@openclaw/fs-safe 0.18.1 → 0.18.2

package/dist/secret-file.js

@@ -5,8 +5,7 @@ import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
 import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
-import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
-import { assertOwnedDirectory } from "./directory-mode-owner.js";
+import { pinNodeDirectoryForMode, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
 import { openPinnedFileSync } from "./pinned-open.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
@@ -199,7 +198,11 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
     }
     return { rootGuard, parentGuard: targetGuard };
 }
-function snapshotSecretFileWriteParams(params, rootDir, filePath) {
+function snapshotSecretFileWriteParams(params) {
+    const rootDir = params.rootDir;
+    const filePath = params.filePath;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     return {
         rootDir,
         filePath,
@@ -305,31 +308,23 @@ async function materializeSecretFileAtomic(params, createOnly) {
     });
 }
 export async function writeSecretFileAtomic(params) {
-    const rootDir = params.rootDir;
-    const filePath = params.filePath;
-    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
-    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
-    const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
-    const canonicalPath = await secretFileWriteQueueKey(filePath);
+    const ownedParams = snapshotSecretFileWriteParams(params);
+    const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
     await serializePathWrite(canonicalPath, async () => {
         await materializeSecretFileAtomic(ownedParams, false);
     });
 }
 export async function createSecretFileAtomic(params) {
     try {
-        const rootDir = params.rootDir;
-        const filePath = params.filePath;
-        assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
-        assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
-        const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
-        const canonicalPath = await secretFileWriteQueueKey(filePath);
+        const ownedParams = snapshotSecretFileWriteParams(params);
+        const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
         await serializePathWrite(canonicalPath, async () => {
             await materializeSecretFileAtomic(ownedParams, true);
         });
     }
     catch (error) {
         if ((error instanceof FsSafeError && error.code === "already-exists") ||
-            error.code === "EEXIST") {
+            error?.code === "EEXIST") {
             throw new FsSafeError("secret-exists", "Private secret file already exists.", { cause: error });
         }
         throw error;

package/dist/secret-read-policy.js

@@ -7,7 +7,7 @@ import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
-    const code = error.code;
+    const code = error?.code;
     return code === "ENOENT" || code === "ENOTDIR" ? "not-found" : "invalid-path";
 }
 export function secretReadError(code, action, label, resolvedPath, error) {

package/dist/secure-file-windows.js

@@ -1,5 +1,5 @@
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
+import { fileIdentityMismatchError } from "./strict-file-identity.js";
 import { getNativeBinding } from "./native.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
 import { warnNativeFallback } from "./native-fallback-warning.js";
@@ -10,20 +10,15 @@ const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators
 function permissionUnverified(message, cause) {
     throw new FsSafeError("permission-unverified", message, cause === undefined ? {} : { cause });
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
 function parseIdentity(value) {
     if (typeof value !== "string")
-        identityMismatch();
+        throw fileIdentityMismatchError();
     const match = IDENTITY_RE.exec(value);
     if (!match)
-        identityMismatch();
+        throw fileIdentityMismatchError();
     return {
         dev: BigInt(`0x${match[1]}`),
         ino: BigInt(`0x${match[2]}`),
@@ -34,7 +29,7 @@ function inspectDescriptorResult(params, result, mechanism) {
         permissionUnverified("Windows descriptor ACL facts were malformed");
     const observed = parseIdentity(result.identity);
     if (observed.dev !== params.identity.dev || observed.ino !== params.identity.ino) {
-        identityMismatch();
+        throw fileIdentityMismatchError();
     }
     const facts = validateSecureWindowsSecurityFacts(result.security);
     return {

package/dist/secure-temp-dir.js

@@ -3,15 +3,10 @@ import { tmpdir as getOsTmpDir } from "node:os";
 import path from "node:path";
 import { directoryEntryPath } from "./directory-entry-path.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { hasNodeErrorCode } from "./path.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
 import { captureSecureTempRepairAdapter, repairSecureTempDirectory, secureTempDirectoryReceipt, } from "./secure-temp-repair.js";
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 export function resolveSecureTempRoot(options) {
     const { fallbackPrefix: prefix, accessSync: suppliedAccess, lstatSync: suppliedLstat, mkdirSync: suppliedMkdir, descriptor: suppliedDescriptor, getuid: suppliedGetuid, tmpdir: suppliedTmpdir, platform: suppliedPlatform, preferredDir, skipPreferredOnWindows, warn: suppliedWarn, warningPrefix: suppliedWarningPrefix, unsafeFallbackLabel: suppliedFallbackLabel, } = options;
     const platform = suppliedPlatform ?? process.platform;
@@ -87,7 +82,7 @@ export function resolveSecureTempRoot(options) {
             candidate = lstatSync(candidatePath);
         }
         catch (error) {
-            return { kind: isNodeErrorWithCode(error, "ENOENT") ? "missing" : "invalid", error };
+            return { kind: hasNodeErrorCode(error, "ENOENT") ? "missing" : "invalid", error };
         }
         let receipt;
         try {

package/dist/sidecar-lock-acquire.js

@@ -102,7 +102,7 @@ export async function acquireSidecarLock(options, context) {
             await waitForRetry();
         }
         catch (waitError) {
-            if (waitError.code === "file_lock_timeout")
+            if (waitError?.code === "file_lock_timeout")
                 throw denial;
             throw waitError;
         }

package/dist/sidecar-lock-reclaim.js

@@ -357,13 +357,12 @@ export async function removeStaleSidecarLockIfAllowed(params) {
     if (params.assertGuardHeld)
         await params.assertGuardHeld();
     params.assertAuthorized?.();
+    if (params.lockRoot) {
+        await params.lockRoot.remove(relativeSidecarLockPath(params.lockRoot, params.lockPath), { assertBeforeMutation: params.assertAuthorized });
+        return "removed";
+    }
     try {
-        if (params.lockRoot) {
-            await params.lockRoot.remove(relativeSidecarLockPath(params.lockRoot, params.lockPath), { assertBeforeMutation: params.assertAuthorized });
-        }
-        else {
-            await fs.rm(params.lockPath);
-        }
+        await fs.rm(params.lockPath);
         return "removed";
     }
     catch (err) {

package/dist/stat-observation.js

@@ -1,11 +1,4 @@
-import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 function safeNumber(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
@@ -35,7 +28,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
     const ino = numericIno ? BigInt(rawIno) : typeof rawIno === "bigint" ? rawIno : undefined;
     if (expected && ((dev !== undefined && dev !== expected.dev) ||
         (ino !== undefined && ino !== expected.ino)))
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (numericDev && numericIno) {
         return (captureIdentity
             ? { stat, identity: expected ?? { dev: dev, ino: ino } }
@@ -47,7 +40,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
         const current = inspect(true);
         if ((dev !== undefined && current.dev !== dev) ||
             (ino !== undefined && current.ino !== ino))
-            identityMismatch();
+            throw fileIdentityMismatchError();
         return current;
     }, expected, platform);
     return (captureIdentity

package/dist/strict-file-identity.d.ts

@@ -1,5 +1,7 @@
 import type { BigIntStats } from "node:fs";
+import { FsSafeError } from "./errors.js";
 type ExactFileIdentity = Pick<BigIntStats, "dev" | "ino">;
+export declare function fileIdentityMismatchError(): FsSafeError;
 export declare function inspectFileIdentity<T extends ExactFileIdentity>(inspect: () => T | Promise<T>, expected?: ExactFileIdentity, platform?: NodeJS.Platform): Promise<T>;
 export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform, mismatch?: () => Error): T;
 export {};

package/dist/strict-file-identity.js

@@ -1,6 +1,6 @@
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
-function identityMismatch() {
+export function fileIdentityMismatchError() {
     const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
     recordFileObservationFailure(error, "identity");
     return error;
@@ -13,20 +13,20 @@ function identityCheck(expected, platform) {
             const value = stat[field];
             // Numeric receipts cannot recover identity bits already lost to rounding.
             if (typeof value !== "bigint")
-                throw identityMismatch();
+                throw fileIdentityMismatchError();
             if (platform === "win32" && value === 0n) {
                 complete = false;
             }
             else {
                 if (known[field] !== undefined && known[field] !== value)
-                    throw identityMismatch();
+                    throw fileIdentityMismatchError();
                 known[field] = value;
             }
         }
         return complete;
     };
     if (expected && !check(expected))
-        throw identityMismatch();
+        throw fileIdentityMismatchError();
     return check;
 }
 // Retry only unknown Windows identities, retaining every known component so a
@@ -38,9 +38,9 @@ export async function inspectFileIdentity(inspect, expected, platform = process.
         if (check(stat))
             return stat;
     }
-    throw identityMismatch();
+    throw fileIdentityMismatchError();
 }
-export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = identityMismatch) {
+export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = fileIdentityMismatchError) {
     let knownDev;
     let knownIno;
     if (expected) {

package/dist/temp-target.js

@@ -6,6 +6,7 @@ import { suffixWindowsReservedDeviceName } from "./filename.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { assertSafePathSegment, sanitizeSafePathSegment, trimHyphenEdges } from "./safe-path-segment.js";
 import { resolveSecureTempRoot } from "./secure-temp-dir.js";
+import { hasNodeErrorCode } from "./path.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 const HYPHEN_CHAR_CODE = 0x2d;
@@ -76,12 +77,6 @@ export function buildRandomTempFilePath(params) {
     assertNoWindowsPathAlias(filePath, "filesystem", "temp file path uses a Windows filesystem namespace alias");
     return filePath;
 }
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 async function cleanupTempDir(dir, identity, onCleanupError) {
     try {
         const current = fsSync.lstatSync(dir, { bigint: true });
@@ -91,7 +86,7 @@ async function cleanupTempDir(dir, identity, onCleanupError) {
         await fs.rm(dir, { recursive: true, force: true });
     }
     catch (err) {
-        if (!isNodeErrorWithCode(err, "ENOENT")) {
+        if (!hasNodeErrorCode(err, "ENOENT")) {
             onCleanupError?.(err);
         }
     }
@@ -174,7 +169,7 @@ export async function createOwnedTempFile(params) {
                     await owner.cleanup();
                 }
                 catch (err) {
-                    if (!isNodeErrorWithCode(err, "ENOENT")) {
+                    if (!hasNodeErrorCode(err, "ENOENT")) {
                         params.onCleanupError?.(err);
                     }
                 }

package/dist/temp-workspace-admission.js

@@ -4,10 +4,9 @@ import path from "node:path";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync, } from "./directory-guard.js";
 import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, assertTrustedTempWorkspaceDirectory, inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-child-admission.js";
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
 import { realpathSync } from "./realpath.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 const WINDOWS = process.platform === "win32";
 function effectiveOwner() {
     // Windows mode/uid fields do not describe ACL authority. The supplied root's
@@ -72,11 +71,6 @@ function assertCanonicalRoot(entry) {
         throw new FsSafeError("path-mismatch", "temp workspace root ancestry changed");
     }
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function inspectSnapshotIdentity(entry) {
     const expected = entry.numericIdentity;
     if (!expected) {
@@ -87,21 +81,21 @@ function inspectSnapshotIdentity(entry) {
     const devKnown = Number.isSafeInteger(stat.dev) && stat.dev >= 0 && (!WINDOWS || stat.dev !== 0);
     if (devKnown) {
         if (stat.dev !== expected.dev)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     const inoKnown = Number.isSafeInteger(stat.ino) && stat.ino >= 0 && (!WINDOWS || stat.ino !== 0);
     if (inoKnown) {
         if (stat.ino !== expected.ino)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (!requiresExactRetry)
         return stat;
     // Read exact identity only once. The strict helper may re-check this constant
@@ -157,7 +151,7 @@ function canonicalAncestry(root) {
 }
 function exactIdentityMatches(current, expected) {
     if (current.dev !== expected.dev || current.ino !== expected.ino)
-        identityMismatch();
+        throw fileIdentityMismatchError();
 }
 function associateTempWorkspaceRoot(entry, ownerUid, descriptorFd) {
     const stat = inspectTempWorkspaceDescriptorIdentitySync(descriptorFd, entry.identity, entry.numericIdentity);

package/dist/temp-workspace-child-admission.js

@@ -2,8 +2,7 @@ import fsSync, {} from "node:fs";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync } from "./directory-guard.js";
 import { pinNodeDirectoryForMode, pinNodeDirectoryForModeSync } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 export const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY = process.platform === "linux" || process.platform === "darwin";
 export function projectTempWorkspaceNumericIdentity(identity) {
     const dev = Number(identity.dev);
@@ -14,15 +13,10 @@ export function projectTempWorkspaceNumericIdentity(identity) {
     }
     return Object.freeze({ dev, ino });
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function inspectNumericIdentity(current, expected) {
     if (!Number.isSafeInteger(current.dev) || current.dev < 0 || current.dev !== expected.dev ||
         !Number.isSafeInteger(current.ino) || current.ino < 0 || current.ino !== expected.ino) {
-        identityMismatch();
+        throw fileIdentityMismatchError();
     }
     return current;
 }

package/dist/temp-workspace-descriptor.js

@@ -1,7 +1,6 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
-import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
-import { assertOwnedDirectory } from "./directory-mode-owner.js";
+import { nodeDirectorySearchOnlyFlags, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";

package/dist/windows-owner.d.ts

@@ -1,9 +1,9 @@
-import { type PermissionCommandFailure } from "./permission-exec.js";
+import { type PermissionFailureFields } from "./permission-exec.js";
 export type WindowsOwnerExec = (command: string, args: string[]) => Promise<{
     stdout: string;
     stderr: string;
 }>;
-export type WindowsOwnerSummary = {
+export type WindowsOwnerSummary = Omit<PermissionFailureFields & {
     sid?: string;
     currentUserSid?: string;
     daclPresent?: boolean;
@@ -11,10 +11,7 @@ export type WindowsOwnerSummary = {
     aclError?: string;
     remote?: boolean;
     trusted?: boolean;
-    error?: string;
-    errorDetail?: PermissionCommandFailure;
-    errorCause?: unknown;
-};
+}, never>;
 export type WindowsOwnerAce = {
     sid: string;
     mask: number;

package/dist/windows-security-bridge.cs

@@ -2,8 +2,6 @@
 // descriptor never passes through CommonSecurityDescriptor's ACE normalization.
 using System;
 using System.Collections.Generic;
-using System.ComponentModel;
-using System.IO;
 using System.Runtime.InteropServices;
 using System.Security.AccessControl;
 using System.Security.Principal;

package/docs/secret-file.md

@@ -113,6 +113,10 @@ If an already validated descriptor fails while reading, both readers throw an
 operational `FsSafeError` with `code: "read-failed"`; inspect `cause` for the
 underlying Node filesystem code such as `EIO`.
 
+Caught `null` or `undefined` inspection and read failures are reported as
+structured errors with an `Error` cause carrying `"null"` or `"undefined"`,
+instead of an internal `TypeError` while inspecting the thrown value.
+
 A synchronous reader closes its descriptor once. A close failure preserves an
 earlier read or identity-validation error; after a successful read, the close
 failure is reported before trimming or rejecting empty content.
@@ -137,6 +141,11 @@ startWebhookVerifier(signingKey);
 
 Async. Creates the parent directory at `dirMode` (default `0o700`) if missing, writes content to a sibling temp file, finalizes `mode` (default `0o600`) through an owned descriptor after content writes, and atomically renames over the destination. Publication verification checks the final file identity and mode.
 
+Both secret writers capture top-level parameter values when called, before
+asynchronous filesystem preparation; a supplied byte buffer is captured by
+reference. A parameter getter throwing `null` or `undefined` rejects with that
+same value before filesystem inspection.
+
 On POSIX, both native and JavaScript writers verify actual `0o600` permission
 bits through the retained descriptor before writing content. A filesystem that
 reports successful chmod without enforcing those bits fails with

package/docs/sidecar-lock.md

@@ -267,6 +267,8 @@ Pass `lockRoot` to place sidecar create, read, verification, and removal behind
 an existing `Root` capability. `lockPath` must resolve inside that root.
 Identity-conditioned removal remains the only release and reclaim deletion
 path.
+Root mutation refusals during stale removal propagate unchanged, including
+`null`, `undefined`, and errors carrying `ENOENT`; they do not become missing-sidecar retries.
 
 Async Root-backed acquisition normalizes the target's parent without creating
 it, checking the retained Root before and after normalization. A deleted or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -169,13 +169,13 @@
     "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.18.1",
-    "@openclaw/fs-safe-darwin-x64": "0.18.1",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.18.1",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.18.1",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.18.1",
-    "@openclaw/fs-safe-linux-x64-musl": "0.18.1",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.18.1",
+    "@openclaw/fs-safe-darwin-arm64": "0.18.2",
+    "@openclaw/fs-safe-darwin-x64": "0.18.2",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.18.2",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.18.2",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.18.2",
+    "@openclaw/fs-safe-linux-x64-musl": "0.18.2",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.18.2",
     "jszip": "^3.10.2"
   },
   "devDependencies": {

package/dist/directory-mode-owner.d.ts

@@ -1,20 +0,0 @@
-import type { BigIntStats, Stats } from "node:fs";
-export type DirectoryModeChecks = {
-    check?: () => void;
-    beforeChmod?: () => Promise<void>;
-};
-export type DirectoryModeOwner = {
-    verify(check?: () => void): Promise<void>;
-    apply(mode: number, checks?: DirectoryModeChecks): Promise<void>;
-    close(): Promise<void>;
-};
-export declare function assertOwnedDirectory(expected: Stats | BigIntStats, actual: Stats | BigIntStats): void;
-/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
-export declare function ownDirectoryMode(params: {
-    inspect: () => Promise<number>;
-    chmod: (mode: number) => Promise<void>;
-    prepareChmod?: () => Promise<void>;
-    verifyChmod?: () => Promise<void>;
-    close: () => Promise<void>;
-    ignoreChmodError?: boolean;
-}): DirectoryModeOwner;

package/dist/directory-mode-owner.js

@@ -1,78 +0,0 @@
-import { FsSafeError } from "./errors.js";
-import { sameFileIdentityForCleanup } from "./file-identity.js";
-export function assertOwnedDirectory(expected, actual) {
-    if (actual.isSymbolicLink() || !actual.isDirectory()) {
-        throw new FsSafeError("not-file", "directory mode target must be a real directory");
-    }
-    if (!sameFileIdentityForCleanup(expected, actual)) {
-        throw new FsSafeError("path-mismatch", "directory changed before its mode could be applied");
-    }
-}
-/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
-export function ownDirectoryMode(params) {
-    let pending = Promise.resolve();
-    let closing;
-    const enqueue = (run) => {
-        if (closing)
-            return Promise.reject(new FsSafeError("path-mismatch", "directory mode owner is closed"));
-        const operation = pending.then(run);
-        pending = operation.catch(() => undefined);
-        return operation;
-    };
-    return {
-        verify: (check) => enqueue(async () => {
-            check?.();
-            await params.inspect();
-            check?.();
-        }),
-        apply: (mode, checks = {}) => enqueue(async () => {
-            // inspect() reports permission bits only; chmod ignores file-type bits,
-            // so tolerate raw stat modes (e.g. S_IFDIR | 0o755) by masking up front.
-            mode &= 0o7777;
-            checks.check?.();
-            const currentMode = await params.inspect();
-            checks.check?.();
-            if (currentMode === mode && !checks.beforeChmod && !checks.check)
-                return;
-            if (currentMode !== mode) {
-                await params.prepareChmod?.();
-                checks.check?.();
-            }
-            await checks.beforeChmod?.();
-            checks.check?.();
-            // Hooks/ancestor checks can yield; recheck the original named association.
-            await params.inspect();
-            checks.check?.();
-            let dispatchDeadlineFailure;
-            if (currentMode !== mode) {
-                checks.check?.();
-                try {
-                    await params.chmod(mode);
-                }
-                catch (error) {
-                    if (!params.ignoreChmodError)
-                        throw error;
-                }
-                // Expiry cannot release the fd while post-dispatch verification is pending.
-                try {
-                    checks.check?.();
-                }
-                catch (error) {
-                    dispatchDeadlineFailure = { error };
-                }
-                await params.verifyChmod?.();
-            }
-            const finalMode = await params.inspect();
-            if (dispatchDeadlineFailure)
-                throw dispatchDeadlineFailure.error;
-            checks.check?.();
-            if (!params.ignoreChmodError && finalMode !== mode) {
-                throw new FsSafeError("path-mismatch", "directory final mode could not be verified");
-            }
-        }),
-        close() {
-            closing ??= pending.then(params.close);
-            return closing;
-        },
-    };
-}