@openclaw/fs-safe 0.6.0 → 0.7.0

package/dist/replace-file-temp-owner.js

@@ -0,0 +1,346 @@
+import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
+const PUBLISHED_READ_FLAGS = syncFs.constants.O_RDONLY |
+    (process.platform !== "win32" && typeof syncFs.constants.O_NOFOLLOW === "number"
+        ? syncFs.constants.O_NOFOLLOW
+        : 0) |
+    (process.platform !== "win32" && typeof syncFs.constants.O_NONBLOCK === "number"
+        ? syncFs.constants.O_NONBLOCK
+        : 0);
+function assertOwnedFile(stat, pathname, pathnameEntry) {
+    if (stat.isSymbolicLink()) {
+        throw new FsSafeError("symlink", `Atomic replace owned file became a symlink: ${pathname}`);
+    }
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", `Atomic replace owned file must remain regular: ${pathname}`);
+    }
+    if (stat.nlink > 1n || (pathnameEntry && stat.nlink !== 1n)) {
+        throw new FsSafeError("hardlink", `Atomic replace owned file must retain one link: ${pathname}`);
+    }
+}
+function missingOwnedFile(pathname, cause) {
+    return new FsSafeError("path-mismatch", `Atomic replace owned file disappeared: ${pathname}`, {
+        cause,
+    });
+}
+function cleanupFailure(originalError, cleanupError) {
+    if (originalError !== undefined) {
+        return new Error(`Atomic file replace failed (${String(originalError)}); cleanup also failed (${String(cleanupError)})`, { cause: originalError });
+    }
+    return cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError));
+}
+async function cleanupOwnedPath(params) {
+    if (!params.identity)
+        return true;
+    try {
+        const current = await params.fsModule.lstat(params.pathname, { bigint: true });
+        if (current.isSymbolicLink() ||
+            !current.isFile() ||
+            current.nlink !== 1n ||
+            !sameFileIdentityForCleanup(current, params.identity)) {
+            return true;
+        }
+        await params.fsModule.unlink(params.pathname);
+        return true;
+    }
+    catch (cleanupError) {
+        if (cleanupError.code === "ENOENT")
+            return true;
+        if (params.throwOnCleanupError) {
+            throw cleanupFailure(params.originalError, cleanupError);
+        }
+        return false;
+    }
+}
+function cleanupOwnedPathSync(params) {
+    if (!params.identity)
+        return true;
+    try {
+        const current = params.fsModule.lstatSync(params.pathname, { bigint: true });
+        if (current.isSymbolicLink() ||
+            !current.isFile() ||
+            current.nlink !== 1n ||
+            !sameFileIdentityForCleanup(current, params.identity)) {
+            return true;
+        }
+        params.fsModule.unlinkSync(params.pathname);
+        return true;
+    }
+    catch (cleanupError) {
+        if (cleanupError.code === "ENOENT")
+            return true;
+        if (params.throwOnCleanupError) {
+            throw cleanupFailure(params.originalError, cleanupError);
+        }
+        return false;
+    }
+}
+export class AsyncAtomicTempOwner {
+    pathname;
+    #handle;
+    #identity;
+    #exists = false;
+    #unregister;
+    constructor(pathname) {
+        this.pathname = pathname;
+        this.#unregister = registerTempPathForExit(pathname, { singleLinkFile: true });
+    }
+    start() {
+        this.#exists = true;
+    }
+    onIdentity = (identity) => {
+        this.#identity = identity;
+        this.#unregister.setIdentity(identity);
+    };
+    adopt(temp) {
+        this.#handle = temp.handle;
+        this.onIdentity(temp.identity);
+    }
+    get identity() {
+        if (!this.#identity)
+            throw new Error("Atomic temp owner has no identity");
+        return this.#identity;
+    }
+    async assertCurrent(fsModule, pathname = this.pathname) {
+        const opened = await inspectFileIdentity(async () => {
+            const stat = await this.#handle.stat({ bigint: true });
+            assertOwnedFile(stat, pathname, false);
+            return stat;
+        }, this.identity);
+        try {
+            await inspectFileIdentity(async () => {
+                const stat = await fsModule.lstat(pathname, { bigint: true });
+                assertOwnedFile(stat, pathname, true);
+                return stat;
+            }, opened);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                throw missingOwnedFile(pathname, error);
+            }
+            throw error;
+        }
+    }
+    async assertPublished(fsModule, pathname, expectedHash) {
+        try {
+            await this.assertCurrent(fsModule, pathname);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof FsSafeError) || error.code !== "path-mismatch" || !expectedHash) {
+                throw error;
+            }
+        }
+        let published;
+        try {
+            try {
+                published = await fsModule.open(pathname, PUBLISHED_READ_FLAGS);
+            }
+            catch (error) {
+                if (error.code === "ELOOP") {
+                    throw new FsSafeError("symlink", `Atomic replace published file became a symlink: ${pathname}`, {
+                        cause: error,
+                    });
+                }
+                throw error;
+            }
+            const identity = await inspectFileIdentity(async () => {
+                const stat = await published.stat({ bigint: true });
+                assertOwnedFile(stat, pathname, false);
+                return stat;
+            });
+            await inspectFileIdentity(async () => {
+                const stat = await fsModule.lstat(pathname, { bigint: true });
+                assertOwnedFile(stat, pathname, true);
+                return stat;
+            }, identity);
+            if (sha256Hex(await published.readFile()) !== expectedHash) {
+                throw new FsSafeError("path-mismatch", `Atomic replace published content changed: ${pathname}`);
+            }
+            await this.#handle?.close();
+            this.#handle = published;
+            this.#identity = identity;
+            published = undefined;
+        }
+        finally {
+            await published?.close().catch(() => undefined);
+        }
+    }
+    markRenamed() {
+        this.#exists = false;
+        this.#unregister();
+    }
+    async finish(params) {
+        let deferredError;
+        let cleanupComplete = !this.#exists;
+        if (this.#exists) {
+            try {
+                cleanupComplete = await cleanupOwnedPath({
+                    fsModule: params.fsModule,
+                    pathname: this.pathname,
+                    identity: this.#identity,
+                    originalError: params.originalError,
+                    throwOnCleanupError: params.throwOnCleanupError,
+                });
+            }
+            catch (error) {
+                deferredError = error;
+            }
+        }
+        if (cleanupComplete)
+            this.#unregister();
+        try {
+            await this.#handle?.close();
+        }
+        catch (closeError) {
+            deferredError = deferredError
+                ? new AggregateError([deferredError, closeError], "Atomic temp cleanup and close failed")
+                : params.originalError !== undefined
+                    ? new AggregateError([params.originalError, closeError], "Atomic file replace and close failed")
+                    : closeError;
+        }
+        if (deferredError)
+            throw deferredError;
+    }
+}
+export class SyncAtomicTempOwner {
+    pathname;
+    #fd;
+    #identity;
+    #exists = false;
+    #unregister;
+    constructor(pathname) {
+        this.pathname = pathname;
+        this.#unregister = registerTempPathForExit(pathname, { singleLinkFile: true });
+    }
+    start() {
+        this.#exists = true;
+    }
+    onIdentity = (identity) => {
+        this.#identity = identity;
+        this.#unregister.setIdentity(identity);
+    };
+    adopt(temp) {
+        this.#fd = temp.fd;
+        this.onIdentity(temp.identity);
+    }
+    get identity() {
+        if (!this.#identity)
+            throw new Error("Atomic temp owner has no identity");
+        return this.#identity;
+    }
+    assertCurrent(fsModule, pathname = this.pathname) {
+        const opened = inspectFileIdentitySync(() => {
+            const stat = fsModule.fstatSync(this.#fd, { bigint: true });
+            assertOwnedFile(stat, pathname, false);
+            return stat;
+        }, this.identity);
+        try {
+            inspectFileIdentitySync(() => {
+                const stat = fsModule.lstatSync(pathname, { bigint: true });
+                assertOwnedFile(stat, pathname, true);
+                return stat;
+            }, opened);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                throw missingOwnedFile(pathname, error);
+            }
+            throw error;
+        }
+    }
+    assertPublished(fsModule, pathname, expectedHash) {
+        try {
+            this.assertCurrent(fsModule, pathname);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof FsSafeError) || error.code !== "path-mismatch" || !expectedHash) {
+                throw error;
+            }
+        }
+        let publishedFd;
+        try {
+            try {
+                publishedFd = fsModule.openSync(pathname, PUBLISHED_READ_FLAGS);
+            }
+            catch (error) {
+                if (error.code === "ELOOP") {
+                    throw new FsSafeError("symlink", `Atomic replace published file became a symlink: ${pathname}`, {
+                        cause: error,
+                    });
+                }
+                throw error;
+            }
+            const identity = inspectFileIdentitySync(() => {
+                const stat = fsModule.fstatSync(publishedFd, { bigint: true });
+                assertOwnedFile(stat, pathname, false);
+                return stat;
+            });
+            inspectFileIdentitySync(() => {
+                const stat = fsModule.lstatSync(pathname, { bigint: true });
+                assertOwnedFile(stat, pathname, true);
+                return stat;
+            }, identity);
+            if (sha256Hex(fsModule.readFileSync(publishedFd)) !== expectedHash) {
+                throw new FsSafeError("path-mismatch", `Atomic replace published content changed: ${pathname}`);
+            }
+            fsModule.closeSync(this.#fd);
+            this.#fd = publishedFd;
+            this.#identity = identity;
+            publishedFd = undefined;
+        }
+        finally {
+            if (publishedFd !== undefined) {
+                try {
+                    fsModule.closeSync(publishedFd);
+                }
+                catch {
+                    // Best-effort close after a rejected content verification.
+                }
+            }
+        }
+    }
+    markRenamed() {
+        this.#exists = false;
+        this.#unregister();
+    }
+    finish(params) {
+        let deferredError;
+        let cleanupComplete = !this.#exists;
+        if (this.#exists) {
+            try {
+                cleanupComplete = cleanupOwnedPathSync({
+                    fsModule: params.fsModule,
+                    pathname: this.pathname,
+                    identity: this.#identity,
+                    originalError: params.originalError,
+                    throwOnCleanupError: params.throwOnCleanupError,
+                });
+            }
+            catch (error) {
+                deferredError = error;
+            }
+        }
+        if (cleanupComplete)
+            this.#unregister();
+        if (this.#fd !== undefined) {
+            try {
+                params.fsModule.closeSync(this.#fd);
+            }
+            catch (closeError) {
+                deferredError = deferredError
+                    ? new AggregateError([deferredError, closeError], "Atomic temp cleanup and close failed")
+                    : params.originalError !== undefined
+                        ? new AggregateError([params.originalError, closeError], "Atomic file replace and close failed")
+                        : closeError;
+            }
+        }
+        if (deferredError)
+            throw deferredError;
+    }
+}

package/dist/replace-file.d.ts

@@ -1,6 +1,7 @@
 import syncFs from "node:fs";
 import fs from "node:fs/promises";
 import { type ReplaceFileAtomicRestoreCleanup, type ReplaceFileAtomicRestoreFailureDetails, type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy } from "./replace-file-copy-fallback.js";
+import { type RenameIdentityPolicy } from "./replace-file-rename-policy.js";
 export type ReplaceFileAtomicFileSystem = {
     promises: Pick<typeof fs, "mkdir" | "writeFile" | "rename" | "copyFile" | "unlink" | "rm" | "open" | "stat" | "lstat"> & {
         /** @deprecated Accepted for adapter compatibility but never called. */
@@ -12,7 +13,7 @@ export type ReplaceFileAtomicSyncFileSystem = Pick<typeof syncFs, "mkdirSync" |
     chmodSync?: typeof syncFs.chmodSync;
     fchmodSync?: typeof syncFs.fchmodSync;
 };
-export type { ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, };
+export type { RenameIdentityPolicy, ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, };
 type ReplaceFileAtomicBaseOptions = {
     filePath: string;
     content: string | Uint8Array;
@@ -26,12 +27,15 @@ type ReplaceFileAtomicBaseOptions = {
     copyFallbackRestore?: ReplaceFileCopyFallbackRestorePolicy;
     maxRestoreBytes?: number;
     destinationHardlinks?: ReplaceFileDestinationHardlinkPolicy;
+    /** Strict by default; locked content verification is an explicit FUSE compatibility policy. */
+    renameIdentity?: RenameIdentityPolicy;
     syncTempFile?: boolean;
     syncParentDir?: boolean;
     throwOnCleanupError?: boolean;
 };
 export type ReplaceFileAtomicOptions = ReplaceFileAtomicBaseOptions & {
     fileSystem?: ReplaceFileAtomicFileSystem;
+    /** Runs while the exact staged file is retained; replacing or hardlinking it is rejected. */
     beforeRename?: (params: {
         filePath: string;
         tempPath: string;
@@ -39,6 +43,7 @@ export type ReplaceFileAtomicOptions = ReplaceFileAtomicBaseOptions & {
 };
 export type ReplaceFileAtomicSyncOptions = ReplaceFileAtomicBaseOptions & {
     fileSystem?: ReplaceFileAtomicSyncFileSystem;
+    /** Runs while the exact staged file is retained; replacing or hardlinking it is rejected. */
     beforeRename?: (params: {
         filePath: string;
         tempPath: string;

package/dist/replace-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file.d.ts","sourceRoot":"","sources":["../src/replace-file.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAKL,KAAK,+BAA+B,EACpC,KAAK,sCAAsC,EAC3C,KAAK,oCAAoC,EACzC,KAAK,oCAAoC,EAC1C,MAAM,iCAAiC,CAAC;AAazC,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,IAAI,CACZ,OAAO,EAAE,EACP,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,CACV,GAAG;QACF,uEAAuE;QACvE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,OAAO,MAAM,EACX,WAAW,GACX,cAAc,GACd,eAAe,GACf,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,GACV,WAAW,GACX,eAAe,GACf,UAAU,GACV,WAAW,CACd,GAAG;IACF,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IACpC,UAAU,CAAC,EAAE,OAAO,MAAM,CAAC,UAAU,CAAC;CACvC,CAAC;AAEF,YAAY,EACV,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,oCAAoC,GACrC,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE,UAAU,CAAC,EAAE,2BAA2B,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,GAAG;IACxE,UAAU,CAAC,EAAE,+BAA+B,CAAC;IAC7C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAAC;CACpC,CAAC;AAgNF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAOlC;AAkED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,uBAAuB,CAoFzB"}
+{"version":3,"file":"replace-file.d.ts","sourceRoot":"","sources":["../src/replace-file.ts"],"names":[],"mappings":"AACA,OAAO,MAAwC,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAKL,KAAK,+BAA+B,EACpC,KAAK,sCAAsC,EAC3C,KAAK,oCAAoC,EACzC,KAAK,oCAAoC,EAC1C,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,iCAAiC,CAAC;AAMzC,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,IAAI,CACZ,OAAO,EAAE,EACP,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,CACV,GAAG;QACF,uEAAuE;QACvE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,OAAO,MAAM,EACX,WAAW,GACX,cAAc,GACd,eAAe,GACf,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,GACV,WAAW,GACX,eAAe,GACf,UAAU,GACV,WAAW,CACd,GAAG;IACF,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IACpC,UAAU,CAAC,EAAE,OAAO,MAAM,CAAC,UAAU,CAAC;CACvC,CAAC;AAEF,YAAY,EACV,oBAAoB,EACpB,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,oCAAoC,GACrC,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,+FAA+F;IAC/F,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE,UAAU,CAAC,EAAE,2BAA2B,CAAC;IACzC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,GAAG;IACxE,UAAU,CAAC,EAAE,+BAA+B,CAAC;IAC7C,6FAA6F;IAC7F,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAAC;CACpC,CAAC;AAkMF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAgBlC;AAuED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,uBAAuB,CAczB"}

package/dist/replace-file.js

@@ -1,11 +1,12 @@
 import { randomUUID } from "node:crypto";
-import syncFs from "node:fs";
+import syncFs, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { assertDestinationHardlinkPolicy, assertDestinationHardlinkPolicySync, copyFallbackReplace, copyFallbackReplaceSync, } from "./replace-file-copy-fallback.js";
 import { applyDirectoryMode, applyDirectoryModeSync, writeTempFile, writeTempFileSync, } from "./replace-file-descriptor.js";
+import { atomicExpectedContentHash, validateRenameIdentity, withAtomicRenameIdentityLock, withAtomicRenameIdentityLockSync, } from "./replace-file-rename-policy.js";
+import { AsyncAtomicTempOwner, SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
 import { assertSafePathPrefix } from "./safe-path-segment.js";
-import { registerTempPathForExit } from "./temp-cleanup.js";
 import { sleep, sleepSync } from "./timing.js";
 import { serializePathWrite } from "./write-queue.js";
 function isRetryableRenameError(error) {
@@ -17,6 +18,7 @@ function isPermissionRenameError(error) {
 }
 async function renameWithRetry(params) {
     for (let attempt = 0; attempt <= params.maxRetries; attempt++) {
+        await params.assertSourceCurrent();
         try {
             await params.fsModule.rename(params.src, params.dest);
             return { method: "rename" };
@@ -34,6 +36,7 @@ async function renameWithRetry(params) {
                     destinationHardlinks: params.destinationHardlinks,
                     restore: params.copyFallbackRestore,
                     maxRestoreBytes: params.maxRestoreBytes,
+                    expectedSourceIdentity: params.sourceIdentity,
                     sync: params.syncFallback,
                 });
                 return { method: "copy-fallback" };
@@ -45,6 +48,7 @@ async function renameWithRetry(params) {
 }
 function renameWithRetrySync(params) {
     for (let attempt = 0; attempt <= params.maxRetries; attempt++) {
+        params.assertSourceCurrent();
         try {
             params.fsModule.renameSync(params.src, params.dest);
             return { method: "rename" };
@@ -62,6 +66,7 @@ function renameWithRetrySync(params) {
                     destinationHardlinks: params.destinationHardlinks,
                     restore: params.copyFallbackRestore,
                     maxRestoreBytes: params.maxRestoreBytes,
+                    expectedSourceIdentity: params.sourceIdentity,
                     fchmodSync: params.fchmodSync,
                     sync: params.syncFallback,
                 });
@@ -158,26 +163,20 @@ function syncDirectoryBestEffortSync(fsModule, dirPath) {
         }
     }
 }
-async function cleanupTempFile(params) {
-    const cleanupError = await params.fsModule
-        .rm(params.tempPath, { force: true })
-        .catch((error) => error);
-    if (!cleanupError)
-        return true;
-    if (params.throwOnCleanupError) {
-        if (params.originalError !== undefined) {
-            throw new Error(`Atomic file replace failed (${String(params.originalError)}); cleanup also failed (${String(cleanupError)})`, { cause: params.originalError });
-        }
-        throw cleanupError;
-    }
-    return false;
-}
 export async function replaceFileAtomic(options) {
     const filePath = options.filePath;
     validateReplaceFilePath(filePath);
     validateRestoreOptions(options);
+    validateRenameIdentity(options.renameIdentity);
     return await serializePathWrite(path.resolve(filePath), async () => {
-        return await replaceFileAtomicUnserialized(options);
+        if (options.renameIdentity !== "verify-content-with-lock") {
+            return await replaceFileAtomicUnserialized(options);
+        }
+        await (options.fileSystem?.promises ?? fs).mkdir(path.dirname(filePath), {
+            recursive: true,
+            mode: options.dirMode ?? 0o700,
+        });
+        return await withAtomicRenameIdentityLock(filePath, async () => await replaceFileAtomicUnserialized(options));
     });
 }
 async function replaceFileAtomicUnserialized(options) {
@@ -186,24 +185,27 @@ async function replaceFileAtomicUnserialized(options) {
     const dir = path.dirname(filePath);
     const dirMode = options.dirMode ?? 0o700;
     const mode = await resolveMode(options);
+    const expectedHash = atomicExpectedContentHash(options.renameIdentity, options.content);
     const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
-    const unregisterTempPath = registerTempPathForExit(tempPath);
-    let tempExists = false;
+    const tempOwner = new AsyncAtomicTempOwner(tempPath);
     let originalError;
     try {
         await fsModule.mkdir(dir, { recursive: true, mode: dirMode });
         await applyDirectoryMode({ fsModule, dirPath: dir, mode: dirMode });
-        tempExists = true;
-        unregisterTempPath.setIdentity(await writeTempFile({
+        tempOwner.start();
+        tempOwner.adopt(await writeTempFile({
             fsModule,
             tempPath,
             content: options.content,
             mode,
             sync: options.syncTempFile === true,
+            onIdentity: tempOwner.onIdentity,
         }));
+        await tempOwner.assertCurrent(fsModule);
         if (options.beforeRename) {
             await options.beforeRename({ filePath, tempPath });
         }
+        await tempOwner.assertCurrent(fsModule);
         await assertDestinationHardlinkPolicy(fsModule, filePath, options.destinationHardlinks);
         const result = await renameWithRetry({
             fsModule,
@@ -215,15 +217,23 @@ async function replaceFileAtomicUnserialized(options) {
             copyFallbackRestore: options.copyFallbackRestore ?? "none",
             maxRestoreBytes: options.maxRestoreBytes,
             destinationHardlinks: options.destinationHardlinks,
+            sourceIdentity: tempOwner.identity,
+            assertSourceCurrent: () => tempOwner.assertCurrent(fsModule),
             syncFallback: options.syncTempFile === true,
         });
         if (result.method === "rename") {
-            tempExists = false;
-            unregisterTempPath();
+            tempOwner.markRenamed();
+            await tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        else {
+            await tempOwner.assertCurrent(fsModule);
         }
         if (options.syncParentDir) {
             await syncDirectoryBestEffort(fsModule, dir);
         }
+        if (result.method === "rename") {
+            await tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
         return result;
     }
     catch (error) {
@@ -231,27 +241,34 @@ async function replaceFileAtomicUnserialized(options) {
         throw error;
     }
     finally {
-        let tempRemoved = !tempExists;
-        if (tempExists) {
-            tempRemoved = await cleanupTempFile({
-                fsModule,
-                tempPath,
-                originalError,
-                throwOnCleanupError: options.throwOnCleanupError === true,
-            });
-        }
-        if (tempRemoved)
-            unregisterTempPath();
+        await tempOwner.finish({
+            fsModule,
+            originalError,
+            throwOnCleanupError: options.throwOnCleanupError === true,
+        });
     }
 }
 export function replaceFileAtomicSync(options) {
     const filePath = options.filePath;
     validateReplaceFilePath(filePath);
     validateRestoreOptions(options);
+    validateRenameIdentity(options.renameIdentity);
+    if (options.renameIdentity !== "verify-content-with-lock") {
+        return replaceFileAtomicSyncUnserialized(options);
+    }
+    (options.fileSystem ?? syncFs).mkdirSync(path.dirname(filePath), {
+        recursive: true,
+        mode: options.dirMode ?? 0o700,
+    });
+    return withAtomicRenameIdentityLockSync(filePath, () => replaceFileAtomicSyncUnserialized(options));
+}
+function replaceFileAtomicSyncUnserialized(options) {
+    const filePath = options.filePath;
     const fsModule = options.fileSystem ?? syncFs;
     const dir = path.dirname(filePath);
     const dirMode = options.dirMode ?? 0o700;
     const mode = resolveModeSync(options);
+    const expectedHash = atomicExpectedContentHash(options.renameIdentity, options.content);
     const fchmodSync = options.fileSystem?.fchmodSync ?? (options.fileSystem === undefined ? syncFs.fchmodSync : undefined);
     if (!fchmodSync &&
         (options.mode !== undefined ||
@@ -260,24 +277,26 @@ export function replaceFileAtomicSync(options) {
         throw missingFchmodSyncError();
     }
     const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
-    const unregisterTempPath = registerTempPathForExit(tempPath);
-    let tempExists = false;
+    const tempOwner = new SyncAtomicTempOwner(tempPath);
     let originalError;
     try {
         fsModule.mkdirSync(dir, { recursive: true, mode: dirMode });
         applyDirectoryModeSync({ fsModule, dirPath: dir, mode: dirMode, fchmodSync });
-        tempExists = true;
-        unregisterTempPath.setIdentity(writeTempFileSync({
+        tempOwner.start();
+        tempOwner.adopt(writeTempFileSync({
             fsModule,
             tempPath,
             content: options.content,
             mode,
             fchmodSync,
             sync: options.syncTempFile === true,
+            onIdentity: tempOwner.onIdentity,
         }));
+        tempOwner.assertCurrent(fsModule);
         if (options.beforeRename) {
             options.beforeRename({ filePath, tempPath });
         }
+        tempOwner.assertCurrent(fsModule);
         assertDestinationHardlinkPolicySync(fsModule, filePath, options.destinationHardlinks);
         const result = renameWithRetrySync({
             fsModule,
@@ -289,16 +308,24 @@ export function replaceFileAtomicSync(options) {
             copyFallbackRestore: options.copyFallbackRestore ?? "none",
             maxRestoreBytes: options.maxRestoreBytes,
             destinationHardlinks: options.destinationHardlinks,
+            sourceIdentity: tempOwner.identity,
+            assertSourceCurrent: () => tempOwner.assertCurrent(fsModule),
             fchmodSync,
             syncFallback: options.syncTempFile === true,
         });
         if (result.method === "rename") {
-            tempExists = false;
-            unregisterTempPath();
+            tempOwner.markRenamed();
+            tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        else {
+            tempOwner.assertCurrent(fsModule);
         }
         if (options.syncParentDir) {
             syncDirectoryBestEffortSync(fsModule, dir);
         }
+        if (result.method === "rename") {
+            tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
         return result;
     }
     catch (error) {
@@ -306,23 +333,10 @@ export function replaceFileAtomicSync(options) {
         throw error;
     }
     finally {
-        let tempRemoved = !tempExists;
-        if (tempExists) {
-            try {
-                fsModule.rmSync(tempPath, { force: true });
-                tempRemoved = true;
-            }
-            catch (cleanupError) {
-                if (options.throwOnCleanupError) {
-                    if (originalError !== undefined) {
-                        throw new Error(`Atomic file replace failed (${String(originalError)}); cleanup also failed (${String(cleanupError)})`, { cause: originalError });
-                    }
-                    throw cleanupError;
-                }
-                // The temp file is best-effort cleanup after write failure.
-            }
-        }
-        if (tempRemoved)
-            unregisterTempPath();
+        tempOwner.finish({
+            fsModule,
+            originalError,
+            throwOnCleanupError: options.throwOnCleanupError === true,
+        });
     }
 }