotPrefix: true }) ? trimmed : undefined;
 }
 export function assertSafePathPrefix(prefix, options = {}) {
     // Prefixes are often derived from safe filenames. Normalize harmless

package/dist/secret-file.d.ts

@@ -23,4 +23,3 @@ export declare function prepareSecretFileWrite(params: Omit<SecretFileWriteParam
 export declare function writeSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
 export declare function createSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
 export {};
-//# sourceMappingURL=secret-file.d.ts.map

package/dist/secret-file.js

@@ -31,29 +31,19 @@ export function readSecretFileSync(filePath, label, options = {}) {
     }
     let raw;
     try {
-        const openedIdentity = inspectFileIdentitySync(() => {
-            const stat = fs.fstatSync(opened.fd, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, previewStat);
-        inspectFileIdentitySync(() => {
-            const stat = fs.lstatSync(opened.path, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, openedIdentity);
+        // The pin already compared the descriptor and resolved name without yielding.
+        const openedIdentity = inspectFileIdentitySync(() => opened.identity, previewStat);
         inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedIdentity);
         raw = readFileDescriptorBoundedSync(opened.fd, maxBytes).toString("utf8");
     }
     catch (error) {
+        try {
+            fs.closeSync(opened.fd);
+        }
+        catch { /* Preserve the read failure. */ }
         throw secretReadError(error instanceof FsSafeError ? error.code : "read-failed", "read", label, resolvedPath, error);
     }
-    finally {
-        fs.closeSync(opened.fd);
-    }
+    fs.closeSync(opened.fd);
     return trimSecretFileContent(raw, label, resolvedPath);
 }
 export function tryReadSecretFileSync(filePath, label, options = {}) {

package/dist/secret-read-async.d.ts

@@ -1,4 +1,3 @@
 import { type SecretFileReadOptions } from "./secret-read-policy.js";
 export declare function readSecretFile(filePath: string, label: string, options?: SecretFileReadOptions): Promise<string>;
 export declare function tryReadSecretFile(filePath: string | undefined, label: string, options?: SecretFileReadOptions): Promise<string | undefined>;
-//# sourceMappingURL=secret-read-async.d.ts.map

package/dist/secret-read-async.js

@@ -5,11 +5,11 @@ import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { prepareSecretRead, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function readSecretFile(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
+    const { resolvedPath, maxBytes, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     let handle;
     let raw;
     try {
@@ -18,20 +18,20 @@ export async function readSecretFile(filePath, label, options = {}) {
         assertNoUnsafeDeviceReadPath(realPath);
         handle = await fs.open(realPath, resolveReadOpenFlags());
         const openedHandle = handle;
-        const openedStat = await inspectFileIdentity(async () => {
+        const openedStat = inspectFileIdentitySync(() => {
             const stat = fsSync.fstatSync(openedHandle.fd, { bigint: true });
             if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
         }, previewStat);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const stat = fsSync.lstatSync(realPath, { bigint: true });
             if (!stat.isFile())
                 throw new FsSafeError("path-mismatch", "security validation failed");
             return stat;
         }, openedStat);
-        await inspectFileIdentity(() => inspectInput("secret path became a symlink"), openedStat);
+        inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedStat);
         raw = (await readFileHandleBounded(handle, maxBytes)).toString("utf8");
     }
     catch (error) {

package/dist/secret-read-policy.d.ts

@@ -18,4 +18,3 @@ export declare function prepareSecretRead(filePath: string, label: string, optio
     previewStat: BigIntStats;
     inspectInput: (symlinkMessage: string) => BigIntStats;
 };
-//# sourceMappingURL=secret-read-policy.d.ts.map

package/dist/secret.d.ts

@@ -1,4 +1,3 @@
 export { createSecretFileAtomic, PRIVATE_SECRET_DIR_MODE, PRIVATE_SECRET_FILE_MODE, readSecretFileSync, tryReadSecretFileSync, writeSecretFileAtomic, } from "./secret-file.js";
 export { DEFAULT_SECRET_FILE_MAX_BYTES, type SecretFileReadOptions } from "./secret-read-policy.js";
 export { readSecretFile, tryReadSecretFile } from "./secret-read-async.js";
-//# sourceMappingURL=secret.d.ts.map

package/dist/secure-file-windows.d.ts

@@ -1,11 +1,6 @@
 import type { BigIntStats, Stats } from "node:fs";
 import type { PermissionCheck } from "./permissions.js";
 type ExactIdentity = Pick<BigIntStats, "dev" | "ino">;
-export declare function inspectSecureWindowsDescriptor(params: {
-    fd: number;
-    identity: ExactIdentity;
-    stat: Stats;
-}): PermissionCheck;
 /** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
 export declare function inspectSecureWindowsFile(params: {
     fd: number;
@@ -13,4 +8,3 @@ export declare function inspectSecureWindowsFile(params: {
     stat: Stats;
 }): Promise<PermissionCheck>;
 export {};
-//# sourceMappingURL=secure-file-windows.d.ts.map

package/dist/secure-file-windows.js

@@ -29,27 +29,6 @@ function parseIdentity(value) {
         ino: BigInt(`0x${match[2]}`),
     };
 }
-export function inspectSecureWindowsDescriptor(params) {
-    let native;
-    try {
-        native = getNativeBinding();
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
-    }
-    const inspect = native?.inspectWindowsSecureFileHandle;
-    if (typeof inspect !== "function") {
-        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
-    }
-    let result;
-    try {
-        result = inspect.call(native, params.fd);
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification failed", cause);
-    }
-    return inspectDescriptorResult(params, result, "native");
-}
 function inspectDescriptorResult(params, result, mechanism) {
     if (!isRecord(result))
         permissionUnverified("Windows descriptor ACL facts were malformed");
@@ -85,19 +64,25 @@ export async function inspectSecureWindowsFile(params) {
     catch (cause) {
         permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
     }
-    if (typeof native?.inspectWindowsSecureFileHandle === "function") {
-        return inspectSecureWindowsDescriptor(params);
-    }
-    if (getFsSafeNativeConfig().mode === "require") {
+    const inspect = native?.inspectWindowsSecureFileHandle;
+    const nativeAvailable = typeof inspect === "function";
+    if (!nativeAvailable && getFsSafeNativeConfig().mode === "require") {
         permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
     }
-    warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+    if (!nativeAvailable) {
+        warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+    }
     let result;
     try {
-        result = await inspectWindowsDescriptorCommand(params.fd);
+        if (nativeAvailable) {
+            result = inspect.call(native, params.fd);
+        }
+        else {
+            result = await inspectWindowsDescriptorCommand(params.fd);
+        }
     }
     catch (cause) {
         permissionUnverified("Windows descriptor ACL verification failed", cause);
     }
-    return inspectDescriptorResult(params, result, "system-command");
+    return inspectDescriptorResult(params, result, nativeAvailable ? "native" : "system-command");
 }

package/dist/secure-file.d.ts

@@ -29,4 +29,3 @@ export type SecureFileReadResult = {
     permissions?: PermissionCheck;
 };
 export declare function readSecureFile(options: SecureFileReadOptions): Promise<SecureFileReadResult>;
-//# sourceMappingURL=secure-file.d.ts.map

package/dist/secure-file.js

@@ -12,7 +12,7 @@ import { formatPermissionErrorDetail } from "./permission-exec.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, } from "./permissions.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { inspectSecureWindowsFile } from "./secure-file-windows.js";
 import { scheduleTimeout } from "./timing.js";
 import { anchorWindowsDriveRelativePath, assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
@@ -139,9 +139,9 @@ async function openSecureHandle(options, maxBytes) {
         if (!openedStat.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must be a file: ${options.filePath}`);
         }
-        const openedIdentity = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }));
+        const openedIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(handle.fd, { bigint: true }));
         assertNotHardlinked(options, openedIdentity);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const pathStat = options.trust?.allowSymlink
                 ? fsSync.statSync(options.filePath, { bigint: true })
                 : fsSync.lstatSync(options.filePath, { bigint: true });
@@ -153,7 +153,7 @@ async function openSecureHandle(options, maxBytes) {
         }, openedIdentity);
         const realPath = realpathSync.native(options.filePath);
         assertNoWindowsPathAlias(realPath, "filesystem", `${label(options)} resolved path uses a Windows filesystem namespace alias`);
-        await inspectFileIdentity(() => {
+        inspectFileIdentitySync(() => {
             const realPathStat = fsSync.statSync(realPath, { bigint: true });
             assertNotHardlinked(options, realPathStat);
             return realPathStat;
@@ -168,11 +168,11 @@ async function openSecureHandle(options, maxBytes) {
         throw err;
     }
 }
-async function assertTrustedDirs(options, realPath) {
+function assertTrustedDirs(options, realPath) {
     if (!options.trust?.trustedDirs || options.trust.trustedDirs.length === 0) {
         return;
     }
-    const trusted = await Promise.all(options.trust.trustedDirs.map(async (dir) => {
+    const trusted = options.trust.trustedDirs.map((dir) => {
         let realPath;
         try {
             realPath = realpathSync.native(dir);
@@ -182,7 +182,7 @@ async function assertTrustedDirs(options, realPath) {
         }
         assertNoWindowsPathAlias(realPath, "filesystem", "trusted directory uses a Windows filesystem namespace alias");
         return realPath;
-    }));
+    });
     if (!trusted.some((dir) => isPathInside(dir, realPath))) {
         throw new FsSafeError("outside-workspace", `${label(options)} is outside trustedDirs: ${realPath}`);
     }
@@ -281,10 +281,10 @@ export async function readSecureFile(options) {
     assertNoWindowsPathAlias(options.filePath, "filesystem", `${label(options)} path uses a Windows filesystem namespace alias`);
     const opened = await openSecureHandle(options, maxBytes);
     try {
-        await assertTrustedDirs(options, opened.realPath);
+        assertTrustedDirs(options, opened.realPath);
         const permissions = await assertSecurePermissions(options, opened.pathStat, opened.realPath, opened.identity, opened.handle.fd);
         const buffer = await readHandleWithTimeout(opened.handle, options.io?.timeoutMs, maxBytes);
-        const finalIdentity = await inspectFileIdentity(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
+        const finalIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
         if (!finalIdentity.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must remain a file: ${options.filePath}`);
         }

package/dist/secure-temp-dir.d.ts

@@ -27,4 +27,3 @@ export type ResolveSecureTempRootOptions = {
     warningPrefix?: string;
 };
 export declare function resolveSecureTempRoot(options: ResolveSecureTempRootOptions): string;
-//# sourceMappingURL=secure-temp-dir.d.ts.map

package/dist/secure-temp-repair.d.ts

@@ -32,4 +32,3 @@ export declare function secureTempDirectoryReceipt(stat: ExactDirectoryStat, uid
 /** No pathname chmod, search-only descriptors, procfs, or reopening fallback. */
 export declare function repairSecureTempDirectory(candidate: string, expected: SecureTempDirectoryReceipt, uid: number, adapter: SecureTempRepairAdapter, access: () => void, repaired: () => void, finalize?: boolean): void;
 export {};
-//# sourceMappingURL=secure-temp-repair.d.ts.map

package/dist/sibling-staged-file.d.ts

@@ -15,4 +15,3 @@ export declare function writeCallbackSibling<T>(params: {
     filePath: string;
     result: T;
 }>;
-//# sourceMappingURL=sibling-staged-file.d.ts.map

package/dist/sibling-staged-file.js

@@ -2,7 +2,7 @@ import { syncFileBestEffort } from "./file-sync.js";
 import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import path from "node:path";
-import { assertAsyncDirectoryGuard, assertDirectoryIdentitySync, createAsyncDirectoryGuard, } from "./directory-guard.js";
+import { assertDirectoryIdentitySync, createAsyncDirectoryGuard, } from "./directory-guard.js";
 import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { isWindowsReservedDeviceName } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
@@ -10,7 +10,7 @@ import { getNativeBinding } from "./native.js";
 import { handoffPrivateProducerFile, } from "./private-producer-handoff.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { rootFromDirectoryGuard } from "./root-impl.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { createOwnedTempFile } from "./temp-target.js";
 import { serializePathWrite } from "./write-queue.js";
@@ -52,8 +52,8 @@ function assertRegularFile(stat) {
         throw new FsSafeError("hardlink", "sibling temp must have exactly one link");
     }
 }
-async function inspectStage(inspect, expected) {
-    return await inspectFileIdentity(async () => {
+function inspectStage(inspect, expected) {
+    return inspectFileIdentitySync(() => {
         const stat = inspect();
         assertRegularFile(stat);
         return stat;
@@ -67,12 +67,7 @@ function aggregateErrors(errors, message) {
 // Own the workspace before the producer can leave partial output. The finished
 // file still enters the ordinary sibling admission and publication lifecycle.
 async function writeIsolatedProducer(params) {
-    const tempPath = params.tempPath;
-    const write = params.write;
-    const writeReceiver = params.writeReceiver;
-    const parentGuard = params.parentGuard;
-    const assertParent = params.assertParent;
-    const syncTempFile = params.syncTempFile;
+    const { tempPath, write, writeReceiver, parentGuard, assertParent, syncTempFile } = params;
     assertParent();
     const targetRoot = rootFromDirectoryGuard(parentGuard);
     // Select the handoff before invoking the producer. Missing required native
@@ -150,7 +145,9 @@ export async function writeCallbackSibling(params) {
     const syncTempFile = params.syncTempFile;
     const syncParentDir = params.syncParentDir;
     const guard = await createAsyncDirectoryGuard(parent, { bigint: true });
-    const assertParent = () => assertAsyncDirectoryGuard(guard);
+    const assertParent = () => assertDirectoryIdentitySync(parent, {
+        dev: guard.stat.dev, ino: guard.stat.ino, realPath: guard.realPath,
+    });
     let handle;
     let identity;
     let unregister;
@@ -158,10 +155,10 @@ export async function writeCallbackSibling(params) {
     let renamed = false;
     let failure;
     const inspectPath = (pathname, expected) => inspectStage(() => fsSync.lstatSync(pathname, { bigint: true }), expected);
-    const assertCurrent = async (pathname) => {
-        await assertParent();
-        const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-        const current = await inspectPath(pathname, opened);
+    const assertCurrent = (pathname) => {
+        assertParent();
+        const opened = inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
+        const current = inspectPath(pathname, opened);
         if (maxBytes !== undefined &&
             (opened.size > maxBytes || current.size > maxBytes)) {
             throw new FsSafeError("too-large", `sibling temp exceeds maxBytes (${maxBytes})`);
@@ -176,11 +173,7 @@ export async function writeCallbackSibling(params) {
                 writeReceiver: params,
                 parentGuard: guard,
                 syncTempFile: syncTempFile,
-                assertParent: () => assertDirectoryIdentitySync(parent, {
-                    dev: guard.stat.dev,
-                    ino: guard.stat.ino,
-                    realPath: guard.realPath,
-                }),
+                assertParent,
             });
             result = isolated.result;
             cleanupWorkspace = isolated.cleanupWorkspace;
@@ -193,13 +186,10 @@ export async function writeCallbackSibling(params) {
         else {
             result = await Reflect.apply(write, params, [tempPath]);
         }
-        await assertParent();
-        if (handle) {
-            const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-            await inspectPath(tempPath, opened);
-        }
-        else {
-            const before = await inspectPath(tempPath);
+        assertParent();
+        let expected = identity;
+        if (!handle) {
+            expected = inspectPath(tempPath);
             try {
                 // No create/truncate flags; O_NONBLOCK also bounds a FIFO swap during open.
                 const access = syncTempFile ? fsSync.constants.O_RDWR : fsSync.constants.O_RDONLY;
@@ -211,12 +201,14 @@ export async function writeCallbackSibling(params) {
                 }
                 throw error;
             }
-            const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), before);
-            await inspectPath(tempPath, opened);
+        }
+        const opened = inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), expected);
+        inspectPath(tempPath, opened);
+        if (!identity) {
             identity = opened;
             unregister = registerTempPathForExit(tempPath, { identity, singleLinkFile: true });
         }
-        await assertParent();
+        assertParent();
         if (cleanupWorkspace) {
             const cleanup = cleanupWorkspace;
             cleanupWorkspace = undefined;
@@ -233,7 +225,7 @@ export async function writeCallbackSibling(params) {
             throw new FsSafeError("invalid-path", "final path must differ from the sibling temp path");
         }
         await serializePathWrite(filePath, async () => {
-            await assertCurrent(tempPath);
+            assertCurrent(tempPath);
             if (mode !== undefined) {
                 try {
                     await handle.chmod(mode);
@@ -242,20 +234,21 @@ export async function writeCallbackSibling(params) {
                     if (!ignoreModeError)
                         throw error;
                 }
+                assertCurrent(tempPath);
             }
             if (syncTempFile) {
-                await assertCurrent(tempPath);
                 await syncFileBestEffort(handle);
+                assertCurrent(tempPath);
             }
-            await assertCurrent(tempPath);
             await fs.rename(tempPath, filePath);
             // A later verification failure never authorizes rollback of the final name.
             renamed = true;
             unregister();
-            await assertCurrent(filePath);
-            if (syncParentDir)
+            assertCurrent(filePath);
+            if (syncParentDir) {
                 await syncDirectoryBestEffort(parent);
-            await assertCurrent(filePath);
+                assertCurrent(filePath);
+            }
         });
         return { filePath, result };
     }
@@ -276,9 +269,9 @@ export async function writeCallbackSibling(params) {
         try {
             if (!renamed && identity) {
                 try {
-                    await assertParent();
-                    await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-                    await inspectPath(tempPath, identity);
+                    assertParent();
+                    inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
+                    inspectPath(tempPath, identity);
                     await fs.unlink(tempPath);
                     unregister?.();
                 }

package/dist/sibling-temp.d.ts

@@ -26,4 +26,3 @@ export declare function writeViaSiblingTempPath(params: {
     fallbackFileName?: string;
     tempPrefix?: string;
 }): Promise<void>;
-//# sourceMappingURL=sibling-temp.d.ts.map

package/dist/sidecar-lock-acquire.d.ts

@@ -1,5 +1,4 @@
 import type { SidecarLockAcquireOptions, SidecarLockHandle } from "./sidecar-lock-types.js";
-import { type SidecarLockAcquisitionContext } from "./sidecar-lock-admission.js";
+import type { SidecarLockAcquisitionContext } from "./sidecar-lock-admission.js";
 export type { HeldSidecarLock } from "./sidecar-lock-admission.js";
 export declare function acquireSidecarLock<TPayload extends Record<string, unknown>>(options: SidecarLockAcquireOptions<TPayload>, context: SidecarLockAcquisitionContext): Promise<SidecarLockHandle>;
-//# sourceMappingURL=sidecar-lock-acquire.d.ts.map