@openclaw/fs-safe 0.5.6 → 0.7.0

package/dist/pinned-open.js

@@ -1,15 +1,12 @@
 import fs from "node:fs";
 import { isUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity as hasSameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 function isExpectedPathError(error) {
     const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
     return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
 }
-function sameFileIdentity(left, right) {
-    return hasSameFileIdentity(left, right);
-}
 export function openPinnedFileSync(params) {
     const ioFs = params.ioFs ?? fs;
     const allowedType = params.allowedType ?? "file";
@@ -29,53 +26,30 @@ export function openPinnedFileSync(params) {
         if (isUnsafeDeviceReadPath(realPath)) {
             return { ok: false, reason: "validation" };
         }
-        const preOpenStat = ioFs.lstatSync(realPath);
-        if (!isAllowedType(preOpenStat, allowedType)) {
-            return {
-                ok: false,
-                reason: "validation",
-                error: new FsSafeError("not-file", "path does not have the required file type"),
-            };
-        }
-        if (params.rejectHardlinks && preOpenStat.isFile() && preOpenStat.nlink > 1) {
-            return {
-                ok: false,
-                reason: "validation",
-                error: new FsSafeError("hardlink", "path must not be hardlinked"),
-            };
-        }
-        if (params.maxBytes !== undefined &&
-            preOpenStat.isFile() &&
-            preOpenStat.size > params.maxBytes) {
-            return { ok: false, reason: "validation" };
-        }
+        const preOpenStat = inspectFileIdentitySync(() => {
+            const stat = ioFs.lstatSync(realPath, { bigint: true });
+            assertAllowedStat(stat, allowedType, params);
+            return stat;
+        });
         fd = ioFs.openSync(realPath, openReadFlags);
         const openedStat = ioFs.fstatSync(fd);
-        if (!isAllowedType(openedStat, allowedType)) {
-            return {
-                ok: false,
-                reason: "validation",
-                error: new FsSafeError("not-file", "path does not have the required file type"),
-            };
-        }
-        if (params.rejectHardlinks && openedStat.isFile() && openedStat.nlink > 1) {
-            return {
-                ok: false,
-                reason: "validation",
-                error: new FsSafeError("hardlink", "path must not be hardlinked"),
-            };
-        }
-        if (params.maxBytes !== undefined && openedStat.isFile() && openedStat.size > params.maxBytes) {
-            return { ok: false, reason: "validation" };
-        }
-        if (!sameFileIdentity(preOpenStat, openedStat)) {
-            return { ok: false, reason: "validation" };
-        }
+        const identity = inspectFileIdentitySync(() => {
+            const stat = ioFs.fstatSync(fd, { bigint: true });
+            assertAllowedStat(stat, allowedType, params);
+            return stat;
+        }, preOpenStat);
+        inspectFileIdentitySync(() => {
+            const stat = ioFs.lstatSync(realPath, { bigint: true });
+            assertAllowedStat(stat, allowedType, params);
+            return stat;
+        }, identity);
         const opened = { ok: true, path: realPath, fd, stat: openedStat };
         fd = null;
         return opened;
     }
     catch (error) {
+        if (error instanceof FsSafeError)
+            return { ok: false, reason: "validation", error };
         if (isExpectedPathError(error)) {
             return { ok: false, reason: "path", error };
         }
@@ -87,9 +61,14 @@ export function openPinnedFileSync(params) {
         }
     }
 }
-function isAllowedType(stat, allowedType) {
-    if (allowedType === "directory") {
-        return stat.isDirectory();
+function assertAllowedStat(stat, allowedType, params) {
+    if (stat.isSymbolicLink() || !(allowedType === "directory" ? stat.isDirectory() : stat.isFile())) {
+        throw new FsSafeError("not-file", "path does not have the required file type");
+    }
+    if (params.rejectHardlinks && stat.isFile() && stat.nlink > 1n) {
+        throw new FsSafeError("hardlink", "path must not be hardlinked");
+    }
+    if (params.maxBytes !== undefined && stat.isFile() && stat.size > params.maxBytes) {
+        throw new FsSafeError("too-large", "file exceeds byte limit");
     }
-    return stat.isFile();
 }

package/dist/pinned-write.d.ts

@@ -1,4 +1,5 @@
 import type { Readable } from "node:stream";
+import { type AsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 export type PinnedWriteInput = {
     kind: "buffer";
@@ -10,6 +11,10 @@ export type PinnedWriteInput = {
 };
 export type RenameIdentityMismatchPolicy = "throw" | "verify-content";
 export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
+export type PublishedWriteIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+}>;
 export type PinnedWriteParams = {
     rootPath: string;
     relativeParentPath: string;
@@ -21,6 +26,7 @@ export type PinnedWriteParams = {
     input: PinnedWriteInput;
     rootIdentity?: FileIdentityStat;
     onRenameIdentityMismatch?: RenameIdentityMismatchPolicy;
+    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AsyncDirectoryGuard) => Promise<void>;
 };
 export declare function runPinnedWriteHelper(params: PinnedWriteParams): Promise<FileIdentityStat>;
 export declare function runPinnedWriteWithRenamePolicy(params: PinnedWriteParams & {

package/dist/pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAU3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAgEzC,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAEtE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;CACzD,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAe/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}
+{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAkE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAW3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAgEzC,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAEtE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;IAExD,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,mBAAmB,KAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/dist/pinned-write.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { normalizeMaxBytes } from "./byte-budget.js";
 import { createAsyncDirectoryGuard, createNearestExistingDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { syncDirectoryBestEffort } from "./fsync.js";
@@ -11,6 +12,7 @@ import { mkdirPathComponentsWithGuards } from "./guarded-mkdir.js";
 import { runPinnedWriteNative } from "./native-pinned-write.js";
 import { getNativeBinding } from "./native.js";
 import { validatePinnedOperationPayload } from "./pinned-operation.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { withSidecarLock } from "./sidecar-lock.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 function byteLength(input, encoding) {
@@ -59,20 +61,21 @@ async function writeStreamToHandle(stream, handle, maxBytes) {
     }
 }
 export async function runPinnedWriteHelper(params) {
+    const normalizedParams = { ...params, maxBytes: normalizeMaxBytes(params.maxBytes) };
     assertSafeBasename(params.basename);
     validatePinnedOperationPayload({
         relativeParentPath: params.relativeParentPath,
     });
     // The explicit compatibility policy uses the guarded Node fallback, where
     // content verification can replace the strict post-rename inode check.
-    if (params.onRenameIdentityMismatch === "verify-content") {
-        return await runPinnedWriteFallback(params);
+    if (normalizedParams.onRenameIdentityMismatch === "verify-content") {
+        return await runPinnedWriteFallback(normalizedParams);
     }
     const native = getNativeBinding();
     if (native) {
-        return await runPinnedWriteNative(native, params);
+        return await runPinnedWriteNative(native, normalizedParams);
     }
-    return await runPinnedWriteFallback(params);
+    return await runPinnedWriteFallback(normalizedParams);
 }
 export async function runPinnedWriteWithRenamePolicy(params) {
     const { targetPath, renameIdentity, ...writeParams } = params;
@@ -115,7 +118,7 @@ async function runPinnedWriteFallback(params) {
         : await createNearestExistingDirectoryGuard(params.rootPath, parentPath);
     const targetPath = path.join(parentPath, params.basename);
     if (params.overwrite === false) {
-        let handle = await withAsyncDirectoryGuards([parentGuard], async () => await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode), {
+        const handle = await withAsyncDirectoryGuards([parentGuard], async () => await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode), {
             onPostGuardFailure: async (openedHandle) => {
                 // The parent failed verification, so targetPath may now resolve
                 // somewhere else. Close the fd, but do not clean up by path.
@@ -124,6 +127,7 @@ async function runPinnedWriteFallback(params) {
         });
         let created = true;
         try {
+            const verificationIdentity = await handle.stat({ bigint: true });
             await handle.chmod(params.mode);
             if (params.input.kind === "buffer") {
                 assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
@@ -139,9 +143,10 @@ async function runPinnedWriteFallback(params) {
             }
             await syncFileBestEffort(handle);
             const stat = await handle.stat();
-            await handle.close().catch(() => undefined);
             await syncDirectoryBestEffort(parentPath);
+            // Publication is complete. A failed outer check must not remove its target.
             created = false;
+            await params.verifyPublished?.(handle.fd, verificationIdentity, parentGuard);
             return { dev: stat.dev, ino: stat.ino };
         }
         finally {
@@ -160,10 +165,11 @@ async function runPinnedWriteFallback(params) {
             : 0);
     let handle;
     let tempStat;
-    let targetStat;
+    let readHandle;
     let renamed = false;
     try {
         handle = await fs.open(tempPath, tempFlags, params.mode);
+        let verificationIdentity = await handle.stat({ bigint: true });
         await handle.chmod(params.mode);
         if (params.input.kind === "buffer") {
             assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
@@ -184,14 +190,13 @@ async function runPinnedWriteFallback(params) {
         }
         const expectedTempStat = tempStat;
         await syncFileBestEffort(handle);
-        await handle.close().catch(() => undefined);
-        handle = undefined;
+        let verifiedIdentity = expectedTempStat;
         await withAsyncDirectoryGuards([parentGuard], async () => {
             await fs.rename(tempPath, targetPath);
             renamed = true;
             await getFsSafeTestHooks()?.afterPinnedWriteFallbackRename?.(targetPath);
             await syncDirectoryBestEffort(parentPath);
-            targetStat = await fs.lstat(targetPath);
+            const targetStat = await fs.lstat(targetPath);
             if (targetStat.isSymbolicLink()) {
                 throw new FsSafeError("path-mismatch", "fallback target changed during write");
             }
@@ -207,42 +212,26 @@ async function runPinnedWriteFallback(params) {
                     throw new FsSafeError("path-mismatch", "fallback target changed during write");
                 }
                 const expectedHash = sha256Hex(params.input.data, params.input.encoding);
-                const readFlags = fsSync.constants.O_RDONLY |
-                    (process.platform !== "win32" && "O_NOFOLLOW" in fsSync.constants
-                        ? fsSync.constants.O_NOFOLLOW
-                        : 0);
-                const readHandle = await fs.open(targetPath, readFlags);
-                let actualHash;
-                let readHandleStat;
-                try {
-                    // Capture fd-based identity before reading — this is stable across all
-                    // subsequent lookups (on FUSE and locally), unlike the lstat-based
-                    // targetStat that triggered this fallback.
-                    readHandleStat = await readHandle.stat();
-                    actualHash = sha256Hex(await readHandle.readFile());
-                }
-                finally {
-                    await readHandle.close().catch(() => undefined);
-                }
+                readHandle = await fs.open(targetPath, resolveReadOpenFlags());
+                const readHandleStat = await readHandle.stat({ bigint: true });
+                const actualHash = sha256Hex(await readHandle.readFile());
                 if (actualHash !== expectedHash) {
                     throw new FsSafeError("path-mismatch", "fallback target changed during write");
                 }
-                // Replace the unreliable lstat-based targetStat with the fd-based stat so
-                // the returned identity is consistent with what subsequent verifications
-                // (e.g. verifyAtomicWriteResult) will obtain by opening the same file.
-                targetStat = readHandleStat;
+                // The content-verified destination, not the old temp inode, is now pinned.
+                verificationIdentity = readHandleStat;
+                // Preserve the helper's legacy numeric return facts, not the private proof.
+                verifiedIdentity = { dev: Number(readHandleStat.dev), ino: Number(readHandleStat.ino) };
             }
         });
+        await params.verifyPublished?.((readHandle ?? handle).fd, verificationIdentity, parentGuard);
+        return { dev: verifiedIdentity.dev, ino: verifiedIdentity.ino };
     }
-    catch (error) {
+    finally {
+        await readHandle?.close().catch(() => undefined);
         await handle?.close().catch(() => undefined);
         if (!renamed) {
             await fs.rm(tempPath, { force: true }).catch(() => undefined);
         }
-        throw error;
-    }
-    if (!targetStat) {
-        throw new FsSafeError("path-mismatch", "fallback target was not verified");
     }
-    return { dev: targetStat.dev, ino: targetStat.ino };
 }

package/dist/private-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-directory.d.ts","sourceRoot":"","sources":["../src/private-directory.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,IAAI,CAAC,CAiBf"}
+{"version":3,"file":"private-directory.d.ts","sourceRoot":"","sources":["../src/private-directory.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/private-directory.js

@@ -3,11 +3,12 @@ import { getNativeBinding } from "./native.js";
 export async function createPrivateDirectory(targetPath, options) {
     const platform = options?.platform ?? process.platform;
     if (platform !== "win32") {
-        throw new FsSafeError("helper-unavailable", "private-directory creation is available only on Windows through the bundled native binding");
+        throw new FsSafeError("helper-unavailable", "private-directory creation is supported only on Windows");
     }
     const native = getNativeBinding();
     if (!native) {
-        throw new FsSafeError("helper-unavailable", "private Windows directory creation requires the bundled native binding");
+        throw new FsSafeError("helper-unavailable", "private Windows directory creation requires the matching optional native platform package; " +
+            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
     }
     native.createPrivateDirectory(targetPath);
 }

package/dist/private-temp-workspace.d.ts

@@ -1,11 +1,13 @@
 import { type FileStore, type FileStoreSync } from "./file-store.js";
 import { type TempPathIdentityReceipt } from "./temp-cleanup.js";
-export type TempWorkspaceCleanupResult = "removed" | "missing" | "identity-mismatch";
+import { type TempWorkspaceCleanupResult, type TempWorkspaceCleanupSafety } from "./temp-workspace-owner.js";
+export type { TempWorkspaceCleanupResult, TempWorkspaceCleanupSafety, } from "./temp-workspace-owner.js";
 export type TempWorkspaceOptions = {
     rootDir: string;
     prefix: string;
     dirMode?: number;
     mode?: number;
+    cleanupSafety?: TempWorkspaceCleanupSafety;
 };
 export type TempWorkspace = {
     dir: string;

package/dist/private-temp-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAErF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA+KF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CA8EnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}
+{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AAuKF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}

package/dist/private-temp-workspace.js

@@ -4,11 +4,18 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileStore, fileStoreSync, } from "./file-store.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { isNotFoundPathError } from "./path.js";
 import { throwFsSafeReadError } from "./read-error.js";
 import { matchRootFileOpenFailure, openRootFileSync, } from "./root-file.js";
 import { registerTempPathForExit, } from "./temp-cleanup.js";
+import { TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner, } from "./temp-workspace-owner.js";
+function resolveTempWorkspaceCleanupSafety(value) {
+    if (value === undefined || value === "compatible")
+        return "compatible";
+    if (value === "require-bounded")
+        return value;
+    throw new TypeError("cleanupSafety must be compatible or require-bounded");
+}
 function sanitizeTempPrefix(prefix) {
     const sanitized = prefix.trim().replace(/[^a-zA-Z0-9._-]/g, "-");
     if (!sanitized || sanitized === "." || sanitized === "..") {
@@ -79,52 +86,47 @@ function ensurePrivateDirectorySync(dir, mode) {
         // Best-effort on platforms that do not enforce POSIX modes.
     }
 }
-async function cleanupWorkspace(dir, identity) {
-    let current;
-    try {
-        current = await fs.lstat(dir, { bigint: true });
-    }
-    catch (error) {
-        return error.code === "ENOENT" ? "missing" : "identity-mismatch";
-    }
-    if (!sameFileIdentityForCleanup(current, identity)) {
-        return "identity-mismatch";
-    }
-    await fs.rm(dir, { recursive: true, force: true });
-    return "removed";
-}
-function cleanupWorkspaceSync(dir, identity) {
-    let current;
-    try {
-        current = fsSync.lstatSync(dir, { bigint: true });
-    }
-    catch (error) {
-        return error.code === "ENOENT" ? "missing" : "identity-mismatch";
-    }
-    if (!sameFileIdentityForCleanup(current, identity)) {
-        return "identity-mismatch";
-    }
-    fsSync.rmSync(dir, { recursive: true, force: true });
-    return "removed";
-}
 async function createTempWorkspace(options) {
     const dirMode = options.dirMode ?? 0o700;
     const mode = options.mode ?? 0o600;
+    const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
     const requestedRoot = path.resolve(options.rootDir);
     const root = await fs.realpath(requestedRoot).catch(() => requestedRoot);
     await ensurePrivateDirectory(root, dirMode);
-    const dir = await fs.mkdtemp(path.join(root, sanitizeTempPrefix(options.prefix)));
-    await fs.chmod(dir, dirMode).catch(() => undefined);
-    const stat = await fs.lstat(dir, { bigint: true });
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new Error(`Temp workspace must be a directory: ${dir}`);
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    let dir;
+    let stat;
+    let cleanupOwner;
+    let unregisterTempDir;
+    try {
+        dir = await fs.mkdtemp(path.join(root, sanitizeTempPrefix(options.prefix)));
+        await fs.chmod(dir, dirMode).catch(() => undefined);
+        stat = await fs.lstat(dir, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Temp workspace must be a directory: ${dir}`);
+        }
+        if (capability.parent)
+            capability.assertCurrent();
+        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        unregisterTempDir = registerTempPathForExit(dir, {
+            cleanupSync: () => cleanupOwner.cleanupSync(),
+        });
     }
+    catch (error) {
+        try {
+            if (cleanupOwner)
+                cleanupOwner.cleanupSync();
+            else
+                capability.close();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
+        }
+        throw error;
+    }
+    const owner = cleanupOwner;
     const identity = { dev: Number(stat.dev), ino: Number(stat.ino) };
-    const cleanupIdentity = { dev: stat.dev, ino: stat.ino };
-    const unregisterTempDir = registerTempPathForExit(dir, {
-        recursive: true,
-        identity: cleanupIdentity,
-    });
+    // Once registered, even a store-construction failure remains exit-cleanable.
     const store = fileStore({ rootDir: dir, private: true, dirMode, mode });
     return {
         dir,
@@ -148,7 +150,7 @@ async function createTempWorkspace(options) {
         },
         cleanup: async () => {
             try {
-                return await cleanupWorkspace(dir, cleanupIdentity);
+                return await owner.cleanup();
             }
             finally {
                 unregisterTempDir();
@@ -156,7 +158,7 @@ async function createTempWorkspace(options) {
         },
         [Symbol.asyncDispose]: async () => {
             try {
-                await cleanupWorkspace(dir, cleanupIdentity);
+                await owner.cleanup();
             }
             finally {
                 unregisterTempDir();
@@ -182,6 +184,7 @@ export async function withTempWorkspace(options, run) {
 export function tempWorkspaceSync(options) {
     const dirMode = options.dirMode ?? 0o700;
     const mode = options.mode ?? 0o600;
+    const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
     const requestedRoot = path.resolve(options.rootDir);
     let root = requestedRoot;
     try {
@@ -191,23 +194,45 @@ export function tempWorkspaceSync(options) {
         root = requestedRoot;
     }
     ensurePrivateDirectorySync(root, dirMode);
-    const dir = fsSync.mkdtempSync(path.join(root, sanitizeTempPrefix(options.prefix)));
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    let dir;
+    let stat;
+    let cleanupOwner;
+    let unregisterTempDir;
     try {
-        fsSync.chmodSync(dir, dirMode);
+        dir = fsSync.mkdtempSync(path.join(root, sanitizeTempPrefix(options.prefix)));
+        try {
+            fsSync.chmodSync(dir, dirMode);
+        }
+        catch {
+            // Best-effort on platforms that do not enforce POSIX modes.
+        }
+        stat = fsSync.lstatSync(dir, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Temp workspace must be a directory: ${dir}`);
+        }
+        if (capability.parent)
+            capability.assertCurrent();
+        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        unregisterTempDir = registerTempPathForExit(dir, {
+            cleanupSync: () => cleanupOwner.cleanupSync(),
+        });
     }
-    catch {
-        // Best-effort on platforms that do not enforce POSIX modes.
-    }
-    const stat = fsSync.lstatSync(dir, { bigint: true });
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new Error(`Temp workspace must be a directory: ${dir}`);
+    catch (error) {
+        try {
+            if (cleanupOwner)
+                cleanupOwner.cleanupSync();
+            else
+                capability.close();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
+        }
+        throw error;
     }
+    const owner = cleanupOwner;
     const identity = { dev: Number(stat.dev), ino: Number(stat.ino) };
-    const cleanupIdentity = { dev: stat.dev, ino: stat.ino };
-    const unregisterTempDir = registerTempPathForExit(dir, {
-        recursive: true,
-        identity: cleanupIdentity,
-    });
+    // Once registered, even a store-construction failure remains exit-cleanable.
     const store = fileStoreSync({ rootDir: dir, private: true, dirMode, mode });
     return {
         dir,
@@ -244,7 +269,7 @@ export function tempWorkspaceSync(options) {
         },
         cleanup: () => {
             try {
-                return cleanupWorkspaceSync(dir, cleanupIdentity);
+                return owner.cleanupSync();
             }
             finally {
                 unregisterTempDir();
@@ -252,7 +277,7 @@ export function tempWorkspaceSync(options) {
         },
         [Symbol.dispose]: () => {
             try {
-                cleanupWorkspaceSync(dir, cleanupIdentity);
+                owner.cleanupSync();
             }
             finally {
                 unregisterTempDir();

package/dist/publish-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA2ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}
+{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AAsND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}

package/dist/publish-file.js

@@ -8,6 +8,7 @@ import { hashFileHandle } from "./file-hash.js";
 import { sameFileIdentity, sameFileIdentityForCleanup, } from "./file-identity.js";
 import { syncNativeFileBestEffort } from "./native-operations.js";
 import { getNativeBinding, requireNativeBinding } from "./native.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { directorySyncFailure, publicationFailure, rememberCreatedTarget, } from "./publish-file-failure.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 const HARDLINK_FALLBACK_CODES = new Set([
@@ -29,10 +30,7 @@ export function isHardlinkFallbackError(error) {
     return HARDLINK_FALLBACK_CODES.has(error?.code ?? "");
 }
 function sourceOpenFlags() {
-    return (fsSync.constants.O_RDONLY |
-        (process.platform !== "win32" && typeof fsSync.constants.O_NOFOLLOW === "number"
-            ? fsSync.constants.O_NOFOLLOW
-            : 0));
+    return resolveReadOpenFlags();
 }
 function directoryOpenFlags() {
     return (fsSync.constants.O_RDONLY |

package/dist/read-opened-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-opened-file.d.ts","sourceRoot":"","sources":["../src/read-opened-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBtB"}
+{"version":3,"file":"read-opened-file.d.ts","sourceRoot":"","sources":["../src/read-opened-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBtB"}

package/dist/read-opened-file.js

@@ -1,12 +1,14 @@
+import { normalizeMaxBytes } from "./byte-budget.js";
 import { readFileHandleBounded } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
 export async function readOpenedFileSafely(params) {
-    if (params.maxBytes !== undefined && params.opened.stat.size > params.maxBytes) {
-        throw new FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${params.opened.stat.size})`);
+    const maxBytes = normalizeMaxBytes(params.maxBytes);
+    if (maxBytes !== undefined && params.opened.stat.size > maxBytes) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got ${params.opened.stat.size})`);
     }
-    const buffer = params.maxBytes === undefined
+    const buffer = maxBytes === undefined
         ? await params.opened.handle.readFile()
-        : await readFileHandleBounded(params.opened.handle, params.maxBytes);
+        : await readFileHandleBounded(params.opened.handle, maxBytes);
     return {
         buffer,
         containment: params.opened.containment,

package/dist/regular-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAY7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AAaD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAyD3C;AA6DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CA6BA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA2D7E"}
+{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,MAAM,MAAM,SAAS,CAAC;AAc7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AAaD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA6D3C;AA2DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAoCA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwExF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAyE7E"}