@openclaw/fs-safe 0.4.7 → 0.5.0

package/dist/native.d.ts

@@ -0,0 +1,14 @@
+import type { NativeBinding } from "./native-binding.js";
+export type { NativeBinding } from "./native-binding.js";
+export declare function __loadBundledNativeForTest(): NativeBinding;
+export declare function __nativeLoaderDetectorsForTest(): {
+    report: boolean | undefined;
+    filesystem: boolean | undefined;
+    elfInterpreter: boolean | undefined;
+};
+export declare function __nativeTargetForTest(platform: NodeJS.Platform, arch: string, musl?: boolean): string | undefined;
+export declare function getNativeBinding(): NativeBinding | undefined;
+export declare function requireNativeBinding(): NativeBinding;
+export declare function __setNativeLoaderForTest(loader: () => NativeBinding): void;
+export declare function __resetNativeLoaderForTest(): void;
+//# sourceMappingURL=native.d.ts.map

package/dist/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmKzD,wBAAgB,0BAA0B,IAAI,aAAa,CAE1D;AAED,wBAAgB,8BAA8B,IAAI;IAChD,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,CAMA;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,UAAQ,GACX,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAkB5D;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAQpD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,aAAa,GAAG,IAAI,CAK1E;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAKjD"}

package/dist/native.js

@@ -0,0 +1,204 @@
+import { closeSync, openSync, readSync, readdirSync, } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { FsSafeError } from "./errors.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
+const require = createRequire(import.meta.url);
+const bundledNativeDirectory = fileURLToPath(new URL("../dist/native/", import.meta.url));
+let binding;
+let loadError;
+let attempted = false;
+let loadBinding = loadBundledBinding;
+function isMuslFilename(file) {
+    return file.includes("libc.musl-") || file.includes("ld-musl-");
+}
+function isMuslFromReport() {
+    try {
+        if (!process.report || typeof process.report.getReport !== "function")
+            return undefined;
+        const report = process.report.getReport();
+        if (report.header?.glibcVersionRuntime)
+            return false;
+        if (report.sharedObjects?.some(isMuslFilename))
+            return true;
+    }
+    catch {
+        // Continue with filesystem and ELF inspection.
+    }
+    return undefined;
+}
+function isMuslFromFilesystem() {
+    for (const directory of ["/lib", "/usr/lib"]) {
+        try {
+            if (readdirSync(directory).some(isMuslFilename))
+                return true;
+        }
+        catch {
+            // A missing or unreadable conventional library directory is inconclusive.
+        }
+    }
+    return undefined;
+}
+function readUInt(buffer, offset, bytes, littleEndian) {
+    if (offset < 0 || offset + bytes > buffer.length)
+        return undefined;
+    if (bytes === 2)
+        return littleEndian ? buffer.readUInt16LE(offset) : buffer.readUInt16BE(offset);
+    if (bytes === 4)
+        return littleEndian ? buffer.readUInt32LE(offset) : buffer.readUInt32BE(offset);
+    const value = littleEndian ? buffer.readBigUInt64LE(offset) : buffer.readBigUInt64BE(offset);
+    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : undefined;
+}
+function isMuslFromElfInterpreter() {
+    let fd;
+    try {
+        fd = openSync(process.execPath, "r");
+        const header = Buffer.alloc(64);
+        if (readSync(fd, header, 0, header.length, 0) < 52)
+            return undefined;
+        if (!header.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
+            return undefined;
+        const elfClass = header[4];
+        const dataEncoding = header[5];
+        if ((elfClass !== 1 && elfClass !== 2) || (dataEncoding !== 1 && dataEncoding !== 2)) {
+            return undefined;
+        }
+        const littleEndian = dataEncoding === 1;
+        const is64Bit = elfClass === 2;
+        const tableOffset = readUInt(header, is64Bit ? 32 : 28, is64Bit ? 8 : 4, littleEndian);
+        const entrySize = readUInt(header, is64Bit ? 54 : 42, 2, littleEndian);
+        const entryCount = readUInt(header, is64Bit ? 56 : 44, 2, littleEndian);
+        if (tableOffset === undefined ||
+            entrySize === undefined ||
+            entryCount === undefined ||
+            entrySize < (is64Bit ? 56 : 32) ||
+            entryCount > 1024) {
+            return undefined;
+        }
+        const programHeader = Buffer.alloc(entrySize);
+        for (let index = 0; index < entryCount; index += 1) {
+            const offset = tableOffset + index * entrySize;
+            if (readSync(fd, programHeader, 0, entrySize, offset) !== entrySize)
+                return undefined;
+            if (readUInt(programHeader, 0, 4, littleEndian) !== 3)
+                continue;
+            const interpreterOffset = readUInt(programHeader, is64Bit ? 8 : 4, is64Bit ? 8 : 4, littleEndian);
+            const interpreterSize = readUInt(programHeader, is64Bit ? 32 : 16, is64Bit ? 8 : 4, littleEndian);
+            if (interpreterOffset === undefined ||
+                interpreterSize === undefined ||
+                interpreterSize < 1 ||
+                interpreterSize > 4096) {
+                return undefined;
+            }
+            const interpreter = Buffer.alloc(interpreterSize);
+            if (readSync(fd, interpreter, 0, interpreterSize, interpreterOffset) !== interpreterSize) {
+                return undefined;
+            }
+            return isMuslFilename(interpreter.toString("utf8"));
+        }
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Best-effort detection must never turn close failure into import failure.
+            }
+        }
+    }
+    return undefined;
+}
+function isMusl() {
+    if (process.platform !== "linux")
+        return false;
+    for (const detector of [isMuslFromReport, isMuslFromFilesystem, isMuslFromElfInterpreter]) {
+        const result = detector();
+        if (result !== undefined)
+            return result;
+    }
+    // Unknown Linux libc: try the glibc binary and let its require fail normally.
+    return false;
+}
+function targetFor(platform, arch, musl) {
+    if (platform === "win32" && arch === "x64")
+        return "win32-x64-msvc";
+    if (platform === "darwin" && arch === "x64")
+        return "darwin-x64";
+    if (platform === "darwin" && arch === "arm64")
+        return "darwin-arm64";
+    if (platform === "linux" && (arch === "x64" || arch === "arm64")) {
+        return `linux-${arch}-${musl ? "musl" : "gnu"}`;
+    }
+    return undefined;
+}
+function bundledTarget() {
+    return targetFor(process.platform, process.arch, isMusl());
+}
+function loadBundledBinding() {
+    const target = bundledTarget();
+    if (!target) {
+        throw new Error(`Unsupported OS or architecture: ${process.platform}-${process.arch}`);
+    }
+    return require(join(bundledNativeDirectory, target, "fs-safe-native.node"));
+}
+export function __loadBundledNativeForTest() {
+    return loadBundledBinding();
+}
+export function __nativeLoaderDetectorsForTest() {
+    return {
+        report: isMuslFromReport(),
+        filesystem: isMuslFromFilesystem(),
+        elfInterpreter: isMuslFromElfInterpreter(),
+    };
+}
+export function __nativeTargetForTest(platform, arch, musl = false) {
+    return targetFor(platform, arch, musl);
+}
+export function getNativeBinding() {
+    const { mode } = getFsSafeNativeConfig();
+    if (mode === "off")
+        return undefined;
+    if (!attempted) {
+        attempted = true;
+        try {
+            binding = loadBinding();
+        }
+        catch (error) {
+            loadError = error;
+        }
+    }
+    if (binding)
+        return binding;
+    if (mode === "require") {
+        throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
+            cause: loadError,
+        });
+    }
+    return undefined;
+}
+export function requireNativeBinding() {
+    const native = getNativeBinding();
+    if (!native) {
+        throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
+            cause: loadError,
+        });
+    }
+    return native;
+}
+export function __setNativeLoaderForTest(loader) {
+    binding = undefined;
+    loadError = undefined;
+    attempted = false;
+    loadBinding = loader;
+}
+export function __resetNativeLoaderForTest() {
+    binding = undefined;
+    loadError = undefined;
+    attempted = false;
+    loadBinding = loadBundledBinding;
+}

package/dist/output-sibling.d.ts

@@ -0,0 +1,8 @@
+export declare function writeExternalFileViaSibling<T>(params: {
+    finalPath: string;
+    write: (filePath: string) => Promise<T>;
+    fallbackFileName?: string;
+    maxBytes?: number;
+    mode?: number;
+}): Promise<T>;
+//# sourceMappingURL=output-sibling.d.ts.map

package/dist/output-sibling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-sibling.d.ts","sourceRoot":"","sources":["../src/output-sibling.ts"],"names":[],"mappings":"AAgGA,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Cb"}

package/dist/output-sibling.js

@@ -0,0 +1,122 @@
+import { randomUUID } from "node:crypto";
+import fsSync from "node:fs";
+import fs, {} from "node:fs/promises";
+import path from "node:path";
+import { createAsyncDirectoryGuard } from "./directory-guard.js";
+import { syncDirectoryBestEffort } from "./directory-durability.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
+import { sanitizeUntrustedFileName } from "./filename.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
+import { serializePathWrite } from "./write-queue.js";
+const OPEN_READ_WRITE_NOFOLLOW = fsSync.constants.O_RDWR |
+    (process.platform !== "win32" && typeof fsSync.constants.O_NOFOLLOW === "number"
+        ? fsSync.constants.O_NOFOLLOW
+        : 0);
+function safeFallbackFileName(fallbackFileName) {
+    return sanitizeUntrustedFileName(fallbackFileName ?? "output.bin", "output.bin");
+}
+function buildSiblingTempPath(targetPath, fallbackFileName) {
+    const safeTail = sanitizeUntrustedFileName(path.basename(targetPath), safeFallbackFileName(fallbackFileName));
+    return path.join(path.dirname(targetPath), `.fs-safe-output-${process.pid}-${randomUUID()}-${safeTail}.part`);
+}
+function assertStagedFile(pathname, opened, maxBytes) {
+    if (pathname.isSymbolicLink() || !pathname.isFile() || !opened.isFile()) {
+        throw new FsSafeError("not-file", "sibling-staged output must be a regular file");
+    }
+    if (!sameFileIdentity(pathname, opened)) {
+        throw new FsSafeError("path-mismatch", "sibling-staged output changed while opening");
+    }
+    if (opened.nlink > 1) {
+        throw new FsSafeError("hardlink", "hardlinked sibling-staged output not allowed");
+    }
+    if (maxBytes !== undefined && opened.size > maxBytes) {
+        throw new FsSafeError("too-large", `sibling-staged output exceeds maxBytes (${maxBytes})`);
+    }
+}
+async function openPinnedStagedFile(tempPath, maxBytes) {
+    const preview = await fs.lstat(tempPath);
+    if (preview.isSymbolicLink()) {
+        throw new FsSafeError("symlink", "symlink sibling-staged output not allowed");
+    }
+    const handle = await fs.open(tempPath, OPEN_READ_WRITE_NOFOLLOW);
+    try {
+        const identity = await handle.stat();
+        assertStagedFile(await fs.lstat(tempPath), identity, maxBytes);
+        return { handle, identity };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function syncFile(handle) {
+    try {
+        await handle.sync();
+    }
+    catch (error) {
+        if (error.code !== "EPERM")
+            throw error;
+    }
+}
+async function cleanupTempPath(tempPath, identity) {
+    try {
+        const current = await fs.lstat(tempPath);
+        if (!identity || (!current.isSymbolicLink() && sameFileIdentity(current, identity))) {
+            await fs.rm(tempPath, { force: true });
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            // Cleanup is best-effort; the randomized path remains inside the writable boundary.
+        }
+    }
+}
+export async function writeExternalFileViaSibling(params) {
+    const finalPath = path.resolve(params.finalPath);
+    const parentPath = path.dirname(finalPath);
+    const parentGuard = await createAsyncDirectoryGuard(parentPath);
+    const tempPath = buildSiblingTempPath(finalPath, params.fallbackFileName);
+    const unregisterTempPath = registerTempPathForExit(tempPath);
+    let stagedIdentity;
+    let renamed = false;
+    try {
+        const result = await params.write(tempPath);
+        const pinned = await openPinnedStagedFile(tempPath, params.maxBytes);
+        stagedIdentity = pinned.identity;
+        unregisterTempPath.setIdentity(stagedIdentity);
+        try {
+            if (params.mode !== undefined) {
+                await pinned.handle.chmod(params.mode);
+            }
+            await syncFile(pinned.handle);
+            await serializePathWrite(finalPath, async () => {
+                await withAsyncDirectoryGuards([parentGuard], async () => {
+                    const currentIdentity = await pinned.handle.stat();
+                    assertStagedFile(await fs.lstat(tempPath), currentIdentity, params.maxBytes);
+                    if (!sameFileIdentity(currentIdentity, stagedIdentity)) {
+                        throw new FsSafeError("path-mismatch", "sibling-staged output changed before rename");
+                    }
+                    await fs.rename(tempPath, finalPath);
+                    renamed = true;
+                    const published = await fs.lstat(finalPath);
+                    if (published.isSymbolicLink() || !sameFileIdentity(published, currentIdentity)) {
+                        throw new FsSafeError("path-mismatch", "sibling-staged output changed during rename");
+                    }
+                });
+                await syncDirectoryBestEffort(parentPath);
+            });
+        }
+        finally {
+            await pinned.handle.close().catch(() => undefined);
+        }
+        return result;
+    }
+    finally {
+        if (!renamed) {
+            await cleanupTempPath(tempPath, stagedIdentity);
+        }
+        unregisterTempPath();
+    }
+}

package/dist/output.d.ts

@@ -4,6 +4,8 @@ export type ExternalFileWriteOptions<T = void> = {
     write: (filePath: string) => Promise<T>;
     maxBytes?: number;
     mode?: number;
+    staging?: "workspace" | "sibling";
+    fallbackFileName?: string;
 };
 export type ExternalFileWriteResult<T = void> = {
     path: string;

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AA6CF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CA+BrC"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CA+CrC"}

package/dist/output.js

@@ -2,10 +2,21 @@ import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { sanitizeUntrustedFileName } from "./filename.js";
 import { isPathInside } from "./path.js";
+import { writeExternalFileViaSibling } from "./output-sibling.js";
 import { root } from "./root.js";
 import { tempFile } from "./temp-target.js";
-function tempFileNameForTarget(targetPath) {
-    return sanitizeUntrustedFileName(path.basename(targetPath), "output.bin");
+const NON_PORTABLE_FILE_NAME_CHARACTERS = /[\u0000-\u001f\u007f-\u009f<>:"/\\|?*]/u;
+function tempFileNameForTarget(targetPath, fallbackFileName) {
+    const fallback = sanitizeUntrustedFileName(fallbackFileName ?? "output.bin", "output.bin");
+    return sanitizeUntrustedFileName(path.basename(targetPath), fallback);
+}
+function sanitizedTargetPath(targetPath, fallbackFileName) {
+    const basename = path.basename(targetPath);
+    if (!NON_PORTABLE_FILE_NAME_CHARACTERS.test(basename)) {
+        return targetPath;
+    }
+    const sanitized = tempFileNameForTarget(targetPath, fallbackFileName);
+    return sanitized === basename ? targetPath : path.join(path.dirname(targetPath), sanitized);
 }
 function ensureTrailingSep(value) {
     return value.endsWith(path.sep) ? value : `${value}${path.sep}`;
@@ -43,16 +54,32 @@ export async function writeExternalFileWithinRoot(options) {
         throw new FsSafeError("invalid-path", "target path is required");
     }
     assertFileTargetPath(requestedTargetPath);
-    const targetPath = toRootPathInput({
+    const rawTargetPath = toRootPathInput({
         rootDir: targetRoot.rootDir,
         rootReal: targetRoot.rootReal,
         targetPath: requestedTargetPath,
     });
-    assertFileTargetPath(targetPath);
+    assertFileTargetPath(rawTargetPath);
+    const targetPath = sanitizedTargetPath(rawTargetPath, options.fallbackFileName);
     const finalPath = await targetRoot.resolve(targetPath);
+    if (options.staging === "sibling") {
+        const parentPath = path.dirname(targetPath);
+        if (parentPath !== ".") {
+            await targetRoot.mkdir(parentPath);
+        }
+        const siblingFinalPath = await targetRoot.resolve(targetPath);
+        const result = await writeExternalFileViaSibling({
+            finalPath: siblingFinalPath,
+            write: options.write,
+            fallbackFileName: options.fallbackFileName,
+            maxBytes: options.maxBytes,
+            mode: options.mode,
+        });
+        return { path: siblingFinalPath, result };
+    }
     const staged = await tempFile({
         prefix: "fs-safe-output",
-        fileName: tempFileNameForTarget(targetPath),
+        fileName: tempFileNameForTarget(targetPath, options.fallbackFileName),
     });
     try {
         const result = await options.write(staged.path);

package/dist/owner-dacl.d.ts

@@ -0,0 +1,31 @@
+export type WindowsAceFlags = {
+    raw: number;
+    objectInherit: boolean;
+    containerInherit: boolean;
+    noPropagateInherit: boolean;
+    inheritOnly: boolean;
+    inherited: boolean;
+    successfulAccess: boolean;
+    failedAccess: boolean;
+};
+export type WindowsAccessControlEntry = {
+    sid: string;
+    mask: number;
+    aceType: "allow" | "deny";
+    flags: WindowsAceFlags;
+};
+export type OwnerAndDaclResult = {
+    status: "supported";
+    ownerSid: string;
+    currentUserSid: string;
+    daclPresent: boolean;
+    isLocal: boolean;
+    complete: boolean;
+    unsupportedAceTypes: number[];
+    aces: WindowsAccessControlEntry[];
+} | {
+    status: "unsupported-platform";
+    platform: NodeJS.Platform;
+};
+export declare function readOwnerAndDacl(targetPath: string): OwnerAndDaclResult;
+//# sourceMappingURL=owner-dacl.d.ts.map

package/dist/owner-dacl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA4BvE"}

package/dist/owner-dacl.js

@@ -0,0 +1,27 @@
+import { FsSafeError } from "./errors.js";
+import { getNativeBinding } from "./native.js";
+export function readOwnerAndDacl(targetPath) {
+    if (process.platform !== "win32") {
+        return { status: "unsupported-platform", platform: process.platform };
+    }
+    const native = getNativeBinding();
+    if (!native) {
+        throw new FsSafeError("helper-unavailable", "Windows owner and DACL facts require the bundled native binding");
+    }
+    const facts = native.readOwnerAndDacl(targetPath);
+    return {
+        status: "supported",
+        ownerSid: facts.ownerSid,
+        currentUserSid: facts.currentUserSid,
+        daclPresent: facts.daclPresent,
+        isLocal: facts.isLocal,
+        complete: facts.aceListComplete,
+        unsupportedAceTypes: [...facts.unsupportedAceTypes],
+        aces: facts.aces.map((entry) => ({
+            sid: entry.sid,
+            mask: entry.mask,
+            aceType: entry.aceType,
+            flags: { ...entry.flags },
+        })),
+    };
+}

package/dist/path-policy.js

@@ -15,7 +15,7 @@ export async function assertNoPathAliasEscape(params) {
         return;
     }
     await assertNoHardlinkedFinalPath({
-        filePath: resolved.absolutePath,
+        filePath: resolved.canonicalPath,
         root: resolved.rootPath,
         boundaryLabel: params.boundaryLabel,
         allowFinalHardlinkForUnlink: params.policy?.allowFinalHardlinkForUnlink,

package/dist/permissions-public.d.ts

@@ -1,2 +1,4 @@
 export { formatOctal, formatPermissionDetail, formatPermissionRemediation, inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, safeStat, type PermissionCheck, type PermissionCheckOptions, type SafeStatResult, } from "./permissions.js";
+export { createPrivateDirectory, type CreatePrivateDirectoryOptions, } from "./private-directory.js";
+export { readOwnerAndDacl, type OwnerAndDaclResult, type WindowsAccessControlEntry, type WindowsAceFlags, } from "./owner-dacl.js";
 //# sourceMappingURL=permissions-public.d.ts.map

package/dist/permissions-public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-public.d.ts","sourceRoot":"","sources":["../src/permissions-public.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"permissions-public.d.ts","sourceRoot":"","sources":["../src/permissions-public.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/permissions-public.js

@@ -1 +1,3 @@
 export { formatOctal, formatPermissionDetail, formatPermissionRemediation, inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, safeStat, } from "./permissions.js";
+export { createPrivateDirectory, } from "./private-directory.js";
+export { readOwnerAndDacl, } from "./owner-dacl.js";

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AA6CF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA8F1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAQT;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAOf;AAgGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAyBvF;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAY1E;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC,GACA,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B,MAAM,CAaR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7D"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AA6CF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAQT;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAOf;AAgGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAyBvF;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAY1E;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC,GACA,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B,MAAM,CAaR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7D"}

package/dist/permissions.js

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
+import { inspectWindowsPermissionsNative } from "./windows-permissions-native.js";
 import { resolveWindowsSystemCommand } from "./windows-command.js";
 import { inspectWindowsOwner, resolveWindowsCurrentUserSid, resolveWindowsPrincipalSids, } from "./windows-owner.js";
 const execFileAsync = promisify(execFile);
@@ -102,6 +103,11 @@ export async function inspectPathPermissions(targetPath, opts) {
     const bits = modeBits(effectiveMode);
     const platform = opts?.platform ?? process.platform;
     if (platform === "win32") {
+        const native = inspectWindowsPermissionsNative({
+            targetPath, stat: st, effectiveIsDir, effectiveMode, bits,
+        });
+        if (native)
+            return native;
         const owner = await inspectWindowsOwner({
             targetPath,
             env: opts?.env,

package/dist/pinned-operation.d.ts

@@ -0,0 +1,2 @@
+export declare function validatePinnedOperationPayload(payload: Record<string, unknown>): void;
+//# sourceMappingURL=pinned-operation.d.ts.map

package/dist/pinned-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-operation.d.ts","sourceRoot":"","sources":["../src/pinned-operation.ts"],"names":[],"mappings":"AAEA,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAarF"}

package/dist/pinned-operation.js

@@ -0,0 +1,35 @@
+import { FsSafeError } from "./errors.js";
+export function validatePinnedOperationPayload(payload) {
+    if (typeof payload.relativePath === "string") {
+        validatePinnedRelativePath(payload.relativePath);
+    }
+    if (typeof payload.relativeParentPath === "string") {
+        validatePinnedRelativePath(payload.relativeParentPath);
+    }
+    if (typeof payload.from === "string") {
+        validatePinnedRelativePath(payload.from);
+    }
+    if (typeof payload.to === "string") {
+        validatePinnedRelativePath(payload.to);
+    }
+}
+function validatePinnedRelativePath(relativePath) {
+    if (relativePath.length === 0 || relativePath === ".") {
+        return;
+    }
+    if (relativePath.includes("\0")) {
+        throw new FsSafeError("invalid-path", "relative path contains a NUL byte");
+    }
+    if (relativePath.startsWith("/") ||
+        relativePath.startsWith("//") ||
+        relativePath === ".." ||
+        relativePath.startsWith("../") ||
+        relativePath.startsWith("..\\")) {
+        throw new FsSafeError("invalid-path", "relative path must not escape root");
+    }
+    for (const segment of relativePath.split("/")) {
+        if (segment === "..") {
+            throw new FsSafeError("invalid-path", "relative path must not contain '..'");
+        }
+    }
+}

package/dist/pinned-write.d.ts

@@ -1,6 +1,6 @@
 import type { Readable } from "node:stream";
 import type { FileIdentityStat } from "./file-identity.js";
-type PinnedWriteInput = {
+export type PinnedWriteInput = {
     kind: "buffer";
     data: string | Buffer;
     encoding?: BufferEncoding;
@@ -8,9 +8,9 @@ type PinnedWriteInput = {
     kind: "stream";
     stream: Readable;
 };
-type RenameIdentityMismatchPolicy = "throw" | "verify-content";
+export type RenameIdentityMismatchPolicy = "throw" | "verify-content";
 export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
-type PinnedWriteParams = {
+export type PinnedWriteParams = {
     rootPath: string;
     relativeParentPath: string;
     basename: string;
@@ -27,17 +27,4 @@ export declare function runPinnedWriteWithRenamePolicy(params: PinnedWriteParams
     targetPath: string;
     renameIdentity?: RenameIdentityPolicy;
 }): Promise<FileIdentityStat>;
-export declare function runPinnedCopyHelper(params: {
-    rootPath: string;
-    relativeParentPath: string;
-    basename: string;
-    mkdir: boolean;
-    mode: number;
-    overwrite?: boolean;
-    maxBytes?: number;
-    sourcePath: string;
-    sourceIdentity: FileIdentityStat;
-    rootIdentity?: FileIdentityStat;
-}): Promise<FileIdentityStat>;
-export {};
 //# sourceMappingURL=pinned-write.d.ts.map

package/dist/pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAa3D,KAAK,gBAAgB,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAuFzC,KAAK,4BAA4B,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;CACzD,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkD/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,gBAAgB,CAAC;IACjC,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqB5B"}
+{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAU3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAgEzC,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAEtE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;CACzD,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAe/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}