@openclaw/fs-safe 0.5.1 → 0.5.3

package/dist/local-roots.js

@@ -2,11 +2,11 @@ import fsSync from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { expandHomePrefix, resolveUserPath } from "./home-dir.js";
-import { safeFileURLToPath } from "./local-file-access.js";
+import { isFileUrl, safeFileURLToPath } from "./local-file-access.js";
 import { isPathInside } from "./path.js";
 import { root } from "./root.js";
 function resolveLocalPathInput(input, label) {
-    if (input.startsWith("file://")) {
+    if (isFileUrl(input)) {
         try {
             return safeFileURLToPath(input);
         }
@@ -25,7 +25,7 @@ function resolveLocalRootInput(input, label) {
     if (!trimmed) {
         throw new FsSafeError("invalid-path", `${label} entry is required`);
     }
-    const resolved = trimmed.startsWith("file://")
+    const resolved = isFileUrl(trimmed)
         ? resolveLocalPathInput(trimmed, label)
         : expandHomePrefix(trimmed);
     if (resolved.includes("\0")) {
@@ -41,7 +41,9 @@ function isPathInsideRoot(candidate, rootDir) {
 }
 function resolveRootRealSync(rootDir) {
     try {
-        const stat = fsSync.lstatSync(rootDir);
+        // Configured roots may themselves be symlinks. Follow only this trusted
+        // root entry, then use its canonical directory for containment checks.
+        const stat = fsSync.statSync(rootDir);
         if (!stat.isDirectory()) {
             return null;
         }
@@ -101,8 +103,8 @@ function resolveCandidateCanonicalSync(filePath) {
 export function resolveLocalPathFromRootsSync(options) {
     const label = options.label ?? "local roots";
     const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
-    for (const rootEntry of options.roots) {
-        const rootDir = resolveLocalRootInput(rootEntry, label);
+    const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    for (const rootDir of rootDirs) {
         const rootReal = resolveRootRealSync(rootDir);
         if (!rootReal) {
             continue;
@@ -129,8 +131,8 @@ export function resolveLocalPathFromRootsSync(options) {
 export async function readLocalFileFromRoots(options) {
     const label = options.label ?? "local roots";
     const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
-    for (const rootEntry of options.roots) {
-        const rootDir = resolveLocalRootInput(rootEntry, label);
+    const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    for (const rootDir of rootDirs) {
         let scopedRoot;
         try {
             scopedRoot = await root(rootDir);
@@ -138,29 +140,32 @@ export async function readLocalFileFromRoots(options) {
         catch {
             continue;
         }
-        const relativePath = path.relative(scopedRoot.rootDir, requestedPath);
-        if (!relativePath ||
-            relativePath === ".." ||
-            relativePath.startsWith(`..${path.sep}`) ||
-            path.isAbsolute(relativePath)) {
-            continue;
-        }
-        try {
-            const readOptions = {
-                hardlinks: options.hardlinks,
-                nonBlockingRead: options.nonBlockingRead,
-                symlinks: options.symlinks,
-            };
-            // Leave maxBytes absent when the caller omits it so Root's own default
-            // cap remains in force instead of being overwritten by undefined.
-            if (options.maxBytes !== undefined) {
-                readOptions.maxBytes = options.maxBytes;
+        const readOptions = {
+            hardlinks: options.hardlinks,
+            nonBlockingRead: options.nonBlockingRead,
+            symlinks: options.symlinks,
+        };
+        // Leave maxBytes absent when the caller omits it so Root's own default
+        // cap remains in force instead of being overwritten by undefined.
+        if (options.maxBytes !== undefined) {
+            readOptions.maxBytes = options.maxBytes;
+        }
+        // A trusted root symlink has two valid spellings. Preserve the caller's
+        // lexical spelling when possible so Root.read() still enforces its
+        // symlink policy, while also accepting a path expressed below rootReal.
+        const relativePaths = [scopedRoot.rootDir, scopedRoot.rootReal]
+            .filter((rootPath, index, roots) => roots.indexOf(rootPath) === index)
+            .filter((rootPath) => isPathInside(rootPath, requestedPath))
+            .map((rootPath) => path.relative(rootPath, requestedPath))
+            .filter(Boolean);
+        for (const relativePath of relativePaths) {
+            try {
+                const result = await scopedRoot.read(relativePath, readOptions);
+                return { ...result, root: scopedRoot.rootReal };
+            }
+            catch {
+                // Try the canonical spelling before moving to the next configured root.
             }
-            const result = await scopedRoot.read(relativePath, readOptions);
-            return { ...result, root: scopedRoot.rootReal };
-        }
-        catch {
-            continue;
         }
     }
     return null;

package/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA4UD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAuCf"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA6VD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/move-path.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { guardedRename } from "./guarded-mutation.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
 export function moveCopyFallbackReasonForRenameError(error, platform = process.platform) {
     const code = error?.code;
     if (code === "EXDEV") {
@@ -102,6 +103,21 @@ function regularReadFlags() {
             ? fsConstants.O_NONBLOCK
             : 0));
 }
+async function chmodDirectoryPinned(directoryPath, mode) {
+    if (process.platform === "win32") {
+        // Node cannot portably open a Windows directory for descriptor-bound
+        // chmod. POSIX modes are not enforced there, so do not fall back to a
+        // pathname operation that could follow a replacement symlink.
+        return;
+    }
+    const handle = await fs.open(directoryPath, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+    try {
+        await handle.chmod(mode);
+    }
+    finally {
+        await handle.close();
+    }
+}
 async function writeAll(handle, buffer, bytesRead) {
     let offset = 0;
     while (offset < bytesRead) {
@@ -141,20 +157,20 @@ async function copyRegularFilePinned(params) {
                 }
                 await writeAll(destinationHandle, scratch, bytesRead);
             }
+            // Re-check the opened source before the staged tree can be committed. If
+            // it changed while we copied, the caller should retry the move.
+            const finalSourceStat = await sourceHandle.stat();
+            if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
+                throw hardlinkedSourceError(params.from);
+            }
+            if (!sameIdentity(params.identity, entryIdentity(finalSourceStat))) {
+                throw sourceChangedError(params.from);
+            }
+            await destinationHandle.chmod(modeBits(params.mode));
         }
         finally {
             await destinationHandle.close();
         }
-        // Re-check the opened handle before the staged tree can be committed. If
-        // the source changed while we copied, the caller should retry the move.
-        const finalSourceStat = await sourceHandle.stat();
-        if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
-            throw hardlinkedSourceError(params.from);
-        }
-        if (!sameIdentity(params.identity, entryIdentity(finalSourceStat))) {
-            throw sourceChangedError(params.from);
-        }
-        await fs.chmod(params.to, modeBits(params.mode)).catch(() => undefined);
     }
     catch (error) {
         if (destinationCreated) {
@@ -198,7 +214,7 @@ async function copyEntryWithManifest(from, to, options) {
         await assertSourceStillMatches(from, identity);
         // mkdir() honors process umask. Restore the source mode before commit so
         // EXDEV fallback preserves directory permissions like fs.cp did.
-        await fs.chmod(to, modeBits(sourceStat.mode));
+        await chmodDirectoryPinned(to, modeBits(sourceStat.mode));
         return { ...identity, children, kind: "directory" };
     }
     if (!sourceStat.isFile()) {
@@ -284,19 +300,42 @@ export async function movePathWithCopyFallback(options) {
     await assertCopyDestinationOutsideSource(sourcePath, targetPath);
     const targetDir = path.dirname(targetPath);
     const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
+    const unregisterStaged = registerTempPathForExit(staged, { recursive: true });
+    let stagedCommitted = false;
     try {
         const manifest = await copyEntryWithManifest(sourcePath, staged, {
             sourceHardlinks: options.sourceHardlinks ?? "allow",
             ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
         });
+        unregisterStaged.setIdentity(await fs.lstat(staged));
         await assertCopyDestinationOutsideSource(sourcePath, targetPath);
         await guardedRename({ from: staged, to: targetPath });
+        stagedCommitted = true;
+        unregisterStaged();
         const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest);
         if (cleanupResult === "stale") {
             throw sourceChangedError(sourcePath);
         }
     }
     finally {
-        await fs.rm(staged, { recursive: true, force: true }).catch(() => undefined);
+        if (!stagedCommitted) {
+            try {
+                const stagedIdentity = await fs.lstat(staged);
+                if (!stagedIdentity.isSymbolicLink())
+                    unregisterStaged.setIdentity(stagedIdentity);
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    unregisterStaged();
+                }
+            }
+            try {
+                await fs.rm(staged, { recursive: true, force: true });
+                unregisterStaged();
+            }
+            catch {
+                // Keep the identity-bound exit cleanup registered for a later retry.
+            }
+        }
     }
 }

package/dist/native-binding.d.ts

@@ -74,6 +74,7 @@ export interface NativeBinding {
     readArchiveEntryNative(path: string, kind: string, requested: string, maxBytes: number, maxEntries: number, maxMetaEntryBytes: number, signal: AbortSignal): Promise<Buffer>;
     readOwnerAndDacl(path: string): NativeWindowsSecurityFacts;
     renameNoReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
+    renameReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
     sha256File(fd: number): Promise<NativeFileHash>;
 }
 //# sourceMappingURL=native-binding.d.ts.map

package/dist/native-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD"}
+{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD"}

package/dist/native-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-operations.d.ts","sourceRoot":"","sources":["../src/native-operations.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E,CAAC;AA0CF,wBAAgB,oCAAoC,CAAC,MAAM,EAAE;IAC3D,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GAAG,IAAI,CAsBP;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CA6CvC;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE5D"}
+{"version":3,"file":"native-operations.d.ts","sourceRoot":"","sources":["../src/native-operations.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E,CAAC;AA0CF,wBAAgB,oCAAoC,CAAC,MAAM,EAAE;IAC3D,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GAAG,IAAI,CAsBP;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAyDvC;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE5D"}

package/dist/native-operations.js

@@ -72,7 +72,20 @@ export async function createNativeExclusiveFile(targetPath, mode) {
     let fd;
     let created;
     try {
-        const opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL));
+        let opened;
+        try {
+            opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL));
+        }
+        catch (error) {
+            // The parent open above and every post-create operation remain untagged.
+            // Only this exclusive-open failure has enough provenance for a caller to
+            // classify a Windows lock-file denial without swallowing setup failures.
+            const openError = error;
+            if (process.platform === "win32" && openError.code === "EPERM") {
+                openError.path = targetPath;
+            }
+            throw error;
+        }
         fd = opened.fd;
         fsSync.fchmodSync(fd, mode);
         created = fsSync.fstatSync(fd);

package/dist/native-pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiD7E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA4F3B"}
+{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiD7E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAsH3B"}

package/dist/native-pinned-write.js

@@ -9,23 +9,22 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-async function inputToBuffer(input, maxBytes) {
+async function writeNativeInput(fd, input, maxBytes) {
     if (input.kind === "buffer") {
         const data = typeof input.data === "string"
             ? Buffer.from(input.data, input.encoding ?? "utf8")
             : Buffer.from(input.data);
         assertWithinMaxBytes(data.byteLength, maxBytes);
-        return data;
+        writeNativeFd(fd, data);
+        return;
     }
-    const chunks = [];
     let bytes = 0;
     for await (const chunk of input.stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
         assertWithinMaxBytes(bytes, maxBytes);
-        chunks.push(buffer);
+        writeNativeFd(fd, buffer);
     }
-    return Buffer.concat(chunks, bytes);
 }
 function nativeOpenFlags(flags) {
     const closeOnExec = fsSync.constants.O_CLOEXEC;
@@ -37,7 +36,6 @@ function sameNativeIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino;
 }
 export async function runPinnedWriteNative(binding, params) {
-    const data = await inputToBuffer(params.input, params.maxBytes);
     const root = await fs.open(params.rootPath, fsSync.constants.O_RDONLY |
         (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
     let parentFd;
@@ -67,27 +65,56 @@ export async function runPinnedWriteNative(binding, params) {
             !sameNativeIdentity(parentPathStat, parentIdentity)) {
             throw new FsSafeError("path-mismatch", "native write parent changed during resolution");
         }
-        try {
-            await fs.lstat(path.join(parentPath, params.basename));
-            throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                throw error;
+        if (params.overwrite === false) {
+            try {
+                await fs.lstat(path.join(parentPath, params.basename));
+                throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
             }
         }
         tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
-        fsSync.fchmodSync(tempFd, params.mode || 0o600);
-        writeNativeFd(tempFd, data);
-        syncNativeFileBestEffort(tempFd);
         tempIdentity = fsSync.fstatSync(tempFd);
-        binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        // Creation is requested at 0600 in the binding, but a restrictive umask
+        // can remove owner access. Keep the unpublished inode private and
+        // reopenable until the published name has been identity-fenced.
+        fsSync.fchmodSync(tempFd, 0o600);
+        await writeNativeInput(tempFd, params.input, params.maxBytes);
+        syncNativeFileBestEffort(tempFd);
+        if (params.overwrite === false) {
+            binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        }
+        else {
+            binding.renameReplace(parentFd, tempName, parentFd, params.basename);
+        }
         renamed = true;
         targetFd = binding.openBeneath(parentFd, params.basename, nativeOpenFlags(fsSync.constants.O_RDONLY)).fd;
         const targetIdentity = binding.fstatIdentity(targetFd);
         if (!targetIdentity.isFile || !sameNativeIdentity(tempIdentity, targetIdentity)) {
             throw new FsSafeError("path-mismatch", "native write target changed after rename");
         }
+        // Native exclusive creation starts at 0600. Apply the requested mode only
+        // after reopening and fencing the published name, both so mode 000 stays
+        // verifiable and so broader modes are never exposed before that fence.
+        try {
+            fsSync.fchmodSync(targetFd, params.mode);
+            syncNativeFileBestEffort(targetFd);
+        }
+        catch (error) {
+            fsSync.closeSync(targetFd);
+            targetFd = undefined;
+            removeNativeCreatedFileIfStillPinned({
+                binding,
+                parentPath,
+                parentFd,
+                basename: params.basename,
+                created: tempIdentity,
+            });
+            throw error;
+        }
         syncNativeFileBestEffort(parentFd);
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }

package/dist/output-sibling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output-sibling.d.ts","sourceRoot":"","sources":["../src/output-sibling.ts"],"names":[],"mappings":"AAgGA,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Cb"}
+{"version":3,"file":"output-sibling.d.ts","sourceRoot":"","sources":["../src/output-sibling.ts"],"names":[],"mappings":"AA+FA,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CA8Cb"}

package/dist/output-sibling.js

@@ -66,11 +66,10 @@ async function cleanupTempPath(tempPath, identity) {
         if (!identity || (!current.isSymbolicLink() && sameFileIdentity(current, identity))) {
             await fs.rm(tempPath, { force: true });
         }
+        return true;
     }
     catch (error) {
-        if (error.code !== "ENOENT") {
-            // Cleanup is best-effort; the randomized path remains inside the writable boundary.
-        }
+        return error.code === "ENOENT";
     }
 }
 export async function writeExternalFileViaSibling(params) {
@@ -114,9 +113,11 @@ export async function writeExternalFileViaSibling(params) {
         return result;
     }
     finally {
+        let cleanupComplete = renamed;
         if (!renamed) {
-            await cleanupTempPath(tempPath, stagedIdentity);
+            cleanupComplete = await cleanupTempPath(tempPath, stagedIdentity);
         }
-        unregisterTempPath();
+        if (cleanupComplete)
+            unregisterTempPath();
     }
 }

package/dist/path-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}

package/dist/path-policy.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import { ROOT_PATH_ALIAS_POLICIES, resolveRootPath, } from "./root-path.js";
 import { isNotFoundPathError } from "./path.js";
+import { shortPath } from "./short-path.js";
 export const PATH_ALIAS_POLICIES = ROOT_PATH_ALIAS_POLICIES;
 export async function assertNoPathAliasEscape(params) {
     const resolved = await resolveRootPath({
@@ -42,9 +42,3 @@ export async function assertNoHardlinkedFinalPath(params) {
         throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${shortPath(params.root)}): ${shortPath(params.filePath)}`);
     }
 }
-function shortPath(value) {
-    if (value.startsWith(os.homedir())) {
-        return `~${value.slice(os.homedir().length)}`;
-    }
-    return value;
-}

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAKzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA4BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAMzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA4BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}

package/dist/path.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
+import { isDriveRelativePath } from "./safe-path-segment.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
@@ -119,6 +120,9 @@ export function splitSafeRelativePath(relativePath) {
         if (segment === "..") {
             throw new FsSafeError("invalid-path", "relative path must not contain '..'");
         }
+        if (isDriveRelativePath(segment)) {
+            throw new FsSafeError("invalid-path", "relative path must not contain a drive letter");
+        }
     }
     return segments;
 }

package/dist/permission-exec.d.ts

@@ -0,0 +1,6 @@
+export declare const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30000;
+export declare function executePermissionCommand(command: string, args: string[], timeoutMs?: number): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+//# sourceMappingURL=permission-exec.d.ts.map

package/dist/permission-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-exec.d.ts","sourceRoot":"","sources":["../src/permission-exec.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,SAAqC,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7C"}

package/dist/permission-exec.js

@@ -0,0 +1,28 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30_000;
+export async function executePermissionCommand(command, args, timeoutMs = DEFAULT_PERMISSION_EXEC_TIMEOUT_MS) {
+    try {
+        return (await execFileAsync(command, args, {
+            encoding: "utf8",
+            windowsHide: true,
+            maxBuffer: 1024 * 1024,
+            timeout: timeoutMs,
+            killSignal: "SIGKILL",
+        }));
+    }
+    catch (err) {
+        if (err &&
+            typeof err === "object" &&
+            "killed" in err &&
+            err.killed === true &&
+            "signal" in err &&
+            err.signal === "SIGKILL") {
+            throw new Error(`Windows permission inspection timed out after ${timeoutMs}ms`, {
+                cause: err,
+            });
+        }
+        throw err;
+    }
+}

package/dist/permissions-windows.d.ts

@@ -0,0 +1,56 @@
+import type { PermissionCheck, PermissionCheckOptions, SafeStatResult } from "./permissions.js";
+export type PermissionExec = (command: string, args: string[]) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export type WindowsAclEntry = {
+    principal: string;
+    /** Canonical principal SID when resolved from Windows. */
+    sid?: string;
+    rights: string[];
+    rawRights: string;
+    canRead: boolean;
+    canWrite: boolean;
+};
+export type WindowsAclSummary = {
+    ok: boolean;
+    entries: WindowsAclEntry[];
+    untrustedWorld: WindowsAclEntry[];
+    untrustedGroup: WindowsAclEntry[];
+    trusted: WindowsAclEntry[];
+    error?: string;
+};
+export type WindowsUserInfoProvider = () => {
+    username?: string | null;
+};
+export type IcaclsResetCommandOptions = {
+    isDir: boolean;
+    env?: NodeJS.ProcessEnv;
+    userInfo?: WindowsUserInfoProvider;
+};
+export declare function inspectWindowsPermissions(params: {
+    targetPath: string;
+    stat: SafeStatResult;
+    effectiveIsDir: boolean;
+    effectiveMode: number | null;
+    bits: number | null;
+    opts?: PermissionCheckOptions;
+}): Promise<PermissionCheck>;
+export declare function resolveWindowsUserPrincipal(env?: NodeJS.ProcessEnv, userInfo?: WindowsUserInfoProvider): string | null;
+export declare function parseIcaclsOutput(output: string, targetPath: string): WindowsAclEntry[];
+export declare function summarizeWindowsAcl(entries: WindowsAclEntry[], env?: NodeJS.ProcessEnv): Pick<WindowsAclSummary, "trusted" | "untrustedWorld" | "untrustedGroup">;
+export declare function inspectWindowsAcl(targetPath: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    exec?: PermissionExec;
+    currentUserSid?: string;
+    principalSids?: Record<string, string>;
+    principalTranslationFailed?: boolean;
+}): Promise<WindowsAclSummary>;
+export declare function formatWindowsAclSummary(summary: WindowsAclSummary): string;
+export declare function formatIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): string;
+export declare function createIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): {
+    command: string;
+    args: string[];
+    display: string;
+} | null;
+//# sourceMappingURL=permissions-windows.d.ts.map

package/dist/permissions-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAShG,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAYjK;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4BxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}