@openclaw/fs-safe 0.5.0 → 0.5.2

package/dist/guarded-mkdir.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { isNotFoundPathError, isPathRelativeEscape } from "./path.js";
+import { directoryComponentNotDirectoryError } from "./root-errors.js";
 function isSameOrChildPath(candidate, parent) {
     const parentPrefix = parent.endsWith(path.sep) ? parent : `${parent}${path.sep}`;
     return candidate === parent || candidate.startsWith(parentPrefix);
@@ -15,9 +16,7 @@ async function realpathOrThrowNotFile(target) {
         if (isNotFoundPathError(error)) {
             // A dangling symlink (or a component removed between lstat and
             // realpath) is not a usable directory component.
-            throw new FsSafeError("not-file", "directory component must be a directory", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw directoryComponentNotDirectoryError(error instanceof Error ? error : undefined);
         }
         throw error;
     }
@@ -40,8 +39,8 @@ export async function mkdirPathComponentsWithGuards(params) {
     for (const part of relative.split(path.sep).filter(Boolean)) {
         const next = path.join(current, part);
         const parentGuard = await createAsyncDirectoryGuard(current);
-        await params.beforeComponent?.(next);
         await assertAsyncDirectoryGuard(parentGuard);
+        await params.beforeComponent?.(next);
         try {
             await fs.mkdir(next);
         }
@@ -52,7 +51,7 @@ export async function mkdirPathComponentsWithGuards(params) {
         }
         const stat = await fs.lstat(next);
         if (!stat.isSymbolicLink() && !stat.isDirectory()) {
-            throw new FsSafeError("not-file", "directory component must be a directory");
+            throw directoryComponentNotDirectoryError();
         }
         // Node's recursive mkdir follows symlinks in missing components. Build one
         // segment at a time and realpath-check each segment before descending.
@@ -72,7 +71,7 @@ export async function mkdirPathComponentsWithGuards(params) {
             // the returned resolved path, not their own lexical parent path.
             const targetStat = await fs.stat(nextReal);
             if (!targetStat.isDirectory()) {
-                throw new FsSafeError("not-file", "directory component must be a directory");
+                throw directoryComponentNotDirectoryError();
             }
             await createAsyncDirectoryGuard(nextReal);
             await assertAsyncDirectoryGuard(parentGuard);

package/dist/install-path.js

@@ -41,7 +41,7 @@ export function resolveSafeInstallDir(params) {
         path.isAbsolute(relative)) {
         return { ok: false, error: params.invalidNameMessage };
     }
-    return { ok: true, path: targetDir };
+    return { ok: true, path: resolvedTarget };
 }
 export async function assertCanonicalPathWithinBase(params) {
     const baseDir = path.resolve(params.baseDir);

package/dist/json-document-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-document-store.d.ts","sourceRoot":"","sources":["../src/json-document-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAKlE,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACvC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE,CAAC;AA2BF,wBAAgB,eAAe,CAAC,CAAC,EAC/B,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC5B,OAAO,GAAE,oBAAyB,GACjC,SAAS,CAAC,CAAC,CAAC,CA0Ed"}
+{"version":3,"file":"json-document-store.d.ts","sourceRoot":"","sources":["../src/json-document-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AASlE,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACvC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE,CAAC;AA2BF,wBAAgB,eAAe,CAAC,CAAC,EAC/B,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC5B,OAAO,GAAE,oBAAyB,GACjC,SAAS,CAAC,CAAC,CAAC,CAiFd"}

package/dist/json-document-store.js

@@ -43,24 +43,30 @@ export function createJsonStore(adapter, options = {}) {
     async function withSerializedMutation(run) {
         const canonicalPath = await canonicalPathFromExistingAncestor(adapter.filePath);
         const activePaths = activeStoreMutations.getStore();
-        if (activePaths?.has(canonicalPath)) {
+        if (activePaths?.get(canonicalPath)?.active) {
             throw new FsSafeError("store-reentrant-update", `jsonStore cannot write or update ${canonicalPath} from inside its active update callback; return the complete next value from the outer update instead`);
         }
         return await serializePathWrite(`json-store:${canonicalPath}`, async () => {
-            const mutationPaths = new Set(activePaths);
-            mutationPaths.add(canonicalPath);
+            const mutationPaths = new Map([...(activePaths ?? [])].filter(([, token]) => token.active));
+            const token = { active: true };
+            mutationPaths.set(canonicalPath, token);
             return await activeStoreMutations.run(mutationPaths, async () => {
-                if (!locks || !lockOptions) {
-                    return await run();
+                try {
+                    if (!locks || !lockOptions) {
+                        return await run();
+                    }
+                    return await locks.withLock({
+                        targetPath: adapter.filePath,
+                        staleMs: lockOptions.staleMs,
+                        timeoutMs: lockOptions.timeoutMs,
+                        retry: lockOptions.retry,
+                        staleRecovery: lockOptions.staleRecovery,
+                        payload: () => ({ pid: process.pid, createdAt: new Date().toISOString() }),
+                    }, run);
+                }
+                finally {
+                    token.active = false;
                 }
-                return await locks.withLock({
-                    targetPath: adapter.filePath,
-                    staleMs: lockOptions.staleMs,
-                    timeoutMs: lockOptions.timeoutMs,
-                    retry: lockOptions.retry,
-                    staleRecovery: lockOptions.staleRecovery,
-                    payload: () => ({ pid: process.pid, createdAt: new Date().toISOString() }),
-                }, run);
             });
         });
     }

package/dist/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAM7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAgJhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAM7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA6IhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}

package/dist/json.js

@@ -7,6 +7,7 @@ import { stringifyJsonDocument } from "./json-stringify.js";
 import { readRegularFile, readRegularFileSync, statRegularFile } from "./regular-file.js";
 import { openRootFileSync } from "./root-file.js";
 import { writeTextAtomic } from "./text-atomic.js";
+import { sleep } from "./timing.js";
 const READ_RETRY_MAX_ATTEMPTS = 5;
 const READ_RETRY_BASE_DELAY_MS = 50;
 function isRetryableReadError(err, options) {
@@ -19,9 +20,6 @@ function isRetryableReadError(err, options) {
     const code = getErrorCode(err);
     return code === "ENOENT" || code === "EPERM";
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 async function readRegularFileWithRetry(filePath, options = {}) {
     let lastErr;
     for (let attempt = 0; attempt < READ_RETRY_MAX_ATTEMPTS; attempt++) {

package/dist/local-file-access.d.ts

@@ -1,8 +1,9 @@
+export declare function isFileUrl(input: string): boolean;
 export declare function hasEncodedFileUrlSeparator(pathname: string): boolean;
 export declare function isWindowsNetworkPath(filePath: string, platform?: NodeJS.Platform): boolean;
 export declare function isWindowsDriveLetterPath(filePath: string, platform?: NodeJS.Platform): boolean;
 export declare function assertNoWindowsNetworkPath(filePath: string, label?: string): void;
-export declare function safeFileURLToPath(fileUrl: string): string;
-export declare function trySafeFileURLToPath(fileUrl: string): string | undefined;
+export declare function safeFileURLToPath(fileUrl: string, platform?: NodeJS.Platform): string;
+export declare function trySafeFileURLToPath(fileUrl: string, platform?: NodeJS.Platform): string | undefined;
 export declare function basenameFromMediaSource(source?: string): string | undefined;
 //# sourceMappingURL=local-file-access.d.ts.map

package/dist/local-file-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-file-access.d.ts","sourceRoot":"","sources":["../src/local-file-access.ts"],"names":[],"mappings":"AAWA,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAeT;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAET;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,IAAI,CAIjF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmBzD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgB3E"}
+{"version":3,"file":"local-file-access.d.ts","sourceRoot":"","sources":["../src/local-file-access.ts"],"names":[],"mappings":"AAOA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhD;AAOD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAeT;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAET;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,IAAI,CAIjF;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAqBR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgB3E"}

package/dist/local-file-access.js

@@ -2,6 +2,10 @@ import path from "node:path";
 import { fileURLToPath, URL } from "node:url";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 const ENCODED_FILE_URL_SEPARATOR_RE = /%(?:2f|5c)/i;
+const FILE_URL_PREFIX_RE = /^file:\/\//i;
+export function isFileUrl(input) {
+    return FILE_URL_PREFIX_RE.test(input);
+}
 function isLocalFileUrlHost(hostname) {
     const normalized = normalizeLowercaseStringOrEmpty(hostname);
     return normalized === "" || normalized === "localhost";
@@ -32,7 +36,7 @@ export function assertNoWindowsNetworkPath(filePath, label = "Path") {
         throw new Error(`${label} cannot use Windows network paths: ${filePath}`);
     }
 }
-export function safeFileURLToPath(fileUrl) {
+export function safeFileURLToPath(fileUrl, platform = process.platform) {
     let parsed;
     try {
         parsed = new URL(fileUrl);
@@ -49,13 +53,15 @@ export function safeFileURLToPath(fileUrl) {
     if (hasEncodedFileUrlSeparator(parsed.pathname)) {
         throw new Error(`file:// URLs cannot encode path separators: ${fileUrl}`);
     }
-    const filePath = fileURLToPath(parsed);
-    assertNoWindowsNetworkPath(filePath, "Local file URL");
+    const filePath = fileURLToPath(parsed, { windows: platform === "win32" });
+    if (isWindowsNetworkPath(filePath, platform)) {
+        throw new Error(`Local file URL cannot use Windows network paths: ${filePath}`);
+    }
     return filePath;
 }
-export function trySafeFileURLToPath(fileUrl) {
+export function trySafeFileURLToPath(fileUrl, platform = process.platform) {
     try {
-        return safeFileURLToPath(fileUrl);
+        return safeFileURLToPath(fileUrl, platform);
     }
     catch {
         return undefined;
@@ -65,7 +71,7 @@ export function basenameFromMediaSource(source) {
     if (!source) {
         return undefined;
     }
-    if (source.startsWith("file://")) {
+    if (isFileUrl(source)) {
         const filePath = trySafeFileURLToPath(source);
         return filePath ? path.basename(filePath) || undefined : undefined;
     }

package/dist/local-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAMA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAmGF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CA6B7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA0CtC"}
+{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAMA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAqGF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CA6B7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA2CtC"}

package/dist/local-roots.js

@@ -2,11 +2,11 @@ import fsSync from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { expandHomePrefix, resolveUserPath } from "./home-dir.js";
-import { safeFileURLToPath } from "./local-file-access.js";
+import { isFileUrl, safeFileURLToPath } from "./local-file-access.js";
 import { isPathInside } from "./path.js";
 import { root } from "./root.js";
 function resolveLocalPathInput(input, label) {
-    if (input.startsWith("file://")) {
+    if (isFileUrl(input)) {
         try {
             return safeFileURLToPath(input);
         }
@@ -25,7 +25,7 @@ function resolveLocalRootInput(input, label) {
     if (!trimmed) {
         throw new FsSafeError("invalid-path", `${label} entry is required`);
     }
-    const resolved = trimmed.startsWith("file://")
+    const resolved = isFileUrl(trimmed)
         ? resolveLocalPathInput(trimmed, label)
         : expandHomePrefix(trimmed);
     if (resolved.includes("\0")) {
@@ -41,7 +41,9 @@ function isPathInsideRoot(candidate, rootDir) {
 }
 function resolveRootRealSync(rootDir) {
     try {
-        const stat = fsSync.lstatSync(rootDir);
+        // Configured roots may themselves be symlinks. Follow only this trusted
+        // root entry, then use its canonical directory for containment checks.
+        const stat = fsSync.statSync(rootDir);
         if (!stat.isDirectory()) {
             return null;
         }
@@ -101,8 +103,8 @@ function resolveCandidateCanonicalSync(filePath) {
 export function resolveLocalPathFromRootsSync(options) {
     const label = options.label ?? "local roots";
     const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
-    for (const rootEntry of options.roots) {
-        const rootDir = resolveLocalRootInput(rootEntry, label);
+    const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    for (const rootDir of rootDirs) {
         const rootReal = resolveRootRealSync(rootDir);
         if (!rootReal) {
             continue;
@@ -129,8 +131,8 @@ export function resolveLocalPathFromRootsSync(options) {
 export async function readLocalFileFromRoots(options) {
     const label = options.label ?? "local roots";
     const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
-    for (const rootEntry of options.roots) {
-        const rootDir = resolveLocalRootInput(rootEntry, label);
+    const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    for (const rootDir of rootDirs) {
         let scopedRoot;
         try {
             scopedRoot = await root(rootDir);
@@ -138,29 +140,32 @@ export async function readLocalFileFromRoots(options) {
         catch {
             continue;
         }
-        const relativePath = path.relative(scopedRoot.rootDir, requestedPath);
-        if (!relativePath ||
-            relativePath === ".." ||
-            relativePath.startsWith(`..${path.sep}`) ||
-            path.isAbsolute(relativePath)) {
-            continue;
-        }
-        try {
-            const readOptions = {
-                hardlinks: options.hardlinks,
-                nonBlockingRead: options.nonBlockingRead,
-                symlinks: options.symlinks,
-            };
-            // Leave maxBytes absent when the caller omits it so Root's own default
-            // cap remains in force instead of being overwritten by undefined.
-            if (options.maxBytes !== undefined) {
-                readOptions.maxBytes = options.maxBytes;
+        const readOptions = {
+            hardlinks: options.hardlinks,
+            nonBlockingRead: options.nonBlockingRead,
+            symlinks: options.symlinks,
+        };
+        // Leave maxBytes absent when the caller omits it so Root's own default
+        // cap remains in force instead of being overwritten by undefined.
+        if (options.maxBytes !== undefined) {
+            readOptions.maxBytes = options.maxBytes;
+        }
+        // A trusted root symlink has two valid spellings. Preserve the caller's
+        // lexical spelling when possible so Root.read() still enforces its
+        // symlink policy, while also accepting a path expressed below rootReal.
+        const relativePaths = [scopedRoot.rootDir, scopedRoot.rootReal]
+            .filter((rootPath, index, roots) => roots.indexOf(rootPath) === index)
+            .filter((rootPath) => isPathInside(rootPath, requestedPath))
+            .map((rootPath) => path.relative(rootPath, requestedPath))
+            .filter(Boolean);
+        for (const relativePath of relativePaths) {
+            try {
+                const result = await scopedRoot.read(relativePath, readOptions);
+                return { ...result, root: scopedRoot.rootReal };
+            }
+            catch {
+                // Try the canonical spelling before moving to the next configured root.
             }
-            const result = await scopedRoot.read(relativePath, readOptions);
-            return { ...result, root: scopedRoot.rootReal };
-        }
-        catch {
-            continue;
         }
     }
     return null;

package/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA4UD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAuCf"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA6VD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/move-path.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { guardedRename } from "./guarded-mutation.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
 export function moveCopyFallbackReasonForRenameError(error, platform = process.platform) {
     const code = error?.code;
     if (code === "EXDEV") {
@@ -102,6 +103,21 @@ function regularReadFlags() {
             ? fsConstants.O_NONBLOCK
             : 0));
 }
+async function chmodDirectoryPinned(directoryPath, mode) {
+    if (process.platform === "win32") {
+        // Node cannot portably open a Windows directory for descriptor-bound
+        // chmod. POSIX modes are not enforced there, so do not fall back to a
+        // pathname operation that could follow a replacement symlink.
+        return;
+    }
+    const handle = await fs.open(directoryPath, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+    try {
+        await handle.chmod(mode);
+    }
+    finally {
+        await handle.close();
+    }
+}
 async function writeAll(handle, buffer, bytesRead) {
     let offset = 0;
     while (offset < bytesRead) {
@@ -141,20 +157,20 @@ async function copyRegularFilePinned(params) {
                 }
                 await writeAll(destinationHandle, scratch, bytesRead);
             }
+            // Re-check the opened source before the staged tree can be committed. If
+            // it changed while we copied, the caller should retry the move.
+            const finalSourceStat = await sourceHandle.stat();
+            if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
+                throw hardlinkedSourceError(params.from);
+            }
+            if (!sameIdentity(params.identity, entryIdentity(finalSourceStat))) {
+                throw sourceChangedError(params.from);
+            }
+            await destinationHandle.chmod(modeBits(params.mode));
         }
         finally {
             await destinationHandle.close();
         }
-        // Re-check the opened handle before the staged tree can be committed. If
-        // the source changed while we copied, the caller should retry the move.
-        const finalSourceStat = await sourceHandle.stat();
-        if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
-            throw hardlinkedSourceError(params.from);
-        }
-        if (!sameIdentity(params.identity, entryIdentity(finalSourceStat))) {
-            throw sourceChangedError(params.from);
-        }
-        await fs.chmod(params.to, modeBits(params.mode)).catch(() => undefined);
     }
     catch (error) {
         if (destinationCreated) {
@@ -198,7 +214,7 @@ async function copyEntryWithManifest(from, to, options) {
         await assertSourceStillMatches(from, identity);
         // mkdir() honors process umask. Restore the source mode before commit so
         // EXDEV fallback preserves directory permissions like fs.cp did.
-        await fs.chmod(to, modeBits(sourceStat.mode));
+        await chmodDirectoryPinned(to, modeBits(sourceStat.mode));
         return { ...identity, children, kind: "directory" };
     }
     if (!sourceStat.isFile()) {
@@ -284,19 +300,42 @@ export async function movePathWithCopyFallback(options) {
     await assertCopyDestinationOutsideSource(sourcePath, targetPath);
     const targetDir = path.dirname(targetPath);
     const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
+    const unregisterStaged = registerTempPathForExit(staged, { recursive: true });
+    let stagedCommitted = false;
     try {
         const manifest = await copyEntryWithManifest(sourcePath, staged, {
             sourceHardlinks: options.sourceHardlinks ?? "allow",
             ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
         });
+        unregisterStaged.setIdentity(await fs.lstat(staged));
         await assertCopyDestinationOutsideSource(sourcePath, targetPath);
         await guardedRename({ from: staged, to: targetPath });
+        stagedCommitted = true;
+        unregisterStaged();
         const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest);
         if (cleanupResult === "stale") {
             throw sourceChangedError(sourcePath);
         }
     }
     finally {
-        await fs.rm(staged, { recursive: true, force: true }).catch(() => undefined);
+        if (!stagedCommitted) {
+            try {
+                const stagedIdentity = await fs.lstat(staged);
+                if (!stagedIdentity.isSymbolicLink())
+                    unregisterStaged.setIdentity(stagedIdentity);
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    unregisterStaged();
+                }
+            }
+            try {
+                await fs.rm(staged, { recursive: true, force: true });
+                unregisterStaged();
+            }
+            catch {
+                // Keep the identity-bound exit cleanup registered for a later retry.
+            }
+        }
     }
 }

package/dist/native-binding.d.ts

@@ -74,6 +74,7 @@ export interface NativeBinding {
     readArchiveEntryNative(path: string, kind: string, requested: string, maxBytes: number, maxEntries: number, maxMetaEntryBytes: number, signal: AbortSignal): Promise<Buffer>;
     readOwnerAndDacl(path: string): NativeWindowsSecurityFacts;
     renameNoReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
+    renameReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
     sha256File(fd: number): Promise<NativeFileHash>;
 }
 //# sourceMappingURL=native-binding.d.ts.map

package/dist/native-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD"}
+{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD"}

package/dist/native-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-operations.d.ts","sourceRoot":"","sources":["../src/native-operations.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E,CAAC;AA0CF,wBAAgB,oCAAoC,CAAC,MAAM,EAAE;IAC3D,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GAAG,IAAI,CAsBP;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CA6CvC;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE5D"}
+{"version":3,"file":"native-operations.d.ts","sourceRoot":"","sources":["../src/native-operations.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E,CAAC;AA0CF,wBAAgB,oCAAoC,CAAC,MAAM,EAAE;IAC3D,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GAAG,IAAI,CAsBP;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAyDvC;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE5D"}

package/dist/native-operations.js

@@ -72,7 +72,20 @@ export async function createNativeExclusiveFile(targetPath, mode) {
     let fd;
     let created;
     try {
-        const opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL));
+        let opened;
+        try {
+            opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL));
+        }
+        catch (error) {
+            // The parent open above and every post-create operation remain untagged.
+            // Only this exclusive-open failure has enough provenance for a caller to
+            // classify a Windows lock-file denial without swallowing setup failures.
+            const openError = error;
+            if (process.platform === "win32" && openError.code === "EPERM") {
+                openError.path = targetPath;
+            }
+            throw error;
+        }
         fd = opened.fd;
         fsSync.fchmodSync(fd, mode);
         created = fsSync.fstatSync(fd);

package/dist/native-pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiD7E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA4F3B"}
+{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiD7E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAsH3B"}

package/dist/native-pinned-write.js

@@ -9,23 +9,22 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-async function inputToBuffer(input, maxBytes) {
+async function writeNativeInput(fd, input, maxBytes) {
     if (input.kind === "buffer") {
         const data = typeof input.data === "string"
             ? Buffer.from(input.data, input.encoding ?? "utf8")
             : Buffer.from(input.data);
         assertWithinMaxBytes(data.byteLength, maxBytes);
-        return data;
+        writeNativeFd(fd, data);
+        return;
     }
-    const chunks = [];
     let bytes = 0;
     for await (const chunk of input.stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
         assertWithinMaxBytes(bytes, maxBytes);
-        chunks.push(buffer);
+        writeNativeFd(fd, buffer);
     }
-    return Buffer.concat(chunks, bytes);
 }
 function nativeOpenFlags(flags) {
     const closeOnExec = fsSync.constants.O_CLOEXEC;
@@ -37,7 +36,6 @@ function sameNativeIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino;
 }
 export async function runPinnedWriteNative(binding, params) {
-    const data = await inputToBuffer(params.input, params.maxBytes);
     const root = await fs.open(params.rootPath, fsSync.constants.O_RDONLY |
         (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
     let parentFd;
@@ -67,27 +65,56 @@ export async function runPinnedWriteNative(binding, params) {
             !sameNativeIdentity(parentPathStat, parentIdentity)) {
             throw new FsSafeError("path-mismatch", "native write parent changed during resolution");
         }
-        try {
-            await fs.lstat(path.join(parentPath, params.basename));
-            throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                throw error;
+        if (params.overwrite === false) {
+            try {
+                await fs.lstat(path.join(parentPath, params.basename));
+                throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
             }
         }
         tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
-        fsSync.fchmodSync(tempFd, params.mode || 0o600);
-        writeNativeFd(tempFd, data);
-        syncNativeFileBestEffort(tempFd);
         tempIdentity = fsSync.fstatSync(tempFd);
-        binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        // Creation is requested at 0600 in the binding, but a restrictive umask
+        // can remove owner access. Keep the unpublished inode private and
+        // reopenable until the published name has been identity-fenced.
+        fsSync.fchmodSync(tempFd, 0o600);
+        await writeNativeInput(tempFd, params.input, params.maxBytes);
+        syncNativeFileBestEffort(tempFd);
+        if (params.overwrite === false) {
+            binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        }
+        else {
+            binding.renameReplace(parentFd, tempName, parentFd, params.basename);
+        }
         renamed = true;
         targetFd = binding.openBeneath(parentFd, params.basename, nativeOpenFlags(fsSync.constants.O_RDONLY)).fd;
         const targetIdentity = binding.fstatIdentity(targetFd);
         if (!targetIdentity.isFile || !sameNativeIdentity(tempIdentity, targetIdentity)) {
             throw new FsSafeError("path-mismatch", "native write target changed after rename");
         }
+        // Native exclusive creation starts at 0600. Apply the requested mode only
+        // after reopening and fencing the published name, both so mode 000 stays
+        // verifiable and so broader modes are never exposed before that fence.
+        try {
+            fsSync.fchmodSync(targetFd, params.mode);
+            syncNativeFileBestEffort(targetFd);
+        }
+        catch (error) {
+            fsSync.closeSync(targetFd);
+            targetFd = undefined;
+            removeNativeCreatedFileIfStillPinned({
+                binding,
+                parentPath,
+                parentFd,
+                basename: params.basename,
+                created: tempIdentity,
+            });
+            throw error;
+        }
         syncNativeFileBestEffort(parentFd);
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }